openmausbot 0.1.97 → 0.1.99

package/dist-server/server/profile-requests.js

@@ -11,6 +11,7 @@ import { PROFILE_REQUEST_FIELDS } from "../shared/profile-request.js";
 import { parseBotProfilePatch } from "./bot-profile.js";
 import { validateBotCwd } from "./bot-cwd.js";
 import { newId } from "./contracts.js";
+import { UNDO_STALE } from "./direct-apply.js";
 import { profileRevision, profileSnapshot } from "./profile-revision.js";
 import { recordProfileChange } from "./profile-versions.js";
 import { redactSecretsInText } from "./redact.js";
@@ -205,6 +206,9 @@ export class ProfileRequestService {
         const snapshot = profileSnapshot(target);
         const before = {};
         const finalChanges = {};
+        // Undo restores `before`, so it is offered only when the card holds the
+        // old values exactly (credential-shaped text is scrubbed from cards).
+        let exactBefore = true;
         for (const field of PROFILE_REQUEST_FIELDS) {
             if (field === "notifications" || field === "speakReplies") {
                 const value = changes[field];
@@ -218,6 +222,8 @@ export class ProfileRequestService {
                 if (value === undefined || value === snapshot[field])
                     continue;
                 before[field] = redactSecretsInText(snapshot[field]);
+                if (before[field] !== snapshot[field])
+                    exactBefore = false;
                 finalChanges[field] = value;
             }
         }
@@ -240,11 +246,14 @@ export class ProfileRequestService {
             expectedRevision: profileRevision(target),
         };
         const copy = profileCardCopy({ name: targetName, crossBot }, snapshot, before, finalChanges, reason);
-        const persistence = this.canPersist?.(args.botId, args.threadId);
+        const grant = submitted ? this.autoApply?.(args.botId, args.threadId, targetBotId) ?? null : null;
+        // A new working folder widens what the bot's tools read and write
+        // without asking, so below Full access it keeps today's card.
+        const automatic = grant === "full-access" || (grant === "self" && finalChanges.cwd === undefined);
+        const persistence = this.canPersist?.(args.botId, args.threadId, !automatic);
         if (persistence && !persistence.ok) {
             throw new ProfileRequestError(persistence.error, persistence.status);
         }
-        const automatic = submitted && this.autoApply?.(args.botId, args.threadId) === true;
         const messageInput = {
             role: "bot",
             kind: "options",
@@ -267,10 +276,77 @@ export class ProfileRequestService {
         // The hidden receipt is persisted before the profile changes. The same
         // validation and durable commit marker serve both automatic and human decisions.
         const result = this.resolve({ botId: args.botId, threadId: args.threadId, requestId, behavior: "allow" });
-        if (result.state === "applied")
-            return { ...proposal, result };
+        if (result.state === "applied") {
+            if (!result.settlementPending)
+                this.recordAutoApplied(args.threadId, message.id, targetBotId, exactBefore);
+            return { ...proposal, result, appliedBy: grant };
+        }
         throw new ProfileRequestError(result.state === "invalid" ? result.error : "The profile change could not be applied", result.state === "invalid" ? result.status : 409);
     }
+    /** Marks a card whose change applied without a person, with the revision
+     * its Undo checks. A failure here only loses the Undo. */
+    recordAutoApplied(threadId, messageId, targetBotId, exactBefore) {
+        try {
+            const card = this.store.messagesFor(threadId).find((candidate) => candidate.id === messageId)?.card;
+            const target = this.store.bot(targetBotId);
+            if (!card?.profileRequest || !target)
+                return;
+            this.store.patchMessage(threadId, messageId, {
+                card: {
+                    ...card,
+                    autoApplied: true,
+                    profileRequest: { ...card.profileRequest, ...(exactBefore ? { undo: { appliedRevision: profileRevision(target) } } : {}) },
+                },
+            });
+        }
+        catch {
+            // The profile change itself is durable; only its Undo is lost.
+        }
+    }
+    /** Puts back the fields a change that applied without a person changed.
+     * Authorized by the caller exactly like answering the card; refuses,
+     * applying nothing, once the profile changed since. */
+    undo(args) {
+        const message = this.store
+            .messagesFor(args.threadId)
+            .find((candidate) => candidate.card?.requestId === args.requestId && candidate.card.profileRequest);
+        const card = message?.card;
+        const payload = card?.profileRequest;
+        if (!message || !card || !payload)
+            return { claimed: false };
+        if (card.undone)
+            return { claimed: true, state: "already_undone" };
+        const cannot = (error, status = 409) => ({ claimed: true, state: "invalid", error, status });
+        if (!card.autoApplied || card.answered !== "allow")
+            return cannot("Only a change that applied on its own can be undone here.");
+        if (payload.botId !== args.botId || payload.threadId !== args.threadId) {
+            return cannot("This profile change belongs to another conversation", 403);
+        }
+        if (!payload.undo)
+            return cannot("This change can't be undone here.");
+        const target = this.store.bot(payload.targetBotId);
+        if (!target || profileRevision(target) !== payload.undo.appliedRevision) {
+            return { claimed: true, state: "invalid", error: UNDO_STALE, status: 409, stale: true };
+        }
+        const { cwd, ...rest } = payload.before;
+        const patch = {};
+        for (const field of PROFILE_REQUEST_FIELDS) {
+            if (field === "cwd" || payload.changes[field] === undefined)
+                continue;
+            patch[field] = rest[field];
+        }
+        if (payload.changes.cwd !== undefined) {
+            const checked = validateBotCwd(cwd || null);
+            if (!checked.ok)
+                return cannot(checked.error);
+            patch.cwd = checked.cwd ?? undefined;
+        }
+        if (!this.store.patchBotProfile(target.id, patch))
+            return cannot(NO_SUCH_BOT, 404);
+        recordProfileChange(target.id, "user", `undo:${message.id}`, payload.changes, payload.before);
+        this.store.patchMessage(args.threadId, message.id, { card: { ...card, undone: true } });
+        return { claimed: true, state: "undone", targetBotId: target.id };
+    }
     /** Claims a profile card even after it was settled, so a duplicate click
      * never re-applies an already-applied change. */
     resolve(args) {

