openmausbot 0.1.98 → 0.1.100

package/dist-server/server/mcp-oauth.js

@@ -1,9 +1,11 @@
 // OAuth sign-in for URL MCP servers, the way MCP clients do it: discover
 // the authorization server from the MCP server's 401, sign in as the app
 // the person registered for this server or else register as a public
-// client when the server allows it, run PKCE through the person's browser
-// with a loopback callback (or a URL pasted from another computer), then
-// keep the tokens fresh.
+// client when the server allows it, run PKCE through the person's browser,
+// then keep the tokens fresh. The browser comes back to a loopback listener
+// on this machine; a browser on another computer (My Cloud, a hosted
+// workspace) comes back to this server's own https address instead, and
+// where it cannot, the person pastes the address the browser ended on.
 // Engines never see this: they get an ordinary Authorization header.
 //
 // The loopback listener and callback checks follow
@@ -27,7 +29,10 @@ const DEFAULT_LIFETIME_MS = 5 * 60_000;
  * that lapses mid-way. */
 const REFRESH_MARGIN_MS = 2 * 60_000;
 const REQUEST_TIMEOUT_MS = 10_000;
-const CALLBACK_PATH = "/mcp-oauth/callback";
+/** The callback path, on a loopback listener and on this server's own
+ * https address alike. */
+export const MCP_OAUTH_CALLBACK_PATH = "/mcp-oauth/callback";
+const CALLBACK_PATH = MCP_OAUTH_CALLBACK_PATH;
 /** complete()'s answer for a flow that ended while its code was spent. */
 const DISCARDED = "discarded";
 export class McpSignInError extends Error {
@@ -53,6 +58,33 @@ function preferredPort(url) {
 export function mcpOAuthRedirectUri(url) {
     return `http://127.0.0.1:${preferredPort(url)}${CALLBACK_PATH}`;
 }
+/** An exact https origin (no path, no credentials), or null. */
+function httpsOrigin(value) {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password && value.replace(/\/+$/, "") === url.origin ? url.origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The https address of this server that a browser on another computer
+ * comes back to after approving a sign-in, or null for the loopback
+ * callback. `browserOrigin` is the origin that browser proved it is using
+ * (its Origin header, equal to the request's own origin); `configured` are
+ * this server's public addresses (a Cloud home's, a hosted workspace's, a
+ * connected domain, OMB_PUBLIC_URL). The browser's own origin wins when it
+ * is one of them or none is set; otherwise the first configured one does,
+ * never a Host header nobody vouched for. */
+export function mcpCallbackOrigin(browserOrigin, configured) {
+    const known = configured.map(httpsOrigin).filter((origin) => origin !== null);
+    const proven = httpsOrigin(browserOrigin);
+    if (proven && (known.length === 0 || known.includes(proven)))
+        return proven;
+    return known[0] ?? null;
+}
 /** RFC 8414 §2: an absent list means client_secret_basic. */
 function tokenAuthMethod(meta, secret) {
     if (!secret)
@@ -116,6 +148,9 @@ function tokensFrom(body, previous) {
         ...(typeof body.scope === "string" ? { scope: body.scope } : {}),
     };
 }
+/** The authorization server answered a registration, and said no. */
+class RegistrationRefused extends Error {
+}
 export class McpOAuthManager {
     store;
     lifetimeMs;
@@ -156,7 +191,7 @@ export class McpOAuthManager {
         const { tokens: _dropped, ...rest } = this.store.get(name, url) ?? { url };
         this.store.put(name, { ...rest, url, state: "needs-sign-in" });
     }
-    start(name, url, wwwAuthenticate, owner = "loopback") {
+    start(name, url, wwwAuthenticate, owner = "loopback", browser = { remote: false }) {
         const current = this.flows.get(name);
         if (current?.status.phase === "waiting" && !this.isOwnerLive(current.owner)) {
             this.finish(current, "cancelled", "Your session ended. Start again.");
@@ -174,7 +209,7 @@ export class McpOAuthManager {
             }
             return pending.promise;
         }
-        const starting = { owner, url, cancelled: false, promise: undefined };
+        const starting = { owner, url, browser, cancelled: false, promise: undefined };
         starting.promise = this.begin(name, url, starting, wwwAuthenticate).finally(() => this.starting.delete(name));
         this.starting.set(name, starting);
         return starting.promise;
@@ -225,6 +260,24 @@ export class McpOAuthManager {
         await this.acceptCallback(flow, callback);
         return { ...flow.status };
     }
+    /** The browser came back to this server's own https address. `host` is
+     * the address it asked for (the Host header) and `search` the query it
+     * brought. The flow is the one that redirect URI and state belong to; it
+     * then passes the same one-shot checks as the listener and paste-back.
