@meetopenbot/openbot 1.5.1 → 1.6.0

package/dist/build-tools.js

@@ -7,6 +7,7 @@ import { installAgentTools } from "./tools/install-agent.js";
 import { threadStatusTools } from "./tools/thread-status.js";
 import { threadTitleTools } from "./tools/thread-title.js";
 import { previewTools } from "./tools/preview.js";
+import { variablesRequestTools } from "./tools/variables-request.js";
 import { wrapToolsWithApproval } from "./tools/approval.js";
 export const DEFAULT_APPROVAL_ACTIONS = ["update_channel_spec", "start_thread"];
 /**
@@ -24,6 +25,7 @@ export function buildOpenbotTools(args) {
         ...threadStatusTools,
         ...threadTitleTools,
         ...previewTools,
+        ...variablesRequestTools,
         ...args.context.tools,
     };
     const approvalConfig = args.context.config?.approval;

package/dist/index.js

@@ -11,6 +11,7 @@ import { installAgentTools } from './tools/install-agent.js';
 import { threadStatusTools } from './tools/thread-status.js';
 import { threadTitleTools } from './tools/thread-title.js';
 import { previewTools } from './tools/preview.js';
+import { variablesRequestTools } from './tools/variables-request.js';
 import { buildOpenbotTools } from './build-tools.js';
 export const OPENBOT_PLUGIN_ID = '@meetopenbot/openbot';
 const modelField = await modelConfigField({
@@ -51,6 +52,7 @@ export const openbotPlugin = defineOpenbotPlugin({
         ...threadStatusTools,
         ...threadTitleTools,
         ...previewTools,
+        ...variablesRequestTools,
     },
     async *run(args) {
         const { context } = args;

package/dist/system-prompt.js

@@ -1,11 +1,10 @@
-import { settingsVariablesMarkdown, SETTINGS_VARIABLES_MARKDOWN } from '@meetopenbot/plugin-sdk';
 export const OPENBOT_SYSTEM_PROMPT = [
     "# ROLE",
     "You are OpenBot, the coordinator. Humans talk only to you. Specialized agents have their own harnesses; you ask them to do work. You do not impersonate them, and you do not do their jobs yourself.",
     "",
     "# SECURITY POLICY",
-    "- **CRITICAL**: Never request API keys, passwords, or sensitive credentials via text or UI widgets; these are managed deterministically via secure forms and must never enter your context.",
-    `- **Credential Guidance**: Only relay a credential requirement after a specialist or tool actually reports a specific missing variable. Then pass through that exact variable name with a link to ${SETTINGS_VARIABLES_MARKDOWN} prefilled via \`?new=ENV_VAR_NAME\` (e.g. ${settingsVariablesMarkdown('LINEAR_API_KEY')}). Never guess, invent, or name an API key or provider that no agent or tool reported.`,
+    "- **CRITICAL**: Never ask for API keys, passwords, or sensitive credentials in chat or through form widgets; values must never enter your context.",
+    "- **Credential Guidance**: Only ask for a variable after a specialist or tool actually reports it missing. Then call `request_variables` once with every exact name it reported (backend and build-time `VITE_*` alike), each with a short hint. The human fills them in an inline card that saves straight to Space variables and resumes this thread — do not also link to Settings or list the names as links. Never guess, invent, or name an API key or provider that no agent or tool reported.",
     "",
     "# CORE MISSION",
     "You are a high-level manager. Not every message is project work.",
@@ -65,7 +64,8 @@ export const OPENBOT_SYSTEM_PROMPT = [
     "- For any other public page the human should see, call `open_preview` with that http(s) URL too. Never pass localhost, 127.0.0.1, or a port on this machine.",
     "",
     "# SPACE VARIABLES",
-    "- Secrets live in OpenBot variables, not in chat. Workspace-wide keys: Settings → Variables. Per-space keys: Space menu → Variables (override workspace keys with the same name for shell commands in that space).",
+    "- Secrets live in OpenBot variables, not in chat. Project keys belong to the Space (Space menu → Variables) and override workspace keys with the same name for shell commands in that space. Workspace-wide keys (Settings → Variables) are for things shared by every space. `request_variables` defaults to the Space; the human can switch it to all spaces.",
+    "- After the human saves variables, ask the specialist to restart whatever needed them (dev server, backend) so the new environment is picked up.",
     "- Provider keys for harness LLM calls (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, etc.) are workspace-only — space copies of those names are for app shells only and do not switch coding agents off OpenBot Credits.",
     "- Coding agents inherit merged space variables in their shell environment — including `pnpm dev` subprocesses. Do not ask the human to paste secrets. Only tell a coding agent to write a project `.env` when the scaffold requires it or the app errors about a missing `.env`; otherwise a restarted dev server should pick up keys from the shell (use exact names such as `VITE_*` for Vite).",
     "",

