openmausbot 0.1.97 → 0.1.99

package/dist-server/server/index.js

@@ -48,11 +48,11 @@ import { buildTurnDigest, coverageForDriver, digestPromptLine, renderDigest, too
 import { appendDecision, bindDecisionRetention, boundRetentionDays, decisionRetentionDays, decisionsCsv, flushDecisionLog, pruneDecisions, readDecisionRange, readDecisions, withDecisionActor } from "./decision-log.js";
 import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, parseAudioRange, readAttachment, saveAudio, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
-import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
+import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, listMessageFolder, messageFolderEntryName, openMessageFile, openMessageFolderEntry, } from "./message-file.js";
 import { avatarGenerationRequestSchema, avatarGenerationStateMatches, generateAvatarImage, avatarImageStatus, snapshotAvatarGenerationState, } from "./avatar-image.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
-import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
+import { RoomTurnDeadline, RoomTurnStallRegistry, effectiveRoomTurnTimeoutMinutes, parseConversationTurnTimeout, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
 import { roomTurnEnd } from "./room-turn-end.js";
 import { pickComputer } from "./computer-selection.js";
 import * as boat from "./boat.js";
@@ -67,6 +67,7 @@ import { liveCardKind, liveDecisionRefusal } from "../shared/live-approval.js";
 import { boatAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { connectorCallFromFrame, connectorRefusalText, connectorUnrecognizedText, evaluateConnectorTools } from "./connector-verdict.js";
+import { connectorCardText } from "./connector-card-text.js";
 import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
 import { buildRecall } from "./recall.js";
 import { createMemoryUpkeep, upkeepEnabled } from "./memory-upkeep.js";
@@ -74,7 +75,7 @@ import { appendAboutMe, commitLearned, planLearned } from "./profile-learned.js"
 import { canAccessTeam, canReachPeer, coordinatorSupervises, livePeerRoster, livePeerRosterBlock, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmWakeAction, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
 import { attachForTurn, saveBotAttachment } from "./bot-attachment.js";
-import { cacheUntilConfigChanges, ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, mergeOpenCodeProviderKeys, openCodeProviderKeys, } from "./config.js";
+import { cacheUntilConfigChanges, ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, mcpCallTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, mergeOpenCodeProviderKeys, openCodeProviderKeys, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -83,7 +84,8 @@ import { appendUsage, parseUsageRange, readUsage, summarizeUsage, usageCsv, USAG
 import { loadPlanUsage, planAccountsFromInstances } from "./plan-usage.js";
 import { GroupUsageReader } from "./group-thread-usage.js";
 import { ledgerCost } from "./model-prices.js";
-import { checkProviderKey, PROVIDER_KEY_KINDS } from "./provider-key-check.js";
+import { checkProviderKey, PROVIDER_KEY_KINDS, providerBaseUrl } from "./provider-key-check.js";
+import { forgetKey, noteKeyAccepted, noteKeyRejected, onKeyRejectionChange } from "./key-rejections.js";
 import { assertWithinBudget, noteSpend, spendAlertText, spendState, takeSpendAlert } from "./spend.js";
 import { fleetAvailable, fleetRequest, fleetSocketPath } from "./fleet-client.js";
 import { entitled } from "./enterprise.js";
@@ -95,7 +97,7 @@ import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { recoveryCapabilityError } from "./automatic-recovery.js";
 import { decodeGeneratedImage } from "./generated-image.js";
 import { addDisabledMcpServer, MAX_MCP_SERVERS, isRemoteMcpServer, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
-import { McpOAuthError, McpSignInError, McpOAuthManager, mcpOAuthRedirectUri, withMcpSignIn, withoutPendingSignIn } from "./mcp-oauth.js";
+import { MCP_OAUTH_CALLBACK_PATH, McpOAuthError, McpSignInError, McpOAuthManager, mcpCallbackOrigin, mcpOAuthRedirectUri, withMcpSignIn, withoutPendingSignIn } from "./mcp-oauth.js";
 import { probeMcpServer } from "./mcp-probe.js";
 import { GROUP_GOAL_MAX_TURNS, groupGoalAssignmentKey, groupGoalCompletionTurnId, groupGoalCoordinatorInstructions, groupGoalWorkerInstructions, parseGroupGoalDecision, resolveGroupGoalMember, selectGroupGoalCoordinator, } from "./group-goal-run.js";
 import { BUILT_IN_DRIVERS } from "./drivers/builtIn.js";
@@ -126,12 +128,13 @@ import { createCloudMoveRoutes, workspaceShared } from "./cloud-move-http.js";
 import { RESTART_EXIT_CODE } from "./restart.js";
 import { holdIncludedServices } from "./included-services.js";
 import { selectDefaultModelSelection, withNewBotEffort } from "./default-model-selection.js";
+import { threadModelFallback } from "./thread-model.js";
 import { computerEngineMoveText, removedComputerInstanceIds, writeComputerEngineMoveLines } from "./computer-engine-removal.js";
 import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, peerApprovalFailure, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
 import { peerDeliveryReceipt } from "./peer-delivery.js";
 import { peerProvenanceNote, withPeerProvenance } from "./peer-provenance.js";
 import { decideRoomPost, emptyRoomPostBudget } from "./room-post-budget.js";
-import { isProjectEmoji, mentionedBots, parseConnectorTools, roomResponders, sectionKey, Store, titleFromLlm, toWireTask, } from "./store.js";
+import { isProjectEmoji, mentionedBots, parseConnectorTools, roomResponders, sectionKey, Store, threadTitleFrom, titleFromLlm, toWireTask, } from "./store.js";
 import * as tts from "./tts/index.js";
 import { createDecider, deciderIncludedHere, deciderReady, deciderSavePatch, describeDecider } from "./decider/index.js";
 import { decideRoomResponder } from "./decider/room-routing.js";
@@ -150,7 +153,7 @@ import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, support
 import { listMemoryTopics, memoryDate, readMemoryFile, readMemoryTopic, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, journalMemoryWrite, } from "./memory-journal.js";
 import { readSectionContext, readSections, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
-import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, listBotSkillsWithOrigin, resolveBotSkills, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
+import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, listBotSkillsWithOrigin, resolveBotSkills, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, undoSkillWrite, } from "./skills.js";
 import { fetchSkillFromSource } from "./skill-fetch.js";
 import { pickBotName } from "./names.js";
 import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
@@ -176,6 +179,7 @@ import { agentBrowserFrame, agentBrowserIntegration, browserEngineEncryptionKey,
 import { createScreenFrameSource } from "./screen-frame-source.js";
 import { screenFrameHash, screenSurfaceForTool, screenTouchingTool, settledFrameIsNews } from "./screen-frame-gate.js";
 import { asSchedule, RoutineRequestService } from "./routine-requests.js";
+import { directApply, UNDO_STALE } from "./direct-apply.js";
 import { createOptionsCard } from "./options-card.js";
 import { buildBotOverview, connectedAppsFacts } from "./bot-overview.js";
 import { ProfileRequestService } from "./profile-requests.js";
@@ -228,7 +232,7 @@ import { applyPendingWorkspaceRestore, readLastWorkspaceRestore } from "./worksp
 import { createCustomDomainVerifier, customDomainIpv4, normalizeCustomDomain } from "./custom-domain.js";
 import { allowedScopes, createEmailSignIn, parseAllowList } from "./account-signin.js";
 import { ProviderAuthSessions } from "./provider-auth-sessions.js";
-import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, isLoopbackHost, isProxied, labelFromUserAgent, requestOrigin, requestSource, requiredScope, resolveLoopbackTrust, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
+import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, isLoopbackHost, isProxied, labelFromUserAgent, provesSameOrigin, requestOrigin, requestSource, requiredScope, resolveLoopbackTrust, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
 import { cookieMaxAgeSeconds, formatPairingCode, SessionRegistry } from "./sessions.js";
 import { ThreadStarters } from "./thread-starters.js";
 import { activityCsv, activityEntries, appendAdminAction, botAuditSnapshot, botChangeRows, configChangeRows, parseActivityWhat, flushAdminActivity, pruneAdminActivity, readAdminActivityRange, sharedSignIn, signInListsOf, } from "./admin-activity.js";
@@ -244,6 +248,8 @@ import { createHostedSlackRoutes } from "./routes/hosted-slack.js";
 import { createBotPresetRoutes } from "./routes/bot-presets.js";
 import { createBotMemoryRoutes } from "./routes/bot-memory.js";
 import { createDeciderRoutes } from "./routes/decider.js";
+import { createThreadModelRoutes } from "./routes/thread-models.js";
+import { createUndoRoutes } from "./routes/undo.js";
 import { createDesktopViewer, desktopViewerUrl } from "./routes/desktop-viewer.js";
 import { localDesktopTarget, localVmViewerStatus, viewerTargetId } from "./desktop-viewer-targets.js";
 import { createAntigravityLeftoverRoutes } from "./routes/antigravity-leftovers.js";
@@ -835,12 +841,13 @@ function openerFrom(fromThreadId) {
         return person;
     return person && !cloudOwnerPerson(person) ? person : CLOUD_NOBODY_KEY;
 }
-/** The model a thread a bot opens from one of its own threads starts on:
- * that thread's, not the bot default the person may have moved away from
- * (#1950). Only the bot's own thread counts — a room or a teammate's thread
- * is not one of its tasks, and another bot's model belongs to another engine.
