@otto-code/server 0.5.0

package/dist/server/server/agent/providers/openai-compat-feature-definitions.d.ts

@@ -0,0 +1,40 @@
+import type { AgentFeature, AgentSelectOption } from "../agent-sdk-types.js";
+export declare const OPENAI_COMPAT_REASONING_EFFORTS: readonly ["off", "low", "medium", "high"];
+export type OpenAICompatReasoningEffort = (typeof OPENAI_COMPAT_REASONING_EFFORTS)[number];
+/**
+ * Effort advertised per model as `thinkingOptions`, like every other
+ * provider, so the standard Effort control (composer, schedule form,
+ * artifact form) drives it. The selection maps onto the request's
+ * `reasoning_effort` parameter. Custom provider profiles that declare their
+ * own per-model `thinkingOptions` override these defaults in the registry
+ * merge.
+ */
+export declare const OPENAI_COMPAT_THINKING_OPTIONS: readonly AgentSelectOption[];
+export declare const OPENAI_COMPAT_DEFAULT_THINKING_OPTION_ID: OpenAICompatReasoningEffort;
+/**
+ * "off" omits the reasoning_effort parameter from requests entirely, so
+ * endpoints that reject unknown parameters are unaffected until the user
+ * opts in. Unknown persisted values also normalize to "off" rather than
+ * failing the session.
+ */
+export declare function normalizeOpenAICompatReasoningEffort(value: unknown): OpenAICompatReasoningEffort;
+/**
+ * Auto-compaction control: "off", or the context-window percentage at which
+ * the daemon compacts the conversation automatically. Option ids mirror
+ * COMPACTION_THRESHOLD_PERCENTS in the protocol's provider config.
+ */
+export declare const OPENAI_COMPAT_AUTO_COMPACT_VALUES: readonly ["off", "50", "60", "70", "80", "90"];
+export type OpenAICompatAutoCompact = (typeof OPENAI_COMPAT_AUTO_COMPACT_VALUES)[number];
+export declare const OPENAI_COMPAT_AUTO_COMPACT_FALLBACK: OpenAICompatAutoCompact;
+/**
+ * Unknown persisted values normalize to the provider-configured default
+ * rather than failing the session, mirroring reasoning-effort handling.
+ */
+export declare function normalizeOpenAICompatAutoCompact(value: unknown, defaultValue: OpenAICompatAutoCompact): OpenAICompatAutoCompact;
+export declare function buildOpenAICompatFeatures(input: {
+    autoCompact: OpenAICompatAutoCompact;
+    autoCompactDefault: OpenAICompatAutoCompact;
+    /** Provider config hides the per-agent select; the default applies silently. */
+    hideAutoCompact?: boolean;
+}): AgentFeature[];
+//# sourceMappingURL=openai-compat-feature-definitions.d.ts.map

package/dist/server/server/agent/providers/openai-compat-feature-definitions.js

@@ -0,0 +1,82 @@
+export const OPENAI_COMPAT_REASONING_EFFORTS = ["off", "low", "medium", "high"];
+/**
+ * Effort advertised per model as `thinkingOptions`, like every other
+ * provider, so the standard Effort control (composer, schedule form,
+ * artifact form) drives it. The selection maps onto the request's
+ * `reasoning_effort` parameter. Custom provider profiles that declare their
+ * own per-model `thinkingOptions` override these defaults in the registry
+ * merge.
+ */
+export const OPENAI_COMPAT_THINKING_OPTIONS = [
+    { id: "off", label: "Off", description: "Don't request reasoning", isDefault: true },
+    { id: "low", label: "Low" },
+    { id: "medium", label: "Medium" },
+    { id: "high", label: "High" },
+];
+export const OPENAI_COMPAT_DEFAULT_THINKING_OPTION_ID = "off";
+/**
+ * "off" omits the reasoning_effort parameter from requests entirely, so
+ * endpoints that reject unknown parameters are unaffected until the user
+ * opts in. Unknown persisted values also normalize to "off" rather than
+ * failing the session.
