openmausbot 0.1.97 → 0.1.98

package/dist-server/server/index.js

@@ -52,7 +52,7 @@ import { messageFileDisposition, messageFileDownloadName, messageAttachmentName,
 import { avatarGenerationRequestSchema, avatarGenerationStateMatches, generateAvatarImage, avatarImageStatus, snapshotAvatarGenerationState, } from "./avatar-image.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
-import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
+import { RoomTurnDeadline, RoomTurnStallRegistry, effectiveRoomTurnTimeoutMinutes, parseConversationTurnTimeout, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
 import { roomTurnEnd } from "./room-turn-end.js";
 import { pickComputer } from "./computer-selection.js";
 import * as boat from "./boat.js";
@@ -67,6 +67,7 @@ import { liveCardKind, liveDecisionRefusal } from "../shared/live-approval.js";
 import { boatAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { connectorCallFromFrame, connectorRefusalText, connectorUnrecognizedText, evaluateConnectorTools } from "./connector-verdict.js";
+import { connectorCardText } from "./connector-card-text.js";
 import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
 import { buildRecall } from "./recall.js";
 import { createMemoryUpkeep, upkeepEnabled } from "./memory-upkeep.js";
@@ -74,7 +75,7 @@ import { appendAboutMe, commitLearned, planLearned } from "./profile-learned.js"
 import { canAccessTeam, canReachPeer, coordinatorSupervises, livePeerRoster, livePeerRosterBlock, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmWakeAction, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
 import { attachForTurn, saveBotAttachment } from "./bot-attachment.js";
-import { cacheUntilConfigChanges, ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, mergeOpenCodeProviderKeys, openCodeProviderKeys, } from "./config.js";
+import { cacheUntilConfigChanges, ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, mcpCallTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, mergeOpenCodeProviderKeys, openCodeProviderKeys, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -83,7 +84,8 @@ import { appendUsage, parseUsageRange, readUsage, summarizeUsage, usageCsv, USAG
 import { loadPlanUsage, planAccountsFromInstances } from "./plan-usage.js";
 import { GroupUsageReader } from "./group-thread-usage.js";
 import { ledgerCost } from "./model-prices.js";
-import { checkProviderKey, PROVIDER_KEY_KINDS } from "./provider-key-check.js";
+import { checkProviderKey, PROVIDER_KEY_KINDS, providerBaseUrl } from "./provider-key-check.js";
+import { forgetKey, noteKeyAccepted, noteKeyRejected, onKeyRejectionChange } from "./key-rejections.js";
 import { assertWithinBudget, noteSpend, spendAlertText, spendState, takeSpendAlert } from "./spend.js";
 import { fleetAvailable, fleetRequest, fleetSocketPath } from "./fleet-client.js";
 import { entitled } from "./enterprise.js";
@@ -126,12 +128,13 @@ import { createCloudMoveRoutes, workspaceShared } from "./cloud-move-http.js";
 import { RESTART_EXIT_CODE } from "./restart.js";
 import { holdIncludedServices } from "./included-services.js";
 import { selectDefaultModelSelection, withNewBotEffort } from "./default-model-selection.js";
+import { threadModelFallback } from "./thread-model.js";
 import { computerEngineMoveText, removedComputerInstanceIds, writeComputerEngineMoveLines } from "./computer-engine-removal.js";
 import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, peerApprovalFailure, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
 import { peerDeliveryReceipt } from "./peer-delivery.js";
 import { peerProvenanceNote, withPeerProvenance } from "./peer-provenance.js";
 import { decideRoomPost, emptyRoomPostBudget } from "./room-post-budget.js";
-import { isProjectEmoji, mentionedBots, parseConnectorTools, roomResponders, sectionKey, Store, titleFromLlm, toWireTask, } from "./store.js";
+import { isProjectEmoji, mentionedBots, parseConnectorTools, roomResponders, sectionKey, Store, threadTitleFrom, titleFromLlm, toWireTask, } from "./store.js";
 import * as tts from "./tts/index.js";
 import { createDecider, deciderIncludedHere, deciderReady, deciderSavePatch, describeDecider } from "./decider/index.js";
 import { decideRoomResponder } from "./decider/room-routing.js";
@@ -244,6 +247,7 @@ import { createHostedSlackRoutes } from "./routes/hosted-slack.js";
 import { createBotPresetRoutes } from "./routes/bot-presets.js";
 import { createBotMemoryRoutes } from "./routes/bot-memory.js";
 import { createDeciderRoutes } from "./routes/decider.js";
+import { createThreadModelRoutes } from "./routes/thread-models.js";
 import { createDesktopViewer, desktopViewerUrl } from "./routes/desktop-viewer.js";
 import { localDesktopTarget, localVmViewerStatus, viewerTargetId } from "./desktop-viewer-targets.js";
 import { createAntigravityLeftoverRoutes } from "./routes/antigravity-leftovers.js";
@@ -835,12 +839,13 @@ function openerFrom(fromThreadId) {
         return person;
     return person && !cloudOwnerPerson(person) ? person : CLOUD_NOBODY_KEY;
 }
-/** The model a thread a bot opens from one of its own threads starts on:
- * that thread's, not the bot default the person may have moved away from
- * (#1950). Only the bot's own thread counts — a room or a teammate's thread
- * is not one of its tasks, and another bot's model belongs to another engine.
