mixdog 1.3.1 → 1.3.3

package/src/runtime/agent/orchestrator/session/human-gate/requests.mjs

@@ -119,13 +119,16 @@ export function humanRequestFields(input = {}) {
     // browser page ID, or a computer window id and app, so the card can bring
     // exactly that window forward on the user's click.
     const token = (value, limit) => (/^[\w.:#@-]+$/.test(text(value, limit)) ? text(value, limit) : '');
-    const identity =
-      surface === 'browser'
-        ? { ...(token(takeover.tab, 64) ? { tab: token(takeover.tab, 64) } : {}) }
-        : {
-            ...(token(takeover.windowId, 128) ? { windowId: token(takeover.windowId, 128) } : {}),
-            ...(text(takeover.app, 120) ? { app: text(takeover.app, 120) } : {}),
-          };
+    const tab = token(takeover.tab, 64);
+    const windowId = token(takeover.windowId, 128);
+    const app = text(takeover.app, 120);
+    const identity = {};
+    if (surface === 'browser') {
+      if (tab) identity.tab = tab;
+    } else {
+      if (windowId) identity.windowId = windowId;
+      if (app) identity.app = app;
+    }
     // A login takeover (purpose 'login') opens the desktop's sign-in window on
     // its validated page instead of handing over the side panel.
     const login = surface === 'browser' && takeover.purpose === 'login' ? loginPageUrl(takeover.url) : null;
@@ -143,7 +146,13 @@ export function humanRequestFields(input = {}) {
     fields.permission = {
       scopes: scopes
         .filter((scope) => isRecord(scope) && text(scope.id))
-        .map((scope) => ({ id: text(scope.id), label: text(scope.label) || text(scope.id) })),
+        .map((scope) => ({
+          id: text(scope.id),
+          label: text(scope.label) || text(scope.id),
+          // The option's kind (allow_always / allow_once / reject, as an ACP or
+          // MCP permission request names them); the card maps buttons by it.
+          ...(text(scope.kind) ? { kind: text(scope.kind) } : {}),
+        })),
     };
   }
   return fields;
@@ -191,5 +200,6 @@ export function normalizeHumanResponse(request, approved, extra = {}) {
 /** `args` with the card's edited fields in place of the model's. */
 export function applyEditedArgs(args, editedArgs, editable) {
   const edits = editableArgs(editedArgs, editable);
-  return Object.keys(edits).length ? { ...(isRecord(args) ? args : {}), ...edits } : args;
+  if (!Object.keys(edits).length) return args;
+  return { ...(isRecord(args) ? args : {}), ...edits };
 }

package/src/runtime/agent/orchestrator/session/human-gate/run-policy.mjs

@@ -0,0 +1,73 @@
+// session/human-gate/run-policy.mjs
+// Schedule and webhook runs never ask. Saving a schedule or webhook is the
+// user's explicit grant for its runs (and for the work they start: sub-agents):
+// outbound actions and ordinary tool approvals are
+// allowed without a card, a held row or a push, inside the bot's own
+// permissions (a `block` is applied before any ask, gate.mjs). Payments and
+// permanent deletes (the action kinds that can never be remembered) are never
+// done in a run: denied at once, with a result the bot can report. Group-room
+// members are not runs of this kind and keep their held/approval behaviour.
+import { ACTION_KINDS, isRememberableAction } from './outbound-policy.mjs';
+
+export const RUN_FORBIDDEN_REASON =
+  "Payments and permanent deletes aren't allowed in schedule/webhook runs; do it from the chat.";
+
+/** The ask reason of a schedule/webhook save: the grant, said plainly. */
+export const AUTOMATION_GRANT_REASON =
+  "Approving lets this schedule's or webhook's runs act without asking, within the bot's permissions. Payments and permanent deletes are never done in runs.";
+
+/** Whether `run` (the unattended port's `runOf`) is a schedule or webhook run. */
+export const isGrantedRun = (run) => Boolean(run) && run.kind !== 'room';
+
+/** Whether an outbound request is a payment or permanent delete. */
+export function isForbiddenInRun(request) {
+  const category = request?.kind === 'outbound' ? request.outbound?.category : '';
+  return ACTION_KINDS.includes(category) && !isRememberableAction(category);
+}
+
+const READ_VERBS = new Set([
+  'get',
+  'list',
+  'search',
+  'read',
+  'fetch',
+  'retrieve',
+  'find',
+  'view',
+  'describe',
+  'lookup',
+]);
+const DELETE_TOKENS = new Set(['delete', 'remove', 'destroy', 'erase', 'purge', 'wipe']);
+
+/** Whether a connector/MCP tool deletes remote items without being a confirmed
+ *  recoverable `trash`: in a run that counts as a permanent delete. Read-verb
+ *  names (`list_deleted_items`) stay reads. `classified` is the outbound
+ *  classification of the call (outbound-policy.mjs), if any. */
+export function isRemoteDeleteInRun({ name, annotations }, classified) {
+  const toolName = String(name || '');
+  if (!toolName.startsWith('mcp__')) return false;
+  if (classified?.category === 'trash') return false;
+  if (classified?.category === 'delete') return true;
+  const bare = String(annotations?.mcpToolName || toolName.split('__').slice(2).join('__'))
+    .toLowerCase()
+    .replace(/-/g, '_');
+  const tokens = bare.split(/[^a-z0-9]+/).filter(Boolean);
+  if (READ_VERBS.has(tokens[0])) return false;
+  return tokens.some((token) => DELETE_TOKENS.has(token));
+}
+
+/** Whether `call` saves a schedule or webhook (the setup tool's `save_automation`). */
+export const savesAutomation = (call) => call?.name === 'setup' && call.args?.action === 'save_automation';
+
+/** The answer a granted run gets instead of a card: `{ approval }` to run the
+ *  call, or `{ denial, approval }` for a payment or permanent delete. The
+ *  `response` is the audit decision (`run-allowed`, `run-forbidden`). */
+export function runAskOutcome({ name, request }) {
+  if (isForbiddenInRun(request)) {
+    return {
+      denial: `Error: tool "${name}" denied: ${RUN_FORBIDDEN_REASON} Report this to the user; do not retry it or reach the same result another way.`,
+      approval: { approved: false, response: 'run-forbidden', reason: RUN_FORBIDDEN_REASON },
+    };
+  }
+  return { approval: { approved: true, response: 'run-allowed', reason: 'schedule/webhook run' } };
+}

