openmausbot 0.1.93 → 0.1.95

package/dist-server/server/config.js

@@ -1,7 +1,7 @@
 // Config + data dirs. One file, ~/.openmausbot/config.json, env fallbacks:
 //   { "xai": {"key":"xai-…"}, "composio": {"apiKey":"ak_…"}, "box": {"token":"…"},
 //     "instances": { "<instanceId>": {"driver":"grok", …} } }
-import { readFileSync, mkdirSync, existsSync, renameSync } from "node:fs";
+import { readFileSync, mkdirSync, existsSync, renameSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
@@ -14,7 +14,6 @@ import { PROVIDER_ICON_PRESETS, providerIconError } from "../shared/provider-ico
 import { isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
 import { parseJson, schemaIssue } from "./schema.js";
 import { CLOUD_SEAT_IDLE_STOP_MS } from "./cloud-overflow.js";
-import { cloudHomeConfigured } from "./cloud-home.js";
 const optionalText = z.string().optional();
 const SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -304,6 +303,10 @@ const featureConfigSchema = z.object({
      * consent card or a configured allowlist — never a silent Auto default.
      * Off until baked; see cloudOverflowEnabled for how to enable it by hand. */
     cloudOverflow: z.boolean().optional(),
+    /** Opt-in shared skills library: one store at the data dir that bots
+     * read by assignment instead of per-workspace copies. Off until
+     * explicitly enabled — see skillsLibraryEnabled. */
+    skillsLibrary: z.boolean().optional(),
 });
 /** First-run progress. Kept in the workspace config rather than a browser so
  * it survives cleared site data and is shared by every paired client. Hint
@@ -474,6 +477,15 @@ const appConfigSchema = z.object({
             .optional(),
         jobs: z.object({ roomRouting: z.boolean().optional() }).optional(),
     }).optional(),
+    /** Live calls: an OpenAI project key for GPT-Live, kept apart from every
+     * other OpenAI credential so a Live call never bills an image or engine key
+     * the user did not hand to it. `voice` is a GPT-Live built-in voice name. */
+    live: z.object({
+        key: optionalText,
+        voice: z.string().trim().max(40).regex(/^[a-z]*$/, "a Live voice is a lowercase built-in voice name").optional(),
+        readTypedReplies: z.boolean().optional(),
+        idleMinutes: z.number().int().min(1).max(60).optional(),
+    }).optional(),
     /** Avatar provider credentials stay separate; choosing a router never reuses a cloud key. */
     imageGen: z.object({
         provider: z.enum(["openai", "xai", "custom"]).optional(),
@@ -630,6 +642,17 @@ export function browserEngineAttachCdpUrl(cfg) {
 export function roomTurnTimeoutMinutes(cfg) {
     return cfg.rooms?.turnTimeoutMinutes ?? DEFAULT_ROOM_TURN_TIMEOUT_MINUTES;
 }
+export const LIVE_IDLE_MINUTES_DEFAULT = 5;
+/** Non-secret Live settings. The key only shows up as `configured`. */
+export function liveSettingsFor(cfg) {
+    const minutes = cfg.live?.idleMinutes;
+    return {
+        configured: Boolean(cfg.live?.key?.trim()),
+        voice: cfg.live?.voice ?? "",
+        readTypedReplies: cfg.live?.readTypedReplies ?? true,
+        idleMinutes: Number.isInteger(minutes) && minutes >= 1 && minutes <= 60 ? minutes : LIVE_IDLE_MINUTES_DEFAULT,
+    };
+}
 /** Room handoff tree budgets in milliseconds. The tree lifetime pauses
  * while a node is actively executing; the hard cap is the maximum stall
  * window, measured wall-clock from the tree's last durable progress. Read
@@ -692,14 +715,11 @@ export function showToolCallsEnabled(cfg) {
 export function routinesInConversationEnabled(cfg) {
     return cfg.features?.routinesInConversation === true;
 }
-/** Workspace-level gate for the experimental built-in browser. A bot's own
- * switch sits under it, so either can withhold the browser. Off until the
- * desktop's first-run welcome turns it on. A Cloud home (cloud-home.ts)
