openmausbot 0.1.98 → 0.1.100

package/dist-server/server/routes/undo.js

@@ -0,0 +1,17 @@
+import { PASS } from "./table.js";
+export function createUndoRoutes(deps) {
+    return async ({ req, res, path, method, auth, json, readBody }) => {
+        const m = path.match(/^\/api\/threads\/([\w-]+)\/undo$/);
+        if (!m || method !== "POST")
+            return PASS;
+        const threadId = m[1];
+        const body = await readBody(req);
+        const requestId = typeof body?.requestId === "string" ? body.requestId : "";
+        if (!requestId)
+            return json(res, 400, { error: "requestId is required" });
+        const refusal = deps.refusal(auth, threadId, requestId);
+        if (refusal)
+            return json(res, 403, { error: refusal });
+        deps.undo(auth, res, threadId, requestId);
+    };
+}

package/dist-server/server/routine-requests.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { cronScheduleLabel } from "../shared/cron-label.js";
 import { normalizeCronSchedule, nextCronRuns } from "../shared/routine-schedule.js";
 import { newId } from "./contracts.js";
+import { SELF_ROUTINE_CAP, UNDO_STALE } from "./direct-apply.js";
 import { redactSecretsInText } from "./redact.js";
 import { parseJson, schemaIssue } from "./schema.js";
 import { intervalHasRestrictions, nextOccurrence, } from "./routines.js";
@@ -200,6 +201,19 @@ const storedOperationSchema = z.discriminatedUnion("action", [
     z.object({ action: z.literal("run_now"), ...storedManageBase }).strict(),
     z.object({ action: z.literal("delete"), ...storedManageBase }).strict(),
 ]);
+const storedSnapshotSchema = storedDefinitionSchema.extend({
+    enabled: z.boolean(),
+    target: z.literal("room-goal").optional(),
+    groupId: z.string().min(1).max(128).optional(),
+    resultsThreadId: z.string().min(1).max(128).optional(),
+}).strict();
+const storedUndoSchema = z.object({
+    name: z.string().max(200),
+    schedule: storedScheduleSchema.optional(),
+    appliedUpdatedAt: z.number().int().nonnegative().optional(),
+    before: storedSnapshotSchema.optional(),
+    ownersBefore: z.boolean().optional(),
+}).strict();
 const routineRequestCardDataSchema = z.object({
     version: z.literal(1),
     requestId: z.string().min(1).max(128),
@@ -209,6 +223,7 @@ const routineRequestCardDataSchema = z.object({
     operation: storedOperationSchema,
     appliedAt: z.number().int().nonnegative().optional(),
     resultId: z.string().min(1).max(128).optional(),
+    undo: storedUndoSchema.optional(),
 }).strict();
 export class RoutineRequestError extends Error {
     status;
@@ -896,6 +911,47 @@ function revalidateOperation(operation, manager, botId, now) {
         }
     }
 }
+/** The routine as it stands, kept for Undo. None when it carries what a
+ * card cannot hold exactly: attachments, or credential-shaped text the
+ * transcript scrubs. */
+function routineSnapshot(routine) {
+    if (routine.attachments?.length)
+        return undefined;
+    if (redactSecretsInText(routine.name) !== routine.name || redactSecretsInText(routine.prompt) !== routine.prompt)
+        return undefined;
+    const snapshot = {
+        name: routine.name,
+        instructions: routine.prompt,
+        schedule: structuredClone(routine.schedule),
+        runOn: routine.runOn,
+        durationMinutes: routine.durationMinutes,
+        ...(routine.timeoutMinutes === undefined ? {} : { timeoutMinutes: routine.timeoutMinutes }),
+        ...(routine.continuity ? { continuity: true } : {}),
+        ...(routine.overlap === "queue" ? { overlap: "queue" } : {}),
+        enabled: routine.enabled,
+        ...(routine.target === "room-goal" ? { target: "room-goal" } : {}),
+        ...(routine.groupId ? { groupId: routine.groupId } : {}),
+        ...(routine.resultsThreadId ? { resultsThreadId: routine.resultsThreadId } : {}),
+    };
