openmausbot 0.1.70 → 0.1.71

package/dist-server/proxy-paths.js

@@ -17,6 +17,7 @@ var SPAWNED_PROXIES = {
   agents: resolveProxy("drivers/agents-proxy"),
   dweb: resolveProxy("drivers/dweb-proxy"),
   connectors: resolveProxy("connector-proxy"),
+  mcpGate: resolveProxy("mcp-gate"),
   phone: resolveProxy("drivers/phone-proxy"),
   // Loaded by the external `pi` process via `-e`, not by this server — but
   // resolved through the same single source of truth so the packaged layout

package/dist-server/server/agent-tool-policy.js

@@ -0,0 +1,29 @@
+/** Reviewed local reads exposed by the built-in agents MCP integration.
+ * This exact catalog supplies MCP tool metadata only; names, prefixes, or
+ * third-party annotations alone must never grant read access.
+ * Session recall keeps its own-bot scope and may record a deduplicated access
+ * disclosure in a room; it does not edit recalled messages or launch work.
+ */
+export const READ_ONLY_AGENT_TOOL_NAMES = new Set([
+    "list_bots",
+    "list_rooms",
+    "list_threads",
+    "check_delegation",
+    "wait_delegation",
+    "session_search",
+    "session_read",
+    "list_routines",
+    "skills_list",
+]);
+const READ_ONLY_ANNOTATIONS = Object.freeze({
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+});
+export function isReadOnlyAgentTool(name) {
+    return READ_ONLY_AGENT_TOOL_NAMES.has(name);
+}
+export function agentToolAnnotations(name) {
+    return isReadOnlyAgentTool(name) ? READ_ONLY_ANNOTATIONS : undefined;
+}