+ */
+export function normalizeOpenAICompatReasoningEffort(value) {
+    return OPENAI_COMPAT_REASONING_EFFORTS.includes(value)
+        ? value
+        : "off";
+}
+/**
+ * Auto-compaction control: "off", or the context-window percentage at which
+ * the daemon compacts the conversation automatically. Option ids mirror
+ * COMPACTION_THRESHOLD_PERCENTS in the protocol's provider config.
+ */
+export const OPENAI_COMPAT_AUTO_COMPACT_VALUES = ["off", "50", "60", "70", "80", "90"];
+export const OPENAI_COMPAT_AUTO_COMPACT_FALLBACK = "80";
+function buildAutoCompactFeature(defaultValue) {
+    return {
+        type: "select",
+        id: "auto_compact",
+        label: "Auto-compact",
+        description: "Compact the conversation automatically when context usage crosses the threshold",
+        tooltip: "Change auto-compaction",
+        icon: "summarize",
+        options: [
+            {
+                id: "off",
+                label: "Off",
+                description: "Only compact manually via /compact",
+                ...(defaultValue === "off" ? { isDefault: true } : {}),
+            },
+            ...["50", "60", "70", "80", "90"].map((percent) => {
+                const option = {
+                    id: percent,
+                    label: `At ${percent}%`,
+                };
+                if (defaultValue === percent) {
+                    option.isDefault = true;
+                }
+                return option;
+            }),
+        ],
+    };
+}
+/**
+ * Unknown persisted values normalize to the provider-configured default
+ * rather than failing the session, mirroring reasoning-effort handling.
+ */
+export function normalizeOpenAICompatAutoCompact(value, defaultValue) {
+    return OPENAI_COMPAT_AUTO_COMPACT_VALUES.includes(value)
+        ? value
+        : defaultValue;
+}
+export function buildOpenAICompatFeatures(input) {
+    const features = [];
+    if (!input.hideAutoCompact) {
+        features.push({
+            ...buildAutoCompactFeature(input.autoCompactDefault),
+            value: input.autoCompact,
+        });
+    }
+    return features;
+}
+//# sourceMappingURL=openai-compat-feature-definitions.js.map

package/dist/server/server/agent/providers/openai-compat-mcp.d.ts

@@ -0,0 +1,87 @@
+import type { Logger } from "pino";
+import type { McpServerConfig } from "../agent-sdk-types.js";
+import type { ManagedProcessRegistry } from "../../managed-processes/managed-processes.js";
+export interface McpToolBinding {
+    /** Namespaced, sanitized name exposed to the model. */
+    modelName: string;
+    serverName: string;
+    toolName: string;
+    description: string;
+    parameters: Record<string, unknown>;
+    /**
+     * The server's self-declared readOnlyHint annotation. Untrusted — only
+     * consulted in acceptEdits mode when the provider opts into
+     * mcpToolPermissions: "trust-read-only".
+     */
+    readOnlyHint: boolean;
+}
+export interface McpPromptBinding {
+    /** Namespaced, sanitized slash-command name. */
+    commandName: string;
+    serverName: string;
+    promptName: string;
+    description?: string;
+    argumentNames: string[];
+}
+export interface McpServerFailure {
+    name: string;
+    error: string;
+}
+export interface McpToolCallOutcome {
+    output: string;
+    isError: boolean;
+}
+export interface OpenAICompatMcpManagerOptions {
+    servers: Record<string, McpServerConfig>;
+    providerId: string;
+    cwd: string;
+    logger?: Logger;
+    managedProcesses?: ManagedProcessRegistry | null;
+    connectTimeoutMs?: number;
+}
+export declare class OpenAICompatMcpManager {
+    private readonly servers;
+    private readonly providerId;
+    private readonly cwd;
+    private readonly logger?;
+    private readonly managedProcesses;
+    private readonly connectTimeoutMs;
+    /** Every configured header/env value, replaced with *** in outgoing text. */
+    private readonly secrets;
+    private connectPromise;
+    private connected;
+    private toolBindings;
+    private connectionFailures;
+    private closed;
+    constructor(options: OpenAICompatMcpManagerOptions);
+    get hasServers(): boolean;
+    /** Failures recorded by the last connect pass; empty before the first connect. */
+    get failures(): readonly McpServerFailure[];
+    /**
+     * Connect to every configured server and snapshot its tools. Memoized so
+     * idle sessions never spawn processes and repeated turns reuse connections.
