openmausbot 0.1.73 → 0.1.75

package/dist-server/server/store.js

@@ -72,6 +72,25 @@ function redactBotAuthored(message) {
             card.summary = redactSecretsInText(card.summary);
         if (typeof card.held === "string")
             card.held = redactSecretsInText(card.held);
+        if (typeof card.answeredText === "string")
+            card.answeredText = redactSecretsInText(card.answeredText);
+        // Bot-authored question text sits behind the subtitle the same way a
+        // routine's instructions do, so it is scrubbed on the same boundary.
+        if (card.questionRequest) {
+            card.questionRequest = {
+                ...card.questionRequest,
+                questions: card.questionRequest.questions.map((question) => ({
+                    ...question,
+                    question: redactSecretsInText(question.question),
+                    ...(question.header ? { header: redactSecretsInText(question.header) } : {}),
+                    options: question.options.map((option) => ({
+                        ...option,
+                        label: redactSecretsInText(option.label),
+                        ...(option.description ? { description: redactSecretsInText(option.description) } : {}),
+                    })),
+                })),
+            };
+        }
         // Routine definitions are executable bot-authored text stored behind the
         // visible summary. Scrub the durable payload too so nesting it on a card
         // cannot bypass the transcript's secret-redaction boundary.

package/dist-server/server/team-manifest.js

@@ -139,7 +139,7 @@ export function parseTeamManifest(value) {
  *
  * 1. Allowlist, not blocklist. The returned object is built field by field
  *    from the parsed member, so every privilege-bearing BotRecord field —
- *    approvalMode, autoApprove, autoReview, alwaysAllow, chiefOfStaff, approvePeerComms, composio,
+ *    approvalMode, autoApprove, alwaysAllow, chiefOfStaff, approvePeerComms, composio,
  *    computer, cloudBackend, cwd — is structurally absent, whatever the
  *    file claimed. parseTeamManifest already drops unknown member keys;
  *    this keeps the guarantee even if the schema grows a field later,

package/dist-server/server/thread-events.js

@@ -133,6 +133,14 @@ const stringOrMissing = (value) => value === undefined || typeof value === "stri
 const stringOrNullOrMissing = (value) => value === undefined || value === null || typeof value === "string";
 const numberOrNullOrMissing = (value) => value === undefined || value === null || typeof value === "number";
 const stringsOrMissing = (value) => value === undefined || (Array.isArray(value) && value.every((item) => typeof item === "string"));
+/** A replayed structured ask. Only the shape the card actually reads is
+ * required; the rest is optional and simply absent on an older event. */
+const askQuestionsOrMissing = (value) => value === undefined ||
+    (Array.isArray(value) &&
+        value.every((question) => isRecord(question) &&
+            typeof question.question === "string" &&
+            Array.isArray(question.options) &&
+            question.options.every((option) => isRecord(option) && typeof option.label === "string")));
 function isRuntimeEvent(value) {
     if (!isRecord(value) ||
         typeof value.eventId !== "string" ||
@@ -179,7 +187,8 @@ function isRuntimeEvent(value) {
             return ((value.requestType === "permission" || value.requestType === "question") &&
                 typeof value.tool === "string" &&
                 typeof value.summary === "string" &&
-                stringsOrMissing(value.choices));
+                stringsOrMissing(value.choices) &&
+                askQuestionsOrMissing(value.questions));
         case "request.resolved":
             return ((value.behavior === "allow" || value.behavior === "deny" || value.behavior === "answer") &&
                 (value.source === "user" ||

package/dist-server/server/webhooks.js

@@ -370,7 +370,10 @@ export class WebhookManager {
         const requestedDeliveryId = String(event.deliveryId ?? "").trim().slice(0, 200);
         if (requestedDeliveryId) {
             const key = `${trigger.endpointId}:${requestedDeliveryId}`;
-            const duplicate = this.deliveries.find((delivery) => delivery.key === key);
+            const committed = this.options.findRun?.(trigger.id, requestedDeliveryId);
+            const duplicate = committed
+                ? { runId: committed.id }
+                : this.deliveries.find((delivery) => delivery.key === key);
             if (duplicate) {
                 this.appendAttempt(trigger, event, {
                     outcome: "duplicate",