package/src/runtime/agent/orchestrator/session/human-gate/store.mjs

@@ -11,7 +11,7 @@
 import { createHash } from 'node:crypto';
 import { appendFile, mkdir, readFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { parseJsonText, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
+import { readJsonState, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
 import { ACTION_KINDS, isRememberableAction } from './outbound-policy.mjs';
 
 const ANY_AGENT = '*';
@@ -22,52 +22,64 @@ export const PERMISSION_MODES = Object.freeze(['ask', 'allow', 'block']);
 const field = (value) => String(value ?? '').slice(0, FIELD_LIMIT);
 const grantId = (agentId, action) =>
   `grant_${createHash('sha256').update(`${agentId}\n${action}`).digest('hex').slice(0, 24)}`;
+const MODE_RANK = Object.freeze({ block: 0, ask: 1, allow: 2 });
+export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
 const isGrant = (row) => ACTION_KINDS.includes(row?.action) && (row.mode === 'allow' || row.mode === 'block');
 
+/** The effective mode among `grants`: the agent's own grant, else an every-agent one. */
+function effectiveMode(grants, agentId, action) {
+  const rows = grants.filter((grant) => grant.action === action);
+  const own = rows.find((grant) => grant.agentId === agentId) || rows.find((grant) => grant.agentId === ANY_AGENT);
+  if (own?.mode === 'allow' && !isRememberableAction(action)) return 'ask';
+  return own?.mode || 'ask';
+}
+
 export function createHumanGateStore(directory) {
   const grantsFile = join(directory, 'grants.json');
   const auditFile = join(directory, 'audit.jsonl');
   const grantsOf = (doc) => (Array.isArray(doc?.grants) ? doc.grants.filter(isGrant) : []);
-  async function readGrants() {
-    try {
-      return grantsOf(parseJsonText(await readFile(grantsFile, 'utf8')));
-    } catch (error) {
-      if (error?.code === 'ENOENT') return [];
-      throw error;
-    }
-  }
+  // A damaged file (empty, NUL, torn) is kept aside by readJsonState and reads
+  // as no grants: every action asks again, never "allowed". No `.bak` is ever
+  // written or restored (`restoreBackup: false`, also for a stale one left by
+  // an older build) — an older copy could bring back a revoked allow.
+  const readGrants = async () => grantsOf(await readJsonState(grantsFile, { fallback: null, restoreBackup: false }));
   async function updateGrants(mutate) {
     await mkdir(directory, { recursive: true });
     let result;
-    await updateJsonAtomic(grantsFile, (doc) => {
-      const out = mutate(grantsOf(doc));
-      if (!out) return undefined;
-      result = out.result;
-      return { grants: out.grants };
-    });
+    await updateJsonAtomic(
+      grantsFile,
+      (doc) => {
+        const out = mutate(grantsOf(doc));
+        if (!out) return undefined;
+        result = out.result;
+        return { grants: out.grants };
+      },
+      { restoreBackup: false }
+    );
     return result;
   }
   /** Set `agentId`'s mode for `action`; `ask` removes its grant. Returns the
    *  grant, or null for `ask` and for an `allow` that may not exist. */
-  async function setMode({ agentId, action, mode, device = '' }) {
+  async function setMode({ agentId, action, mode, device = '', noWiden = false }) {
     if (!ACTION_KINDS.includes(action) || !PERMISSION_MODES.includes(mode)) return null;
     if (mode === 'allow' && !isRememberableAction(action)) return null;
     const owner = field(agentId);
     const id = grantId(owner, action);
     const grant = mode === 'ask' ? null : { id, agentId: owner, action, mode, device: field(device), at: Date.now() };
-    await updateGrants((grants) => ({
-      grants: [...grants.filter((row) => row.id !== id), ...(grant ? [grant] : [])],
-      result: grant,
-    }));
+    await updateGrants((grants) => {
+      const next = [...grants.filter((row) => row.id !== id), ...(grant ? [grant] : [])];
+      // `noWiden` (a remote client's call): judged on the effective mode inside the
+      // same locked read-modify-write, so a block landing meanwhile is never lifted.
+      if (noWiden && MODE_RANK[effectiveMode(next, owner, action)] > MODE_RANK[effectiveMode(grants, owner, action)]) {
+        throw new Error(NO_WIDEN_MESSAGE);
+      }
+      return { grants: next, result: grant };
+    });
     return grant;
   }
   /** `allow`, `block` or `ask` for `agentId` + `action`; the agent's own grant wins. */
   async function modeFor({ agentId, action }) {
-    const grants = (await readGrants()).filter((grant) => grant.action === action);
-    const own =
-      grants.find((grant) => grant.agentId === agentId) || grants.find((grant) => grant.agentId === ANY_AGENT);
-    if (own?.mode === 'allow' && !isRememberableAction(action)) return 'ask';
-    return own?.mode || 'ask';
+    return effectiveMode(await readGrants(), agentId, action);
   }
   return {
     setMode,
@@ -151,16 +163,32 @@ export async function agentPermissions(agentId) {
 }
 
