openmausbot 0.1.55

package/dist-server/server/container-mcp.js

@@ -0,0 +1,27 @@
+// Transparent stdio bridge into Cua Driver's official MCP server inside the
+// Local VM. This process defines no tools and parses no MCP messages; the
+// piping, drain-safe exit, and watchdog live in mcp-bridge.ts, shared with
+// the VPS entry point.
+import { cuaExecArgs } from "./container-computer.js";
+import { runMcpBridge } from "./mcp-bridge.js";
+const [runtime, container, socket] = process.argv.slice(2);
+if (!runtime || !["docker", "podman", "container"].includes(runtime)) {
+    process.stderr.write("invalid Local VM runtime\n");
+    process.exit(2);
+}
+if (!container || !/^[a-zA-Z0-9_.-]+$/.test(container) || !socket?.startsWith("/run/user/1000/")) {
+    process.stderr.write("invalid Local VM connection\n");
+    process.exit(2);
+}
+// The who-is-driving pair rides in env, not argv — argv is world-readable
+// through `ps`, and the token guards a loopback endpoint.
+const controlUrl = process.env.OMB_CONTROL_URL ?? "";
+const controlToken = process.env.OMB_CONTROL_TOKEN ?? "";
+runMcpBridge({
+    command: runtime,
+    args: cuaExecArgs(["mcp", "--socket", socket], { container, interactive: true }),
+    label: "Cua Driver",
+    // No liveness watchdog: the runtime CLI talks to a local daemon and fails
+    // fast on its own — there is no silent WAN peer to wedge on.
+    ...(controlUrl && controlToken ? { gate: { url: controlUrl, token: controlToken } } : {}),
+});

package/dist-server/server/contracts.js

@@ -0,0 +1,24 @@
+// Canonical harness contracts — ported from upstream
+// (apps/server/src/provider/ProviderDriver.ts, Services/ProviderAdapter.ts,
+// packages/contracts/src/{provider,providerInstance,providerRuntime}.ts),
+// de-Effect-ed: Promises instead of Effect, listener callbacks instead of
+// Stream. The shapes and names are kept so the two codebases stay mutually
+// readable.
+export class ProviderError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = "ProviderError";
+        this.code = code;
+    }
+}
+/** Reasoning-effort levels, ascending. A union of everything any engine
+ * accepts; each driver declares the subset its CLI will take. */
+export const EFFORT_LEVELS = ["none", "low", "medium", "high", "xhigh", "max"];
+/** Narrow untrusted API/config input before it becomes a model selection. */
+export function isEffortLevel(value) {
+    return typeof value === "string" && EFFORT_LEVELS.includes(value);
+}
+let eventCounter = 0;
+export const newEventId = () => `ev-${Date.now().toString(36)}-${(eventCounter++).toString(36)}`;
+export const newId = () => crypto.randomUUID();

