openmausbot 0.1.70 → 0.1.72

package/dist-server/server/memory-store.js

@@ -0,0 +1,308 @@
+// The person-facing half of bot memory: browse it, edit it, delete it.
+//
+// workspace.ts owns the files (MEMORY.md and memory/ under the bot's
+// workspace) and the load budget. This module owns the RULES for reaching
+// those files from outside the process. A `path` arrives from HTTP, so it
+// is matched against an allowlist of the three shapes memory actually has
+// rather than sanitised — a rejected name is a bug report, not a path to
+// be repaired. Anything else would be an arbitrary-file-read on the disk.
+//
+// Every write goes through writeFileAtomic at 0600 and through the secret
+// scrubber first: memory is agent-authored as often as person-authored,
+// and a bot that pastes a key into its own notes must not leave it on disk
+// in the clear. Writes also carry an optional expected hash so an editor
+// that opened the file a minute ago cannot silently overwrite an entry the
+// bot wrote in between — today's whole-file PUT races memory_update.
+//
+// No knowledge of turns or HTTP here; the journal and the routes sit on top.
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, unlinkSync } from "node:fs";
+import { dirname, join, sep } from "node:path";
+import { writeFileAtomic } from "./atomic.js";
+import { redactSecretsInText } from "./redact.js";
+import { MEMORY_FILE_MAX_BYTES, MEMORY_MAX_BYTES, MEMORY_MAX_LINES, ensureWorkspace, isMemoryTopicName, workspaceDir, } from "./workspace.js";
+export const MEMORY_INDEX = "MEMORY.md";
+/** Carries an HTTP status so the route can answer without a lookup table.
+ * A conflict also carries what is on disk now, so an editor can show the
+ * bot's version next to the person's draft instead of guessing. */
+export class MemoryStoreError extends Error {
+    status;
+    code;
+    currentHash;
+    current;
+    constructor(code, status, message, conflict) {
+        super(message);
+        this.name = "MemoryStoreError";
+        this.code = code;
+        this.status = status;
+        if (conflict) {
+            this.currentHash = conflict.currentHash;
+            this.current = conflict.current;
+        }
+    }
+}
+const BOT_ID = /^[\w-]{1,128}$/;
+function pathError(path) {
+    return new MemoryStoreError("path", 400, `not a memory file: ${JSON.stringify(path)} — use MEMORY.md, memory/<topic>.md or memory/log/<day>.md`);
+}
+/** Only three shapes exist: the index, one topic file directly under
+ * memory/, or one daily log directly under memory/log/. The name gate is
+ * the same one listing uses (workspace.ts isMemoryTopicName), so what the
+ * API can reach and what the overview shows agree by construction. No
+ * separators inside a name means no traversal; no leading dot means no
+ * dotfiles and no bare "..". Backslashes and NUL never match. */
+export function parseMemoryPath(path) {
+    if (typeof path !== "string" || !path)
+        throw pathError(path);
+    if (path === MEMORY_INDEX)
+        return { path, kind: "index", name: MEMORY_INDEX };
+    const parts = path.split("/");
+    if (parts.length === 2 && parts[0] === "memory" && isMemoryTopicName(parts[1])) {
+        return { path, kind: "topic", name: parts[1] };
+    }
+    if (parts.length === 3 && parts[0] === "memory" && parts[1] === "log" && isMemoryTopicName(parts[2])) {
+        return { path, kind: "log", name: parts[2] };
+    }
+    throw pathError(path);
+}
+function assertBotId(botId) {
+    if (!BOT_ID.test(botId))
+        throw new MemoryStoreError("path", 400, "invalid bot id");
+}
+function relativeSegments(ref) {
+    if (ref.kind === "index")
+        return [MEMORY_INDEX];
+    if (ref.kind === "topic")
+        return ["memory", ref.name];
+    return ["memory", "log", ref.name];
+}
+/** The absolute path a memory document lives at, after proving it stays
+ * inside the workspace. The grammar already forbids traversal; this guards
+ * the other escape — a symlink. A bot with file tools can turn memory/ or
+ * a topic file into a link to anywhere, and the editor would then read or
+ * overwrite that target. So the nearest existing ancestor is resolved
+ * through realpath and must sit under the real workspace, and the file
+ * itself, when present, must be a regular file rather than a link. */
+export function resolveMemoryPath(botId, path) {
+    assertBotId(botId);
+    const ref = parseMemoryPath(path);
+    const root = workspaceDir(botId);
+    const absolute = join(root, ...relativeSegments(ref));
