Merge main into the stall watchdog

Main grew a queue in the channel composer and a repeat count on the boundary
while this branch was open, and both of them landed in the files the watchdog
threads its `stopped` prop through.

The three channel components now carry both. `ChatTranscript` draws the red line
where `Thinking` was and the parked messages under it; `ConversationView` takes
`stopped` alongside `queueWhileBusy` and `stoppable` and passes each to the half
that wants it; `ChannelChat` hands down `runError` as well as the two counters
main added.

A turn the watchdog ends is a turn that ended, so the queue drains on it exactly
as it does on Stop. Nothing was needed to make that true: the watchdog writes one
RUN_ERROR into the stream and closes it, so `runAgent` settles, both counters
come back down in their `finally` blocks, and the drain sees the same falling
edge it sees for every other way a turn can finish. The one path with a branch of
its own is a disabled conversation, which is main's and is untouched.

The audit page keeps both new filters and both new labels, and `config.test.ts`
keeps both sides' cases.

Author: jerelvelarde

.env.example

@@ -76,6 +76,26 @@ AGENT_STALL_TIMEOUT_MS=60000
 # framework Bot unless you point it at another provider below.
 OPENAI_API_KEY=
 
+# Where that key is spent. Unset, it is OpenAI. Set, it is any endpoint speaking the same
+# `/v1/chat/completions` API: a gateway in front of several providers, a proxy, or a model on
+# hardware you control. The API server reads it for the built-in agents and both shipped Bots read
+# it too, so one line moves the whole deployment rather than one Bot.
+#
+# Model names travel verbatim, so use whatever the endpoint publishes. An endpoint that namespaces
+# its catalogue wants both halves of the name, in `BOT_MODEL` and in the tenant package's
+# `default_model` alike:
+#
+#   OPENAI_BASE_URL=https://gateway.internal/v1
+#   OPENAI_API_KEY=...
+#   BOT_MODEL=openai/gpt-4o
+#
+# OPENAI_BASE_URL=
+
+# The same for the other two providers, under the names the API server already reads. They are
+# different APIs rather than different URLs for this one, so each has its own.
+# ANTHROPIC_BASE_URL=
+# GOOGLE_GENERATIVE_AI_BASE_URL=
+
 # Framework Bot provider: openai, anthropic or google. It reads that provider's own
 # key and refuses to start without it, so a deployment on Anthropic never needs an OpenAI key for it.
 # The proof-of-concept Bot is OpenAI only by construction: it speaks that API directly.
@@ -113,7 +133,17 @@ AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS=true
 # which Bot took it. A rule can still restrict a single Bot with `bot.id`.
 #
 # Attributes: tool.name, bot.id, actor.id, page.url, page.host, element.ref/role/name/type,
-#             key, file.path, file.name, file.extension.
+#             key, file.path, file.name, file.extension, repeat.count.
+#
+# repeat.count is how many times this Bot has just made this exact call, counting the one being
+# decided. A stuck model retries, and each retry is a real action on somebody's live website that is
+# perfectly reasonable on its own terms; only the count tells the thirtieth click apart from the
+# first. `repeat.count >= 10` in `deny` stops a Bot going in circles. Two calls are the same call
+# when the thing acted on is the same, whatever was typed into it, so ten searches typed into one box
+# are ten repeats and a rule about repetition refuses the tenth: try one in `dry-run` first. The
+# count is held in memory by the process that served the call, so a deployment running two API
+# replicas splits every count and a rule about ten attempts fires at twenty or never, and calls to
+# another server's tools over MCP are not counted at all.
 #
 # Name every route to the same effect. A form submits from a keypress in any of its fields, so a rule
 # that only blocks a Submit button does not block Enter from another field. The example below refuses
@@ -124,6 +154,16 @@ AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS=true
 #
 # AGENT_COMPUTER_POLICY={"mode":"enforce","deny":["(intent == \"activate\" && contains(element.name, \"submit\")) || (tool.name == \"computer_key\" && key == \"Enter\")"],"allow":["true"]}
 
+# How long two identical calls count as the same repetition, in ms. Three minutes unset, which
+# assumes a retry loop is a model round trip apart: call the tool, read the failure, try again.
+# Widen it for a deployment whose provider is slow or heavily queued, where genuine retries arrive
+# minutes apart and every attempt would otherwise be counted as the first one. Widen it too far and
+# honest work starts to accumulate: a Bot told to watch a dashboard all morning reloads the same page
+# and is not stuck. Anything that is not a positive whole number stops the server rather than falling
+# back to the default, because a rule about repetition that never fires looks exactly like a Bot
+# behaving itself.
+# COMPUTER_REPEAT_WINDOW_MS=180000
+
 # How long one action waits for its element, in ms. Read by agent-computer, not the server.
 # ACTION_TIMEOUT_MS=10000
 

