openmausbot 0.1.96 → 0.1.98

package/dist-server/server/store.js

@@ -5,7 +5,7 @@
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, readFileSync, mkdirSync, rmSync, statSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
-import { writeFileAtomic } from "./atomic.js";
+import { writeFileAtomic, writeFileAtomicIfChanged } from "./atomic.js";
 import { parseToolScope, toolScopeWidens } from "../shared/tool-scope.js";
 import { ensureSections, readSections, changeEmptySection } from "./section-context.js";
 import { removeBotFolder, soulFile, soulHash, writeSoulMirror } from "./bot-folder.js";
@@ -18,9 +18,11 @@ import { newId } from "./contracts.js";
 import { pickBotName } from "./names.js";
 import { redactSecretsInText } from "./redact.js";
 import { AVATAR_FOCUS_CENTER, AVATAR_ZOOM_MIN, botAvatarProfile, clampAvatarFocus, clampAvatarZoom } from "../shared/bot-avatar.js";
-import { approvalModeFor, isApprovalMode } from "../shared/approval-mode.js";
+import { approvalModeFor, isApprovalMode, modelSwitchNeedsAsk } from "../shared/approval-mode.js";
+import { REMOVED_COMPUTER_DRIVER } from "./computer-engine-removal.js";
 import { isMentionBoundary, isMentionNameContinuation } from "../shared/mention-boundary.js";
 import { CONNECTOR_SLUG_PATTERN, CONNECTOR_TOOL_NAME_PATTERN } from "../shared/wire.js";
+import { sameModelSelection } from "../shared/thread-model.js";
 export const groupWireProjectionIsExact = true;
 // Unicode's complete emoji sequences include flags, skin tones and ZWJ
 // combinations. Also allow unqualified single symbols (e.g. ♥), but not
@@ -31,13 +33,19 @@ export function isProjectEmoji(value) {
 }
 export const taskWireProjectionIsExact = true;
 /** The typed wire projection for one task. Pairs with the assertion above:
- * returning WireTask means an undeclared server field cannot ride silently. */
-export function toWireTask(task) {
-    const { resumeCursors: _resumeCursors, lastInstanceId: _lastInstanceId, handedMessages: _handedMessages, appliedCompactionId: _appliedCompactionId, contextFloor: _contextFloor, lastContextModel: _lastContextModel, surfaceSource, ...wire } = task;
+ * returning WireTask means an undeclared server field cannot ride silently.
+ * A thread with no model of its own follows its bot: the wire carries the
+ * model it runs on either way, so every client reads one effective model. */
+export function toWireTask(task, botModel) {
+    const { resumeCursors: _resumeCursors, lastInstanceId: _lastInstanceId, handedMessages: _handedMessages, appliedCompactionId: _appliedCompactionId, contextFloor: _contextFloor, lastContextModel: _lastContextModel, surfaceSource, ...stored } = task;
+    const wire = { ...stored, modelSelection: structuredClone(task.modelSelection ?? botModel), followsBotModel: task.modelSelection === undefined };
     // Who pinned stays private. A client learns only whether the pin is the
     // machine's own record, so it never presents one as the person's choice.
     return surfaceSource === "auto" && wire.surface !== undefined ? { ...wire, surfaceAuto: true } : wire;
 }
+/** The level a thread drops to when its engine changes under a level the new
+ * engine would have to confirm (modelSwitchNeedsAsk), as on every switch. */
+const ASK_NOW = { approvalMode: "ask", autoApprove: false, alwaysAllow: [] };
 const TASK_PATCH_FIELDS = [
     "title", "projectId", "modelSelection", "approvalMode", "autoApprove", "alwaysAllow",
     "unread", "rewound", "archivedAt", "pinned", "pinnedMessageId", "resumeCursors", "lastInstanceId", "cwd",
@@ -325,6 +333,9 @@ export function parseConnectorTools(value) {
 }
 const BOTS_FILE = join(DATA_DIR, "bots.json");
 const GROUPS_FILE = join(DATA_DIR, "groups.json");
+/** Written once the copies older builds made of a bot's model on its threads
+ * are cleared (Store load), so that cleanup runs once per data directory. */
+const THREAD_MODEL_COPIES_CLEARED = join(DATA_DIR, "thread-model-copies-cleared");
 /** The registries carry souls, project paths and per-bot settings, so they are
  * owner-only like the other data-dir stores. A file written by an older