+    let realRoot;
+    try {
+        realRoot = realpathSync(root);
+    }
+    catch {
+        // no workspace yet — nothing to escape from, nothing to read either
+        return absolute;
+    }
+    let ancestor = dirname(absolute);
+    while (!existsSync(ancestor) && ancestor !== root)
+        ancestor = dirname(ancestor);
+    const realAncestor = realpathSync(ancestor);
+    if (realAncestor !== realRoot && !realAncestor.startsWith(realRoot + sep)) {
+        throw new MemoryStoreError("path", 400, `memory path escapes the workspace: ${JSON.stringify(path)}`);
+    }
+    try {
+        if (lstatSync(absolute).isSymbolicLink()) {
+            throw new MemoryStoreError("path", 400, `memory file is a link, not a file: ${JSON.stringify(path)}`);
+        }
+    }
+    catch (error) {
+        if (error instanceof MemoryStoreError)
+            throw error;
+        // missing is fine: a topic the person is about to create
+    }
+    return absolute;
+}
+export function hashMemoryText(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex");
+}
+/** Mirrors loadMemory()'s cut exactly so the gauge never claims something
+ * loads that does not: first MEMORY_MAX_LINES lines, then MEMORY_MAX_BYTES
+ * bytes, whichever cuts first. */
+export function memoryCapacity(raw) {
+    const lines = raw === "" ? 0 : raw.split("\n").length;
+    let loaded = raw;
+    let truncated = false;
+    if (lines > MEMORY_MAX_LINES) {
+        loaded = raw.split("\n").slice(0, MEMORY_MAX_LINES).join("\n");
+        truncated = true;
+    }
+    if (Buffer.byteLength(loaded, "utf8") > MEMORY_MAX_BYTES) {
+        loaded = Buffer.from(loaded, "utf8").subarray(0, MEMORY_MAX_BYTES).toString("utf8").replace(/�+$/, "");
+        truncated = true;
+    }
+    return {
+        lines,
+        bytes: Buffer.byteLength(raw, "utf8"),
+        maxLines: MEMORY_MAX_LINES,
+        maxBytes: MEMORY_MAX_BYTES,
+        loadedLines: loaded === "" ? 0 : loaded.split("\n").length,
+        loadedBytes: Buffer.byteLength(loaded, "utf8"),
+        truncated,
+        hash: hashMemoryText(raw),
+    };
+}
+function listMarkdown(dir, prefix) {
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const files = [];
+    for (const name of names) {
+        if (!isMemoryTopicName(name))
+            continue;
+        try {
+            // lstat, not stat: a symlinked topic is not a memory file (see
+            // resolveMemoryPath) and must not be listed as one
+            const info = lstatSync(join(dir, name));
+            if (!info.isFile())
+                continue;
+            files.push({ path: `${prefix}/${name}`, name, bytes: info.size, modifiedAt: Math.round(info.mtimeMs) });
+        }
+        catch {
+            // deleted between readdir and lstat: simply not listed
+        }
+    }
+    // newest first: the file the bot just touched is the one to look at
+    return files.sort((a, b) => b.modifiedAt - a.modifiedAt || a.name.localeCompare(b.name));
+}
+/** Reads never create the workspace: a bot that has not run yet simply
+ * has nothing to show, and an overview must not leave a folder behind. */
+export function memoryOverview(botId) {
+    assertBotId(botId);
+    const root = workspaceDir(botId);
+    let raw = "";
+    try {
+        raw = readFileSync(resolveMemoryPath(botId, MEMORY_INDEX), "utf8");
+    }
+    catch (error) {
+        if (error instanceof MemoryStoreError)
+            throw error;
+        raw = "";
+    }
+    return {
+        botId,
+        workspacePath: root,
+        index: memoryCapacity(raw),
+        topics: listMarkdown(join(root, "memory"), "memory"),
+        logs: listMarkdown(join(root, "memory", "log"), "memory/log"),
+    };
+}
+/** A missing document reads as empty rather than as an error: the topic
+ * the person is about to create has no file yet, and its hash is the hash
+ * of "", which is what a save of a new file must present. */
+export function readMemoryDoc(botId, path) {
+    const absolute = resolveMemoryPath(botId, path);
+    try {
+        const text = readFileSync(absolute, "utf8");
+        return { path, text, hash: hashMemoryText(text), exists: true };
+    }
+    catch {
+        return { path, text: "", hash: hashMemoryText(""), exists: false };
+    }
+}
+/** Atomic, 0600, redacted. With `expectedHash`, the write is refused (409)
+ * unless the file still hashes to what the caller last saw — the bot may
+ * have written between the person's read and their save, and a whole-file
