openmausbot 0.1.98 → 0.1.99

package/dist-server/server/harness/registry.js

@@ -50,54 +50,72 @@ export class ProviderRegistry {
         this.driversByKind = new Map(drivers.map((d) => [d.driverKind, d]));
     }
     async load(configs, decorate) {
-        for (const [instanceId, entry] of Object.entries(configs)) {
-            // Account edits replace only their own process/session state.
-            await this.dispose(instanceId);
-            const driver = this.driversByKind.get(entry.driver);
-            if (!driver) {
-                this.byId.set(instanceId, {
-                    instanceId,
-                    shadow: {
-                        instanceId,
-                        driverKind: entry.driver,
-                        displayName: entry.displayName,
-                        cli: cliOfRaw(entry.config),
-                        shadow: true,
-                        reason: `unknown driver "${entry.driver}" — kept as configured, unavailable here`,
-                    },
-                });
+        // Create instances concurrently: a driver's create may probe its CLI with
+        // a multi-second timeout, and N slow CLIs must not queue on each other.
+        // Each entry resolves to the RegistryEntry it becomes — a create or
+        // decode failure stays local to its instance, exactly as before.
+        const loaded = await Promise.all(Object.entries(configs).map(async ([instanceId, entry]) => {
+            const ready = await this.createEntry(instanceId, entry, decorate);
+            // Usable as soon as it is ready, not after the slowest CLI.
+            this.byId.set(instanceId, ready);
+            return ready;
+        }));
+        // Config order, not completion order: entries()/describe() are the UI's
+        // list and must not shuffle when a slow CLI lands last. An entry that a
+        // dispose replaced or removed meanwhile is no longer this load's to place.
+        for (const entry of loaded) {
+            if (this.byId.get(entry.instanceId) !== entry)
                 continue;
-            }
-            try {
-                const config = entry.config === undefined ? driver.defaultConfig() : driver.decodeConfig(entry.config);
-                // Override detection is on the RAW config, never the decoded one:
-                // decodeConfig fills in the driver default ("claude", "codex", …),
-                // so reading `cli` there would flag every instance as overridden.
-                const rawCli = cliOfRaw(entry.config);
-                if (rawCli)
-                    this.cliByInstance.set(instanceId, rawCli);
-                const live = await driver.create({
+            this.byId.delete(entry.instanceId);
+            this.byId.set(entry.instanceId, entry);
+        }
+    }
+    async createEntry(instanceId, entry, decorate) {
+        // Account edits replace only their own process/session state.
+        await this.dispose(instanceId);
+        const driver = this.driversByKind.get(entry.driver);
+        if (!driver) {
+            return {
+                instanceId,
+                shadow: {
                     instanceId,
-                    displayName: entry.displayName ?? driver.metadata.displayName,
-                    environment: entry.environment ?? {},
-                    enabled: entry.enabled ?? true,
-                    config,
-                });
-                this.byId.set(instanceId, { instanceId, live: decorate ? decorate(live) : live });
-            }
-            catch (e) {
-                this.byId.set(instanceId, {
+                    driverKind: entry.driver,
+                    displayName: entry.displayName,
+                    cli: cliOfRaw(entry.config),
+                    shadow: true,
+                    reason: `unknown driver "${entry.driver}" — kept as configured, unavailable here`,
+                },
+            };
+        }
+        try {
+            const config = entry.config === undefined ? driver.defaultConfig() : driver.decodeConfig(entry.config);
+            // Override detection is on the RAW config, never the decoded one:
+            // decodeConfig fills in the driver default ("claude", "codex", …),
+            // so reading `cli` there would flag every instance as overridden.
