openmausbot 0.1.97 → 0.1.98

package/dist-server/permission-proxy.js

@@ -157,6 +157,7 @@ var allowQuestion = allowsTool(selection.scope, { kind: "mcp", server: "ogb", na
 var socketPath = process.argv[2] ?? "";
 var waiting = /* @__PURE__ */ new Map();
 var conn = connect(socketPath);
+conn.setEncoding("utf8");
 var dead = () => {
   for (const resolve of waiting.values()) {
     resolve({ behavior: "deny", message: "OpenMausBot: permission broker unavailable \u2014 skip this action" });
@@ -295,6 +296,7 @@ async function handle(msg) {
   }
 }
 var inBuf = "";
+process.stdin.setEncoding("utf8");
 process.stdin.on("data", (chunk) => {
   inBuf += chunk;
   let nl;

package/dist-server/server/atomic.js

@@ -4,8 +4,15 @@
 // reader always sees either the complete old contents or the complete new
 // ones. Without this, an interrupted writeFileSync produces half-written JSON
 // that fails to parse on next boot and is silently treated as empty state.
+//
+// The fsync is the expensive part: on macOS it is F_FULLFSYNC, about 4 ms of
+// blocked event loop per call. `durable: false` drops only the fsync, for
+// files whose loss after a power cut costs nothing (a derived cache, a
+// session-scoped token). The temp file and rename stay, so an app crash or
+// kill -9 still never leaves a torn file; only a power loss or kernel panic
+// can leave such a file empty.
 import { randomUUID } from "node:crypto";
-import { closeSync, fsyncSync, openSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 /** Windows refuses a rename onto an existing path while anything else holds a
  * handle to either file, and a virus scanner or the search indexer opening a
  * just-closed file for a few milliseconds is enough. It surfaces as EPERM or
@@ -51,7 +58,8 @@ export function writeFileAtomic(path, data, options = {}) {
         // config file visible between the write and a later chmod.
         fd = openSync(tmp, "w", options.mode);
         writeFileSync(fd, data);
-        fsyncSync(fd);
+        if (options.durable !== false)
+            fsyncSync(fd);
         closeSync(fd);
         fd = null;
         renameWithRetry(tmp, path);
@@ -74,3 +82,63 @@ export function writeFileAtomic(path, data, options = {}) {
         throw e;
     }
 }
+/** True only when `path` is already exactly `data`: a regular file (never a
+ * symlink, FIFO or directory), owned by this user, with permissions no
+ * broader than `mode`. Any doubt or error answers false, so the caller falls
+ * back to a full write — this check must never be the reason a save fails.
+ *
+ * It reads the file on disk rather than remembering the last write: a
+ * workspace restore or a hand edit can change the file underneath, and the
+ * next save has to put its own bytes back exactly as before. */
+function holdsExactly(path, data, mode) {
+    let fd = null;
+    try {
+        if (process.platform === "win32") {
+            // No O_NOFOLLOW on Windows; a reparse point is replaced, not read.
+            if (!lstatSync(path).isFile())
+                return false;
+            fd = openSync(path, "r");
+        }
+        else {
+            // Inspect and read the same inode the open landed on, so a swap
+            // between a stat and the read cannot be mistaken for a match.
+            // O_NONBLOCK keeps a FIFO planted at the path from hanging the open.
+            fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        }
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size !== Buffer.byteLength(data))
+            return false;
+        const uid = process.getuid?.();
+        if (uid !== undefined && stat.uid !== uid)
+            return false;
+        // Windows reports 0o666 for any writable file; its mode bits mean nothing.
+        if (mode !== undefined && process.platform !== "win32" && (stat.mode & 0o777 & ~mode) !== 0)
+            return false;
+        // Bytes, not strings: decoding and comparing a megabyte-sized registry as
+        // a JS string costs several times more than a memcmp of the raw bytes.
+        return readFileSync(fd).equals(Buffer.from(data));
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                /* best-effort cleanup */
+            }
+        }
+    }
+}
+/** writeFileAtomic for saves that often repeat what the file already holds.
+ * A save that changes nothing costs one open and read instead of a temp
+ * file, a rename and an fsync; a save whose size differs pays only an
+ * open and fstat before the normal write. Returns whether it wrote. */
+export function writeFileAtomicIfChanged(path, data, options = {}) {
+    if (holdsExactly(path, data, options.mode))
+        return false;
+    writeFileAtomic(path, data, options);
+    return true;
+}