package/dist-server/server/workspace-backup.js

@@ -32,7 +32,7 @@ const EXCLUSION_NOTES = [
     "External project folders, CLI login homes, browser session homes, OS keychains, companion devices and other servers.",
     "VM/container disk layers and remote cloud data; durable files inside this workspace are included.",
 ];
-const RESTORE_WARNING = "Restoring pauses routines, webhooks and calendar calls, and does not resume pending delegations or queued runs. Definitions and historical receipts are retained; review before enabling them again.";
+const RESTORE_WARNING = "Restoring pauses routines, webhooks and calendar calls, and does not resume pending delegations, queued chat messages or queued runs. Definitions and historical receipts are retained; review before enabling them again.";
 function excluded(name) {
     return EXCLUDED.has(name) || excludedWorkspaceAuthPath(name) || name.startsWith("openmausbot-server.lease.") || name.startsWith("box-create-requests.lock.") || /^perm-[A-Za-z0-9_-]+\.sock$/.test(name);
 }
@@ -887,17 +887,32 @@ function prepareRestore(dataDir, id, manifest) {
             });
     }
     const dbPath = join(prepared, "messages.db");
-    if (existsSync(dbPath) && manifest.sourceDataDir !== resolve(dataDir)) {
+    if (existsSync(dbPath)) {
         const db = new DatabaseSync(dbPath);
         try {
-            const update = db.prepare("UPDATE messages SET json = ?, text = ? WHERE thread_id = ? AND id = ?");
             db.exec("BEGIN");
-            for (const row of db.prepare("SELECT thread_id, id, json FROM messages").iterate()) {
-                const message = JSON.parse(String(row.json));
-                rebaseMessage(message, manifest.sourceDataDir, resolve(dataDir));
-                const json = JSON.stringify(message);
-                if (json !== row.json)
-                    update.run(json, record(message) && typeof message.text === "string" ? message.text : null, row.thread_id, row.id);
+            if (manifest.sourceDataDir !== resolve(dataDir)) {
+                const update = db.prepare("UPDATE messages SET json = ?, text = ? WHERE thread_id = ? AND id = ?");
+                for (const row of db.prepare("SELECT thread_id, id, json FROM messages").iterate()) {
+                    const message = JSON.parse(String(row.json));
+                    rebaseMessage(message, manifest.sourceDataDir, resolve(dataDir));
+                    const json = JSON.stringify(message);
+                    if (json !== row.json)
+                        update.run(json, record(message) && typeof message.text === "string" ? message.text : null, row.thread_id, row.id);
+                }
+            }
+            // Import is not a server restart: the source may still be running.
+            // Keep accepted words/receipts for review, but never execute a copy of
+            // its pending work (including when restoring to the original home).
+            if (db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'chat_followups'").get()) {
+                const pause = db.prepare("UPDATE chat_followups SET status = 'interrupted', payload = ? WHERE id = ?");
+                for (const row of db.prepare("SELECT id, payload FROM chat_followups WHERE status IN ('pending', 'dispatching', 'interrupted')").iterate()) {
+                    const payload = JSON.parse(String(row.payload));
+                    rebaseMessage(payload, manifest.sourceDataDir, resolve(dataDir));
+                    if (record(payload))
+                        delete payload.prompt;
+                    pause.run(JSON.stringify(payload), row.id);
+                }
             }
             db.exec("COMMIT");
         }