  * release (or loosened by hand) is tightened on load. Best effort: failing to
@@ -455,6 +466,7 @@ export class Store {
     threads = new Map();
     defaultSelection;
     completeNewBotSelection;
+    driverKindOf;
     listeners = new Set();
     /** A broken team registry must not prevent loading independent chat data. */
     registeringInitialSections = true;
@@ -464,9 +476,14 @@ export class Store {
     constructor(defaultSelection, 
     /** Workspace-wide new-bot defaults (config newBots), applied to every
      * new bot's selection whichever path created it. */
-    completeNewBotSelection = (selection) => selection) {
+    completeNewBotSelection = (selection) => selection, 
+    /** The driver an engine instance runs, for the level a thread keeps when
+     * its engine changes (modelSwitchNeedsAsk). Unknown counts as another
+     * driver, so Full and Custom fall back to Ask. */
+    driverKindOf = () => undefined) {
         this.defaultSelection = defaultSelection;
         this.completeNewBotSelection = completeNewBotSelection;
+        this.driverKindOf = driverKindOf;
         mkdirSync(DATA_DIR, { recursive: true });
         for (const file of [BOTS_FILE, GROUPS_FILE])
             tightenRegistryFile(file);
@@ -695,11 +712,17 @@ export class Store {
         }
         if (groupsMigrated)
             this.saveGroups();
+        // Older builds copied a bot's model onto every thread it made, so a
+        // thread on exactly its bot's model is a copy, not a person's pick: once
+        // per data directory it is cleared and the thread follows its bot. A
+        // different model can't be told apart from a pick and stays. Only over a
+        // bot list this load could read, so an unreadable file is not skipped.
+        const clearModelCopies = !existsSync(THREAD_MODEL_COPIES_CLEARED) && (botsLoaded || !existsSync(BOTS_FILE));
         // bots saved before tasks existed have one endless thread; adopt it as
         // their first task so nothing is lost and nothing special-cases it
         for (const b of this.bots) {
-            // Folders are organizational only. Preserve existing thread model
-            // snapshots while discarding the unshipped folder-default setting.
+            // Folders are organizational only. Preserve threads' own models while
+            // discarding the unshipped folder-default setting.
             if (b.projects?.some((project) => "modelSelection" in project)) {
                 b.projects = b.projects.map(({ id, name, emoji }) => ({ id, name, ...(isProjectEmoji(emoji) ? { emoji } : {}) }));
                 botsMigrated = true;
@@ -729,8 +752,8 @@ export class Store {
                 botsMigrated = true;
             }
             for (const task of b.tasks) {
-                if (task.modelSelection === undefined) {
-                    task.modelSelection = structuredClone(b.modelSelection);
+                if (clearModelCopies && task.modelSelection !== undefined && sameModelSelection(task.modelSelection, b.modelSelection)) {
+                    delete task.modelSelection;
                     botsMigrated = true;
                 }
                 if (!task.resumeCursors) {
@@ -773,6 +796,8 @@ export class Store {
         }
         if (botsMigrated)
             this.saveBots();
+        if (clearModelCopies)
+            writeFileAtomic(THREAD_MODEL_COPIES_CLEARED, "Threads follow their bot's model; the copies older builds made are cleared.\n", { mode: 0o600 });
         // Search reads SQLite directly, so migrate every known legacy transcript
         // at startup rather than waiting until the user happens to open it. Only
         // pending JSON files are touched; already-migrated threads stay lazy.
@@ -895,10 +920,13 @@ export class Store {
         if (botsDirty)
             this.saveBots();
     }
+    // Many saves repeat what is already on disk (the same resume cursor, an
+    // unchanged task field), so both registries skip a byte-identical write.
+    // Events are still emitted by the callers either way.