package/dist-server/server/cloud-home-start.js

@@ -1,4 +1,4 @@
-// Entry point of the OMB Cloud Pro home image (deploy/fly/Dockerfile).
+// Entry point of the OMB Cloud Pro home image (the Dockerfile's cloud-home target).
 //
 // Starts as root, hands a fresh Fly volume (mounted root-owned at /data) to
 // the unprivileged `maus` user, and stays a small root supervisor of two
@@ -77,7 +77,7 @@ export function cloudHomeChildEnvironments(config, env, home) {
 /** Why the root supervisor must not run or trust `files`, or null: each
  * must be root's and not writable by anyone else (nor any folder above it),
  * and none may live on the volume `home`, which `maus` owns. The image makes its code
- * root's (deploy/fly/Dockerfile); a file `maus` could rewrite would run as
+ * root's (the Dockerfile's cloud-home target); a file `maus` could rewrite would run as
  * root at the next start, or be handed the secrets. */
 export function codeTrustProblem(files, home, stat = statSync) {
     const volume = posix.join(home, "/");
@@ -155,7 +155,7 @@ export function startCloudHome(env = process.env) {
     if (ids) {
         const problem = codeTrustProblem([process.execPath, fileURLToPath(import.meta.url), join(here, "index.js"), edgeBin, edgeConfig], home);
         if (problem)
-            throw new Error(`This image's code is not safe to run as root: ${problem}. Rebuild it from deploy/fly/Dockerfile.`);
+            throw new Error(`This image's code is not safe to run as root: ${problem}. Rebuild it with docker build --target cloud-home.`);
     }
     const { server, edge, secrets, dropped } = cloudHomeChildEnvironments(config, env, home);
     // Names only, never values: what the server does not get from here.

package/dist-server/server/config.js

@@ -24,6 +24,13 @@ export const FISH_TTS_MODELS = ["s2.1-pro", "s2.1-pro-free"];
 export const DEFAULT_ROOM_TURN_TIMEOUT_MINUTES = 5;
 export const MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
 export const MAX_ROOM_TURN_TIMEOUT_MINUTES = 1_440;
+/** Per-call ceiling for a bot's MCP tools (tools/call on the chat MCP
+ * transport). 10 minutes matches the historic constant in
+ * chat-mcp-tools.ts; a single tool call that runs longer is cut at this
+ * deadline because its execution outcome can no longer be trusted. */
+export const DEFAULT_MCP_CALL_TIMEOUT_MINUTES = 10;
+export const MIN_MCP_CALL_TIMEOUT_MINUTES = 1;
+export const MAX_MCP_CALL_TIMEOUT_MINUTES = 60;
 export const DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES = 30;
 export const DEFAULT_ROOM_HANDOFF_MIN_RUNWAY_MINUTES = 10;
 export const DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES = 240;
@@ -105,6 +112,16 @@ const roomConfigSchema = z.object({
     (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) &&
     (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) <=
         (rooms.handoffHardCapMinutes ?? DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES), { message: "rooms handoff bounds must satisfy handoffMinRunwayMinutes <= handoffLifetimeMinutes <= handoffHardCapMinutes" });
+const mcpConfigSchema = z.object({
+    /** Ceiling (minutes) for one bot MCP tool call. Missing values resolve to
+     * 10, preserving the historic chat-mcp-tools constant. */
+    callTimeoutMinutes: z
+        .number()
+        .int()
+        .min(MIN_MCP_CALL_TIMEOUT_MINUTES)
+        .max(MAX_MCP_CALL_TIMEOUT_MINUTES)
+        .optional(),
+}).strict();
 /** Isolation for bot desktops. Migration note (issue #1654): switching
  * modes changes lease keys and vm-home directories, so desktops cold-start
  * under the new mode — a pool seat lives in vm-homes/pool-N — while the old
@@ -503,6 +520,7 @@ const appConfigSchema = z.object({
      * system language. Unknown tags degrade to English in the renderer. */
     language: optionalText,
     rooms: roomConfigSchema.optional(),
+    mcp: mcpConfigSchema.optional(),
     context: z.object({
         rebuildBytes: z.number().int().min(1_024).max(1_000_000).optional(),
         compactAt: z.number().positive().max(10_000_000).optional(),
@@ -635,6 +653,9 @@ export function browserEngineAttachCdpUrl(cfg) {
 export function roomTurnTimeoutMinutes(cfg) {
     return cfg.rooms?.turnTimeoutMinutes ?? DEFAULT_ROOM_TURN_TIMEOUT_MINUTES;
 }
+export function mcpCallTimeoutMinutes(cfg) {
+    return cfg.mcp?.callTimeoutMinutes ?? DEFAULT_MCP_CALL_TIMEOUT_MINUTES;
+}
 export const LIVE_IDLE_MINUTES_DEFAULT = 5;
 /** Non-secret Live settings. The key only shows up as `configured`. */
 export function liveSettingsFor(cfg) {
@@ -1204,7 +1225,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "mcp", "threads", "context", "memory", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;