package/dist-server/server/workspace.js

@@ -52,6 +52,19 @@ export function ensureWorkspace(botId) {
 export function workspaceDir(botId) {
     return join(WORKSPACES_DIR, botId);
 }
+/** File locations, not file contents or wider tool permissions. Threads keep
+ * independent working directories; the same bot can find its earlier output
+ * without assuming that a file absent from the current directory was lost. */
+export function workspaceLocationsPrompt(botId, cwd, botCwd) {
+    return "\n\nFile locations for this bot (absolute paths): " + JSON.stringify({
+        currentWorkingFolder: cwd ?? "Provider default; inspect the working directory before using relative paths",
+        sharedBotFolder: workspaceDir(botId),
+        otherThreadFiles: join(TASK_WORKSPACES_DIR, botId),
+        ...(botCwd ? { configuredProjectFolder: botCwd } : {}),
+    }) + ". Different conversations can have different working folders. For an existing file, use the exact path from the conversation; if missing here, check this bot's listed folders before saying it is gone or recreating it." +
+        " Follow an explicitly requested destination. Otherwise put new task output in the current working folder and report its absolute path so another thread or room can use it." +
+        " Do not move old files, edit another active thread's work, or read another bot's private folders without authorization. These paths do not grant additional access.";
+}
 /** Lines as a person counts them: a file that ends in a newline has no
  * extra empty line after it. Every budget check and every "N lines"
  * message uses this one count. */

package/dist-server/shared/approval-mode.js

@@ -1,9 +1,17 @@
-/** The four approval levels exposed by the desktop app. */
-export const APPROVAL_MODES = ["ask", "auto", "full", "custom"];
-/** Only providers with an implemented permission mapping may expose elevation. */
+/** The approval levels exposed by the app. Each one is a provider's own
+ * permission mode, passed through: OpenMausBot never decides a permission
+ * itself (Full access aside, which answers residual prompts because that is
+ * what the person granted). The order is the order the selector shows. */
+export const APPROVAL_MODES = ["ask", "edits", "auto", "full", "custom"];
+/** Only providers with an implemented permission mapping may expose a level.
+ * `edits` (auto-accept edits) exists where the engine has such a mode:
+ * Claude and Grok `acceptEdits`, Antigravity `auto_edit`. Codex's Ask already
+ * runs `workspace-write`, so an edits level would change nothing there. */
 export function supportsApprovalMode(driverKind, mode) {
     if (mode === "custom")
         return driverKind === "codex";
+    if (mode === "edits")
+        return ["claudeAgent", "grokAgent", "antigravityAgent"].includes(driverKind ?? "");
     if (mode !== "full")
         return true;
     return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo"].includes(driverKind ?? "");
@@ -11,13 +19,6 @@ export function supportsApprovalMode(driverKind, mode) {
 export function hasNativeAutoReview(driverKind) {
     return ["codex", "claudeAgent", "cursorAgent", "grokAgent"].includes(driverKind ?? "");
 }
-/** A native reviewer has already declined to decide, or Auto has no native
- * equivalent. Never second-guess that request with the app's heuristic rules.
- * Antigravity and OpenCode Full approve residual ACP tool-permission requests
- * through the app's explicit Full-access grant. Questions remain interactive. */
-export function requiresNativeApproval(driverKind, mode) {
-    return mode === "auto" || (mode === "full" && ["claudeAgent", "cursorAgent", "grokAgent"].includes(driverKind));
-}
 export function isApprovalMode(value) {
     return typeof value === "string" && APPROVAL_MODES.includes(value);
 }