+     * Per-server failures are collected, never thrown.
+     */
+    ensureConnected(): Promise<void>;
+    private connectAll;
+    private recordConnectionFailure;
+    private connectServer;
+    private snapshotTools;
+    /** Pids of spawned stdio servers (diagnostics and lifecycle tests). */
+    getStdioPids(): number[];
+    /** Tool bindings snapshotted at connect; empty before the first connect. */
+    getToolBindings(): McpToolBinding[];
+    resolveTool(modelName: string): McpToolBinding | undefined;
+    callTool(binding: McpToolBinding, args: Record<string, unknown>, options: {
+        signal?: AbortSignal;
+    }): Promise<McpToolCallOutcome>;
+    /** Prompts listed on demand (for slash commands); per-server failures are skipped. */
+    listPrompts(): Promise<McpPromptBinding[]>;
+    /** Resolve a prompt to the text fed to the model in place of the typed /command. */
+    getPrompt(binding: McpPromptBinding, argumentValue: string | null): Promise<string>;
+    /** Idempotent: close clients, tree-kill stdio children, unregister processes. */
+    close(): Promise<void>;
+    /** Replace configured header/env secret values in outgoing text with ***. */
+    redact(text: string): string;
+}
+//# sourceMappingURL=openai-compat-mcp.d.ts.map

package/dist/server/server/agent/providers/openai-compat-mcp.js

@@ -0,0 +1,353 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { createExternalProcessEnv } from "../../otto-env.js";
+import { terminateWithTreeKill } from "../../../utils/tree-kill.js";
+import { capToolOutput } from "./openai-compat-tools.js";
+/**
+ * MCP client host for the OpenAI-compatible provider. The daemon owns that
+ * provider's tool loop (there is no agent binary to host an MCP client), so
+ * this manager connects to the configured MCP servers, snapshots their tools,
+ * and routes tool calls — one manager per agent session.
+ *
+ * Security posture:
+ * - stdio servers spawn with a scrubbed environment (Otto control vars
+ *   stripped) plus only the explicit per-server overlay, cwd = agent cwd, and
+ *   no shell. They are tree-killed on close and registered in the
+ *   managed-process registry so daemon-restart reaping covers leaks.
+ * - Configured header and env values are secrets: they are redacted from all
+ *   error text this module returns, and never logged.
+ * - A server that fails to connect is skipped and recorded as a failure —
+ *   never fatal to the session.
+ * - Tool names are namespaced `mcp_{server}_{tool}` so a server cannot shadow
+ *   the builtin coding tools or Otto's injected catalog.
+ */
+const DEFAULT_CONNECT_TIMEOUT_MS = 10000;
+const LIST_TIMEOUT_MS = 10000;
+const CALL_TOOL_TIMEOUT_MS = 120000;
+const STDIO_KILL_GRACE_MS = 500;
+/** OpenAI function names must match ^[a-zA-Z0-9_-]{1,64}$. */
+const MAX_FUNCTION_NAME_CHARS = 64;
+const REDACTED = "***";
+function sanitizeNamePart(part) {
+    return part.replace(/[^a-zA-Z0-9_-]/gu, "_");
+}
+/** Build `mcp_{server}_{tool}` capped at the OpenAI limit, deduped with a numeric suffix. */
+function buildNamespacedName(prefix, used) {
+    let candidate = prefix.slice(0, MAX_FUNCTION_NAME_CHARS);
+    let suffix = 2;
+    while (used.has(candidate)) {
+        const tail = `_${suffix}`;
+        candidate = `${prefix.slice(0, MAX_FUNCTION_NAME_CHARS - tail.length)}${tail}`;
+        suffix += 1;
+    }
+    used.add(candidate);
+    return candidate;
+}
+function flattenContentText(content) {
+    if (!Array.isArray(content)) {
+        return "";
+    }
+    return content
+        .flatMap((part) => {
+        if (!part || typeof part !== "object")
+            return [];
+        const record = part;
+        return record.type === "text" && typeof record.text === "string" ? [record.text] : [];
+    })
+        .join("\n");
+}
+export class OpenAICompatMcpManager {
+    constructor(options) {
+        this.connectPromise = null;
+        this.connected = [];
+        this.toolBindings = new Map();
+        this.connectionFailures = [];
+        this.closed = false;
+        this.servers = options.servers;
+        this.providerId = options.providerId;
+        this.cwd = options.cwd;
+        this.logger = options.logger;
+        this.managedProcesses = options.managedProcesses ?? null;
+        this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+        this.secrets = collectSecrets(options.servers);
+    }
+    get hasServers() {
+        return Object.keys(this.servers).length > 0;
+    }
+    /** Failures recorded by the last connect pass; empty before the first connect. */
+    get failures() {
+        return this.connectionFailures;
+    }
+    /**
+     * Connect to every configured server and snapshot its tools. Memoized so
+     * idle sessions never spawn processes and repeated turns reuse connections.