package/dist-server/server/provider-key-check.js

@@ -14,9 +14,13 @@ export function isLoopback(hostname) {
     const host = hostname.replace(/^\[|\]$/g, "");
     return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.startsWith("127.");
 }
+/** A provider's base URL: the configured one, or its default. */
+export function providerBaseUrl(provider, base) {
+    return (base?.trim() || DEFAULT_URLS[provider]).replace(/\/+$/, "");
+}
 /** The models endpoint for a provider, from its base URL or the default. */
 export function providerModelsUrl(provider, base) {
-    const root = (base?.trim() || DEFAULT_URLS[provider]).replace(/\/+$/, "");
+    const root = providerBaseUrl(provider, base);
     if (provider === "anthropic")
         return root.endsWith("/v1") ? `${root}/models` : `${root}/v1/models`;
     return `${root}/models`;

package/dist-server/server/request-auth.js

@@ -283,6 +283,7 @@ export const CLIENT_ALLOW = [
     // approvals and cards
     { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/respond$/ },
     { methods: ["POST"], path: /^\/api\/threads\/[\w-]+\/respond$/ },
+    { methods: ["POST"], path: /^\/api\/threads\/[\w-]+\/undo$/ }, // whoever may answer the card: see the handler
     { methods: ["PATCH"], path: /^\/api\/bots\/[\w-]+\/cards\/[\w-]+$/ },
     { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/secret-cards\/[\w-]+\/(?:resume|dismiss)$/ },
     { methods: ["GET"], path: /^\/api\/bots\/[\w-]+\/connector-cards\/[\w-]+\/status$/ },
@@ -340,7 +341,7 @@ export function clientBotPatchViolation(body) {
     return null;
 }
 /** Same for a room: name and reading state, never its folder or who answers. */
-const CLIENT_GROUP_PATCH_FIELDS = new Set(["name", "bulletin", "unread", "pinnedMessageId", "section"]);
+const CLIENT_GROUP_PATCH_FIELDS = new Set(["name", "bulletin", "unread", "pinnedMessageId", "section", "turnTimeoutMinutes"]);
 export function clientGroupPatchViolation(body) {
     if (!body || typeof body !== "object" || Array.isArray(body))
         return "body";