+    return storedSnapshotSchema.safeParse(snapshot).success ? snapshot : undefined;
+}
+/** Puts an updated routine's definition back exactly: an interval's
+ * restrictions are cleared explicitly, since an omitted one is kept. */
+function restorePatch(before, now) {
+    const schedule = asSchedule(before.schedule, now);
+    return {
+        name: before.name,
+        prompt: before.instructions,
+        runOn: before.runOn,
+        schedule: schedule.type === "interval"
+            ? { ...schedule, weekdays: schedule.weekdays ?? null, window: schedule.window ?? null, endsAt: schedule.endsAt ?? null }
+            : schedule,
+        durationMinutes: before.durationMinutes,
+        timeoutMinutes: before.timeoutMinutes ?? null,
+        continuity: before.continuity === true,
+        overlap: before.overlap ?? "skip",
+    };
+}
 export class RoutineRequestService {
     store;
     routines;
@@ -968,18 +1024,27 @@ export class RoutineRequestService {
         };
         if (args.from)
             messageInput.from = args.from;
+        // Resolve the current source-thread grant after the asynchronous probe.
+        const owner = operation.forBot?.botId ?? botId;
+        const grant = submitted ? this.autoApply?.(botId, threadId, owner) ?? null : null;
+        // A bot applying its own routines keeps at most SELF_ROUTINE_CAP of them
+        // on; a create or resume past that shows the card, as before. Full
+        // access has no cap.
+        const automatic = grant === "full-access" || (grant === "self" && !this.overSelfCap(operation, owner));
         // This check and append are deliberately adjacent and synchronous. JS
         // cannot interleave another completed proposal between the capacity /
         // ownership decision and the durable transcript write.
-        const persistence = this.canPersist?.(botId, threadId);
+        const persistence = this.canPersist?.(botId, threadId, !automatic);
         if (persistence && !persistence.ok) {
             throw new RoutineRequestError(persistence.error, persistence.status);
         }
         if (args.canCommit && !args.canCommit()) {
             throw new RoutineRequestError("The requesting turn ended before this proposal could be saved", 401);
         }
-        // Resolve the current source-thread grant after the asynchronous probe.
-        const automatic = submitted && this.autoApply?.(botId, threadId) === true;
+        // What Undo puts back, taken before the change.
+        const before = automatic && (operation.action === "update" || operation.action === "delete")
+            ? this.snapshotOf(operation.routineId, owner)
+            : undefined;
         if (automatic) {
             messageInput.card.options = [];
             messageInput.card.dismissed = true;
@@ -1005,8 +1070,10 @@ export class RoutineRequestService {
         catch (error) {
             result = { claimed: true, state: "invalid", error: error instanceof Error ? error.message : String(error), status: error instanceof RoutineRequestError ? error.status : 400 };
         }
-        if (result.state === "applied")
-            return { ...proposal, result };
+        if (result.state === "applied") {
+            this.recordAutoApplied(threadId, message.id, definition, before);
+            return { ...proposal, result, ...(grant ? { appliedBy: grant } : {}) };
+        }
         // The scheduler commit can succeed even if settling its transcript
         // fails. Report that exact result; a retry only finishes the receipt.
         const receipt = this.routines.routineRequestReceipt(requestId);
@@ -1015,10 +1082,147 @@ export class RoutineRequestService {
             return { ...proposal, result: {
                     claimed: true, state: "applied", action: receipt.action, resultId: receipt.resultId,
                     settlementPending: true, message: "Routine change applied. Recording the operation receipt could not finish; the change will not be applied again.",