package/dist-server/server/control-client.js

@@ -0,0 +1,100 @@
+// The proxy-side half of computer control. The harness keeps the record of
+// who is driving (server/computer-control.ts); the per-turn computer
+// processes consult it through this client before acting, because the
+// action paths themselves never traverse the harness — a box click goes
+// straight to the box's REST API, and a Local VM / VPS click rides a
+// transparent stdio bridge into Cua Driver.
+//
+// Failure posture: CLOSED once configured. A missing/expired turn capability
+// must never be interpreted as "the person released control": that would let
+// a stale computer proxy resume acting underneath them. An unconfigured
+// client remains disengaged because there is no control surface to consult.
+//
+// The state is cached briefly so a computer_batch of two dozen actions
+// doesn't turn into two dozen loopback round trips.
+const DISENGAGED = { held: false, helpOpen: false };
+const UNAVAILABLE = { held: true, helpOpen: false };
+export function createControlClient(options) {
+    const url = options?.url ?? process.env.OMB_CONTROL_URL ?? "";
+    const token = options?.token ?? process.env.OMB_CONTROL_TOKEN ?? "";
+    const cacheMs = options?.cacheMs ?? 750;
+    const fetchImpl = options?.fetchImpl ?? fetch;
+    const configured = Boolean(url && token);
+    const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+    let cachedAt = 0;
+    let cached = DISENGAGED;
+    async function read() {
+        try {
+            const res = await fetchImpl(url, { headers, signal: AbortSignal.timeout(2_000) });
+            if (!res.ok)
+                return UNAVAILABLE;
+            const body = await res.json().catch(() => null);
+            return { held: body?.held === true, helpOpen: body?.helpOpen === true };
+        }
+        catch {
+            return UNAVAILABLE;
+        }
+    }
+    return {
+        configured,
+        async state(fresh = false) {
+            if (!configured)
+                return DISENGAGED;
+            const now = Date.now();
+            if (!fresh && now - cachedAt < cacheMs)
+                return cached;
+            cached = await read();
+            cachedAt = Date.now();
+            return cached;
+        },
+        async requestHelp(reason) {
+            if (!configured)
+                return null;
+            try {
+                const res = await fetchImpl(url, {
+                    method: "POST",
+                    headers,
+                    body: JSON.stringify({ reason }),
+                    signal: AbortSignal.timeout(2_000),
+                });
+                if (!res.ok)
+                    return null;
+                const body = await res.json().catch(() => null);
+                return typeof body?.requestId === "string" && body.requestId ? body.requestId : null;
+            }
+            catch {
+                return null;
+            }
+        },
+        async expireHelp(requestId) {
+            if (!configured || !requestId)
+                return;
+            try {
+                await fetchImpl(url, {
+                    method: "DELETE",
+                    headers,
+                    body: JSON.stringify({ requestId }),
+                    signal: AbortSignal.timeout(2_000),
+                });
+            }
+            catch {
+                // Best effort: the harness also clears the in-memory request on
+                // release/restart, and an unavailable harness cannot show the card.
+            }
+        },
+    };
+}
+/** The one sentence every refused action gets. Deliberately does not vary
+ * per tool: the model needs the same three facts every time — nothing
+ * happened, don't retry blindly, and how to wait properly. */
+export const CONTROL_REFUSAL = "A person has taken control of this computer, so this call was NOT performed. " +
+    "Do not retry it — the screen is changing under their hands. " +
+    "Call computer_request_help (no reason needed) to wait for them to finish, " +
+    "then take a fresh screenshot before your next action.";
+/** The bridge-gated computers (Local VM, VPS) speak Cua Driver's own tool
+ * surface, which has no wait tool to point at — so the guidance is to
+ * pause, not to call anything. */
+export const CONTROL_REFUSAL_PLAIN = "A person has taken control of this computer, so this call was NOT performed. " +
+    "Do not retry it — the screen is changing under their hands. " +
+    "Pause this task, tell the person you are waiting for them to hand control back, " +
+    "and take a fresh screenshot before your next action once they have.";

package/dist-server/server/data-dir-lease.js

@@ -0,0 +1,3 @@
+// The canonical implementation is plain ESM so Electron's main process and
+// the TypeScript harness server enforce exactly the same lease protocol.
+export { acquireDataDirLease, acquireDataDirLeaseForProcess, DataDirLeaseError, } from "../electron/data-dir-lease.mjs";