- * Approval stays the bot's, except that a level the inherited engine would
- * have to confirm on a model switch starts the new thread in Ask. */
+/** The model a thread a bot opens from one of its own threads starts on
+ * (#1950): the model a person picked in that thread, kept as the new thread's
+ * own. A thread that follows the bot opens one that follows it too. Only the
+ * bot's own thread counts — a room or a teammate's thread is not one of its
+ * tasks, and another bot's model belongs to another engine. Approval stays
+ * the bot's, except that a level the inherited engine would have to confirm
+ * on a model switch starts the new thread in Ask. */
 function parentThreadModel(botId, parentThreadId) {
     // The stored profile, never a per-thread projection: the comparison is
     // against the defaults the new thread would otherwise get.
@@ -1668,6 +1675,9 @@ const managedPolicy = new ManagedDesktopPolicy({ onChange: () => {
         broadcast({ kind: "config", ...configStatus() });
         resyncOpenCodeProviderKeys();
     } });
+// A key the provider refused, or accepted again, changes what Model
+// providers and the picker show; the config event refreshes /api/instances.
+onKeyRejectionChange(() => broadcast({ kind: "config", ...configStatus() }));
 /** A computer kind this server will not use, refused before anything is
  * prepared: a Cloud home never offers this computer or a Local VM
  * (cloud-home.ts), and an enrolled organisation may disallow any kind. */
@@ -2055,6 +2065,9 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, r
                 const speaking = botForThread(botId, threadId) ?? store.bot(botId);
                 return tts.voiceReady(cfg, speaking?.voice) && speaking?.voiceNotes !== false ? "1" : "0";
             })(),
+            // And for a role: team setup, bot creation and deletion, rooms and
+            // retries are shown only to a Chief of Staff, whom their routes require.
+            OMB_CHIEF_OF_STAFF: store.bot(botId)?.chiefOfStaff === true ? "1" : "0",
         },
     };
 }
@@ -3005,6 +3018,62 @@ function checkedTaskModelSwitch(current, raw, updateBotDefault, resetApprovalToA
     }
     return checked;
 }
+/** An engine as a turn's start sees it, without waiting on its CLI: the live
+ * instance and what its last read said (registry.lastSnapshot). Before the
+ * first read it counts as available, so only what is known stops a pick. */
+function threadEngine(instanceId) {
+    const live = registry.get(instanceId);
+    if (!live)
+        return undefined;
+    return {
+        instanceId, driverKind: live.driverKind, enabled: live.enabled, models: live.models,
+        capabilities: { modelVariants: live.adapter.capabilities.modelVariants === true },
+        snapshot: registry.lastSnapshot(instanceId) ?? { state: "available" },
+        access: providerConfigs()[instanceId]?.access ?? registry.access(instanceId),
+    };
+}
+/** This thread's own model, when it gives way to its bot's now
+ * (threadModelFallback); null when the thread follows its bot or its own
+ * model runs as picked. */
+function threadModelGivingWay(botId, threadId) {
+    const bot = store.bot(botId);
+    const own = store.taskByThread(botId, threadId)?.modelSelection;
+    if (!bot || !own)
+        return null;
+    return threadModelFallback(own, bot.modelSelection, threadEngine, {
+        refusal: policyModelRefusal,
+        ...(hostedModels ? { allows: (selection) => hostedModels.allows(selection) } : {}),
+    }) ? own : null;
+}
+/** The model a turn in this thread would run on now (healThreadModel). */
+function turnSelection(botId, threadId) {
+    return threadModelGivingWay(botId, threadId) ? store.bot(botId)?.modelSelection : store.projectBotForTask(botId, threadId)?.modelSelection;
+}
+/** A model as a person reads it: its catalog label, after its engine's name
+ * while that engine is here. */
+function modelName(selection) {
+    const instance = registry.get(selection.instanceId);
+    const label = instance?.models.options.find((option) => option.id === selection.model)?.label ?? selection.model;
+    return instance ? `${instance.displayName || instance.driverKind} · ${label}` : label;
+}
+/** A thread's own model that can't run here gives way to its bot's: the turn
+ * about to start runs on the bot's model, the thread follows the bot from
+ * then on, and one plain line in it says so. Every turn starts through
+ * startTurn (a person's message, a routine, a delegation, a webhook, a
+ * queued follow-up), so this is the one place it happens; a room turn
+ * already runs on each member's own model. */
+function healThreadModel(botId, threadId) {
+    const bot = store.bot(botId);
+    const own = threadModelGivingWay(botId, threadId);
+    if (!bot || !own || bot.approvalGrant || threadBusy(botId, threadId))
+        return;
+    if (!store.followBotModel(botId, [threadId], (from, to) => hostedModels?.resetTask(from, to) ?? {}).length)
+        return;
+    store.appendMessage(threadId, { role: "bot", kind: "activity", tool: {
+            name: `notice: This thread's model (${modelName(own)}) isn't available, so it now uses ${bot.name}'s model (${modelName(bot.modelSelection)}).`,
+            ok: true,
+        } });
+}
 function checkedExportSkillNames(value, bots) {
     // Sharing instructions is explicit: ordinary package exports include none.
     if (value === undefined)
@@ -3201,15 +3270,27 @@ function checkedMemberIds(value) {
     return { ok: true, memberIds };
 }
 let bootSelection = { instanceId: "", model: "" };
+/** The engines read at start, while it runs (below). It is where the server
+ * learns what each engine supports (a Claude CLI's version and flags), so a
+ * turn waits for it, as every turn did when the server listened only after
+ * that read. */
+let enginesRead = null;
 /** Preset bots for New bot, from shared files and the organization (presets.ts). */
 const presetStore = createPresetStore();
-const store = new Store(() => bootSelection, (selection) => withNewBotEffort(selection, cfg.newBots?.effort, registry.get(selection.instanceId)?.adapter.capabilities.effortLevels));
+const store = new Store(() => bootSelection, (selection) => withNewBotEffort(selection, cfg.newBots?.effort, registry.get(selection.instanceId)?.adapter.capabilities.effortLevels), (instanceId) => registry.cliTarget(instanceId)?.driverKind);
 const teamComputers = new TeamComputers(join(DATA_DIR, "team-computers.json"), ENVIRONMENT_ID);
 let followupsReady = false;
 const sendSequencer = new SendSequencer();
 // Before the new-bot default is read: a saved default may name the engine.
 await retryComputerEngineMove();
-bootSelection = await defaultSelection();
+// Reading the new-bot default probes every engine CLI (each up to its
+// timeout), and at start only the first-run seed needs the answer. A later
+// start listens without waiting: the same read runs behind it, and turns
+// wait for it (enginesRead).
