openmausbot 0.1.97 → 0.1.99

package/dist-server/permission-proxy.js

@@ -157,6 +157,7 @@ var allowQuestion = allowsTool(selection.scope, { kind: "mcp", server: "ogb", na
 var socketPath = process.argv[2] ?? "";
 var waiting = /* @__PURE__ */ new Map();
 var conn = connect(socketPath);
+conn.setEncoding("utf8");
 var dead = () => {
   for (const resolve of waiting.values()) {
     resolve({ behavior: "deny", message: "OpenMausBot: permission broker unavailable \u2014 skip this action" });
@@ -295,6 +296,7 @@ async function handle(msg) {
   }
 }
 var inBuf = "";
+process.stdin.setEncoding("utf8");
 process.stdin.on("data", (chunk) => {
   inBuf += chunk;
   let nl;

package/dist-server/server/activity.js

@@ -103,6 +103,8 @@ const OUTCOME_OF_DECISION = {
     "user-approved": "allowed",
     "review-would-approve": "allowed",
     "user-denied": "denied",
+    // A person reverted a change that had applied on its own.
+    "user-undone": "denied",
     "review-would-deny": "denied",
     "card-shown": "waiting",
 };

package/dist-server/server/atomic.js

@@ -4,8 +4,15 @@
 // reader always sees either the complete old contents or the complete new
 // ones. Without this, an interrupted writeFileSync produces half-written JSON
 // that fails to parse on next boot and is silently treated as empty state.
+//
+// The fsync is the expensive part: on macOS it is F_FULLFSYNC, about 4 ms of
+// blocked event loop per call. `durable: false` drops only the fsync, for
+// files whose loss after a power cut costs nothing (a derived cache, a
+// session-scoped token). The temp file and rename stay, so an app crash or
+// kill -9 still never leaves a torn file; only a power loss or kernel panic
+// can leave such a file empty.
 import { randomUUID } from "node:crypto";
-import { closeSync, fsyncSync, openSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 /** Windows refuses a rename onto an existing path while anything else holds a
  * handle to either file, and a virus scanner or the search indexer opening a
  * just-closed file for a few milliseconds is enough. It surfaces as EPERM or
@@ -51,7 +58,8 @@ export function writeFileAtomic(path, data, options = {}) {
         // config file visible between the write and a later chmod.
         fd = openSync(tmp, "w", options.mode);
         writeFileSync(fd, data);
-        fsyncSync(fd);
+        if (options.durable !== false)
+            fsyncSync(fd);
         closeSync(fd);
         fd = null;
         renameWithRetry(tmp, path);
@@ -74,3 +82,63 @@ export function writeFileAtomic(path, data, options = {}) {
         throw e;
     }
 }
+/** True only when `path` is already exactly `data`: a regular file (never a
+ * symlink, FIFO or directory), owned by this user, with permissions no
+ * broader than `mode`. Any doubt or error answers false, so the caller falls
+ * back to a full write — this check must never be the reason a save fails.
+ *
+ * It reads the file on disk rather than remembering the last write: a
+ * workspace restore or a hand edit can change the file underneath, and the
+ * next save has to put its own bytes back exactly as before. */
+function holdsExactly(path, data, mode) {
+    let fd = null;
+    try {
+        if (process.platform === "win32") {
+            // No O_NOFOLLOW on Windows; a reparse point is replaced, not read.
+            if (!lstatSync(path).isFile())
+                return false;
+            fd = openSync(path, "r");
+        }
+        else {
+            // Inspect and read the same inode the open landed on, so a swap
+            // between a stat and the read cannot be mistaken for a match.
+            // O_NONBLOCK keeps a FIFO planted at the path from hanging the open.
+            fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        }
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size !== Buffer.byteLength(data))
+            return false;
+        const uid = process.getuid?.();
+        if (uid !== undefined && stat.uid !== uid)
+            return false;
+        // Windows reports 0o666 for any writable file; its mode bits mean nothing.
+        if (mode !== undefined && process.platform !== "win32" && (stat.mode & 0o777 & ~mode) !== 0)
+            return false;
+        // Bytes, not strings: decoding and comparing a megabyte-sized registry as
+        // a JS string costs several times more than a memcmp of the raw bytes.
+        return readFileSync(fd).equals(Buffer.from(data));
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                /* best-effort cleanup */
+            }
+        }
+    }
+}
+/** writeFileAtomic for saves that often repeat what the file already holds.
+ * A save that changes nothing costs one open and read instead of a temp
+ * file, a rename and an fsync; a save whose size differs pays only an
+ * open and fstat before the normal write. Returns whether it wrote. */
+export function writeFileAtomicIfChanged(path, data, options = {}) {
+    if (holdsExactly(path, data, options.mode))
+        return false;
+    writeFileAtomic(path, data, options);
+    return true;
+}