package/dist-server/server/room-turn-timeout.js

@@ -1,6 +1,34 @@
+import { MAX_ROOM_TURN_TIMEOUT_MINUTES, MIN_ROOM_TURN_TIMEOUT_MINUTES, } from "./config.js";
 export function roomTurnTimeoutMs(minutes) {
     return minutes * 60_000;
 }
+/** A conversation may replace the global group ceiling. Null clears that
+ * choice. Anything else is refused rather than silently clamped. */
+export function parseConversationTurnTimeout(value) {
+    if (value === null)
+        return { ok: true, minutes: null };
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < MIN_ROOM_TURN_TIMEOUT_MINUTES ||
+        value > MAX_ROOM_TURN_TIMEOUT_MINUTES) {
+        return {
+            ok: false,
+            error: "Turn limit must be a whole number from 1 to 1,440, or null to use the group default.",
+        };
+    }
+    return { ok: true, minutes: value };
+}
+/** The ceiling captured for one turn. An override wins; a missing or
+ * unusable one keeps the global group limit. */
+export function effectiveRoomTurnTimeoutMinutes(globalMinutes, override) {
+    if (typeof override === "number" &&
+        Number.isInteger(override) &&
+        override >= MIN_ROOM_TURN_TIMEOUT_MINUTES &&
+        override <= MAX_ROOM_TURN_TIMEOUT_MINUTES) {
+        return override;
+    }
+    return globalMinutes;
+}
 /**
  * One room turn's slice of the configured room ceiling.
  *

package/dist-server/server/routes/thread-models.js

@@ -0,0 +1,36 @@
+import { sameModelSelection } from "../../shared/thread-model.js";
+import { PASS } from "./table.js";
+const MAX_THREAD_IDS = 10_000;
+export function createThreadModelRoutes(deps) {
+    return async ({ req, res, path, method, auth, json, readBody }) => {
+        const m = path.match(/^\/api\/bots\/([\w-]+)\/threads\/follow-model$/);
+        if (!m || method !== "POST")
+            return PASS;
+        const bot = deps.bot(m[1]);
+        if (!bot)
+            return json(res, 404, { error: "no such bot" });
+        if (!deps.mayChangeModel(auth))
+            return json(res, 403, { error: "On this Cloud only its owner can change a bot's model." });
+        const body = await readBody(req);
+        if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((key) => key !== "threadIds")) {
+            return json(res, 400, { error: "send {} or { threadIds }" });
+        }
+        const raw = body.threadIds;
+        if (raw !== undefined && (!Array.isArray(raw) || raw.length > MAX_THREAD_IDS || raw.some((id) => typeof id !== "string"))) {
+            return json(res, 400, { error: "threadIds must be a list of this bot's thread ids" });
+        }
+        const tasks = bot.tasks ?? [];
+        const ids = new Set(tasks.map((task) => task.threadId));
+        const foreign = raw?.find((id) => !ids.has(id));
+        if (foreign !== undefined)
+            return json(res, 400, { error: `"${foreign}" is not one of this bot's threads` });
+        if (bot.approvalGrant)
+            return json(res, 409, { error: "wait for the approval-level change to finish before changing models" });
+        const listed = raw === undefined ? null : new Set(raw);
+        const own = tasks.filter((task) => (!listed || listed.has(task.threadId)) &&
+            task.modelSelection !== undefined && !sameModelSelection(task.modelSelection, bot.modelSelection));
+        const busy = own.filter((task) => deps.busy(bot.id, task.threadId));
+        const switched = deps.follow(bot.id, own.filter((task) => !busy.includes(task)).map((task) => task.threadId));
+        return json(res, 200, { switched: switched.length, busy: busy.length, bot: deps.reply(bot.id) });
+    };
+}