+            const rawCli = cliOfRaw(entry.config);
+            if (rawCli)
+                this.cliByInstance.set(instanceId, rawCli);
+            const live = await driver.create({
+                instanceId,
+                displayName: entry.displayName ?? driver.metadata.displayName,
+                environment: entry.environment ?? {},
+                enabled: entry.enabled ?? true,
+                config,
+            });
+            return { instanceId, live: decorate ? decorate(live) : live };
+        }
+        catch (e) {
+            return {
+                instanceId,
+                shadow: {
                     instanceId,
-                    shadow: {
-                        instanceId,
-                        driverKind: entry.driver,
-                        displayName: entry.displayName ?? driver.metadata.displayName,
-                        cli: cliOfRaw(entry.config),
-                        shadow: true,
-                        reason: e instanceof Error ? e.message : String(e),
-                    },
-                });
-            }
+                    driverKind: entry.driver,
+                    displayName: entry.displayName ?? driver.metadata.displayName,
+                    cli: cliOfRaw(entry.config),
+                    shadow: true,
+                    reason: e instanceof Error ? e.message : String(e),
+                },
+            };
         }
     }
     get(instanceId) {

package/dist-server/server/index.js

@@ -48,7 +48,7 @@ import { buildTurnDigest, coverageForDriver, digestPromptLine, renderDigest, too
 import { appendDecision, bindDecisionRetention, boundRetentionDays, decisionRetentionDays, decisionsCsv, flushDecisionLog, pruneDecisions, readDecisionRange, readDecisions, withDecisionActor } from "./decision-log.js";
 import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, parseAudioRange, readAttachment, saveAudio, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
-import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
+import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, listMessageFolder, messageFolderEntryName, openMessageFile, openMessageFolderEntry, } from "./message-file.js";
 import { avatarGenerationRequestSchema, avatarGenerationStateMatches, generateAvatarImage, avatarImageStatus, snapshotAvatarGenerationState, } from "./avatar-image.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
@@ -97,7 +97,7 @@ import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { recoveryCapabilityError } from "./automatic-recovery.js";
 import { decodeGeneratedImage } from "./generated-image.js";
 import { addDisabledMcpServer, MAX_MCP_SERVERS, isRemoteMcpServer, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
-import { McpOAuthError, McpSignInError, McpOAuthManager, mcpOAuthRedirectUri, withMcpSignIn, withoutPendingSignIn } from "./mcp-oauth.js";
+import { MCP_OAUTH_CALLBACK_PATH, McpOAuthError, McpSignInError, McpOAuthManager, mcpCallbackOrigin, mcpOAuthRedirectUri, withMcpSignIn, withoutPendingSignIn } from "./mcp-oauth.js";
 import { probeMcpServer } from "./mcp-probe.js";
 import { GROUP_GOAL_MAX_TURNS, groupGoalAssignmentKey, groupGoalCompletionTurnId, groupGoalCoordinatorInstructions, groupGoalWorkerInstructions, parseGroupGoalDecision, resolveGroupGoalMember, selectGroupGoalCoordinator, } from "./group-goal-run.js";
 import { BUILT_IN_DRIVERS } from "./drivers/builtIn.js";
@@ -153,7 +153,7 @@ import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, support
 import { listMemoryTopics, memoryDate, readMemoryFile, readMemoryTopic, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, journalMemoryWrite, } from "./memory-journal.js";
 import { readSectionContext, readSections, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
-import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, listBotSkillsWithOrigin, resolveBotSkills, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
+import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, listBotSkillsWithOrigin, resolveBotSkills, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, undoSkillWrite, } from "./skills.js";
 import { fetchSkillFromSource } from "./skill-fetch.js";
 import { pickBotName } from "./names.js";
 import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
@@ -179,6 +179,7 @@ import { agentBrowserFrame, agentBrowserIntegration, browserEngineEncryptionKey,
 import { createScreenFrameSource } from "./screen-frame-source.js";