- * Approval stays the bot's, except that a level the inherited engine would
- * have to confirm on a model switch starts the new thread in Ask. */
+/** The model a thread a bot opens from one of its own threads starts on
+ * (#1950): the model a person picked in that thread, kept as the new thread's
+ * own. A thread that follows the bot opens one that follows it too. Only the
+ * bot's own thread counts — a room or a teammate's thread is not one of its
+ * tasks, and another bot's model belongs to another engine. Approval stays
+ * the bot's, except that a level the inherited engine would have to confirm
+ * on a model switch starts the new thread in Ask. */
 function parentThreadModel(botId, parentThreadId) {
     // The stored profile, never a per-thread projection: the comparison is
     // against the defaults the new thread would otherwise get.
@@ -1668,6 +1673,9 @@ const managedPolicy = new ManagedDesktopPolicy({ onChange: () => {
         broadcast({ kind: "config", ...configStatus() });
         resyncOpenCodeProviderKeys();
     } });
+// A key the provider refused, or accepted again, changes what Model
+// providers and the picker show; the config event refreshes /api/instances.
+onKeyRejectionChange(() => broadcast({ kind: "config", ...configStatus() }));
 /** A computer kind this server will not use, refused before anything is
  * prepared: a Cloud home never offers this computer or a Local VM
  * (cloud-home.ts), and an enrolled organisation may disallow any kind. */
@@ -2055,6 +2063,9 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, r
                 const speaking = botForThread(botId, threadId) ?? store.bot(botId);
                 return tts.voiceReady(cfg, speaking?.voice) && speaking?.voiceNotes !== false ? "1" : "0";
             })(),
+            // And for a role: team setup, bot creation and deletion, rooms and
+            // retries are shown only to a Chief of Staff, whom their routes require.
+            OMB_CHIEF_OF_STAFF: store.bot(botId)?.chiefOfStaff === true ? "1" : "0",
         },
     };
 }
@@ -3005,6 +3016,62 @@ function checkedTaskModelSwitch(current, raw, updateBotDefault, resetApprovalToA
     }
     return checked;
 }
+/** An engine as a turn's start sees it, without waiting on its CLI: the live
+ * instance and what its last read said (registry.lastSnapshot). Before the
+ * first read it counts as available, so only what is known stops a pick. */
+function threadEngine(instanceId) {
+    const live = registry.get(instanceId);
+    if (!live)
+        return undefined;
+    return {
+        instanceId, driverKind: live.driverKind, enabled: live.enabled, models: live.models,
+        capabilities: { modelVariants: live.adapter.capabilities.modelVariants === true },
+        snapshot: registry.lastSnapshot(instanceId) ?? { state: "available" },
+        access: providerConfigs()[instanceId]?.access ?? registry.access(instanceId),
+    };
+}
+/** This thread's own model, when it gives way to its bot's now
+ * (threadModelFallback); null when the thread follows its bot or its own
+ * model runs as picked. */
+function threadModelGivingWay(botId, threadId) {
+    const bot = store.bot(botId);
+    const own = store.taskByThread(botId, threadId)?.modelSelection;
+    if (!bot || !own)
+        return null;
+    return threadModelFallback(own, bot.modelSelection, threadEngine, {
+        refusal: policyModelRefusal,
+        ...(hostedModels ? { allows: (selection) => hostedModels.allows(selection) } : {}),
+    }) ? own : null;
+}
+/** The model a turn in this thread would run on now (healThreadModel). */
+function turnSelection(botId, threadId) {
+    return threadModelGivingWay(botId, threadId) ? store.bot(botId)?.modelSelection : store.projectBotForTask(botId, threadId)?.modelSelection;
+}
+/** A model as a person reads it: its catalog label, after its engine's name
+ * while that engine is here. */
+function modelName(selection) {
+    const instance = registry.get(selection.instanceId);
+    const label = instance?.models.options.find((option) => option.id === selection.model)?.label ?? selection.model;
+    return instance ? `${instance.displayName || instance.driverKind} · ${label}` : label;
+}
+/** A thread's own model that can't run here gives way to its bot's: the turn
+ * about to start runs on the bot's model, the thread follows the bot from
+ * then on, and one plain line in it says so. Every turn starts through
+ * startTurn (a person's message, a routine, a delegation, a webhook, a
+ * queued follow-up), so this is the one place it happens; a room turn
+ * already runs on each member's own model. */
+function healThreadModel(botId, threadId) {
+    const bot = store.bot(botId);
+    const own = threadModelGivingWay(botId, threadId);
+    if (!bot || !own || bot.approvalGrant || threadBusy(botId, threadId))
+        return;
+    if (!store.followBotModel(botId, [threadId], (from, to) => hostedModels?.resetTask(from, to) ?? {}).length)
+        return;
+    store.appendMessage(threadId, { role: "bot", kind: "activity", tool: {
+            name: `notice: This thread's model (${modelName(own)}) isn't available, so it now uses ${bot.name}'s model (${modelName(bot.modelSelection)}).`,
+            ok: true,
+        } });
+}
 function checkedExportSkillNames(value, bots) {
     // Sharing instructions is explicit: ordinary package exports include none.
