openmausbot 0.1.95 → 0.1.96

package/dist/assets/swimlanesDiagram-TC7HE7FX-C6bZtBXk.js

@@ -1,8 +0,0 @@
-import{c as r,s as e}from"./flowDiagram-KWPJA3E3-Bdw9DqEl.js";import{_ as a}from"./mermaid.core-C6yU5FSS.js";import"./chunk-5VM5RSS4-BmVYJ0f8.js";import"./chunk-XXDRQBXY-CPqxINpA.js";import"./chunk-WEXAMYUT-C7ZvuguH.js";import"./chunk-GWA4HPMP-DFYSb6J6.js";import"./channel-DS2NbT5x.js";import"./index-X_5ydXIE.js";var o=a(t=>`${e(t)}
-  .swimlane.cluster:not([data-color-id]) rect {
-    stroke: ${t.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,"getStyles"),s=o,u=r({styles:s});export{u as diagram};

package/dist-server/server/claim-idle.js

@@ -1,33 +0,0 @@
-/** Quiet-window policy for releasing a held seat while its turn lives.
- *
- * The policy is deliberately synchronous and clock-injected: like the
- * claim map it serves, expiry is evaluated when a claim is touched
- * (claim, blocker, owns) rather than by a timer, so the server's single
- * thread decides every transition and tests pin time exactly. Slice
- * #1655 reuses this window math for its own idle release; keep this
- * module free of server imports. */
-/** Default quiet window: no screen activity for this long releases the seat. */
-export const COMPUTER_CLAIM_QUIET_MS = 90_000;
-/** Default reclaim window: the previous holder re-claims directly for this long. */
-export const COMPUTER_CLAIM_RECLAIM_MS = 10 * 60_000;
-export class IdleReleasePolicy {
-    quietMs;
-    reclaimMs;
-    constructor(quietMs = COMPUTER_CLAIM_QUIET_MS, reclaimMs = COMPUTER_CLAIM_RECLAIM_MS) {
-        if (!Number.isFinite(quietMs) || quietMs <= 0)
-            throw new Error("Idle release quiet window must be positive");
-        if (!Number.isFinite(reclaimMs) || reclaimMs <= 0)
-            throw new Error("Idle release reclaim window must be positive");
-        this.quietMs = quietMs;
-        this.reclaimMs = reclaimMs;
-    }
-    /** True once the seat has been quiet for the full window. Screen-poller
-     * frames never refresh the activity clock, so they cannot keep a seat. */
-    quietElapsed(lastActivityAt, now) {
-        return now - lastActivityAt >= this.quietMs;
-    }
-    /** True while a released seat's previous holder still re-claims directly. */
-    reclaimLive(releasedAt, now) {
-        return now < releasedAt + this.reclaimMs;
-    }
-}

package/dist-server/server/cloud-overflow.js

@@ -1,167 +0,0 @@
-/** Consent, cost, and idle-stop policy for overflowing a local computer
- * wait onto a per-second-billed cloud seat (#1655).