-                } };
+                }, ...(grant ? { appliedBy: grant } : {}) };
         }
         throw new RoutineRequestError(result.state === "invalid" ? result.error : "The routine change could not be applied", result.state === "invalid" ? result.status : 409);
     }
+    /** Whether one more enabled routine would take the bot past the cap. */
+    overSelfCap(operation, owner) {
+        if (operation.action !== "create" && operation.action !== "resume")
+            return false;
+        const enabled = this.routines.listRoutines().filter((routine) => routine.botId === owner && routine.enabled).length;
+        return enabled + 1 > SELF_ROUTINE_CAP;
+    }
+    snapshotOf(routineId, owner) {
+        const routine = ownedRoutine(this.routines, routineId, owner);
+        return routine ? routineSnapshot(routine) : undefined;
+    }
+    /** Marks a card whose change applied without a person, with what its
+     * one-line receipt and Undo need. A failure here leaves the change
+     * applied and the card as it was, only without Undo. */
+    recordAutoApplied(threadId, messageId, definition, before) {
+        try {
+            const message = this.store.messagesFor(threadId).find((candidate) => candidate.id === messageId);
+            const card = message?.card;
+            const payload = card?.routineRequest;
+            if (!message || !card || !payload)
+                return;
+            const action = payload.operation.action;
+            const routineId = payload.operation.action === "create" ? payload.resultId : payload.operation.routineId;
+            const after = routineId ? this.routines.listRoutines().find((routine) => routine.id === routineId) : undefined;
+            const undo = {
+                name: redactSecretsInText(after?.name ?? definition?.name ?? before?.name ?? "routine"),
+                ...(action === "create" || action === "update" || action === "resume"
+                    ? { schedule: structuredClone(after?.schedule ?? definition?.schedule) }
+                    : {}),
+                ...(after && (action === "update" || action === "pause" || action === "resume") ? { appliedUpdatedAt: after.updatedAt } : {}),
+                ...(before ? { before } : {}),
+            };
+            if (!storedUndoSchema.safeParse(undo).success)
+                delete undo.schedule;
+            this.store.patchMessage(threadId, messageId, {
+                card: { ...card, autoApplied: true, routineRequest: { ...payload, undo } },
+            });
+        }
+        catch {
+            // The routine change itself is durable; only its Undo is lost.
+        }
+    }
+    /** Puts back a change that applied without a person. Authorized by the
+     * caller exactly like answering the card; refuses, applying nothing, once
+     * the routine changed since. A second Undo reports already undone. */
+    undo(args) {
+        const message = this.store
+            .messagesFor(args.threadId)
+            .find((candidate) => candidate.card?.requestId === args.requestId && candidate.card.routineRequest);
+        const card = message?.card;
+        if (!message || !card)
+            return { claimed: false };
+        if (card.undone)
+            return { claimed: true, state: "already_undone" };
+        const cannot = (error, status = 409) => ({ claimed: true, state: "invalid", error, status });
+        if (!card.autoApplied || card.answered !== "allow")
+            return cannot("Only a change that applied on its own can be undone here.");
+        const parsed = routineRequestCardDataSchema.safeParse(card.routineRequest);
+        if (!parsed.success)
+            return cannot("This change can't be undone here.");
+        const payload = parsed.data;
+        if (payload.botId !== args.botId || payload.threadId !== args.threadId) {