+ * overwrite would erase that note without anyone noticing. */
+export function writeMemoryDoc(botId, path, text, opts = {}) {
+    const ref = parseMemoryPath(path);
+    ensureWorkspace(botId);
+    if (ref.kind === "log")
+        mkdirSync(join(workspaceDir(botId), "memory", "log"), { recursive: true, mode: 0o700 });
+    const absolute = resolveMemoryPath(botId, path);
+    const after = redactSecretsInText(text);
+    const bytes = Buffer.byteLength(after, "utf8");
+    if (bytes > MEMORY_FILE_MAX_BYTES) {
+        throw new MemoryStoreError("too-large", 413, `memory files are capped at ${Math.round(MEMORY_FILE_MAX_BYTES / 1024)}KB — move longer notes into memory/<topic>.md files`);
+    }
+    const current = readMemoryDoc(botId, path);
+    if (opts.expectedHash !== undefined && opts.expectedHash !== current.hash) {
+        throw new MemoryStoreError("conflict", 409, "this file changed since you opened it — reload to see the new version, or save again to overwrite it", { currentHash: current.hash, current: current.text });
+    }
+    writeFileAtomic(absolute, after, { mode: 0o600 });
+    return { path, before: current.exists ? current.text : null, after, hash: hashMemoryText(after) };
+}
+/** Topic and log files only. MEMORY.md is loaded unconditionally at turn
+ * start and the next ensureWorkspace() would silently reseed it, which
+ * reads as "delete did nothing" — clearing it is a write of "". */
+export function deleteMemoryDoc(botId, path) {
+    const ref = parseMemoryPath(path);
+    if (ref.kind === "index") {
+        throw new MemoryStoreError("forbidden", 400, "MEMORY.md cannot be deleted — clear its text instead");
+    }
+    const absolute = resolveMemoryPath(botId, path);
+    const current = readMemoryDoc(botId, path);
+    if (current.exists)
+        unlinkSync(absolute);
+    return { path, before: current.exists ? current.text : null };
+}
+export function obsidianUrlFor(workspacePath) {
+    return `obsidian://open?path=${encodeURIComponent(workspacePath)}`;
+}
+/** Runs the platform URL/folder opener and resolves its exit code; null
+ * when it could not be launched or did not exit in time. Same shape as
+ * cli.ts openDashboard: no shell, fixed argv, nothing from the request. */
+const spawnOpener = (command, args) => new Promise((done) => {
+    let child;
+    try {
+        child = spawn(command, args, { stdio: "ignore", windowsHide: true, detached: true });
+    }
+    catch {
+        return done(null);
+    }
+    const timer = setTimeout(() => {
+        child.kill();
+        done(null);
+    }, 3000);
+    child.once("error", () => {
+        clearTimeout(timer);
+        done(null);
+    });
+    child.once("exit", (code) => {
+        clearTimeout(timer);
+        done(code);
+    });
+    child.unref();
+});
+/** Opens the bot's memory folder on the machine running the server — in
+ * Obsidian (obsidian://open?path=…) or in Finder/Explorer/the file manager.
+ * The folder is on the server's disk, so this only makes sense from the
+ * same machine; the route restricts it to loopback callers. The desktop
+ * shell's own openExternal is http(s)-only, which is why the URL opener
+ * lives here rather than going through the preload bridge. */
+export async function openMemoryLocation(botId, target, platform = process.platform, run = spawnOpener) {
+    assertBotId(botId);
+    const workspacePath = ensureWorkspace(botId);
+    const location = target === "obsidian" ? obsidianUrlFor(workspacePath) : workspacePath;
+    let command;
+    let args;
+    if (platform === "darwin") {
+        command = "open";
+        args = [location];
+    }
+    else if (platform === "win32") {
+        command = target === "obsidian" ? "rundll32.exe" : "explorer.exe";
+        args = target === "obsidian" ? ["url.dll,FileProtocolHandler", location] : [location];
+    }
+    else {
+        command = "xdg-open";
+        args = [location];
+    }
+    const code = await run(command, args);
+    // explorer.exe reports 1 even when it opened the window; only "could not
+    // launch" is a failure there
+    const ok = code === 0 || (platform === "win32" && target === "folder" && code !== null);
+    if (ok)
+        return { ok: true, workspacePath };
+    const error = target === "obsidian"
+        ? `Obsidian did not open. Is it installed? The folder is ${workspacePath}`
+        : `The file manager did not open. The folder is ${workspacePath}`;
+    return { ok: false, error, workspacePath };
+}