package/dist/tools/variables-request.js

@@ -0,0 +1,106 @@
+import z from 'zod';
+/** `metadata.type` of the card the host shows to collect missing variables. */
+export const VARIABLES_REQUEST_TYPE = 'variables_request';
+const ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const MAX_KEYS = 20;
+/** Valid, de-duplicated env keys in the order given. */
+export function requestedVariables(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const item of raw) {
+        const entry = typeof item === 'string' ? { key: item } : item;
+        const key = typeof entry?.key === 'string' ? entry.key.trim() : '';
+        if (!ENV_KEY.test(key) || seen.has(key))
+            continue;
+        seen.add(key);
+        const description = typeof entry?.description === 'string' && entry.description.trim()
+            ? entry.description.trim()
+            : undefined;
+        out.push(description ? { key, description } : { key });
+        if (out.length >= MAX_KEYS)
+            break;
+    }
+    return out;
+}
+/**
+ * The card that asks the human for missing variables. Clients that know the
+ * `variables_request` type render masked inputs that save straight to the
+ * variables API, so values never pass through the thread or the model.
+ */
+export function variablesRequestEvent(args) {
+    const names = args.variables.map((variable) => `\`${variable.key}\``).join(', ');
+    return {
+        type: 'client:ui:widget',
+        data: {
+            kind: 'message',
+            widgetId: `variables_${Date.now()}`,
+            title: 'Add variables',
+            body: args.reason?.trim() || `This space needs ${names}.`,
+            state: 'open',
+            metadata: {
+                type: VARIABLES_REQUEST_TYPE,
+                variables: args.variables,
+                ...(args.reason?.trim() ? { reason: args.reason.trim() } : {}),
+            },
+        },
+        meta: {
+            agentId: args.agentId,
+            ...(args.threadId ? { threadId: args.threadId } : {}),
+        },
+    };
+}
+async function requestVariables(rawArgs, ctx) {
+    const threadId = ctx.threadId ?? ctx.state.threadId;
+    if (!threadId) {
+        const message = 'Missing threadId for request_variables';
+        return { success: false, error: message, output: message };
+    }
+    const data = (rawArgs ?? {});
+    const variables = requestedVariables(data.variables);
+    if (variables.length === 0) {
+        const message = 'Pass at least one variable name such as FIREBASE_PROJECT_ID.';
+        return { success: false, error: message, output: message };
+    }
+    await ctx.emit(variablesRequestEvent({
+        variables,
+        reason: typeof data.reason === 'string' ? data.reason : undefined,
+        agentId: ctx.agentId,
+        threadId,
+    }));
+    return {
+        success: true,
+        output: 'Shown a card asking the human for ' +
+            variables.map((variable) => variable.key).join(', ') +
+            '. They save the values there; you will get a message when they do. Do not ask them to paste values in chat.',
+    };
+}
+export const toolDefinitions = {
+    request_variables: {
+        description: 'Ask the human for missing environment variables with an inline card in the thread. Values are saved as Space variables by default (or for all spaces if they choose) and never appear in chat. Pass every missing name at once, including build-time ones like VITE_*.',
+        inputSchema: z.object({
+            variables: z
+                .array(z.object({
+                key: z.string().min(1).describe('Exact env var name, e.g. FIREBASE_PROJECT_ID.'),
+                description: z
+                    .string()
+                    .optional()
+                    .describe('Short hint on what it is or where to find it.'),
+            }))
+                .min(1)
+                .max(MAX_KEYS),
+            reason: z
+                .string()
+                .optional()
+                .describe('One sentence on why they are needed, e.g. "The backend needs these to start."'),
+        }),
+    },
+};
+export const tools = {
+    request_variables: {
+        ...toolDefinitions.request_variables,
+        execute: requestVariables,
+    },
+};
+export const variablesRequestTools = tools;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meetopenbot/openbot",
-  "version": "1.5.1",
+  "version": "1.6.0",
   "description": "OpenBot coordinator runtime: ask specialists, route work into Spaces, and track todos.",
   "type": "module",
   "main": "./dist/index.js",