openmausbot 0.1.59 → 0.1.61

package/dist-server/index.js

@@ -14563,7 +14563,7 @@ function supportsApprovalMode(driverKind, mode) {
   return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo"].includes(driverKind ?? "");
 }
 function requiresNativeApproval(driverKind, mode) {
-  return mode === "auto" || mode === "full" && ["claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent"].includes(driverKind);
+  return mode === "auto" || mode === "full" && ["claudeAgent", "cursorAgent", "grokAgent"].includes(driverKind);
 }
 function isApprovalMode(value) {
   return typeof value === "string" && APPROVAL_MODES.includes(value);
@@ -14812,22 +14812,33 @@ function autoVerdict(bot, tool, summary, context) {
   return { approve: null, source: "no-grant" };
 }
 function approvalHeldReason(context) {
-  if (context.source === "native-approval") return "The provider requires your approval for this action.";
+  const key3 = approvalHeldNote(context);
+  return key3 && HELD_NOTE[key3];
+}
+var HELD_NOTE = {
+  "approval.held.native": "The provider requires your approval for this action.",
+  "approval.held.sandbox": "This changes the provider sandbox, so only Full access can approve it automatically.",
+  "approval.held.localComputer": "Controlling your computer is never covered by Always allow, so this needs you.",
+  "approval.held.unattended": "A webhook or another bot started this turn, so Approve for me is paused and every action asks.",
+  "approval.held.unattendedFullAccess": "A webhook or another bot started this turn, so Approve for me is paused and every action asks. Full access keeps working unattended.",
+  "approval.held.destructive": "This looks destructive, so Approve for me stopped to ask.",
+  "approval.held.sensitive": "This touches credentials, so Approve for me stopped to ask.",
+  "approval.held.needsYou": "This action needs you, so Approve for me stopped to ask.",
+  "approval.held.undeliveredFull": "Full access couldn't deliver this approval.",
+  "approval.held.undelivered": "Approve for me couldn't answer this one."
+};
+function approvalHeldNote(context) {
+  if (context.source === "native-approval") return "approval.held.native";
   if (!context.permission) return void 0;
-  if (context.requiresExplicitApproval) {
-    return "This changes the provider sandbox, so only Full access can approve it automatically.";
-  }
-  if (context.source === "local-computer-block") {
-    return "Controlling your computer is never covered by Always allow, so this needs you.";
-  }
+  if (context.requiresExplicitApproval) return "approval.held.sandbox";
+  if (context.source === "local-computer-block") return "approval.held.localComputer";
   if (context.mode !== "auto") return void 0;
   if (context.unattended) {
-    const hint = context.fullAccessAvailable ? " Full access keeps working unattended." : "";
-    return `A webhook or another bot started this turn, so Approve for me is paused and every action asks.${hint}`;
+    return context.fullAccessAvailable ? "approval.held.unattendedFullAccess" : "approval.held.unattended";
   }
-  if (context.source === "destructive-guard") return "This looks destructive, so Approve for me stopped to ask.";
-  if (context.source === "sensitive-guard") return "This touches credentials, so Approve for me stopped to ask.";
-  return "This action needs you, so Approve for me stopped to ask.";
+  if (context.source === "destructive-guard") return "approval.held.destructive";
+  if (context.source === "sensitive-guard") return "approval.held.sensitive";
+  return "approval.held.needsYou";
 }
 