package/dist-server/server/bot-package.js

@@ -1,10 +1,14 @@
 import { z } from "zod";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { schemaIssue } from "./schema.js";
+import { isSkillName, parseSkillMd, SKILL_FILE_MAX_BYTES } from "./skills.js";
 import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
 export const BOT_PACKAGE_FORMAT = "openmaus.package";
 export const BOT_PACKAGE_VERSION = 1;
 export const BOTMRR_MARKDOWN_VERSION = 1;
+export const BOT_PACKAGE_SKILLS_VERSION = 1;
+export const BOT_PACKAGE_MAX_SKILLS = 20;
+const BOT_PACKAGE_MARKDOWN_MAX_BYTES = 1_000_000;
 const COLORS = [
     "green",
     "blue",
@@ -27,6 +31,24 @@ const key = requiredText(64).regex(/^[a-z0-9][a-z0-9_-]*$/, {
     message: "may only contain lowercase letters, numbers, - and _",
 });
 const MAX_DATE_MS = 8_640_000_000_000_000;
+const skillName = requiredText(64).refine(isSkillName, {
+    message: "must be a lowercase skill name",
+});
+const portableSource = optionalText(2_000).refine((value) => value === undefined || !/^(?:[a-z]:[\\/]|[\\/]|\\\\|file:)/i.test(value), { message: "must not be an absolute path" });
+const skillInstructions = z
+    .string({ error: "must be text" })
+    .min(1, { message: "is required" })
+    .max(SKILL_FILE_MAX_BYTES, { message: "is too long" })
+    .refine((value) => Buffer.byteLength(value, "utf8") <= SKILL_FILE_MAX_BYTES, { message: "is too large" })
+    .refine((value) => /^---\r?\n/.test(value), { message: "must start with SKILL.md frontmatter" });
+const portableSkillSchema = z.object({
+    name: skillName,
+    description: requiredText(1_024),
+    source: portableSource,
+    license: optionalText(200),
+    compatibility: optionalText(200),
+    instructions: skillInstructions,
+});
 const CLOCK_TIME = /^([01]\d|2[0-3]):[0-5]\d$/;
 const intervalWeekdays = z.array(z.number().int().min(0).max(6)).min(1).max(7).refine((weekdays) => new Set(weekdays).size === weekdays.length, "must contain unique weekdays");
 const intervalWindow = z.object({
@@ -113,6 +135,7 @@ const packageSchema = z.object({
                 mascotBody: optionalText(40),
             }),
             playbooks: z.array(key).max(40).optional(),
+            skills: z.array(skillName).max(BOT_PACKAGE_MAX_SKILLS).optional(),
         })).min(1).max(200),
         chiefOfStaff: key.optional(),
         rooms: z.array(z.object({
@@ -144,6 +167,10 @@ const packageSchema = z.object({
             triggers: z.array(requiredText(100)).min(1).max(30),
             instructions: requiredText(24_000),
         })).max(80).optional(),
+        skills: z.object({
+            version: z.literal(BOT_PACKAGE_SKILLS_VERSION),
+            entries: z.array(portableSkillSchema).min(1).max(BOT_PACKAGE_MAX_SKILLS),
+        }).optional(),
         examples: z.array(z.object({
             title: requiredText(120),
             input: requiredText(4_000),
@@ -158,7 +185,7 @@ export function isBotPackage(value) {
         value.format === BOT_PACKAGE_FORMAT;
 }
 function markdownDocument(markdown) {
-    if (Buffer.byteLength(markdown) > 1_000_000)
+    if (Buffer.byteLength(markdown) > BOT_PACKAGE_MARKDOWN_MAX_BYTES)
         throw new Error("The bot playbook is too large");
     const frontmatter = markdown.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
     if (!frontmatter)
@@ -206,6 +233,7 @@ export function parseBotPackage(value) {
     };
     const agents = unique(pkg.agents.map((agent) => agent.key), "agent");
     const playbooks = unique((pkg.playbooks ?? []).map((playbook) => playbook.key), "playbook");
+    const skills = unique((pkg.skills?.entries ?? []).map((skill) => skill.name), "skill");
     unique((pkg.rooms ?? []).map((room) => room.key), "room");
     unique((pkg.routines ?? []).map((routine) => routine.key), "routine");
     if (pkg.chiefOfStaff && !agents.has(pkg.chiefOfStaff)) {
@@ -216,6 +244,28 @@ export function parseBotPackage(value) {
             if (!playbooks.has(playbook))
                 throw new Error(`Agent ${agent.key} references unknown playbook: ${playbook}`);
         }
+        const assignedSkills = unique(agent.skills ?? [], `skill in agent ${agent.key}`);
+        for (const skill of assignedSkills) {
+            if (!skills.has(skill))
+                throw new Error(`Agent ${agent.key} references unknown skill: ${skill}`);
+        }
+    }
+    const referencedSkills = new Set(pkg.agents.flatMap((agent) => agent.skills ?? []));
+    for (const skill of pkg.skills?.entries ?? []) {
+        const parsed = parseSkillMd(skill.instructions);
+        if ("error" in parsed)