     if (value === undefined)
@@ -3201,15 +3268,27 @@ function checkedMemberIds(value) {
     return { ok: true, memberIds };
 }
 let bootSelection = { instanceId: "", model: "" };
+/** The engines read at start, while it runs (below). It is where the server
+ * learns what each engine supports (a Claude CLI's version and flags), so a
+ * turn waits for it, as every turn did when the server listened only after
+ * that read. */
+let enginesRead = null;
 /** Preset bots for New bot, from shared files and the organization (presets.ts). */
 const presetStore = createPresetStore();
-const store = new Store(() => bootSelection, (selection) => withNewBotEffort(selection, cfg.newBots?.effort, registry.get(selection.instanceId)?.adapter.capabilities.effortLevels));
+const store = new Store(() => bootSelection, (selection) => withNewBotEffort(selection, cfg.newBots?.effort, registry.get(selection.instanceId)?.adapter.capabilities.effortLevels), (instanceId) => registry.cliTarget(instanceId)?.driverKind);
 const teamComputers = new TeamComputers(join(DATA_DIR, "team-computers.json"), ENVIRONMENT_ID);
 let followupsReady = false;
 const sendSequencer = new SendSequencer();
 // Before the new-bot default is read: a saved default may name the engine.
 await retryComputerEngineMove();
-bootSelection = await defaultSelection();
+// Reading the new-bot default probes every engine CLI (each up to its
+// timeout), and at start only the first-run seed needs the answer. A later
+// start listens without waiting: the same read runs behind it, and turns
+// wait for it (enginesRead).
+if (store.needsSeed())
+    bootSelection = await defaultSelection();
+else
+    enginesRead = defaultSelection().then((selection) => { bootSelection = selection; }, (error) => console.warn(`[engines] reading the engines at start failed: ${error instanceof Error ? error.message : String(error)}`)).finally(() => { enginesRead = null; });
 store.seedIfEmpty();
 hostedModels?.reconcile(store);
 // Skills library boot sweep (features.skillsLibrary): migrate per-bot
@@ -3263,11 +3342,13 @@ if (browserCleanupReferencesReconciled)
  * than the desktop window did. Stripped here rather than at each call site
  * so a new broadcast cannot forget. */
 let activeCoordinationForThread = (_threadId) => false;
-const wireTask = (task) => {
+/** One thread as a client sees it. `botModel` is its bot's model: a thread
+ * without a model of its own runs on it (toWireTask). */
+const wireTask = (task, botModel) => {
     // Time-based snoozes heal on read against the server clock — no client
     // timer, no device skew. The 0 sentinel ("until new activity") is not a
     // time and survives reads; only a wake event in the store clears it.
-    const { snoozedUntil, ...base } = toWireTask(task);
+    const { snoozedUntil, ...base } = toWireTask(task, botModel);
     const coordinated = { ...base, waitingForTeammates: activeCoordinationForThread(task.threadId) && !task.busy };
     const asleep = snoozedUntil === 0 || (snoozedUntil !== undefined && snoozedUntil > Date.now());
     return asleep ? { ...coordinated, snoozedUntil } : coordinated;
@@ -3281,7 +3362,7 @@ const wireBot = (bot) => {
         ? { ...rest, approvalMode: "ask", autoApprove: false }
         : rest;
     return { ...visible, waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
-        avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
+        avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map((task) => wireTask(task, bot.modelSelection)) } : {}) };
 };
 function toolScopeForTurn(botId) {
     const bot = store.bot(botId);
@@ -3296,7 +3377,7 @@ function toolScopeForTurn(botId) {
  * can validate it before sending the confirmation that makes it effective. */
 const wireTrustedApprovalBot = (bot) => {
     const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
-    return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
+    return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map((task) => wireTask(task, bot.modelSelection)) } : {}) };
 };
 /** A settings-based preview, not a receipt of a dispatched turn. No
  * provisioning or credentials are needed to inspect it. The selected engine
@@ -3950,7 +4031,7 @@ const storedAvatarExists = (avatarUrl) => attachmentExists(avatarUrl.slice("/api
 const publicBot = (bot) => ({
     ...wireBot(bot),
     ...messagePage(bot.threadId, DEFAULT_PAGE),
-    tasks: store.tasks(bot.id).map(wireTask),
+    tasks: store.tasks(bot.id).map((task) => wireTask(task, bot.modelSelection)),
 });
 const publicBotQueuedMessages = () => queuedSteerSnapshot((botId, threadId) => Boolean(store.taskByThread(botId, threadId)));
 // busyBotId names only the speaker that currently owns the provider process.
@@ -4142,6 +4223,15 @@ function updateChannel(groupId, value) {
             throw Object.assign(new Error("invalid default responder"), { status: 400 });
         patch.defaultResponder = responder;
     }
+    if (Object.prototype.hasOwnProperty.call(body, "turnTimeoutMinutes")) {
+        if (!existing.dm) {
+            throw Object.assign(new Error("set the turn limit on that conversation"), { status: 400 });
+        }
+        const parsed = parseConversationTurnTimeout(body.turnTimeoutMinutes);
+        if (!parsed.ok)
+            throw Object.assign(new Error(parsed.error), { status: 400 });
+        patch.turnTimeoutMinutes = parsed.minutes;
+    }
     if (body.cwd !== undefined) {
         if (existing.dm)
             throw Object.assign(new Error("direct-message channels cannot have a working folder"), { status: 400 });
@@ -4462,7 +4552,14 @@ function publicGroupState(record) {
         usage = groupUsageReader.forThread(group.threadId);
     }
     catch { /* accounting must not block chat */ }
-    return { ...group, usage: usage ?? null, working: groupIsWorking(group) || [...roomHandoffs.nodes.values()].some(n => n.groupId === group.id && !["completed", "failed", "cancelled"].includes(n.status)) };
+    return {
+        ...group,
+        // Always present so a client can tell "back to the group default"
+        // apart from a partial patch that did not mention the field.