- *
- * Like server/claim-idle.ts this module is deliberately synchronous and
- * clock-injected: the server decides every transition on its single
- * thread and tests pin time exactly. Nothing here starts or stops a
- * machine — the wiring does, and only when the decision says to. Keep
- * this module free of server imports. */
-import { computerWaitDuration } from "./computer-wait.js";
-/** Default idle stop: a cloud seat no real screen work has touched for
- * this long is stopped (archived), because billing runs per second while
- * it runs. "A few idle minutes" per the issue. */
-export const CLOUD_SEAT_IDLE_STOP_MS = 5 * 60_000;
-/** Retry cadence for an idle stop that failed (#1655): the first retry
- * after one minute, doubling per failure up to ten. A failed stop keeps
- * its lease — the seat still bills — so the sweep always retries instead
- * of abandoning a running machine. */
-export const CLOUD_SEAT_SLEEP_RETRY_MS = 60_000;
-export const CLOUD_SEAT_SLEEP_RETRY_MAX_MS = 10 * 60_000;
-export function cloudOverflowAction(situation) {
-    if (!situation.featureEnabled || !situation.cloudConfigured || situation.perSecondCostUsd === null)
-        return { kind: "off" };
-    if (situation.started)
-        return { kind: "none" };
-    if (situation.consented)
-        return { kind: "start" };
-    if (situation.offered)
-        return { kind: "none" };
-    return { kind: "offer" };
-}
-/** Per-conversation consent plus the offer bookkeeping that keeps the
- * card to one per conversation until it is revoked. A thread the operator
- * allowlisted in config carries standing consent and never needs the
- * card. */
-export class CloudOverflowConsent {
-    grants = new Map();
-    offers = new Map();
-    revocations = new Set();
-    /** Consent for this conversation. With `perSecondCostUsd`, a card
-     * consent counts only at the rate its card showed — an allowlisted
-     * thread carries the operator's standing consent, and the operator is
-     * also the one who sets the rate. */
-    consented(threadId, allowlistedThreads = new Set(), perSecondCostUsd) {
-        if (this.revocations.has(threadId))
-            return false;
-        if (allowlistedThreads.has(threadId))
-            return true;
-        const grant = this.grants.get(threadId);
-        if (!grant)
-            return false;
-        return perSecondCostUsd === undefined || grant.perSecondCostUsd === perSecondCostUsd;
-    }
-    /** `perSecondCostUsd` is the rate the answered card showed. */
-    grant(threadId, perSecondCostUsd, now = Date.now()) {
-        this.revocations.delete(threadId);
-        this.grants.set(threadId, { at: now, perSecondCostUsd });
-    }
-    /** Revoking also clears the offered mark, so a later wait in the same
-     * conversation may ask again instead of meeting silence. */
-    revoke(threadId) {
-        const had = this.grants.delete(threadId);
-        this.revocations.add(threadId);
-        this.offers.delete(threadId);
-        return had;
-    }
-    /** A card is outstanding for this conversation — at the given rate
-     * when one is supplied, so a config change re-offers with the new
-     * price instead of meeting silence at the old one. */
-    offered(threadId, perSecondCostUsd) {
-        const offer = this.offers.get(threadId);
-        if (!offer)
-            return false;
-        return perSecondCostUsd === undefined || offer.perSecondCostUsd === perSecondCostUsd;
-    }
-    /** The rate the outstanding card showed, or null when no card is out. */
-    offeredRate(threadId) {
-        return this.offers.get(threadId)?.perSecondCostUsd ?? null;
-    }
-    markOffered(threadId, perSecondCostUsd, now = Date.now()) {
-        this.offers.set(threadId, { at: now, perSecondCostUsd });
-    }
-}
-/** One running cloud seat started by overflow. `touch` is called only
- * for real computer tool completions on that seat — screen-poller frames
- * never reach it, exactly like #1653's activity clock, so preview
- * traffic cannot keep a paid machine awake. */
-export class CloudSeatLease {
-    botId;
-    threadId;
-    /** The claim generation that started the seat: a stop releases the Box
-     * claim for exactly this owner, never a newer turn's. */
-    generation;
-    startedAt;
-    idleStopMs;
-    lastActivityAt;
-    sleepRetryNotBefore = 0;
-    sleepRetryMs = CLOUD_SEAT_SLEEP_RETRY_MS;
-    constructor(init) {
-        const idleStopMs = init.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-        if (!Number.isFinite(idleStopMs) || idleStopMs <= 0)
-            throw new Error("Cloud seat idle stop window must be positive");
-        this.botId = init.botId;
-        this.threadId = init.threadId;
-        this.generation = init.generation;
-        this.startedAt = init.now ?? Date.now();
-        this.lastActivityAt = this.startedAt;
-        this.idleStopMs = idleStopMs;
-    }
-    touch(now = Date.now()) {
-        this.lastActivityAt = now;
-        // Real work earns a fresh stop attempt: the backoff only paces
-        // retries against an idle seat that keeps failing to sleep.