 // server/schema.ts
@@ -59052,17 +59063,21 @@ bus.subscribe((event) => {
       const permission = event.requestType === "permission";
       const asker = bot ?? (speaker ? store.bot(speaker.botId) : void 0);
       const unattended = permission && asker && event.requestId ? isUnattended(asker.id) : false;
+      const effectiveApprovalMode = asker ? approvalModeForTurn(asker, isInternalTurn(event.threadId)) : "ask";
       const verdict = permission && asker && event.requestId ? autoVerdict({
         // the same origin the dispatch used, so a peer-started turn's
         // residual asks are judged as Approve for me here too
-        approvalMode: approvalModeForTurn(asker, isInternalTurn(event.threadId)),
+        approvalMode: effectiveApprovalMode,
         autoApprove: false,
         alwaysAllow: asker.alwaysAllow
       }, event.tool, event.summary, {
         unattended,
         scope: event.approvalScope,
         requiresExplicitApproval: event.requiresExplicitApproval,
-        nativeApproval: requiresNativeApproval(event.provider, approvalModeForTurn(asker))
+        // Antigravity's residual asks must use a peer-started turn's
+        // effective safe Auto mode, not its durable Full grant.
+        // Preserve the existing policy of every other provider.
+        nativeApproval: requiresNativeApproval(event.provider, event.provider === "antigravityAgent" ? effectiveApprovalMode : approvalModeForTurn(asker))
       }) : null;
       if (verdict?.approve && asker && event.requestId) {
         const settled = verdict.approve;
@@ -59105,7 +59120,8 @@ bus.subscribe((event) => {
                   scope: event.approvalScope,
                   requiresExplicitApproval: event.requiresExplicitApproval
                 }),
-                held: verdict.source === "full-access" ? "Full access couldn't deliver this approval." : "Approve for me couldn't answer this one.",
+                held: HELD_NOTE[verdict.source === "full-access" ? "approval.held.undeliveredFull" : "approval.held.undelivered"],
+                heldCode: verdict.source === "full-access" ? "approval.held.undeliveredFull" : "approval.held.undelivered",
                 approvalScope: event.approvalScope
               }
             });
@@ -59125,6 +59141,14 @@ bus.subscribe((event) => {
         })();
         break;
       }
+      const heldContext = {
+        source: verdict?.source,
+        permission,
+        requiresExplicitApproval: event.requiresExplicitApproval,
+        mode: asker ? approvalModeForOrigin(approvalModeFor(asker), { peerInitiated: isInternalTurn(event.threadId) }) : "ask",
+        unattended: Boolean(unattended),
+        fullAccessAvailable: asker && !isInternalTurn(event.threadId) ? supportsApprovalMode(registry2.cliTarget(asker.modelSelection.instanceId)?.driverKind, "full") : false
+      };
       const message3 = pushMessage({
         role: "bot",
         kind: "options",
@@ -59141,16 +59165,10 @@ bus.subscribe((event) => {
             scope: event.approvalScope,
             requiresExplicitApproval: event.requiresExplicitApproval
           }) : void 0,
-          // A card can outlive the bot record that raised it. Without one
-          // there is no mode to explain, but the sandbox note still applies.
-          held: approvalHeldReason({
-            source: verdict?.source,
-            permission,
-            requiresExplicitApproval: event.requiresExplicitApproval,
-            mode: asker ? approvalModeForOrigin(approvalModeFor(asker), { peerInitiated: isInternalTurn(event.threadId) }) : "ask",
-            unattended: Boolean(unattended),
-            fullAccessAvailable: asker && !isInternalTurn(event.threadId) ? supportsApprovalMode(registry2.cliTarget(asker.modelSelection.instanceId)?.driverKind, "full") : false
-          }),
+          // The text stays for cards saved before heldCode existed, and for
+          // clients that do not know the key yet.
+          held: approvalHeldReason(heldContext),
+          heldCode: approvalHeldNote(heldContext),
           approvalScope: event.approvalScope
         }
       });
@@ -64544,7 +64562,7 @@ data: ${JSON.stringify({ kind: "ping" })}
       const existingApprovalMode = approvalModeFor(existing);
       if ((existingApprovalMode === "full" || existingApprovalMode === "custom") && (!supportsApprovalMode(registry2.cliTarget(checked.selection.instanceId)?.driverKind, existingApprovalMode) || registry2.cliTarget(checked.selection.instanceId)?.driverKind !== registry2.cliTarget(existing.modelSelection.instanceId)?.driverKind)) {
         return json3(res, 400, {
-          error: "Changing providers with elevated permissions requires choosing Ask or Auto first"
+          error: "Changing providers with elevated permissions requires choosing Ask first"
         });
       }
       const bot = store.patchBot(existing.id, { modelSelection: checked.selection });
@@ -64727,7 +64745,7 @@ data: ${JSON.stringify({ kind: "ping" })}
       const targetSelection = normalizedSelection ?? existingBot?.modelSelection;
       if ((requestedApprovalMode === "full" || requestedApprovalMode === "custom") && (body.approvalMode !== void 0 || normalizedSelection !== void 0) && (!targetSelection || !supportsApprovalMode(registry2.cliTarget(targetSelection.instanceId)?.driverKind, requestedApprovalMode) || existingBot && normalizedSelection && registry2.cliTarget(normalizedSelection.instanceId)?.driverKind !== registry2.cliTarget(existingBot.modelSelection.instanceId)?.driverKind)) {
         return json3(res, 400, {
-          error: "This provider does not support the selected approval level, or changing providers requires choosing Ask or Auto first"
+          error: "This provider does not support the selected approval level, or changing providers requires choosing Ask first"
         });
       }
       const requiresPrivateApprovalTransition = (requestedApprovalMode === "full" || requestedApprovalMode === "custom") && currentApprovalMode !== requestedApprovalMode || currentApprovalMode === "custom" && requestedApprovalMode !== "custom";

