openmausbot 0.1.74 → 0.1.75

package/dist-server/server/permission-proxy.js

@@ -10,9 +10,18 @@
 //   ask_user  — the agent can pose a question mid-run and wait; the
 //               human's words come back verbatim.
 //
+// One tool arrives through `approve` that is not a permission at all: the
+// CLI's own AskUserQuestion. It is the tool the model actually reaches for
+// when it wants a person to choose, and acceptEdits will not run it unasked,
+// so it lands here looking like "may I run a tool?" — which is how a question
+// ended up on screen as an Allow/Deny box over a JSON blob. It is intercepted
+// below and asked as what it is: one card carrying every question it posed,
+// answered through the tool's own `answers` field.
+//
 // stdout is the MCP channel — never console.log here.
 import { connect } from "node:net";
 import { randomUUID } from "node:crypto";
+import { parseAskQuestions, questionAnswersByQuestion } from "../shared/ask-question.js";
 const socketPath = process.argv[2] ?? "";
 const waiting = new Map();
 const conn = connect(socketPath);
@@ -45,6 +54,77 @@ conn.on("data", (chunk) => {
     }
 });
 const send = (obj) => process.stdout.write(JSON.stringify(obj) + "\n");
+/** Hand one ask to the broker and wait for the human's answer. */
+function askBroker(ask) {
+    return new Promise((resolve) => {
+        waiting.set(String(ask.id), resolve);
+        if (conn.destroyed)
+            return dead();
+        try {
+            conn.write(JSON.stringify(ask) + "\n");
+        }
+        catch {
+            dead();
+        }
+    });
+}
+// ── the CLI's own AskUserQuestion ──────────────────────────────────────
+const ASK_USER_QUESTION = "AskUserQuestion";
+const asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+/** One question, in the shape the broker and the option card understand. */
+/**
+ * Ask the person every question at once, then answer the tool the way it
+ * documents.
+ *
+ * The answer is NOT a bare allow. A bare allow tells the CLI to go and run
+ * AskUserQuestion, and a headless run has no dialog to collect anything —
+ * the model gets "The user did not answer the questions." back and the
+ * click is thrown away. The `answers` object is the field the tool's own
+ * schema calls "User answers collected by the permission component":
+ * keyed by the question's text, one comma-joined string per question.
+ *
+ * One ask, not one per question: the card draws the whole set with a tab
+ * each, so a person sees what they are committing to before answering any
+ * of it. `questionAnswersByQuestion` maps the answer text back per question.
+ *
+ * There is deliberately no "fall through to the permission path" here. That
+ * path cannot answer this tool — allowing it throws the click away, as
+ * above — so the fallback offered a person an Allow/Deny box over raw JSON.
+ * That box is the bug this file exists to remove.
+ */
+async function answerNativeQuestions(input) {
+    // Unanswerable entries are SKIPPED by the parser, not fatal: one bad entry
+    // must not cost the user the good questions beside it. Nothing left means
+    // the whole call was unanswerable, which becomes a denial.
+    const questions = parseAskQuestions(input);
+    if (!questions?.length) {
+        return JSON.stringify({
+            behavior: "deny",
+            message: "OpenMausBot: this AskUserQuestion call had no answerable question (each one needs question text), so nobody was shown it. Ask again with a well-formed call, or continue without it.",
+        });
+    }
+    const answer = await askBroker({
+        t: "ask",
+        id: randomUUID(),
+        kind: "question",
+        tool: ASK_USER_QUESTION,
+        input: { questions },
+    });
+    // A question is only ever denied when the broker is gone.
+    if (answer.behavior === "deny") {
+        return JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
+    }
+    // What lands in `answers` turns on WHO answered, not on whether there are
+    // words. The broker's own notes are words — the timeout's "nobody answered
+    // in time, use your best judgment" is a whole sentence — so filing anything
+    // non-blank hands the model system text in the slot reserved for what the
+    // person chose. Left out, the CLI reports the question as unanswered, which
+    // is the truth.
+    const answers = answer.source === "user" && typeof answer.message === "string"
+        ? questionAnswersByQuestion(answer.message, questions)
+        : {};
+    return JSON.stringify({ behavior: "allow", updatedInput: { ...asRecord(input), answers } });
+}
 const TOOLS = [
     {
         name: "approve",
@@ -93,6 +173,12 @@ async function handle(msg) {
     if (msg.method === "tools/call") {
         const name = msg.params?.name;
         const args = msg.params?.arguments ?? {};
+        const reply = (text) => send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text }] } });
+        // AskUserQuestion is a question wearing a permission's clothes. It never
+        // continues into the permission path below — see nativeQuestions.
+        if (name === "approve" && args.tool_name === ASK_USER_QUESTION) {
+            return reply(await answerNativeQuestions(args.input));
+        }
         const askId = randomUUID();
         const isQuestion = name === "ask_user";
         // the CLI may include its own suggested permission rules; on allow we
@@ -103,20 +189,9 @@ async function handle(msg) {
             : Array.isArray(args.suggestions)
                 ? args.suggestions
                 : null;
-        const answer = await new Promise((resolve) => {
-            waiting.set(askId, resolve);
-            if (conn.destroyed)
-                return dead();
-            const ask = isQuestion
-                ? { t: "ask", id: askId, kind: "question", tool: "ask_user", input: { question: args.question, choices: args.choices } }
-                : { t: "ask", id: askId, tool: args.tool_name, input: args.input };
-            try {
-                conn.write(JSON.stringify(ask) + "\n");
-            }
-            catch {
-                dead();
-            }
-        });
+        const answer = await askBroker(isQuestion
+            ? { t: "ask", id: askId, kind: "question", tool: "ask_user", input: { question: args.question, choices: args.choices } }
+            : { t: "ask", id: askId, tool: args.tool_name, input: args.input });
         let text = answer.message || "No answer was given — use your best judgment.";
         if (!isQuestion) {
             if (answer.behavior === "allow") {
@@ -129,7 +204,7 @@ async function handle(msg) {
                 text = JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
             }
         }
-        return send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text }] } });
+        return reply(text);
     }
     if (String(msg.method ?? "").startsWith("notifications/"))
         return;