package/dist-server/server/connector-card-text.js

@@ -0,0 +1,15 @@
+// The plain line a connection card carries beside its `connector` payload.
+//
+// Desktop and current phones draw `kind: "connector"` as a card and never
+// read this. It exists for clients that do not know the kind yet — phone
+// builds from before the in-chat card shipped decode it as "unknown" and draw
+// whatever `text` a message has, so without it they showed nothing at all
+// while the bot sat waiting for a connection. Exports and backups read it too.
+// It names the app and points at the card; it never carries a link, because
+// the authorization URL is only ever handed to the person's own client.
+/** "Connect GitHub to continue." — or, for a second account, the alias too. */
+export function connectorCardText(label, alias) {
+    const app = label.replace(/\s+/g, " ").trim() || "this app";
+    const account = alias?.replace(/\s+/g, " ").trim();
+    return account ? `Connect ${app} as “${account}” to continue.` : `Connect ${app} to continue.`;
+}

package/dist-server/server/default-model-selection.js

@@ -1,10 +1,13 @@
 const claudeFirst = (instances) => instances.find((instance) => instance.driverKind === "claudeAgent") ?? instances[0];
+/** Installed and waiting on a sign-in. A custom endpoint brings its own
+ * credential, so its sign-in state does not count. */
+export function signedOut(instance) {
+    return instance.snapshot.state === "available" && instance.access !== "custom" && instance.snapshot.authenticated === false;
+}
 /** The ready rule: an engine can run a turn now when it is available, the
- * organisation allows it, and it is not signed out. A custom endpoint brings
- * its own credential, so its sign-in state does not count. */
+ * organisation allows it, and it is not signed out (signedOut). */
 export function readyToRun(instance, context = {}) {
-    return instance.snapshot.state === "available" && context.refusal?.(instance) === undefined &&
-        (instance.access === "custom" || instance.snapshot.authenticated !== false);
+    return instance.snapshot.state === "available" && context.refusal?.(instance) === undefined && !signedOut(instance);
 }
 /** The engine a new bot gets, and the one a bot moved off a removed engine
  * gets (computer-engine-removal.ts): one picker for both.