-        this.sleepRetryNotBefore = 0;
-        this.sleepRetryMs = CLOUD_SEAT_SLEEP_RETRY_MS;
-    }
-    /** An idle stop may run now — true until a failure defers it. */
-    sleepDue(now = Date.now()) {
-        return now >= this.sleepRetryNotBefore;
-    }
-    /** The idle stop failed: keep the lease and back off, bounded, so the
-     * sweep retries gently instead of hammering a sick Box — and never
-     * abandons a seat that still bills. */
-    deferSleep(now = Date.now()) {
-        this.sleepRetryNotBefore = now + this.sleepRetryMs;
-        this.sleepRetryMs = Math.min(this.sleepRetryMs * 2, CLOUD_SEAT_SLEEP_RETRY_MAX_MS);
-    }
-    idleFor(now = Date.now()) {
-        return Math.max(0, now - this.lastActivityAt);
-    }
-    idleElapsed(now = Date.now()) {
-        return now - this.lastActivityAt >= this.idleStopMs;
-    }
-}
-/** Dollars per second at rate-card precision: enough places for small
- * per-second rates to stay visible, trailing zeros trimmed but never
- * past two decimals. */
-export function formatPerSecondUsd(perSecondCostUsd) {
-    let text = perSecondCostUsd.toFixed(6).replace(/0+$/, "");
-    if (text.endsWith("."))
-        text += "00";
-    else {
-        const decimals = text.length - text.indexOf(".") - 1;
-        if (decimals < 2)
-            text += "0".repeat(2 - decimals);
-    }
-    return "$" + text;
-}
-/** The consent card (#1655): the per-second cost sits beside the local
- * wait picture before any choice is made, and nothing starts without an
- * explicit consent the person still has to give. */
-export function cloudOverflowOfferText(opts) {
-    const idleStopMs = opts.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-    const estimate = opts.waitEstimateMs === undefined ? "" : ` Recent local waits here have taken about ${computerWaitDuration(opts.waitEstimateMs)}.`;
-    return `This computer is busy. Its work can overflow to a cloud computer for ${formatPerSecondUsd(opts.perSecondCostUsd)} per second.${estimate} Nothing starts without your consent — allow cloud overflow for this conversation to start it; the cloud computer stops after ${computerWaitDuration(idleStopMs)} idle.`;
-}
-export function cloudSeatStartedText(opts) {
-    const idleStopMs = opts.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-    return `Cloud computer started at ${formatPerSecondUsd(opts.perSecondCostUsd)} per second. It stops automatically after ${computerWaitDuration(idleStopMs)} idle, and the local wait continues until this computer is free.`;
-}
-export function cloudSeatStoppedText(idleMs) {
-    return `Cloud computer stopped after ${computerWaitDuration(idleMs)} idle — billing pauses while it sleeps.`;
-}
-export function cloudOverflowConsentText(allowed, idleStopMs = CLOUD_SEAT_IDLE_STOP_MS) {
-    return allowed
-        ? `Cloud overflow allowed for this conversation. A waiting turn may start the cloud computer; it stops after ${computerWaitDuration(idleStopMs)} idle.`
-        : "Cloud overflow consent revoked. Waits stay local, and no cloud computer starts without a new consent.";
-}

package/dist-server/server/tightening-requests.js

@@ -1,435 +0,0 @@
-// propose_tightening: a bot (or a Chief for a section peer) proposes an
-// authority REDUCTION through a human-confirmed card. Same shape as
-// profile-requests.ts: everything is re-validated at confirm time — a card
-// can sit open for days, so the direction is checked against live state
-// again and the revision (a hash of the touched authority surface) must
-// still match. Escalation is inexpressible in the payload and rejected by
-// the validator; restoring authority stays owner-only in Edit Profile.