     saveBots(bots = this.bots, registerSections = true) {
         if (registerSections)
             this.rememberSections([...this.bots, ...bots].map((bot) => bot.section));
-        writeFileAtomic(BOTS_FILE, JSON.stringify(bots.map(({ busy: _busy, activity: _activity, ...bot }) => ({
+        writeFileAtomicIfChanged(BOTS_FILE, JSON.stringify(bots.map(({ busy: _busy, activity: _activity, ...bot }) => ({
             ...bot,
             tasks: bot.tasks?.map(({ busy: _taskBusy, activity: _taskActivity, turnStartedAt: _taskTurnStarted, ...task }) => persistedPin(task)),
         })), null, 2), { mode: 0o600 });
@@ -906,7 +934,7 @@ export class Store {
     saveGroups(groups = this.groups, registerSections = true) {
         if (registerSections)
             this.rememberSections(groups.map((group) => group.section));
-        writeFileAtomic(GROUPS_FILE, JSON.stringify(groups.map(({ busyBotId: _busyBotId, turnStartedAt: _turnStartedAt, ...g }) => ({
+        writeFileAtomicIfChanged(GROUPS_FILE, JSON.stringify(groups.map(({ busyBotId: _busyBotId, turnStartedAt: _turnStartedAt, ...g }) => ({
             ...g,
             ...(g.tasks ? { tasks: g.tasks.map((task) => persistedPin(task)) } : {}),
         })), null, 2), { mode: 0o600 });
@@ -1119,6 +1147,9 @@ export class Store {
             else if (!patch.busyBotId)
                 delete group.turnStartedAt;
         }
+        if (Object.prototype.hasOwnProperty.call(patch, "turnTimeoutMinutes") && patch.turnTimeoutMinutes == null) {
+            delete group.turnTimeoutMinutes;
+        }
         if (!group.dm && Object.prototype.hasOwnProperty.call(patch, "pinnedMessageId")) {
             const active = this.activeGroupTask(group.id);
             if (active)
@@ -1259,6 +1290,20 @@ export class Store {
         this.emit({ type: "group", groupId });
         return task;
     }
+    /** Null removes the conversation's own ceiling so the next turn uses the
+     * global group limit. A sibling conversation is left alone. */
+    setGroupTaskTurnTimeout(groupId, threadId, minutes) {
+        const task = this.groupTaskByThread(groupId, threadId);
+        if (!task)
+            return null;
+        if (minutes == null)
+            delete task.turnTimeoutMinutes;
+        else
+            task.turnTimeoutMinutes = minutes;
+        this.saveGroups();
+        this.emit({ type: "group", groupId });
+        return task;
+    }
     renameGroupTask(groupId, threadId, title) {
         const task = this.groupTaskByThread(groupId, threadId);
         if (!task)
@@ -1625,7 +1670,6 @@ export class Store {
                 createdAt: bot.createdAt,
                 updatedAt: bot.createdAt,
                 resumeCursors: {},
-                modelSelection: structuredClone(bot.modelSelection),
                 unread: false,
                 activity: "idle",
                 busy: false,
@@ -1657,7 +1701,8 @@ export class Store {
         return bot;
     }
     /** All setup fields and the Chief's receipt commit before publishing any
-     * mutation. Model defaults never rewrite saved thread selections. */
+     * mutation. A new model moves the threads that follow the bot, never a
+     * thread's own model. */
     applyTeamSetup(request) {
         const chief = this.bot(request.botId);
         if (!chief)
@@ -1686,7 +1731,7 @@ export class Store {
                     // a restricted Chief never creates a bot everyone sees.
                     ...(chief.visibility && chief.visibility !== "everyone" ? { visibility: structuredClone(chief.visibility) } : {}),
                     tasks: [{ threadId: operation.threadId, title: UNTITLED_THREAD, createdAt, updatedAt: createdAt, resumeCursors: {},
-                            modelSelection: structuredClone(modelSelection), approvalMode: "ask", autoApprove: false,
+                            approvalMode: "ask", autoApprove: false,
                             unread: false, activity: "idle", busy: false }],
                 };
                 // "" is the private-workspace spelling on proposal; the record
@@ -1701,13 +1746,7 @@ export class Store {
                 const previous = nextBots[at];
                 next = { ...previous, ...operation.fields };
                 if (operation.fields.modelSelection)
-                    next.tasks = previous.tasks?.map((task) => ({
-                        ...task,
-                        modelSelection: structuredClone(task.modelSelection ?? previous.modelSelection),
-                        approvalMode: approvalModeFor(this.projectBotForTask(previous.id, task.threadId)),
-                        autoApprove: task.autoApprove ?? previous.autoApprove,
-                        alwaysAllow: structuredClone(task.alwaysAllow ?? previous.alwaysAllow ?? []),
-                    }));
+                    next.tasks = this.withDefaultModel(previous, operation.fields.modelSelection);
                 nextBots[at] = next;
             }
             if (operation.fields.chiefOfStaff === false)
@@ -1745,23 +1784,38 @@ export class Store {
         this.emit({ type: "bot", botId: chief.id });
         return result;
     }
-    /** One reviewed default-model change (propose_model): task stamping is
-     * identical to applyTeamSetup's update branch — saved per-thread
