openmausbot 0.1.69 → 0.1.71

package/dist-server/server/local-computer.js

@@ -273,7 +273,7 @@ export function readCuaConnection({ platform = process.platform, userData = proc
             candidates.push(join(home, "Library", "Application Support", directory, "cua-connection.json"));
         }
     }
-    for (const file of [...new Set(candidates)]) {
+    for (const file of new Set(candidates)) {
         try {
             const raw = JSON.parse(readFileSync(file, "utf8"));
             if (platform === "linux") {

package/dist-server/server/mcp-gate-config.js

@@ -0,0 +1,56 @@
+// Turning a bot's own MCP server into a gated one.
+//
+// Shared by every driver that mounts external MCP servers, so the rule about
+// what a tool may put into a model's context is written once. The gate itself
+// is mcp-gate.ts; the policy it applies is mcp-trim.ts.
+import { join } from "node:path";
+import { DATA_DIR } from "./config.js";
+import { DEFAULT_RESULT_BUDGET } from "./mcp-trim.js";
+import { SPAWNED_PROXIES } from "./proxy-paths.js";
+/** Characters of a single tool result allowed into context, or 0 to mount
+ * bot servers directly as before. `OMB_MCP_RESULT_BUDGET=0` is the escape
+ * hatch for a bot that genuinely needs whole payloads in the conversation. */
+export function resultBudget(env = process.env) {
+    const raw = env.OMB_MCP_RESULT_BUDGET;
+    if (raw === undefined || raw === "")
+        return DEFAULT_RESULT_BUDGET;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed >= 0 ? Math.floor(parsed) : DEFAULT_RESULT_BUDGET;
+}
+/** Where a thread's oversized results are kept so the bot can read them back.
+ * Under the app's data directory, not the user's project folder: these are
+ * the harness's spill, and it sweeps them after a day. */
+export function spillDir(threadId) {
+    return join(DATA_DIR, "tool-results", threadId.replace(/[^A-Za-z0-9_-]/g, "-").slice(0, 80) || "thread");
+}
+/** The gated form of one bot-owned server, or null to mount it unchanged.
+ *
+ * Only a stdio server can be gated: the gate stands between two processes,
+ * and there is no process to stand between for an http/sse entry. Those are
+ * mounted as they were — a known gap, not a silent one.
+ *
+ * The upstream spec travels in the gate's `env`, which means it travels inside
+ * the same 0600 MCP config file the driver already writes for exactly this
+ * reason: a server's credentials must never reach argv, where `ps` shows them
+ * to every process on the machine. */
+export function gateServer(input) {
+    const { name, server, budget } = input;
+    if (budget <= 0)
+        return null;
+    if (!server || typeof server !== "object" || Array.isArray(server))
+        return null;
+    const spec = server;
+    if (typeof spec.command !== "string" || !spec.command)
+        return null;
+    return {
+        command: input.execPath ?? process.execPath,
+        args: [SPAWNED_PROXIES.mcpGate],
+        env: {
+            ...input.nodeEnv,
+            OMB_GATE_NAME: name,
+            OMB_GATE_UPSTREAM: JSON.stringify({ command: spec.command, args: spec.args ?? [], env: spec.env ?? {} }),
+            OMB_GATE_SPILL_DIR: spillDir(input.threadId),
+            OMB_GATE_BUDGET: String(budget),
+        },
+    };
+}

package/dist-server/server/mcp-gate.js

@@ -0,0 +1,227 @@
+// A pass-through MCP server that keeps one tool result from eating a
+// conversation.
+//
+// The provider CLI mounts this instead of the bot's real MCP server. Every
+// JSON-RPC frame is relayed in both directions untouched, except the response
+// to a `tools/call`: an oversized result is cut to a budget (mcp-trim.ts), the
+// untrimmed text is written to a file, and the model is told in the result
+// where that file is so it can read or grep the rest with its ordinary tools.
+//
+// Why here and not in the driver: on every vendor-CLI engine the tool call and
+// its result never pass through the harness at all. The CLI runs the server
+// itself and appends the raw answer to the session it owns. Standing between
+// the two processes is the only place the harness can see, or shrink, what a
+// tool puts into the model's context.
+//
+// stdout is the MCP transport. Never log there.
