openmausbot 0.1.65 → 0.1.67

package/dist-server/server/local-computer-proxy.js

@@ -0,0 +1,28 @@
+// Near-side gate for the host CUA process. The descriptor and turn token
+// travel in environment variables, never command-line arguments or logs.
+import { runMcpBridge } from "./mcp-bridge.js";
+import { augmentedPath } from "./env-path.js";
+const { OMB_CUA_COMMAND: command, OMB_CUA_ARGS: encodedArgs, OMB_CONTROL_URL: url, OMB_CONTROL_TOKEN: token, ...childEnv } = process.env;
+let args;
+try {
+    const parsed = JSON.parse(encodedArgs ?? "");
+    const endpoint = new URL(url ?? "");
+    if (!command?.trim() || command.includes("\0") ||
+        !Array.isArray(parsed) || !parsed.every((arg) => typeof arg === "string" && !arg.includes("\0")) ||
+        !token || !["http:", "https:"].includes(endpoint.protocol) ||
+        !["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname) || endpoint.username || endpoint.password) {
+        throw new Error("invalid connection");
+    }
+    args = parsed;
+}
+catch {
+    process.stderr.write("invalid local computer proxy connection\n");
+    process.exit(2);
+}
+runMcpBridge({
+    command: command,
+    args,
+    env: { ...childEnv, PATH: augmentedPath() },
+    label: "Local Cua Driver",
+    gate: { url: url, token: token },
+});

package/dist-server/server/local-computer.js

@@ -1,6 +1,7 @@
 import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join } from "node:path";
+import { SPAWNED_PROXIES } from "./proxy-paths.js";
 export const REQUIRED_LINUX_TOOLS = ["click", "get_window_state", "list_apps", "type_text"];
 // Keep this exact field set synchronized with DRIVER_FILE_IDENTITY_KEYS in
 // electron/cua-linux.cjs; Electron publishes it and the server revalidates it.
@@ -14,6 +15,22 @@ export const DRIVER_FILE_IDENTITY_KEYS = [
     "mtimeNs",
     "ctimeNs",
 ];
+/** Keep the platform descriptor intact, but acquire computer authority only
+ * when the first actual tool call reaches the shared stdio gate. */
+export function gatedLocalComputer(connection, control) {
+    return {
+        ...connection,
+        command: process.execPath,
+        args: ["--experimental-strip-types", SPAWNED_PROXIES.localComputer],
+        env: {
+            ...connection.env,
+            OMB_CUA_COMMAND: connection.command,
+            OMB_CUA_ARGS: JSON.stringify(connection.args),
+            OMB_CONTROL_URL: control.url,
+            OMB_CONTROL_TOKEN: control.token,
+        },
+    };
+}
 function exactKeys(value, keys) {
     const expected = new Set(keys);
     return Object.keys(value).length === expected.size && Object.keys(value).every((key) => expected.has(key));

package/dist-server/server/mcp-bridge.js

@@ -1,5 +1,4 @@
-// The one stdio bridge behind both MCP entry points
-// (container-mcp.ts for the Local VM, vps-container-mcp.ts for the BYO VPS).
+// The shared stdio bridge for the host computer, Local VM, and BYO VPS.
 //
 // It is almost transparent — bytes in, bytes out — with two deliberate
 // near-side exceptions:
@@ -152,7 +151,7 @@ export function createGateInterceptor(options) {
                 options.forward(line);
                 return;
             }
-            const held = await options.isHeld().catch(() => false);
+            const held = await options.isHeld().catch(() => true);
             if (!held) {
                 options.forward(line);
                 return;
@@ -160,9 +159,10 @@ export function createGateInterceptor(options) {
             options.refuse(JSON.stringify({
                 jsonrpc: "2.0",
                 id: frame.id ?? null,
-                result: { content: [{ type: "text", text: refusalText }], isError: true },
+                result: { content: [{ type: "text", text: options.getRefusalReason?.() ?? refusalText }], isError: true },
             }));
         });
+        return queue;
     };
 }
 /** The near-side MCP method filter. `ping` is answered here so the bundled
@@ -175,8 +175,9 @@ export function createMcpBridgeInterceptor(options) {
             forward: options.forward,
             refuse: options.answer,
             refusalText: options.gate.refusalText,
+            getRefusalReason: options.gate.getRefusalReason,
         })
-        : options.forward;
+        : (line) => { options.forward(line); };
     return (line) => {
         let frame = null;
         try {
@@ -192,13 +193,13 @@ export function createMcpBridgeInterceptor(options) {
             }
             return;
         }
-        afterPing(line);
+        return afterPing(line);
     };
 }
 export function runMcpBridge(options) {
     const child = spawn(options.command, options.args, {
         shell: false,
-        env: { ...process.env, PATH: augmentedPath() },
+        env: options.env ?? { ...process.env, PATH: augmentedPath() },
         stdio: ["pipe", "pipe", "pipe"],
     });
     // docker may exit before it drains stdin; pipe() leaves this error unhandled.
@@ -207,24 +208,39 @@ export function runMcpBridge(options) {
     const client = options.gate
         ? createControlClient({ url: options.gate.url, token: options.gate.token })
         : null;
+    let refusalReason;
     const answer = (line) => process.stdout.write(line + "\n");
     const forward = (line) => child.stdin.write(line + "\n");
-    const inbound = createLineSplitter(createMcpBridgeInterceptor({
+    const intercept = createMcpBridgeInterceptor({
         answer,
         forward,
         ...(options.gate
             ? {
                 gate: {
-                    isHeld: async () => (await client.state(true)).held,
+                    isHeld: async () => {
+                        refusalReason = undefined;
+                        const state = await client.state(true);
+                        refusalReason = state.blockedReason;
+                        return state.held;
+                    },
+                    getRefusalReason: () => refusalReason,
                 },
             }
             : {}),
-    }));
+    });
+    let pendingInput = Promise.resolve();
+    const inbound = createLineSplitter((line) => {
+        const completion = intercept(line);
+        if (completion)
+            pendingInput = completion;
+    });
     const onStdin = (chunk) => inbound.push(chunk);
     process.stdin.on("data", onStdin);
     process.stdin.on("end", () => {
         inbound.flush();
-        child.stdin.end();
+        // A final tools/call can still be awaiting the control endpoint. Do not
+        // close the far end before the serialized gate has forwarded it.
+        void pendingInput.finally(() => child.stdin.end());
     });
     // Injected responses and refusals must never land inside one of the
     // child's half-written frames, so the child's stdout is re-emitted at