package/dist-server/server/routes/undo.js

@@ -0,0 +1,17 @@
+import { PASS } from "./table.js";
+export function createUndoRoutes(deps) {
+    return async ({ req, res, path, method, auth, json, readBody }) => {
+        const m = path.match(/^\/api\/threads\/([\w-]+)\/undo$/);
+        if (!m || method !== "POST")
+            return PASS;
+        const threadId = m[1];
+        const body = await readBody(req);
+        const requestId = typeof body?.requestId === "string" ? body.requestId : "";
+        if (!requestId)
+            return json(res, 400, { error: "requestId is required" });
+        const refusal = deps.refusal(auth, threadId, requestId);
+        if (refusal)
+            return json(res, 403, { error: refusal });
+        deps.undo(auth, res, threadId, requestId);
+    };
+}

package/dist-server/server/routine-requests.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { cronScheduleLabel } from "../shared/cron-label.js";
 import { normalizeCronSchedule, nextCronRuns } from "../shared/routine-schedule.js";
 import { newId } from "./contracts.js";
+import { SELF_ROUTINE_CAP, UNDO_STALE } from "./direct-apply.js";
 import { redactSecretsInText } from "./redact.js";
 import { parseJson, schemaIssue } from "./schema.js";
 import { intervalHasRestrictions, nextOccurrence, } from "./routines.js";
@@ -200,6 +201,19 @@ const storedOperationSchema = z.discriminatedUnion("action", [
     z.object({ action: z.literal("run_now"), ...storedManageBase }).strict(),
     z.object({ action: z.literal("delete"), ...storedManageBase }).strict(),
 ]);
+const storedSnapshotSchema = storedDefinitionSchema.extend({
+    enabled: z.boolean(),
+    target: z.literal("room-goal").optional(),
+    groupId: z.string().min(1).max(128).optional(),
+    resultsThreadId: z.string().min(1).max(128).optional(),
+}).strict();
+const storedUndoSchema = z.object({
+    name: z.string().max(200),
+    schedule: storedScheduleSchema.optional(),
+    appliedUpdatedAt: z.number().int().nonnegative().optional(),
+    before: storedSnapshotSchema.optional(),
+    ownersBefore: z.boolean().optional(),
+}).strict();
 const routineRequestCardDataSchema = z.object({
     version: z.literal(1),
     requestId: z.string().min(1).max(128),
@@ -209,6 +223,7 @@ const routineRequestCardDataSchema = z.object({
     operation: storedOperationSchema,
     appliedAt: z.number().int().nonnegative().optional(),
     resultId: z.string().min(1).max(128).optional(),
+    undo: storedUndoSchema.optional(),
 }).strict();
 export class RoutineRequestError extends Error {
     status;
@@ -896,6 +911,47 @@ function revalidateOperation(operation, manager, botId, now) {
         }
     }
 }
+/** The routine as it stands, kept for Undo. None when it carries what a
+ * card cannot hold exactly: attachments, or credential-shaped text the
+ * transcript scrubs. */
+function routineSnapshot(routine) {
+    if (routine.attachments?.length)
+        return undefined;
+    if (redactSecretsInText(routine.name) !== routine.name || redactSecretsInText(routine.prompt) !== routine.prompt)
+        return undefined;
+    const snapshot = {
+        name: routine.name,
+        instructions: routine.prompt,
+        schedule: structuredClone(routine.schedule),
+        runOn: routine.runOn,
+        durationMinutes: routine.durationMinutes,
+        ...(routine.timeoutMinutes === undefined ? {} : { timeoutMinutes: routine.timeoutMinutes }),
+        ...(routine.continuity ? { continuity: true } : {}),
+        ...(routine.overlap === "queue" ? { overlap: "queue" } : {}),
+        enabled: routine.enabled,
+        ...(routine.target === "room-goal" ? { target: "room-goal" } : {}),
+        ...(routine.groupId ? { groupId: routine.groupId } : {}),
+        ...(routine.resultsThreadId ? { resultsThreadId: routine.resultsThreadId } : {}),
+    };
+    return storedSnapshotSchema.safeParse(snapshot).success ? snapshot : undefined;
+}
+/** Puts an updated routine's definition back exactly: an interval's
+ * restrictions are cleared explicitly, since an omitted one is kept. */
+function restorePatch(before, now) {
+    const schedule = asSchedule(before.schedule, now);
+    return {
+        name: before.name,
+        prompt: before.instructions,
+        runOn: before.runOn,
+        schedule: schedule.type === "interval"
+            ? { ...schedule, weekdays: schedule.weekdays ?? null, window: schedule.window ?? null, endsAt: schedule.endsAt ?? null }
+            : schedule,
+        durationMinutes: before.durationMinutes,
+        timeoutMinutes: before.timeoutMinutes ?? null,
+        continuity: before.continuity === true,
+        overlap: before.overlap ?? "skip",
+    };
+}
 export class RoutineRequestService {
     store;
     routines;
@@ -968,18 +1024,27 @@ export class RoutineRequestService {
         };
         if (args.from)
             messageInput.from = args.from;
+        // Resolve the current source-thread grant after the asynchronous probe.
+        const owner = operation.forBot?.botId ?? botId;
+        const grant = submitted ? this.autoApply?.(botId, threadId, owner) ?? null : null;
+        // A bot applying its own routines keeps at most SELF_ROUTINE_CAP of them