+if (store.needsSeed())
+    bootSelection = await defaultSelection();
+else
+    enginesRead = defaultSelection().then((selection) => { bootSelection = selection; }, (error) => console.warn(`[engines] reading the engines at start failed: ${error instanceof Error ? error.message : String(error)}`)).finally(() => { enginesRead = null; });
 store.seedIfEmpty();
 hostedModels?.reconcile(store);
 // Skills library boot sweep (features.skillsLibrary): migrate per-bot
@@ -3263,11 +3344,13 @@ if (browserCleanupReferencesReconciled)
  * than the desktop window did. Stripped here rather than at each call site
  * so a new broadcast cannot forget. */
 let activeCoordinationForThread = (_threadId) => false;
-const wireTask = (task) => {
+/** One thread as a client sees it. `botModel` is its bot's model: a thread
+ * without a model of its own runs on it (toWireTask). */
+const wireTask = (task, botModel) => {
     // Time-based snoozes heal on read against the server clock — no client
     // timer, no device skew. The 0 sentinel ("until new activity") is not a
     // time and survives reads; only a wake event in the store clears it.
-    const { snoozedUntil, ...base } = toWireTask(task);
+    const { snoozedUntil, ...base } = toWireTask(task, botModel);
     const coordinated = { ...base, waitingForTeammates: activeCoordinationForThread(task.threadId) && !task.busy };
     const asleep = snoozedUntil === 0 || (snoozedUntil !== undefined && snoozedUntil > Date.now());
     return asleep ? { ...coordinated, snoozedUntil } : coordinated;
@@ -3281,7 +3364,7 @@ const wireBot = (bot) => {
         ? { ...rest, approvalMode: "ask", autoApprove: false }
         : rest;
     return { ...visible, waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
-        avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
+        avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map((task) => wireTask(task, bot.modelSelection)) } : {}) };
 };
 function toolScopeForTurn(botId) {
     const bot = store.bot(botId);
@@ -3296,7 +3379,7 @@ function toolScopeForTurn(botId) {
  * can validate it before sending the confirmation that makes it effective. */
 const wireTrustedApprovalBot = (bot) => {
     const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
-    return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
+    return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map((task) => wireTask(task, bot.modelSelection)) } : {}) };
 };
 /** A settings-based preview, not a receipt of a dispatched turn. No
  * provisioning or credentials are needed to inspect it. The selected engine
@@ -3481,6 +3564,24 @@ function sourceApprovalMode(botId, threadId) {
 function fullAccessForSource(botId, threadId) {
     return sourceApprovalMode(botId, threadId) === "full";
 }
+/** On a Cloud home a turn a guest drives keeps a card for every change,
+ * even one to the bot itself. */
+function selfApplyBlocked(threadId) {
+    return cloudGuestDriven(threadId);
+}
+/** Whether a bot's routine, skill, profile or model change applies without
+ * a person, and why: Full access applies everything as it always has, and
+ * at any level a change to the bot itself applies, shown as a one-line
+ * receipt with Undo (server/direct-apply.ts). Team setup and peer approvals
+ * stay Full access only (fullAccessForSource). */
+function appliesDirectly(botId, threadId, targetBotId) {
+    return directApply({
+        fullAccess: fullAccessForSource(botId, threadId),
+        botId,
+        targetBotId,
+        blocked: selfApplyBlocked(threadId) || !connectorThread(botId, threadId),
+    });
+}
 function peerReviewRequired(bot, threadId) {
     return Boolean(bot.approvePeerComms && !fullAccessForSource(bot.id, threadId));
 }
@@ -3950,7 +4051,7 @@ const storedAvatarExists = (avatarUrl) => attachmentExists(avatarUrl.slice("/api
 const publicBot = (bot) => ({
     ...wireBot(bot),
     ...messagePage(bot.threadId, DEFAULT_PAGE),
-    tasks: store.tasks(bot.id).map(wireTask),
+    tasks: store.tasks(bot.id).map((task) => wireTask(task, bot.modelSelection)),
 });
 const publicBotQueuedMessages = () => queuedSteerSnapshot((botId, threadId) => Boolean(store.taskByThread(botId, threadId)));
 // busyBotId names only the speaker that currently owns the provider process.
@@ -4142,6 +4243,15 @@ function updateChannel(groupId, value) {
             throw Object.assign(new Error("invalid default responder"), { status: 400 });
         patch.defaultResponder = responder;
     }
+    if (Object.prototype.hasOwnProperty.call(body, "turnTimeoutMinutes")) {
+        if (!existing.dm) {
+            throw Object.assign(new Error("set the turn limit on that conversation"), { status: 400 });
+        }
+        const parsed = parseConversationTurnTimeout(body.turnTimeoutMinutes);
+        if (!parsed.ok)
+            throw Object.assign(new Error(parsed.error), { status: 400 });
+        patch.turnTimeoutMinutes = parsed.minutes;
+    }
     if (body.cwd !== undefined) {
         if (existing.dm)
             throw Object.assign(new Error("direct-message channels cannot have a working folder"), { status: 400 });
@@ -4462,7 +4572,14 @@ function publicGroupState(record) {
         usage = groupUsageReader.forThread(group.threadId);
     }
     catch { /* accounting must not block chat */ }
-    return { ...group, usage: usage ?? null, working: groupIsWorking(group) || [...roomHandoffs.nodes.values()].some(n => n.groupId === group.id && !["completed", "failed", "cancelled"].includes(n.status)) };
+    return {
+        ...group,
+        // Always present so a client can tell "back to the group default"
+        // apart from a partial patch that did not mention the field.
+        turnTimeoutMinutes: record.turnTimeoutMinutes ?? null,
+        usage: usage ?? null,
+        working: groupIsWorking(group) || [...roomHandoffs.nodes.values()].some(n => n.groupId === group.id && !["completed", "failed", "cancelled"].includes(n.status)),
+    };
 }
 function beginGroupTurnOperation(groupId, threadId, botIds = []) {
     const operation = {
@@ -8847,6 +8964,8 @@ async function startTurn(botId, text, opts) {
             },
         };
     }
+    // A thread whose own model can't run runs on its bot's from now on.
+    healThreadModel(botId, threadId);
     const bot = store.projectBotForTask(botId, threadId);
     if (!bot)
         throw Object.assign(new Error("no such task"), { status: 404 });
@@ -9088,6 +9207,11 @@ async function startTurn(botId, text, opts) {
     turnContext.delete(threadId);
     void (async () => {
         try {
+            if (enginesRead) {
+                await enginesRead;
+                if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId))
+                    throw new DirectTurnSetupCancelled("turn stopped while the engines were read");
+            }
             // Readiness can wait on the network. Admit the task first so its busy
             // state, Stop action and watchdog own that wait just like VM setup.
             if (opts?.runOn === "cloud") {
@@ -10042,6 +10166,7 @@ async function startTurn(botId, text, opts) {
                 mentionTurn: tagged.length > 0,
                 integrations,
                 mcpFromUserConfig: claudeUserMcpEnabled(cfg) && !managedPolicy.restrictsMcp(),
+                mcpCallTimeoutMs: mcpCallTimeoutMinutes(cfg) * 60_000,
                 cwd,
             }), () => !directTurnClaimExists(bot.id, dispatchClaimId, threadId), async () => {
                 await instance.adapter.interruptTurn(threadId).catch(() => { });
@@ -10279,6 +10404,9 @@ function routineSourceOwner(run) {
             ? { bot, group: undefined, threadId: task.threadId }
             : null;
     }
+    // Without a results snapshot (a run from before every routine reported to
+    // its bot's main thread, or a bot with no visible thread) the chat that
+    // made the routine is the destination.
     const threadId = run.sourceThreadId?.trim();
     if (!threadId)
         return null;
@@ -10299,6 +10427,21 @@ function routineSourceOwner(run) {
     const group = store.groupByThread(threadId);
     return group?.memberIds.includes(bot.id) ? { bot, group, threadId } : null;
 }
+/** There is no durable "main thread" (bot.threadId is only the UI
+ * selection), so a routine reports into the bot's oldest open conversation:
+ * the one it was created with until that is deleted or archived. Deleting
+ * the last one already gives the bot a fresh conversation (Store.deleteTask). */
+function botMainThread(botId) {
+    const visible = store.tasks(botId).filter((task) => !task.routineRunId);
+    const open = visible.filter((task) => task.archivedAt === undefined);
+    return (open.length ? open : visible).reduce((oldest, task) => (!oldest || task.createdAt < oldest.createdAt ? task : oldest), undefined)?.threadId;
+}
+/** Routines without a chosen thread used to get an automatic "<name> ·
+ * Results" thread. One nobody renamed is that automatic default, not a
+ * choice: new runs move to the main thread, and the old thread stays. */
+function legacyResultsThread(routineName, task) {
+    return task.title.endsWith(" · Results") || task.title === threadTitleFrom(`${routineName} · Results`);
+}
 function routineSourceThread(run) {
     return routineSourceOwner(run)?.threadId ?? null;
 }
@@ -10532,21 +10675,32 @@ routines = new RoutineManager({
         return Boolean(bot && !bot.hidden && task && !task.routineRunId);
     },
     resolveResultsThread: (routine, forceNew) => {
-        // A trusted chat source is already snapshotted as sourceThreadId on each
-        // run. Keep it distinct: it can belong to a teammate or room, whereas an
-        // explicit resultsThreadId must be a visible task owned by the running bot.