 import { screenFrameHash, screenSurfaceForTool, screenTouchingTool, settledFrameIsNews } from "./screen-frame-gate.js";
 import { asSchedule, RoutineRequestService } from "./routine-requests.js";
+import { directApply, UNDO_STALE } from "./direct-apply.js";
 import { createOptionsCard } from "./options-card.js";
 import { buildBotOverview, connectedAppsFacts } from "./bot-overview.js";
 import { ProfileRequestService } from "./profile-requests.js";
@@ -231,7 +232,7 @@ import { applyPendingWorkspaceRestore, readLastWorkspaceRestore } from "./worksp
 import { createCustomDomainVerifier, customDomainIpv4, normalizeCustomDomain } from "./custom-domain.js";
 import { allowedScopes, createEmailSignIn, parseAllowList } from "./account-signin.js";
 import { ProviderAuthSessions } from "./provider-auth-sessions.js";
-import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, isLoopbackHost, isProxied, labelFromUserAgent, requestOrigin, requestSource, requiredScope, resolveLoopbackTrust, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
+import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, isLoopbackHost, isProxied, labelFromUserAgent, provesSameOrigin, requestOrigin, requestSource, requiredScope, resolveLoopbackTrust, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
 import { cookieMaxAgeSeconds, formatPairingCode, SessionRegistry } from "./sessions.js";
 import { ThreadStarters } from "./thread-starters.js";
 import { activityCsv, activityEntries, appendAdminAction, botAuditSnapshot, botChangeRows, configChangeRows, parseActivityWhat, flushAdminActivity, pruneAdminActivity, readAdminActivityRange, sharedSignIn, signInListsOf, } from "./admin-activity.js";
@@ -248,6 +249,7 @@ import { createBotPresetRoutes } from "./routes/bot-presets.js";
 import { createBotMemoryRoutes } from "./routes/bot-memory.js";
 import { createDeciderRoutes } from "./routes/decider.js";
 import { createThreadModelRoutes } from "./routes/thread-models.js";
+import { createUndoRoutes } from "./routes/undo.js";
 import { createDesktopViewer, desktopViewerUrl } from "./routes/desktop-viewer.js";
 import { localDesktopTarget, localVmViewerStatus, viewerTargetId } from "./desktop-viewer-targets.js";
 import { createAntigravityLeftoverRoutes } from "./routes/antigravity-leftovers.js";
@@ -3562,6 +3564,24 @@ function sourceApprovalMode(botId, threadId) {
 function fullAccessForSource(botId, threadId) {
     return sourceApprovalMode(botId, threadId) === "full";
 }
+/** On a Cloud home a turn a guest drives keeps a card for every change,
+ * even one to the bot itself. */
+function selfApplyBlocked(threadId) {
+    return cloudGuestDriven(threadId);
+}
+/** Whether a bot's routine, skill, profile or model change applies without
+ * a person, and why: Full access applies everything as it always has, and
+ * at any level a change to the bot itself applies, shown as a one-line
+ * receipt with Undo (server/direct-apply.ts). Team setup and peer approvals
+ * stay Full access only (fullAccessForSource). */
+function appliesDirectly(botId, threadId, targetBotId) {
+    return directApply({
+        fullAccess: fullAccessForSource(botId, threadId),
+        botId,
+        targetBotId,
+        blocked: selfApplyBlocked(threadId) || !connectorThread(botId, threadId),
+    });
+}
 function peerReviewRequired(bot, threadId) {
     return Boolean(bot.approvePeerComms && !fullAccessForSource(bot.id, threadId));
 }
@@ -10896,7 +10916,7 @@ async function cloudRoutineReadiness(botId, threadId) {
 const routineRequests = new RoutineRequestService({
     store,
     routines,
-    autoApply: fullAccessForSource,
+    autoApply: appliesDirectly,
     cloudReady: cloudRoutineReadiness,
     canPersist: proposalPersistence,
     // Cross-bot routines: the confirmation card can sit open indefinitely, so
@@ -11229,14 +11249,14 @@ function resolveAndSendTrust(res, threadId, requestId, behavior) {
 }
 const profileRequests = new ProfileRequestService({
     store,
-    autoApply: fullAccessForSource,
+    autoApply: appliesDirectly,
     canPersist: proposalPersistence,
     // A Chief may change a section peer; anyone else only itself. Re-checked at confirm.
     validateTarget: chiefPeerTargetRule("profile"),
 });
 const modelRequests = new ModelRequestService({
     store,
-    autoApply: fullAccessForSource,
+    autoApply: appliesDirectly,
     canPersist: proposalPersistence,
     // Same authority rule as profile proposals: a Chief may name one section peer.