+        // on; a create or resume past that shows the card, as before. Full
+        // access has no cap.
+        const automatic = grant === "full-access" || (grant === "self" && !this.overSelfCap(operation, owner));
         // This check and append are deliberately adjacent and synchronous. JS
         // cannot interleave another completed proposal between the capacity /
         // ownership decision and the durable transcript write.
-        const persistence = this.canPersist?.(botId, threadId);
+        const persistence = this.canPersist?.(botId, threadId, !automatic);
         if (persistence && !persistence.ok) {
             throw new RoutineRequestError(persistence.error, persistence.status);
         }
         if (args.canCommit && !args.canCommit()) {
             throw new RoutineRequestError("The requesting turn ended before this proposal could be saved", 401);
         }
-        // Resolve the current source-thread grant after the asynchronous probe.
-        const automatic = submitted && this.autoApply?.(botId, threadId) === true;
+        // What Undo puts back, taken before the change.
+        const before = automatic && (operation.action === "update" || operation.action === "delete")
+            ? this.snapshotOf(operation.routineId, owner)
+            : undefined;
         if (automatic) {
             messageInput.card.options = [];
             messageInput.card.dismissed = true;
@@ -1005,8 +1070,10 @@ export class RoutineRequestService {
         catch (error) {
             result = { claimed: true, state: "invalid", error: error instanceof Error ? error.message : String(error), status: error instanceof RoutineRequestError ? error.status : 400 };
         }
-        if (result.state === "applied")
-            return { ...proposal, result };
+        if (result.state === "applied") {
+            this.recordAutoApplied(threadId, message.id, definition, before);
+            return { ...proposal, result, ...(grant ? { appliedBy: grant } : {}) };
+        }
         // The scheduler commit can succeed even if settling its transcript
         // fails. Report that exact result; a retry only finishes the receipt.
         const receipt = this.routines.routineRequestReceipt(requestId);
@@ -1015,10 +1082,147 @@ export class RoutineRequestService {
             return { ...proposal, result: {
                     claimed: true, state: "applied", action: receipt.action, resultId: receipt.resultId,
                     settlementPending: true, message: "Routine change applied. Recording the operation receipt could not finish; the change will not be applied again.",
-                } };
+                }, ...(grant ? { appliedBy: grant } : {}) };
         }
         throw new RoutineRequestError(result.state === "invalid" ? result.error : "The routine change could not be applied", result.state === "invalid" ? result.status : 409);
     }
+    /** Whether one more enabled routine would take the bot past the cap. */
+    overSelfCap(operation, owner) {
+        if (operation.action !== "create" && operation.action !== "resume")
+            return false;
+        const enabled = this.routines.listRoutines().filter((routine) => routine.botId === owner && routine.enabled).length;
+        return enabled + 1 > SELF_ROUTINE_CAP;
+    }
+    snapshotOf(routineId, owner) {
+        const routine = ownedRoutine(this.routines, routineId, owner);
+        return routine ? routineSnapshot(routine) : undefined;
+    }
+    /** Marks a card whose change applied without a person, with what its
+     * one-line receipt and Undo need. A failure here leaves the change
+     * applied and the card as it was, only without Undo. */
+    recordAutoApplied(threadId, messageId, definition, before) {
+        try {
+            const message = this.store.messagesFor(threadId).find((candidate) => candidate.id === messageId);
+            const card = message?.card;
+            const payload = card?.routineRequest;
+            if (!message || !card || !payload)
+                return;
+            const action = payload.operation.action;
+            const routineId = payload.operation.action === "create" ? payload.resultId : payload.operation.routineId;
+            const after = routineId ? this.routines.listRoutines().find((routine) => routine.id === routineId) : undefined;
+            const undo = {
+                name: redactSecretsInText(after?.name ?? definition?.name ?? before?.name ?? "routine"),
+                ...(action === "create" || action === "update" || action === "resume"
+                    ? { schedule: structuredClone(after?.schedule ?? definition?.schedule) }
+                    : {}),
+                ...(after && (action === "update" || action === "pause" || action === "resume") ? { appliedUpdatedAt: after.updatedAt } : {}),
+                ...(before ? { before } : {}),
+            };
+            if (!storedUndoSchema.safeParse(undo).success)
+                delete undo.schedule;
+            this.store.patchMessage(threadId, messageId, {
+                card: { ...card, autoApplied: true, routineRequest: { ...payload, undo } },
+            });
+        }
+        catch {