-        if (!forceNew && routineSourceOwner(routine))
-            return routine.resultsThreadId;
+        // Every run reports into the routine's bot's main thread, wherever the
+        // routine was made (chat, editor, API, or a teammate's request). A run
+        // still executes in its own hidden task, which Run logs and Open run use.
+        // A thread the person chose in "Post results to" keeps winning.
+        const bot = store.bot(routine.botId);
+        const chosen = !forceNew && routine.resultsThreadId && bot && !bot.hidden
+            ? store.taskByThread(bot.id, routine.resultsThreadId) : undefined;
+        // On a Cloud home a routine reports only where its writer may write: a
+        // guest's (or nobody's) keeps a results conversation opened as theirs.
+        const opener = CLOUD_HOME ? routineOpener(routine.id) : undefined;
+        const main = bot && !bot.hidden ? botMainThread(bot.id) : undefined;
+        const mainAllowed = main && (!CLOUD_HOME || (opener === CLOUD_OWNER_KEY && !cloudGuestOpened(main)));
+        const keepChosen = chosen && !chosen.routineRunId && !(mainAllowed && legacyResultsThread(routine.name, chosen));
+        if (keepChosen)
+            return chosen.threadId;
+        if (mainAllowed || !CLOUD_HOME)
+            return main;
         const threadId = store.createTask(routine.botId, `${routine.name} · Results`, false)?.threadId;
-        // On a Cloud home the results conversation is opened by whoever wrote the
-        // routine: it carries their name for it (cloudGuestOpened).
-        if (threadId && CLOUD_HOME)
-            threadStarters.set(threadId, routineOpener(routine.id));
+        if (threadId)
+            threadStarters.set(threadId, opener);
         return threadId;
     },
     discardResultsThread: (botId, threadId) => {
         const task = store.taskByThread(botId, threadId);
-        if (task && !task.busy && !task.routineRunId && store.messagesFor(threadId).length === 0) {
+        // The main thread is reused, never allocated, so a failed write keeps it.
+        if (task && threadId !== botMainThread(botId) && !task.busy && !task.routineRunId && store.messagesFor(threadId).length === 0) {
             store.deleteTask(botId, threadId);
             handoffs.forget(threadId);
         }
@@ -10718,7 +10872,11 @@ if (recoveryOwners.length > 0) {
 // after the user confirms a durable card. Keeping this beside the scheduler
 // makes the card resolvable after an app restart without involving the model.
 async function cloudRoutineReadiness(botId, threadId) {
-    const bot = threadId ? store.projectBotForTask(botId, threadId) : store.bot(botId);
+    const projected = threadId ? store.projectBotForTask(botId, threadId) : store.bot(botId);
+    // The model its turn will run on: a thread's own model that can't run
+    // gives way to the bot's when the turn starts (healThreadModel).
+    const selection = threadId ? turnSelection(botId, threadId) : projected?.modelSelection;
+    const bot = projected && selection ? { ...projected, modelSelection: selection } : projected;
     if (!bot || bot.hidden)
         return { ready: false, reason: "The routine's target bot no longer exists." };
     if (!boat.boatConfigured(cfg)) {
@@ -10758,7 +10916,7 @@ async function cloudRoutineReadiness(botId, threadId) {
 const routineRequests = new RoutineRequestService({
     store,
     routines,
-    autoApply: fullAccessForSource,
+    autoApply: appliesDirectly,
     cloudReady: cloudRoutineReadiness,
     canPersist: proposalPersistence,
     // Cross-bot routines: the confirmation card can sit open indefinitely, so
@@ -11091,14 +11249,14 @@ function resolveAndSendTrust(res, threadId, requestId, behavior) {
 }
 const profileRequests = new ProfileRequestService({
     store,
-    autoApply: fullAccessForSource,
+    autoApply: appliesDirectly,
     canPersist: proposalPersistence,
     // A Chief may change a section peer; anyone else only itself. Re-checked at confirm.
     validateTarget: chiefPeerTargetRule("profile"),
 });
 const modelRequests = new ModelRequestService({
     store,
-    autoApply: fullAccessForSource,
+    autoApply: appliesDirectly,
     canPersist: proposalPersistence,
     // Same authority rule as profile proposals: a Chief may name one section peer.
     validateTarget: chiefPeerTargetRule("default model"),
@@ -11416,6 +11574,104 @@ function resolveAndSendModel(res, args) {
     json(res, 200, { ok: true, outcome: "rejected" });
     return true;
 }
+/** Undo for a learned skill a bot wrote without a person (undoSkillWrite). */
+function undoSkillCard(botId, threadId, messageId) {
+    const message = store.messagesFor(threadId).find((candidate) => candidate.id === messageId);
+    const card = message?.card;
+    const request = card?.skillRequest;
+    if (!message || !card || !request)
+        return { claimed: false };
+    if (card.undone)
+        return { claimed: true, state: "already_undone" };
+    if (!card.autoApplied || card.answered !== "allow") {
+        return { claimed: true, state: "invalid", error: "Only a change that applied on its own can be undone here.", status: 409 };
+    }
+    if (request.botId !== botId || request.threadId !== threadId) {
+        return { claimed: true, state: "invalid", error: "this skill request belongs to a different bot", status: 403 };
+    }
+    const undone = undoSkillWrite(botId, {
+        stagedId: request.stagedId,
+        name: request.name,
+        action: request.action,
+        ...(request.previous ? { previous: { skillMd: request.previous.preview, source: request.previous.source } } : {}),
+    });
+    if ("stale" in undone)
+        return { claimed: true, state: "invalid", error: UNDO_STALE, status: 409, stale: true };
+    if ("error" in undone)
+        return { claimed: true, state: "invalid", error: undone.error, status: 409 };
+    store.patchMessage(threadId, message.id, { card: { ...card, undone: true } });
+    return { claimed: true, state: "undone" };
+}
+/** Undo on the one-line receipt of a change that applied without a person
+ * (a bot's change to itself, or Full access). The caller authorizes it
+ * exactly like answering that card; the card remembers it was undone. */
+function undoAppliedChange(res, threadId, requestId) {
+    const message = store.messagesFor(threadId).find((candidate) => candidate.card?.requestId === requestId);
+    const card = message?.card;
+    if (!message || !card)
+        return json(res, 404, { error: "this change is no longer in the conversation" });
+    // The proposing bot comes from the conversation (a room card's trusted
+    // sender, else the thread's bot), never from the card payload.
+    const botId = message.from?.botId ?? store.botByThread(threadId)?.id;
+    if (!botId)
+        return json(res, 400, { error: "this change has no valid owner" });
+    let result = { claimed: false };
+    if (card.routineRequest) {
+        const undone = routineRequests.undo({ botId, threadId, requestId });
+        // On a Cloud home a routine Undo removed is forgotten, and one it put
+        // back is the owner's only if it was theirs before the change.