-     * selections are never rewritten, and a thread with no selection of its
-     * own is pinned to the previous default so it does not silently follow
-     * the new one. */
+    /** Moving this thread from one model to another takes its level back to
+     * Ask where the new engine would have to confirm it (modelSwitchNeedsAsk),
+     * as on every engine switch. Read before anything changes. */
+    switchNeedsAsk(botId, threadId, from, to) {
+        if (from.instanceId === to.instanceId)
+            return false;
+        const thread = this.projectBotForTask(botId, threadId);
+        return Boolean(thread) && modelSwitchNeedsAsk(approvalModeFor(thread), this.driverKindOf(from.instanceId), this.driverKindOf(to.instanceId));
+    }
+    /** A bot's threads as a change of its model to `next` leaves them. Each
+     * keeps the level it runs at now (older threads may still inherit the
+     * bot's, which may change in the same write); one that follows the bot
+     * moves with it, back to Ask where the new engine would have to confirm
+     * its level; a thread's own model stays. */
+    withDefaultModel(bot, next) {
+        return bot.tasks?.map((task) => ({
+            ...task,
+            approvalMode: approvalModeFor(this.projectBotForTask(bot.id, task.threadId)),
+            autoApprove: task.autoApprove ?? bot.autoApprove,
+            alwaysAllow: structuredClone(task.alwaysAllow ?? bot.alwaysAllow ?? []),
+            ...(task.modelSelection === undefined && this.switchNeedsAsk(bot.id, task.threadId, bot.modelSelection, next) ? structuredClone(ASK_NOW) : {}),
+        }));
+    }
+    /** One reviewed default-model change (propose_model), with
+     * applyTeamSetup's task stamping (withDefaultModel): every thread that
+     * follows the bot moves to the new model, and a thread's own model, which a
+     * person picked there, stays. */
     applyModelDefault(id, modelSelection) {
         const previous = this.bot(id);
         if (!previous)
             return null;
-        const next = { ...previous, modelSelection: structuredClone(modelSelection) };
-        next.tasks = previous.tasks?.map((task) => ({
-            ...task,
-            modelSelection: structuredClone(task.modelSelection ?? previous.modelSelection),
-            approvalMode: approvalModeFor(this.projectBotForTask(previous.id, task.threadId)),
-            autoApprove: task.autoApprove ?? previous.autoApprove,
-            alwaysAllow: structuredClone(task.alwaysAllow ?? previous.alwaysAllow ?? []),
-        }));
+        const next = { ...previous, modelSelection: structuredClone(modelSelection), tasks: this.withDefaultModel(previous, modelSelection) };
         this.saveBots(this.bots.map((candidate) => candidate.id === id ? next : candidate));
         this.bots = this.bots.map((candidate) => candidate.id === id ? next : candidate);
         this.emit({ type: "bot", botId: id });
@@ -1859,9 +1913,16 @@ export class Store {
             patch = { ...patch };
             delete patch.toolScope;
         }
+        // A new model moves the threads that follow the bot; one whose level the
+        // new engine would have to confirm goes back to Ask. That is a
+        // revocation, so it holds in memory like the others below.
+        const toAsk = patch.modelSelection ? (bot.tasks ?? []).filter((task) => task.modelSelection === undefined &&
+            this.switchNeedsAsk(id, task.threadId, bot.modelSelection, patch.modelSelection)) : [];
         // Runtime revocations must become effective in memory even when disk is
         // unavailable. Profile edits use the separate atomic path below.
         Object.assign(bot, patch);
+        for (const task of toAsk)
+            Object.assign(task, structuredClone(ASK_NOW));
         const task = this.activeTask(id);
         if (task) {
             for (const key of ["resumeCursors", "rewound", "pinnedMessageId", "unread"]) {
@@ -2144,6 +2205,129 @@ export class Store {
             this.emit({ type: "bot", botId: bot.id });
         return changed.length;
     }
+    /** The removed Computer engine's saved choices move to `replacement` in one
+     * save: each bot's model, each conversation's own model, and its backups.
+     * Native resume cursors and handed-message records of the removed engine go
+     * too; the conversations stay, and the new engine reads them from the
+     * transcript. Each conversation keeps working where it did: on Auto the
+     * removed engine always ran on the bot's own cloud computer, so where
+     * `keepCloud` says that computer is still there and the new engine can use
+     * it, a moved bot's Works on becomes Cloud, and a moved conversation of an
+     * Auto bot is pinned there the way an Auto turn records where it landed.
+     * Where the new engine can't use a computer, an Auto-recorded cloud pin on
+     * a moved conversation gives way, as on a Works on change
+     * (clearAutoSurfacePins); a place the person chose stays chosen.
+     * A level the new engine would have to confirm goes back to Ask, as on
+     * every engine switch (modelSwitchNeedsAsk); a conversation that followed
+     * the bot's level keeps the level it had. Every other setting is kept.