+            // The routine change itself is durable; only its Undo is lost.
+        }
+    }
+    /** Puts back a change that applied without a person. Authorized by the
+     * caller exactly like answering the card; refuses, applying nothing, once
+     * the routine changed since. A second Undo reports already undone. */
+    undo(args) {
+        const message = this.store
+            .messagesFor(args.threadId)
+            .find((candidate) => candidate.card?.requestId === args.requestId && candidate.card.routineRequest);
+        const card = message?.card;
+        if (!message || !card)
+            return { claimed: false };
+        if (card.undone)
+            return { claimed: true, state: "already_undone" };
+        const cannot = (error, status = 409) => ({ claimed: true, state: "invalid", error, status });
+        if (!card.autoApplied || card.answered !== "allow")
+            return cannot("Only a change that applied on its own can be undone here.");
+        const parsed = routineRequestCardDataSchema.safeParse(card.routineRequest);
+        if (!parsed.success)
+            return cannot("This change can't be undone here.");
+        const payload = parsed.data;
+        if (payload.botId !== args.botId || payload.threadId !== args.threadId) {
+            return cannot("This routine change belongs to another conversation", 403);
+        }
+        const operation = payload.operation;
+        const owner = operation.forBot?.botId ?? payload.botId;
+        const undo = payload.undo;
+        const stale = { claimed: true, state: "invalid", error: UNDO_STALE, status: 409, stale: true };
+        const now = this.now();
+        let routineId;
+        let restoredId;
+        try {
+            switch (operation.action) {
+                case "run_now":
+                    return cannot("A routine run can't be undone.");
+                case "create": {
+                    routineId = payload.resultId ?? "";
+                    if (!routineId || !ownedRoutine(this.routines, routineId, owner))
+                        return stale;
+                    this.routines.remove(routineId);
+                    break;
+                }
+                case "update":
+                case "pause":
+                case "resume": {
+                    routineId = operation.routineId;
+                    if (undo?.appliedUpdatedAt === undefined || (operation.action === "update" && !undo.before)) {
+                        return cannot("This change can't be undone here.");
+                    }
+                    const current = ownedRoutine(this.routines, routineId, owner);
+                    if (!current || current.updatedAt !== undo.appliedUpdatedAt)
+                        return stale;
+                    const patch = operation.action === "update"
+                        ? restorePatch(undo.before, now)
+                        : { enabled: operation.action === "pause" };
+                    if (!this.routines.update(routineId, patch))
+                        return stale;
+                    break;
+                }
+                case "delete": {
+                    routineId = operation.routineId;
+                    const before = undo?.before;
+                    if (!before)
+                        return cannot("This change can't be undone here.");
+                    restoredId = this.routines.create({
+                        name: before.name,
+                        prompt: before.instructions,
+                        botId: owner,
+                        ...(before.target ? { target: before.target, groupId: before.groupId } : {}),
+                        runOn: before.runOn,
+                        enabled: before.enabled,
+                        schedule: asSchedule(before.schedule, now),
+                        durationMinutes: before.durationMinutes,
+                        ...(before.timeoutMinutes === undefined ? {} : { timeoutMinutes: before.timeoutMinutes }),
+                        ...(before.continuity ? { continuity: true } : {}),
+                        ...(before.overlap === "queue" ? { overlap: "queue" } : {}),
+                        ...(before.resultsThreadId ? { resultsThreadId: before.resultsThreadId } : {}),
+                    }).id;
+                    break;
+                }
+                default:
+                    return cannot("This change can't be undone here.");
+            }
+        }
+        catch (error) {
+            return cannot(redactSecretsInText(error instanceof Error ? error.message : String(error)).slice(0, 500));
+        }
+        this.store.patchMessage(args.threadId, message.id, { card: { ...card, undone: true } });
+        return {
+            claimed: true,
+            state: "undone",
+            action: operation.action,
+            routineId,
+            ...(restoredId ? { restoredId } : {}),
+            ...(undo?.ownersBefore !== undefined ? { ownersBefore: undo.ownersBefore } : {}),
+        };
+    }
     async requireCloudReadiness(operation, proposerBotId) {
         if (!this.cloudReady || operation.action === "pause" || operation.action === "delete")
             return;