+            throw new Error(`Skill ${skill.name} is invalid: ${parsed.error}`);
+        if (parsed.name !== skill.name)
+            throw new Error(`Skill ${skill.name} does not match its SKILL.md name`);
+        if (parsed.description !== skill.description)
+            throw new Error(`Skill ${skill.name} does not match its description`);
+        for (const field of ["license", "compatibility"]) {
+            if (skill[field] !== undefined && skill[field] !== parsed[field]) {
+                throw new Error(`Skill ${skill.name} does not match its ${field}`);
+            }
+        }
+        if (!referencedSkills.has(skill.name))
+            throw new Error(`Skill ${skill.name} is not referenced by an agent`);
     }
     for (const room of pkg.rooms ?? []) {
         const members = unique(room.members, `member in room ${room.key}`);
@@ -301,7 +351,10 @@ export function renderBotPackageMarkdown(document) {
     const connections = pkg.requirements.apps.length
         ? pkg.requirements.apps.map((app) => `- **${app.label}${app.optional ? " (optional)" : ""}:** ${app.reason}`).join("\n")
         : "- No connected apps are required.";
-    return `---\n${frontmatter}\n---\n\n# ${pkg.name}\n\n${pkg.tagline}\n\n> **Give this file to your Chief of Staff.** It is the complete team blueprint. Any agent system can run it; OpenMausBot can also install it directly.\n\n## Activation\n\nYou are the Chief of Staff for this blueprint. Read the whole document before acting. Confirm the user's goal and any missing inputs, then create or delegate to the specialist roles below. Preserve their names, ownership, boundaries, shared-room rules, and playbooks. If your platform cannot literally spawn agents, perform the roles one at a time and keep their outputs clearly separated.\n\nNever request pasted passwords or secret keys. Use the platform's normal connection flow. Do not send messages, publish content, spend money, delete data, or enable a schedule without the user's explicit approval. All routines start paused.\n\n## Mission\n\n${pkg.summary}\n\n## Outcomes\n\n${list(pkg.outcomes)}\n\n## Connections\n\n${connections}\n\n## Team\n\n${agents}\n\n## Chief of Staff\n\nThe Chief of Staff role is \`${pkg.chiefOfStaff ?? pkg.agents[0].key}\`. This role owns delegation, synthesis, conflict resolution, and the final answer to the user.\n${rooms ? `\n## Shared rooms\n\n${rooms}\n` : ""}${routines ? `\n## Suggested routines\n\n${routines}\n` : ""}${playbooks ? `\n## Playbooks\n\n${playbooks}\n` : ""}${examples ? `\n## Example job\n\n${examples}\n` : ""}\n## Completion rule\n\nReturn one clear result to the user, distinguish evidence from inference, cite source links when the work uses external material, and state what still needs human approval or a connected app.\n`;
+    const markdown = `---\n${frontmatter}\n---\n\n# ${pkg.name}\n\n${pkg.tagline}\n\n> **Give this file to your Chief of Staff.** It is the complete team blueprint. Any agent system can run it; OpenMausBot can also install it directly.\n\n## Activation\n\nYou are the Chief of Staff for this blueprint. Read the whole document before acting. Confirm the user's goal and any missing inputs, then create or delegate to the specialist roles below. Preserve their names, ownership, boundaries, shared-room rules, and playbooks. If your platform cannot literally spawn agents, perform the roles one at a time and keep their outputs clearly separated.\n\nNever request pasted passwords or secret keys. Use the platform's normal connection flow. Do not send messages, publish content, spend money, delete data, or enable a schedule without the user's explicit approval. All routines start paused.\n\n## Mission\n\n${pkg.summary}\n\n## Outcomes\n\n${list(pkg.outcomes)}\n\n## Connections\n\n${connections}\n\n## Team\n\n${agents}\n\n## Chief of Staff\n\nThe Chief of Staff role is \`${pkg.chiefOfStaff ?? pkg.agents[0].key}\`. This role owns delegation, synthesis, conflict resolution, and the final answer to the user.\n${rooms ? `\n## Shared rooms\n\n${rooms}\n` : ""}${routines ? `\n## Suggested routines\n\n${routines}\n` : ""}${playbooks ? `\n## Playbooks\n\n${playbooks}\n` : ""}${examples ? `\n## Example job\n\n${examples}\n` : ""}\n## Completion rule\n\nReturn one clear result to the user, distinguish evidence from inference, cite source links when the work uses external material, and state what still needs human approval or a connected app.\n`;
+    if (Buffer.byteLength(markdown) > BOT_PACKAGE_MARKDOWN_MAX_BYTES)
+        throw new Error("The bot playbook is too large");
+    return markdown;
 }
 export function packageAgentAsMember(agent) {
     return {