package/dist-server/server/decision-log.js

@@ -0,0 +1,106 @@
+// The authorization DECISION log: one fleet-wide, append-only NDJSON file
+// answering "which tool call was allowed, denied, or carded — by which
+// rule, when, for which bot".
+//
+// The per-thread event log (harness/bus.ts) cannot answer that. It records
+// that a request opened and later resolved, but the WHY — a grant waved it
+// through, a guard held it, an unattended block overrode a grant that
+// would otherwise have fired — exists only for a moment at the fold point
+// and is gone by the time the event is on disk. So the fold writes the
+// reason down here at the moment it is known, and the human-answer path
+// writes a second row when a card comes back.
+//
+// Same discipline as the event tee: 0600 (rows name tools and command
+// lines), through redactSecrets (summaries carry whatever the agent typed,
+// credentials included), and fire-and-forget — an audit log must never
+// take down the decision it is auditing.
+//
+// Deliberately NOT covered: ask_bot peer-approval cards. They never cross
+// the runtime bus (peer-approval.ts appends its cards straight to the
+// store), so wiring them here would mean a second, parallel tap — a
+// separate change if it earns its keep.
+import { readFileSync } from "node:fs";
+import { appendFile, rename, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { redactSecrets } from "./redact.js";
+const FILE_NAME = "decisions.ndjson";
+// Rotation is logrotate at its simplest: when the live file crosses the cap
+// it becomes `.1` (clobbering the previous `.1`) and a fresh file starts.
+// Total disk is bounded at ~2× the cap; at a few hundred bytes per row that
+// is years of human-scale approvals, and anything fancier — dated segments,
+// compression — is more machinery than an audit trail this size warrants.
+const MAX_BYTES = 4 * 1024 * 1024;
+const writeQueues = new Map();
+async function writeDecision(dataDir, row, maxBytes) {
+    const file = join(dataDir, FILE_NAME);
+    try {
+        if ((await stat(file)).size >= maxBytes)
+            await rename(file, `${file}.1`);
+    }
+    catch {
+        /* no live file yet — nothing to rotate */
+    }
+    const record = redactSecrets({ at: new Date().toISOString(), ...row });
+    await appendFile(file, JSON.stringify(record) + "\n", { mode: 0o600 });
+}
+/** Append one decision row. Fire-and-forget, mirroring the event bus tee:
+ * the fold that calls this is delivering approvals and cards, and a full
+ * disk must not turn into denied tools. */
+export function appendDecision(dataDir, row, opts) {
+    const previous = writeQueues.get(dataDir) ?? Promise.resolve();
+    // Serialize stat → optional rotate → append for each directory. Without
+    // this queue two simultaneous approvals can both rotate, overwrite .1,
+    // or append out of decision order.
+    const queued = previous
+        .then(() => writeDecision(dataDir, row, opts?.maxBytes ?? MAX_BYTES))
+        .catch(() => {
+        /* logging must never take down the fold */
+    });
+    writeQueues.set(dataDir, queued);
+    void queued.finally(() => {
+        if (writeQueues.get(dataDir) === queued)
+            writeQueues.delete(dataDir);
+    });
+}
+/** Test/shutdown seam: wait until every decision already queued for this
+ * directory has reached disk. Normal request paths deliberately do not wait. */
+export async function flushDecisionLog(dataDir) {
+    await writeQueues.get(dataDir);
+}
+const isDecisionRow = (value) => typeof value === "object" &&
+    value !== null &&
+    typeof value.at === "string" &&
+    typeof value.threadId === "string" &&
+    typeof value.decision === "string" &&
+    typeof value.source === "string";
+/** The newest `limit` rows, oldest first — the same order the inspector
+ * uses for thread events. Reads `.1` before the live file so a request
+ * right after a rotation still sees history instead of a nearly empty
+ * log; whole-file reads are fine here because rotation caps both files,
+ * unlike the unbounded per-thread event logs that need a tail walk. */
+export function readDecisions(dataDir, limit) {
+    const file = join(dataDir, FILE_NAME);
+    const rows = [];
+    for (const path of [`${file}.1`, file]) {
+        let text;
+        try {
+            text = readFileSync(path, "utf8");
+        }
+        catch {
+            continue;
+        }
+        for (const line of text.split("\n")) {
+            if (!line)
+                continue;
+            try {
+                const value = JSON.parse(line);
+                if (isDecisionRow(value))
+                    rows.push(value);
+            }
+            catch {
+                /* a line torn mid-write — skip the fragment, keep the rest */
+            }
+        }
+    }
+    return rows.slice(-limit);
+}