+     * The scheme is the redirect URI's: a proxy in front of this server may
+     * end TLS, so the request itself cannot say it was https. */
+    async publicCallback(host, search) {
+        const state = new URLSearchParams(search).get("state") ?? "";
+        let match;
+        for (const flow of this.flows.values()) {
+            const expected = new URL(flow.redirectUri);
+            if (!flow.server && expected.host === host?.trim().toLowerCase() && sameSecret(state, flow.state))
+                match = flow;
+        }
+        if (!match)
+            return { status: 400, text: "Invalid sign-in callback. Return to OpenMausBot and try again." };
+        return this.answer(match, new URL(`${new URL(match.redirectUri).origin}${CALLBACK_PATH}${search.startsWith("?") ? search : ""}`));
+    }
     /** Revoke with the server when it offers that (best effort), then forget. */
     async signOut(name, url) {
         this.cancel(name);
@@ -342,7 +395,7 @@ export class McpOAuthManager {
         });
         const body = await response.json().catch(() => ({}));
         if (!response.ok || typeof body.client_id !== "string" || !body.client_id) {
-            throw new Error("This server would not register OpenMausBot for sign-in. Try again later.");
+            throw new RegistrationRefused("This server would not register OpenMausBot for sign-in. Try again later.");
         }
         return body.client_id;
     }
@@ -354,6 +407,23 @@ export class McpOAuthManager {
         if (!meta)
             throw new McpOAuthError("not-oauth", "This server does not offer an OAuth sign-in. Add its token as a header instead.");
         const registered = this.clients(name, url);
+        // A browser on another computer comes back to this server's own https
+        // address. Only for a client registered now, for that address: an app
+        // registered in advance keeps the loopback redirect it was given. A
+        // server that refuses the address gets the loopback callback, pasted.
+        if (!registered && starting.browser.remote && starting.browser.origin) {
+            const redirectUri = `${starting.browser.origin}${CALLBACK_PATH}`;
+            let clientId = null;
+            try {
+                clientId = await this.register(meta, redirectUri);
+            }
+            catch (error) {
+                if (!(error instanceof RegistrationRefused))
+                    throw error;
+            }
+            if (clientId)
+                return { ...this.open(name, url, starting, meta, redirectUri, { id: clientId, method: "none" }, null, meta.scopes).status };
+        }
         const server = createServer();
         try {
             await listen(server, preferredPort(url));
@@ -374,40 +444,46 @@ export class McpOAuthManager {
                 ? { id: registered.clientId, ...(registered.clientSecret ? { secret: registered.clientSecret } : {}), method: tokenAuthMethod(meta, registered.clientSecret) }
                 : { id: await this.register(meta, redirectUri), method: "none" };
             const scopes = registered?.scopes?.length ? registered.scopes : meta.scopes;
-            if (starting.cancelled || !this.isOwnerLive(starting.owner))
-                throw new McpSignInError("Sign-in cancelled because the session or server changed.", 409);
-            const state = randomBytes(32).toString("base64url");
-            const verifier = randomBytes(32).toString("base64url");
-            const authorize = new URL(meta.authorizationEndpoint);
-            authorize.searchParams.set("response_type", "code");
-            authorize.searchParams.set("client_id", client.id);
-            authorize.searchParams.set("redirect_uri", redirectUri);
-            authorize.searchParams.set("state", state);
-            authorize.searchParams.set("code_challenge", createHash("sha256").update(verifier).digest("base64url"));
-            authorize.searchParams.set("code_challenge_method", "S256");
-            authorize.searchParams.set("resource", meta.resource);
-            if (scopes?.length)
-                authorize.searchParams.set("scope", scopes.join(" "));
-            const status = {
-                phase: "waiting",
-                flowId: randomUUID(),