+        if (undone.claimed && undone.state === "undone" && cloudRoutineAuthors) {
+            if (undone.action === "create")
+                cloudRoutineAuthors.remove(undone.routineId);
+            else if (undone.action === "update") {
+                if (undone.ownersBefore)
+                    cloudOwnersRoutine(undone.routineId);
+                else
+                    cloudRoutineAuthors.forget(undone.routineId);
+            }
+            else if (undone.action === "delete" && undone.restoredId) {
+                if (undone.ownersBefore)
+                    cloudOwnersRoutine(undone.restoredId);
+                else
+                    cloudRoutineAuthors.wrote(undone.restoredId, CLOUD_NOBODY_KEY);
+            }
+        }
+        result = undone;
+    }
+    else if (card.profileRequest) {
+        const undone = profileRequests.undo({ botId, threadId, requestId });
+        if (undone.claimed && undone.state === "undone") {
+            const target = store.bot(undone.targetBotId);
+            if (target)
+                broadcast({ kind: "bot", bot: wireBot(target) });
+        }
+        result = undone;
+    }
+    else if (card.modelRequest) {
+        const undone = modelRequests.undo({ botId, threadId, requestId });
+        if (undone.claimed && undone.state === "undone") {
+            const target = store.bot(undone.targetBotId);
+            if (target)
+                broadcast({ kind: "bot", bot: wireBot(target) });
+        }
+        result = undone;
+    }
+    else if (card.skillRequest) {
+        result = undoSkillCard(botId, threadId, message.id);
+    }
+    if (!result.claimed)
+        return json(res, 409, { error: "Only a change that applied on its own can be undone here." });
+    if (result.state === "invalid") {
+        return json(res, result.status, { error: result.error, ...(result.stale ? { code: "changed-since" } : {}) });
+    }
+    if (result.state === "undone") {
+        appendDecision(DATA_DIR, {
+            threadId, requestId, botId, botName: store.bot(botId)?.name,
+            tool: card.tool, summary: card.subtitle, decision: "user-undone", source: "user",
+        });
+    }
+    json(res, 200, { ok: true, undone: true, ...(result.state === "already_undone" ? { alreadyUndone: true } : {}) });
+}
 // Webhook definitions are independent from calendar schedules, but every
 // delivery joins the same RoutineManager queue. That keeps unattended work
 // ordered behind a busy MAUS and gives webhook runs the same durable receipts.
@@ -11437,10 +11693,9 @@ const webhooks = new WebhookManager({
             return;
         store.appendMessage(threadId, { role: "bot", kind: "text", text, webhookPost: true });
     },
-    // Mirrors resolveResultsThread's routines wiring a few hundred lines up
-    // in this same file: create-on-first-use, never activated (so it never
-    // steals the bot's live selection the way POST /api/bots/:id/tasks
-    // does), reused forever after via trigger.resultsThreadId.
+    // Create-on-first-use, never activated (so it never steals the bot's
+    // live selection the way POST /api/bots/:id/tasks does), reused forever
+    // after via trigger.resultsThreadId.
     resolvePostThread: (trigger, forceNew) => {
         if (!forceNew && trigger.resultsThreadId)
             return trigger.resultsThreadId;
@@ -12207,6 +12462,10 @@ setupRetry = 0) {
             { id: "skill-instructions", label: "Skill instructions", text: renderSkillInstructions(selectedSkills, { includeRoot: Boolean(workspace) }) },
             { id: "playbooks", label: "Playbooks", text: installedPlaybookInstructions(text, bot.playbooks) },
         ]);
+        // The engines read at start is part of setup (it learns what this engine
+        // supports): wait for it before the claim below.
+        if (enginesRead)
+            await enginesRead;
         // run the turn and wait for it to settle, folding the reply text so a
         // chained @mention can be routed afterwards
         // Claim only after setup succeeded. An unavailable, busy, unsupported, or
@@ -12246,7 +12505,10 @@ setupRetry = 0) {
             else
                 markCancelledProviderHandshake(threadId, retirementOwner);
         };
-        const timeoutMinutes = roomTurnTimeoutMinutes(cfg);
+        const liveGroup = store.group(groupId) ?? group;
+        const timeoutMinutes = effectiveRoomTurnTimeoutMinutes(roomTurnTimeoutMinutes(cfg), liveGroup.dm
+            ? liveGroup.turnTimeoutMinutes
+            : store.groupTaskByThread(liveGroup.id, threadId)?.turnTimeoutMinutes);
         const outcome = await new Promise((resolve) => {
             let done = false;
             let unsub = () => { };
@@ -12334,6 +12596,7 @@ setupRetry = 0) {
                 cwd,
                 integrations,
                 mcpFromUserConfig: claudeUserMcpEnabled(cfg) && !managedPolicy.restrictsMcp(),
+                mcpCallTimeoutMs: mcpCallTimeoutMinutes(cfg) * 60_000,
                 ...(instance.instanceId === readyBot.modelSelection.instanceId
                     ? memberTurnSelection(readyBot.modelSelection)
                     : { model: instance.models.default }),
@@ -13367,14 +13630,16 @@ function roomPostEligibility(bot, group) {
     }
     return { ok: true };
 }
-function proposalPersistence(botId, threadId) {
+/** `opensCard` false for a change that applies directly: it adds no open
+ * card, so the open-card budget does not hold it back. */
+function proposalPersistence(botId, threadId, opensCard = true) {
     if (!store.bot(botId)) {
         return { ok: false, status: 403, error: "unknown sender" };
     }
     if (!connectorThread(botId, threadId)) {
         return { ok: false, status: 403, error: "source conversation does not belong to sender" };
     }
-    if (fullAccessForSource(botId, threadId))
+    if (!opensCard || fullAccessForSource(botId, threadId))
         return { ok: true };
     // Only cards on the visible branch can be acted on from the composer.
     // Abandoned branches must not permanently consume the proposal quota.
@@ -13387,14 +13652,14 @@ function proposalPersistence(botId, threadId) {
         ? { ok: false, status: 429, error: "confirm or cancel an existing proposal first" }
         : { ok: true };
 }
-function skillProposalPersistence(botId, threadId) {
+function skillProposalPersistence(botId, threadId, opensCard = true) {
     if (!store.bot(botId)) {
         return { ok: false, status: 403, error: "unknown sender" };
     }
     if (!connectorThread(botId, threadId)) {
         return { ok: false, status: 403, error: "source conversation does not belong to sender" };
     }
-    if (fullAccessForSource(botId, threadId))
+    if (!opensCard || fullAccessForSource(botId, threadId))
         return { ok: true };
     const openRequests = store.activePath(threadId).filter((message) => message.card?.skillRequest?.botId === botId &&
         !message.card.answered &&
@@ -13461,6 +13726,7 @@ function appendSkillRequestCard(args) {
         sha256: args.staged.sha256,
         warnings: args.staged.warnings,
         createdAt: Date.now(),
+        ...(args.applied && args.previous ? { previous: args.previous } : {}),
     };
     const from = store.bot(args.botId);
     store.appendMessage(args.threadId, {
@@ -13471,7 +13737,7 @@ function appendSkillRequestCard(args) {
             title: copy.title,
             subtitle: copy.subtitle,
             options: args.applied ? [] : [args.staged.action === "create" ? "Enable" : "Update", "Deny"],
-            ...(args.applied ? { answered: "allow", title: `Skill "${args.staged.name}" ${args.staged.action === "create" ? "enabled" : "updated"}` } : {}),
+            ...(args.applied ? { answered: "allow", autoApplied: true, title: `Skill "${args.staged.name}" ${args.staged.action === "create" ? "enabled" : "updated"}` } : {}),
             requestId,
             tool: copy.tool,
             skillRequest: payload,
@@ -14262,6 +14528,7 @@ function configStatus() {
         // not a secret — the settings picker shows it; "" = follow the system
         language: cfg.language ?? "",
         rooms: { turnTimeoutMinutes: roomTurnTimeoutMinutes(cfg) },
+        mcp: { callTimeoutMinutes: mcpCallTimeoutMinutes(cfg) },
         automaticRecovery: cfg.automaticRecovery ?? { enabled: false },
         // absent effort = no level is sent, so clients can tell it from any level
         newBots: cfg.newBots?.effort ? { effort: cfg.newBots.effort } : {},
@@ -14617,15 +14884,22 @@ function serveStatic(res, path) {
     try {
         const data = readFileSync(file);
         const type = MIME[extname(file)] ?? "application/octet-stream";
-        res.writeHead(200, { "content-type": type, ...(type === "text/html" ? PAGE_HEADERS : {}) });
+        // Vite puts a content hash in the name of every file it writes under
+        // /assets/, so a URL there never changes: the browser keeps it instead of
+        // downloading the bundle on every load. That only holds while public/ has
+        // no assets/ dir (index.test.ts checks). Pages are revalidated, so a new
+        // build shows up on the next load.