+     * Nothing changes in memory until the save succeeds, so a failed save can
+     * be tried again. Returns one entry per moved conversation, plus one for
+     * the bot's open conversation when only the bot's own engine moved.
+     * Idempotent: nothing left names the engine. */
+    retireInstances(ids, replacement, options) {
+        const retired = (selection) => Boolean(selection && ids.has(selection.instanceId));
+        const without = (record) => Object.fromEntries(Object.entries(record).filter(([key]) => !ids.has(key)));
+        const touches = (record) => Boolean(record && Object.keys(record).some(key => ids.has(key)));
+        const needsAsk = (target) => modelSwitchNeedsAsk(approvalModeFor(target), REMOVED_COMPUTER_DRIVER, options.driverKind);
+        const askNow = { approvalMode: "ask", autoApprove: false, alwaysAllow: [] };
+        const changes = [];
+        const moves = [];
+        for (const bot of this.bots) {
+            const patch = {};
+            const tasks = (bot.tasks ?? []).map(() => ({}));
+            const botMoved = retired(bot.modelSelection);
+            const keepsCloud = options.canWorkOnCloud && options.keepCloud(bot);
+            let botAsk = false;
+            if (botMoved) {
+                if (bot.computer === undefined && keepsCloud)
+                    patch.computer = "cloud";
+                if (needsAsk(bot)) {
+                    Object.assign(patch, structuredClone(askNow));
+                    botAsk = true;
+                }
+                patch.modelSelection = structuredClone(replacement);
+            }
+            if (bot.fallback?.some(retired)) {
+                const kept = bot.fallback.filter(candidate => !retired(candidate));
+                patch.fallback = kept.length ? kept : undefined;
+            }
+            if (touches(bot.resumeCursors))
+                patch.resumeCursors = without(bot.resumeCursors);
+            const computer = patch.computer ?? bot.computer;
+            /** Where a conversation worked before the move (its own place, else
+             * the bot's Works on, and on Auto the bot's own cloud computer where
+             * keepCloud says so), and what the move did to that. */
+            const cloudAfterMove = (pin, pinSource) => {
+                const place = pin ?? bot.computer;
+                const wasCloud = place === "cloud" || (place === undefined && options.keepCloud(bot));
+                if (!wasCloud || options.canWorkOnCloud)
+                    return { cloud: wasCloud, noComputer: false };
+                // An Auto-recorded pin gives way (below): only the person's place
+                // or the bot's Works on can still send it to the cloud computer.
+                const personPin = pin !== undefined && pinSource !== "auto";
+                const still = personPin ? pin : bot.computer;
+                return { cloud: false, noComputer: still !== "cloud" ? "auto" : personPin ? "pin" : "works-on" };
+            };
+            (bot.tasks ?? []).forEach((task, index) => {
+                const taskPatch = tasks[index];
+                // Read before anything changes: a conversation that follows the bot's
+                // level has the bot's level here.
+                const before = this.projectBotForTask(bot.id, task.threadId);
+                // The bot's own level goes back to Ask, so a conversation that
+                // followed it keeps the level it had (as switchTaskModel does).
+                if (botAsk) {
+                    Object.assign(taskPatch, {
+                        approvalMode: before.approvalMode, autoApprove: before.autoApprove, alwaysAllow: structuredClone(before.alwaysAllow ?? []),
+                    });
+                }
+                // The engine this conversation ran on: its own, else the bot's.
+                const moved = task.modelSelection ? retired(task.modelSelection) : botMoved;
+                if (moved) {
+                    if (!botMoved && computer === undefined && task.surface === undefined && keepsCloud) {
+                        taskPatch.surface = "cloud";
+                        taskPatch.surfaceSource = "auto";
+                    }
+                    // The machine's memory of where Auto landed: with no computer on
+                    // the new engine, the next turn would be refused there once.
+                    if (!options.canWorkOnCloud && task.surface === "cloud" && task.surfaceSource === "auto") {
+                        taskPatch.surface = undefined;
+                        taskPatch.surfaceSource = undefined;
+                    }
+                    const ask = needsAsk(before);
+                    if (ask)
+                        Object.assign(taskPatch, structuredClone(askNow));
+                    if (task.modelSelection)
+                        taskPatch.modelSelection = structuredClone(replacement);
+                    const scope = botMoved && task.threadId === bot.threadId ? "bot" : "conversation";
+                    moves.push({ botId: bot.id, threadId: task.threadId, scope, ...cloudAfterMove(task.surface, task.surfaceSource),
+                        askNow: ask || (scope === "bot" && botAsk) });
+                }
+                else if (botMoved && task.threadId === bot.threadId) {
+                    // The bot's own engine and level moved, but its open conversation
+                    // has an engine of its own: it is still told, about the bot.