 /** Set one row of that table (capability setAgentPermission); returns the table. */
-export async function setAgentPermission(agentId, action, mode) {
+export async function setAgentPermission(agentId, action, mode, options) {
   const agent = requiredAgentId(agentId);
   if (!ACTION_KINDS.includes(action)) throw new Error(`action must be one of ${ACTION_KINDS.join(', ')}`);
   if (!PERMISSION_MODES.includes(mode)) throw new Error(`mode must be one of ${PERMISSION_MODES.join(', ')}`);
   if (mode === 'allow' && !isRememberableAction(action)) throw new Error(`${action} always asks; it cannot be allowed`);
   const store = await humanGateStore();
-  await store.setMode({ agentId: agent, action, mode });
+  await store.setMode({ agentId: agent, action, mode, noWiden: options?.noWiden === true });
   return store.permissions(agent);
 }
 
+const BROWSER_AUDIT_DECISIONS = Object.freeze(['approve', 'deny', 'granted', 'remembered', 'run-allowed', 'blocked']);
+
+/** Audit one Browser Use approval of a bot (capability recordAgentApprovalAudit):
+ *  the bot, the action kind and what happened — `approve` / `deny` for the card,
+ *  `granted` when "always allow" was saved, `remembered` when a saved allow let
+ *  a step run unasked. Never a page address, target or value. */
+export async function recordAgentApprovalAudit(agentId, action, decision) {
+  const agent = requiredAgentId(agentId);
+  if (!ACTION_KINDS.includes(action)) throw new Error(`action must be one of ${ACTION_KINDS.join(', ')}`);
+  if (!BROWSER_AUDIT_DECISIONS.includes(decision)) {
+    throw new Error(`decision must be one of ${BROWSER_AUDIT_DECISIONS.join(', ')}`);
+  }
+  await (await humanGateStore()).recordAudit({ agentId: agent, kind: 'browser', action, tool: 'browser', decision });
+  return null;
+}
+
 /** Replace the process store (tests); null restores the default. */
 export function setHumanGateStore(store) {
   processStore = store || null;

package/src/runtime/agent/orchestrator/session/human-gate/unattended-port.mjs

@@ -0,0 +1,15 @@
+// session/human-gate/unattended-port.mjs
+// The port unattended runs (schedule, webhook, room member) register
+// (session-runtime/held-requests.mjs): `{ runOf(sessionId) → { kind, agentId,
+// name } | null, hold(request, { signal }) → Promise<approval>,
+// humanNeeded(sessionId, outcome, site) → Promise<boolean> }` — the last ends
+// a schedule/webhook run that would need a takeover. gate.mjs re-exports it.
+let unattendedPort = null;
+
+export function setUnattendedApprovalPort(port) {
+  unattendedPort = port || null;
+}
+
+export function unattendedApprovalPort() {
+  return unattendedPort;
+}

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -838,10 +838,13 @@ function compactionTelemetryRecord(sessionRef, policy, meta, prev) {
       meta.compactError ?? meta.lastError,
       prev.lastError
     ),
+    // The last compaction's wall time: replaced only by a stage that reports
+    // a finished compaction's duration; a plain pre-send check keeps it (the
+    // other timing fields stay with `...prev`).
     lastDurationMs:
       meta.durationMs != null && Number.isFinite(Number(meta.durationMs))
         ? Math.max(0, Math.round(Number(meta.durationMs)))
-        : null,
+        : (prev.lastDurationMs ?? null),
     compactCount: (prev.compactCount || 0) + (changed ? 1 : 0),
     singleShotConsumed:
       policy.singleShot === true && meta.stage === 'compacting' ? true : prev.singleShotConsumed === true,