README.md

@@ -175,6 +175,8 @@ Settings worth knowing:
 | Variable                             | Use                                                                       |
 | ------------------------------------ | ------------------------------------------------------------------------- |
 | `OPENBOT_DEV_NO_AUTH`                | Admits every request as one administrator. How OpenBot runs today.        |
+| `OPENAI_BASE_URL`                    | Answers the OpenAI-shaped calls from somewhere else: a gateway, a proxy.  |
+| `ANTHROPIC_BASE_URL`, `GOOGLE_GENERATIVE_AI_BASE_URL` | The same, for those two APIs.            |
 | `COMPUTER_TOKEN`                     | Secret every Bot computer request must present. `start.sh` sets one.      |
 | `SUPERVISOR_TOKEN`                   | Secret the supervisor requires. `start.sh` sets one.                      |
 | `COMPUTER_SUPERVISOR_URL`            | Gives each Bot a computer of its own instead of one shared computer.      |

agent-bot/src/index.ts

@@ -26,7 +26,21 @@ const PORT = Number.parseInt(process.env.PORT ?? "4200", 10);
  */
 const MODEL = process.env.BOT_MODEL ?? "gpt-5.5";
 
-const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
+/**
+ * Where that model is answered from.
+ *
+ * Unset, this is OpenAI. Set, it is any endpoint speaking the same `/v1/chat/completions` API: a
+ * gateway in front of several providers, a proxy, or a model on hardware you control. Which is the
+ * point of writing against that API by hand rather than against one company's URL.
+ *
+ * `BOT_MODEL` is sent verbatim, because an endpoint names its own catalogue.
+ */
+const BASE_URL = process.env.OPENAI_BASE_URL?.trim() || undefined;
+
+const openai = new OpenAI({
+  apiKey: process.env.OPENAI_API_KEY,
+  baseURL: BASE_URL,
+});
 
 /** Translate the conversation AG-UI carries into the shape the model provider expects. */
 function toProviderMessages(input: RunAgentInput) {

agent-langgraph/src/index.ts

@@ -58,6 +58,24 @@ const PROVIDER = (process.env.BOT_PROVIDER ?? "openai").toLowerCase();
 const MODEL = process.env.BOT_MODEL ?? defaultModelFor(PROVIDER);
 /** OpenAI only. Its newer models require the Responses API, which the integration handles. */
 const USE_RESPONSES_API = process.env.BOT_RESPONSES_API === "true";
+/**
+ * OpenAI only, and the same variable the API server reads for its built-in agents.
+ *
+ * Unset, `openai` means OpenAI. Set, it means any endpoint speaking that API: a gateway in front of
+ * several providers, a proxy, or a model on hardware you control. The integration owns the HTTP, so
+ * this is a base URL rather than another provider branch, and `BOT_MODEL` is sent verbatim because
+ * an endpoint names its own catalogue.
+ */
+const OPENAI_BASE_URL = process.env.OPENAI_BASE_URL?.trim() || undefined;
+/**
+ * The same idea for the other two providers, under the names the API server already reads.
+ *
+ * Sharing the variable names is the point: one line moves the built-in agents and this Bot
+ * together, and a deployment cannot end up with half of itself pointed somewhere else.
+ */
+const ANTHROPIC_BASE_URL = process.env.ANTHROPIC_BASE_URL?.trim() || undefined;
+const GOOGLE_BASE_URL =
+  process.env.GOOGLE_GENERATIVE_AI_BASE_URL?.trim() || undefined;
 
 function defaultModelFor(provider: string): string {
   if (provider === "anthropic") return "claude-sonnet-4-5";
@@ -177,19 +195,22 @@ function buildModel() {
       model: MODEL,
       apiKey: API_KEY,
       streaming: true,
+      ...(ANTHROPIC_BASE_URL ? { anthropicApiUrl: ANTHROPIC_BASE_URL } : {}),
     });
   }
   if (PROVIDER === "google") {
     return new ChatGoogleGenerativeAI({
       model: MODEL,
       apiKey: API_KEY,
       streaming: true,
+      ...(GOOGLE_BASE_URL ? { baseUrl: GOOGLE_BASE_URL } : {}),
     });
   }
   return new ChatOpenAI({
     model: MODEL,
     apiKey: API_KEY,
     streaming: true,
+    ...(OPENAI_BASE_URL ? { configuration: { baseURL: OPENAI_BASE_URL } } : {}),
     ...(USE_RESPONSES_API ? { useResponsesApi: true } : {}),
   });
 }

app/src/components/channels/channel-chat.tsx

@@ -142,6 +142,33 @@ export function ChannelChat({
   const [runError, setRunError] = useState<string | null>(null);
   const awaitingReply = useRef(false);
 