     validateTarget: chiefPeerTargetRule("default model"),
@@ -11554,6 +11574,104 @@ function resolveAndSendModel(res, args) {
     json(res, 200, { ok: true, outcome: "rejected" });
     return true;
 }
+/** Undo for a learned skill a bot wrote without a person (undoSkillWrite). */
+function undoSkillCard(botId, threadId, messageId) {
+    const message = store.messagesFor(threadId).find((candidate) => candidate.id === messageId);
+    const card = message?.card;
+    const request = card?.skillRequest;
+    if (!message || !card || !request)
+        return { claimed: false };
+    if (card.undone)
+        return { claimed: true, state: "already_undone" };
+    if (!card.autoApplied || card.answered !== "allow") {
+        return { claimed: true, state: "invalid", error: "Only a change that applied on its own can be undone here.", status: 409 };
+    }
+    if (request.botId !== botId || request.threadId !== threadId) {
+        return { claimed: true, state: "invalid", error: "this skill request belongs to a different bot", status: 403 };
+    }
+    const undone = undoSkillWrite(botId, {
+        stagedId: request.stagedId,
+        name: request.name,
+        action: request.action,
+        ...(request.previous ? { previous: { skillMd: request.previous.preview, source: request.previous.source } } : {}),
+    });
+    if ("stale" in undone)
+        return { claimed: true, state: "invalid", error: UNDO_STALE, status: 409, stale: true };
+    if ("error" in undone)
+        return { claimed: true, state: "invalid", error: undone.error, status: 409 };
+    store.patchMessage(threadId, message.id, { card: { ...card, undone: true } });
+    return { claimed: true, state: "undone" };
+}
+/** Undo on the one-line receipt of a change that applied without a person
+ * (a bot's change to itself, or Full access). The caller authorizes it
+ * exactly like answering that card; the card remembers it was undone. */
+function undoAppliedChange(res, threadId, requestId) {
+    const message = store.messagesFor(threadId).find((candidate) => candidate.card?.requestId === requestId);
+    const card = message?.card;
+    if (!message || !card)
+        return json(res, 404, { error: "this change is no longer in the conversation" });
+    // The proposing bot comes from the conversation (a room card's trusted
+    // sender, else the thread's bot), never from the card payload.
+    const botId = message.from?.botId ?? store.botByThread(threadId)?.id;
+    if (!botId)
+        return json(res, 400, { error: "this change has no valid owner" });
+    let result = { claimed: false };
+    if (card.routineRequest) {
+        const undone = routineRequests.undo({ botId, threadId, requestId });
+        // On a Cloud home a routine Undo removed is forgotten, and one it put
+        // back is the owner's only if it was theirs before the change.
+        if (undone.claimed && undone.state === "undone" && cloudRoutineAuthors) {
+            if (undone.action === "create")
+                cloudRoutineAuthors.remove(undone.routineId);
+            else if (undone.action === "update") {
+                if (undone.ownersBefore)
+                    cloudOwnersRoutine(undone.routineId);
+                else
+                    cloudRoutineAuthors.forget(undone.routineId);
+            }
+            else if (undone.action === "delete" && undone.restoredId) {
+                if (undone.ownersBefore)
+                    cloudOwnersRoutine(undone.restoredId);
+                else
+                    cloudRoutineAuthors.wrote(undone.restoredId, CLOUD_NOBODY_KEY);
+            }
+        }
+        result = undone;
+    }
+    else if (card.profileRequest) {
+        const undone = profileRequests.undo({ botId, threadId, requestId });
+        if (undone.claimed && undone.state === "undone") {
+            const target = store.bot(undone.targetBotId);
+            if (target)
+                broadcast({ kind: "bot", bot: wireBot(target) });
+        }
+        result = undone;
+    }
+    else if (card.modelRequest) {
+        const undone = modelRequests.undo({ botId, threadId, requestId });
+        if (undone.claimed && undone.state === "undone") {
+            const target = store.bot(undone.targetBotId);
+            if (target)
+                broadcast({ kind: "bot", bot: wireBot(target) });
+        }
+        result = undone;
+    }
+    else if (card.skillRequest) {
+        result = undoSkillCard(botId, threadId, message.id);
+    }
+    if (!result.claimed)
+        return json(res, 409, { error: "Only a change that applied on its own can be undone here." });
+    if (result.state === "invalid") {
+        return json(res, result.status, { error: result.error, ...(result.stale ? { code: "changed-since" } : {}) });
+    }
+    if (result.state === "undone") {
+        appendDecision(DATA_DIR, {
+            threadId, requestId, botId, botName: store.bot(botId)?.name,
+            tool: card.tool, summary: card.subtitle, decision: "user-undone", source: "user",
+        });
+    }
+    json(res, 200, { ok: true, undone: true, ...(result.state === "already_undone" ? { alreadyUndone: true } : {}) });
+}
 // Webhook definitions are independent from calendar schedules, but every
 // delivery joins the same RoutineManager queue. That keeps unattended work
 // ordered behind a busy MAUS and gives webhook runs the same durable receipts.