package/dist-server/shared/ask-question.js

@@ -0,0 +1,172 @@
+/**
+ * Structured questions raised by a provider's own "ask the human" tool —
+ * Claude Code's built-in `AskUserQuestion`.
+ *
+ * That tool reaches us as a PERMISSION ask (the CLI routes it through
+ * --permission-prompt-tool like any other tool use), which is exactly the
+ * wrong shape: a person cannot answer "which model should this bot use?"
+ * with Deny / Always allow / Allow once. So the ask is re-read here into the
+ * questions the model actually posed, the card renders them as choices, and
+ * the answer goes back as text.
+ *
+ * The payload is bot-authored, so every field is treated as untrusted: the
+ * shape is validated rather than cast, and the counts and lengths are capped
+ * so a runaway (or hostile) tool call cannot produce an unreadable card.
+ */
+/** The provider tool whose input this module understands. */
+export const ASK_USER_QUESTION_TOOL = "AskUserQuestion";
+/** Caps. Claude Code's own limits are smaller (1-4 questions, 2-4 options);
+ * these leave room for a provider that widens them without letting a card
+ * grow without bound. */
+export const MAX_QUESTIONS = 6;
+export const MAX_OPTIONS = 12;
+const MAX_QUESTION_TEXT = 400;
+const MAX_LABEL = 120;
+const MAX_DESCRIPTION = 400;
+/** One free-text answer. Long enough for a sentence or two of context. */
+export const MAX_CUSTOM_ANSWER = 2000;
+function text(value, limit) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed.slice(0, limit) : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseOption(value) {
+    // A bare string is not the documented shape, but it is the obvious
+    // degradation and costs one line to accept.
+    if (typeof value === "string") {
+        const label = text(value, MAX_LABEL);
+        return label ? { label } : null;
+    }
+    if (!isRecord(value))
+        return null;
+    const label = text(value.label, MAX_LABEL);
+    if (!label)
+        return null;
+    const description = text(value.description, MAX_DESCRIPTION);
+    return description ? { label, description } : { label };
+}
+function parseQuestion(value) {
+    if (!isRecord(value))
+        return null;
+    const question = text(value.question, MAX_QUESTION_TEXT);
+    if (!question)
+        return null;
+    const options = [];
+    const seen = new Set();
+    for (const raw of Array.isArray(value.options) ? value.options : []) {
+        const option = parseOption(raw);
+        // Duplicate labels are the one thing a radio group cannot survive: the
+        // answer text could no longer say which row was picked.
+        if (!option || seen.has(option.label))
+            continue;
+        seen.add(option.label);
+        options.push(option);
+        if (options.length === MAX_OPTIONS)
+            break;
+    }
+    // A question with nothing to choose from is still answerable — the card
+    // always offers free text — so an empty option list is kept, not dropped.
+    const header = text(value.header, MAX_LABEL);
+    return {
+        question,
+        ...(header ? { header } : {}),
+        ...(value.multiSelect === true ? { multiSelect: true } : {}),
+        options,
+    };
+}
+/** The questions inside an AskUserQuestion tool input, or null when the
+ * payload is not one (a malformed call falls back to the ordinary card). */
+export function parseAskQuestions(input) {
+    if (!isRecord(input) || !Array.isArray(input.questions))
+        return null;
+    const questions = [];
+    for (const raw of input.questions) {
+        const question = parseQuestion(raw);
+        if (!question)
+            continue;
+        questions.push(question);
+        if (questions.length === MAX_QUESTIONS)
+            break;
+    }
+    return questions.length ? questions : null;
+}
+/** The one line the card subtitle and a spoken prompt show. */
+export function askQuestionSummary(questions) {
+    const first = questions[0]?.question ?? "";
+    const rest = questions.length - 1;
+    return rest > 0 ? `${first} (+${rest} more question${rest > 1 ? "s" : ""})` : first;
+}
+/** Flat labels for clients that only know how to render a list of choices
+ * (the phone companions, and any older desktop build). Only a single
+ * question can be answered that way without losing which one was answered. */
+export function questionChoices(questions) {
+    if (questions.length !== 1)
+        return undefined;
+    const only = questions[0];
+    if (only.multiSelect || only.options.length < 2)
+        return undefined;
+    return only.options.map((option) => option.label);
+}
+/** The lead-in on a formatted answer. It exists for the model — the answer
+ * is delivered on the deny channel, so it has to say what it is — and the
+ * card strips it back off when it shows the person what they sent. */
+export const ANSWER_PREAMBLE = "The user answered your questions.";
+/**
+ * What the model is told. It arrives as the tool's result, so it has to
+ * stand on its own: name each question, then what was picked for it.
+ */
+export function formatQuestionAnswers(questions, answers) {
+    const blocks = [];
+    questions.forEach((question, index) => {
+        const picked = (answers[index] ?? []).map((value) => value.trim()).filter(Boolean);
+        if (!picked.length)
+            return;
+        blocks.push(`Q: ${question.question}\nA: ${picked.join(", ")}`);
+    });
+    if (!blocks.length)
+        return "";
+    return `${ANSWER_PREAMBLE}\n\n${blocks.join("\n\n")}`;
+}
+/** The same answer with the model-facing lead-in removed, for the settled
+ * card. Anything that does not carry the lead-in is shown as it is. */
+export function answerWithoutPreamble(answer) {
+    return answer.startsWith(`${ANSWER_PREAMBLE}\n\n`) ? answer.slice(ANSWER_PREAMBLE.length + 2) : answer;
+}
+/**
+ * The answer text, read back as one value per question.
+ *
+ * `AskUserQuestion` is answered through its own `answers` field, keyed by the
+ * question's text — but the card sends ONE answer for the whole set, because
+ * a person answers the whole card at once. `formatQuestionAnswers` writes
+ * each question's text beside its answer for exactly this reason, so the map
+ * is recovered rather than guessed.
+ *
+ * A message that carries no blocks at all is the flat path: an older client,
+ * or a phone answering a single-question card with one of the option labels
+ * the harness also sends. With exactly one question there is no ambiguity
+ * about what it answers, so the whole message is that question's answer.
+ * With more than one there is, and nothing is filed.
+ */
+export function questionAnswersByQuestion(message, questions) {
+    const answers = {};
+    const known = new Map(questions.map((entry) => [entry.question, entry.question]));
+    for (const block of message.split("\n\n")) {
+        const match = /^Q: ([\s\S]+?)\nA: ([\s\S]+)$/.exec(block.trim());
+        if (!match)
+            continue;
+        // Only a question this ask actually posed. An unrecognized block is
+        // dropped rather than filed under a key the tool never asked about.
+        const question = known.get(match[1].trim());
+        if (question)
+            answers[question] = match[2].trim();
+    }
+    if (Object.keys(answers).length)
+        return answers;
+    const only = questions.length === 1 ? questions[0] : undefined;
+    const flat = message.trim();
+    return only && flat ? { [only.question]: flat } : {};
+}