package/dist-server/server/peer-approval.js

@@ -31,9 +31,17 @@ function settleCard(pending, behavior, source) {
     });
     // answered (by whoever): the turn is working again — the same hand-back
     // the request.resolved fold does for a provider's card
-    const waiting = pending.bus.store.bot(pending.fromBotId);
-    if (waiting?.activity === "waiting-on-you")
-        pending.bus.store.setActivity(waiting.id, "working");
+    const store = pending.bus.store;
+    const task = store.projectBotForTask(pending.fromBotId, pending.threadId);
+    if (task) {
+        if (task.activity === "waiting-on-you")
+            store.setTaskActivity(task.id, pending.threadId, "working");
+    }
+    else if (store.groupByThread(pending.threadId)) {
+        const waiting = store.bot(pending.fromBotId);
+        if (waiting?.activity === "waiting-on-you")
+            store.setActivity(waiting.id, "working");
+    }
 }
 /** requestId → pending ask. Lives only in memory — restarting the
  * server cancels every in-flight approval, like provider permissions do. */
@@ -79,10 +87,15 @@ function pushApprovalCard(bus, from, target, message, action, requestId, sourceT
 function announceCard(bus, from, card, sourceThreadId) {
     // the bot is not working now — it is waiting on a person. A delegation
     // drained after its turn has already settled is idle, and stays so.
-    const live = bus.store.bot(from.id);
-    if (live?.busy)
-        bus.store.setActivity(from.id, "waiting-on-you");
+    const task = bus.store.projectBotForTask(from.id, sourceThreadId);
     const room = bus.store.groupByThread(sourceThreadId);
+    if (task) {
+        if (task.busy)
+            bus.store.setTaskActivity(from.id, sourceThreadId, "waiting-on-you");
+    }
+    else if (room && bus.store.bot(from.id)?.busy) {
+        bus.store.setActivity(from.id, "waiting-on-you");
+    }
     const group = room && !room.dm ? { id: room.id, name: room.name } : undefined;
     const title = card.card?.title ?? "";
     const detail = card.card?.subtitle ? `${title} — ${card.card.subtitle}` : title;

package/dist-server/server/provider-auth-sessions.js

@@ -108,4 +108,11 @@ export class ProviderAuthSessions {
         // Called when disposing the provider fleet, which owns child teardown.
         this.flows.clear();
     }
+    clearInstance(instanceId) {
+        const flow = this.flows.get(instanceId);
+        if (flow)
+            flow.revoked = true;
+        this.flows.delete(instanceId);
+        // The registry's per-instance disposal owns child teardown.
+    }
 }

package/dist-server/server/proxy-paths.js

@@ -31,7 +31,9 @@ export function resolveProxy(relative) {
  * the smoke test can assert each one actually exists in a packaged layout —
  * the check that would have caught the 0.1.24 breakage. */
 export const SPAWNED_PROXIES = {
+    browser: resolveProxy("browser-proxy"),
     computer: resolveProxy("computer-proxy"),
+    localComputer: resolveProxy("local-computer-proxy"),
     permission: resolveProxy("permission-proxy"),
     containerMcp: resolveProxy("container-mcp"),
     vpsContainerMcp: resolveProxy("vps-container-mcp"),