@@ -13512,14 +13630,16 @@ function roomPostEligibility(bot, group) {
     }
     return { ok: true };
 }
-function proposalPersistence(botId, threadId) {
+/** `opensCard` false for a change that applies directly: it adds no open
+ * card, so the open-card budget does not hold it back. */
+function proposalPersistence(botId, threadId, opensCard = true) {
     if (!store.bot(botId)) {
         return { ok: false, status: 403, error: "unknown sender" };
     }
     if (!connectorThread(botId, threadId)) {
         return { ok: false, status: 403, error: "source conversation does not belong to sender" };
     }
-    if (fullAccessForSource(botId, threadId))
+    if (!opensCard || fullAccessForSource(botId, threadId))
         return { ok: true };
     // Only cards on the visible branch can be acted on from the composer.
     // Abandoned branches must not permanently consume the proposal quota.
@@ -13532,14 +13652,14 @@ function proposalPersistence(botId, threadId) {
         ? { ok: false, status: 429, error: "confirm or cancel an existing proposal first" }
         : { ok: true };
 }
-function skillProposalPersistence(botId, threadId) {
+function skillProposalPersistence(botId, threadId, opensCard = true) {
     if (!store.bot(botId)) {
         return { ok: false, status: 403, error: "unknown sender" };
     }
     if (!connectorThread(botId, threadId)) {
         return { ok: false, status: 403, error: "source conversation does not belong to sender" };
     }
-    if (fullAccessForSource(botId, threadId))
+    if (!opensCard || fullAccessForSource(botId, threadId))
         return { ok: true };
     const openRequests = store.activePath(threadId).filter((message) => message.card?.skillRequest?.botId === botId &&
         !message.card.answered &&
@@ -13606,6 +13726,7 @@ function appendSkillRequestCard(args) {
         sha256: args.staged.sha256,
         warnings: args.staged.warnings,
         createdAt: Date.now(),
+        ...(args.applied && args.previous ? { previous: args.previous } : {}),
     };
     const from = store.bot(args.botId);
     store.appendMessage(args.threadId, {
@@ -13616,7 +13737,7 @@ function appendSkillRequestCard(args) {
             title: copy.title,
             subtitle: copy.subtitle,
             options: args.applied ? [] : [args.staged.action === "create" ? "Enable" : "Update", "Deny"],
-            ...(args.applied ? { answered: "allow", title: `Skill "${args.staged.name}" ${args.staged.action === "create" ? "enabled" : "updated"}` } : {}),
+            ...(args.applied ? { answered: "allow", autoApplied: true, title: `Skill "${args.staged.name}" ${args.staged.action === "create" ? "enabled" : "updated"}` } : {}),
             requestId,
             tool: copy.tool,
             skillRequest: payload,
@@ -14902,6 +15023,11 @@ ROUTES.push(createThreadModelRoutes({
     mayChangeModel: (auth) => !CLOUD_HOME || cloudOwnerSession(auth),
     reply: (botId) => publicBot(store.bot(botId)),
 }));
+// Undo on the one-line receipt of a change that applied without a person.
+ROUTES.push(createUndoRoutes({
+    refusal: (auth, threadId, requestId) => cardAnswerRefusal(auth, threadId, requestId, "allow"),
+    undo: (auth, res, threadId, requestId) => withDecisionActor(decisionActorFor(auth), () => undoAppliedChange(res, threadId, requestId)),
+}));
 ROUTES.push(createAntigravityLeftoverRoutes({
     hosted: Boolean(hostedModels),
     isAntigravity: (instanceId) => registry.get(instanceId)?.driverKind === "antigravityAgent",
@@ -15054,6 +15180,17 @@ const handleRequest = async (req, res) => {
             if (refusal)
                 return json(res, 403, { error: refusal, code: "managed_policy" });
         }
+        // An MCP server's sign-in, started in a browser on another computer,
+        // comes back here (server/mcp-oauth.ts). Public like the loopback
+        // listener it stands in for: the state is the credential, checked once.