- * skips that welcome, ships the browser in its image and has no other screen
- * of its own, so there it is on unless the person switched it off. */
-export function builtInBrowserEnabled(cfg, env = process.env) {
-    const chosen = cfg.features?.browser;
-    return chosen === undefined ? cloudHomeConfigured(env) : chosen === true;
+/** Workspace-level gate for the built-in browser. A bot's own switch sits
+ * under it, so either can withhold the browser. On unless the person switched
+ * it off: an explicit `false` (Settings, or a bot's computer panel) is kept. */
+export function builtInBrowserEnabled(cfg, _env = process.env) {
+    return cfg.features?.browser !== false;
 }
 /** Opt-in computer sharing: the routes, the agent tools, the advertised
  * capability and the desktop connector. Off unless an explicit `true` turns
@@ -766,6 +786,14 @@ export function cloudOverflowIdleStopMs(cfg) {
 export function cloudOverflowAllowlistedThreads(cfg) {
     return new Set(cfg.cloudOverflow?.allowlistedThreads ?? []);
 }
+/** Opt-in shared skills library (skills lane S1): one store at the data dir
+ * that bots reference by assignment instead of per-workspace copies. Off
+ * unless enabled by hand in ~/.openmausbot/config.json
+ * (`{"features": {"skillsLibrary": true}}`); while off, every skills
+ * surface keeps today's byte-identical per-bot behavior. */
+export function skillsLibraryEnabled(cfg) {
+    return cfg.features?.skillsLibrary === true;
+}
 /** Config sections no provider driver reads. A write that touches only
  * these must not rebuild the fleet: rebuilding disposes every engine child
  * and reloads it, seconds of work that would also interrupt in-flight
@@ -778,6 +806,7 @@ export const FLEET_NEUTRAL_KEYS = new Set([
     // no engine reads it: the harness asks it before a turn starts
     "decider",
     "imageGen",
+    "live",
     "vps",
     "rooms",
     "threads",
@@ -937,6 +966,9 @@ export function loadConfig() {
     cfg.decider = { ...cfg.decider };
     if (process.env.OMB_JEV_API_KEY !== undefined)
         cfg.decider.key = process.env.OMB_JEV_API_KEY;
+    cfg.live = { ...cfg.live };
+    if (process.env.OMB_OPENAI_LIVE_KEY !== undefined)
+        cfg.live.key = process.env.OMB_OPENAI_LIVE_KEY;
     cfg.imageGen = { ...cfg.imageGen };
     if (process.env.OMB_OPENAI_IMAGE_KEY !== undefined)
         cfg.imageGen.key = process.env.OMB_OPENAI_IMAGE_KEY;
@@ -954,6 +986,34 @@ export function loadConfig() {
     }
     return cfg;
 }
+/** `derive(loadConfig())`, worked out again only when config.json changes:
+ * a new file (every save renames one into place), a new size, a new
+ * modification time, or new permissions or owner. For values read on every
+ * request or stream frame, where parsing the file each time costs more than
+ * the work itself. A file that is missing, saved in the last two seconds, or
+ * that loadConfig() could not use (unreadable, a failed read, invalid JSON)
+ * is read on every call: a second write inside one clock tick is never
+ * missed, and a file that is fixed is used again on the next call. */
+export function cacheUntilConfigChanges(derive) {
+    let cached = null;
+    return () => {
+        let stamp = null;
+        try {
+            const file = statSync(join(DATA_DIR, "config.json"), { bigint: true });
+            if (Date.now() - Number(file.mtimeMs) >= 2_000)
+                stamp = `${file.ino}:${file.size}:${file.mtimeNs}:${file.ctimeNs}`;
+        }
+        catch {
+            // Missing or out of reach: read it the way loadConfig() always has.
+        }
+        if (stamp !== null && cached?.stamp === stamp)
+            return cached.value;
+        const value = derive(loadConfig());
+        // A warning means loadConfig() ignored the file and ran on defaults.