package/dist-server/server/message-db.js

@@ -49,8 +49,40 @@ function open() {
     );
   `);
     ensureRecallIndex(db);
+    ensureMemoryIndex(db);
     return db;
 }
+// The bot's memory files — MEMORY.md, memory/<topic>.md, memory/log/<day>.md
+// — indexed for the same session_search. One row per file, with the size
+// and mtime it was indexed at so a search can notice a file the bot's own
+// file tools rewrote without any filesystem watcher. Kept in this database
+// because FTS5 is already here; the files themselves stay the source of
+// truth on disk and this table is rebuilt from them at any time.
+function ensureMemoryIndex(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS memory_files (
+      bot_id TEXT NOT NULL,
+      path TEXT NOT NULL,
+      text TEXT NOT NULL,
+      mtime_ms INTEGER NOT NULL,
+      bytes INTEGER NOT NULL,
+      PRIMARY KEY (bot_id, path)
+    );
+    CREATE VIRTUAL TABLE IF NOT EXISTS memory_fts USING fts5(
+      text, content='memory_files', content_rowid='rowid', tokenize='unicode61'
+    );
+    CREATE TRIGGER IF NOT EXISTS memory_fts_ai AFTER INSERT ON memory_files BEGIN
+      INSERT INTO memory_fts(rowid, text) VALUES (new.rowid, new.text);
+    END;
+    CREATE TRIGGER IF NOT EXISTS memory_fts_ad AFTER DELETE ON memory_files BEGIN
+      INSERT INTO memory_fts(memory_fts, rowid, text) VALUES ('delete', old.rowid, old.text);
+    END;
+    CREATE TRIGGER IF NOT EXISTS memory_fts_au AFTER UPDATE ON memory_files BEGIN
+      INSERT INTO memory_fts(memory_fts, rowid, text) VALUES ('delete', old.rowid, old.text);
+      INSERT INTO memory_fts(rowid, text) VALUES (new.rowid, new.text);
+    END;
+  `);
+}
 // Ranked recall over transcript text, for the bot's own session_search tool.
 // An external-content FTS5 table over messages.text: the index stores no
 // copy of the text, and three triggers keep it in step with every insert,
@@ -58,14 +90,33 @@ function open() {
 // is no more of a dependency than the table it indexes. The sidebar's LIKE
 // search below stays as it is — substring find over a single thread wants
 // every occurrence, not a relevance ranking.
+/** FTS5 is in every runtime OpenMausBot supports — node:sqlite on Node ≥ 24
+ * (package.json engines) and the Node inside Electron 43 — so a SQLite
+ * without it is a mis-installed runtime, not a mode to run in. Say that,
+ * instead of surfacing SQLite's own "no such module: fts5" from deep inside
+ * open() with nothing about what to do. Anything else is rethrown as-is. */
+export function describeMissingFts5(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!/no such module:\s*fts5/i.test(message))
+        return null;
+    return new Error(`OpenMausBot needs SQLite with FTS5, which is built into Node 24 and newer (and into the app). ` +
+        `This Node (${process.version}) has none: install Node 24 or newer. (${message})`);
+}
 function ensureRecallIndex(db) {
     const existed = db