-import { createHash } from "node:crypto";
-import { z } from "zod";
-import { approvalModeFor } from "../shared/approval-mode.js";
-import { TIGHTENING_MODE_TARGETS, validateTightening, } from "../shared/tightening-request.js";
-import { newId } from "./contracts.js";
-import { recordAuthorityChange } from "./profile-versions.js";
-import { redactSecretsInText } from "./redact.js";
-const MAX_REASON = 500;
-const STALE = "This bot's authority changed after this card was prepared. Ask the bot to review it and propose again.";
-const NO_SUCH_BOT = "That bot no longer exists";
-const CHOOSE_ONE = "Choose at least one tightening intent: approvalMode, composio, browser, approvePeerComms, alwaysAllow, mcpServers, skills";
-const INTENT_KEYS = [
-    "approvalMode",
-    "composio",
-    "browser",
-    "approvePeerComms",
-    "alwaysAllow",
-    "mcpServers",
-    "skills",
-];
-/** Direction is enforced by shape first: the payload cannot name "full" or
- * "custom" as a target, cannot ask to switch composio/browser back on, and
- * the list fields only carry removals. The state-relative remainder (an
- * upward move inside ask/edits/auto, a grant not currently held) is checked
- * by validateTightening against live state at propose and confirm. */
-const intentsSchema = z.object({
-    approvalMode: z.enum(TIGHTENING_MODE_TARGETS, {
-        error: 'approvalMode may only be proposed as "ask", "edits", or "auto"; full and custom stay owner-only',
-    }).optional(),
-    composio: z.literal(false, { error: "composio may only be turned off" }).optional(),
-    browser: z.literal(false, { error: "browser may only be turned off" }).optional(),
-    approvePeerComms: z.literal(true, { error: "approvePeerComms may only be turned on" }).optional(),
-    alwaysAllow: z.array(z.string().min(1).max(200)).max(200).optional(),
-    mcpServers: z.array(z.string().min(1).max(200)).max(100).optional(),
-    skills: z.array(z.string().min(1).max(100)).max(100).optional(),
-});
-export class TighteningRequestError extends Error {
-    status;
-    constructor(message, status = 400) {
-        super(message);
-        this.name = "TighteningRequestError";
-        this.status = status;
-    }
-}
-function reasonText(value) {
-    if (typeof value !== "string")
-        throw new TighteningRequestError("reason is required");
-    const trimmed = value.trim();
-    if (!trimmed)
-        throw new TighteningRequestError("reason is required");
-    if (trimmed.length > MAX_REASON) {
-        throw new TighteningRequestError(`reason must be ${MAX_REASON} characters or fewer`);
-    }
-    return redactSecretsInText(trimmed);
-}
-function parseIntents(input) {
-    if (typeof input !== "object" || input === null || Array.isArray(input)) {
-        throw new TighteningRequestError(CHOOSE_ONE);
-    }
-    const record = input;
-    for (const key of Object.keys(record)) {
-        if (!INTENT_KEYS.includes(key)) {
-            throw new TighteningRequestError(`unsupported tightening field: ${key}`);
-        }
-    }
-    const parsed = intentsSchema.safeParse(input);
-    if (!parsed.success) {
-        throw new TighteningRequestError(parsed.error.issues[0]?.message ?? CHOOSE_ONE);
-    }
-    const intents = parsed.data;
-    // Copy through only the keys the caller sent, so "did this card touch
-    // approvalMode" stays answerable from the payload alone.