+        cached = stamp === null || lastIgnoredConfigWarning !== "" ? null : { stamp, value };
+        return value;
+    };
+}
 /** After saveConfig() writes a credential, the running process's env must
  * follow the newest value — loadConfig() prefers env, so the secret injected
  * at boot would otherwise shadow the save until relaunch: the UI would show
@@ -978,6 +1038,7 @@ export function syncCredentialEnv(patch) {
         [patch.decider?.key, "OMB_JEV_API_KEY"],
         [patch.imageGen?.key, "OMB_OPENAI_IMAGE_KEY"],
         [patch.imageGen?.customApiKey, "OMB_CUSTOM_IMAGE_KEY"],
+        [patch.live?.key, "OMB_OPENAI_LIVE_KEY"],
     ];
     for (const [value, name] of secrets) {
         if (value === undefined)
@@ -1028,6 +1089,7 @@ export const WORKSPACE_CREDENTIAL_ENV = [
     "OMB_JEV_API_KEY",
     "OMB_OPENAI_IMAGE_KEY",
     "OMB_CUSTOM_IMAGE_KEY",
+    "OMB_OPENAI_LIVE_KEY",
     "COMPOSIO_API_KEY",
     "OMB_COMPOSIO_BROKER_TOKEN",
     // Cloud Pro's included Boat, voice and decision relay tokens
@@ -1118,7 +1180,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;

package/dist-server/server/container-computer.js

@@ -46,9 +46,7 @@ const RUNTIMES = ["docker", "podman", "container"];
 const INTERNAL_VIEWER_PORT = 6901;
 const HOST_VIEWER_PORT = 6080;
 const MEMORY_BYTES = 4 * 1024 * 1024 * 1024;
-const NANO_CPUS = 2_000_000_000;
 const PIDS_LIMIT = 512;
-const SHM_BYTES = 512 * 1024 * 1024;
 export const SHARED_LOCAL_VM_TARGET = {
     key: "shared",
     containerName: CONTAINER,
@@ -604,14 +602,10 @@ function appleWorkspaceMountIsSafe(mounts, platform, expectedWorkspace) {
         mounts[0]?.destination === VM_WORKSPACE_GUEST &&
         !options.some((option) => option === "ro" || option === "readonly"));
 }
-/** One hardening contract for both managed containers (Local VM here, the
- * BYO-VPS backend in vps-computer.ts): exact resource limits, no privilege,
- * no host namespaces or devices, no disabled security profiles. The only
- * runtime-specific capability exception is Podman's Firefox sandbox chroot.
- * Callers also differ on restart policy — the VPS
- * container must survive a reboot nobody is watching ("unless-stopped"),
- * while Local VM starts remain controlled by OMB's idle policy and turn
- * lifecycle rather than a daemon restart policy. */
+/** Shared isolation contract for Local VM and BYO-VPS containers. Resource
+ * budgets are creation defaults, not an isolation requirement. Podman alone
+ * needs chroot for Firefox's sandbox. Local VM starts stay controlled by
+ * OMB's idle policy; VPS restart policy belongs to the server operator. */
 export function dockerSecurityIsHardened(config, options = {}) {
     if (!config)
         return false;
@@ -621,26 +615,20 @@ export function dockerSecurityIsHardened(config, options = {}) {
         .sort();
     const unsafeSecurityOption = (config.SecurityOpt ?? []).some((option) => /(?:^|=)(?:unconfined|disable)$/i.test(option));
     const restartPolicy = config.RestartPolicy?.Name;
-    const restartPolicyOk = options.restartPolicy === "unless-stopped"
+    const restartPolicyOk = options.restartPolicy === "any" || (options.restartPolicy === "unless-stopped"
         ? restartPolicy === "unless-stopped"
-        : restartPolicy === undefined || restartPolicy === "" || restartPolicy === "no";
-    return (config.Memory === MEMORY_BYTES &&
-        (config.MemorySwap ?? 0) === MEMORY_BYTES &&
-        (config.NanoCpus ?? 0) === NANO_CPUS &&
-        config.PidsLimit === PIDS_LIMIT &&
-        capDrop.includes("all") &&
+        : restartPolicy === undefined || restartPolicy === "" || restartPolicy === "no");
+    return (capDrop.includes("all") &&
         capAdd.join(",") === (options.podmanBrowserSandbox ? "setgid,setuid,sys_chroot" : "setgid,setuid") &&
         config.Privileged === false &&
         !config.PidMode &&
         config.IpcMode === "private" &&
         !config.UTSMode &&
-        config.ShmSize === SHM_BYTES &&
         (!config.Devices || config.Devices.length === 0) &&