-                authorizationUrl: authorize.toString(),
-                expiresAt: new Date(Date.now() + this.lifetimeMs).toISOString(),
-            };
-            const flow = {
-                owner: starting.owner, name, url, status, state, verifier, redirectUri, client, meta, server, consumed: false,
-                expiry: setTimeout(() => this.finish(flow, "expired", "Sign-in expired. Start again."), this.lifetimeMs),
-            };
-            flow.expiry.unref();
+            const flow = this.open(name, url, starting, meta, redirectUri, client, server, scopes);
             server.on("request", (request, response) => void this.callback(flow, request, response));
-            this.flows.set(name, flow);
-            return { ...status };
+            return { ...flow.status };
         }
         catch (error) {
             server.close();
             throw error;
         }
     }
+    /** Make the authorize link and keep the flow waiting for its callback. */
+    open(name, url, starting, meta, redirectUri, client, server, scopes) {
+        if (starting.cancelled || !this.isOwnerLive(starting.owner))
+            throw new McpSignInError("Sign-in cancelled because the session or server changed.", 409);
+        const state = randomBytes(32).toString("base64url");
+        const verifier = randomBytes(32).toString("base64url");
+        const authorize = new URL(meta.authorizationEndpoint);
+        authorize.searchParams.set("response_type", "code");
+        authorize.searchParams.set("client_id", client.id);
+        authorize.searchParams.set("redirect_uri", redirectUri);
+        authorize.searchParams.set("state", state);
+        authorize.searchParams.set("code_challenge", createHash("sha256").update(verifier).digest("base64url"));
+        authorize.searchParams.set("code_challenge_method", "S256");
+        authorize.searchParams.set("resource", meta.resource);
+        if (scopes?.length)
+            authorize.searchParams.set("scope", scopes.join(" "));
+        const status = {
+            phase: "waiting",
+            flowId: randomUUID(),
+            authorizationUrl: authorize.toString(),
+            expiresAt: new Date(Date.now() + this.lifetimeMs).toISOString(),
+            ...(server && starting.browser.remote ? { pasteBack: true } : {}),
+        };
+        const flow = {
+            owner: starting.owner, name, url, status, state, verifier, redirectUri, client, meta, server, consumed: false,
+            expiry: setTimeout(() => this.finish(flow, "expired", "Sign-in expired. Start again."), this.lifetimeMs),
+        };
+        flow.expiry.unref();
+        this.flows.set(name, flow);
+        return flow;
+    }
     async callback(flow, request, response) {
         response.setHeader("Cache-Control", "no-store");
         response.setHeader("Content-Type", "text/plain; charset=utf-8");
@@ -426,23 +502,25 @@ export class McpOAuthManager {
             response.writeHead(400).end("Invalid sign-in callback. Return to OpenMausBot and try again.");
             return;
         }
+        const answer = request.method === "GET"
+            ? await this.answer(flow, callback)
+            : { status: 400, text: "Invalid or expired sign-in. Return to OpenMausBot and try again." };
+        response.writeHead(answer.status).end(answer.text);
+    }
+    /** Spend a callback the browser brought back, and say how it went in
+     * words fit for a plain page: never the code or the server's own text. */
+    async answer(flow, callback) {
         try {
-            if (request.method !== "GET")
-                throw new McpSignInError("Invalid sign-in callback.", 400);
             await this.acceptCallback(flow, callback);
-            if (flow.status.phase === "failed") {
-                response.writeHead(400).end(`${flow.status.message} You can close this tab.`);
-            }
-            else {
-                response.end("Signed in. You can close this tab and return to OpenMausBot.");
-            }
+            return flow.status.phase === "failed"
+                ? { status: 400, text: `${flow.status.message} You can close this tab.` }
+                : { status: 200, text: "Signed in. You can close this tab and return to OpenMausBot." };
         }