package/dist-server/server/drivers/acp/core.js

@@ -31,6 +31,7 @@ import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { PROVIDER_CREDENTIAL_ENV, stripControlPlaneEnv, WORKSPACE_CREDENTIAL_ENV } from "../../config.js";
 import { decodeInjectId } from "../local-inject.js";
+import { DeviceAuthController } from "../device-auth.js";
 import { deletePromptSplitReceipt, promptHalves, readPromptSplitReceipt, splitSessionPrompt, writePromptSplitReceipt } from "../prompt-split.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../../procs.js";
 import { classifyQuiet, describeQuiet, lastSeenPhrase, LogTail, quietKey, sampleProcessTree, } from "./quiet-status.js";
@@ -373,6 +374,9 @@ export function createAcpDriver(support) {
             };
             if (support.resolveModelsOnCreate !== false)
                 await refreshModels();
+            const deviceSignIn = support.deviceSignIn
+                ? new DeviceAuthController(support.deviceSignIn, { cli: config.cli, environment: () => childEnv(), onAuthenticated: refreshModels })
+                : null;
             const listeners = new Set();
             const active = new Map();
             // One live agent process per thread, kept across turns — the Claude
@@ -1904,6 +1908,11 @@ export function createAcpDriver(support) {
                     return models;
                 },
                 refreshModels: support.resolveModels ? refreshModels : undefined,
+                ...(deviceSignIn ? {
+                    startAuthentication: () => deviceSignIn.start(),
+                    getAuthentication: (flowId) => deviceSignIn.get(flowId),
+                    cancelAuthentication: () => deviceSignIn.cancel(),
+                } : {}),
                 snapshot,
                 adapter: {
                     provider: DRIVER_KIND,
@@ -1950,6 +1959,7 @@ export function createAcpDriver(support) {
                     },
                 },
                 dispose: async () => {
+                    await deviceSignIn?.dispose();
                     for (const { stop } of active.values())
                         stop();
                     for (const threadId of Array.from(sessions.keys()))

package/dist-server/server/drivers/acp/grok.js

@@ -20,6 +20,45 @@ export const STATIC_GROK_MODELS = {
     ],
 };
 const SLUG = /^[a-z0-9][a-z0-9._-]*$/i;
+/** Grok's own home: `$GROK_HOME`, else `~/.grok`. Its grok.com sign-in,
+ * config and catalog all live here. */
+export function grokHome(env = process.env) {
+    return env.GROK_HOME || harnessHome("grok", env);
+}
+/** The grok.com sign-in a turn runs on is stored. */
+export function grokSignedIn(env) {
+    return existsSync(join(grokHome(env), "auth.json"));
+}
+function grokLoginFailure(output) {
+    if (/(unexpected argument|unrecognized (argument|option)|unknown option).*device-(auth|code)/i.test(output)) {
+        return "This server's Grok is too old to sign in with a code. Update Grok on the server, then try again.";
+    }
+    if (/device-code login is not available/i.test(output)) {
+        return "This Grok account can't sign in with a code. Use an xAI API key instead.";
+    }
+    if (/expired/i.test(output))
+        return "The Grok sign-in code expired. Start sign-in again for a new code.";
+    if (/denied|rejected/i.test(output))
+        return "Grok sign-in was declined in the browser. Start sign-in again to try once more.";
+    return "Grok sign-in did not finish. Check the server's connection, then try again.";
+}
+/** Grok Build's half of the in-app sign-in (device-auth.ts): `grok login
+ * --device-auth` on the grok.com subscription. Grok has no status command,
+ * so nothing is checked first, and a stored login that a failed turn just
+ * refused is signed in again; the sign-in is confirmed the way a turn checks