+        turnTimeoutMinutes: record.turnTimeoutMinutes ?? null,
+        usage: usage ?? null,
+        working: groupIsWorking(group) || [...roomHandoffs.nodes.values()].some(n => n.groupId === group.id && !["completed", "failed", "cancelled"].includes(n.status)),
+    };
 }
 function beginGroupTurnOperation(groupId, threadId, botIds = []) {
     const operation = {
@@ -8847,6 +8944,8 @@ async function startTurn(botId, text, opts) {
             },
         };
     }
+    // A thread whose own model can't run runs on its bot's from now on.
+    healThreadModel(botId, threadId);
     const bot = store.projectBotForTask(botId, threadId);
     if (!bot)
         throw Object.assign(new Error("no such task"), { status: 404 });
@@ -9088,6 +9187,11 @@ async function startTurn(botId, text, opts) {
     turnContext.delete(threadId);
     void (async () => {
         try {
+            if (enginesRead) {
+                await enginesRead;
+                if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId))
+                    throw new DirectTurnSetupCancelled("turn stopped while the engines were read");
+            }
             // Readiness can wait on the network. Admit the task first so its busy
             // state, Stop action and watchdog own that wait just like VM setup.
             if (opts?.runOn === "cloud") {
@@ -10042,6 +10146,7 @@ async function startTurn(botId, text, opts) {
                 mentionTurn: tagged.length > 0,
                 integrations,
                 mcpFromUserConfig: claudeUserMcpEnabled(cfg) && !managedPolicy.restrictsMcp(),
+                mcpCallTimeoutMs: mcpCallTimeoutMinutes(cfg) * 60_000,
                 cwd,
             }), () => !directTurnClaimExists(bot.id, dispatchClaimId, threadId), async () => {
                 await instance.adapter.interruptTurn(threadId).catch(() => { });
@@ -10279,6 +10384,9 @@ function routineSourceOwner(run) {
             ? { bot, group: undefined, threadId: task.threadId }
             : null;
     }
+    // Without a results snapshot (a run from before every routine reported to
+    // its bot's main thread, or a bot with no visible thread) the chat that
+    // made the routine is the destination.
     const threadId = run.sourceThreadId?.trim();
     if (!threadId)
         return null;
@@ -10299,6 +10407,21 @@ function routineSourceOwner(run) {
     const group = store.groupByThread(threadId);
     return group?.memberIds.includes(bot.id) ? { bot, group, threadId } : null;
 }
+/** There is no durable "main thread" (bot.threadId is only the UI
+ * selection), so a routine reports into the bot's oldest open conversation:
+ * the one it was created with until that is deleted or archived. Deleting
+ * the last one already gives the bot a fresh conversation (Store.deleteTask). */
+function botMainThread(botId) {
+    const visible = store.tasks(botId).filter((task) => !task.routineRunId);
+    const open = visible.filter((task) => task.archivedAt === undefined);
+    return (open.length ? open : visible).reduce((oldest, task) => (!oldest || task.createdAt < oldest.createdAt ? task : oldest), undefined)?.threadId;
+}
+/** Routines without a chosen thread used to get an automatic "<name> ·
+ * Results" thread. One nobody renamed is that automatic default, not a
+ * choice: new runs move to the main thread, and the old thread stays. */
+function legacyResultsThread(routineName, task) {
+    return task.title.endsWith(" · Results") || task.title === threadTitleFrom(`${routineName} · Results`);
+}
 function routineSourceThread(run) {
     return routineSourceOwner(run)?.threadId ?? null;
 }
@@ -10532,21 +10655,32 @@ routines = new RoutineManager({
         return Boolean(bot && !bot.hidden && task && !task.routineRunId);
     },
     resolveResultsThread: (routine, forceNew) => {
-        // A trusted chat source is already snapshotted as sourceThreadId on each
-        // run. Keep it distinct: it can belong to a teammate or room, whereas an
-        // explicit resultsThreadId must be a visible task owned by the running bot.
-        if (!forceNew && routineSourceOwner(routine))
-            return routine.resultsThreadId;
+        // Every run reports into the routine's bot's main thread, wherever the
+        // routine was made (chat, editor, API, or a teammate's request). A run
+        // still executes in its own hidden task, which Run logs and Open run use.
+        // A thread the person chose in "Post results to" keeps winning.
+        const bot = store.bot(routine.botId);
+        const chosen = !forceNew && routine.resultsThreadId && bot && !bot.hidden
+            ? store.taskByThread(bot.id, routine.resultsThreadId) : undefined;
+        // On a Cloud home a routine reports only where its writer may write: a
+        // guest's (or nobody's) keeps a results conversation opened as theirs.