+        const cache = type === "text/html" ? "no-cache" : safe.startsWith("/assets/") ? "public, max-age=31536000, immutable" : null;
+        res.writeHead(200, { "content-type": type, ...(type === "text/html" ? PAGE_HEADERS : {}), ...(cache ? { "cache-control": cache } : {}) });
         res.end(data);
         return true;
     }
     catch {
-        // SPA fallback
+        // SPA fallback. Never immutable: a missing chunk answered with the page
+        // must not stay cached under the chunk's URL.
         try {
             const data = readFileSync(join(STATIC_DIR, "index.html"));
-            res.writeHead(200, { "content-type": "text/html", ...PAGE_HEADERS });
+            res.writeHead(200, { "content-type": "text/html", "cache-control": "no-cache", ...PAGE_HEADERS });
             res.end(data);
             return true;
         }
@@ -14740,6 +15014,20 @@ ROUTES.push(createBotMemoryRoutes({
     },
 }));
 ROUTES.push(createDeciderRoutes({ decider }));
+// "Switch them too": a bot's threads on a model of their own follow its model again.
+ROUTES.push(createThreadModelRoutes({
+    bot: (id) => store.bot(id),
+    busy: (botId, threadId) => threadBusy(botId, threadId),
+    follow: (botId, threadIds) => store.followBotModel(botId, threadIds, (from, to) => hostedModels?.resetTask(from, to) ?? {}),
+    // Like updateBotDefault on a thread: on a Cloud home, the owner's alone.
+    mayChangeModel: (auth) => !CLOUD_HOME || cloudOwnerSession(auth),
+    reply: (botId) => publicBot(store.bot(botId)),
+}));
+// Undo on the one-line receipt of a change that applied without a person.
+ROUTES.push(createUndoRoutes({
+    refusal: (auth, threadId, requestId) => cardAnswerRefusal(auth, threadId, requestId, "allow"),
+    undo: (auth, res, threadId, requestId) => withDecisionActor(decisionActorFor(auth), () => undoAppliedChange(res, threadId, requestId)),
+}));
 ROUTES.push(createAntigravityLeftoverRoutes({
     hosted: Boolean(hostedModels),
     isAntigravity: (instanceId) => registry.get(instanceId)?.driverKind === "antigravityAgent",
@@ -14892,6 +15180,17 @@ const handleRequest = async (req, res) => {
             if (refusal)
                 return json(res, 403, { error: refusal, code: "managed_policy" });
         }
+        // An MCP server's sign-in, started in a browser on another computer,
+        // comes back here (server/mcp-oauth.ts). Public like the loopback
+        // listener it stands in for: the state is the credential, checked once.
+        if (path === MCP_OAUTH_CALLBACK_PATH) {
+            const answer = method === "GET"
+                ? await mcpOAuth.publicCallback(req.headers.host, url.search)
+                : { status: 400, text: "Invalid sign-in callback. Return to OpenMausBot and try again." };
+            res.writeHead(answer.status, { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" });
+            res.end(answer.text);
+            return;
+        }
         // ── who is asking (server/request-auth.ts) ──────────────────────────
         // Two public routes come first: what this server is, and turning a pairing
         // code into a session. Everything else needs the loopback owner or a
@@ -15957,7 +16256,9 @@ const handleRequest = async (req, res) => {
                         forBot = { botId: target.id, name: target.name };
                     }
                 }
-                const persistence = proposalPersistence(from.id, fromThreadId);
+                // Sender and conversation only: the service checks the open-card
+                // budget once it knows whether this change opens a card at all.
+                const persistence = proposalPersistence(from.id, fromThreadId, false);
                 if (!persistence.ok) {
                     return json(res, persistence.status, { error: persistence.error });
                 }
@@ -15991,6 +16292,12 @@ const handleRequest = async (req, res) => {
                     cloudRoutineAuthors?.forget(applied.resultId);
                     cloudRoutineAuthors?.wrote(applied.resultId, CLOUD_NOBODY_KEY);
                 }
+                // Undo puts an updated or deleted routine back as the owner's only
+                // if it was theirs before this change.
+                if (applied && wasOwners && proposedCard?.autoApplied && proposedCard.routineRequest?.undo) {
+                    store.patchMessage(fromThreadId, proposed.messageId, { card: { ...proposedCard,
+                            routineRequest: { ...proposedCard.routineRequest, undo: { ...proposedCard.routineRequest.undo, ownersBefore: true } } } });
+                }
                 appendDecision(DATA_DIR, {
                     threadId: fromThreadId,
                     requestId: proposed.requestId,
@@ -16001,7 +16308,7 @@ const handleRequest = async (req, res) => {
                     // response returned to the model.
                     summary: proposedCard?.subtitle ?? proposed.summary,
                     decision: proposed.state === "applied" ? "auto-approved" : "card-shown",
-                    source: proposed.state === "applied" ? "full-access" : "routine",
+                    source: proposed.state === "applied" ? proposed.appliedBy ?? "full-access" : "routine",
                 });
                 return json(res, 201, proposed);
             }
@@ -16086,7 +16393,7 @@ const handleRequest = async (req, res) => {
                 appendDecision(DATA_DIR, {
                     threadId: body.fromThreadId, requestId: proposed.requestId, botId: from.id, botName: from.name,
                     tool: "update_profile", summary: proposed.detail, decision: proposed.state === "applied" ? "auto-approved" : "card-shown",
-                    source: proposed.state === "applied" ? "full-access" : "profile",
+                    source: proposed.state === "applied" ? proposed.appliedBy ?? "full-access" : "profile",
                 });
                 return json(res, 201, proposed);
             }
@@ -16118,7 +16425,7 @@ const handleRequest = async (req, res) => {
                 appendDecision(DATA_DIR, {
                     threadId: body.fromThreadId, requestId: proposed.requestId, botId: from.id, botName: from.name,
                     tool: "update_model", summary: proposed.detail, decision: proposed.state === "applied" ? "auto-approved" : "card-shown",
-                    source: proposed.state === "applied" ? "full-access" : "model",
+                    source: proposed.state === "applied" ? proposed.appliedBy ?? "full-access" : "model",
                 });
                 return json(res, 201, proposed);
             }
@@ -16330,7 +16637,10 @@ const handleRequest = async (req, res) => {
                 if (!connectorThread(from.id, fromThreadId)) {
                     return json(res, 403, { error: "source conversation does not belong to sender" });
                 }
-                const persistence = skillProposalPersistence(from.id, fromThreadId);
+                // Skills written here are always the sender's own, so they apply at
+                // any level, with a one-line receipt and Undo (appliesDirectly).
+                const direct = appliesDirectly(from.id, fromThreadId, from.id);
+                const persistence = skillProposalPersistence(from.id, fromThreadId, !direct);
                 if (!persistence.ok)
                     return json(res, persistence.status, { error: persistence.error });
                 const action = body.action === "create" || body.action === "update" ? body.action : "";
@@ -16356,11 +16666,15 @@ const handleRequest = async (req, res) => {
                 });
                 if ("error" in staged)
                     return json(res, 422, { error: staged.error });
-                if (fullAccessForSource(from.id, fromThreadId)) {
+                if (direct) {
+                    // What an update replaces, so Undo can put it back.
+                    const previousSkillMd = staged.action === "update" ? readSkillFile(from.id, staged.name) : null;
+                    const previousSource = listSkills(from.id).find((skill) => skill.name === staged.name)?.source;
+                    const previous = previousSkillMd !== null && previousSource ? { preview: previousSkillMd, source: previousSource } : undefined;
                     const applied = applySkillWriteWithReceipt(from.id, staged, () => {
-                        const receipt = appendSkillRequestCard({ botId: from.id, threadId: fromThreadId, staged, applied: true });
+                        const receipt = appendSkillRequestCard({ botId: from.id, threadId: fromThreadId, staged, applied: true, previous });
                         appendDecision(DATA_DIR, { threadId: fromThreadId, requestId: receipt.requestId, botId: from.id, botName: from.name,
-                            tool: "stage_skill", summary: receipt.summary, decision: "auto-approved", source: "full-access" });
+                            tool: "stage_skill", summary: receipt.summary, decision: "auto-approved", source: direct });
                     });
                     if ("error" in applied) {
                         rejectStagedSkillWrite(from.id, staged.id);
@@ -18048,6 +18362,9 @@ const handleRequest = async (req, res) => {
                     const message = store.appendMessage(threadId, {
                         role: "bot",
                         kind: "connector",
+                        // Read only by clients that predate the card (older phones draw
+                        // an unknown kind by its text); see connector-card-text.ts.