+            return cannot("This routine change belongs to another conversation", 403);
+        }
+        const operation = payload.operation;
+        const owner = operation.forBot?.botId ?? payload.botId;
+        const undo = payload.undo;
+        const stale = { claimed: true, state: "invalid", error: UNDO_STALE, status: 409, stale: true };
+        const now = this.now();
+        let routineId;
+        let restoredId;
+        try {
+            switch (operation.action) {
+                case "run_now":
+                    return cannot("A routine run can't be undone.");
+                case "create": {
+                    routineId = payload.resultId ?? "";
+                    if (!routineId || !ownedRoutine(this.routines, routineId, owner))
+                        return stale;
+                    this.routines.remove(routineId);
+                    break;
+                }
+                case "update":
+                case "pause":
+                case "resume": {
+                    routineId = operation.routineId;
+                    if (undo?.appliedUpdatedAt === undefined || (operation.action === "update" && !undo.before)) {
+                        return cannot("This change can't be undone here.");
+                    }
+                    const current = ownedRoutine(this.routines, routineId, owner);
+                    if (!current || current.updatedAt !== undo.appliedUpdatedAt)
+                        return stale;
+                    const patch = operation.action === "update"
+                        ? restorePatch(undo.before, now)
+                        : { enabled: operation.action === "pause" };
+                    if (!this.routines.update(routineId, patch))
+                        return stale;
+                    break;
+                }
+                case "delete": {
+                    routineId = operation.routineId;
+                    const before = undo?.before;
+                    if (!before)
+                        return cannot("This change can't be undone here.");
+                    restoredId = this.routines.create({
+                        name: before.name,
+                        prompt: before.instructions,
+                        botId: owner,
+                        ...(before.target ? { target: before.target, groupId: before.groupId } : {}),
+                        runOn: before.runOn,
+                        enabled: before.enabled,
+                        schedule: asSchedule(before.schedule, now),
+                        durationMinutes: before.durationMinutes,
+                        ...(before.timeoutMinutes === undefined ? {} : { timeoutMinutes: before.timeoutMinutes }),
+                        ...(before.continuity ? { continuity: true } : {}),
+                        ...(before.overlap === "queue" ? { overlap: "queue" } : {}),
+                        ...(before.resultsThreadId ? { resultsThreadId: before.resultsThreadId } : {}),
+                    }).id;
+                    break;
+                }
+                default:
+                    return cannot("This change can't be undone here.");
+            }
+        }
+        catch (error) {
+            return cannot(redactSecretsInText(error instanceof Error ? error.message : String(error)).slice(0, 500));
+        }
+        this.store.patchMessage(args.threadId, message.id, { card: { ...card, undone: true } });
+        return {
+            claimed: true,
+            state: "undone",
+            action: operation.action,
+            routineId,
+            ...(restoredId ? { restoredId } : {}),
+            ...(undo?.ownersBefore !== undefined ? { ownersBefore: undo.ownersBefore } : {}),
+        };
+    }
     async requireCloudReadiness(operation, proposerBotId) {
         if (!this.cloudReady || operation.action === "pause" || operation.action === "delete")
             return;