+                    moves.push({ botId: bot.id, threadId: task.threadId, scope: "bot-only", ...cloudAfterMove(undefined, undefined), askNow: botAsk });
+                }
+                if (touches(task.resumeCursors))
+                    taskPatch.resumeCursors = without(task.resumeCursors);
+                if (task.handedMessages && touches(task.handedMessages))
+                    taskPatch.handedMessages = without(task.handedMessages);
+            });
+            if (Object.keys(patch).length || tasks.some(taskPatch => Object.keys(taskPatch).length))
+                changes.push({ bot, patch, tasks });
+        }
+        if (!changes.length)
+            return moves;
+        const next = new Map(changes.map(({ bot, patch, tasks }) => [bot, {
+                ...bot, ...patch, tasks: bot.tasks?.map((task, index) => ({ ...task, ...tasks[index] })),
+            }]));
+        this.saveBots(this.bots.map(bot => next.get(bot) ?? bot));
+        for (const { bot, patch, tasks } of changes) {
+            bot.tasks?.forEach((task, index) => Object.assign(task, tasks[index]));
+            Object.assign(bot, patch);
+            this.emit({ type: "bot", botId: bot.id });
+        }
+        return moves;
+    }
     setResumeCursor(botId, instanceId, cursor, threadId) {
         const bot = this.bot(botId);
         if (!bot)
@@ -2462,37 +2646,61 @@ export class Store {
         this.emit({ type: "bot", botId });
         return cleared;
     }
-    /** Model/provider changes are one configuration transaction: never publish
-     * a new provider before its confirmed approval downgrade, or change the
-     * default while leaving the selected thread behind after a write failure. */
+    /** A person picks a model in one thread, and with updateBotDefault makes it
+     * the bot's model too. A thread on its bot's model follows the bot: it
+     * keeps no model of its own. Model/provider changes are one configuration
+     * transaction: never publish a new provider before its confirmed approval
+     * downgrade, or change the default while leaving the selected thread
+     * behind after a write failure. */
     switchTaskModel(botId, threadId, selection, updateBotDefault, resetApprovalToAsk, taskPatch = {}) {
         const bot = this.bot(botId);
         const task = this.taskByThread(botId, threadId);
         if (!bot || !task)
             return null;
-        const patch = { modelSelection: structuredClone(selection),
-            ...(resetApprovalToAsk ? { approvalMode: "ask", autoApprove: false, alwaysAllow: [] } : {}) };
-        const nextTask = persistedPin({ ...task, ...taskPatch, ...patch,
+        const approval = resetApprovalToAsk ? structuredClone(ASK_NOW) : {};
+        const own = sameModelSelection(selection, updateBotDefault ? selection : bot.modelSelection) ? undefined : structuredClone(selection);
+        const nextTask = persistedPin({ ...task, ...taskPatch, modelSelection: own, ...approval,
             ...(typeof taskPatch.title === "string" ? { title: taskPatch.title.trim().slice(0, 80) || UNTITLED_THREAD } : {}) });
-        // Older threads may still inherit settings. Freeze their effective
-        // values before updating the default so "other threads unchanged" also
-        // holds for workspaces created before per-thread approval settings.
-        const nextTasks = bot.tasks.map((candidate) => candidate === task ? nextTask : !updateBotDefault ? candidate : {
-            ...candidate,
-            modelSelection: structuredClone(candidate.modelSelection ?? bot.modelSelection),
-            approvalMode: approvalModeFor(this.projectBotForTask(botId, candidate.threadId)),
-            autoApprove: candidate.autoApprove ?? bot.autoApprove,
-            alwaysAllow: structuredClone(candidate.alwaysAllow ?? bot.alwaysAllow ?? []),
-        });
-        const next = { ...bot, ...(updateBotDefault ? patch : {}),
-            tasks: nextTasks };
-        this.saveBots(this.bots.map((candidate) => candidate === bot ? next : candidate));
+        // A new bot model moves the threads that follow it (withDefaultModel);
+        // every other thread keeps its model and the level it runs at now.