+                        text: connectorCardText(toolkit.label, item.alias),
                         ...(owner.group ? { from: { botId: owner.bot.id, name: owner.bot.name, color: owner.bot.color } } : {}),
                         connector: {
                             slug: item.slug,
@@ -18460,7 +18777,7 @@ const handleRequest = async (req, res) => {
             return json(res, 200, {
                 bots: shownBots.map((bot) => memberBot({
                     ...wireBot(bot),
-                    tasks: store.tasks(bot.id).map(wireTask),
+                    tasks: store.tasks(bot.id).map((task) => wireTask(task, bot.modelSelection)),
                     ...messagePage(bot.threadId, limit),
                 }, visible)),
                 botQueuedMessages: visible.everything ? queued : Object.fromEntries(Object.entries(queued).filter(([threadId]) => visible.thread(threadId))),
@@ -18593,7 +18910,28 @@ const handleRequest = async (req, res) => {
                 }
                 roots = messageFileRootsForThread(senderId, threadId);
             }
-            const file = await openMessageFile(href, roots);
+            // A link to a folder answers with its files; each one is then fetched
+            // by plain name under the same message grant and file checks.
+            const folderEntry = method === "POST" && body.entry !== undefined
+                ? messageFolderEntryName(body.entry)
+                : undefined;
+            if (folderEntry === null)
+                return json(res, 400, { error: "entry must be one file name" });
+            let file;
+            try {
+                file = folderEntry
+                    ? await openMessageFolderEntry(href, folderEntry, roots)
+                    : await openMessageFile(href, roots);
+            }
+            catch (error) {
+                // Only a client that asks for listings gets one; older clients keep the 400.
+                if (body?.listFolder !== true || folderEntry || error?.code !== "directory")
+                    throw error;
+                const listing = await listMessageFolder(href, roots);
+                res.setHeader("x-openmausbot-folder", "1");
+                res.setHeader("cache-control", "private, no-store");
+                return json(res, 200, listing);
+            }
             if ((streamsMessageImage || botAttachment?.kind === "image") && !file.mime.startsWith("image/")) {
                 await file.handle.close();
                 return json(res, 415, { error: "only images can be previewed here" });
@@ -19424,7 +19762,7 @@ const handleRequest = async (req, res) => {
             if (!body || typeof body !== "object" || Array.isArray(body)) {
                 return json(res, 400, { error: "body must be a JSON object" });
             }
-            const allowed = new Set(["title", "pinned"]);
+            const allowed = new Set(["title", "pinned", "turnTimeoutMinutes"]);
             if (Object.keys(body).some((key) => !allowed.has(key)))
                 return json(res, 400, { error: "unsupported channel thread setting" });
             const existing = store.groupTaskByThread(group.id, m[2]);
@@ -19432,12 +19770,16 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: "no such channel task" });
             const pinning = body.pinned !== undefined;
             const renaming = body.title !== undefined;
-            if (!pinning && !renaming)
+            const limiting = Object.prototype.hasOwnProperty.call(body, "turnTimeoutMinutes");
+            if (!pinning && !renaming && !limiting)
                 return json(res, 400, { error: "unsupported channel thread setting" });
             if (pinning && typeof body.pinned !== "boolean")
                 return json(res, 400, { error: "pinned must be a boolean" });
             if (renaming && typeof body.title !== "string")
                 return json(res, 400, { error: "title must be a string" });
+            const parsedLimit = limiting ? parseConversationTurnTimeout(body.turnTimeoutMinutes) : null;
+            if (parsedLimit && !parsedLimit.ok)
+                return json(res, 400, { error: parsedLimit.error });
             // Echoing the current title lets a newer client pin on an older server
             // without the old handler turning a missing title into "Untitled".
             // That echo is not a rename. A real rename stays blocked while working.
@@ -19445,10 +19787,19 @@ const handleRequest = async (req, res) => {
             const notYours = titleChange ? cloudThreadRefusal(auth, m[2]) : null;
             if (notYours)
                 return json(res, 403, { error: notYours });
-            if (channelTaskBlocked(group) && !(pinning && !titleChange)) {
+            // A longer limit applies to the next turn, so it can be saved while
+            // this one is still running. A rename still waits.
+            const settingsOnly = !titleChange && (pinning || limiting);
+            if (channelTaskBlocked(group) && !settingsOnly) {
                 return json(res, 409, { error: "this channel is working or waiting on you — finish that turn first" });
             }
             let task = existing;
+            if (limiting && parsedLimit?.ok) {
+                const limited = store.setGroupTaskTurnTimeout(group.id, m[2], parsedLimit.minutes);
+                if (!limited)
+                    return json(res, 404, { error: "no such channel task" });
+                task = limited;
+            }
             if (pinning) {
                 const pinned = store.setGroupTaskPinned(group.id, m[2], body.pinned === true);
                 if (!pinned)
@@ -20282,10 +20633,12 @@ const handleRequest = async (req, res) => {
             }
             // patchBot persists first and emits the canonical bot change, which the
             // store listener above turns into the slim wire-format SSE broadcast.
+            // Every thread that follows the bot moves with it; the selected thread
+            // follows it from now on too, as if picked there.
             const bot = store.patchBot(existing.id, { modelSelection: checked.selection });
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
-            store.patchTask(bot.id, selected.threadId, { modelSelection: checked.selection,
+            store.patchTask(bot.id, selected.threadId, { modelSelection: undefined,
                 ...hostedModels?.resetTask(selected.modelSelection, checked.selection) });
             return json(res, 200, { bot: wireBot(bot) });
         }
@@ -20971,8 +21324,10 @@ const handleRequest = async (req, res) => {
             // and pins that already match stay; returning to Auto sweeps nothing.
             if (computerSpecified && requestedComputer !== undefined)
                 store.clearAutoSurfacePins(m[1], requestedComputer);
+            // A new bot model moves every thread that follows the bot; the selected
+            // thread follows it from now on too.
             if (normalizedSelection && selectedTask)
-                store.patchTask(bot.id, selectedTask.threadId, { modelSelection: normalizedSelection,
+                store.patchTask(bot.id, selectedTask.threadId, { modelSelection: undefined,
                     ...hostedModels?.resetTask(selectedTask.modelSelection, normalizedSelection) });
             if (existingBot && (bot.browserProfile !== beforeBrowserProfile || bot.browser !== beforeBrowserEnabled)) {
                 browserLive.closeForBot(bot.id);
@@ -21769,12 +22124,15 @@ const handleRequest = async (req, res) => {
             if (phoneSecretSubmissions.hasThread(bot.threadId)) {
                 return json(res, 409, { error: "this task is securely saving a credential — try again when it finishes" });
             }
-            if (!registry.get(bot.modelSelection.instanceId)) {
+            // A thread's own model that can't run gives way to the bot's when the
+            // rerun starts (healThreadModel), so check the model it will run on.
+            const rerunSelection = turnSelection(bot.id, bot.threadId) ?? bot.modelSelection;
+            if (!registry.get(rerunSelection.instanceId)) {
                 return json(res, 409, {
-                    error: `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`,
+                    error: `provider instance "${rerunSelection.instanceId}" is unavailable — pick another model in settings`,
                 });
             }
-            const rerunInstance = registry.get(bot.modelSelection.instanceId);
+            const rerunInstance = registry.get(rerunSelection.instanceId);
             const rerunRefusal = policyModelRefusal(rerunInstance);
             if (rerunRefusal)
                 return json(res, 409, { error: rerunRefusal });
@@ -22205,7 +22563,7 @@ const handleRequest = async (req, res) => {
             // Who opened it decides who may answer its cards on a shared workspace.
             if (auth.kind === "session")
                 threadStarters.set(task.threadId, actorKey(auth));
-            return json(res, 201, { bot: publicBot(store.bot(bot.id)), task: wireTask(task) });
+            return json(res, 201, { bot: publicBot(store.bot(bot.id)), task: wireTask(task, store.bot(bot.id).modelSelection) });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/tasks\/([\w-]+)$/);
         if (m && method === "POST") {
@@ -22223,7 +22581,7 @@ const handleRequest = async (req, res) => {
             const switched = store.switchTask(bot.id, m[2]);
             if (!switched)
                 return json(res, 404, { error: "no such task" });
-            const switchedSettings = { ...wireBot(switched), tasks: store.tasks(switched.id).map(wireTask) };
+            const switchedSettings = { ...wireBot(switched), tasks: store.tasks(switched.id).map((task) => wireTask(task, switched.modelSelection)) };
             // "0" is settings only, a positive page is a bounded transcript, and no
             // parameter is the whole thread — the one branch that materialises it.