         .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'messages_fts'")
         .get();
+    try {
+        db.exec(`
+      CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
+        text, content='messages', content_rowid='rowid', tokenize='unicode61'
+      );
+    `);
+    }
+    catch (error) {
+        throw describeMissingFts5(error) ?? error;
+    }
     db.exec(`
-    CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
-      text, content='messages', content_rowid='rowid', tokenize='unicode61'
-    );
     CREATE TRIGGER IF NOT EXISTS messages_fts_ai AFTER INSERT ON messages BEGIN
       INSERT INTO messages_fts(rowid, text) VALUES (new.rowid, new.text);
     END;
@@ -347,6 +398,42 @@ export function recallMessages(query, threadIds, limit = 12) {
         };
     });
 }
+/** Index one memory file (upsert keeps the rowid, so the update trigger
+ * keeps the FTS rows in step — the same reasoning as UPSERT_MESSAGE). */
+export function indexMemoryFile(botId, path, text, stat) {
+    db()
+        .prepare("INSERT INTO memory_files (bot_id, path, text, mtime_ms, bytes) VALUES (?, ?, ?, ?, ?) " +
+        "ON CONFLICT(bot_id, path) DO UPDATE SET text = excluded.text, mtime_ms = excluded.mtime_ms, bytes = excluded.bytes")
+        .run(botId, path, text, Math.trunc(stat.mtimeMs), stat.bytes);
+}
+export function removeMemoryFile(botId, path) {
+    db().prepare("DELETE FROM memory_files WHERE bot_id = ? AND path = ?").run(botId, path);
+}
+/** What is indexed for a bot, so the caller can compare against the disk. */
+export function indexedMemoryFiles(botId) {
+    const rows = db()
+        .prepare("SELECT path, mtime_ms, bytes FROM memory_files WHERE bot_id = ?")
+        // SAFETY: the SELECT names exactly these three NOT NULL columns
+        .all(botId);
+    return rows.map((row) => ({ path: row.path, mtimeMs: row.mtime_ms, bytes: row.bytes }));
+}
+/** Relevance-ranked recall over ONE bot's memory files. Scoped by bot id
+ * in SQL, the same way recallMessages scopes by thread: another bot's
+ * memory is not a lower-ranked result, it is not a result. */
+export function recallMemory(query, botId, limit = 12) {
+    const match = ftsQuery(query);
+    if (!match)
+        return [];
+    const rows = db()
+        .prepare("SELECT f.path, f.mtime_ms, " +
+        `snippet(memory_fts, 0, '[', ']', '…', ${SNIPPET_TOKENS}) AS snippet ` +
+        "FROM memory_fts JOIN memory_files f ON f.rowid = memory_fts.rowid " +
+        "WHERE memory_fts MATCH ? AND f.bot_id = ? " +
+        "ORDER BY bm25(memory_fts), f.mtime_ms DESC LIMIT ?")
+        // SAFETY: the SELECT names exactly these three columns; snippet() is never null
+        .all(match, botId, limit);
+    return rows.map((row) => ({ file: row.path, at: row.mtime_ms, snippet: row.snippet.replace(/\s+/g, " ").trim() }));
+}
 /** Test/shutdown hook — closes the handle so a wiped DATA_DIR starts clean. */
 export function closeMessageDb() {
     try {