-    const present = {};
-    if (record.approvalMode !== undefined)
-        present.approvalMode = intents.approvalMode;
-    if (record.composio !== undefined)
-        present.composio = intents.composio;
-    if (record.browser !== undefined)
-        present.browser = intents.browser;
-    if (record.approvePeerComms !== undefined)
-        present.approvePeerComms = intents.approvePeerComms;
-    if (record.alwaysAllow !== undefined)
-        present.alwaysAllow = intents.alwaysAllow;
-    if (record.mcpServers !== undefined)
-        present.mcpServers = intents.mcpServers;
-    if (record.skills !== undefined)
-        present.skills = intents.skills;
-    if (Object.keys(present).length === 0)
-        throw new TighteningRequestError(CHOOSE_ONE);
-    return present;
-}
-/** The card revision: a hash of exactly the authority surface a tightening
- * can touch, plus the private receipt (an older, interrupted card cannot
- * apply twice). Sorted lists so an unrelated reorder is not a false stale. */
-export function tighteningRevision(state, lastTighteningRequestId = "") {
-    return createHash("sha256")
-        .update(JSON.stringify({
-        approvalMode: state.approvalMode,
-        composio: state.composio,
-        browser: state.browser,
-        approvePeerComms: state.approvePeerComms,
-        alwaysAllow: [...state.alwaysAllow].sort(),
-        mcpServers: [...state.mcpServers].sort(),
-        skills: [...state.skills].sort(),
-        lastTighteningRequestId,
-    }), "utf8")
-        .digest("hex");
-}
-export function tighteningSnapshot(bot, extras) {
-    return {
-        approvalMode: approvalModeFor(bot),
-        composio: bot.composio !== false,
-        browser: bot.browser !== false,
-        approvePeerComms: bot.approvePeerComms === true,
-        alwaysAllow: bot.alwaysAllow ?? [],
-        mcpServers: extras.mcpServers ?? [...(bot.mcpServers ?? [])],
-        skills: extras.skills ?? [],
-    };
-}
-/** Minimal card copy: the judged facts (field, before, after, names) plus
- * the standing rule that only the owner can grant authority back. */
-export function tighteningCardCopy(target, before, intents, reason) {
-    const checked = validateTightening(before, intents);
-    const after = checked.ok ? checked.after : before;
-    const title = target.crossBot ? `Tighten @${target.name}'s permissions?` : `Tighten ${target.name}'s permissions?`;
-    const lines = target.crossBot ? [`Whose permissions: @${target.name}`, `Why: ${reason}`] : [`Why: ${reason}`];
-    if (intents.approvalMode !== undefined)
-        lines.push(`Approvals: ${before.approvalMode} → ${intents.approvalMode}`);
-    if (intents.composio !== undefined)
-        lines.push("Connected apps: on → off");
-    if (intents.browser !== undefined)
-        lines.push("Browser: on → off");
-    if (intents.approvePeerComms !== undefined)
-        lines.push("Peer contact: no approval → ask first");
-    if (intents.alwaysAllow?.length)
-        lines.push(removalLine("Always-allow grants", "removed", before.alwaysAllow, after.alwaysAllow));
-    if (intents.mcpServers?.length)
-        lines.push(removalLine("MCP servers", "unmounted", before.mcpServers, after.mcpServers));
-    if (intents.skills?.length)
-        lines.push(removalLine("Skills", "disabled", before.skills, after.skills));
-    lines.push(`This reduces ${target.name}'s authority, and the reverse cannot be proposed back.`);
-    const fields = INTENT_KEYS.filter((key) => intents[key] !== undefined);
-    return { title, summary: `${title} · ${fields.join(", ")}`, detail: lines.join("\n") };
-}
-const REMOVED_NAME_CAP = 5;
-/** One line per list field with the counts on both sides and the exact
- * names that go away, capped with a count so a wide card still reads in
- * one pass while the human approves precisely what disappears. */
-function removalLine(label, verb, before, after) {
-    const removed = before.filter((name) => !after.includes(name));
-    const shown = removed.slice(0, REMOVED_NAME_CAP);
-    const more = removed.length - shown.length;
-    const names = shown.join(", ") + (more > 0 ? ` (+${more} more)` : "");
-    return `${label}: ${before.length} → ${after.length} — ${verb}: ${names}`;
-}
-export class TighteningRequestService {
-    store;
-    now;
-    canPersist;
-    autoApply;
-    mountedMcpServers;
