@@ -425,3 +425,66 @@ WORKER_SHARED_SECRET=
 # One key for the whole deployment, not one per person. Composio keeps people apart by a user id sent
 # with every call, so one account's connections are never reachable from another's.
 COMPOSIO_API_KEY=
+
+# ---------------------------------------------------------------------------
+# Reaching people outside the app: Slack, Teams, SMS, push
+# ---------------------------------------------------------------------------
+
+# Slack and Microsoft Teams arrive through an OpenTag deployment, which calls this server as its
+# AG-UI agent at <public URL>/api/delivery/webhooks/opentag/agent. The secret is at least 32
+# characters and is the same value as OpenTag's AGENT_AUTH_HEADER bearer token. OPENTAG_URL is
+# where messages go when no Slack or Teams turn is open (replies after an approval, questions,
+# progress); without it those sends fail visibly. Setting OPENTAG_URL or the icon without the secret
+# stops the server at start-up. The former SLACK_* settings are refused at start-up.
+# OPENTAG_SHARED_SECRET=
+# OPENTAG_URL=https://opentag.example.com
+# OPENTAG_BOT_ICON_URL_TEMPLATE=https://avatars.example.com/{seed}.png
+
+# The public origin providers call back on, when it is not OPENBOT_PUBLIC_URL or BETTER_AUTH_URL (a
+# tunnel, say). Twilio signs over the URL it was given, so this must match the Twilio number's setting.
+# DELIVERY_PUBLIC_URL=https://hooks.example.com
+
+# SMS. All four or none: some but not all stops the server at start-up. Point the number's incoming
+# webhook at <DELIVERY_PUBLIC_URL>/api/delivery/webhooks/sms.
+# TWILIO_ACCOUNT_SID=
+# TWILIO_AUTH_TOKEN=
+# TWILIO_VERIFY_SERVICE_SID=
+# TWILIO_FROM_NUMBER=
+
+# Push to the native app in mobile/. EXPO_PROJECT_ID is the app's EAS project UUID and switches push
+# and native-app sign-in on; a device registers only when the app reports the same id. The access token is optional and is
+# sent to Expo's push service as a bearer token.
+# EXPO_PROJECT_ID=00000000-0000-0000-0000-000000000000
+# EXPO_ACCESS_TOKEN=
+
+# ---------------------------------------------------------------------------
+# Inbound email triggers
+# ---------------------------------------------------------------------------
+
+# Amazon SES receiving for this domain publishes to an SNS topic subscribed to
+# <public URL>/api/events/email/sns. Each email trigger's address is trigger-<id>@<domain>. Both
+# are needed; without them email triggers have no address. Messages from any other topic are refused.
+# OPENBOT_INBOUND_EMAIL_DOMAIN=in.example.com
+# OPENBOT_INBOUND_EMAIL_SNS_TOPIC_ARNS=arn:aws:sns:us-east-1:123456789012:openbot-inbound
+
+# ---------------------------------------------------------------------------
+# Directory provisioning and audit export
+# ---------------------------------------------------------------------------
+
+# SCIM 2.0 at <BETTER_AUTH_URL>/api/auth/scim/v2, on only while the token is set. The _NEXT token is
+# accepted alongside it while a directory moves to a new one.
+#   openssl rand -base64 32
+# SCIM_BEARER_TOKEN=
+# SCIM_BEARER_TOKEN_NEXT=
+# SCIM_CONNECTION_ID=directory
+
+# Every audit row as an OTLP log record over HTTP, for a SIEM or an OpenTelemetry Collector. Either
+# endpoint switches it on: the logs endpoint is used as written, the generic one gets /v1/logs.
+# Headers are key=value pairs separated by commas. OPENBOT_OTEL_EXPORT=off turns it off with an
+# endpoint still set.
+# OTEL_EXPORTER_OTLP_ENDPOINT=https://collector.example.com:4318
+# OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=
+# OTEL_EXPORTER_OTLP_HEADERS=x-api-key=change-me
+# OTEL_EXPORTER_OTLP_LOGS_HEADERS=
+# OTEL_SERVICE_NAME=openbot
+# OPENBOT_OTEL_EXPORT=off
@@ -87,6 +87,51 @@ jobs:
       - run: bun run typecheck
         working-directory: ${{ matrix.package }}
 