package/dist-server/server/package-export.js

@@ -32,6 +32,8 @@ export function createBotPackageExport(input) {
     const playbooks = [];
     const playbookKeys = new Set();
     const agentPlaybooks = new Map();
+    const packageSkills = new Map();
+    const agentSkills = new Map();
     for (const bot of bots) {
         const agentKey = idToKey.get(bot.id);
         const assigned = [];
@@ -50,6 +52,20 @@ export function createBotPackageExport(input) {
             assigned.push(key);
         }
         agentPlaybooks.set(bot.id, assigned);
+        const assignedSkills = [];
+        for (const skill of input.skillsByBot?.get(bot.id) ?? []) {
+            const existing = packageSkills.get(skill.name);
+            if (existing && (existing.instructions !== skill.instructions || existing.description !== skill.description ||
+                existing.source !== skill.source || existing.license !== skill.license ||
+                existing.compatibility !== skill.compatibility)) {
+                throw new Error(`Skill "${skill.name}" has conflicting content across selected bots`);
+            }
+            if (!existing)
+                packageSkills.set(skill.name, { ...skill });
+            if (!assignedSkills.includes(skill.name))
+                assignedSkills.push(skill.name);
+        }
+        agentSkills.set(bot.id, assignedSkills);
     }
     const requirements = new Map();
     for (const bot of bots) {
@@ -132,6 +148,9 @@ export function createBotPackageExport(input) {
         const assigned = agentPlaybooks.get(bot.id);
         if (assigned?.length)
             agent.playbooks = assigned;
+        const assignedSkills = agentSkills.get(bot.id);
+        if (assignedSkills?.length)
+            agent.skills = assignedSkills;
         return agent;
     });
     const definition = {
@@ -157,6 +176,12 @@ export function createBotPackageExport(input) {
         definition.routines = routines;
     if (playbooks.length)
         definition.playbooks = playbooks;
+    if (packageSkills.size) {
+        definition.skills = {
+            version: 1,
+            entries: [...packageSkills.values()].map((skill) => ({ ...skill })),
+        };
+    }
     return parseBotPackage({
         format: "openmaus.package",
         version: 1,

package/dist-server/server/peer-approval.js

@@ -156,7 +156,7 @@ export function resolvePeerComms(_bus, requestId, behavior) {
 /** Drop every approval waiting on a bot that no longer exists (or is being
  * deleted), denying it so the caller's turn doesn't wait out the timeout. */
 export function cancelPeerApprovalsFor(botId) {
-    for (const [requestId, pending] of [...pendingComms]) {
+    for (const [requestId, pending] of Array.from(pendingComms)) {
         if (pending.fromBotId !== botId && pending.toBotId !== botId)
             continue;
         pendingComms.delete(requestId);

