feat(bot-mode): bring Group Chats to mobile gateways

[andrexibiza]

Bot Group Chats on mobile gateways

Fixes #89166

Related: #97681
Source composition: #97846, #98073, #96162, #89180

Why this matters to users

A Group Chat should not become unreachable when its owner leaves Desktop. From an authorized Signal, Telegram, WhatsApp, Slack, Matrix, Discord, SMS, email, or other connected chat, the owner can inspect recent activity, send the next instruction, retry failed work, approve or deny an exact hosted command, or Stop the Group Chat without knowing which gateway currently hosts it.

Before this change, mobile clients could not reliably control Desktop-created or gateway-hosted Group Chats, and periodic cross-process lease refreshes could flood adapters that cannot edit a status message in place. After it, Group Chats have one durable /group control surface across Desktop and messaging gateways, while non-editing adapters keep the initial wait notice and terminal warning without receiving a new refresh message every 15 seconds.

What changed

• /group lists and opens existing Bot Group Chats from mobile messaging clients.
• /group <number> send <message> appends one durable room turn without acquiring or interrupting the ordinary chat session's turn lease.
• /group <number> retry and /group <number> stop use exact idempotency, authority, generation, and cancellation fences.
• /group <number> approvals, approve, and deny expose only exact, owner-authorized hosted command decisions; permanent/session-wide approval is not available from messaging.
• Telegram, Discord, and Matrix receive native bounded room/participant controls; Signal, WhatsApp, Slack, SMS, email, and other adapters receive the same hierarchy as bounded text.
• Same-gateway and cross-gateway rooms preserve authoritative replay and can continue without Desktop when their routes are reachable.
• Classic Desktop-driven rooms use a durable exact-owner mailbox rather than silently executing only part of the group.
• Periodic session-lease wait refreshes no longer flood adapters that cannot update status in place; the initial wait notice and terminal timeout warning remain.

The mobile path is gateway control, not a model prompt. It dispatches while an ordinary agent turn is active without cancelling, steering, or queueing behind that conversation.

Git authorship and provenance

The prior submitted object 2e2ecc074b4c37f22408cc6f29071e6bb251e314 incorrectly collapsed the composition into one commit authored solely by Axl. Body acknowledgements were not sufficient Git attribution. David Dudok de Wit (@dokterdok) identified the defect in this source-composition review; that assessment is correct. This head corrects it forward-only: the published commit remains the first parent, while the complete source-authored train is the second parent. No force-push, rebase, amend, or source-history rewrite is required.

Preserved source work:

• David Dudok de Wit (@dokterdok) — feat(bot-mode): integrate hosted Group Chats into Desktop #97846 and feat(bot-mode): control Group Chats from messaging #98073: automatic Group Chat continuity, safe reconnect, hosted/classic messaging control, approval authority, ownership-boundary sharding, and review-driven hardening. Exact source heads incorporated: 240f42ff4f54428a7a4b59309d56ebd0312d42d5 and 6fb588dc7c367139dcb25986d611893170066afc.
• @jugol — fix(desktop): enable cross-source group chat creation #96162: cross-source Group Chat creation. The source-authored current-architecture forward port survives as 22b26d04ca6719a4e87326681079dc1c040eabbc with jugol <solomoj94@gmail.com> as Git author.
• @liuhao1024 — fix(gateway): stop lease-wait refreshes flooding non-editing chat adapters #89180: capability-gated suppression of standalone lease-wait refresh flooding. The current-architecture replay survives as 6a746344e42a8cdbbf614e3b3730187dc55f8934 with liuhao1024 <sunsky.lau@gmail.com> as Git author.
• Axl Ibiza, MBA (@andrexibiza): current-stack acceptance regressions, mobile-control documentation, the no-growth lease-status extraction, the append-only topology bridge, current-main conflict reconciliation, and Windows-fixture hygiene. These commits do not replace the contributor-authored commits above.

The final bridge 5a467ef9671eed2a2cbd70c011c6c87187daf789 is byte-identical to its source-composed second parent e3ec744b16c591f4e3fda49188e53466bd1fb172; it exists only to advance the already-published PR ref without rewriting history.