package/dist-server/server/checkpoints.js

@@ -246,33 +246,25 @@ function gitFailure(command, err, stderr, signal) {
 }
 /** Run one git command against the shadow repo. cwd is the WORK TREE — the
  * "." pathspec in add resolves relative to it. Every call carries the
- * GIT_TIMEOUT_MS hard timeout. */
-function runGit(args, cwd, env, signal) {
+ * GIT_TIMEOUT_MS hard timeout. `input` is written to git's stdin.
+ * Each call is a process start, which costs tens of milliseconds on Windows,
+ * and the turn waits for its snapshot — so a snapshot keeps its calls few
+ * (see commitAll). */
+function runGit(args, cwd, env, signal, input) {
     return new Promise((resolvePromise, rejectPromise) => {
         signal?.throwIfAborted();
-        execFile("git", args, { cwd, env, signal, windowsHide: true, encoding: "utf8", timeout: GIT_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+        const child = execFile("git", args, { cwd, env, signal, windowsHide: true, encoding: "utf8", timeout: GIT_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
             if (err)
                 rejectPromise(gitFailure(args[0], err, stderr, signal));
             else
                 resolvePromise(stdout);
         });
-    });
-}
-/** `git diff --cached --quiet`: is there anything staged beyond HEAD? Used
- * instead of `status --porcelain` emptiness on purpose — a nested repo with
- * a dirty work tree shows up in status forever while staging nothing, which
- * would either commit empty churn every turn or fail the commit outright. */
-function hasStagedChanges(cwd, env, signal) {
-    return new Promise((resolvePromise, rejectPromise) => {
-        signal?.throwIfAborted();
-        execFile("git", ["diff", "--cached", "--quiet", "--ignore-submodules=dirty"], { cwd, env, signal, windowsHide: true, encoding: "utf8", timeout: GIT_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (err, _stdout, stderr) => {
-            if (err === null)
-                resolvePromise(false);
-            else if (err.code === 1)
-                resolvePromise(true);
-            else
-                rejectPromise(gitFailure("diff", err, stderr, signal));
-        });
+        if (input !== undefined) {
+            // A git that exits before reading reports through its exit status; a
+            // broken pipe here must not become an unhandled stream error.
+            child.stdin?.on("error", () => { });
+            child.stdin?.end(input);
+        }
     });
 }
 // One operation at a time per shadow repo: snapshots, diffs and pin releases
@@ -312,6 +304,20 @@ async function sweepLiveRefs(cwd, env, shadow, signal) {
         droppedPins.add(shadow);
     sweptShadows.add(shadow);
 }
+/** One git call, however long the history: HEAD and at most its parent. */
+async function readHead(cwd, env, signal) {
+    const out = await runGit(["log", "-2", "--format=%H %T %P", "HEAD"], cwd, env, signal);
+    const [head, parent] = out.split("\n").filter(Boolean).map((line) => line.trim().split(" "));
+    const [hash, tree, ...parents] = head ?? [];
+    if (!hash || !tree)
+        throw new Error(`git log: unexpected output ${JSON.stringify(out.slice(0, 200))}`);
+    let base = null;
+    if (parents.length === 0)
+        base = hash;
+    else if (parents.length === 1 && parent?.length === 2)
+        base = parents[0];
+    return { hash, tree, base };
+}
 /** Create the shadow repo on first use; self-heal its config files on every
  * use (they are tiny, and rewriting them lets exclude-list updates reach
  * shadows that already exist). The base commit is an EMPTY marker so HEAD
@@ -349,14 +355,17 @@ async function ensureShadow(cwd, env, shadow, signal) {
         }
     }
     writeFileSync(join(shadow, ".git", "info", "exclude"), EXCLUDES + [...cachePatterns].join("\n") + "\n");
+    let head;
     try {
-        await runGit(["rev-parse", "--verify", "HEAD"], cwd, env, signal);
+        head = await readHead(cwd, env, signal);
     }
     catch {
         // brand-new repo (or a crash between init and first commit)
         await runGit(["commit", "--no-verify", "--allow-empty", "-m", "checkpoint base"], cwd, env, signal);
+        head = await readHead(cwd, env, signal);
     }
     await sweepLiveRefs(cwd, env, shadow, signal);
+    return head;
 }