+ * it. Checked against grok 1.0.25 and 1.0.41: `login --help` and the
+ * device-code text in their binaries. */
+export const GROK_DEVICE_SIGN_IN = {
+    provider: "grok",
+    product: "Grok",
+    account: "Grok",
+    homeEnv: "GROK_HOME",
+    homeDir: ".grok",
+    loginArgs: ["login", "--device-auth"],
+    install: "Install it with xAI's installer (https://x.ai/cli), then try again.",
+    failure: grokLoginFailure,
+    signedIn: grokSignedIn,
+};
 function unquote(raw) {
     const value = raw.trim();
     if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
@@ -30,7 +69,7 @@ function unquote(raw) {
 /** Local slugs from ~/.grok/config.toml, plus the cloud defaults.
  *  `grok -m <slug>` already accepts these; the picker just didn't list them. */
 export function readGrokModelCatalog(env = process.env) {
-    const path = join(env.GROK_HOME || harnessHome("grok", env), "config.toml");
+    const path = join(grokHome(env), "config.toml");
     let text = "";
     try {
         text = readFileSync(path, "utf8");
@@ -112,7 +151,7 @@ export function ensureGrokInjectSlug(modelId, env = process.env) {
     const host = localHost(inject.host);
     if (!host)
         return modelId;
-    const path = join(env.GROK_HOME || harnessHome("grok", env), "config.toml");
+    const path = join(grokHome(env), "config.toml");
     let text = "";
     try {
         text = readFileSync(path, "utf8");
@@ -215,7 +254,7 @@ export function grokInheritedProfile(cli, env, cwd) {
     let path = flag >= 0 ? (args[flag].includes("=") ? args[flag].slice(args[flag].indexOf("=") + 1) : args[flag + 1]) : undefined;
     if (flag >= 0 && (!path || path.startsWith("-")))
         return unsupported();
-    const files = [join(env.GROK_HOME || harnessHome("grok", env), "config.toml")];
+    const files = [join(grokHome(env), "config.toml")];
     for (let directory = resolve(cwd);;) {
         const file = join(directory, ".grok", "config.toml");
         if (!files.includes(file))
@@ -331,7 +370,7 @@ const support = {
     effortLevels: ["low", "medium", "high"],
     defaultCli: "grok",
     nativeSource: "grok.acp",
-    loginNote: "Grok CLI is not signed in — run `grok login` in a terminal",
+    loginNote: "Grok is not signed in to your grok.com account — choose Sign in to Grok in engine setup",
     // No Windows one-liner: the installer is a POSIX shell script, and offering
     // `curl … | bash` there would be advice that cannot run. Windows falls back
     // to docsUrl, which is honest rather than broken.
@@ -341,8 +380,11 @@ const support = {
             linux: "curl -fsSL https://x.ai/cli/install.sh | bash",
         },
         docsUrl: "https://x.ai/cli",
+        // The terminal route, for people who prefer it; the app's own sign-in
+        // is the device code below, which needs no terminal.
         signInCommand: "grok login",
     },
+    deviceSignIn: GROK_DEVICE_SIGN_IN,
     // Write the [model.slug] block with the instance HOME/GROK_HOME, then pass
     // the slug on argv. spawnArgs must not call ensureGrokInjectSlug itself —
     // that helper defaults to process.env and would miss the instance override.
@@ -458,7 +500,7 @@ const support = {
     // an unauthenticated CLI is a user action, not something to paper over.
     pickAuthMethod: (methods) => (methods.some((m) => m.id === "cached_token") ? "cached_token" : null),
     authFailure: "fail",
-    isAuthenticated: (env) => existsSync(join(harnessHome("grok", env), "auth.json")),
+    isAuthenticated: (env) => grokSignedIn(env),
     // `--append-system-prompt`/`--rules` are accepted by the CLI but do NOT
     // reach the agent-stdio system prompt (verified against 1.0.0), so the
     // persona is prepended codex-style.