         catch (error) {
-            response.writeHead(error instanceof McpSignInError ? error.status : 400)
-                .end("Invalid or expired sign-in. Return to OpenMausBot and try again.");
+            return { status: error instanceof McpSignInError ? error.status : 400, text: "Invalid or expired sign-in. Return to OpenMausBot and try again." };
         }
     }
-    /** Both the listener and authenticated paste-back use the same one-shot checks. */
+    /** The listener, the public callback and authenticated paste-back all use the same one-shot checks. */
     async acceptCallback(flow, callback) {
         if (!this.isOwnerLive(flow.owner))
             this.finish(flow, "cancelled", "Your session ended. Start again.");
@@ -519,8 +597,8 @@ export class McpOAuthManager {
         if (flow.status.phase !== "waiting")
             return;
         clearTimeout(flow.expiry);
-        flow.server.close();
-        flow.server.closeIdleConnections();
+        flow.server?.close();
+        flow.server?.closeIdleConnections();
         flow.status = { ...flow.status, phase, authorizationUrl: null, ...(message ? { message } : {}) };
     }
 }

package/dist-server/server/mcp-probe.js

@@ -8,7 +8,13 @@ import { killCliTree, spawnCli } from "./procs.js";
 export const SIGN_IN_REQUIRED = "This server needs you to sign in.";
 const MAX_STDOUT_BYTES = 1_048_576;
 const MAX_TOOLS = 100;
-const DEFAULT_TIMEOUT_MS = 8_000;
+/** A command starts on this computer and answers fast. */
+export const STDIO_PROBE_TIMEOUT_MS = 8_000;
+/** A URL server answers over the internet, and initialize + tools/list for
+ * an account with many businesses (Whop, admin scope) can take well over
+ * 8 seconds. The probe only runs when the person asks for it, never on a
+ * bot's turn. */
+export const REMOTE_PROBE_TIMEOUT_MS = 30_000;
 function probeEnvironment(server) {
     const env = { ...process.env, PATH: augmentedPath() };
     stripWorkspaceCredentialEnv(env);
@@ -58,19 +64,20 @@ function publicTools(raw, secrets) {
 /** Prove the MCP handshake and list the tools of one configured server,
  * whichever way it is reached. Neither path returns anything the renderer
  * must not see: child stderr, environment values, header values. */
-export function probeMcpServer(server, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
+export function probeMcpServer(server, timeoutMs, signal) {
     return isRemoteMcpServer(server)
-        ? probeRemoteMcpServer(server, timeoutMs, signal)
-        : probeStdioMcpServer(server, timeoutMs, signal);
+        ? probeRemoteMcpServer(server, timeoutMs ?? REMOTE_PROBE_TIMEOUT_MS, signal)
+        : probeStdioMcpServer(server, timeoutMs ?? STDIO_PROBE_TIMEOUT_MS, signal);
 }
-/** Connect to a remote server over its transport, bounded by the same
- * timeout as a command. HTTP status codes are safe to show and are the one
- * detail that tells a wrong token from a wrong address. */
+/** Connect to a remote server over its transport, bounded by one timeout
+ * for initialize + tools/list together. HTTP status codes are safe to show
+ * and are the one detail that tells a wrong token from a wrong address. */
 async function probeRemoteMcpServer(server, timeoutMs, signal) {
     if (signal?.aborted)
         return { ok: false, error: publicProbeError("cancelled") };
-    const timeout = AbortSignal.timeout(timeoutMs);
-    const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+    const timeout = new AbortController();
+    const timer = setTimeout(() => timeout.abort(), timeoutMs);
+    const combined = signal ? AbortSignal.any([signal, timeout.signal]) : timeout.signal;
     const client = new RemoteMcpClient(server);
     try {
         await client.initialize("OpenMausBot", combined);
@@ -84,7 +91,7 @@ async function probeRemoteMcpServer(server, timeoutMs, signal) {
     catch (error) {
         if (signal?.aborted)
             return { ok: false, error: publicProbeError("cancelled") };
-        if (timeout.aborted)
+        if (timeout.signal.aborted)
             return { ok: false, error: publicProbeError("timeout") };
         // A 401 that names an OAuth sign-in is not a wrong address or header:
         // the person has to sign in. Anything else keeps the plain status.