+  mobile:
+    name: native types
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: mobile/package-lock.json
+      # The native app is an isolated npm package; adding it to Bun workspaces would change the
+      # existing desktop/server installation contract. CI installs its own reviewed lockfile.
+      - run: npm ci --prefix mobile --ignore-scripts
+      - run: npm run --prefix mobile typecheck
+
+  # The agent-computer tests that launch a real Chromium. They are asked for by name because a
+  # machine running `bun test` is not required to have a browser, and these are the only tests that
+  # would catch a password reaching the snapshot a model reads, a session cookie lost on restart, or
+  # WebRTC leaving around the egress filter. The browser is the one the computer image installs,
+  # pinned by agent-computer's own lockfile.
+  computer-browser:
+    name: computer (real browser)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+      - run: bun install --frozen-lockfile
+      - run: bun install --frozen-lockfile
+        working-directory: agent-computer
+      - run: bunx playwright install --with-deps chromium
+        working-directory: agent-computer
+      - run: >-
+          bun test tests/sign-in.test.ts tests/session-cookies.test.ts tests/follows-popup.test.ts
+          tests/demonstration-live.test.ts tests/webrtc-proxy.test.ts
+        working-directory: agent-computer
+        env:
+          OPENBOT_COMPUTER_BROWSER: '1'
+          OPENBOT_DEMONSTRATION_LIVE: '1'
+
   chart:
     name: chart (${{ matrix.target }})
     runs-on: ubuntu-latest
@@ -565,7 +610,7 @@ jobs:
     name: verify
     runs-on: ubuntu-latest
     if: always()
-    needs: [static, deployables, chart, test, startup, python-harness, build, migrations, image, component-dockerfiles]
+    needs: [static, deployables, mobile, computer-browser, chart, test, startup, python-harness, build, migrations, image, component-dockerfiles]
     steps:
       - name: Require every check
         env:
 
@@ -8,6 +8,37 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ## Unreleased
 
+### Bots work as coworkers
+
+A Bot can now carry on without anyone watching it. It runs standing **Responsibilities** fed by
+schedules, signed webhooks, GitHub, Linear, Sentry, PagerDuty, inbound email and Slack messages,
+drives its own computer while the app is closed, and keeps its browser profile, cookies and files
+across restarts. Its questions and approval requests reach the person who owns the conversation in
+Slack or Microsoft Teams (through OpenTag), by text message or by push, and the conversation
+resumes when they answer; charts reach Slack and Teams as native charts. **Reachability** links
+each of those places to a conversation.
+
+Approvals become one personal flow across the browser, connected apps, shell, files, the host and
+remote Bots, with custom rules, auto-review and host command modes (**Approvals**). Bots can
+message each other, share a group conversation with attributed speakers, and be published to
+teammates as **Team Bots**. **Memory** imports facts from connected apps with their source, and
+optional background research suggests next steps. A browser demonstration can be recorded and
+turned into a skill. Administrators get capability toggles, SSO-required sign-in, SCIM, network
+egress policy, action recording, OpenTelemetry export, and **Passwords** with private sign-in
+requests.
+
+Upgrading runs migrations `0048_coworker_parity`, `0049_coworker_parity_lanes` and
+`0050_review_fixes`.
+
+### A Bot's computer refuses the network until its policy arrives
+
+A computer used to allow every connection until the server had pushed its Bot's network policy,
+which left up to 30 seconds of unfiltered access after every wake. It now refuses until the policy
+arrives, and the server pushes it as the computer wakes. Cloud metadata and link-local addresses are
+refused in every mode, including `allow_all`, and the browser's WebRTC traffic now goes through the
+filter instead of around it. A computer run without an API server can set
+`EGRESS_POLICY_REQUIRED=0` to keep the old behaviour.
+
 ### `start.sh` names the port to change on macOS
 
 When the API server's or the app's port was held by another process, `start.sh` was meant to say
 
@@ -73,6 +73,8 @@ const ACTING_PATHS = new Set([
   "/scroll",
   "/exec",
   "/files/write",
+  // Typing a person's login into the page. Refused while they hold the wheel, like any other typing.
+  "/sign-in/fill",
 ]);
 
 export function actsOnTheComputer(pathname: string): boolean {
 
@@ -165,14 +165,12 @@ export function createControl(
   }
   function interrupt(reason: string): ControlState {
     const request = current();
+    // Recovery is for a page a person was driving: what they left it as is unknown until someone
+    // looks. A request nobody took left the page exactly as the Bot had it, and holding the Bot
+    // until a person "checks" a page no person touched stranded it asking for control it had.
+    const personHadIt = data.holder === "human" || request?.status === "taken";
     if (request && active(request)) finish(request, "interrupted", reason);
-    if (
-      request &&
-      (active(request) ||
-        request.status === "interrupted" ||
-        data.holder === "human")
-    )
-      data.recoveryRequired = true;
+    if (personHadIt) data.recoveryRequired = true;
     data.holder = "bot";
     data.since = now();
     data.resumeSnapshotRequired = true;
 