 /** Folder listings in flight at once (libuv's pool has four threads). */
 const LISTING_CONCURRENCY = 4;
@@ -469,9 +478,11 @@ async function stageWorkTree(cwd, env, signal) {
 }
 /** Capture fully before advancing HEAD: null when the add was partial, so a
  * partial capture never replaces the last usable checkpoint or authorizes
- * removal of its objects. */
-async function commitAll(cwd, env, label, signal) {
-    const previous = (await runGit(["rev-parse", "HEAD"], cwd, env, signal)).trim();
+ * removal of its objects. With `pin`, the turn's pin lands on the returned
+ * commit in the same ref transaction that moves HEAD.
+ * A changed folder costs the shadow `write-tree`, `commit-tree` and one
+ * `update-ref` past staging; an unchanged one, `write-tree` alone. */
+async function commitAll(cwd, env, head, label, pin, signal) {
     try {
         await stageWorkTree(cwd, env, signal);
     }
@@ -481,18 +492,25 @@ async function commitAll(cwd, env, label, signal) {
             throw e;
         return null;
     }
-    const changed = await hasStagedChanges(cwd, env, signal);
-    const base = (await runGit(["rev-list", "--max-parents=0", "HEAD"], cwd, env, signal)).trim();
-    const count = (await runGit(["rev-list", "--count", "HEAD"], cwd, env, signal)).trim();
-    if (!changed && Number(count) <= 2)
-        return { hash: previous, advanced: false, compacted: false };
+    // Is anything staged beyond HEAD? The staged tree is HEAD's tree exactly
+    // when nothing is. Only what is staged counts, never work-tree status: a
+    // nested repo with a dirty work tree stages nothing (its gitlink is
+    // unchanged), so it neither commits empty churn every turn nor fails.
     const tree = (await runGit(["write-tree"], cwd, env, signal)).trim();
-    const message = changed ? label : (await runGit(["show", "-s", "--format=%B", "HEAD"], cwd, env, signal)).trim();
-    // Parent only the empty marker, never the previous snapshot: keeping the
-    // previous commit as an ancestor would retain every old tree indefinitely.
-    const hash = (await runGit(["commit-tree", tree, "-p", base, "-m", message], cwd, env, signal)).trim();
-    await runGit(["update-ref", "HEAD", hash, previous], cwd, env, signal);
-    return { hash, advanced: true, compacted: Number(count) > 2 };
+    const changed = tree !== head.tree;
+    let hash = head.hash;
+    if (changed || head.base === null) {
+        const base = head.base ?? (await runGit(["rev-list", "--max-parents=0", "HEAD"], cwd, env, signal)).trim();
+        const message = changed ? label : (await runGit(["show", "-s", "--format=%B", "HEAD"], cwd, env, signal)).trim();
+        // Parent only the empty marker, never the previous snapshot: keeping the
+        // previous commit as an ancestor would retain every old tree indefinitely.
+        hash = (await runGit(["commit-tree", tree, "-p", base, "-m", message], cwd, env, signal)).trim();
+    }
+    const advanced = hash !== head.hash;
+    const updates = [advanced ? `update HEAD ${hash} ${head.hash}\n` : "", pin ? `update ${liveRef(pin)} ${hash}\n` : ""].join("");
+    if (updates !== "")
+        await runGit(["update-ref", "--stdin"], cwd, env, signal, updates);
+    return { hash, advanced, compacted: advanced && head.base === null };
 }
 /** HEAD-advancing snapshots per shadow since this process last collected. */
 const commitsSinceGc = new Map();
@@ -582,12 +600,10 @@ export async function snapshot(botId, cwd, label, signal, opts) {
         releaseCollection(shadow);
         return await serialize(shadow, async () => {
             const env = gitEnv(shadow, worktree);
-            await ensureShadow(worktree, env, shadow, signal);
-            const result = await commitAll(worktree, env, label, signal);
+            const head = await ensureShadow(worktree, env, shadow, signal);
+            const result = await commitAll(worktree, env, head, label, opts?.pin, signal);
             if (!result)
                 return null;
-            if (opts?.pin)
-                await runGit(["update-ref", liveRef(opts.pin), result.hash], worktree, env, signal);
             // Never awaited by the turn waiting on this snapshot, and held for that
             // turn's settled diff: diffWorkingTree queues it behind itself, so GC
             // never eats into the digest's capture window.