@@ -105,6 +112,7 @@ async function probeRemoteMcpServer(server, timeoutMs, signal) {
         return { ok: false, error: "Could not reach this address. Check the URL and your network." };
     }
     finally {
+        clearTimeout(timer);
         await client.close().catch(() => { });
     }
 }

package/dist-server/server/message-file.js

@@ -3,9 +3,9 @@
 // reader: the HTTP route supplies only roots derived from the exact bot
 // message, and this helper keeps the eventual file handle inside one of them.
 import { constants } from "node:fs";
-import { open, realpath, stat } from "node:fs/promises";
-import { basename, extname, isAbsolute, posix, relative, resolve, sep, win32 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { lstat, open, readdir, realpath, stat } from "node:fs/promises";
+import { basename, extname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { fromMarkdown } from "mdast-util-from-markdown";
 import { windowsPathDestinations } from "../shared/markdown-windows-paths.js";
 export const MESSAGE_FILE_MAX_BYTES = 25 * 1024 * 1024;
@@ -392,6 +392,8 @@ export async function openMessageFile(href, roots) {
             const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
             handle = await open(canonicalBefore, constants.O_RDONLY | noFollow);
             const opened = await handle.stat();
+            if (opened.isDirectory())
+                throw statusError(400, "the link points to a folder, not a file", "directory");
             if (!opened.isFile())
                 throw statusError(400, "the link does not point to a regular file");
             if (opened.size > MESSAGE_FILE_MAX_BYTES) {
@@ -422,6 +424,96 @@ export async function openMessageFile(href, roots) {
         throw outsideWorkspace();
     throw statusError(404, "the linked file is unavailable");
 }
+export const MESSAGE_FOLDER_MAX_ENTRIES = 200;
+/**
+ * List the regular files directly inside a message-linked folder, under the
+ * same roots and canonical containment as openMessageFile. Subfolders,
+ * sockets and any entry that resolves outside the root are left out. Each
+ * entry is then opened by name through openMessageFile, which re-checks it.
+ */
+export async function listMessageFolder(href, roots) {
+    const { path: _path, ...listing } = await readMessageFolder(href, roots);
+    return listing;
+}
+/** Open one file of a listed folder by its plain name, with every file check. */
+export async function openMessageFolderEntry(href, entry, roots) {
+    const folder = await readMessageFolder(href, roots);
+    if (!folder.entries.some((listed) => listed.name === entry)) {
+        throw statusError(404, "the linked file is unavailable");
+    }
+    return openMessageFile(pathToFileURL(join(folder.path, entry)).href, roots);
+}
+async function readMessageFolder(href, roots) {
+    const requested = referencedPath(href);
+    const canonicalRoots = (await Promise.all(roots.map(async (root) => {
+        try {
+            const canonical = await realpath(root);
+            return (await stat(canonical)).isDirectory() ? canonical : null;
+        }
+        catch {
+            return null;
+        }
+    }))).filter((root) => Boolean(root));
+    if (canonicalRoots.length === 0)
+        throw statusError(404, "the linked folder is unavailable");
+    const candidates = isAbsolute(requested)
+        ? [resolve(requested)]
+        : canonicalRoots.map((root) => resolve(root, requested));
+    let sawOutsideRoot = false;
+    for (const candidate of new Set(candidates)) {
+        let folder;
+        try {
+            folder = await realpath(candidate);
+        }
+        catch {
+            continue;
+        }
+        const root = canonicalRoots.find((allowed) => containedBy(allowed, folder));
+        if (!root) {
+            sawOutsideRoot = true;
+            continue;
+        }
+        if (!(await stat(folder)).isDirectory())
+            throw statusError(400, "the link does not point to a folder");
+        const names = (await readdir(folder)).sort((a, b) => a.localeCompare(b));