+        const others = updateBotDefault ? this.withDefaultModel(bot, selection) : bot.tasks;
+        const nextTasks = bot.tasks.map((candidate, index) => candidate === task ? nextTask : others[index]);
+        const botPatch = updateBotDefault ? { modelSelection: structuredClone(selection), ...approval } : {};
+        this.saveBots(this.bots.map((candidate) => candidate === bot ? { ...bot, ...botPatch, tasks: nextTasks } : candidate));
         bot.tasks.forEach((candidate, index) => Object.assign(candidate, nextTasks[index]));
-        if (updateBotDefault)
-            Object.assign(bot, patch);
+        Object.assign(bot, botPatch);
         this.emit({ type: "bot", botId });
         return task;
     }
+    /** These threads follow their bot's model again: each one's own model is
+     * cleared ("Switch them too", "Use the bot's model", or a model that can't
+     * run here). A level the bot's engine would have to confirm goes back to
+     * Ask, as on every engine switch, and `reset` adds what a changed model
+     * needs (a hosted workspace's fresh session). One write. Returns the
+     * threads that changed; a listed thread that already follows stays as it is. */
+    followBotModel(botId, threadIds, reset = () => ({})) {
+        const bot = this.bot(botId);
+        if (!bot?.tasks)
+            return [];
+        const listed = new Set(threadIds);
+        const patches = bot.tasks.map((task) => !listed.has(task.threadId) || task.modelSelection === undefined ? null : {
+            ...reset(task.modelSelection, bot.modelSelection),
+            modelSelection: undefined,
+            ...(this.switchNeedsAsk(botId, task.threadId, task.modelSelection, bot.modelSelection) ? structuredClone(ASK_NOW) : {}),
+        });
+        const moved = bot.tasks.filter((_, index) => patches[index]).map((task) => task.threadId);
+        if (!moved.length)
+            return [];
+        const nextTasks = bot.tasks.map((task, index) => patches[index] ? { ...task, ...patches[index] } : task);
+        this.saveBots(this.bots.map((candidate) => candidate === bot ? { ...bot, tasks: nextTasks } : candidate));
+        bot.tasks.forEach((task, index) => { if (patches[index])
+            Object.assign(task, patches[index]); });
+        const active = bot.tasks.find((task) => task.threadId === bot.threadId);
+        if (active)
+            this.mirrorActiveTask(bot, active);
+        this.emit({ type: "bot", botId });
+        return moved;
+    }
     /** One durable write: never leave only part of a bot's threads updated. */
     setAllThreadApprovalMode(botId, mode) {
         const bot = this.bot(botId);
@@ -2532,9 +2740,9 @@ export class Store {
         bot.pinnedMessageId = task.pinnedMessageId;
     }
     /** A fresh context on the same bot: new thread, new session, same
-     * persona/tools/computer. Becomes the active task. It runs on the bot's
-     * default model unless the caller hands it one (a thread opened from
-     * another of this bot's threads keeps that thread's model). */
+     * persona/tools/computer. Becomes the active task. It follows the bot's
+     * model unless the caller hands it another one: a thread opened from
+     * another of this bot's threads keeps the model a person picked there. */
     createTask(botId, title, activate = true, projectId, openedBy, approvalMode, modelSelection) {
         const bot = this.bot(botId);
         if (!bot)
@@ -2550,7 +2758,7 @@ export class Store {
             ...(projectId ? { projectId } : {}),
             ...(openedBy ? { openedBy: structuredClone(openedBy) } : {}),
             resumeCursors: {},
-            modelSelection: structuredClone(modelSelection ?? bot.modelSelection),
+            ...(modelSelection && !sameModelSelection(modelSelection, bot.modelSelection) ? { modelSelection: structuredClone(modelSelection) } : {}),
             approvalMode: approvalMode ?? approvalModeFor(bot),
             autoApprove: approvalMode ? false : Boolean(bot.autoApprove),
             alwaysAllow: approvalMode ? [] : [...(bot.alwaysAllow ?? [])],
@@ -2656,10 +2864,14 @@ export class Store {
         this.emit({ type: "bot", botId });
         return bot;
     }
+    /** A first run: no bot yet, so seedIfEmpty makes one. */
+    needsSeed() {
+        return this.bots.length === 0;
+    }
     /** First-run seed: one bot so the app never opens empty — it gets a
      * random friendly name like every other bot. */
     seedIfEmpty() {
-        if (this.bots.length)
+        if (!this.needsSeed())
             return;
         this.createBot();
     }

package/dist-server/server/surface.js

@@ -6,6 +6,8 @@
 // decides or describes a surface lives here, so the picker, the dispatch,
 // the system prompt and the notification cannot drift apart.
 import { canWorkOnCloud } from "../shared/cloud-computer.js";
+import { canUseMcpServer } from "../shared/tool-scope.js";
+import { placeRowText } from "../shared/place-view.js";
 const SURFACES = new Set(["cloud", "vm", "local", "browser"]);
 /** Parse a surface arriving over the wire; anything else is "not said". */
 export function parseSurface(value) {
@@ -68,65 +70,43 @@ export function resolveSurface(input) {
     }
     return { computer: undefined, browser: browserOn, pinned: null, note: "" };
 }
-/** The next action per source: the full sentence after a failed attach, and
- * the clause after "Choose another model, or" when the engine is the cause. */
-const PLACE_ACTION = {
-    pin: {
-        sentence: "Clear this conversation's place in the composer to continue.",
-        clause: "clear this conversation's place in the composer",
-    },
-    // The dispatch clears an Auto-recorded pin that failed, so the next
-    // message runs on Auto: that pin was the machine's memory, not a choice.