         (!config.DeviceRequests || config.DeviceRequests.length === 0) &&
         !unsafeSecurityOption &&
         !config.UsernsMode &&
         config.CgroupnsMode === "private" &&
-        config.OomKillDisable !== true &&
         config.AutoRemove !== true &&
         restartPolicyOk);
 }

package/dist-server/server/contracts.js

@@ -49,6 +49,15 @@ export function qualifiedModelLabel(id, qualifier, options = {}) {
         return id;
     return `${id}${decorate(qualifier)}`;
 }
+/** True when this driver's turn can run against a cloud computer — natively
+ * (remoteAgent) or through its computer tools (computerMcp), where the cloud
+ * computer is one more stdio server. The one rule for Hosted desktop: every
+ * cloud attach path refuses an engine without it before anything is
+ * provisioned (cloudPlaceDriverError). Derived, so no driver can declare it
+ * out of step with the two fields it reads. */
+export function usesCloudComputer(capabilities) {
+    return capabilities.remoteAgent === true || capabilities.computerMcp === true;
+}
 let eventCounter = 0;
 export const newEventId = () => `ev-${Date.now().toString(36)}-${(eventCounter++).toString(36)}`;
 export const newId = () => crypto.randomUUID();

package/dist-server/server/control-client.js

@@ -90,16 +90,10 @@ export function createControlClient(options) {
         },
     };
 }
-/** The one sentence every refused action gets. Deliberately does not vary
- * per tool: the model needs the same three facts every time — nothing
- * happened, don't retry blindly, and how to wait properly. */
-export const CONTROL_REFUSAL = "A person has taken control of this computer, so this call was NOT performed. " +
-    "Do not retry it — the screen is changing under their hands. " +
-    "Call computer_request_help (no reason needed) to wait for them to finish, " +
-    "then take a fresh screenshot before your next action.";
-/** The bridge-gated computers (Local VM, VPS) speak Cua Driver's own tool
- * surface, which has no wait tool to point at — so the guidance is to
- * pause, not to call anything. */
+/** The one sentence every refused computer action gets, on every computer.
+ * Deliberately does not vary per tool: the model needs the same three facts
+ * every time — nothing happened, don't retry blindly, and wait for the
+ * person. */
 export const CONTROL_REFUSAL_PLAIN = "A person has taken control of this computer, so this call was NOT performed. " +
     "Do not retry it — the screen is changing under their hands. " +
     "Pause this task, tell the person you are waiting for them to hand control back, " +

package/dist-server/server/decision-log.js

@@ -65,9 +65,10 @@ export function decisionRetentionDays(configured, env = process.env) {
 }
 const actorScope = new AsyncLocalStorage();
 /** Run `work` as a person's card answer: every `source: "user"` row it
- * writes names `actor`, without each resolver having to thread it through. */
-export function withDecisionActor(actor, work) {
-    return actorScope.run(actor, work);
+ * writes names `actor` (and `via`, for an answer spoken on a Live call),
+ * without each resolver having to thread it through. */
+export function withDecisionActor(actor, work, via) {
+    return actorScope.run(via ? { actor, via } : { actor }, work);
 }
 function monthKey(at) {
     return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
@@ -88,10 +89,12 @@ async function writeDecision(dataDir, record) {
  * the fold that calls this is delivering approvals and cards, and a full
  * disk must not turn into denied tools. */
 export function appendDecision(dataDir, row) {
-    const actor = row.actor ?? (row.source === "user" ? actorScope.getStore() : undefined);
+    const scope = row.source === "user" ? actorScope.getStore() : undefined;
+    const actor = row.actor ?? scope?.actor;
+    const via = row.via ?? scope?.via;
     // Redact now, not when the queue drains: the row is what was true at the
     // moment of the decision.