+import { spawn } from "node:child_process";
+import { mkdirSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import { resolveCliSpawn } from "./env-path.js";
+import { DEFAULT_RESULT_BUDGET, trimResultText, trimStructured } from "./mcp-trim.js";
+import { killCliTree } from "./procs.js";
+const NAME = process.env.OMB_GATE_NAME || "mcp";
+const SPILL_DIR = process.env.OMB_GATE_SPILL_DIR || "";
+const BUDGET = Number(process.env.OMB_GATE_BUDGET) > 0 ? Number(process.env.OMB_GATE_BUDGET) : DEFAULT_RESULT_BUDGET;
+/** Spilled results older than this are swept at startup: they exist for the
+ * turn that produced them, not forever. */
+const SPILL_MAX_AGE_MS = 24 * 60 * 60_000;
+/** Whether the model is told where the untrimmed result was saved. Off by
+ * default: offering the path measured WORSE than no trimming, because the
+ * model reads the file back in. See TrimInput.spillHint. */
+const SPILL_HINT = process.env.OMB_GATE_SPILL_HINT === "1";
+/** The gate's own settings never reach the upstream server's environment. */
+const GATE_ENV_KEYS = ["OMB_GATE_NAME", "OMB_GATE_SPILL_DIR", "OMB_GATE_BUDGET", "OMB_GATE_UPSTREAM", "OMB_GATE_SPILL_HINT"];
+function fail(message) {
+    process.stderr.write(`mcp-gate(${NAME}): ${message}\n`);
+    process.exit(1);
+}
+function upstreamSpec() {
+    let parsed;
+    try {
+        parsed = JSON.parse(process.env.OMB_GATE_UPSTREAM ?? "");
+    }
+    catch {
+        fail("OMB_GATE_UPSTREAM is not valid JSON");
+    }
+    const spec = parsed;
+    if (!spec || typeof spec !== "object" || typeof spec.command !== "string" || !spec.command) {
+        fail("OMB_GATE_UPSTREAM needs a command");
+    }
+    return spec;
+}
+/** Delete spilled results older than SPILL_MAX_AGE_MS. Best effort: a sweep
+ * that fails must never stop the bot's tools from working. */
+function sweepSpill(dir) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    const cutoff = Date.now() - SPILL_MAX_AGE_MS;
+    for (const entry of entries) {
+        try {
+            const path = join(dir, entry);
+            if (statSync(path).mtimeMs < cutoff)
+                rmSync(path, { force: true });
+        }
+        catch {
+            /* another gate may be sweeping the same directory */
+        }
+    }
+}
+let spilled = 0;
+/** Save the untrimmed text and return its path, or undefined when there is
+ * nowhere to put it — the trim still happens, the model is just told the rest
+ * was discarded rather than where to find it. */
+function spill(tool, text) {
+    if (!SPILL_DIR)
+        return undefined;
+    const safeTool = tool.replace(/[^A-Za-z0-9_.-]/g, "-").slice(0, 60) || "tool";
+    const path = join(SPILL_DIR, `${Date.now()}-${process.pid}-${spilled++}-${safeTool}.json`);
+    try {
+        mkdirSync(SPILL_DIR, { recursive: true, mode: 0o700 });
+        writeFileSync(path, text, { mode: 0o600 });
+        return path;
+    }
+    catch (error) {
+        process.stderr.write(`mcp-gate(${NAME}): could not save the full result: ${String(error)}\n`);
+        return undefined;
+    }
+}
+/** Rewrite one `tools/call` result in place. Returns true when anything was
+ * actually trimmed, so the caller can report it on stderr. */
+function trimCallResult(result, tool) {
+    const content = result.content;
+    if (!Array.isArray(content))
+        return false;
+    // The text blocks are what a provider puts in the model's context, and a
+    // server that answers with several is answering with one payload split up,
+    // so they share the budget rather than each getting it.