package/dist-server/server/auto-approve.js

@@ -194,31 +194,58 @@ export function autoDecision(bot, tool, summary, context) {
  * delegating between bots, every card looks like this until someone answers.
  * Say that plainly, and name the mode that keeps running. */
 export function approvalHeldReason(context) {
+    const key = approvalHeldNote(context);
+    return key && HELD_NOTE[key];
+}
+/** Every fixed note a held card can show, by catalog key.
+ *
+ * The card is the last thing between a bot and someone's filesystem, so the
+ * one line explaining why it stopped should not be the one line still in
+ * English. The client translates by key and falls back to this text, which
+ * the server keeps sending: cards saved before the key existed still render,
+ * and so do the free-text apply errors that have no key at all.
+ *
+ * The unattended hint is a whole second sentence rather than a suffix. A
+ * translator needs the sentence, not two halves to reassemble. */
+export const HELD_NOTE = {
+    "approval.held.native": "The provider requires your approval for this action.",
+    "approval.held.sandbox": "This changes the provider sandbox, so only Full access can approve it automatically.",
+    "approval.held.localComputer": "Controlling your computer is never covered by Always allow, so this needs you.",
+    "approval.held.unattended": "A webhook or another bot started this turn, so Approve for me is paused and every action asks.",
+    "approval.held.unattendedFullAccess": "A webhook or another bot started this turn, so Approve for me is paused and every action asks. Full access keeps working unattended.",
+    "approval.held.destructive": "This looks destructive, so Approve for me stopped to ask.",
+    "approval.held.sensitive": "This touches credentials, so Approve for me stopped to ask.",
+    "approval.held.needsYou": "This action needs you, so Approve for me stopped to ask.",
+    "approval.held.undeliveredFull": "Full access couldn't deliver this approval.",
+    "approval.held.undelivered": "Approve for me couldn't answer this one.",
+};
+/** Which note, as a key. approvalHeldReason is this plus the English text, so
+ * the branching that decides the note lives in exactly one place. */
+export function approvalHeldNote(context) {
     if (context.source === "native-approval")
-        return "The provider requires your approval for this action.";
+        return "approval.held.native";
     if (!context.permission)
         return undefined;
-    if (context.requiresExplicitApproval) {
-        return "This changes the provider sandbox, so only Full access can approve it automatically.";
-    }
+    if (context.requiresExplicitApproval)
+        return "approval.held.sandbox";
     // Host control reaches this only over a grant that would otherwise have
     // fired, in a mode that explains nothing else. "I pressed Always allow and
     // it asked anyway" is the whole confusion, so answer that and not the mode.
-    if (context.source === "local-computer-block") {
-        return "Controlling your computer is never covered by Always allow, so this needs you.";
-    }
+    if (context.source === "local-computer-block")
+        return "approval.held.localComputer";
     if (context.mode !== "auto")
         return undefined;
     if (context.unattended) {
-        const hint = context.fullAccessAvailable ? " Full access keeps working unattended." : "";
-        return `A webhook or another bot started this turn, so Approve for me is paused and every action asks.${hint}`;
+        return context.fullAccessAvailable
+            ? "approval.held.unattendedFullAccess"
+            : "approval.held.unattended";
     }
     // A guard names itself. Both stop the same mode, but one is about damage
     // and the other about secrets, and a read-only .env card that says
     // "destructive" teaches people to stop reading these.
     if (context.source === "destructive-guard")
-        return "This looks destructive, so Approve for me stopped to ask.";
+        return "approval.held.destructive";
     if (context.source === "sensitive-guard")
-        return "This touches credentials, so Approve for me stopped to ask.";
-    return "This action needs you, so Approve for me stopped to ask.";
+        return "approval.held.sensitive";
+    return "approval.held.needsYou";
 }