-    enabledSkills;
-    disableSkill;
-    targetBusy;
-    /** Public: a caller's section membership can change between propose and
-     * confirm, and tests flip this mid-scenario to model that. */
-    validateTarget;
-    constructor(options) {
-        this.store = options.store;
-        this.now = options.now ?? Date.now;
-        this.canPersist = options.canPersist;
-        this.autoApply = options.autoApply;
-        this.mountedMcpServers = options.mountedMcpServers;
-        this.enabledSkills = options.enabledSkills;
-        this.disableSkill = options.disableSkill;
-        this.targetBusy = options.targetBusy;
-        this.validateTarget = options.validateTarget;
-    }
-    snapshotOf(bot) {
-        return tighteningSnapshot(bot, {
-            mcpServers: this.mountedMcpServers?.(bot),
-            skills: this.enabledSkills?.(bot.id) ?? [],
-        });
-    }
-    /** Disable every named skill, or report the first failure together with
-     * the names still outstanding. Shared by the fresh apply and the
-     * receipt-backed retry so both leave the same trail. */
-    applySkillDisables(botId, names) {
-        for (let index = 0; index < names.length; index += 1) {
-            const disabled = this.disableSkill(botId, names[index]);
-            if (!disabled.ok)
-                return { ok: false, error: disabled.error, outstanding: names.slice(index) };
-        }
-        return { ok: true };
-    }
-    propose(args) {
-        return this.prepare(args);
-    }
-    submit(args) {
-        const proposal = this.prepare(args, true);
-        return { ...proposal, state: proposal.result ? "applied" : "pending" };
-    }
-    prepare(args, submitted = false) {
-        const reason = reasonText(args.reason);
-        const intents = parseIntents(args.intents);
-        const targetBotId = args.targetBotId ?? args.botId;
-        const target = this.store.bot(targetBotId);
-        if (!target)
-            throw new TighteningRequestError(NO_SUCH_BOT, 404);
-        const crossBot = targetBotId !== args.botId;
-        if (crossBot && this.validateTarget) {
-            const refusal = this.validateTarget(args.botId, targetBotId);
-            if (refusal)
-                throw new TighteningRequestError(refusal, 403);
-        }
-        const before = this.snapshotOf(target);
-        const checked = validateTightening(before, intents);
-        if (!checked.ok)
-            throw new TighteningRequestError(checked.error, 400);
-        const requestId = newId();
-        const targetName = redactSecretsInText(target.name);
-        const payload = {
-            version: 1,
-            requestId,
-            botId: args.botId,
-            threadId: args.threadId,
-            targetBotId,
-            targetName,
-            createdAt: this.now(),
-            reason,
-            intents,
-            before,
-            expectedRevision: tighteningRevision(before, target.lastTighteningRequestId),
-        };
-        const copy = tighteningCardCopy({ name: targetName, crossBot }, before, intents, reason);
-        const persistence = this.canPersist?.(args.botId, args.threadId);
-        if (persistence && !persistence.ok) {
-            throw new TighteningRequestError(persistence.error, persistence.status);
-        }
-        const automatic = submitted && this.autoApply?.(args.botId, args.threadId) === true;
-        const messageInput = {
-            role: "bot",
-            kind: "options",
-            card: {
-                title: copy.title,
-                subtitle: copy.detail,
-                options: automatic ? [] : ["Confirm", "Cancel"],
-                ...(automatic ? { dismissed: true } : {}),
-                requestId,
-                tool: "tighten_permissions",
-                tighteningRequest: payload,
-            },
-        };
-        if (args.from)
-            messageInput.from = args.from;
-        const message = this.store.appendMessage(args.threadId, messageInput);
-        const proposal = { requestId, messageId: message.id, title: copy.title, summary: copy.summary, detail: copy.detail };
-        if (!automatic)
-            return proposal;
-        // The hidden receipt is persisted before the authority changes. The same
-        // validation and durable commit marker serve both automatic and human decisions.