+        if (path === MCP_OAUTH_CALLBACK_PATH) {
+            const answer = method === "GET"
+                ? await mcpOAuth.publicCallback(req.headers.host, url.search)
+                : { status: 400, text: "Invalid sign-in callback. Return to OpenMausBot and try again." };
+            res.writeHead(answer.status, { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" });
+            res.end(answer.text);
+            return;
+        }
         // ── who is asking (server/request-auth.ts) ──────────────────────────
         // Two public routes come first: what this server is, and turning a pairing
         // code into a session. Everything else needs the loopback owner or a
@@ -16119,7 +16256,9 @@ const handleRequest = async (req, res) => {
                         forBot = { botId: target.id, name: target.name };
                     }
                 }
-                const persistence = proposalPersistence(from.id, fromThreadId);
+                // Sender and conversation only: the service checks the open-card
+                // budget once it knows whether this change opens a card at all.
+                const persistence = proposalPersistence(from.id, fromThreadId, false);
                 if (!persistence.ok) {
                     return json(res, persistence.status, { error: persistence.error });
                 }
@@ -16153,6 +16292,12 @@ const handleRequest = async (req, res) => {
                     cloudRoutineAuthors?.forget(applied.resultId);
                     cloudRoutineAuthors?.wrote(applied.resultId, CLOUD_NOBODY_KEY);
                 }
+                // Undo puts an updated or deleted routine back as the owner's only
+                // if it was theirs before this change.
+                if (applied && wasOwners && proposedCard?.autoApplied && proposedCard.routineRequest?.undo) {
+                    store.patchMessage(fromThreadId, proposed.messageId, { card: { ...proposedCard,
+                            routineRequest: { ...proposedCard.routineRequest, undo: { ...proposedCard.routineRequest.undo, ownersBefore: true } } } });
+                }
                 appendDecision(DATA_DIR, {
                     threadId: fromThreadId,
                     requestId: proposed.requestId,
@@ -16163,7 +16308,7 @@ const handleRequest = async (req, res) => {
                     // response returned to the model.
                     summary: proposedCard?.subtitle ?? proposed.summary,
                     decision: proposed.state === "applied" ? "auto-approved" : "card-shown",
-                    source: proposed.state === "applied" ? "full-access" : "routine",
+                    source: proposed.state === "applied" ? proposed.appliedBy ?? "full-access" : "routine",
                 });
                 return json(res, 201, proposed);
             }
@@ -16248,7 +16393,7 @@ const handleRequest = async (req, res) => {
                 appendDecision(DATA_DIR, {
                     threadId: body.fromThreadId, requestId: proposed.requestId, botId: from.id, botName: from.name,
                     tool: "update_profile", summary: proposed.detail, decision: proposed.state === "applied" ? "auto-approved" : "card-shown",
-                    source: proposed.state === "applied" ? "full-access" : "profile",
+                    source: proposed.state === "applied" ? proposed.appliedBy ?? "full-access" : "profile",
                 });
                 return json(res, 201, proposed);
             }
@@ -16280,7 +16425,7 @@ const handleRequest = async (req, res) => {
                 appendDecision(DATA_DIR, {
                     threadId: body.fromThreadId, requestId: proposed.requestId, botId: from.id, botName: from.name,
                     tool: "update_model", summary: proposed.detail, decision: proposed.state === "applied" ? "auto-approved" : "card-shown",
-                    source: proposed.state === "applied" ? "full-access" : "model",
+                    source: proposed.state === "applied" ? proposed.appliedBy ?? "full-access" : "model",
                 });
                 return json(res, 201, proposed);
             }
@@ -16492,7 +16637,10 @@ const handleRequest = async (req, res) => {
                 if (!connectorThread(from.id, fromThreadId)) {
                     return json(res, 403, { error: "source conversation does not belong to sender" });
                 }
-                const persistence = skillProposalPersistence(from.id, fromThreadId);
+                // Skills written here are always the sender's own, so they apply at
+                // any level, with a one-line receipt and Undo (appliesDirectly).
+                const direct = appliesDirectly(from.id, fromThreadId, from.id);
+                const persistence = skillProposalPersistence(from.id, fromThreadId, !direct);
                 if (!persistence.ok)
                     return json(res, persistence.status, { error: persistence.error });
                 const action = body.action === "create" || body.action === "update" ? body.action : "";
@@ -16518,11 +16666,15 @@ const handleRequest = async (req, res) => {
                 });
                 if ("error" in staged)
                     return json(res, 422, { error: staged.error });
-                if (fullAccessForSource(from.id, fromThreadId)) {
+                if (direct) {
+                    // What an update replaces, so Undo can put it back.