+     * Per-server failures are collected, never thrown.
+     */
+    ensureConnected() {
+        if (this.closed) {
+            return Promise.resolve();
+        }
+        this.connectPromise ?? (this.connectPromise = this.connectAll());
+        return this.connectPromise;
+    }
+    async connectAll() {
+        // Connect in parallel — sequential connects stack the 10s timeout per
+        // unreachable server ahead of the session's first turn. Tool snapshots
+        // still run in config order so namespaced-name dedup suffixes stay
+        // deterministic.
+        const entries = Object.entries(this.servers);
+        const results = await Promise.allSettled(entries.map(([name, config]) => this.connectServer(name, config)));
+        const usedNames = new Set();
+        for (const [index, [name]] of entries.entries()) {
+            const result = results[index];
+            if (result.status === "rejected") {
+                this.recordConnectionFailure(name, result.reason);
+                continue;
+            }
+            this.connected.push(result.value);
+            try {
+                await this.snapshotTools(result.value, usedNames);
+            }
+            catch (error) {
+                this.recordConnectionFailure(name, error);
+            }
+        }
+    }
+    recordConnectionFailure(name, error) {
+        const message = this.redact(error instanceof Error ? error.message : String(error));
+        this.connectionFailures.push({ name, error: message });
+        this.logger?.warn({ provider: this.providerId, mcpServer: name, error: message }, "MCP server connection failed");
+    }
+    async connectServer(name, config) {
+        const client = new Client({ name: "otto-openai-compat", version: "1.0.0" });
+        if (config.type === "stdio") {
+            const transport = new StdioClientTransport({
+                command: config.command,
+                args: config.args ?? [],
+                cwd: this.cwd,
+                env: createExternalProcessEnv(process.env, config.env ?? {}),
+                stderr: "pipe",
+            });
+            transport.stderr?.on("data", (chunk) => {
+                this.logger?.debug({ provider: this.providerId, mcpServer: name }, `MCP server stderr: ${this.redact(chunk.toString("utf8")).slice(0, 500)}`);
+            });
+            try {
+                await client.connect(transport, { timeout: this.connectTimeoutMs });
+            }
+            catch (error) {
+                // The SDK spawned the process before the handshake failed — reap it.