package/dist-server/server/drivers/agents-catalog.js

@@ -26,6 +26,7 @@ export function catalogProfileFromEnv(env) {
         voiceNotes: env.OMB_VOICE_NOTES === "1",
         cloudHome: env.OMB_CLOUD_HOME === "1",
         memoryEnabled: env.OMB_MEMORY_ENABLED !== "0",
+        chief: env.OMB_CHIEF_OF_STAFF === "1",
         botId: env.OMB_BOT_ID ?? "",
     };
 }
@@ -146,7 +147,7 @@ const ROUTINE_FIELDS_SCHEMA = {
     },
     continuity: {
         type: "boolean",
-        description: "Opt in to using the latest completed run's bounded report as historical context. Defaults to false; set false in an update to start fresh again. Included in the applied result or pending confirmation.",
+        description: "Opt in to using the latest completed run's bounded report as historical context. Use it for recurring work that builds on last time, such as QA passes, monitoring or follow-ups. Defaults to false; set false in an update to start fresh again. Included in the applied result or pending confirmation.",
     },
     overlap: {
         type: "string",
@@ -154,6 +155,9 @@ const ROUTINE_FIELDS_SCHEMA = {
         description: "While this routine is still working, skip scheduled occurrences (default) or queue at most one run. Queue skips further occurrences until the pending run starts; it never builds an unlimited backlog. Manual and webhook requests are separate.",
     },
 };
+// propose_profile's one sentence about for_bot_id, which a bot that is not a
+// Chief is not shown (catalogTools), along with the parameter itself.
+const CHIEF_PROFILE_TARGET = " A Chief of Staff may pass for_bot_id (from list_bots) for a requested change to another bot in its section.";
 const PROPOSAL_OUTCOME = " Read the result: granted Full Access may apply the change immediately. If applied, continue the requested work without another confirmation. Only a pending result requires ending the turn and waiting for the in-app decision. Never claim success from the permission mode alone; report failed or cancelled results honestly. This does not elevate another bot's execution permissions.";
 /** Every tool, in the order it is listed. Four peer tools are worded
  * differently for an external runtime, which may poll inside one process. */
@@ -652,7 +656,7 @@ const toolDefinitions = (externalRuntime) => [
     },
     {
         name: "propose_profile",
-        description: "Submit user-requested changes to your own name, title, description, standing instructions (SOUL.md), working folder (cwd), or your alert and voice toggles (notifications, speakReplies). Keep SOUL.md short — who you are and the rules you never break; put step-by-step procedure into a skill instead. A Chief of Staff may pass for_bot_id (from list_bots) for a requested change to another bot in its section." + PROPOSAL_OUTCOME,
+        description: "Submit user-requested changes to your own name, title, description, standing instructions (SOUL.md), working folder (cwd), or your alert and voice toggles (notifications, speakReplies). Keep SOUL.md short — who you are and the rules you never break; put step-by-step procedure into a skill instead." + CHIEF_PROFILE_TARGET + PROPOSAL_OUTCOME,
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -842,6 +846,14 @@ export const SHARED_COMPUTER_TOOL_NAMES = new Set(["list_shared_computers", "sha
 // tool whose every call would end in a setup error. The route behind it
 // refuses regardless; this keeps the catalog honest about what can work.
 const VOICE_TOOL_NAMES = new Set(["send_voice_note"]);
+// And for a role: every route behind these refuses a bot that is not its
+// section's Chief of Staff, as it does a for_bot_id naming another bot on
+// propose_profile or propose_model. (A routine's for_bot_id is open to any
+// bot that can reach that peer, so it stays.)
+const CHIEF_ONLY_TOOL_NAMES = new Set([
+    "create_bot", "list_team_setup", "propose_team_setup", "propose_bot_deletion", "create_room", "manage_room", "retry_thread",
+]);
+const CHIEF_TARGET_TOOL_NAMES = new Set(["propose_profile", "propose_model"]);
 // One teamwork path in room turns; keep all unrelated integrations available.
 // Ordinary direct chats use this same bounded coordinator. Goal-owned turns
 // retain their independent loop and cannot start a second coordinator.
@@ -878,10 +890,18 @@ function catalogTools(profile) {
     const VOICE_READY_TOOLS = profile.voiceNotes
         ? SHAREABLE_TOOLS
         : SHAREABLE_TOOLS.filter((tool) => !VOICE_TOOL_NAMES.has(tool.name));
+    const ROLE_TOOLS = profile.chief
+        ? VOICE_READY_TOOLS
+        : VOICE_READY_TOOLS.filter((tool) => !CHIEF_ONLY_TOOL_NAMES.has(tool.name)).map((tool) => {
+            if (!CHIEF_TARGET_TOOL_NAMES.has(tool.name))
+                return tool;
+            const properties = Object.fromEntries(Object.entries(tool.inputSchema.properties).filter(([key]) => key !== "for_bot_id"));
+            return { ...tool, description: tool.description.replace(CHIEF_PROFILE_TARGET, ""), inputSchema: { ...tool.inputSchema, properties } };
+        });
     return profile.externalRuntime
         ? BOT_SCOPED_TOOLS.filter(tool => EXTERNAL_TOOL_NAMES.has(tool.name))
         : profile.coordinating
-            ? VOICE_READY_TOOLS.filter(tool => !ROOM_REPLACED_TOOLS.has(tool.name) || (tool.name === "start_thread" && profile.ownThreadCreation))
+            ? ROLE_TOOLS.filter(tool => !ROOM_REPLACED_TOOLS.has(tool.name) || (tool.name === "start_thread" && profile.ownThreadCreation))
                 .map(tool => tool.name === "start_thread" ? {
                 ...tool,
                 description: "Open a separate job on yourself with its own history and run, without switching the person's selected conversation. Use only when the user requests independent jobs (for example one review per pull request). Give a short specific title and complete instructions; you can open at most five per turn. This is not a teammate handoff: use coordinate_bots for teammates and their automatic replies. Self-opened jobs cannot recursively open more jobs. If refused, do not retry; explain what remains.",
@@ -889,5 +909,5 @@ function catalogTools(profile) {
                         bot_id: { type: "string", enum: [profile.botId], description: "Leave out, or use your own bot ID. For teammates use coordinate_bots." },
                     } },
             } : tool)
-            : VOICE_READY_TOOLS.filter(tool => !ROOM_ONLY_TOOLS.has(tool.name));
+            : ROLE_TOOLS.filter(tool => !ROOM_ONLY_TOOLS.has(tool.name));
 }