+                    const previousSkillMd = staged.action === "update" ? readSkillFile(from.id, staged.name) : null;
+                    const previousSource = listSkills(from.id).find((skill) => skill.name === staged.name)?.source;
+                    const previous = previousSkillMd !== null && previousSource ? { preview: previousSkillMd, source: previousSource } : undefined;
                     const applied = applySkillWriteWithReceipt(from.id, staged, () => {
-                        const receipt = appendSkillRequestCard({ botId: from.id, threadId: fromThreadId, staged, applied: true });
+                        const receipt = appendSkillRequestCard({ botId: from.id, threadId: fromThreadId, staged, applied: true, previous });
                         appendDecision(DATA_DIR, { threadId: fromThreadId, requestId: receipt.requestId, botId: from.id, botName: from.name,
-                            tool: "stage_skill", summary: receipt.summary, decision: "auto-approved", source: "full-access" });
+                            tool: "stage_skill", summary: receipt.summary, decision: "auto-approved", source: direct });
                     });
                     if ("error" in applied) {
                         rejectStagedSkillWrite(from.id, staged.id);
@@ -18758,7 +18910,28 @@ const handleRequest = async (req, res) => {
                 }
                 roots = messageFileRootsForThread(senderId, threadId);
             }
-            const file = await openMessageFile(href, roots);
+            // A link to a folder answers with its files; each one is then fetched
+            // by plain name under the same message grant and file checks.
+            const folderEntry = method === "POST" && body.entry !== undefined
+                ? messageFolderEntryName(body.entry)
+                : undefined;
+            if (folderEntry === null)
+                return json(res, 400, { error: "entry must be one file name" });
+            let file;
+            try {
+                file = folderEntry
+                    ? await openMessageFolderEntry(href, folderEntry, roots)
+                    : await openMessageFile(href, roots);
+            }
+            catch (error) {
+                // Only a client that asks for listings gets one; older clients keep the 400.
+                if (body?.listFolder !== true || folderEntry || error?.code !== "directory")
+                    throw error;
+                const listing = await listMessageFolder(href, roots);
+                res.setHeader("x-openmausbot-folder", "1");
+                res.setHeader("cache-control", "private, no-store");
+                return json(res, 200, listing);
+            }
             if ((streamsMessageImage || botAttachment?.kind === "image") && !file.mime.startsWith("image/")) {
                 await file.handle.close();
                 return json(res, 415, { error: "only images can be previewed here" });
@@ -23709,7 +23882,7 @@ const handleRequest = async (req, res) => {
                 mcpProbesInFlight -= 1;
             }
         }
-        // The loopback listener and authenticated paste-back complete the same flow.
+        // The loopback listener, the public callback and authenticated paste-back complete the same flow.
         const mcpSignIn = /^\/api\/mcp\/servers\/([a-z][a-z0-9_-]{0,31})\/(sign-in|sign-out)(?:\/([0-9a-f-]{36}))?$/.exec(path);
         if (mcpSignIn) {
             const [, name, action, flowId] = mcpSignIn;
@@ -23745,7 +23918,14 @@ const handleRequest = async (req, res) => {
                     return json(res, 200, { auth: await mcpOAuth.completeCallback(name, flowId, body.callbackUrl, owner) });
                 }
                 if (action === "sign-in" && method === "POST" && !flowId) {
-                    const started = await mcpOAuth.start(name, url, undefined, owner);
+                    // A browser on another computer cannot reach this machine's
+                    // loopback: it comes back to the https address it is using now,
+                    // when that is one this server vouches for (mcpCallbackOrigin).
+                    const remote = auth.kind === "session" && (isProxied(req) || !isLoopbackHost(req.headers.host));
+                    const origin = remote
+                        ? mcpCallbackOrigin(provesSameOrigin(req) ? requestOrigin(req) : null, [CLOUD_HOME?.publicOrigin, hostedWorkspaceConfiguration()?.tenant.origin, savedCustomDomain(), FALLBACK_PUBLIC_URL])
+                        : null;
+                    const started = await mcpOAuth.start(name, url, undefined, owner, { remote, origin });
                     if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
                         mcpOAuth.revokeOwner(owner);
                         return json(res, 401, { error: "Your session ended. Start a new sign-in." });