+        const entries = [];
+        let truncated = false;
+        for (const name of names) {
+            const child = join(folder, name);
+            try {
+                const own = await lstat(child);
+                if (!own.isFile() && !own.isSymbolicLink())
+                    continue;
+                const target = await realpath(child);
+                if (!containedBy(root, target))
+                    continue;
+                const info = await stat(target);
+                if (!info.isFile())
+                    continue;
+                if (entries.length >= MESSAGE_FOLDER_MAX_ENTRIES) {
+                    truncated = true;
+                    break;
+                }
+                entries.push({ name, bytes: info.size, mime: mimeFor(target) });
+            }
+            catch {
+                continue;
+            }
+        }
+        return { name: basename(folder), entries, truncated, path: folder };
+    }
+    if (sawOutsideRoot)
+        throw outsideWorkspace();
+    throw statusError(404, "the linked folder is unavailable");
+}
+/** One plain file name inside a listed folder; never a path or a dot entry. */
+export function messageFolderEntryName(value) {
+    if (typeof value !== "string" || !value || value.length > 255)
+        return null;
+    if (value === "." || value === ".." || /[\\/\0]/.test(value))
+        return null;
+    return value;
+}
 /** A safe attachment header with a readable ASCII fallback and UTF-8 name. */
 export function messageFileDisposition(name) {
     const safeName = safeDisplayName(name);

package/dist-server/server/model-requests.js

@@ -1,5 +1,6 @@
 import { harnessCapabilityLines } from "./harness-capabilities.js";
 import { newId } from "./contracts.js";
+import { UNDO_STALE } from "./direct-apply.js";
 import { redactSecretsInText } from "./redact.js";
 const MAX_REASON = 500;
 const STALE = "This bot's default model changed after this card was prepared. Ask the bot to review it and propose again.";
@@ -128,10 +129,11 @@ export class ModelRequestService {
             before,
         };
         const copy = modelCardCopy({ targetName, crossBot, before, selection, reason, capabilityLines });
-        const persistence = this.canPersist?.(args.botId, args.threadId);
+        const grant = submitted ? this.autoApply?.(args.botId, args.threadId, targetBotId) ?? null : null;
+        const automatic = grant !== null;
+        const persistence = this.canPersist?.(args.botId, args.threadId, !automatic);
         if (persistence && !persistence.ok)
             throw new ModelRequestError(persistence.error, persistence.status);
-        const automatic = submitted && this.autoApply?.(args.botId, args.threadId) === true;
         const messageInput = {
             role: "bot",
             kind: "options",
@@ -152,10 +154,59 @@ export class ModelRequestService {
         if (!automatic)
             return proposal;
         const result = this.resolve({ botId: args.botId, threadId: args.threadId, requestId, behavior: "allow" });
-        if (result.state === "applied")
-            return { ...proposal, result };
+        if (result.state === "applied") {
+            if (!result.settlementPending)
+                this.recordAutoApplied(args.threadId, message.id);
+            return { ...proposal, result, appliedBy: grant };
+        }
         throw new ModelRequestError(result.state === "invalid" ? result.error : "The model change could not be applied", result.state === "invalid" ? result.status : 409);
     }
+    /** Marks a card whose change applied without a person. A failure here only
+     * loses the Undo. */
+    recordAutoApplied(threadId, messageId) {
+        try {
+            const card = this.store.messagesFor(threadId).find((candidate) => candidate.id === messageId)?.card;
+            if (card?.modelRequest)
+                this.store.patchMessage(threadId, messageId, { card: { ...card, autoApplied: true } });
+        }
+        catch {
+            // The model change itself is durable; only its Undo is lost.