package/dist-server/server/prices.js

@@ -0,0 +1,16 @@
+/** The most specific price for a turn: driver/model, then model, then default. */
+export function priceFor(turn, prices) {
+    return prices[`${turn.driverKind}/${turn.model}`] ?? prices[turn.model] ?? prices.default ?? null;
+}
+const clean = (value) => (typeof value === "number" && Number.isFinite(value) ? Math.max(0, value) : 0);
+/** Dollars billable for one turn, or null when the list has no price for it. */
+export function billableFor(turn, prices) {
+    const price = priceFor(turn, prices);
+    if (!price)
+        return null;
+    const input = clean(turn.input);
+    const cached = Math.min(clean(turn.cachedInput), input);
+    const fresh = input - cached;
+    const cachedRate = price.cachedInputPerMillion ?? price.inputPerMillion;
+    return (fresh * price.inputPerMillion + cached * cachedRate + clean(turn.output) * price.outputPerMillion) / 1_000_000;
+}

package/dist-server/server/provider-auth-sessions.js

@@ -1,6 +1,9 @@
 const failure = (message, status) => Object.assign(new Error(message), { status });
 export class ProviderAuthSessions {
     flows = new Map();
+    get active() {
+        return [...this.flows.values()].some((flow) => flow.busy || (!flow.revoked && flow.expiresAt > Date.now()));
+    }
     async start(instance, owner) {
         if (!instance.startAuthentication)
             throw failure("Account setup is unavailable for this provider.", 404);

package/dist-server/server/provider-key-check.js

@@ -0,0 +1,66 @@
+export const PROVIDER_KEY_KINDS = ["anthropic", "openaiCompat", "xai"];
+const DEFAULT_URLS = {
+    anthropic: "https://api.anthropic.com",
+    openaiCompat: "https://openrouter.ai/api/v1",
+    xai: "https://api.x.ai/v1",
+};
+const MAX_MODELS = 5;
+function isLoopback(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, "");
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.startsWith("127.");
+}
+/** The models endpoint for a provider, from its base URL or the default. */
+export function providerModelsUrl(provider, base) {
+    const root = (base?.trim() || DEFAULT_URLS[provider]).replace(/\/+$/, "");
+    if (provider === "anthropic")
+        return root.endsWith("/v1") ? `${root}/models` : `${root}/v1/models`;
+    return `${root}/models`;
+}
+function modelIds(body) {
+    const record = body && typeof body === "object" ? body : null;
+    const list = Array.isArray(record?.data) ? record.data : Array.isArray(record?.models) ? record.models : [];
+    const ids = [];
+    for (const entry of list) {
+        const item = entry && typeof entry === "object" ? entry : null;
+        const id = typeof item?.id === "string" ? item.id : typeof item?.name === "string" ? item.name : null;
+        if (id && id.length <= 120)
+            ids.push(id);
+        if (ids.length === MAX_MODELS)
+            break;
+    }
+    return ids;
+}
+export async function checkProviderKey(input, fetchImpl = fetch, timeoutMs = 10_000) {
+    let url;
+    try {
+        url = new URL(providerModelsUrl(input.provider, input.url));
+    }
+    catch {
+        return { ok: false, reason: "unexpected" };
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback(url.hostname))) {
+        return { ok: false, reason: "unexpected" };
+    }
+    const headers = input.provider === "anthropic"
+        ? { "x-api-key": input.key, "anthropic-version": "2023-06-01" }
+        : { authorization: `Bearer ${input.key}` };
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        // A redirect is never followed: the key must not be replayed to
+        // whichever host the provider's front door points at today.
+        const response = await fetchImpl(url, { headers, signal: controller.signal, redirect: "manual" });
+        if (response.status === 401 || response.status === 403)
+            return { ok: false, reason: "rejected", status: response.status };
+        if (!response.ok)
+            return { ok: false, reason: "unexpected", status: response.status };
+        const body = await response.json().catch(() => null);
+        return { ok: true, models: modelIds(body) };
+    }
+    catch {
+        return { ok: false, reason: "unreachable" };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist-server/server/proxy-paths.js