-    const record = redactSecrets({ at: new Date().toISOString(), ...row, ...(actor ? { actor } : {}) });
+    const record = redactSecrets({ at: new Date().toISOString(), ...row, ...(actor ? { actor } : {}), ...(via ? { via } : {}) });
     const previous = writeQueues.get(dataDir) ?? Promise.resolve();
     // Serialize appends (and the occasional prune) per directory, so two
     // simultaneous approvals keep their decision order.
@@ -258,7 +261,7 @@ export function decisionsCsv(rows) {
             row.summary ?? "",
             row.rule ?? "",
             row.unattended ? "yes" : "",
-            actorLabel(row.actor),
+            row.via === "call" ? `${actorLabel(row.actor)} (by voice)` : actorLabel(row.actor),
             row.threadId,
             row.requestId ?? "",
         ].map(csvCell).join(","));

package/dist-server/server/delegations.js

@@ -192,6 +192,8 @@ export function _loadPending() {
                 if (typeof item.targetThreadId === "string" && item.targetThreadId) {
                     loaded.targetThreadId = item.targetThreadId;
                 }
+                if (item.oneWay === true)
+                    loaded.oneWay = true;
                 return [loaded];
             });
             if (items.length)
@@ -268,7 +270,7 @@ const MAX_QUEUED_PER_THREAD = 6;
 export function queueDelegation(bus, from, item, maxDepth, sourceThreadId = from.threadId) {
     if (item.toBotId === from.id)
         return { result: "self" };
-    if (item.depth >= maxDepth)
+    if (!item.oneWay && item.depth >= maxDepth)
         return { result: "too_deep" };
     const target = bus.store.bot(item.toBotId);
     if (!target)
@@ -347,6 +349,11 @@ onSettled) {
             const from = bus.store.botByThread(threadId) ??
                 bus.store.bot(item.sourceBotId);
             if (!from) {
+                appendDeliveryMessage(bus, threadId, item, {
+                    role: "bot",
+                    kind: "activity",
+                    tool: { name: "Send failed — the sending bot no longer exists", ok: false },
+                });
                 recordDelegationReceipt({
                     id: item.id,
                     sourceThreadId: threadId,
@@ -373,7 +380,7 @@ onSettled) {
                     result: why.slice(0, 200),
                 });
                 try {
-                    bus.store.appendMessage(threadId, {
+                    appendDeliveryMessage(bus, threadId, item, {
                         role: "bot",
                         kind: "activity",
                         tool: { name: `error: delegation failed — ${why.slice(0, 120)}`, ok: false },
@@ -393,7 +400,7 @@ onSettled) {
                 if (outcome === "settled" && stillQueued) {
                     const receipt = findDelegationReceipt(item.id);
                     try {
-                        if (receipt)
+                        if (receipt && !item.oneWay)
                             onSettled?.(receipt);
                     }
                     catch (error) {
@@ -428,6 +435,15 @@ function acknowledgeDelegation(threadId, itemId) {
         pendingDelegations.delete(threadId);
     savePending();
 }
+function appendDeliveryMessage(bus, sourceThreadId, item, message) {
+    const threadId = item.oneWay && item.targetThreadId && bus.store.taskByThread(item.toBotId, item.targetThreadId)
+        ? item.targetThreadId : sourceThreadId;
+    // A failed independent send needs a visible receipt, not a source wake.
+    // Never recreate a deleted conversation just to post that failure.