package/dist-server/server/drivers/agents-proxy.js

@@ -12,6 +12,7 @@
 //   OMB_COMMS_TOKEN  shared secret for the localhost-only internal endpoints
 //   OMB_TURN_DEPTH   this turn's comms depth (the harness refuses recursion)
 //   OMB_EXTERNAL_RUNTIME  "1" for a standing process: peer tools and polling only
+//   OMB_CHIEF_OF_STAFF    "1" for a Chief of Staff, the only bot shown the Chief-only tools
 //
 // This file is the stdio front end only. What the tools are and which a turn
 // sees: agents-catalog.ts. What a call does: agents-call.ts. How the harness

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -14,7 +14,9 @@ import { allowsTool, canUseMcpServer, parseToolScope } from "../../shared/tool-s
 export class ChatToolSessionError extends Error {
 }
 const STARTUP_MS = 8_000;
-const CALL_MS = 10 * 60_000;
+/** Historic per-call ceiling for a bot's MCP tools; a turn can override it
+ * with SendTurnInput.mcpCallTimeoutMs (server config `mcp.callTimeoutMinutes`). */
+const DEFAULT_CALL_MS = 10 * 60_000;
 const FRAME_BYTES = 2 * 1024 * 1024;
 const OUTPUT_BYTES = 50 * 1024;
 const TOOL_COUNT = 128;
@@ -283,7 +285,7 @@ function omitBlankDefaults(builtInBrowser, tool, args) {
             delete args[field];
     }
 }
-export async function mountChatTools(integrations, signal, computerUse = false, toolScope) {
+export async function mountChatTools(integrations, signal, computerUse = false, toolScope, callTimeoutMs = DEFAULT_CALL_MS) {
     const parsed = parseToolScope(toolScope);
     if (!parsed.ok)
         throw new Error(parsed.error);
@@ -411,7 +413,7 @@ export async function mountChatTools(integrations, signal, computerUse = false,
             }
             const tool = registered.get(name);
             try {
-                const result = await tool.client.call("tools/call", { name: tool.name, arguments: args }, AbortSignal.any([signal, callSignal]), CALL_MS);
+                const result = await tool.client.call("tools/call", { name: tool.name, arguments: args }, AbortSignal.any([signal, callSignal]), callTimeoutMs);
                 if (signal.aborted || callSignal.aborted)
                     throw aborted();
                 if (!object(result) || !Array.isArray(result.content) || (result.isError !== undefined && typeof result.isError !== "boolean"))

package/dist-server/server/drivers/claude-login-auth.js

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 import { killCliTree, spawnCli } from "../procs.js";
-import { canonicalPath } from "./codex-device-auth.js";
+import { canonicalPath } from "./device-auth.js";
 const MAX_OUTPUT = 32_768;
 /** Where Anthropic's sign-in lives. Anything else in the CLI's output is not a link we show. */
 const SIGN_IN_HOSTS = ["claude.com", "claude.ai", "console.anthropic.com", "platform.claude.com"];