package/dist-server/server/cloud-home-start.js

@@ -1,4 +1,4 @@
-// Entry point of the OMB Cloud Pro home image (deploy/fly/Dockerfile).
+// Entry point of the OMB Cloud Pro home image (the Dockerfile's cloud-home target).
 //
 // Starts as root, hands a fresh Fly volume (mounted root-owned at /data) to
 // the unprivileged `maus` user, and stays a small root supervisor of two
@@ -77,7 +77,7 @@ export function cloudHomeChildEnvironments(config, env, home) {
 /** Why the root supervisor must not run or trust `files`, or null: each
  * must be root's and not writable by anyone else (nor any folder above it),
  * and none may live on the volume `home`, which `maus` owns. The image makes its code
- * root's (deploy/fly/Dockerfile); a file `maus` could rewrite would run as
+ * root's (the Dockerfile's cloud-home target); a file `maus` could rewrite would run as
  * root at the next start, or be handed the secrets. */
 export function codeTrustProblem(files, home, stat = statSync) {
     const volume = posix.join(home, "/");
@@ -155,7 +155,7 @@ export function startCloudHome(env = process.env) {
     if (ids) {
         const problem = codeTrustProblem([process.execPath, fileURLToPath(import.meta.url), join(here, "index.js"), edgeBin, edgeConfig], home);
         if (problem)
-            throw new Error(`This image's code is not safe to run as root: ${problem}. Rebuild it from deploy/fly/Dockerfile.`);
+            throw new Error(`This image's code is not safe to run as root: ${problem}. Rebuild it with docker build --target cloud-home.`);
     }
     const { server, edge, secrets, dropped } = cloudHomeChildEnvironments(config, env, home);
     // Names only, never values: what the server does not get from here.

package/dist-server/server/config.js

@@ -24,6 +24,13 @@ export const FISH_TTS_MODELS = ["s2.1-pro", "s2.1-pro-free"];
 export const DEFAULT_ROOM_TURN_TIMEOUT_MINUTES = 5;
 export const MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
 export const MAX_ROOM_TURN_TIMEOUT_MINUTES = 1_440;
+/** Per-call ceiling for a bot's MCP tools (tools/call on the chat MCP
+ * transport). 10 minutes matches the historic constant in
+ * chat-mcp-tools.ts; a single tool call that runs longer is cut at this
+ * deadline because its execution outcome can no longer be trusted. */
+export const DEFAULT_MCP_CALL_TIMEOUT_MINUTES = 10;
+export const MIN_MCP_CALL_TIMEOUT_MINUTES = 1;
+export const MAX_MCP_CALL_TIMEOUT_MINUTES = 60;
 export const DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES = 30;
 export const DEFAULT_ROOM_HANDOFF_MIN_RUNWAY_MINUTES = 10;
 export const DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES = 240;
@@ -105,6 +112,16 @@ const roomConfigSchema = z.object({
     (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) &&
     (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) <=
         (rooms.handoffHardCapMinutes ?? DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES), { message: "rooms handoff bounds must satisfy handoffMinRunwayMinutes <= handoffLifetimeMinutes <= handoffHardCapMinutes" });
+const mcpConfigSchema = z.object({
+    /** Ceiling (minutes) for one bot MCP tool call. Missing values resolve to
+     * 10, preserving the historic chat-mcp-tools constant. */
+    callTimeoutMinutes: z
+        .number()
+        .int()
+        .min(MIN_MCP_CALL_TIMEOUT_MINUTES)
+        .max(MAX_MCP_CALL_TIMEOUT_MINUTES)
+        .optional(),
+}).strict();
 /** Isolation for bot desktops. Migration note (issue #1654): switching
  * modes changes lease keys and vm-home directories, so desktops cold-start
  * under the new mode — a pool seat lives in vm-homes/pool-N — while the old
@@ -503,6 +520,7 @@ const appConfigSchema = z.object({
      * system language. Unknown tags degrade to English in the renderer. */
     language: optionalText,
     rooms: roomConfigSchema.optional(),
+    mcp: mcpConfigSchema.optional(),
     context: z.object({
         rebuildBytes: z.number().int().min(1_024).max(1_000_000).optional(),
         compactAt: z.number().positive().max(10_000_000).optional(),
@@ -635,6 +653,9 @@ export function browserEngineAttachCdpUrl(cfg) {
 export function roomTurnTimeoutMinutes(cfg) {
     return cfg.rooms?.turnTimeoutMinutes ?? DEFAULT_ROOM_TURN_TIMEOUT_MINUTES;
 }
+export function mcpCallTimeoutMinutes(cfg) {
+    return cfg.mcp?.callTimeoutMinutes ?? DEFAULT_MCP_CALL_TIMEOUT_MINUTES;
+}
 export const LIVE_IDLE_MINUTES_DEFAULT = 5;
 /** Non-secret Live settings. The key only shows up as `configured`. */
 export function liveSettingsFor(cfg) {
@@ -1204,7 +1225,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "mcp", "threads", "context", "memory", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;