+    if (item.oneWay && threadId === sourceThreadId && !sourceThreadBelongsToBot(bus.store, item.sourceBotId, sourceThreadId))
+        return;
+    bus.store.appendMessage(threadId, message);
+}
 const isExpired = (item, now) => now - item.queuedAt >= DELEGATION_TTL_MS;
 /** Past the busy-hold cap — the tighter bound that fires while its target is
  * still busy, long before the 24-hour window. */
@@ -457,9 +473,9 @@ function expireDelegation(bus, sourceThreadId, item, ownerId) {
         status: "expired",
         result: busyHold ? `@${name} was still busy after ${busyHoldCapText()}` : `@${name} was not free to take this for 24 hours`,
     });
-    if (!sourceThreadBelongsToBot(bus.store, ownerId, sourceThreadId))
+    if (!item.oneWay && !sourceThreadBelongsToBot(bus.store, ownerId, sourceThreadId))
         return;
-    bus.store.appendMessage(sourceThreadId, {
+    appendDeliveryMessage(bus, sourceThreadId, item, {
         role: "bot",
         kind: "activity",
         tool: {
@@ -511,15 +527,16 @@ export function expireStaleDelegations(bus, now, onSettled) {
             expireDelegation(bus, threadId, item, ownerId ?? item.sourceBotId);
             const receipt = findDelegationReceipt(item.id);
             if (receipt)
-                expired.push(receipt);
+                expired.push({ receipt, oneWay: item.oneWay === true });
         }
     }
     if (!expired.length)
         return 0;
     savePending();
-    for (const receipt of expired) {
+    for (const { receipt, oneWay } of expired) {
         try {
-            onSettled?.(receipt);
+            if (!oneWay)
+                onSettled?.(receipt);
         }
         catch (error) {
             console.error("delegation expired but its source could not be resumed", error);
@@ -533,9 +550,14 @@ export function discardDelegations(bus, threadId) {
     const list = pendingDelegations.get(threadId);
     if (!list?.length)
         return;
-    pendingDelegations.delete(threadId);
+    const kept = list.filter(item => item.oneWay);
+    const dropped = list.filter(item => !item.oneWay);
+    if (kept.length)
+        pendingDelegations.set(threadId, kept);
+    else
+        pendingDelegations.delete(threadId);
     savePending();
-    for (const item of list) {
+    for (const item of dropped) {
         recordDelegationReceipt({
             id: item.id,
             sourceThreadId: threadId,
@@ -545,14 +567,16 @@ export function discardDelegations(bus, threadId) {
             result: "the delegating turn did not finish",
         });
     }
+    if (!dropped.length)
+        return;
     const from = bus.store.botByThread(threadId) ??
-        bus.store.bot(list.find((item) => bus.store.bot(item.sourceBotId))?.sourceBotId ?? list[0].sourceBotId);
+        bus.store.bot(dropped.find((item) => bus.store.bot(item.sourceBotId))?.sourceBotId ?? dropped[0].sourceBotId);
     if (!from)
         return;
     bus.store.appendMessage(threadId, {
         role: "bot",
         kind: "activity",
-        tool: { name: `${list.length} queued delegation${list.length > 1 ? "s" : ""} dropped — the turn did not finish`, ok: false },
+        tool: { name: `${dropped.length} queued delegation${dropped.length > 1 ? "s" : ""} dropped — the turn did not finish`, ok: false },
     });
 }
 async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarget) {
@@ -560,7 +584,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     let target = bus.store.bot(item.toBotId);
     // Retained approval authorizes the message, not a deleted conversation or
     // revoked room membership. Check every retry before writing to its source.