package/dist-server/server/setup-mode.js

@@ -1,5 +1,5 @@
-// Setup mode: the coaching block a bot gets when it has not been set up yet,
-// or when the user asks for it with /setup. The bot interviews the user, says
+// Setup mode: optional coaching when the user asks for it with /setup.
+// An empty profile is not a request to interview the user. The bot says
 // what it intends, and then configures itself only through proposal cards
 // (propose_profile, propose_routine, skill_manage, request_credential) — so
 // nothing changes without the user's approval. Mirrors skill-learn.ts:
@@ -29,11 +29,10 @@ export function expandSetupTurnText(userText) {
         ? `Set yourself up for this job: ${setup.request}`
         : "Set yourself up. Ask me what you need to know, then propose your configuration.";
 }
-/** A bot with neither standing instructions nor a description has not been
- * set up. /setup re-enters the mode for a configured bot. */
+/** Only an explicit setup request enters coaching. Existing/blank bots must
+ * still do ordinary work, including delegated and scheduled requests. */
 export function setupModeActive(input) {
-    const blank = !(input.soul ?? "").trim() && !(input.description ?? "").trim();
-    return blank || parseSetupCommand(input.text) !== null;
+    return parseSetupCommand(input.text) !== null;
 }
 // skill_manage is only ever mounted alongside the other agent tools when
 // skill authoring is turned on for this turn (OMB_SKILL_AUTHORING_ENABLED);
@@ -46,7 +45,7 @@ function folderClause(cwd) {
         : "which folder on this computer it should work in (today it has none and works in a private workspace; offer to keep that, or ask for a path)";
 }
 function buildSetupPrompt(profileAside, cwd) {
-    return ("\n\nThis bot has not been set up yet, or the user asked you to set yourself up. Your job this conversation is to set yourself up from what the user tells you." +
+    return ("\n\nThe user explicitly asked you to set yourself up. For this setup request, help configure the bot from what the user tells you." +
         ` First ask at most four questions that change what you would build: what the job is, when it should happen (on demand, on a schedule, or when something arrives), which apps or accounts it touches, and ${folderClause(cwd)}.` +
         " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Wait for a yes." +
         " When they say yes, first send one message that lists the cards you are about to raise, then make the tool calls — the cards must appear after that message, never before it. After the tool calls add at most one short line and do not repeat the list." +