package/dist-server/server/connector-card-text.js

@@ -0,0 +1,15 @@
+// The plain line a connection card carries beside its `connector` payload.
+//
+// Desktop and current phones draw `kind: "connector"` as a card and never
+// read this. It exists for clients that do not know the kind yet — phone
+// builds from before the in-chat card shipped decode it as "unknown" and draw
+// whatever `text` a message has, so without it they showed nothing at all
+// while the bot sat waiting for a connection. Exports and backups read it too.
+// It names the app and points at the card; it never carries a link, because
+// the authorization URL is only ever handed to the person's own client.
+/** "Connect GitHub to continue." — or, for a second account, the alias too. */
+export function connectorCardText(label, alias) {
+    const app = label.replace(/\s+/g, " ").trim() || "this app";
+    const account = alias?.replace(/\s+/g, " ").trim();
+    return account ? `Connect ${app} as “${account}” to continue.` : `Connect ${app} to continue.`;
+}

package/dist-server/server/default-model-selection.js

@@ -1,10 +1,13 @@
 const claudeFirst = (instances) => instances.find((instance) => instance.driverKind === "claudeAgent") ?? instances[0];
+/** Installed and waiting on a sign-in. A custom endpoint brings its own
+ * credential, so its sign-in state does not count. */
+export function signedOut(instance) {
+    return instance.snapshot.state === "available" && instance.access !== "custom" && instance.snapshot.authenticated === false;
+}
 /** The ready rule: an engine can run a turn now when it is available, the
- * organisation allows it, and it is not signed out. A custom endpoint brings
- * its own credential, so its sign-in state does not count. */
+ * organisation allows it, and it is not signed out (signedOut). */
 export function readyToRun(instance, context = {}) {
-    return instance.snapshot.state === "available" && context.refusal?.(instance) === undefined &&
-        (instance.access === "custom" || instance.snapshot.authenticated !== false);
+    return instance.snapshot.state === "available" && context.refusal?.(instance) === undefined && !signedOut(instance);
 }
 /** The engine a new bot gets, and the one a bot moved off a removed engine
  * gets (computer-engine-removal.ts): one picker for both.

package/dist-server/server/direct-apply.js

@@ -0,0 +1,20 @@
+// Which of a bot's proposed changes apply without a person. One rule for
+// routines, skills, profile and default model, on the desktop, a server and
+// a Cloud home alike:
+// - Full access applies everything it always has, with no new limits;
+// - at any other level a bot's change to ITSELF applies directly (its own
+//   routines, skills, profile, model), and the person sees a one-line
+//   receipt with Undo. A change for another bot keeps its card.
+// The one exception is a Cloud home's guest-driven turn, which keeps today's
+// card for everything (`blocked`). Team setup and peer approvals are not
+// changes to the bot itself and stay Full access only.
+/** What Undo says, applying nothing, once the thing changed since. */
+export const UNDO_STALE = "Changed since, so it can't be undone here.";
+/** A bot applying its own routines directly keeps at most this many
+ * enabled; past it, a create or resume shows today's card instead. */
+export const SELF_ROUTINE_CAP = 20;
+export function directApply(args) {
+    if (args.fullAccess)
+        return "full-access";
+    return args.targetBotId === args.botId && !args.blocked ? "self" : null;
+}