+  /*
+   * TWO DIFFERENT FACTS ABOUT ONE TURN, AND NEITHER OF THEM IS `agent.isRunning`.
+   *
+   * `turnsInFlight` counts what a person would call the Bot having the turn: from the moment `say`
+   * is entered until the whole thing has come back, browser actions in the middle included. It is
+   * what decides whether the next thing typed is sent or parked, and what tells the queue its wait
+   * is over.
+   *
+   * `runsInFlight` counts what Stop can actually reach: the run `copilotkit.runAgent` opens, and
+   * nothing before it. A turn can be in flight for a second and a half before that, while `say`
+   * waits for the runtime agent, and a Stop drawn in that window aborts a controller nobody has
+   * made yet.
+   *
+   * `agent.isRunning` looks like both and is neither. It reports the run on the wire, and a turn
+   * that touches the browser is several runs in a row: the Bot asks for a click, the run ENDS so
+   * the browser can answer it, and another run starts carrying the answer. The agent reports itself
+   * idle in every one of those gaps — the truth about the wire and a lie about the turn. OpenBot
+   * registers every computer tool as a frontend tool, so the gaps open on ordinary work rather than
+   * on some edge case, and anything keyed on the turn ending fires in the middle of one instead.
+   *
+   * Counters rather than booleans because nothing stops a second turn being started from a
+   * component button while the first is still going, and two overlapping turns must not have the
+   * first one to finish declare the conversation idle.
+   */
+  const [turnsInFlight, setTurnsInFlight] = useState(0);
+  const [runsInFlight, setRunsInFlight] = useState(0);
+
   /**
    * Tell the roster what was just said. Failures here must not block the conversation.
    */
@@ -160,12 +187,10 @@ export function ChannelChat({
   reportRef.current = report;
 
   /**
-   * Send a user turn through the channel, including activity reporting and history repair.
+   * Everything `say` does once it has something worth sending, split out so the counter it is
+   * wrapped in covers every way out of here, a throw included.
    */
-  const say = async (text: string, skillInstructions: string[] = []) => {
-    const trimmed = text.trim();
-    if (!trimmed) return;
-
+  const deliver = async (trimmed: string, skillInstructions: string[]) => {
     // Wait briefly for the runtime agent instance before adding the message.
     if (!isReadyRef.current) {
       await Promise.race([
@@ -212,7 +237,32 @@ export function ChannelChat({
       agent.setMessages(repaired as typeof agent.messages);
     }
 
-    await copilotkit.runAgent({ agent });
+    setRunsInFlight((count) => count + 1);
+    try {
+      await copilotkit.runAgent({ agent });
+    } finally {
+      setRunsInFlight((count) => count - 1);
+    }
+  };
+
+  /**
+   * Send a user turn through the channel, including activity reporting and history repair.
+   *
+   * Every user turn in this channel goes through here — what the composer sends, the seed from the
+   * compose screen, and a button inside a rendered component. That is what makes the counter worth
+   * keeping here rather than in the view: the view sees only the turns it started itself, and a
+   * queue that drains on the wrong one of those posts a correction into the middle of an answer.
+   */
+  const say = async (text: string, skillInstructions: string[] = []) => {
+    const trimmed = text.trim();
+    if (!trimmed) return;
+
+    setTurnsInFlight((count) => count + 1);
+    try {
+      await deliver(trimmed, skillInstructions);
+    } finally {
+      setTurnsInFlight((count) => count - 1);
+    }
   };
 
   useEffect(() => {
@@ -321,7 +371,26 @@ export function ChannelChat({
           awaitingReply.current = false;
           copilotkit.stopAgent({ agent });
         }}
-        pending={agent.isRunning}
+        /*
+         * The turn, not the run. A browser action ends one run and starts another, and telling the
+         * conversation it is idle in between is what would drain a parked correction into the
+         * middle of an answer: a second turn racing the first on one thread, with a fabricated
+         * result stitched over a tool call that is still executing.
+         */
+        pending={agent.isRunning || turnsInFlight > 0}
+        /*
+         * A channel outlives its turns, so it is the screen where waiting is worth offering. A
+         * correction typed mid-answer is held here, in this tab, and runs as one follow-up turn the
+         * moment this one is over — including when it is over because somebody pressed the button
+         * above.
+         */
+        queueWhileBusy
+        /*
+         * The run, not the turn. Stop reaches a run through the core's abort controller, and that
+         * controller does not exist until `say` has finished waiting for the runtime agent — so
+         * this is the one place the narrower fact is the honest one to draw a button from.
+         */
+        stoppable={agent.isRunning || runsInFlight > 0}
         /*
          * At the END OF THE TRANSCRIPT rather than above the composer, which is where this used to
          * be. A turn that ends without an answer leaves a gap exactly where the reply was going to