-        const result = this.resolve({ botId: args.botId, threadId: args.threadId, requestId, behavior: "allow" });
-        if (result.state === "applied")
-            return { ...proposal, result };
-        throw new TighteningRequestError(result.state === "invalid" ? result.error : "The tightening could not be applied", result.state === "invalid" ? result.status : 409);
-    }
-    /** Claims a tightening card even after it was settled, so a duplicate
-     * click never re-applies an already-applied reduction. */
-    resolve(args) {
-        const message = this.store
-            .messagesFor(args.threadId)
-            .find((candidate) => candidate.card?.requestId === args.requestId && candidate.card.tighteningRequest);
-        const card = message?.card;
-        const payload = card?.tighteningRequest;
-        if (!message || !card || !payload)
-            return { claimed: false, state: "not_found" };
-        if (payload.requestId !== card.requestId) {
-            return { claimed: true, state: "invalid", error: "This tightening request does not match its card", status: 409 };
-        }
-        if (args.behavior !== "allow" && args.behavior !== "deny") {
-            return { claimed: true, state: "invalid", error: "Tightening confirmations must be confirmed or cancelled", status: 400 };
-        }
-        if (payload.botId !== args.botId || payload.threadId !== args.threadId) {
-            return { claimed: true, state: "invalid", error: "This tightening request belongs to another conversation", status: 403 };
-        }
-        if (card.answered)
-            return { claimed: true, state: "already_settled", behavior: card.answered };
-        let emergency = false;
-        let outstandingSkills = [];
-        try {
-            const target = this.store.bot(payload.targetBotId);
-            // The authority change and receipt share one durable write. If saving
-            // the card failed afterward, a retry only settles it; it never
-            // reapplies authority — but it does finish any skills a failed
-            // attempt left enabled, so a partial disable can never strand the card.
-            if (target?.lastTighteningRequestId === payload.requestId) {
-                const enabled = new Set(this.enabledSkills?.(payload.targetBotId) ?? []);
-                const remaining = (payload.intents.skills ?? []).filter((name) => enabled.has(name));
-                if (remaining.length && !this.disableSkill) {
-                    throw new TighteningRequestError("Skill changes are not available in this workspace", 400);
-                }
-                const finished = this.applySkillDisables(payload.targetBotId, remaining);
-                if (!finished.ok) {
-                    outstandingSkills = finished.outstanding;
-                    throw new TighteningRequestError(finished.error, 409);
-                }
-                const settled = this.store.patchMessage(args.threadId, message.id, {
-                    card: { ...card, answered: "allow", held: undefined, tighteningRequest: { ...payload, appliedAt: payload.appliedAt ?? this.now() } },
-                });
-                if (!settled)
-                    throw new TighteningRequestError("This tightening confirmation card is no longer available", 409);
-                // The first attempt committed the authority change and the durable
-                // receipt, then died before it could settle the card or record
-                // history. This retry settles the card, so it also writes the row
-                // that attempt never reached — from the card's own frozen inputs,
-                // never the live bot: the revision guard proved live state equaled
-                // payload.before at apply, so the validated post-card state is the
-                // committed change, while a live snapshot could fold in later owner
-                // edits and attribute them to this card.
-                const recorded = validateTightening(payload.before, payload.intents);
-                if (recorded.ok) {
-                    recordAuthorityChange(payload.targetBotId, "bot", `card:${message.id}`, payload.before, recorded.after);
-                }
-                return { claimed: true, state: "already_settled", behavior: "allow" };
-            }
-            if (args.behavior === "deny") {
-                this.store.patchMessage(args.threadId, message.id, { card: { ...card, answered: "deny", held: undefined } });
-                return { claimed: true, state: "denied" };
-            }
-            if (!target)
-                throw new TighteningRequestError(NO_SUCH_BOT, 404);
-            const crossBot = payload.targetBotId !== payload.botId;
-            if (crossBot && this.validateTarget) {
-                const refusal = this.validateTarget(payload.botId, payload.targetBotId);
-                if (refusal)
-                    throw new TighteningRequestError(refusal, 404);
-            }
-            const current = this.snapshotOf(target);
-            if (tighteningRevision(current, target.lastTighteningRequestId) !== payload.expectedRevision) {
-                throw new TighteningRequestError(STALE, 409);
-            }
-            // Direction is re-validated against live state, not trusted from the
-            // card: a card that sat open can only ever apply a reduction.
-            const checked = validateTightening(current, payload.intents);
-            if (!checked.ok)
-                throw new TighteningRequestError(checked.error, 409);
-            emergency = payload.intents.approvalMode !== undefined &&
-                (current.approvalMode === "full" || current.approvalMode === "custom") &&
-                payload.intents.approvalMode === "ask";
-            if (this.targetBusy?.(target.id) && !emergency) {
-                if (payload.intents.approvalMode !== undefined) {
-                    throw new TighteningRequestError("Stop this bot's turn before changing its approval level", 409);
-                }
-                if (payload.intents.mcpServers !== undefined) {
-                    throw new TighteningRequestError("Stop this bot's turns before changing its MCP servers", 409);
-                }
-            }
-            // The capability check runs before any mutation: a workspace that
-            // cannot touch skills must not half-apply the card.