package/dist-server/server/drivers/acp/core.js

@@ -31,6 +31,7 @@ import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { PROVIDER_CREDENTIAL_ENV, stripControlPlaneEnv, WORKSPACE_CREDENTIAL_ENV } from "../../config.js";
 import { decodeInjectId } from "../local-inject.js";
+import { DeviceAuthController } from "../device-auth.js";
 import { deletePromptSplitReceipt, promptHalves, readPromptSplitReceipt, splitSessionPrompt, writePromptSplitReceipt } from "../prompt-split.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../../procs.js";
 import { classifyQuiet, describeQuiet, lastSeenPhrase, LogTail, quietKey, sampleProcessTree, } from "./quiet-status.js";
@@ -373,6 +374,9 @@ export function createAcpDriver(support) {
             };
             if (support.resolveModelsOnCreate !== false)
                 await refreshModels();
+            const deviceSignIn = support.deviceSignIn
+                ? new DeviceAuthController(support.deviceSignIn, { cli: config.cli, environment: () => childEnv(), onAuthenticated: refreshModels })
+                : null;
             const listeners = new Set();
             const active = new Map();
             // One live agent process per thread, kept across turns — the Claude
@@ -1904,6 +1908,11 @@ export function createAcpDriver(support) {
                     return models;
                 },
                 refreshModels: support.resolveModels ? refreshModels : undefined,
+                ...(deviceSignIn ? {
+                    startAuthentication: () => deviceSignIn.start(),
+                    getAuthentication: (flowId) => deviceSignIn.get(flowId),
+                    cancelAuthentication: () => deviceSignIn.cancel(),
+                } : {}),
                 snapshot,
                 adapter: {
                     provider: DRIVER_KIND,
@@ -1950,6 +1959,7 @@ export function createAcpDriver(support) {
                     },
                 },
                 dispose: async () => {
+                    await deviceSignIn?.dispose();
                     for (const { stop } of active.values())
                         stop();
                     for (const threadId of Array.from(sessions.keys()))