+    const textBlocks = content.filter((block) => Boolean(block) && typeof block === "object" && block.type === "text" && typeof block.text === "string");
+    const total = textBlocks.reduce((sum, block) => sum + block.text.length, 0);
+    if (!textBlocks.length || total <= BUDGET)
+        return false;
+    const share = Math.floor(BUDGET / textBlocks.length);
+    const path = spill(tool, textBlocks.map((block) => block.text).join("\n"));
+    let trimmed = false;
+    for (const block of textBlocks) {
+        const outcome = trimResultText({ text: block.text, budget: share, spillPath: path, spillHint: SPILL_HINT, toolName: tool });
+        if (!outcome.trimmed)
+            continue;
+        block.text = outcome.text;
+        trimmed = true;
+    }
+    // A tool that also answers with structuredContent would otherwise hand the
+    // provider a second, full copy of everything just cut. Trim it the same way
+    // — structurally only, so it stays valid against the tool's output schema —
+    // and leave it untouched when it cannot be cut without mangling it.
+    if (trimmed && result.structuredContent && typeof result.structuredContent === "object") {
+        const structured = trimStructured(result.structuredContent, BUDGET);
+        if (structured)
+            result.structuredContent = structured.value;
+    }
+    return trimmed;
+}
+const spec = upstreamSpec();
+if (SPILL_DIR)
+    sweepSpill(SPILL_DIR);
+const childEnv = { ...process.env, ...spec.env };
+for (const key of GATE_ENV_KEYS)
+    delete childEnv[key];
+// The CLI used to spawn this server itself, on every platform, so the gate
+// has to spawn it exactly as well. On Windows CreateProcess cannot exec an
+// npm .cmd shim or a node-shebang script, which is what `npx -y mcp-remote`
+// is — resolveCliSpawn rewrites it to the real executable without a shell, so
+// quoting-sensitive JSON argv survives. A shell here would re-interpret the
+// server's own arguments.
+const resolved = resolveCliSpawn(spec.command, spec.args ?? []);
+const child = spawn(resolved.command, resolved.args, {
+    stdio: ["pipe", "pipe", "pipe"],
+    env: childEnv,
+    shell: false,
+    // a console app spawned from the desktop shell flashes a window otherwise
+    ...(process.platform === "win32" ? { windowsHide: true } : {}),
+});
+// The gate owns this process. If the gate is killed rather than closed —
+// the CLI reaping its MCP servers at the end of a turn — the real server
+// must not be left behind, and on Windows only taskkill /T reaps a tree.
+let reaping = false;
+const reapChild = () => {
+    if (reaping)
+        return;
+    reaping = true;
+    void killCliTree(child);
+};
+process.on("SIGTERM", () => {
+    reapChild();
+    process.exit(0);
+});
+process.on("SIGINT", () => {
+    reapChild();
+    process.exit(0);
+});
+process.on("exit", reapChild);
+child.on("error", (error) => {
+    process.stderr.write(`mcp-gate(${NAME}): could not start ${resolved.command}: ${String(error)}\n`);
+    process.exit(1);
+});
+child.stderr.pipe(process.stderr);
+/** id -> tool name, for the calls whose answers are still in flight. */
+const pending = new Map();
+// client -> server: verbatim, but remember which ids are tool calls
+createInterface({ input: process.stdin }).on("line", (line) => {
+    if (line.trim()) {
+        try {
+            const message = JSON.parse(line);
+            if (message.method === "tools/call" && message.id !== undefined && message.id !== null) {
+                const params = message.params;
+                pending.set(String(message.id), typeof params?.name === "string" ? params.name : "tool");
+            }
+        }
+        catch {
+            /* not our business to validate the client's frames */
+        }
+    }
+    child.stdin.write(`${line}\n`);
+});
+process.stdin.on("end", () => child.stdin.end());
+// server -> client: the one direction that gets rewritten
+createInterface({ input: child.stdout }).on("line", (line) => {
+    if (!line.trim())
+        return;
+    let message;
+    try {
+        message = JSON.parse(line);
+    }
+    catch {
+        // Not JSON the gate understands. Relay it exactly as it came: a frame the
+        // gate cannot read is still the upstream server's answer to give.
+        process.stdout.write(`${line}\n`);
+        return;
+    }
+    const id = message.id === undefined || message.id === null ? undefined : String(message.id);
+    const tool = id === undefined ? undefined : pending.get(id);
+    if (id !== undefined)
+        pending.delete(id);
+    const result = message.result;
+    if (tool && result && typeof result === "object" && !Array.isArray(result)) {
+        try {
+            if (trimCallResult(result, tool)) {
+                process.stderr.write(`mcp-gate(${NAME}): trimmed ${tool} to ${BUDGET} chars\n`);
+            }
+        }
+        catch (error) {
+            // A result the trimmer chokes on is relayed whole. Costing context is
+            // recoverable; dropping a tool answer is not.