@@ -0,0 +1,142 @@
+import type { Page } from "playwright";
+import type { InputMessage } from "./screencast";
+export type RecordedGesture = {
+  kind: "click" | "type" | "key" | "scroll";
+  key?: string;
+  deltaY?: number;
+};
+export function gestureForRecording(
+  input: InputMessage,
+): RecordedGesture | null {
+  if (input.type === "mouse")
+    return input.event === "released" && input.button !== "right"
+      ? { kind: "click" }
+      : null;
+  if (input.type === "wheel")
+    return {
+      kind: "scroll",
+      deltaY: Math.max(-2000, Math.min(2000, input.deltaY)),
+    };
+  if (input.type === "text") return { kind: "type" };
+  if (input.event !== "down") return null;
+  if (input.key.length === 1 || (input.text && input.key !== "Enter"))
+    return { kind: "type" };
+  if (
+    [
+      "Enter",
+      "Tab",
+      "Escape",
+      "Backspace",
+      "Delete",
+      "ArrowDown",
+      "ArrowUp",
+      "ArrowLeft",
+      "ArrowRight",
+      "Home",
+      "End",
+      "PageDown",
+      "PageUp",
+    ].includes(input.key)
+  )
+    return { kind: "key", key: input.key };
+  return null;
+}
+export function safeDemonstrationUrl(raw: string): string {
+  try {
+    const url = new URL(raw);
+    if (!["http:", "https:"].includes(url.protocol)) return "about:blank";
+    const path = url.pathname
+      .split("/")
+      .map((part) =>
+        part.length > 40 || /token|secret|password|credential/i.test(part)
+          ? "[redacted]"
+          : part,
+      )
+      .join("/");
+    return `${url.origin}${path}`;
+  } catch {
+    return "about:blank";
+  }
+}
+/** Never reads a field's value, page body, clipboard or image. All text entry is parameterized. */
+export async function describeHumanGesture(page: Page, input: InputMessage) {
+  const gesture = gestureForRecording(input);
+  if (!gesture) return null;
+  const point =
+    input.type === "mouse" || input.type === "wheel"
+      ? { x: input.x, y: input.y }
+      : null;
+  const target = await page.evaluate((point) => {
+    const hit = point
+      ? document.elementFromPoint(point.x, point.y)
+      : document.activeElement;
+    const closest =
+      hit?.closest(
+        "button,a,input,textarea,select,label,[role],[contenteditable=true]",
+      ) ?? hit;
+    // A click on a label's text is a click on the control it names: "Small", a radio, not a label.
+    const element =
+      closest instanceof HTMLLabelElement
+        ? (closest.control ?? closest)
+        : closest;
+    if (!element) return { role: "page", name: "Page", sensitive: false };
+    const tag = element.tagName.toLowerCase();
+    const inputType =
+      element instanceof HTMLInputElement ? element.type.toLowerCase() : "";
+    const role =
+      element.getAttribute("role") ||
+      (
+        {
+          checkbox: "checkbox",
+          radio: "radio",
+          button: "button",
+          submit: "button",
+          reset: "button",
+          image: "button",
+          range: "slider",
+          file: "button",
+        } as Record<string, string>
+      )[inputType] ||
+      (
+        {
+          button: "button",
+          a: "link",
+          input: "textbox",
+          textarea: "textbox",
+          select: "combobox",
+        } as Record<string, string>
+      )[tag] ||
+      tag;
+    const label =
+      element.getAttribute("aria-label") ||
+      (element instanceof HTMLInputElement ||
+      element instanceof HTMLTextAreaElement ||
+      element instanceof HTMLSelectElement
+        ? Array.from(element.labels ?? [])
+            .map((entry) => entry.textContent ?? "")
+            .join(" ")
+        : "") ||
+      (tag === "button" || tag === "a" ? element.textContent : "") ||
+      element.getAttribute("placeholder") ||
+      role;
+    const sensitive =
+      element.getAttribute("type") === "password" ||
+      // Short words only as whole words: "pin" is in "topping" and "shipping", "otp" in "hotpot".
+      /password|secret|token|one.time|verification|credit.card|security.code|passcode|(?:^|[^a-z])(?:cc-|(?:cvc|cvv|pin|otp)(?![a-z]))/i.test(
+        [
+          label,
+          element.getAttribute("name"),
+          element.getAttribute("autocomplete"),
+        ].join(" "),
+      );
+    const name = sensitive
+      ? "[sensitive field]"
+      : label
+          .replace(/[A-Za-z0-9_+/=-]{32,}/g, "[redacted]")
+          .replace(/[^\s@]+@[^\s@]+/g, "[redacted]")
+          .trim()
+          .slice(0, 120);
+    return { role: role.slice(0, 40), name: name || role, sensitive };
+  }, point);
+  return { ...gesture, url: safeDemonstrationUrl(page.url()), target };
+}