+                const pid = transport.pid;
+                if (typeof pid === "number") {
+                    void killPidTree(pid);
+                }
+                throw error;
+            }
+            const pid = transport.pid;
+            let managedRecordId = null;
+            if (typeof pid === "number" && this.managedProcesses) {
+                try {
+                    const record = await this.managedProcesses.record({
+                        owner: { provider: this.providerId, kind: "mcp-server" },
+                        pid,
+                        command: config.command,
+                        args: config.args ?? [],
+                        metadata: { server: name },
+                    });
+                    managedRecordId = record.id;
+                }
+                catch (error) {
+                    this.logger?.warn({ err: error, provider: this.providerId, mcpServer: name }, "Failed to register MCP server process");
+                }
+            }
+            return { name, client, stdioPid: pid ?? null, managedRecordId };
+        }
+        const url = new URL(config.url);
+        const requestInit = config.headers
+            ? { headers: config.headers }
+            : undefined;
+        const transport = config.type === "http"
+            ? new StreamableHTTPClientTransport(url, requestInit ? { requestInit } : undefined)
+            : new SSEClientTransport(url, requestInit ? { requestInit } : undefined);
+        await client.connect(transport, { timeout: this.connectTimeoutMs });
+        return { name, client, stdioPid: null, managedRecordId: null };
+    }
+    async snapshotTools(server, usedNames) {
+        const listing = await server.client.listTools(undefined, { timeout: LIST_TIMEOUT_MS });
+        for (const tool of listing.tools) {
+            const prefix = `mcp_${sanitizeNamePart(server.name)}_${sanitizeNamePart(tool.name)}`;
+            const modelName = buildNamespacedName(prefix, usedNames);
+            this.toolBindings.set(modelName, {
+                modelName,
+                serverName: server.name,
+                toolName: tool.name,
+                description: tool.description ?? "",
+                parameters: tool.inputSchema ?? {
+                    type: "object",
+                    properties: {},
+                },
+                readOnlyHint: tool.annotations?.readOnlyHint === true,
+            });
+        }
+    }
+    /** Pids of spawned stdio servers (diagnostics and lifecycle tests). */
+    getStdioPids() {
+        return this.connected.flatMap((server) => (server.stdioPid !== null ? [server.stdioPid] : []));
+    }
+    /** Tool bindings snapshotted at connect; empty before the first connect. */
+    getToolBindings() {
+        return [...this.toolBindings.values()];
+    }
+    resolveTool(modelName) {
+        return this.toolBindings.get(modelName);
+    }
+    async callTool(binding, args, options) {
+        const server = this.connected.find((candidate) => candidate.name === binding.serverName);
+        if (!server) {
+            return {
+                output: `Error: MCP server '${binding.serverName}' is not connected`,
+                isError: true,
+            };
+        }
+        try {
+            const result = await server.client.callTool({ name: binding.toolName, arguments: args }, undefined, { timeout: CALL_TOOL_TIMEOUT_MS, ...(options.signal ? { signal: options.signal } : {}) });
+            const text = flattenContentText(result.content);
+            const fallback = result.isError ? "Tool failed" : "Done.";
+            return {
+                output: capToolOutput(this.redact(text || fallback)),
+                isError: result.isError === true,
+            };
+        }
+        catch (error) {
+            const message = this.redact(error instanceof Error ? error.message : String(error));
+            return { output: `Error: ${message}`, isError: true };
+        }
+    }
+    /** Prompts listed on demand (for slash commands); per-server failures are skipped. */
+    async listPrompts() {
+        await this.ensureConnected();
+        const bindings = [];
+        const usedNames = new Set();
+        for (const server of this.connected) {
+            try {
+                const listing = await server.client.listPrompts(undefined, { timeout: LIST_TIMEOUT_MS });
+                for (const prompt of listing.prompts) {
+                    const prefix = `mcp_${sanitizeNamePart(server.name)}_${sanitizeNamePart(prompt.name)}`;
+                    bindings.push({
+                        commandName: buildNamespacedName(prefix, usedNames),
+                        serverName: server.name,
+                        promptName: prompt.name,
+                        ...(prompt.description ? { description: prompt.description } : {}),
+                        argumentNames: (prompt.arguments ?? []).map((argument) => argument.name),
+                    });
+                }
+            }
+            catch (error) {
+                // Servers without prompt support reply with "method not found" — normal.