package/dist-server/server/setup-mode.js

@@ -45,7 +45,7 @@ function folderClause(cwd) {
 function buildSetupPrompt(profileAside, cwd) {
     return ("\n\nThe user explicitly asked you to set yourself up. For this setup request, help configure the bot from what the user tells you." +
         ` First ask at most four questions that change what you would build: what the job is, when it should happen (on demand, on a schedule, or when something arrives), which apps or accounts it touches, and ${folderClause(cwd)}.` +
-        " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Ask for missing choices, not an extra yes for already-requested actions under granted Full Access." +
+        " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Ask for missing choices, not an extra yes for already-requested actions: changes to your own profile and routines apply immediately, and the person sees each with an Undo." +
         " First send one message describing the changes you are about to request, then make the tool calls. Follow each result: if applied, continue without another confirmation; if pending, end the turn and wait for its in-app decision. Do not repeat the list or claim success from the permission mode alone." +
         ` Use propose_profile for your identity, standing rules ${profileAside}, and the working folder (cwd), propose_routine only for a schedule the user requested, and request_credential for any missing token.` +
         " Full Access does not supply answers, credentials, or broader permissions for another bot. A credential request still needs the user's secure entry. Report failed or cancelled changes honestly." +

package/dist-server/server/skill-learn.js

@@ -1,6 +1,6 @@
 // `/learn` — turn a described workflow, URL, folder, or "what we just did"
 // into a reusable SKILL.md. The live agent authors the skill with skill_manage;
-// the harness applies it under granted Full Access or stages a pending review.
+// the harness applies it (a bot's own skill applies at any level) or stages a pending review.
 //
 // There is no separate distillation engine. This module only builds the
 // prompt and recognises the slash command, so it works on every engine
@@ -61,7 +61,7 @@ export function buildLearnPrompt(userRequest) {
         "1. Inventory every source the user named, using the tools you already have — file tools for local paths, web fetch for URLs, and this conversation if they referred to something you just did. If the request is ambiguous about scope, make a reasonable choice and note it; do not stall.\n" +
         "2. Check existing skills with skills_list. If one already covers this topic, leave it alone unless the user explicitly asked to revise that named learned/editable skill. For an explicit revision, read only the exact SKILL.md path listed for that skill in your system prompt (the native .agents/skills/<exact-name>/SKILL.md link is a fallback), preserve every still-valid step, re-verify what changed, then call skill_manage with action=\"update\" and skill_name set to that exact name. If you cannot read or verify the current skill, stop instead of replacing it from memory. For a genuinely new skill, use action=\"create\".\n" +
         "3. Pass source as the exact URL or folder you used, or \"conversation\" when the conversation is the source.\n" +
-        "4. Follow the skill_manage result: with granted Full Access it may apply immediately. After an applied result, continue the requested work without another confirmation. If review is pending, a create stays inactive and an update leaves the current version untouched; end the turn and wait for the in-app decision. Never claim success from the permission mode alone, and report failed or cancelled changes honestly.\n\n" +
+        "4. Follow the skill_manage result: your own skill changes apply immediately and the person sees them with an Undo. After an applied result, continue the requested work without another confirmation. If review is pending, a create stays inactive and an update leaves the current version untouched; end the turn and wait for the in-app decision. Never claim success from the permission mode alone, and report failed or cancelled changes honestly.\n\n" +
         AUTHORING_STANDARDS +
         "\n\nWhen done, tell the user the skill name and a one-line summary of what it captured.");
 }

package/dist-server/server/skills.js

@@ -1189,6 +1189,36 @@ export function applySkillWriteWithReceipt(botId, staged, recordApplied) {
             message: "Skill change applied. Recording its receipt or cleaning up staging could not finish; do not apply it again." };
     }
 }
+/** Undo for a learned-skill write that applied without a person: a create
+ * is removed; an update gets the SKILL.md it replaced back, as a fresh
+ * revision through the same stage and apply path. Only while the skill is
+ * exactly as that write left it; otherwise `stale`, and nothing changes. */
+export function undoSkillWrite(botId, write) {
+    const entry = readManifest(botId)[write.name];
+    if (!entry || entry.appliedStageId !== write.stagedId || !installedLearnedSkillMatches(botId, write.name, entry)) {
+        return { stale: true };
+    }
+    if (write.action === "create") {
+        const removed = removeSkill(botId, write.name);
+        return "error" in removed ? removed : { undone: true };
+    }
+    if (!write.previous)
+        return { error: "This change can't be undone here." };
+    const staged = stageSkillWrite(botId, {
+        action: "update",
+        targetName: write.name,
+        files: [{ path: "SKILL.md", content: write.previous.skillMd }],
+        source: write.previous.source,
+    });
+    if ("error" in staged)
+        return staged;
+    const applied = applyStagedSkillWrite(botId, staged.id, { expectedSha256: staged.sha256 });
+    if ("error" in applied) {
+        rejectStagedSkillWrite(botId, staged.id);
+        return applied;
+    }
+    return { undone: true };
+}
 /** The skills block appended to a bot's system prompt: enabled skills only,
  * index lines only — the same progressive-disclosure shape the spec asks
  * agents for. Bodies never ride the prompt; the bot reads the file when a