package/dist-server/shared/provider-safety.js

@@ -0,0 +1,6 @@
+/** Match provider error wording, not ordinary assistant discussions of safety. */
+export function isProviderSafetyBlock(message) {
+    return /\bblocked by (?:our|the provider['’]s) safety systems\b|\bsafety monitoring\b.{0,100}\b(?:paused|ended|blocked)\b|\b(?:safety_check_failed|safety_policy_violation)\b/i.test(message);
+}
+export const PROVIDER_SAFETY_GUIDANCE = "The provider stopped this task. Full access controls tool approvals, not provider safety checks. Review the provider’s findings in Codex if available; OpenMausBot cannot override this block.";
+export const PROVIDER_SAFETY_HELP_URL = "https://learn.chatgpt.com/docs/agent-approvals-security#safety-monitoring-and-paused-tasks";

package/dist-server/vps-container-mcp.js

@@ -15114,6 +15114,14 @@ var featureConfigSchema = external_exports.object({
    * also has its own switch. */
   browser: external_exports.boolean().optional()
 });
+var onboardingConfigSchema = external_exports.object({
+  /** ISO timestamp of finishing (or skipping to the end of) the welcome flow. */
+  completedAt: external_exports.string().trim().max(40).optional(),
+  /** Which welcome flow was completed; a newer flow may re-show itself. */
+  version: external_exports.number().int().min(0).max(1e3).optional(),
+  reelSeen: external_exports.boolean().optional(),
+  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional()
+}).strict();
 var instanceConfigSchema = external_exports.object({
   driver: external_exports.string().min(1),
   displayName: optionalText,
@@ -15207,6 +15215,7 @@ var appConfigSchema = external_exports.object({
   threads: external_exports.object({ maxConcurrentPerBot: external_exports.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS) }).strict().optional(),
   localVm: localVmConfigSchema.optional(),
   features: featureConfigSchema.optional(),
+  onboarding: onboardingConfigSchema.optional(),
   browserProfiles: browserProfilesSchema.optional(),
   instances: instanceConfigMapSchema.optional(),
   /** User-configured MCP servers, mounted into every capable engine. Kept

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.73",
+  "version": "0.1.75",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",