+                this.logger?.debug({ provider: this.providerId, mcpServer: server.name, err: error }, "MCP prompts listing unavailable");
+            }
+        }
+        return bindings;
+    }
+    /** Resolve a prompt to the text fed to the model in place of the typed /command. */
+    async getPrompt(binding, argumentValue) {
+        const server = this.connected.find((candidate) => candidate.name === binding.serverName);
+        if (!server) {
+            throw new Error(`MCP server '${binding.serverName}' is not connected`);
+        }
+        const firstArgument = binding.argumentNames[0];
+        const result = await server.client.getPrompt({
+            name: binding.promptName,
+            ...(firstArgument && argumentValue
+                ? { arguments: { [firstArgument]: argumentValue } }
+                : {}),
+        }, { timeout: LIST_TIMEOUT_MS });
+        const text = result.messages
+            .map((message) => {
+            const content = message.content;
+            return content?.type === "text" && typeof content.text === "string" ? content.text : "";
+        })
+            .filter(Boolean)
+            .join("\n\n");
+        if (!text) {
+            throw new Error(`MCP prompt '${binding.promptName}' returned no text content`);
+        }
+        return this.redact(text);
+    }
+    /** Idempotent: close clients, tree-kill stdio children, unregister processes. */
+    async close() {
+        if (this.closed) {
+            return;
+        }
+        this.closed = true;
+        const servers = this.connected;
+        this.connected = [];
+        this.toolBindings = new Map();
+        for (const server of servers) {
+            await server.client.close().catch(() => undefined);
+            if (server.stdioPid !== null) {
+                await killPidTree(server.stdioPid);
+            }
+            if (server.managedRecordId && this.managedProcesses) {
+                await this.managedProcesses.remove(server.managedRecordId).catch(() => undefined);
+            }
+        }
+    }
+    /** Replace configured header/env secret values in outgoing text with ***. */
+    redact(text) {
+        let result = text;
+        for (const secret of this.secrets) {
+            result = result.split(secret).join(REDACTED);
+        }
+        return result;
+    }
+}
+function collectSecrets(servers) {
+    const secrets = [];
+    for (const config of Object.values(servers)) {
+        const values = config.type === "stdio"
+            ? Object.values(config.env ?? {})
+            : Object.values(config.headers ?? {});
+        for (const value of values) {
+            // Very short values would redact common substrings; headers/env values
+            // that short are not meaningful secrets.
+            if (value.length >= 4) {
+                secrets.push(value);
+            }
+        }
+    }
+    return secrets;
+}
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * SDK close() only signals the direct child; npx-style wrappers leave orphaned
+ * grandchildren. Tree-kill by pid: without an exit-event handle the graceful
+ * wait always runs its course, so skip dead pids and keep the grace short.
+ */
+async function killPidTree(pid) {
+    if (!isPidAlive(pid)) {
+        return;
+    }
+    await terminateWithTreeKill({
+        pid,
+        kill: (signal) => {
+            try {
+                process.kill(pid, signal);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    }, { gracefulTimeoutMs: STDIO_KILL_GRACE_MS });
+}
+//# sourceMappingURL=openai-compat-mcp.js.map

package/dist/server/server/agent/providers/openai-compat-otto-tool-permissions.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Permission classification for Otto catalog tools (browser_*, preview_*,
+ * agent/terminal/schedule management) when the openai-compat provider is the
+ * tool runtime.
+ *
+ * CLI providers reach these tools through their own MCP client, so the CLI's
+ * permission system prompts before running them. The openai-compat provider
+ * has no CLI in front of it — the daemon executes the call directly — so the
+ * daemon must supply the equivalent gating itself. Without it, an "Always Ask"
+ * session could create a terminal and send keystrokes (shell execution),
+ * upload arbitrary files through a browser form, or flip another agent to
+ * bypassPermissions, all without a prompt.
+ *
+ * The classes mirror CompatToolKind (openai-compat-tools.ts):
+ *
+ * - "read":     observation only — never prompts.
+ * - "interact": drives visible UI the user is watching (browser pane
+ *               interaction, preview servers) — prompts in default mode,
+ *               auto-approved in acceptEdits, like file edits.
+ * - "execute":  can run code, move data off the page, or change what other
+ *               agents are allowed to do — prompts in default AND acceptEdits,
+ *               like shell commands.
+ *
+ * Unknown names default to "execute": a new tool must be classified here
+ * before it can skip prompts.
+ */
+export type OttoToolPermissionKind = "read" | "interact" | "execute";
+export declare function ottoToolPermissionKind(name: string): OttoToolPermissionKind;
+//# sourceMappingURL=openai-compat-otto-tool-permissions.d.ts.map