+            process.stderr.write(`mcp-gate(${NAME}): could not trim ${tool}: ${String(error)}\n`);
+            process.stdout.write(`${line}\n`);
+            return;
+        }
+    }
+    process.stdout.write(`${JSON.stringify(message)}\n`);
+});
+child.on("exit", (code, signal) => process.exit(code ?? (signal ? 1 : 0)));

package/dist-server/server/mcp-trim.js

@@ -0,0 +1,182 @@
+// How much of one MCP tool result is allowed into a model's context.
+//
+// An MCP server answers for a machine, not for a context window: a single
+// Swiggy product search returns 60-140 KB of JSON, a restaurant menu 70-105 KB.
+// Whatever comes back is appended to the conversation the CLI keeps, and every
+// later model call in that session re-reads it. Four searches in one turn added
+// 67,000 tokens to a food-ordering thread that never needed them again.
+//
+// So the gate keeps a readable prefix and says, in the result itself, exactly
+// what it cut and where the whole thing is. Nothing is lost — the untrimmed
+// text is written to a file the bot can read or grep with its ordinary tools.
+//
+// This module is pure. The process that uses it is mcp-gate.ts.
+/** Characters of a single tool result that may enter the model's context.
+ * ~4 chars per token, so ~2k tokens: enough for a page of results, far below
+ * the 35k-token searches this exists to stop. */
+export const DEFAULT_RESULT_BUDGET = 8_000;
+/** Never cut below this, whatever the budget says: a result so short that it
+ * cannot carry a single record is worse than no trimming at all. */
+const MIN_BUDGET = 512;
+const fmt = (n) => n.toLocaleString("en-US");
+/** JSON.stringify, or null for a value that cannot be serialized (a cycle). */
+function serialize(value) {
+    try {
+        const json = JSON.stringify(value);
+        return typeof json === "string" ? json : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The longest prefix of `items` whose serialized length fits `budget`.
+ * Always returns at least one element when one exists, so a caller can tell
+ * "one huge record" apart from "nothing fit" and fall back accordingly. */
+function fitArray(items, budget) {
+    const kept = [];
+    let used = 2; // the brackets
+    for (const item of items) {
+        const json = serialize(item);
+        if (json === null)
+            break;
+        const cost = json.length + (kept.length ? 1 : 0); // the comma
+        if (kept.length && used + cost > budget)
+            break;
+        kept.push(item);
+        used += cost;
+    }
+    return kept;
+}
+/** Top-level array fields, in declaration order — where an MCP server puts
+ * its bulk. A bare array root is reported as the single field "". */
+function arrayFields(value) {
+    if (Array.isArray(value))
+        return [{ key: "", items: value }];
+    if (!value || typeof value !== "object")
+        return [];
+    return Object.entries(value)
+        .filter((entry) => Array.isArray(entry[1]))
+        .map(([key, items]) => ({ key, items }));
+}
+/** Cut on a character boundary, never mid-surrogate-pair — half an emoji is
+ * an invalid string that some providers reject outright. */
+function cutAt(text, chars) {
+    const cut = text.slice(0, Math.max(0, chars));
+    const last = cut.charCodeAt(cut.length - 1);
+    return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
+}
+function marker(input) {
+    const counts = input.dropped
+        .filter((d) => d.kept < d.total)
+        .map((d) => `${d.key || "items"} ${fmt(d.kept)} of ${fmt(d.total)}`)
+        .join(", ");
+    const what = input.structural
+        ? counts ? ` Kept ${counts}.` : ""
+        : " Cut mid-text, so what is above may be incomplete JSON.";
+    // What a model should do about it: ask the tool a better question. Never
+    // "go and read the whole thing", which costs more than not trimming.