package/dist-server/server/system-prompt.js

@@ -123,7 +123,7 @@ export function customMcpPrompt(names) {
 }
 export const CREDENTIAL_PROMPT = " If a supported API key is missing for the service actually needed, use request_credential to create a secure credential request. Before requesting a computer-provider key, inspect the configured targets with select_computer; an existing self-hosted VPS does not need Boat credentials. Do not request a different provider's key merely because a task mentions cloud. A freshly QR-paired mobile app or the desktop app can show the secure entry card. Never claim it opened unless the request succeeded, and never ask the user to paste credentials into chat.";
 export const THREADS_PROMPT = " A thread is one conversation with its own history and its own run; a bot can have several running at once, and the person sees them as rows under that bot. Use start_thread to open one on yourself for separate work, or on a teammate to hand them a job that should run on its own. Use list_threads to see how the ones you opened are going. When you mention a thread to the person, write its title as #Title so it links. Do not use a ticket comment, a note, or a room post as a stand-in for a thread.";
-const PROPOSAL_RESULT_PROMPT = " Follow the tool result: with granted Full Access it may report applied immediately; then continue the requested work without asking for another confirmation. If it reports a pending review, end the turn and wait for the in-app decision. Never claim success before an applied result, and report failures honestly. Full Access does not grant another bot broader permissions.";
+const PROPOSAL_RESULT_PROMPT = " Follow the tool result: a change to your own routines, skills, profile or model applies immediately and the person sees it with an Undo; then continue the requested work without asking for another confirmation. A change for another bot may wait for the person. If it reports a pending review, end the turn and wait for the in-app decision. Never claim success before an applied result, and report failures honestly. Full Access does not grant another bot broader permissions.";
 export const ROUTINE_PROMPT = " If the user explicitly asks to list or review, schedule, run, or change routines, use list_routines and propose_routine or propose_routine_action. Keep run_on omitted or maus to use the bot's current model and configured computer, including its VPS. A routine's box (legacy cloud) destination runs on the bot's cloud computer, not the configured VPS; choose it only when the user explicitly wants the cloud computer. Convert calendar requests such as the first or last day of each month or the second Monday to a five-field cron expression with an explicit IANA timezone; use interval for elapsed every-N-minutes work. Never replace a calendar rule with daily AI date checking or an approximate weekly schedule; clarify ambiguous or unsupported requests." + PROPOSAL_RESULT_PROMPT;
 export const ROUTINE_EXECUTION_PROMPT = " Execute this routine now: use available peer tools for required handoffs rather than merely announcing that you will wait; after an accepted delegation, end this turn for automatic resumption, and report a concrete blocker if no handoff is possible.";
 export const LEARN_PROMPT = " If the user sends /learn or asks you to save a reusable procedure from this work, use skills_list and skill_manage. Create new skills; update an existing learned skill only when the user explicitly asks to revise that exact name. Include source provenance." + PROPOSAL_RESULT_PROMPT;

package/dist-server/server/turn-continuation.js

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 /**
  * Automatic continuity: when a turn ends without a final answer and the work
- * is resumable (budget cap or tool errors), persist a structured handoff and
+ * is resumable (a budget cap), persist a structured handoff and
  * let the harness start a `Continue:` thread on the same bot — transparent to
  * the bot, which just sees a normal new thread seeded with the handoff.
  *
@@ -82,26 +82,21 @@ export function writeTurnHandoff(input) {
         return null;
     }
 }
-/** Provider config errors are not resumable: looping on them burns budget and
- * masks the real fix (change the model or the tool set). Everything else that
- * stops a turn without a final answer is a candidate for auto-continuation. */
-const NOT_RESUMABLE = /not a multimodal model|unknown model|does not support|tool arguments do not match/i;
+/** The harness's own budget stops, in its own words: the chat driver's
+ * "Stopped after 64 steps without a final answer…" and the older model-call
+ * cap. Matched from the start of the failure, so a provider's error text can
+ * never read as one: "upstream HTTP 429: Rate limit reached" is not a spent
+ * budget. */
+const CAP_STOP = /^(?:stopped after \d+ [a-z ]+ without a final answer|model-call limit reached)/i;
 /** Classify a terminal turn as resumable. Returns the reason for the
  * continuation (`cap` = budget exhausted), or null when the turn must not be
- * auto-continued. A tool error is never continued: it includes a person's or
- * the approval policy's denial, and a new unattended thread would retry what
- * was refused. */
+ * auto-continued. Only a cap is continued. A provider error (a rate limit, a
+ * quota, a rejected key, a model that cannot take the request) fails the same
+ * way in a new thread: continuing would go straight back to the provider that
+ * just refused. A tool error includes a person's or the approval policy's
+ * denial, and a new unattended thread would retry what was refused. */
 export function classifyContinuable(_stopReason, failure) {
-    if (!failure)
-        return null;
-    if (NOT_RESUMABLE.test(failure))
-        return null;
-    // Only OpenMausBot's own step cap. A provider's "Rate limit reached" or
-    // "usage limit reached" is not a budget a new thread can continue past:
-    // continuing would go straight back to the provider that said slow down.
-    if (/stopped after \d+ steps without a final answer|model-call limit reached/i.test(failure))
-        return "cap";
-    return null;
+    return failure && CAP_STOP.test(failure) ? "cap" : null;
 }
 const CONTINUE_TITLE = /^Continue: /;
 const MAX_PER_BOT_PER_HOUR = 5;