package/dist-server/server/index.js

@@ -11,7 +11,7 @@ import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
 import { approvalModeFor, supportsApprovalMode, requiresNativeApproval, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isReusableCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldReason, approvalModeForOrigin, autoVerdict, rememberableApprovalKey } from "./auto-approve.js";
+import { HELD_NOTE, approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, rememberableApprovalKey } from "./auto-approve.js";
 import { requestReview, resolveAutoReviewMode, shouldReview } from "./auto-review.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrowserCleanupAcknowledged, } from "./browser-lifecycle-cleanup.js";
@@ -2467,18 +2467,23 @@ bus.subscribe((event) => {
             // the guards in auto-approve.ts; explicitly acknowledged Full does not.
             const asker = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
             const unattended = permission && asker && event.requestId ? isUnattended(asker.id) : false;
+            const effectiveApprovalMode = asker ? approvalModeForTurn(asker, isInternalTurn(event.threadId)) : "ask";
             const verdict = permission && asker && event.requestId
                 ? autoVerdict({
                     // the same origin the dispatch used, so a peer-started turn's
                     // residual asks are judged as Approve for me here too
-                    approvalMode: approvalModeForTurn(asker, isInternalTurn(event.threadId)),
+                    approvalMode: effectiveApprovalMode,
                     autoApprove: false,
                     alwaysAllow: asker.alwaysAllow,
                 }, event.tool, event.summary, {
                     unattended,
                     scope: event.approvalScope,
                     requiresExplicitApproval: event.requiresExplicitApproval,
-                    nativeApproval: requiresNativeApproval(event.provider, approvalModeForTurn(asker)),
+                    // Antigravity's residual asks must use a peer-started turn's
+                    // effective safe Auto mode, not its durable Full grant.
+                    // Preserve the existing policy of every other provider.
+                    nativeApproval: requiresNativeApproval(event.provider, event.provider === "antigravityAgent"
+                        ? effectiveApprovalMode : approvalModeForTurn(asker)),
                 })
                 : null;
             if (verdict?.approve && asker && event.requestId) {
@@ -2536,9 +2541,12 @@ bus.subscribe((event) => {
                                     scope: event.approvalScope,
                                     requiresExplicitApproval: event.requiresExplicitApproval,
                                 }),
-                                held: verdict.source === "full-access"
-                                    ? "Full access couldn't deliver this approval."
-                                    : "Approve for me couldn't answer this one.",
+                                held: HELD_NOTE[verdict.source === "full-access"
+                                    ? "approval.held.undeliveredFull"
+                                    : "approval.held.undelivered"],
+                                heldCode: verdict.source === "full-access"
+                                    ? "approval.held.undeliveredFull"
+                                    : "approval.held.undelivered",
                                 approvalScope: event.approvalScope,
                             },
                         });
@@ -2558,6 +2566,18 @@ bus.subscribe((event) => {
                 })();
                 break;
             }
+            // A card can outlive the bot record that raised it. Without one there is
+            // no mode to explain, but the sandbox note still applies.
+            const heldContext = {
+                source: verdict?.source,
+                permission,
+                requiresExplicitApproval: event.requiresExplicitApproval,
+                mode: asker ? approvalModeForOrigin(approvalModeFor(asker), { peerInitiated: isInternalTurn(event.threadId) }) : "ask",
+                unattended: Boolean(unattended),
+                fullAccessAvailable: asker && !isInternalTurn(event.threadId)