-    if (!sourceThreadBelongsToBot(bus.store, sender.id, sourceThreadId)) {
+    if (!item.oneWay && !sourceThreadBelongsToBot(bus.store, sender.id, sourceThreadId)) {
         recordDelegationReceipt({
             id: item.id,
             sourceThreadId,
@@ -580,7 +604,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
             status: "error",
             result: "no such bot",
         });
-        bus.store.appendMessage(sourceThreadId, {
+        appendDeliveryMessage(bus, sourceThreadId, item, {
             role: "bot",
             kind: "activity",
             tool: { name: `error: delegation to ${item.toBotId} failed — no such bot`, ok: false },
@@ -621,7 +645,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
         // a denial, which otherwise recreates a deleted source transcript.
         const current = bus.store.bot(item.toBotId);
         const currentSender = bus.store.bot(from.id);
-        if (!current || !currentSender || !sourceThreadBelongsToBot(bus.store, currentSender.id, sourceThreadId)) {
+        if (!current || !currentSender || (!item.oneWay && !sourceThreadBelongsToBot(bus.store, currentSender.id, sourceThreadId))) {
             recordDelegationReceipt({
                 id: item.id,
                 sourceThreadId,
@@ -644,7 +668,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
                 approvalOutcome: verdict,
                 result: verdict === "deny" ? "the user denied this handoff" : failure.error,
             });
-            bus.store.appendMessage(sourceThreadId, {
+            appendDeliveryMessage(bus, sourceThreadId, item, {
                 role: "bot",
                 kind: "activity",
                 tool: { name: verdict === "deny" ? `Delegation to @${target.name} denied by user`
@@ -682,8 +706,9 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     // members; otherwise the exchange falls back to the pair DM.
     const originatingGroup = (item.originatingGroupId ? bus.store.group(item.originatingGroupId) : undefined) ??
         (sourceThreadId ? bus.store.groupByThread(sourceThreadId) : undefined);
-    const channel = getOrCreateChannel(bus.store, sender, target, originatingGroup);
-    mirrorExchange(bus, sender, target, item.message, channel, sourceThreadId);
+    const channel = item.oneWay ? undefined : getOrCreateChannel(bus.store, sender, target, originatingGroup);
+    if (channel)
+        mirrorExchange(bus, sender, target, item.message, channel, sourceThreadId);
     const reasonLine = item.reason ? `\n\n[Reason: ${item.reason}]` : "";
     // A fresh thread's first line gets the shared peer-provenance note from
     // the harness (which knows whether the opener was unattended); the
@@ -691,7 +716,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     const prefixed = item.targetThreadId
         ? item.message
         : `[Delegated by @${sender.name}, another bot in this OpenMausBot workspace. Do the work and reply directly.]\n\n${item.message}${reasonLine}`;
-    await runTarget(item.toBotId, prefixed, item.depth + 1, sourceThreadId, channel, item.id, sender.id, item.targetThreadId);
+    await runTarget(item.toBotId, prefixed, item.oneWay ? 0 : item.depth + 1, sourceThreadId, channel, item.id, sender.id, item.targetThreadId, item.oneWay === true);
     return "dispatched";
 }
 /** "Is the target free to take this handoff right now?" Both shapes ask for
@@ -723,7 +748,7 @@ function holdWhileTargetBusy(bus, target, sourceThreadId, item, canTakeTurn = ta
     item.busySince = Date.now();
     if (!item.waitAnnounced) {
         item.waitAnnounced = true;
-        bus.store.appendMessage(sourceThreadId, {
+        appendDeliveryMessage(bus, sourceThreadId, item, {
             role: "bot",
             kind: "activity",
             tool: { name: waitingChipText(bus.store, target, item) },
@@ -757,7 +782,7 @@ function dropIfThreadGone(bus, target, sourceThreadId, item) {
         status: "dropped",
         result: `the thread opened on @${target.name} was deleted before it could start`,
     });
-    bus.store.appendMessage(sourceThreadId, {
+    appendDeliveryMessage(bus, sourceThreadId, item, {
         role: "bot",
         kind: "activity",
         tool: { name: `Thread on @${target.name} canceled — it was deleted before it could start`, ok: false },
@@ -795,7 +820,7 @@ function dropIfUnreachable(bus, sender, target, sourceThreadId, item) {
         status: "dropped",
         result,
     });
-    bus.store.appendMessage(sourceThreadId, {
+    appendDeliveryMessage(bus, sourceThreadId, item, {
         role: "bot",
         kind: "activity",
         tool: { name: `Delegation to @${target.name} canceled — ${reason}`, ok: false },