package/dist-server/server/routines.js

@@ -943,7 +943,7 @@ export class RoutineManager {
         this.commitMutation(() => {
             run = this.newRun(routine, this.now(), true, allocations, request?.threadId ?? routine.sourceThreadId);
             // Preserve the invoking chat as provenance/fallback for this run.
-            // An explicitly configured results destination continues to win.
+            // The routine's results destination continues to win.
             if (request)
                 run.sourceThreadId = request.threadId;
             if (request)
@@ -1546,7 +1546,7 @@ export class RoutineManager {
         if (value === null) {
             const destination = this.options.resolveResultsThread?.(routine, true);
             if (!destination)
-                throw new Error("Could not create a results thread for this routine");
+                throw new Error("Could not find a results thread for this routine");
             routine.resultsThreadId = destination;
             return () => this.options.discardResultsThread?.(routine.botId, destination);
         }

package/dist-server/server/setup-mode.js

@@ -45,7 +45,7 @@ function folderClause(cwd) {
 function buildSetupPrompt(profileAside, cwd) {
     return ("\n\nThe user explicitly asked you to set yourself up. For this setup request, help configure the bot from what the user tells you." +
         ` First ask at most four questions that change what you would build: what the job is, when it should happen (on demand, on a schedule, or when something arrives), which apps or accounts it touches, and ${folderClause(cwd)}.` +
-        " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Ask for missing choices, not an extra yes for already-requested actions under granted Full Access." +
+        " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Ask for missing choices, not an extra yes for already-requested actions: changes to your own profile and routines apply immediately, and the person sees each with an Undo." +
         " First send one message describing the changes you are about to request, then make the tool calls. Follow each result: if applied, continue without another confirmation; if pending, end the turn and wait for its in-app decision. Do not repeat the list or claim success from the permission mode alone." +
         ` Use propose_profile for your identity, standing rules ${profileAside}, and the working folder (cwd), propose_routine only for a schedule the user requested, and request_credential for any missing token.` +
         " Full Access does not supply answers, credentials, or broader permissions for another bot. A credential request still needs the user's secure entry. Report failed or cancelled changes honestly." +