+                    ? supportsApprovalMode(registry.cliTarget(asker.modelSelection.instanceId)?.driverKind, "full")
+                    : false,
+            };
             const message = pushMessage({
                 role: "bot",
                 kind: "options",
@@ -2580,18 +2600,10 @@ bus.subscribe((event) => {
                             requiresExplicitApproval: event.requiresExplicitApproval,
                         })
                         : undefined,
-                    // A card can outlive the bot record that raised it. Without one
-                    // there is no mode to explain, but the sandbox note still applies.
-                    held: approvalHeldReason({
-                        source: verdict?.source,
-                        permission,
-                        requiresExplicitApproval: event.requiresExplicitApproval,
-                        mode: asker ? approvalModeForOrigin(approvalModeFor(asker), { peerInitiated: isInternalTurn(event.threadId) }) : "ask",
-                        unattended: Boolean(unattended),
-                        fullAccessAvailable: asker && !isInternalTurn(event.threadId)
-                            ? supportsApprovalMode(registry.cliTarget(asker.modelSelection.instanceId)?.driverKind, "full")
-                            : false,
-                    }),
+                    // The text stays for cards saved before heldCode existed, and for
+                    // clients that do not know the key yet.
+                    held: approvalHeldReason(heldContext),
+                    heldCode: approvalHeldNote(heldContext),
                     approvalScope: event.approvalScope,
                 },
             });
@@ -9395,7 +9407,7 @@ const handleRequest = async (req, res) => {
                 (!supportsApprovalMode(registry.cliTarget(checked.selection.instanceId)?.driverKind, existingApprovalMode) ||
                     registry.cliTarget(checked.selection.instanceId)?.driverKind !== registry.cliTarget(existing.modelSelection.instanceId)?.driverKind)) {
                 return json(res, 400, {
-                    error: "Changing providers with elevated permissions requires choosing Ask or Auto first",
+                    error: "Changing providers with elevated permissions requires choosing Ask first",
                 });
             }
             // patchBot persists first and emits the canonical bot change, which the
@@ -9647,7 +9659,7 @@ const handleRequest = async (req, res) => {
                 (!targetSelection || !supportsApprovalMode(registry.cliTarget(targetSelection.instanceId)?.driverKind, requestedApprovalMode) ||
                     (existingBot && normalizedSelection && registry.cliTarget(normalizedSelection.instanceId)?.driverKind !== registry.cliTarget(existingBot.modelSelection.instanceId)?.driverKind))) {
                 return json(res, 400, {
-                    error: "This provider does not support the selected approval level, or changing providers requires choosing Ask or Auto first",
+                    error: "This provider does not support the selected approval level, or changing providers requires choosing Ask first",
                 });
             }
             const requiresPrivateApprovalTransition = ((requestedApprovalMode === "full" || requestedApprovalMode === "custom") &&

package/dist-server/shared/approval-mode.js

@@ -13,9 +13,10 @@ export function hasNativeAutoReview(driverKind) {
 }
 /** A native reviewer has already declined to decide, or Auto has no native
  * equivalent. Never second-guess that request with the app's heuristic rules.
- * OpenCode's Full mode is implemented by approving individual ACP requests. */
+ * Antigravity and OpenCode Full approve residual ACP tool-permission requests
+ * through the app's explicit Full-access grant. Questions remain interactive. */
 export function requiresNativeApproval(driverKind, mode) {
-    return mode === "auto" || (mode === "full" && ["claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent"].includes(driverKind));
+    return mode === "auto" || (mode === "full" && ["claudeAgent", "cursorAgent", "grokAgent"].includes(driverKind));
 }
 export function isApprovalMode(value) {
     return typeof value === "string" && APPROVAL_MODES.includes(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",