             // Search results land through that branch (src/lib/focus-message.ts):
@@ -22305,7 +22663,7 @@ const handleRequest = async (req, res) => {
                 const task = store.refreshTaskPermissions(profile.id, m[2]);
                 if (!task)
                     return json(res, 404, { error: "no such task" });
-                return json(res, 200, { task: wireTask(task), bot: publicBot(store.bot(profile.id)) });
+                return json(res, 200, { task: wireTask(task, store.bot(profile.id).modelSelection), bot: publicBot(store.bot(profile.id)) });
             }
             const patch = {};
             if (body.projectId !== undefined) {
@@ -22411,7 +22769,7 @@ const handleRequest = async (req, res) => {
             const task = patch.modelSelection
                 ? store.switchTaskModel(m[1], m[2], patch.modelSelection, body.updateBotDefault === true, body.resetApprovalToAsk === true, { ...patch, ...hostedModels?.resetTask(current.modelSelection, patch.modelSelection) })
                 : store.patchTask(m[1], m[2], patch);
-            return json(res, 200, { task: wireTask(task), bot: publicBot(store.bot(m[1])) });
+            return json(res, 200, { task: wireTask(task, store.bot(m[1]).modelSelection), bot: publicBot(store.bot(m[1])) });
         }
         if (m && method === "DELETE") {
             const bot = store.bot(m[1]);
@@ -22483,7 +22841,7 @@ const handleRequest = async (req, res) => {
                 const task = store.retitleTask(m[1], m[2], startedFrom, title) ?? store.taskByThread(m[1], m[2]);
                 if (!task)
                     return json(res, 404, { error: "no such task" });
-                return json(res, 200, { task: wireTask(task) });
+                return json(res, 200, { task: wireTask(task, store.bot(m[1]).modelSelection) });
             }
             finally {
                 titleRegenerations.delete(m[2]);
@@ -23061,7 +23419,17 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: "That does not look like an API key." });
             const url = typeof body?.url === "string" && body.url.trim() ? body.url.trim() : (saved && "url" in saved ? saved.url : undefined);
             res.setHeader("cache-control", "no-store");
-            return json(res, 200, await checkProviderKey({ provider: kind, key, url }));
+            const verdict = await checkProviderKey({ provider: kind, key, url });
+            // A Test is a real use the person chose: the engines on this key agree
+            // with its verdict. Claude runs its key through its CLI, not here.
+            if (kind !== "anthropic") {
+                const base = providerBaseUrl(kind, url);
+                if (verdict.ok)
+                    noteKeyAccepted(base, key);
+                else if (verdict.reason === "rejected")
+                    noteKeyRejected(base, key);
+            }
+            return json(res, 200, verdict);
         }
         if (method === "GET" && path === "/api/decisions") {
             const rawLimit = url.searchParams.get("limit");
@@ -23514,7 +23882,7 @@ const handleRequest = async (req, res) => {
                 mcpProbesInFlight -= 1;
             }
         }
-        // The loopback listener and authenticated paste-back complete the same flow.
+        // The loopback listener, the public callback and authenticated paste-back complete the same flow.
         const mcpSignIn = /^\/api\/mcp\/servers\/([a-z][a-z0-9_-]{0,31})\/(sign-in|sign-out)(?:\/([0-9a-f-]{36}))?$/.exec(path);
         if (mcpSignIn) {
             const [, name, action, flowId] = mcpSignIn;
@@ -23550,7 +23918,14 @@ const handleRequest = async (req, res) => {
                     return json(res, 200, { auth: await mcpOAuth.completeCallback(name, flowId, body.callbackUrl, owner) });
                 }
                 if (action === "sign-in" && method === "POST" && !flowId) {
-                    const started = await mcpOAuth.start(name, url, undefined, owner);
+                    // A browser on another computer cannot reach this machine's
+                    // loopback: it comes back to the https address it is using now,
+                    // when that is one this server vouches for (mcpCallbackOrigin).
+                    const remote = auth.kind === "session" && (isProxied(req) || !isLoopbackHost(req.headers.host));
+                    const origin = remote
+                        ? mcpCallbackOrigin(provesSameOrigin(req) ? requestOrigin(req) : null, [CLOUD_HOME?.publicOrigin, hostedWorkspaceConfiguration()?.tenant.origin, savedCustomDomain(), FALLBACK_PUBLIC_URL])
+                        : null;
+                    const started = await mcpOAuth.start(name, url, undefined, owner, { remote, origin });
                     if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
                         mcpOAuth.revokeOwner(owner);
                         return json(res, 401, { error: "Your session ended. Start a new sign-in." });
@@ -24091,6 +24466,12 @@ const handleRequest = async (req, res) => {
                         browserCleanup.abort(request);
                     throw error;
                 }
+                // A saved or cleared key starts over: neither it nor the key it
+                // replaced stays marked as rejected.
+                const resetKeys = PROVIDER_KEY_KINDS.flatMap((kind) => {
+                    const next = patch[kind]?.key;
+                    return next === undefined ? [] : [cfg[kind]?.key, next];
+                });
                 let configWriteCommitted = false;
                 const externalSecretStorage = url.searchParams.get("secretStorage") === "external";
                 try {
@@ -24156,6 +24537,9 @@ const handleRequest = async (req, res) => {
                     }
                     throw error;
                 }
+                for (const key of resetKeys)
+                    if (key)
+                        forgetKey(key);
                 // Desktops already counting down move to the new window at once, in
                 // every isolation mode; busy work still defers its expiry.
                 if (patch.localVm?.idleTimeoutMinutes !== undefined) {
@@ -24772,7 +25156,7 @@ const handleRequest = async (req, res) => {
     catch (e) {
         const status = e?.status ?? 500;
         const candidateCode = e?.code;
-        const code = typeof candidateCode === "string" && ["guarded_busy", "guarded_branch", "guarded_permissions", "guarded_request_changed", "guarded_request_untracked"].includes(candidateCode)
+        const code = typeof candidateCode === "string" && ["guarded_busy", "guarded_branch", "guarded_permissions", "guarded_request_changed", "guarded_request_untracked", "outside_workspace"].includes(candidateCode)
             ? candidateCode : undefined;
         return json(res, status, { error: e instanceof Error ? e.message : String(e), ...(code ? { code } : {}) });
     }
@@ -24922,12 +25306,22 @@ restoreChannelMessages();
     if (movedAutoPins)
         console.log(`Works on: moved ${movedAutoPins} auto-pinned thread(s) to their bot's current Works on`);
 }
-server.listen(PORT, "127.0.0.1", () => {
+server.listen(PORT, "127.0.0.1", async () => {
     companyRuntimeReady();
     console.log(`openmausbot server on http://127.0.0.1:${PORT}`);
+    // Words queued before the restart start first, ahead of anything sent from
+    // now on. Their turns wait for the engines read at start like every turn.
     followupsReady = true;
     drainQueuedSends();
     drainQueuedChannelSends();
+    // The work below wakes delegators, and a woken delegator keeps its session
+    // only on an engine that records what it was handed, which that read finds
+    // out: it starts once the read is done.
+    if (enginesRead) {
+        await enginesRead;
+        if (companyShutdown)
+            return;
+    }
     // Startup work uses the same turn dispatcher and local tool endpoint as
     // ordinary chat. Start only once every registry is initialized and the
     // endpoint is listening; earlier dispatch can hit uninitialized bindings.