+        const opener = CLOUD_HOME ? routineOpener(routine.id) : undefined;
+        const main = bot && !bot.hidden ? botMainThread(bot.id) : undefined;
+        const mainAllowed = main && (!CLOUD_HOME || (opener === CLOUD_OWNER_KEY && !cloudGuestOpened(main)));
+        const keepChosen = chosen && !chosen.routineRunId && !(mainAllowed && legacyResultsThread(routine.name, chosen));
+        if (keepChosen)
+            return chosen.threadId;
+        if (mainAllowed || !CLOUD_HOME)
+            return main;
         const threadId = store.createTask(routine.botId, `${routine.name} · Results`, false)?.threadId;
-        // On a Cloud home the results conversation is opened by whoever wrote the
-        // routine: it carries their name for it (cloudGuestOpened).
-        if (threadId && CLOUD_HOME)
-            threadStarters.set(threadId, routineOpener(routine.id));
+        if (threadId)
+            threadStarters.set(threadId, opener);
         return threadId;
     },
     discardResultsThread: (botId, threadId) => {
         const task = store.taskByThread(botId, threadId);
-        if (task && !task.busy && !task.routineRunId && store.messagesFor(threadId).length === 0) {
+        // The main thread is reused, never allocated, so a failed write keeps it.
+        if (task && threadId !== botMainThread(botId) && !task.busy && !task.routineRunId && store.messagesFor(threadId).length === 0) {
             store.deleteTask(botId, threadId);
             handoffs.forget(threadId);
         }
@@ -10718,7 +10852,11 @@ if (recoveryOwners.length > 0) {
 // after the user confirms a durable card. Keeping this beside the scheduler
 // makes the card resolvable after an app restart without involving the model.
 async function cloudRoutineReadiness(botId, threadId) {
-    const bot = threadId ? store.projectBotForTask(botId, threadId) : store.bot(botId);
+    const projected = threadId ? store.projectBotForTask(botId, threadId) : store.bot(botId);
+    // The model its turn will run on: a thread's own model that can't run
+    // gives way to the bot's when the turn starts (healThreadModel).
+    const selection = threadId ? turnSelection(botId, threadId) : projected?.modelSelection;
+    const bot = projected && selection ? { ...projected, modelSelection: selection } : projected;
     if (!bot || bot.hidden)
         return { ready: false, reason: "The routine's target bot no longer exists." };
     if (!boat.boatConfigured(cfg)) {
@@ -11437,10 +11575,9 @@ const webhooks = new WebhookManager({
             return;
         store.appendMessage(threadId, { role: "bot", kind: "text", text, webhookPost: true });
     },
-    // Mirrors resolveResultsThread's routines wiring a few hundred lines up
-    // in this same file: create-on-first-use, never activated (so it never
-    // steals the bot's live selection the way POST /api/bots/:id/tasks
-    // does), reused forever after via trigger.resultsThreadId.
+    // Create-on-first-use, never activated (so it never steals the bot's
+    // live selection the way POST /api/bots/:id/tasks does), reused forever
+    // after via trigger.resultsThreadId.
     resolvePostThread: (trigger, forceNew) => {
         if (!forceNew && trigger.resultsThreadId)
             return trigger.resultsThreadId;
@@ -12207,6 +12344,10 @@ setupRetry = 0) {
             { id: "skill-instructions", label: "Skill instructions", text: renderSkillInstructions(selectedSkills, { includeRoot: Boolean(workspace) }) },
             { id: "playbooks", label: "Playbooks", text: installedPlaybookInstructions(text, bot.playbooks) },
         ]);
+        // The engines read at start is part of setup (it learns what this engine
+        // supports): wait for it before the claim below.
+        if (enginesRead)
+            await enginesRead;
         // run the turn and wait for it to settle, folding the reply text so a
         // chained @mention can be routed afterwards
         // Claim only after setup succeeded. An unavailable, busy, unsupported, or
@@ -12246,7 +12387,10 @@ setupRetry = 0) {
             else
                 markCancelledProviderHandshake(threadId, retirementOwner);
         };
-        const timeoutMinutes = roomTurnTimeoutMinutes(cfg);
+        const liveGroup = store.group(groupId) ?? group;
+        const timeoutMinutes = effectiveRoomTurnTimeoutMinutes(roomTurnTimeoutMinutes(cfg), liveGroup.dm
+            ? liveGroup.turnTimeoutMinutes
+            : store.groupTaskByThread(liveGroup.id, threadId)?.turnTimeoutMinutes);
         const outcome = await new Promise((resolve) => {
             let done = false;
             let unsub = () => { };
@@ -12334,6 +12478,7 @@ setupRetry = 0) {
                 cwd,
                 integrations,
                 mcpFromUserConfig: claudeUserMcpEnabled(cfg) && !managedPolicy.restrictsMcp(),
+                mcpCallTimeoutMs: mcpCallTimeoutMinutes(cfg) * 60_000,
                 ...(instance.instanceId === readyBot.modelSelection.instanceId
                     ? memberTurnSelection(readyBot.modelSelection)
                     : { model: instance.models.default }),
@@ -14262,6 +14407,7 @@ function configStatus() {
         // not a secret — the settings picker shows it; "" = follow the system
         language: cfg.language ?? "",
         rooms: { turnTimeoutMinutes: roomTurnTimeoutMinutes(cfg) },
+        mcp: { callTimeoutMinutes: mcpCallTimeoutMinutes(cfg) },
         automaticRecovery: cfg.automaticRecovery ?? { enabled: false },
         // absent effort = no level is sent, so clients can tell it from any level
         newBots: cfg.newBots?.effort ? { effort: cfg.newBots.effort } : {},
@@ -14617,15 +14763,22 @@ function serveStatic(res, path) {
     try {
         const data = readFileSync(file);
         const type = MIME[extname(file)] ?? "application/octet-stream";
-        res.writeHead(200, { "content-type": type, ...(type === "text/html" ? PAGE_HEADERS : {}) });
+        // Vite puts a content hash in the name of every file it writes under
+        // /assets/, so a URL there never changes: the browser keeps it instead of
+        // downloading the bundle on every load. That only holds while public/ has
+        // no assets/ dir (index.test.ts checks). Pages are revalidated, so a new
+        // build shows up on the next load.