package/dist-server/server/drivers/acp/grok.js

@@ -20,6 +20,45 @@ export const STATIC_GROK_MODELS = {
     ],
 };
 const SLUG = /^[a-z0-9][a-z0-9._-]*$/i;
+/** Grok's own home: `$GROK_HOME`, else `~/.grok`. Its grok.com sign-in,
+ * config and catalog all live here. */
+export function grokHome(env = process.env) {
+    return env.GROK_HOME || harnessHome("grok", env);
+}
+/** The grok.com sign-in a turn runs on is stored. */
+export function grokSignedIn(env) {
+    return existsSync(join(grokHome(env), "auth.json"));
+}
+function grokLoginFailure(output) {
+    if (/(unexpected argument|unrecognized (argument|option)|unknown option).*device-(auth|code)/i.test(output)) {
+        return "This server's Grok is too old to sign in with a code. Update Grok on the server, then try again.";
+    }
+    if (/device-code login is not available/i.test(output)) {
+        return "This Grok account can't sign in with a code. Use an xAI API key instead.";
+    }
+    if (/expired/i.test(output))
+        return "The Grok sign-in code expired. Start sign-in again for a new code.";
+    if (/denied|rejected/i.test(output))
+        return "Grok sign-in was declined in the browser. Start sign-in again to try once more.";
+    return "Grok sign-in did not finish. Check the server's connection, then try again.";
+}
+/** Grok Build's half of the in-app sign-in (device-auth.ts): `grok login
+ * --device-auth` on the grok.com subscription. Grok has no status command,
+ * so nothing is checked first, and a stored login that a failed turn just
+ * refused is signed in again; the sign-in is confirmed the way a turn checks
+ * it. Checked against grok 1.0.25 and 1.0.41: `login --help` and the
+ * device-code text in their binaries. */
+export const GROK_DEVICE_SIGN_IN = {
+    provider: "grok",
+    product: "Grok",
+    account: "Grok",
+    homeEnv: "GROK_HOME",
+    homeDir: ".grok",
+    loginArgs: ["login", "--device-auth"],
+    install: "Install it with xAI's installer (https://x.ai/cli), then try again.",
+    failure: grokLoginFailure,
+    signedIn: grokSignedIn,
+};
 function unquote(raw) {
     const value = raw.trim();
     if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
@@ -30,7 +69,7 @@ function unquote(raw) {
 /** Local slugs from ~/.grok/config.toml, plus the cloud defaults.
  *  `grok -m <slug>` already accepts these; the picker just didn't list them. */
 export function readGrokModelCatalog(env = process.env) {
-    const path = join(env.GROK_HOME || harnessHome("grok", env), "config.toml");
+    const path = join(grokHome(env), "config.toml");
     let text = "";
     try {
         text = readFileSync(path, "utf8");
@@ -112,7 +151,7 @@ export function ensureGrokInjectSlug(modelId, env = process.env) {
     const host = localHost(inject.host);
     if (!host)
         return modelId;
-    const path = join(env.GROK_HOME || harnessHome("grok", env), "config.toml");
+    const path = join(grokHome(env), "config.toml");
     let text = "";
     try {
         text = readFileSync(path, "utf8");
@@ -215,7 +254,7 @@ export function grokInheritedProfile(cli, env, cwd) {
     let path = flag >= 0 ? (args[flag].includes("=") ? args[flag].slice(args[flag].indexOf("=") + 1) : args[flag + 1]) : undefined;
     if (flag >= 0 && (!path || path.startsWith("-")))
         return unsupported();
-    const files = [join(env.GROK_HOME || harnessHome("grok", env), "config.toml")];
+    const files = [join(grokHome(env), "config.toml")];
     for (let directory = resolve(cwd);;) {
         const file = join(directory, ".grok", "config.toml");
         if (!files.includes(file))
@@ -331,7 +370,7 @@ const support = {
     effortLevels: ["low", "medium", "high"],
     defaultCli: "grok",
     nativeSource: "grok.acp",
-    loginNote: "Grok CLI is not signed in — run `grok login` in a terminal",
+    loginNote: "Grok is not signed in to your grok.com account — choose Sign in to Grok in engine setup",
     // No Windows one-liner: the installer is a POSIX shell script, and offering
     // `curl … | bash` there would be advice that cannot run. Windows falls back
     // to docsUrl, which is honest rather than broken.
@@ -341,8 +380,11 @@ const support = {
             linux: "curl -fsSL https://x.ai/cli/install.sh | bash",
         },
         docsUrl: "https://x.ai/cli",
+        // The terminal route, for people who prefer it; the app's own sign-in
+        // is the device code below, which needs no terminal.
         signInCommand: "grok login",
     },
+    deviceSignIn: GROK_DEVICE_SIGN_IN,
     // Write the [model.slug] block with the instance HOME/GROK_HOME, then pass
     // the slug on argv. spawnArgs must not call ensureGrokInjectSlug itself —
     // that helper defaults to process.env and would miss the instance override.
@@ -458,7 +500,7 @@ const support = {
     // an unauthenticated CLI is a user action, not something to paper over.
     pickAuthMethod: (methods) => (methods.some((m) => m.id === "cached_token") ? "cached_token" : null),
     authFailure: "fail",
-    isAuthenticated: (env) => existsSync(join(harnessHome("grok", env), "auth.json")),
+    isAuthenticated: (env) => grokSignedIn(env),
     // `--append-system-prompt`/`--rules` are accepted by the CLI but do NOT
     // reach the agent-stdio system prompt (verified against 1.0.0), so the
     // persona is prepended codex-style.

package/dist-server/server/drivers/agents-call.js

@@ -1243,7 +1243,7 @@ export async function callTool(name, args, context) {
                 return `- ${row.action} ${row.name}`;
             }).join("\n")
             : "(none)";
-        return { text: `Imported skills:\n${live}\n\nStaged (waiting for the user to confirm):\n${pending}` };
+        return { text: `Imported skills:\n${live}\n\nStaged (waiting for the user's decision):\n${pending}` };
     }
     if (name === "skill_manage") {
         if (args.action !== "create" && args.action !== "update") {