package/dist-server/server/skill-learn.js

@@ -1,6 +1,6 @@
 // `/learn` — turn a described workflow, URL, folder, or "what we just did"
 // into a reusable SKILL.md. The live agent authors the skill with skill_manage;
-// the harness applies it under granted Full Access or stages a pending review.
+// the harness applies it (a bot's own skill applies at any level) or stages a pending review.
 //
 // There is no separate distillation engine. This module only builds the
 // prompt and recognises the slash command, so it works on every engine
@@ -61,7 +61,7 @@ export function buildLearnPrompt(userRequest) {
         "1. Inventory every source the user named, using the tools you already have — file tools for local paths, web fetch for URLs, and this conversation if they referred to something you just did. If the request is ambiguous about scope, make a reasonable choice and note it; do not stall.\n" +
         "2. Check existing skills with skills_list. If one already covers this topic, leave it alone unless the user explicitly asked to revise that named learned/editable skill. For an explicit revision, read only the exact SKILL.md path listed for that skill in your system prompt (the native .agents/skills/<exact-name>/SKILL.md link is a fallback), preserve every still-valid step, re-verify what changed, then call skill_manage with action=\"update\" and skill_name set to that exact name. If you cannot read or verify the current skill, stop instead of replacing it from memory. For a genuinely new skill, use action=\"create\".\n" +
         "3. Pass source as the exact URL or folder you used, or \"conversation\" when the conversation is the source.\n" +
-        "4. Follow the skill_manage result: with granted Full Access it may apply immediately. After an applied result, continue the requested work without another confirmation. If review is pending, a create stays inactive and an update leaves the current version untouched; end the turn and wait for the in-app decision. Never claim success from the permission mode alone, and report failed or cancelled changes honestly.\n\n" +
+        "4. Follow the skill_manage result: your own skill changes apply immediately and the person sees them with an Undo. After an applied result, continue the requested work without another confirmation. If review is pending, a create stays inactive and an update leaves the current version untouched; end the turn and wait for the in-app decision. Never claim success from the permission mode alone, and report failed or cancelled changes honestly.\n\n" +
         AUTHORING_STANDARDS +
         "\n\nWhen done, tell the user the skill name and a one-line summary of what it captured.");
 }

package/dist-server/server/skills.js

@@ -29,7 +29,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { z } from "zod";
-import { writeFileAtomic } from "./atomic.js";
+import { writeFileAtomic, writeFileAtomicIfChanged } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
 import { redactSecretsInText } from "./redact.js";
 import { LEARN_SOURCE_PREFIX } from "./skill-learn.js";
@@ -191,9 +191,10 @@ function readManagedLinks(botId) {
         return [];
     }
 }
+// Rebuilt on every turn and almost always the same list.
 function writeManagedLinks(botId, names) {
     mkdirSync(skillStateDir(botId), { recursive: true, mode: 0o700 });
-    writeFileAtomic(managedLinksPath(botId), `${JSON.stringify([...new Set(names)].sort(), null, 2)}\n`, { mode: 0o600 });
+    writeFileAtomicIfChanged(managedLinksPath(botId), `${JSON.stringify([...new Set(names)].sort(), null, 2)}\n`, { mode: 0o600 });
 }
 function manifestFromFile(path) {
     try {
@@ -1188,6 +1189,36 @@ export function applySkillWriteWithReceipt(botId, staged, recordApplied) {
             message: "Skill change applied. Recording its receipt or cleaning up staging could not finish; do not apply it again." };
     }
 }
+/** Undo for a learned-skill write that applied without a person: a create
+ * is removed; an update gets the SKILL.md it replaced back, as a fresh
+ * revision through the same stage and apply path. Only while the skill is
+ * exactly as that write left it; otherwise `stale`, and nothing changes. */
+export function undoSkillWrite(botId, write) {
+    const entry = readManifest(botId)[write.name];
+    if (!entry || entry.appliedStageId !== write.stagedId || !installedLearnedSkillMatches(botId, write.name, entry)) {
+        return { stale: true };
+    }
+    if (write.action === "create") {
+        const removed = removeSkill(botId, write.name);
+        return "error" in removed ? removed : { undone: true };
+    }
+    if (!write.previous)
+        return { error: "This change can't be undone here." };
+    const staged = stageSkillWrite(botId, {
+        action: "update",
+        targetName: write.name,
+        files: [{ path: "SKILL.md", content: write.previous.skillMd }],
+        source: write.previous.source,
+    });
+    if ("error" in staged)
+        return staged;
+    const applied = applyStagedSkillWrite(botId, staged.id, { expectedSha256: staged.sha256 });
+    if ("error" in applied) {
+        rejectStagedSkillWrite(botId, staged.id);
+        return applied;
+    }
+    return { undone: true };
+}
 /** The skills block appended to a bot's system prompt: enabled skills only,
  * index lines only — the same progressive-disclosure shape the spec asks
  * agents for. Bodies never ride the prompt; the bot reads the file when a