+        const cache = type === "text/html" ? "no-cache" : safe.startsWith("/assets/") ? "public, max-age=31536000, immutable" : null;
+        res.writeHead(200, { "content-type": type, ...(type === "text/html" ? PAGE_HEADERS : {}), ...(cache ? { "cache-control": cache } : {}) });
         res.end(data);
         return true;
     }
     catch {
-        // SPA fallback
+        // SPA fallback. Never immutable: a missing chunk answered with the page
+        // must not stay cached under the chunk's URL.
         try {
             const data = readFileSync(join(STATIC_DIR, "index.html"));
-            res.writeHead(200, { "content-type": "text/html", ...PAGE_HEADERS });
+            res.writeHead(200, { "content-type": "text/html", "cache-control": "no-cache", ...PAGE_HEADERS });
             res.end(data);
             return true;
         }
@@ -14740,6 +14893,15 @@ ROUTES.push(createBotMemoryRoutes({
     },
 }));
 ROUTES.push(createDeciderRoutes({ decider }));
+// "Switch them too": a bot's threads on a model of their own follow its model again.
+ROUTES.push(createThreadModelRoutes({
+    bot: (id) => store.bot(id),
+    busy: (botId, threadId) => threadBusy(botId, threadId),
+    follow: (botId, threadIds) => store.followBotModel(botId, threadIds, (from, to) => hostedModels?.resetTask(from, to) ?? {}),
+    // Like updateBotDefault on a thread: on a Cloud home, the owner's alone.
+    mayChangeModel: (auth) => !CLOUD_HOME || cloudOwnerSession(auth),
+    reply: (botId) => publicBot(store.bot(botId)),
+}));
 ROUTES.push(createAntigravityLeftoverRoutes({
     hosted: Boolean(hostedModels),
     isAntigravity: (instanceId) => registry.get(instanceId)?.driverKind === "antigravityAgent",
@@ -18048,6 +18210,9 @@ const handleRequest = async (req, res) => {
                     const message = store.appendMessage(threadId, {
                         role: "bot",
                         kind: "connector",
+                        // Read only by clients that predate the card (older phones draw
+                        // an unknown kind by its text); see connector-card-text.ts.
+                        text: connectorCardText(toolkit.label, item.alias),
                         ...(owner.group ? { from: { botId: owner.bot.id, name: owner.bot.name, color: owner.bot.color } } : {}),
                         connector: {
                             slug: item.slug,
@@ -18460,7 +18625,7 @@ const handleRequest = async (req, res) => {
             return json(res, 200, {
                 bots: shownBots.map((bot) => memberBot({
                     ...wireBot(bot),
-                    tasks: store.tasks(bot.id).map(wireTask),
+                    tasks: store.tasks(bot.id).map((task) => wireTask(task, bot.modelSelection)),
                     ...messagePage(bot.threadId, limit),
                 }, visible)),
                 botQueuedMessages: visible.everything ? queued : Object.fromEntries(Object.entries(queued).filter(([threadId]) => visible.thread(threadId))),
@@ -19424,7 +19589,7 @@ const handleRequest = async (req, res) => {
             if (!body || typeof body !== "object" || Array.isArray(body)) {
                 return json(res, 400, { error: "body must be a JSON object" });
             }
-            const allowed = new Set(["title", "pinned"]);
+            const allowed = new Set(["title", "pinned", "turnTimeoutMinutes"]);
             if (Object.keys(body).some((key) => !allowed.has(key)))
                 return json(res, 400, { error: "unsupported channel thread setting" });
             const existing = store.groupTaskByThread(group.id, m[2]);
@@ -19432,12 +19597,16 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: "no such channel task" });
             const pinning = body.pinned !== undefined;
             const renaming = body.title !== undefined;
-            if (!pinning && !renaming)
+            const limiting = Object.prototype.hasOwnProperty.call(body, "turnTimeoutMinutes");
+            if (!pinning && !renaming && !limiting)
                 return json(res, 400, { error: "unsupported channel thread setting" });
             if (pinning && typeof body.pinned !== "boolean")
                 return json(res, 400, { error: "pinned must be a boolean" });
             if (renaming && typeof body.title !== "string")
                 return json(res, 400, { error: "title must be a string" });
+            const parsedLimit = limiting ? parseConversationTurnTimeout(body.turnTimeoutMinutes) : null;
+            if (parsedLimit && !parsedLimit.ok)
+                return json(res, 400, { error: parsedLimit.error });
             // Echoing the current title lets a newer client pin on an older server
             // without the old handler turning a missing title into "Untitled".