package/dist-server/server/browser-live.js

@@ -7,6 +7,9 @@ const execute = promisify(execFile);
 const MAX_FRAME = 3 * 1024 * 1024;
 const MAX_BUFFER = 4 * 1024 * 1024;
 const HEARTBEAT_MS = 10_000;
+// The native press resolver supplies the virtual key codes and Enter/Tab text
+// that its raw input_keyboard relay omits. Keep unknown keys literal.
+const DISCRETE_KEYS = new Set(["Backspace", "Enter", "Tab", "Escape", "Delete", "ArrowUp", "ArrowDown", "ArrowLeft", "ArrowRight", "Home", "End", "PageUp", "PageDown"]);
 export class BrowserLiveError extends Error {
     status;
     constructor(message, status = 400) { super(message); this.name = "BrowserLiveError"; this.status = status; }
@@ -308,17 +311,20 @@ export class BrowserLive {
             throw new BrowserLiveError("The browser stream is not connected.", 409);
         let command;
         const { type, eventType, ...fields } = message;
+        const key = String(fields.code || fields.key);
         const shortcut = Number(fields.modifiers) > 0 && !["Alt", "Control", "Meta", "Shift"].includes(String(fields.key))
             && !(fields.modifiers === 8 && text(fields.key, 64) && [...fields.key].length === 1);
-        if (type === "input_keyboard" && eventType === "keyUp" && shortcut)
-            return; // press already releases the chord.
+        // press already released the key. Match raw held keys, not the modifiers
+        // on keyUp: they may have changed, or blur may flush releases with zero.
+        if (type === "input_keyboard" && eventType === "keyUp" && !viewer.pressedKeys.has(key))
+            return;
         if (type === "input_mouse")
             command = { action: "input_mouse", type: eventType, ...fields };
         else if (eventType === "char")
             command = { action: "keyboard", subaction: "insertText", text: fields.text };
-        else if (eventType === "keyDown" && shortcut) {
-            // The native input_keyboard handler omits CDP modifiers. Its press
-            // action resolves chords and awaits the complete key-down/up pair.
+        else if (eventType === "keyDown" && (shortcut || DISCRETE_KEYS.has(String(fields.key)))) {
+            // press resolves virtual key codes, required text and modifiers, and
+            // acknowledges the complete key-down/up pair before hand-back.
             const modifiers = fields.modifiers;
             const chord = [[1, "Alt"], [2, "Control"], [4, "Meta"], [8, "Shift"]];
             command = { action: "press", key: [...chord.filter(([bit]) => modifiers & bit).map(([, key]) => key), fields.key].join("+") };
@@ -326,7 +332,6 @@ export class BrowserLive {
         else
             command = { action: "input_keyboard", type: eventType, key: fields.key,
                 ...(fields.code === undefined ? {} : { code: fields.code }), ...(fields.text === undefined ? {} : { text: fields.text }) };
-        const key = String(fields.code || fields.key);
         if (command.action === "input_keyboard" && eventType === "keyDown") {
             if (viewer.pressedKeys.size >= 64 && !viewer.pressedKeys.has(key))
                 throw new BrowserLiveError("Too many keys are held. Restart the browser before continuing.", 409);
@@ -354,7 +359,7 @@ export class BrowserLive {
             }
             if (object(JSON.parse(Buffer.concat(chunks).toString("utf8")))?.success !== true)
                 throw new Error("input failed");
-            if (command.action === "input_keyboard" && eventType === "keyUp")
+            if (command.action === "press" || (command.action === "input_keyboard" && eventType === "keyUp"))
                 viewer.pressedKeys.delete(key);
             if (type === "input_mouse" && eventType === "mouseReleased")
                 viewer.pressedButtons.delete(String(fields.button));

package/dist-server/server/config.js

@@ -195,9 +195,13 @@ const browserProfilesSchema = z.array(browserProfileSchema).max(20).superRefine(
         });
     });
 });
+// Deliberately non-strict: an unknown flag (such as `skillRecorder`, the
+// pre-rename name a stale client may still PATCH) is dropped as a no-op
+// instead of failing the whole stored config or the request.
 const featureConfigSchema = z.object({
-    /** Experimental desktop workflow recorder. Hidden unless explicitly enabled. */
-    skillRecorder: z.boolean().optional(),
+    /** Bots may draft skills (skill_manage, /learn) for your review. Off unless
+     * explicitly enabled. */
+    skillAuthoring: z.boolean().optional(),
     /** Show each tool run in the transcript. Off unless explicitly enabled. */
     showToolCalls: z.boolean().optional(),
     /** Experimental built-in browser. Off until explicitly enabled; each bot
@@ -378,8 +382,8 @@ export function localVmMode(cfg) {
 export function localVmMaxInstances(cfg) {
     return cfg.localVm?.maxInstances ?? DEFAULT_LOCAL_VM_MAX_INSTANCES;
 }
-export function skillRecorderEnabled(cfg) {
-    return cfg.features?.skillRecorder === true;
+export function skillAuthoringEnabled(cfg) {
+    return cfg.features?.skillAuthoring === true;
 }
 export function showToolCallsEnabled(cfg) {
     return cfg.features?.showToolCalls === true;
@@ -407,6 +411,38 @@ export function ensureDirs() {
     }
     for (const dir of [DATA_DIR, EVENTS_DIR, NATIVE_DIR])
         mkdirSync(dir, { recursive: true });
+    migrateLegacyFeatureFlags();
+}
+/** `features.skillRecorder` became `features.skillAuthoring` when the Teach a
+ * skill recorder was removed. featureConfigSchema is non-strict, so
+ * parseStoredConfig would silently drop the old key (reading the opt-in as
+ * off) while saveConfig's raw section merge would carry it on disk forever.
+ * Rewrite it once, here, before the server's single loadConfig() at boot: an
+ * explicit `skillAuthoring` already on disk wins over the legacy key, and a
+ * file without the legacy key is left untouched. */
+function migrateLegacyFeatureFlags() {
+    const p = join(DATA_DIR, "config.json");
+    try {
+        if (!existsSync(p))
+            return;
+        const disk = jsonObjectSchema.safeParse(parseJson(readFileSync(p, "utf8")));
+        if (!disk.success)
+            return;
+        const features = jsonObjectSchema.safeParse(disk.data.features);
+        if (!features.success || !Object.hasOwn(features.data, "skillRecorder"))
+            return;
+        const next = { ...features.data };
+        if (!Object.hasOwn(next, "skillAuthoring"))
+            next.skillAuthoring = next.skillRecorder === true;
+        delete next.skillRecorder;
+        writeFileAtomic(p, JSON.stringify({ ...disk.data, features: next }, null, 2), { mode: 0o600 });
+        console.log(`[config] features.skillRecorder renamed to features.skillAuthoring (${String(next.skillAuthoring)})`);
+    }
+    catch (error) {
+        // A readable but unwritable config would otherwise lose the opt-in on
+        // every boot with no trace: parseStoredConfig drops the legacy key.
+        console.error(`[config] could not rename features.skillRecorder: ${error instanceof Error ? error.message : String(error)}`);
+    }
 }
 export function loadConfig() {
     let cfg = {};