The submitted head 63fd45b6245b3430db17fdeb409f38932eb3414d then merges current main@2e25b472108d0f36e02a95bae212255ae76fac0e at 4e1051daa25b8581d914ca893aad38fc66e6e1e2. The three landing-edge conflicts preserve both sides: Slack's resolved Bot predicate plus api_human_users, Discord's guild/profile routing regression, and multi-profile session signatures through the extracted watcher helper.

Reliability and security

• Stable transport IDs make Send, Retry, Stop, and approval decisions idempotent under redelivery.
• Owner/admin authorization is re-evaluated at action time.
• Approval decisions are bound to room authority and epoch, Bot task, execution generation, request, and delivery.
• Shared or unclassified chats, bot/webhook authors, edited commands, unstable delivery identities, unexpected attachments, and incomplete relay provenance fail closed.
• Room authority, epoch, member routes, Desktop ownership, command claims, retries, and Stop are durably fenced.
• Native picker callbacks are bound to the requesting user and exact message, expire, and re-resolve live room state.
• User/Bot labels and activity previews are bounded and neutralized before client formatting.
• Classic Desktop execution is bounded; repeated failure becomes explicitly retryable by the owner rather than being driven indefinitely.

Composition order

1. feat(bot-mode): integrate hosted Group Chats into Desktop #97846 source train through 240f42ff4f, including @jugol's source-authored cross-source creation forward port.
2. feat(bot-mode): control Group Chats from messaging #98073 messaging/approval train through 6fb588dc7c, including ownership splits and hardening.
3. fix(gateway): stop lease-wait refreshes flooding non-editing chat adapters #89180 current-architecture source-authored replay 6a746344e42a.
4. Acceptance regressions and mobile-control documentation.
5. Lease-status ownership shard e3ec744b16c5: the new owner is 38 lines; gateway/run.py has zero net growth and run_agent.py shrinks by one line relative to the source merge base.
6. Append-only bridge 5a467ef9671e from the published PR head to the source-composed tree.
7. Current-main landing-edge merge 4e1051daa25b, with all three conflicts resolved by preserving both contracts.
8. Windows hygiene 63fd45b6245b: every changed watcher fixture writes text with explicit UTF-8 encoding.

This is the integrated landing object. If it lands, the overlapping source branches must not then be merged independently as duplicate feature payloads; their authorship already survives here in Git.

How to test

scripts/run_tests.sh tests/gateway/test_slack_api_human_senders.py
scripts/run_tests.sh tests/gateway/test_group_chat_slack_adapter.py
scripts/run_tests.sh tests/gateway/test_discord_slash_commands.py
scripts/run_tests.sh tests/tui_gateway/test_change_watcher.py
scripts/run_tests.sh tests/gateway/test_session_lease_wait_refresh.py
scripts/run_tests.sh tests/gateway/test_hosted_room_messaging.py
scripts/run_tests.sh tests/gateway/test_desktop_room_mailbox.py
scripts/run_tests.sh tests/gateway/test_hosted_room_peer.py
scripts/run_tests.sh tests/gateway/test_command_bypass_active_session.py

Exercise from an authenticated owner chat:

/group
/group 2
/group 2 bots
/group 2 send Review the launch checklist
/group 2 approvals
/group 2 approve A1B2C3D4
/group 2 deny A1B2C3D4
/group 2 retry
/group 2 stop

Verification

Local verification on the exact final tree (63fd45b6245b3430db17fdeb409f38932eb3414d, tree 90c847d67a2d204b31c7eaecbca564445f5ed0bf):

• canonical focused runner: 184 passed, 1 skipped, 0 failed across the nine test files above;
• python scripts/audit_pr_attribution.py: passed;
• Ruff on the lease shard and touched Python owners: passed;
• Windows footgun scan on the complete PR diff: passed, 85 files scanned;
• import/seam identity: run_agent exports the canonical template object and gateway.run exports the canonical matcher object;
• git diff --check: passed;
• current-main merge simulation: passed with no conflicts;
• no modified legacy file above 2,000 lines grows relative to merge base 2e25b472108d0f36e02a95bae212255ae76fac0e; new session_turn_lease.py is 38 lines.