             // That echo is not a rename. A real rename stays blocked while working.
@@ -19445,10 +19614,19 @@ const handleRequest = async (req, res) => {
             const notYours = titleChange ? cloudThreadRefusal(auth, m[2]) : null;
             if (notYours)
                 return json(res, 403, { error: notYours });
-            if (channelTaskBlocked(group) && !(pinning && !titleChange)) {
+            // A longer limit applies to the next turn, so it can be saved while
+            // this one is still running. A rename still waits.
+            const settingsOnly = !titleChange && (pinning || limiting);
+            if (channelTaskBlocked(group) && !settingsOnly) {
                 return json(res, 409, { error: "this channel is working or waiting on you — finish that turn first" });
             }
             let task = existing;
+            if (limiting && parsedLimit?.ok) {
+                const limited = store.setGroupTaskTurnTimeout(group.id, m[2], parsedLimit.minutes);
+                if (!limited)
+                    return json(res, 404, { error: "no such channel task" });
+                task = limited;
+            }
             if (pinning) {
                 const pinned = store.setGroupTaskPinned(group.id, m[2], body.pinned === true);
                 if (!pinned)
@@ -20282,10 +20460,12 @@ const handleRequest = async (req, res) => {
             }
             // patchBot persists first and emits the canonical bot change, which the
             // store listener above turns into the slim wire-format SSE broadcast.
+            // Every thread that follows the bot moves with it; the selected thread
+            // follows it from now on too, as if picked there.
             const bot = store.patchBot(existing.id, { modelSelection: checked.selection });
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
-            store.patchTask(bot.id, selected.threadId, { modelSelection: checked.selection,
+            store.patchTask(bot.id, selected.threadId, { modelSelection: undefined,
                 ...hostedModels?.resetTask(selected.modelSelection, checked.selection) });
             return json(res, 200, { bot: wireBot(bot) });
         }
@@ -20971,8 +21151,10 @@ const handleRequest = async (req, res) => {
             // and pins that already match stay; returning to Auto sweeps nothing.
             if (computerSpecified && requestedComputer !== undefined)
                 store.clearAutoSurfacePins(m[1], requestedComputer);
+            // A new bot model moves every thread that follows the bot; the selected
+            // thread follows it from now on too.
             if (normalizedSelection && selectedTask)
-                store.patchTask(bot.id, selectedTask.threadId, { modelSelection: normalizedSelection,
+                store.patchTask(bot.id, selectedTask.threadId, { modelSelection: undefined,
                     ...hostedModels?.resetTask(selectedTask.modelSelection, normalizedSelection) });
             if (existingBot && (bot.browserProfile !== beforeBrowserProfile || bot.browser !== beforeBrowserEnabled)) {
                 browserLive.closeForBot(bot.id);
@@ -21769,12 +21951,15 @@ const handleRequest = async (req, res) => {
             if (phoneSecretSubmissions.hasThread(bot.threadId)) {
                 return json(res, 409, { error: "this task is securely saving a credential — try again when it finishes" });
             }
-            if (!registry.get(bot.modelSelection.instanceId)) {
+            // A thread's own model that can't run gives way to the bot's when the
+            // rerun starts (healThreadModel), so check the model it will run on.
+            const rerunSelection = turnSelection(bot.id, bot.threadId) ?? bot.modelSelection;
+            if (!registry.get(rerunSelection.instanceId)) {
                 return json(res, 409, {
-                    error: `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`,
+                    error: `provider instance "${rerunSelection.instanceId}" is unavailable — pick another model in settings`,
                 });
             }
-            const rerunInstance = registry.get(bot.modelSelection.instanceId);
+            const rerunInstance = registry.get(rerunSelection.instanceId);
             const rerunRefusal = policyModelRefusal(rerunInstance);
             if (rerunRefusal)
                 return json(res, 409, { error: rerunRefusal });
@@ -22205,7 +22390,7 @@ const handleRequest = async (req, res) => {
             // Who opened it decides who may answer its cards on a shared workspace.
             if (auth.kind === "session")
                 threadStarters.set(task.threadId, actorKey(auth));
-            return json(res, 201, { bot: publicBot(store.bot(bot.id)), task: wireTask(task) });
+            return json(res, 201, { bot: publicBot(store.bot(bot.id)), task: wireTask(task, store.bot(bot.id).modelSelection) });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/tasks\/([\w-]+)$/);
         if (m && method === "POST") {
@@ -22223,7 +22408,7 @@ const handleRequest = async (req, res) => {
             const switched = store.switchTask(bot.id, m[2]);
             if (!switched)
                 return json(res, 404, { error: "no such task" });
-            const switchedSettings = { ...wireBot(switched), tasks: store.tasks(switched.id).map(wireTask) };
+            const switchedSettings = { ...wireBot(switched), tasks: store.tasks(switched.id).map((task) => wireTask(task, switched.modelSelection)) };
             // "0" is settings only, a positive page is a bounded transcript, and no
             // parameter is the whole thread — the one branch that materialises it.