package/dist-server/server/sessions.js

@@ -66,6 +66,9 @@ const sessionSchema = z.object({
     createdAt: z.number(),
     lastSeenAt: z.number(),
     expiresAt: z.number(),
+    /** Set when the session came from an account sign-in rather than a code. */
+    userId: z.string().max(256).optional(),
+    email: z.string().max(320).optional(),
 });
 const fileSchema = z.object({ version: z.literal(1), sessions: z.array(sessionSchema) });
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
@@ -102,7 +105,7 @@ export function formatPairingCode(code) {
     return code.match(/.{1,4}/g)?.join("-") ?? code;
 }
 function publicSession(record) {
-    return {
+    const view = {
         id: record.id,
         label: record.label,
         scopes: [...record.scopes],
@@ -110,6 +113,9 @@ function publicSession(record) {
         lastSeenAt: record.lastSeenAt,
         expiresAt: record.expiresAt,
     };
+    if (record.email)
+        view.email = record.email;
+    return view;
 }
 export class SessionRegistry {
     sessions = [];
@@ -284,6 +290,41 @@ export class SessionRegistry {
             this.replays.push({ codeHash: presented, attemptId, result, expiresAt: now + EXCHANGE_REPLAY_MS });
         return result;
     }
+    /** A session from a verified account sign-in (server/account-signin.ts)
+     * rather than a pairing code: same token, same term, same gates. */
+    issue(input) {
+        this.prune();
+        const now = this.now();
+        const token = `omb_sess_${randomBytes(32).toString("base64url")}`;
+        const record = {
+            id: randomUUID(),
+            tokenHash: sha256(token),
+            label: (input.label.trim() || "Unnamed device").slice(0, 80),
+            scopes: [...new Set(input.scopes)],
+            createdAt: now,
+            lastSeenAt: now,
+            expiresAt: now + Math.min(SESSION_TTL_MS, SESSION_MAX_AGE_MS),
+        };
+        if (input.userId)
+            record.userId = input.userId;
+        if (input.email)
+            record.email = input.email;
+        this.sessions.push(record);
+        this.lastSeenWrites.set(record.id, now);
+        this.persist();
+        return { token, session: publicSession(record) };
+    }
+    /** The pairing lockout, for other code-like exchanges on the same source. */
+    attemptAllowed(source) {
+        const lock = this.lockState(source);
+        return lock.locked ? { ok: false, retryAfterMs: lock.retryAfterMs } : { ok: true };
+    }
+    noteFailure(source) {
+        this.recordFailure(source);
+    }
+    clearFailures(source) {
+        this.failures.delete(source);
+    }
     // ── sessions ───────────────────────────────────────────────────────────
     authenticate(token) {
         if (!token)

package/dist-server/server/steer-queue.js

@@ -36,24 +36,26 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
     queues.set(threadId, entry);
     return { id };
 }
-/** Drain every queue whose bot is idle: append the held lines (leaf is now
+/** Drain every queue whose task is idle: append the held lines (leaf is now
  * the finished turn's last item), then one run per thread whose prompt is
  * the texts separated by a blank line. `userMessage` is the last appended line
  * so startTurn does not duplicate it; `excludeIds` is every drained line
  * so transcript-replay adapters do not also see earlier queued texts.
  * Entries leave the map BEFORE running so a settle racing another settle
  * can never fire the same queue twice. */
-export function drainSteeredMessages(store, run) {
+export function drainSteeredMessages(store, run, isBlocked) {
     // deleting only the entry being visited is safe under Map iteration
     for (const [threadId, entry] of queues) {
-        const bot = store.bot(entry.botId);
+        const bot = store.projectBotForTask
+            ? store.projectBotForTask(entry.botId, threadId)
+            : store.bot(entry.botId);
         if (!bot) {
-            // the bot was deleted while messages waited — nothing left to steer
+            // the bot or task was deleted while messages waited
             queues.delete(threadId);
             continue;
         }
-        if (bot.busy)
-            continue; // still working — the next settle tries again
+        if (bot.busy || isBlocked?.(entry.botId, threadId))
+            continue;
         // committed to draining: the entry leaves the map before anything runs,
         // so a settle racing another settle can never fire the same queue twice
         queues.delete(threadId);
@@ -93,9 +95,9 @@ export function queuedSteeredMessage(botId, threadId, sendId) {
  * is stable even if the bot switches away from the task while the request is
  * in flight. Returns false when it was already drained, belongs to another
  * bot, or a restart lost the in-memory auto-run intent. */
-export function cancelSteeredMessage(botId, messageId) {
+export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
     for (const [threadId, entry] of queues) {
-        if (entry.botId !== botId)
+        if (entry.botId !== botId || (expectedThreadId !== undefined && threadId !== expectedThreadId))
             continue;
         const items = entry.items.filter((item) => item.messageId !== messageId);
         if (items.length === entry.items.length)