package/dist-server/server/workspace-backup.js

@@ -338,7 +338,12 @@ export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
         if (existsSync(sourceDb)) {
             if (lstatSync(sourceDb).isSymbolicLink())
                 throw new Error("The message database must not be a symbolic link.");
-            const db = new DatabaseSync(sourceDb, { readOnly: true });
+            // Another connection may still open this database meanwhile: a copy's
+            // status poll counts its chats (cloud-move.ts workspaceContents). Its
+            // open (WAL recovery) and close (checkpoint) keep a new reader out for a
+            // moment, and without a busy timeout the first backup step fails at once
+            // ("database is locked", or Node's "not an error"). Wait that moment out.
+            const db = new DatabaseSync(sourceDb, { readOnly: true, timeout: 5_000 });
             // Node 26's native backup completion can wait for unrelated event-loop
             // activity after an async scrypt. A scoped pulse prevents an idle server
             // from waiting indefinitely; it owns no data and always stops here.

package/dist-server/workspace-backup.worker.js

@@ -19519,7 +19519,7 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
     const sourceDb = join2(root, "messages.db");
     if (existsSync(sourceDb)) {
       if (lstatSync2(sourceDb).isSymbolicLink()) throw new Error("The message database must not be a symbolic link.");
-      const db = new DatabaseSync(sourceDb, { readOnly: true });
+      const db = new DatabaseSync(sourceDb, { readOnly: true, timeout: 5e3 });
       const completionPulse = setInterval(() => {
       }, 25);
       try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.98",
+  "version": "0.1.100",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/skills/create-verification-skill/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: create-verification-skill
-description: "Create one reviewed skill that teaches a bot how to launch, drive, and verify a specific app or project. Use only when the user explicitly asks for a verification skill."
+description: "Create one skill that teaches a bot how to launch, drive, and verify a specific app or project. Use only when the user explicitly asks for a verification skill."
 ---
 
 # Create a verification skill
 
-Create one compact, project-specific `SKILL.md` through OpenMausBot's normal
-skill review flow. Do not install files directly, enable a skill yourself, or
-silently add scripts to the user's project.
+Create one compact, project-specific `SKILL.md` through `skill_manage`, which
+shows the person every change with an Undo. Do not install skill files
+directly or silently add scripts to the user's project.
 
 ## 1. Inspect before drafting
 
@@ -52,13 +52,14 @@ The proposed `SKILL.md` must contain YAML frontmatter and these sections:
 Keep it concise. Evidence about the user path is input to the draft—not
 permission to retain secrets, audio, screenshots, or coordinates.
 
-## 4. Stage it for review
+## 4. Save it
 
 Call `skills_list` first. If an existing skill already covers the project,
 report that and do not overwrite it. Otherwise call `skill_manage` with
 `action="create"`, the complete `skill_md`, a short `gist`, and the exact
 source used (repository path, URL, or `conversation`).
 
-`skill_manage` only stages the proposal. Tell the user its name and that it is
-inactive until they approve the in-app review card. Never claim it was enabled
-or scheduled automatically.
+Read the `skill_manage` result. If it applied, tell the user the skill's name,
+that it is on, and that they can undo it from the chat. Only if it is pending,
+tell them it stays inactive until they decide on the in-app card. Never claim
+it was enabled without an applied result.

package/skills/create-verification-skill/manifest.json

@@ -2,7 +2,7 @@
   "id": "create-verification-skill",
   "name": "Create Verification Skill",
   "version": "0.1.0",
-  "description": "Stage one reviewed verification skill for a specific app or project.",
+  "description": "Write one verification skill for a specific app or project.",
   "defaultEnabled": true,
   "triggerTerms": [
     "/create-verification-skill",