package/dist-server/server/store.js

@@ -72,6 +72,25 @@ function redactBotAuthored(message) {
             card.summary = redactSecretsInText(card.summary);
         if (typeof card.held === "string")
             card.held = redactSecretsInText(card.held);
+        if (typeof card.answeredText === "string")
+            card.answeredText = redactSecretsInText(card.answeredText);
+        // Bot-authored question text sits behind the subtitle the same way a
+        // routine's instructions do, so it is scrubbed on the same boundary.
+        if (card.questionRequest) {
+            card.questionRequest = {
+                ...card.questionRequest,
+                questions: card.questionRequest.questions.map((question) => ({
+                    ...question,
+                    question: redactSecretsInText(question.question),
+                    ...(question.header ? { header: redactSecretsInText(question.header) } : {}),
+                    options: question.options.map((option) => ({
+                        ...option,
+                        label: redactSecretsInText(option.label),
+                        ...(option.description ? { description: redactSecretsInText(option.description) } : {}),
+                    })),
+                })),
+            };
+        }
         // Routine definitions are executable bot-authored text stored behind the
         // visible summary. Scrub the durable payload too so nesting it on a card
         // cannot bypass the transcript's secret-redaction boundary.

package/dist-server/server/thread-events.js

@@ -133,6 +133,14 @@ const stringOrMissing = (value) => value === undefined || typeof value === "stri
 const stringOrNullOrMissing = (value) => value === undefined || value === null || typeof value === "string";
 const numberOrNullOrMissing = (value) => value === undefined || value === null || typeof value === "number";
 const stringsOrMissing = (value) => value === undefined || (Array.isArray(value) && value.every((item) => typeof item === "string"));
+/** A replayed structured ask. Only the shape the card actually reads is
+ * required; the rest is optional and simply absent on an older event. */
+const askQuestionsOrMissing = (value) => value === undefined ||
+    (Array.isArray(value) &&
+        value.every((question) => isRecord(question) &&
+            typeof question.question === "string" &&
+            Array.isArray(question.options) &&
+            question.options.every((option) => isRecord(option) && typeof option.label === "string")));
 function isRuntimeEvent(value) {
     if (!isRecord(value) ||
         typeof value.eventId !== "string" ||
@@ -179,7 +187,8 @@ function isRuntimeEvent(value) {
             return ((value.requestType === "permission" || value.requestType === "question") &&
                 typeof value.tool === "string" &&
                 typeof value.summary === "string" &&
-                stringsOrMissing(value.choices));
+                stringsOrMissing(value.choices) &&
+                askQuestionsOrMissing(value.questions));
         case "request.resolved":
             return ((value.behavior === "allow" || value.behavior === "deny" || value.behavior === "answer") &&
                 (value.source === "user" ||

package/dist-server/server/workspace.js

@@ -52,6 +52,19 @@ export function ensureWorkspace(botId) {
 export function workspaceDir(botId) {
     return join(WORKSPACES_DIR, botId);
 }
+/** File locations, not file contents or wider tool permissions. Threads keep
+ * independent working directories; the same bot can find its earlier output
+ * without assuming that a file absent from the current directory was lost. */
+export function workspaceLocationsPrompt(botId, cwd, botCwd) {
+    return "\n\nFile locations for this bot (absolute paths): " + JSON.stringify({
+        currentWorkingFolder: cwd ?? "Provider default; inspect the working directory before using relative paths",
+        sharedBotFolder: workspaceDir(botId),
+        otherThreadFiles: join(TASK_WORKSPACES_DIR, botId),
+        ...(botCwd ? { configuredProjectFolder: botCwd } : {}),
+    }) + ". Different conversations can have different working folders. For an existing file, use the exact path from the conversation; if missing here, check this bot's listed folders before saying it is gone or recreating it." +
+        " Follow an explicitly requested destination. Otherwise put new task output in the current working folder and report its absolute path so another thread or room can use it." +
+        " Do not move old files, edit another active thread's work, or read another bot's private folders without authorization. These paths do not grant additional access.";
+}
 /** Lines as a person counts them: a file that ends in a newline has no
  * extra empty line after it. Every budget check and every "N lines"
  * message uses this one count. */