The incorporated #98073 source head 6fb588dc7c367139dcb25986d611893170066afc is independently green on GitHub for required CI, contributor attribution, Python, JavaScript/TypeScript, Windows, macOS, Docker amd64/arm64, and Nix. Those are source-head receipts, not a substitute for final-head CI. Final hosted CI is not claimed until GitHub completes it on the corrected PR head.

[andrexibiza]

I owe David Dudok de Wit (@dokterdok), @jugol, and @liuhao1024 an apology for the malformed Git provenance in the earlier head of this PR.

I collapsed the composed work into 2e2ecc074b4c37f22408cc6f29071e6bb251e314, a single commit authored only by me, and then treated acknowledgements in the PR body as though they were equivalent to preserving authorship in Git. They are not. That erased the contributor-authored topology maintainers need to inspect and land the work correctly.

The repaired head is now 63fd45b6245b3430db17fdeb409f38932eb3414d, advanced forward-only without a force-push or history rewrite. It preserves:

• David Dudok de Wit's source-authored feat(bot-mode): integrate hosted Group Chats into Desktop #97846 and feat(bot-mode): control Group Chats from messaging #98073 work, including the incorporated heads 240f42ff4f54428a7a4b59309d56ebd0312d42d5 and 6fb588dc7c367139dcb25986d611893170066afc;
• @jugol's cross-source Group Chat creation as source-authored commit 22b26d04ca6719a4e87326681079dc1c040eabbc;
• @liuhao1024's lease-wait refresh repair as source-authored commit 6a746344e42a8cdbbf614e3b3730187dc55f8934;
• the already-published head as the first parent and the complete source-authored train as the second parent through bridge 5a467ef9671eed2a2cbd70c011c6c87187daf789.

I am sorry. This should have been caught before the original push. Body credit never substitutes for source-authored commits in the graph; overlapping work must be deduplicated and composed with authorship intact before a PR head moves.

[andrexibiza]

Landing-edge interlock update — 2026-09-02

Fresh live FILE-LIST reconciliation against main@f6234d00c5d59450adea1d7edd30ad3859375c79 keeps two newer Group Chat carriers in the landing graph:

• fix(groups): recover room tasks across local state cleanup #101306 has moved to head 488f35aef831ec8fd05a415c975523304dc04c1d. It still overlaps feat(bot-mode): bring Group Chats to mobile gateways #100386 in exactly gateway/hosted_room_policy_checkpoint.py, tui_gateway/hosted_room_service.py, and tests/tui_gateway/test_hosted_room_service.py. It owns recovery of terminal room-task publications after active policy projection cleanup/compaction. Its current exact-head CI 33656303622, Docker 33656302909, and Nix 33656302742 are all action_required, so the moved object is not exact-head green.
• fix(bot-mode): derive group clarify/approval attention from $groupClarify instead of duplicating it into $groupNeedsYou #101452 remains at head 3675a3e45041f11add313bf1af36337e823baa1e and overlaps feat(bot-mode): bring Group Chats to mobile gateways #100386 in apps/desktop/src/plugins/hermes-bots/group-chat-view.tsx and apps/desktop/src/plugins/hermes-bots/roster-pane.tsx. It owns derived clarify/approval attention state and rename migration. Its exact-head CI 33655848861, Docker 33655848005, and Nix 33655848068 are green.

These are complementary mechanisms, not duplicates of #100386's mobile Group Chat control/continuity composition. Whichever object lands first changes the landing edge for the others: every later carrier must recompose its shared paths on the landed implementation, preserve both contracts, and reacquire exact-head/every-surviving-commit proof. No receipt transfers across that recomposition.

Current #100386 head remains 63fd45b6245b3430db17fdeb409f38932eb3414d. This is a topology receipt, not a self-review or a release-ready claim.

[dokterdok]

Thanks, Axl. I appreciate the quick correction and the clear provenance breakdown. All good from my side.