+    const where = input.spillHint && input.spillPath
+        ? ` The whole result is at ${JSON.stringify(input.spillPath)}; reading it costs as much as not trimming, so narrow the call first.`
+        : " If you need more, call the tool again with a narrower query, a filter, or the next page.";
+    return `\n\n[OpenMausBot trimmed this tool result to fit the conversation: ${fmt(input.originalChars)} → ${fmt(input.keptChars)} characters.${what}${where}]`;
+}
+/** The structural cut on its own, for a payload that is already parsed and
+ * must stay valid JSON of the same shape (a tool's `structuredContent`).
+ * Returns null when the bulk arrays cannot be made to fit — a caller holding
+ * a schema-bound value must then leave it alone rather than mangle it. */
+export function trimStructured(parsed, budget) {
+    const room = Math.max(MIN_BUDGET, budget);
+    const current = serialize(parsed);
+    if (current !== null && current.length <= room)
+        return null;
+    const fields = arrayFields(parsed);
+    if (!fields.length)
+        return null;
+    const skeleton = Array.isArray(parsed)
+        ? 2
+        : (serialize({ ...parsed, ...Object.fromEntries(fields.map((f) => [f.key, []])) })?.length ?? Infinity);
+    const share = Math.floor((room - skeleton) / fields.length);
+    if (!Number.isFinite(skeleton) || share <= 0)
+        return null;
+    const dropped = [];
+    let value;
+    if (Array.isArray(parsed)) {
+        const kept = fitArray(parsed, share);
+        dropped.push({ key: "", kept: kept.length, total: parsed.length });
+        value = kept;
+    }
+    else {
+        const next = { ...parsed };
+        for (const field of fields) {
+            const kept = fitArray(field.items, share);
+            dropped.push({ key: field.key, kept: kept.length, total: field.items.length });
+            next[field.key] = kept;
+        }
+        value = next;
+    }
+    if (!dropped.some((d) => d.kept < d.total))
+        return null;
+    const json = serialize(value);
+    return json !== null && json.length <= room ? { value, dropped } : null;
+}
+/** Trim one tool result's text down to the budget, keeping whole records
+ * wherever the payload is JSON so the model is never handed a half-object. */
+export function trimResultText(input) {
+    const { text } = input;
+    const budget = Math.max(MIN_BUDGET, input.budget ?? DEFAULT_RESULT_BUDGET);
+    if (text.length <= budget)
+        return { text, trimmed: false, originalChars: text.length };
+    // Reserve room for the marker so the trimmed result actually lands under
+    // the budget instead of just under it plus an explanation.
+    const room = Math.max(MIN_BUDGET, budget - 400);
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    const fields = parsed === undefined ? [] : arrayFields(parsed);
+    if (fields.length) {
+        // What the payload costs with every bulk array emptied. Anything left is
+        // shared out between those arrays, in order, equally.
+        const skeleton = Array.isArray(parsed)
+            ? 2
+            : (serialize({ ...parsed, ...Object.fromEntries(fields.map((f) => [f.key, []])) })?.length ?? Infinity);
+        const share = Math.floor((room - skeleton) / fields.length);
+        if (Number.isFinite(skeleton) && share > 0) {
+            const dropped = [];
+            let value;
+            if (Array.isArray(parsed)) {
+                const kept = fitArray(parsed, share);
+                dropped.push({ key: "", kept: kept.length, total: parsed.length });
+                value = kept;
+            }
+            else {
+                const next = { ...parsed };
+                for (const field of fields) {
+                    const kept = fitArray(field.items, share);
+                    dropped.push({ key: field.key, kept: kept.length, total: field.items.length });
+                    next[field.key] = kept;
+                }
+                value = next;
+            }
+            const json = serialize(value);
+            // One record can be larger than the whole share; if the structural cut
+            // still overflows, the text cut below is the honest answer.
+            if (json !== null && json.length <= room) {
+                return {
+                    text: json + marker({ originalChars: text.length, keptChars: json.length, dropped, spillPath: input.spillPath, spillHint: input.spillHint, structural: true }),
+                    trimmed: true,
+                    originalChars: text.length,
+                };
+            }
+        }
+    }
+    const cut = cutAt(text, room);
+    return {
+        text: cut + marker({ originalChars: text.length, keptChars: cut.length, dropped: [], spillPath: input.spillPath, spillHint: input.spillHint, structural: false }),
+        trimmed: true,
+        originalChars: text.length,
+    };
+}