package/dist-server/shared/ask-question.js

@@ -0,0 +1,172 @@
+/**
+ * Structured questions raised by a provider's own "ask the human" tool —
+ * Claude Code's built-in `AskUserQuestion`.
+ *
+ * That tool reaches us as a PERMISSION ask (the CLI routes it through
+ * --permission-prompt-tool like any other tool use), which is exactly the
+ * wrong shape: a person cannot answer "which model should this bot use?"
+ * with Deny / Always allow / Allow once. So the ask is re-read here into the
+ * questions the model actually posed, the card renders them as choices, and
+ * the answer goes back as text.
+ *
+ * The payload is bot-authored, so every field is treated as untrusted: the
+ * shape is validated rather than cast, and the counts and lengths are capped
+ * so a runaway (or hostile) tool call cannot produce an unreadable card.
+ */
+/** The provider tool whose input this module understands. */
+export const ASK_USER_QUESTION_TOOL = "AskUserQuestion";
+/** Caps. Claude Code's own limits are smaller (1-4 questions, 2-4 options);
+ * these leave room for a provider that widens them without letting a card
+ * grow without bound. */
+export const MAX_QUESTIONS = 6;
+export const MAX_OPTIONS = 12;
+const MAX_QUESTION_TEXT = 400;
+const MAX_LABEL = 120;
+const MAX_DESCRIPTION = 400;
+/** One free-text answer. Long enough for a sentence or two of context. */
+export const MAX_CUSTOM_ANSWER = 2000;
+function text(value, limit) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed.slice(0, limit) : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseOption(value) {
+    // A bare string is not the documented shape, but it is the obvious
+    // degradation and costs one line to accept.
+    if (typeof value === "string") {
+        const label = text(value, MAX_LABEL);
+        return label ? { label } : null;
+    }
+    if (!isRecord(value))
+        return null;
+    const label = text(value.label, MAX_LABEL);
+    if (!label)
+        return null;
+    const description = text(value.description, MAX_DESCRIPTION);
+    return description ? { label, description } : { label };
+}
+function parseQuestion(value) {
+    if (!isRecord(value))
+        return null;
+    const question = text(value.question, MAX_QUESTION_TEXT);
+    if (!question)
+        return null;
+    const options = [];
+    const seen = new Set();
+    for (const raw of Array.isArray(value.options) ? value.options : []) {
+        const option = parseOption(raw);
+        // Duplicate labels are the one thing a radio group cannot survive: the
+        // answer text could no longer say which row was picked.
+        if (!option || seen.has(option.label))
+            continue;
+        seen.add(option.label);
+        options.push(option);
+        if (options.length === MAX_OPTIONS)
+            break;
+    }
+    // A question with nothing to choose from is still answerable — the card
+    // always offers free text — so an empty option list is kept, not dropped.
+    const header = text(value.header, MAX_LABEL);
+    return {
+        question,
+        ...(header ? { header } : {}),
+        ...(value.multiSelect === true ? { multiSelect: true } : {}),
+        options,
+    };
+}
+/** The questions inside an AskUserQuestion tool input, or null when the
+ * payload is not one (a malformed call falls back to the ordinary card). */
+export function parseAskQuestions(input) {
+    if (!isRecord(input) || !Array.isArray(input.questions))
+        return null;
+    const questions = [];
+    for (const raw of input.questions) {
+        const question = parseQuestion(raw);
+        if (!question)
+            continue;
+        questions.push(question);
+        if (questions.length === MAX_QUESTIONS)
+            break;
+    }
+    return questions.length ? questions : null;
+}
+/** The one line the card subtitle and a spoken prompt show. */
+export function askQuestionSummary(questions) {
+    const first = questions[0]?.question ?? "";
+    const rest = questions.length - 1;
+    return rest > 0 ? `${first} (+${rest} more question${rest > 1 ? "s" : ""})` : first;
+}
+/** Flat labels for clients that only know how to render a list of choices