             // Search results land through that branch (src/lib/focus-message.ts):
@@ -22305,7 +22490,7 @@ const handleRequest = async (req, res) => {
                 const task = store.refreshTaskPermissions(profile.id, m[2]);
                 if (!task)
                     return json(res, 404, { error: "no such task" });
-                return json(res, 200, { task: wireTask(task), bot: publicBot(store.bot(profile.id)) });
+                return json(res, 200, { task: wireTask(task, store.bot(profile.id).modelSelection), bot: publicBot(store.bot(profile.id)) });
             }
             const patch = {};
             if (body.projectId !== undefined) {
@@ -22411,7 +22596,7 @@ const handleRequest = async (req, res) => {
             const task = patch.modelSelection
                 ? store.switchTaskModel(m[1], m[2], patch.modelSelection, body.updateBotDefault === true, body.resetApprovalToAsk === true, { ...patch, ...hostedModels?.resetTask(current.modelSelection, patch.modelSelection) })
                 : store.patchTask(m[1], m[2], patch);
-            return json(res, 200, { task: wireTask(task), bot: publicBot(store.bot(m[1])) });
+            return json(res, 200, { task: wireTask(task, store.bot(m[1]).modelSelection), bot: publicBot(store.bot(m[1])) });
         }
         if (m && method === "DELETE") {
             const bot = store.bot(m[1]);
@@ -22483,7 +22668,7 @@ const handleRequest = async (req, res) => {
                 const task = store.retitleTask(m[1], m[2], startedFrom, title) ?? store.taskByThread(m[1], m[2]);
                 if (!task)
                     return json(res, 404, { error: "no such task" });
-                return json(res, 200, { task: wireTask(task) });
+                return json(res, 200, { task: wireTask(task, store.bot(m[1]).modelSelection) });
             }
             finally {
                 titleRegenerations.delete(m[2]);
@@ -23061,7 +23246,17 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: "That does not look like an API key." });
             const url = typeof body?.url === "string" && body.url.trim() ? body.url.trim() : (saved && "url" in saved ? saved.url : undefined);
             res.setHeader("cache-control", "no-store");
-            return json(res, 200, await checkProviderKey({ provider: kind, key, url }));
+            const verdict = await checkProviderKey({ provider: kind, key, url });
+            // A Test is a real use the person chose: the engines on this key agree
+            // with its verdict. Claude runs its key through its CLI, not here.
+            if (kind !== "anthropic") {
+                const base = providerBaseUrl(kind, url);
+                if (verdict.ok)
+                    noteKeyAccepted(base, key);
+                else if (verdict.reason === "rejected")
+                    noteKeyRejected(base, key);
+            }
+            return json(res, 200, verdict);
         }
         if (method === "GET" && path === "/api/decisions") {
             const rawLimit = url.searchParams.get("limit");
@@ -24091,6 +24286,12 @@ const handleRequest = async (req, res) => {
                         browserCleanup.abort(request);
                     throw error;
                 }
+                // A saved or cleared key starts over: neither it nor the key it
+                // replaced stays marked as rejected.
+                const resetKeys = PROVIDER_KEY_KINDS.flatMap((kind) => {
+                    const next = patch[kind]?.key;
+                    return next === undefined ? [] : [cfg[kind]?.key, next];
+                });
                 let configWriteCommitted = false;
                 const externalSecretStorage = url.searchParams.get("secretStorage") === "external";
                 try {
@@ -24156,6 +24357,9 @@ const handleRequest = async (req, res) => {
                     }
                     throw error;
                 }
+                for (const key of resetKeys)
+                    if (key)
+                        forgetKey(key);
                 // Desktops already counting down move to the new window at once, in
                 // every isolation mode; busy work still defers its expiry.
                 if (patch.localVm?.idleTimeoutMinutes !== undefined) {
@@ -24772,7 +24976,7 @@ const handleRequest = async (req, res) => {
     catch (e) {
         const status = e?.status ?? 500;
         const candidateCode = e?.code;
-        const code = typeof candidateCode === "string" && ["guarded_busy", "guarded_branch", "guarded_permissions", "guarded_request_changed", "guarded_request_untracked"].includes(candidateCode)
+        const code = typeof candidateCode === "string" && ["guarded_busy", "guarded_branch", "guarded_permissions", "guarded_request_changed", "guarded_request_untracked", "outside_workspace"].includes(candidateCode)
             ? candidateCode : undefined;
         return json(res, status, { error: e instanceof Error ? e.message : String(e), ...(code ? { code } : {}) });
     }
@@ -24922,12 +25126,22 @@ restoreChannelMessages();
     if (movedAutoPins)
         console.log(`Works on: moved ${movedAutoPins} auto-pinned thread(s) to their bot's current Works on`);
 }
-server.listen(PORT, "127.0.0.1", () => {
+server.listen(PORT, "127.0.0.1", async () => {
     companyRuntimeReady();
     console.log(`openmausbot server on http://127.0.0.1:${PORT}`);
+    // Words queued before the restart start first, ahead of anything sent from
+    // now on. Their turns wait for the engines read at start like every turn.
     followupsReady = true;
     drainQueuedSends();
     drainQueuedChannelSends();
+    // The work below wakes delegators, and a woken delegator keeps its session
+    // only on an engine that records what it was handed, which that read finds
+    // out: it starts once the read is done.
+    if (enginesRead) {
+        await enginesRead;
+        if (companyShutdown)
+            return;
+    }
     // Startup work uses the same turn dispatcher and local tool endpoint as
     // ordinary chat. Start only once every registry is initialized and the
     // endpoint is listening; earlier dispatch can hit uninitialized bindings.