+        }
+    }
+    /** Puts the previous default model back after a change that applied
+     * without a person, through the same checks a switch gets (validateModel:
+     * a pending approval-level change, or permissions the old engine cannot
+     * keep, refuse it). Refuses, applying nothing, once the default moved. */
+    undo(args) {
+        const message = this.store
+            .messagesFor(args.threadId)
+            .find((candidate) => candidate.card?.requestId === args.requestId && candidate.card.modelRequest);
+        const card = message?.card;
+        const payload = card?.modelRequest;
+        if (!message || !card || !payload)
+            return { claimed: false };
+        if (card.undone)
+            return { claimed: true, state: "already_undone" };
+        const cannot = (error, status = 409) => ({ claimed: true, state: "invalid", error, status });
+        if (!card.autoApplied || card.answered !== "allow")
+            return cannot("Only a change that applied on its own can be undone here.");
+        if (payload.botId !== args.botId || payload.threadId !== args.threadId) {
+            return cannot("This model change belongs to another conversation", 403);
+        }
+        const target = this.store.bot(payload.targetBotId);
+        if (!target || !sameSelection(target.modelSelection, payload.selection)) {
+            return { claimed: true, state: "invalid", error: UNDO_STALE, status: 409, stale: true };
+        }
+        if (this.validateModel) {
+            const refusal = this.validateModel(payload.before, target);
+            if (refusal)
+                return cannot(refusal);
+        }
+        if (!this.store.applyModelDefault(target.id, payload.before))
+            return cannot(NO_SUCH_BOT, 404);
+        this.store.patchMessage(args.threadId, message.id, { card: { ...card, undone: true } });
+        return { claimed: true, state: "undone", targetBotId: target.id };
+    }
     /** Claims a model card even after it was settled, so a duplicate click
      * never re-applies an already-applied change. */
     resolve(args) {

package/dist-server/server/profile-requests.js

@@ -11,6 +11,7 @@ import { PROFILE_REQUEST_FIELDS } from "../shared/profile-request.js";
 import { parseBotProfilePatch } from "./bot-profile.js";
 import { validateBotCwd } from "./bot-cwd.js";
 import { newId } from "./contracts.js";
+import { UNDO_STALE } from "./direct-apply.js";
 import { profileRevision, profileSnapshot } from "./profile-revision.js";
 import { recordProfileChange } from "./profile-versions.js";
 import { redactSecretsInText } from "./redact.js";
@@ -205,6 +206,9 @@ export class ProfileRequestService {
         const snapshot = profileSnapshot(target);
         const before = {};
         const finalChanges = {};
+        // Undo restores `before`, so it is offered only when the card holds the
+        // old values exactly (credential-shaped text is scrubbed from cards).
+        let exactBefore = true;
         for (const field of PROFILE_REQUEST_FIELDS) {
             if (field === "notifications" || field === "speakReplies") {
                 const value = changes[field];
@@ -218,6 +222,8 @@ export class ProfileRequestService {
                 if (value === undefined || value === snapshot[field])
                     continue;
                 before[field] = redactSecretsInText(snapshot[field]);
+                if (before[field] !== snapshot[field])
+                    exactBefore = false;
                 finalChanges[field] = value;
             }
         }
@@ -240,11 +246,14 @@ export class ProfileRequestService {
             expectedRevision: profileRevision(target),
         };
         const copy = profileCardCopy({ name: targetName, crossBot }, snapshot, before, finalChanges, reason);
-        const persistence = this.canPersist?.(args.botId, args.threadId);
+        const grant = submitted ? this.autoApply?.(args.botId, args.threadId, targetBotId) ?? null : null;
+        // A new working folder widens what the bot's tools read and write
+        // without asking, so below Full access it keeps today's card.
+        const automatic = grant === "full-access" || (grant === "self" && finalChanges.cwd === undefined);
+        const persistence = this.canPersist?.(args.botId, args.threadId, !automatic);
         if (persistence && !persistence.ok) {
             throw new ProfileRequestError(persistence.error, persistence.status);
         }
-        const automatic = submitted && this.autoApply?.(args.botId, args.threadId) === true;
         const messageInput = {
             role: "bot",
             kind: "options",
@@ -267,10 +276,77 @@ export class ProfileRequestService {
         // The hidden receipt is persisted before the profile changes. The same
         // validation and durable commit marker serve both automatic and human decisions.