+ * (the phone companions, and any older desktop build). Only a single
+ * question can be answered that way without losing which one was answered. */
+export function questionChoices(questions) {
+    if (questions.length !== 1)
+        return undefined;
+    const only = questions[0];
+    if (only.multiSelect || only.options.length < 2)
+        return undefined;
+    return only.options.map((option) => option.label);
+}
+/** The lead-in on a formatted answer. It exists for the model — the answer
+ * is delivered on the deny channel, so it has to say what it is — and the
+ * card strips it back off when it shows the person what they sent. */
+export const ANSWER_PREAMBLE = "The user answered your questions.";
+/**
+ * What the model is told. It arrives as the tool's result, so it has to
+ * stand on its own: name each question, then what was picked for it.
+ */
+export function formatQuestionAnswers(questions, answers) {
+    const blocks = [];
+    questions.forEach((question, index) => {
+        const picked = (answers[index] ?? []).map((value) => value.trim()).filter(Boolean);
+        if (!picked.length)
+            return;
+        blocks.push(`Q: ${question.question}\nA: ${picked.join(", ")}`);
+    });
+    if (!blocks.length)
+        return "";
+    return `${ANSWER_PREAMBLE}\n\n${blocks.join("\n\n")}`;
+}
+/** The same answer with the model-facing lead-in removed, for the settled
+ * card. Anything that does not carry the lead-in is shown as it is. */
+export function answerWithoutPreamble(answer) {
+    return answer.startsWith(`${ANSWER_PREAMBLE}\n\n`) ? answer.slice(ANSWER_PREAMBLE.length + 2) : answer;
+}
+/**
+ * The answer text, read back as one value per question.
+ *
+ * `AskUserQuestion` is answered through its own `answers` field, keyed by the
+ * question's text — but the card sends ONE answer for the whole set, because
+ * a person answers the whole card at once. `formatQuestionAnswers` writes
+ * each question's text beside its answer for exactly this reason, so the map
+ * is recovered rather than guessed.
+ *
+ * A message that carries no blocks at all is the flat path: an older client,
+ * or a phone answering a single-question card with one of the option labels
+ * the harness also sends. With exactly one question there is no ambiguity
+ * about what it answers, so the whole message is that question's answer.
+ * With more than one there is, and nothing is filed.
+ */
+export function questionAnswersByQuestion(message, questions) {
+    const answers = {};
+    const known = new Map(questions.map((entry) => [entry.question, entry.question]));
+    for (const block of message.split("\n\n")) {
+        const match = /^Q: ([\s\S]+?)\nA: ([\s\S]+)$/.exec(block.trim());
+        if (!match)
+            continue;
+        // Only a question this ask actually posed. An unrecognized block is
+        // dropped rather than filed under a key the tool never asked about.
+        const question = known.get(match[1].trim());
+        if (question)
+            answers[question] = match[2].trim();
+    }
+    if (Object.keys(answers).length)
+        return answers;
+    const only = questions.length === 1 ? questions[0] : undefined;
+    const flat = message.trim();
+    return only && flat ? { [only.question]: flat } : {};
+}

package/dist-server/shared/provider-safety.js

@@ -0,0 +1,6 @@
+/** Match provider error wording, not ordinary assistant discussions of safety. */
+export function isProviderSafetyBlock(message) {
+    return /\bblocked by (?:our|the provider['’]s) safety systems\b|\bsafety monitoring\b.{0,100}\b(?:paused|ended|blocked)\b|\b(?:safety_check_failed|safety_policy_violation)\b/i.test(message);
+}
+export const PROVIDER_SAFETY_GUIDANCE = "The provider stopped this task. Full access controls tool approvals, not provider safety checks. Review the provider’s findings in Codex if available; OpenMausBot cannot override this block.";
+export const PROVIDER_SAFETY_HELP_URL = "https://learn.chatgpt.com/docs/agent-approvals-security#safety-monitoring-and-paused-tasks";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.74",
+  "version": "0.1.75",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",