package/dist-server/server/drivers/acp/core.js

@@ -35,6 +35,7 @@ import { supportsApprovalMode } from "../../../shared/approval-mode.js";
 // packaged server dir entirely. See server/proxy-paths.ts.
 const COMPUTER_PROXY_PATH = SPAWNED_PROXIES.computer;
 import { appendNative } from "../native.js";
+import { commandSummary } from "../../tool-summary.js";
 import { SPAWNED_PROXIES } from "../../proxy-paths.js";
 const envOr = (key, fallback) => Number(process.env[key] ?? fallback);
 const INIT_TIMEOUT = envOr("OPENMAUS_ACP_INIT_TIMEOUT_MS", 300_000);
@@ -568,6 +569,7 @@ export function createAcpDriver(support) {
                                 itemType: "tool",
                                 itemId: u.toolCallId,
                                 title: String(u.rawInput?.command ?? u.title ?? "tool").slice(0, 80),
+                                summary: commandSummary(u.rawInput),
                             });
                             break;
                         }

package/dist-server/server/drivers/acp/cursor.js

@@ -177,7 +177,7 @@ export function decodeCursorModelText(text) {
         const line = raw.trim();
         if (!line || line.startsWith("#") || /^available\s+models?\b/i.test(line) || /^models?\b/i.test(line))
             continue;
-        const stripped = line.replace(/^[\s*•\-]+\s*/, "");
+        const stripped = line.replace(/^[\s*•-]+\s*/, "");
         const parts = stripped.split(/\s+[—–|:]\s+|\s+-\s+|\s{2,}/);
         const id = (parts[0] ?? "").trim();
         const rawLabel = parts.slice(1).join(" ").trim();

package/dist-server/server/drivers/acp/grok.js

@@ -208,9 +208,13 @@ const support = {
     // and BEFORE `stdio` (`grok agent -m slug stdio`). Putting -m first is
     // accepted as a TUI option and then ignored, so ACP session/new keeps
     // [models].default (grok-4.6) and oMLX never sees a request.
+    // Auto selects Grok's native classifier; if its feature gate is disabled,
+    // residual requests still ask. Never replace it with bypassPermissions.
+    // Verified: grok 1.0.3 --help and xai-org/grok-build@37949780,
+    // crates/codegen/xai-grok-pager-bin/src/main.rs:1259-1273.
     spawnArgs: (config, turn) => [
         "--permission-mode",
-        config.fullAuto ? "bypassPermissions" : "default",
+        config.fullAuto ? "bypassPermissions" : turn.approvalMode === "auto" ? "auto" : "default",
         "agent",
         ...(turn.model ? ["-m", turn.model] : []),
         // long form on purpose: `--effort` is documented as an alias, and an