-    "auto-pin": {
-        sentence: "This conversation is back on Auto; send your message again.",
-        clause: "send your message again; this conversation is back on Auto",
-    },
-    "works-on": {
-        sentence: "Set Works on to Auto in this bot's settings to continue.",
-        clause: "set Works on to Auto",
-    },
-    routine: {
-        sentence: "Change where this routine runs.",
-        clause: "change where this routine runs",
-    },
-};
-/** Why this engine can't work on the cloud computer, in the words of the
- * place's source, or null when it can (shared/cloud-computer.ts holds the
- * rule). Checked before anything is provisioned, so a turn that cannot run
- * never creates or wakes a machine. */
-export function cloudPlaceDriverError(engine, backend, source = "works-on") {
-    if (canWorkOnCloud(engine, backend))
+/** Why this engine can't work on the cloud computer, as a failed place, or
+ * null when it can (shared/cloud-computer.ts holds the rule). Checked before
+ * anything is provisioned, so a turn that cannot run never creates or wakes
+ * a machine. */
+export function cloudPlaceRefusal(engine, source, bot) {
+    if (canWorkOnCloud(engine))
         return null;
-    const next = `Choose another model, or ${PLACE_ACTION[source].clause}.`;
-    return engine.driverKind === "boxAgent"
-        ? `The Computer engine runs on Boat and can't use a self-hosted VPS. ${next}`
-        : `This model can't use a computer. ${next}`;
+    return placeUnavailable("cloud", { state: "cc-cannot", params: { bot, model: engine.name }, source });
 }
-/** One line, cause then next action. A bot thread's transcript row keeps
- * 160 characters, so the cause is shortened there, never the action; the
- * cause keeps its own words otherwise. */
-export function placeFailureMessage(cause, source, limit = 160) {
-    const action = PLACE_ACTION[source].sentence;
-    const body = cause.trim().replace(/[\s.]+$/, "");
-    const room = limit - action.length - 2;
-    if (body.length <= room)
-        return `${body}. ${action}`;
-    return `${body.slice(0, Math.max(0, room - 1)).trimEnd()}… ${action}`;
+/** Why this bot's Tool selection keeps it off a computer, as a failed place,
+ * or null: one line and the one setting that changes it, the same whatever
+ * chose the place (a turn's refusal and select_computer's reason alike).
+ * Engines reach every desktop through the "computer" MCP server, so a
+ * selection without it has nothing to work with there. Checked with the
+ * engine rule, before anything is created or woken. */
+export function computerToolsRefusal(toolScope, source, bot) {
+    if (canUseMcpServer(toolScope, "computer"))
+        return null;
+    return placeUnavailable("cloud", { state: "cc-tools-off", params: { bot }, source });
 }
-/** A place the turn was told to use could not be used. The message already
- * ends with the one next action; the place lets the dispatch clear a failed
+/** A place the turn was told to use could not be used. Its message is the
+ * row's English words: one line and the one next action as a sentence
+ * (shared/place-view.ts), uncut. `row` lets the app word it again in the
+ * reader's language, and `place` lets the dispatch clear a failed
  * Auto-recorded pin to it, so a failed place never sticks. */
 export class PlaceUnavailableError extends Error {
     place;
-    constructor(place, message) {
-        super(message);
+    row;
+    constructor(place, row, cloudHome = false) {
+        super(placeRowText(row, cloudHome ? "my-cloud" : undefined));
         this.name = "PlaceUnavailableError";
         this.place = place;
+        this.row = row;
     }
 }
-/** A failed attach: the attach's own words as the cause, plus the action. */
-export function placeUnavailable(place, source, cause, limit = 160) {
-    return new PlaceUnavailableError(place, placeFailureMessage(cause, source, limit));
+export function placeUnavailable(place, row, cloudHome = false) {
+    return new PlaceUnavailableError(place, row, cloudHome);
 }
 /** How the prompt and the app name a surface. Deliberately the same words
  * the panel uses, so "tell them it is on the cloud computer" points at a