-            if (payload.intents.skills?.length && !this.disableSkill) {
-                throw new TighteningRequestError("Skill changes are not available in this workspace", 400);
-            }
-            const patch = { lastTighteningRequestId: payload.requestId };
-            if (payload.intents.approvalMode !== undefined) {
-                patch.approvalMode = payload.intents.approvalMode;
-                patch.autoApprove = payload.intents.approvalMode === "auto";
-                patch.approvalGrant = undefined;
-            }
-            if (payload.intents.composio !== undefined)
-                patch.composio = false;
-            if (payload.intents.browser !== undefined)
-                patch.browser = false;
-            if (payload.intents.approvePeerComms !== undefined)
-                patch.approvePeerComms = true;
-            if (payload.intents.alwaysAllow !== undefined)
-                patch.alwaysAllow = [...checked.after.alwaysAllow];
-            if (payload.intents.mcpServers !== undefined)
-                patch.mcpServers = [...checked.after.mcpServers];
-            if (!this.store.patchBot(target.id, patch))
-                throw new TighteningRequestError(NO_SUCH_BOT, 404);
-            // Skills disable AFTER the receipt write. Each disable persists on
-            // its own, so a failure midway can leave part of the list done — but
-            // the receipt is already durable, which turns every retry into the
-            // branch above: finish the remainder, never reapply authority, and
-            // never leave the card permanently stale.
-            const skills = this.applySkillDisables(target.id, payload.intents.skills ?? []);
-            if (!skills.ok) {
-                outstandingSkills = skills.outstanding;
-                throw new TighteningRequestError(skills.error, 409);
-            }
-            const appliedAt = this.now();
-            const settled = this.store.patchMessage(args.threadId, message.id, {
-                card: { ...card, answered: "allow", held: undefined, tighteningRequest: { ...payload, appliedAt } },
-            });
-            if (!settled)
-                throw new TighteningRequestError("This tightening confirmation card is no longer available", 409);
-            // Same audit trail as a profile card: the proposing bot is the actor,
-            // the card id is the via, and the rows land in the one History section
-            // manual edits already write to. Fire-and-forget like every history row.
-            recordAuthorityChange(payload.targetBotId, "bot", `card:${message.id}`, current, checked.after);
-            const fields = INTENT_KEYS.filter((key) => payload.intents[key] !== undefined);
-            return { claimed: true, state: "applied", targetBotId: target.id, fields, ...(emergency ? { emergencyStop: true } : {}) };
-        }
-        catch (error) {
-            const status = error instanceof TighteningRequestError ? error.status : 400;
-            const detail = error instanceof Error ? error.message : String(error);
-            const saved = this.store.bot(payload.targetBotId)?.lastTighteningRequestId === payload.requestId;
-            const notice = outstandingSkills.length
-                ? `Permissions tightened. Confirm again to finish disabling: ${redactSecretsInText(outstandingSkills.join(", "))}`
-                : card.dismissed && card.options.length === 0
-                    ? "Permissions tightened. Recording the operation receipt could not finish; the changes will not be applied again."
-                    : "Permissions tightened. Confirm again to finish recording this decision; the changes will not be applied again.";
-            try {
-                this.store.patchMessage(args.threadId, message.id, {
-                    card: { ...card, held: saved ? notice : redactSecretsInText(detail).slice(0, 500) },
-                });
-            }
-            catch { /* The durable receipt still permits a safe retry. */ }
-            if (saved)
-                return {
-                    claimed: true, state: "applied", targetBotId: payload.targetBotId,
-                    fields: INTENT_KEYS.filter((key) => payload.intents[key] !== undefined),
-                    ...(emergency ? { emergencyStop: true } : {}),
-                };
-            return { claimed: true, state: "invalid", error: detail, status };
-        }
-    }
-}