@@ -40,6 +40,7 @@ export const SPAWNED_PROXIES = {
     agents: resolveProxy("drivers/agents-proxy"),
     dweb: resolveProxy("drivers/dweb-proxy"),
     connectors: resolveProxy("connector-proxy"),
+    mcpGate: resolveProxy("mcp-gate"),
     phone: resolveProxy("drivers/phone-proxy"),
     // Loaded by the external `pi` process via `-e`, not by this server — but
     // resolved through the same single source of truth so the packaged layout

package/dist-server/server/redact.js

@@ -35,6 +35,9 @@ const mask = (value) => (REDACTION_MARKER.test(value) ? value : `«redacted ${va
 // transcript, so only shapes that are unmistakably credentials match.
 const KEY_PREFIXES = [
     /\bsk-(?:ant-|proj-|live-|test-)?[A-Za-z0-9_-]{16,}/g, // anthropic / openai / stripe
+    /\bxai-[A-Za-z0-9_-]{20,}/g, // xai (grok)
+    /\bgsk_[A-Za-z0-9]{40,}/g, // groq
+    /\bhf_[A-Za-z0-9]{30,}/g, // hugging face
     /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g, // github classic
     /\bgithub_pat_[A-Za-z0-9_]{20,}/g, // github fine-grained
     /\bxox[abposr]-[A-Za-z0-9-]{20,}/g, // slack
@@ -49,6 +52,15 @@ const PEM_BLOCK = /(-----BEGIN [A-Z ]*PRIVATE KEY-----)([\s\S]*?)(-----END [A-Z
  * The value must be a single token of some length; prose after a colon
  * ("password: leave blank…") has spaces and does not match. */
 const KEY_VALUE = /\b((?:[A-Za-z0-9_-]*_)?(?:api[_-]?key|apikey|secret|token|password|passwd|authorization|auth[_-]?token|access[_-]?key|private[_-]?key)s?)(["']?\s*[=:]\s*)(["']?)([A-Za-z0-9._~+/=-]{8,})\3/gi;
+/** `X_KEY=value`, `xai-key=value`: an assignment to a name that ENDS in key
+ * is a credential whatever the value looks like, so no length floor. The
+ * separator before `key` is what keeps `hotkey=` and `keyboard=` out. */
+const KEY_SUFFIX_ASSIGNMENT = /\b([A-Za-z][A-Za-z0-9_-]*[_-]key)s?(=)(["']?)([A-Za-z0-9._~+/=-]+)\3/gi;
+/** `--token abc`, `--password=abc`: the flag names a secret; the value is
+ * whatever single token follows, never another flag. */
+const SECRET_FLAG = /(--(?:token|password|passwd|api-key|apikey|secret|access-key|auth-token)(?:=|\s+))(["']?)(?!-)([A-Za-z0-9._~+/=-]+)\2/gi;
+/** `scheme://user:secret@host` — the password in a URL's userinfo. */
+const URL_USERINFO = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@'"]+:)([^\s/@'"«»]+)(@)/gi;
 export function redactSecretsInText(text) {
     if (!text || text.length < 8)
         return text;
@@ -58,6 +70,9 @@ export function redactSecretsInText(text) {
         out = out.replace(re, (m) => mask(m));
     out = out.replace(BEARER, (_m, lead, tok) => `${lead}${mask(tok)}`);
     out = out.replace(KEY_VALUE, (_m, key, sep, quote, value) => `${key}${sep}${quote}${mask(value)}${quote}`);
+    out = out.replace(KEY_SUFFIX_ASSIGNMENT, (_m, key, sep, quote, value) => `${key}${sep}${quote}${mask(value)}${quote}`);
+    out = out.replace(SECRET_FLAG, (_m, flag, quote, value) => `${flag}${quote}${mask(value)}${quote}`);
+    out = out.replace(URL_USERINFO, (_m, lead, secret, at) => `${lead}${mask(secret)}${at}`);
     return out;
 }
 /** Deep copy with credential VALUES replaced. Handles the two shapes that