package/dist-server/server/drivers/claude.js

@@ -15,7 +15,7 @@ import { createServer as createNetServer } from "node:net";
 import { homedir, tmpdir } from "node:os";
 import { join, dirname, isAbsolute, normalize } from "node:path";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "../config.js";
-import { writeFileAtomic } from "../atomic.js";
+import { writeFileAtomic, writeFileAtomicIfChanged } from "../atomic.js";
 import { augmentedPath } from "../env-path.js";
 import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
@@ -599,6 +599,9 @@ export async function createPermissionBroker(opts) {
     let boundPath = opts.socketPaths[0] ?? "";
     const connectionHandler = (conn) => {
         conn.on("error", () => { });
+        // An ask carries the whole tool input (a Write's file content), so one
+        // line spans many reads. Decode as a stream so no character is split.
+        conn.setEncoding("utf8");
         let buf = "";
         conn.on("data", (chunk) => {
             buf += chunk;
@@ -932,8 +935,10 @@ function recordCostState(sessionId, state) {
     const ids = Object.keys(history);
     for (const id of ids.slice(0, Math.max(0, ids.length - COST_HISTORY_SESSIONS)))
         delete history[id];
+    // Written after every turn, so not fsynced: what a power cut could lose is
+    // the same thing a failed write already gives up (below).
     try {
-        writeFileAtomic(COST_HISTORY_FILE, JSON.stringify(history), { mode: 0o600 });
+        writeFileAtomic(COST_HISTORY_FILE, JSON.stringify(history), { mode: 0o600, durable: false });
     }
     catch {
         // a lost state only means a later resume keeps its whole figure
@@ -1051,6 +1056,26 @@ export const ClaudeDriver = {
         const readCliVersion = (env) => new Promise((resolve) => {
             execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout.trim() || null));
         });
+        // The --help read while it runs: snapshots that overlap (the server's
+        // read at start and the app's first one) share it.
+        let helpRead = null;
+        const readCliHelp = (version, env) => {
+            if (helpRead?.version === version)
+                return helpRead.done;
+            const read = {
+                version,
+                done: new Promise((resolve) => {
+                    execCli(config.cli, ["--help"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout));
+                }).then((help) => {
+                    cliHasAutocompact = help === null ? null : /^\s*--autocompact\b/m.test(help);
+                    cliHelpVersion = version;
+                    if (helpRead === read)
+                        helpRead = null;
+                }),
+            };
+            helpRead = read;
+            return read.done;
+        };
         const listeners = new Set();
         // one active turn per thread; a second send while busy is a caller bug
         const active = new Map();
@@ -1411,14 +1436,18 @@ export const ClaudeDriver = {
                 ? readClaudeAuthSettings(env, input.environment) : {};
             // Harness hooks (item 0.2): one helper command for the events the
             // harness observes. The helper reads its bearer from a per-thread file
-            // the harness rewrites every turn, so a long-lived CLI process never
+            // the harness refreshes every turn, so a long-lived CLI process never
             // presents a stale token. Registered through the same private
             // --settings file as the auth override; both are 0600 and per launch.
             const hooks = turn.integrations?.hooks;
             const hookTokenPath = hooks ? hookTokenFile(threadId, botId) : null;
             if (hooks && hookTokenPath) {
                 mkdirSync(dirname(hookTokenPath), { recursive: true, mode: 0o700 });
-                writeFileAtomic(hookTokenPath, hooks.token, { mode: 0o600 });
+                // The bearer is usually the same as last turn, and it only lives in
+                // this process's memory, so a restart invalidates the file anyway:
+                // skip identical bytes and the fsync. A rotated bearer differs from
+                // what is on disk, so it is always written before the CLI launches.
+                writeFileAtomicIfChanged(hookTokenPath, hooks.token, { mode: 0o600, durable: false });
                 env.OMB_HOOK_URL = hooks.url;
                 env.OMB_HOOK_TOKEN_FILE = hookTokenPath;
                 env.OMB_HOOK_NODE = process.execPath;
@@ -2303,13 +2332,8 @@ export const ClaudeDriver = {
                 return { state: "unavailable", reason: `\`${config.cli}\` CLI not found` };
             cliVersion = parseClaudeCliVersion(version);
             cliVersionChecked = true;
-            if (version !== cliHelpVersion) {
-                const help = await new Promise((resolve) => {
-                    execCli(config.cli, ["--help"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout));
-                });
-                cliHasAutocompact = help === null ? null : /^\s*--autocompact\b/m.test(help);
-                cliHelpVersion = version;
-            }
+            if (version !== cliHelpVersion)
+                await readCliHelp(version, env);
             const update = claudeCliUpdate(version, config.cli);
             const warning = claudeInheritWarning(env);
             if (config.requireApiKey) {