         const result = this.resolve({ botId: args.botId, threadId: args.threadId, requestId, behavior: "allow" });
-        if (result.state === "applied")
-            return { ...proposal, result };
+        if (result.state === "applied") {
+            if (!result.settlementPending)
+                this.recordAutoApplied(args.threadId, message.id, targetBotId, exactBefore);
+            return { ...proposal, result, appliedBy: grant };
+        }
         throw new ProfileRequestError(result.state === "invalid" ? result.error : "The profile change could not be applied", result.state === "invalid" ? result.status : 409);
     }
+    /** Marks a card whose change applied without a person, with the revision
+     * its Undo checks. A failure here only loses the Undo. */
+    recordAutoApplied(threadId, messageId, targetBotId, exactBefore) {
+        try {
+            const card = this.store.messagesFor(threadId).find((candidate) => candidate.id === messageId)?.card;
+            const target = this.store.bot(targetBotId);
+            if (!card?.profileRequest || !target)
+                return;
+            this.store.patchMessage(threadId, messageId, {
+                card: {
+                    ...card,
+                    autoApplied: true,
+                    profileRequest: { ...card.profileRequest, ...(exactBefore ? { undo: { appliedRevision: profileRevision(target) } } : {}) },
+                },
+            });
+        }
+        catch {
+            // The profile change itself is durable; only its Undo is lost.
+        }
+    }
+    /** Puts back the fields a change that applied without a person changed.
+     * Authorized by the caller exactly like answering the card; refuses,
+     * applying nothing, once the profile changed since. */
+    undo(args) {
+        const message = this.store
+            .messagesFor(args.threadId)
+            .find((candidate) => candidate.card?.requestId === args.requestId && candidate.card.profileRequest);
+        const card = message?.card;
+        const payload = card?.profileRequest;
+        if (!message || !card || !payload)
+            return { claimed: false };
+        if (card.undone)
+            return { claimed: true, state: "already_undone" };
+        const cannot = (error, status = 409) => ({ claimed: true, state: "invalid", error, status });
+        if (!card.autoApplied || card.answered !== "allow")
+            return cannot("Only a change that applied on its own can be undone here.");
+        if (payload.botId !== args.botId || payload.threadId !== args.threadId) {
+            return cannot("This profile change belongs to another conversation", 403);
+        }
+        if (!payload.undo)
+            return cannot("This change can't be undone here.");
+        const target = this.store.bot(payload.targetBotId);
+        if (!target || profileRevision(target) !== payload.undo.appliedRevision) {
+            return { claimed: true, state: "invalid", error: UNDO_STALE, status: 409, stale: true };
+        }
+        const { cwd, ...rest } = payload.before;
+        const patch = {};
+        for (const field of PROFILE_REQUEST_FIELDS) {
+            if (field === "cwd" || payload.changes[field] === undefined)
+                continue;
+            patch[field] = rest[field];
+        }
+        if (payload.changes.cwd !== undefined) {
+            const checked = validateBotCwd(cwd || null);
+            if (!checked.ok)
+                return cannot(checked.error);
+            patch.cwd = checked.cwd ?? undefined;
+        }
+        if (!this.store.patchBotProfile(target.id, patch))
+            return cannot(NO_SUCH_BOT, 404);
+        recordProfileChange(target.id, "user", `undo:${message.id}`, payload.changes, payload.before);
+        this.store.patchMessage(args.threadId, message.id, { card: { ...card, undone: true } });
+        return { claimed: true, state: "undone", targetBotId: target.id };
+    }
     /** Claims a profile card even after it was settled, so a duplicate click
      * never re-applies an already-applied change. */
     resolve(args) {

package/dist-server/server/request-auth.js

@@ -283,6 +283,7 @@ export const CLIENT_ALLOW = [
     // approvals and cards
     { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/respond$/ },
     { methods: ["POST"], path: /^\/api\/threads\/[\w-]+\/respond$/ },
+    { methods: ["POST"], path: /^\/api\/threads\/[\w-]+\/undo$/ }, // whoever may answer the card: see the handler
     { methods: ["PATCH"], path: /^\/api\/bots\/[\w-]+\/cards\/[\w-]+$/ },
     { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/secret-cards\/[\w-]+\/(?:resume|dismiss)$/ },
     { methods: ["GET"], path: /^\/api\/bots\/[\w-]+\/connector-cards\/[\w-]+\/status$/ },