openmausbot 0.1.74 → 0.1.76

package/dist-server/permission-proxy.js

@@ -1,6 +1,80 @@
 // server/permission-proxy.ts
 import { connect } from "node:net";
 import { randomUUID } from "node:crypto";
+
+// shared/ask-question.ts
+var MAX_QUESTIONS = 6;
+var MAX_OPTIONS = 12;
+var MAX_QUESTION_TEXT = 400;
+var MAX_LABEL = 120;
+var MAX_DESCRIPTION = 400;
+function text(value, limit) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed ? trimmed.slice(0, limit) : void 0;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseOption(value) {
+  if (typeof value === "string") {
+    const label2 = text(value, MAX_LABEL);
+    return label2 ? { label: label2 } : null;
+  }
+  if (!isRecord(value)) return null;
+  const label = text(value.label, MAX_LABEL);
+  if (!label) return null;
+  const description = text(value.description, MAX_DESCRIPTION);
+  return description ? { label, description } : { label };
+}
+function parseQuestion(value) {
+  if (!isRecord(value)) return null;
+  const question = text(value.question, MAX_QUESTION_TEXT);
+  if (!question) return null;
+  const options = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of Array.isArray(value.options) ? value.options : []) {
+    const option = parseOption(raw);
+    if (!option || seen.has(option.label)) continue;
+    seen.add(option.label);
+    options.push(option);
+    if (options.length === MAX_OPTIONS) break;
+  }
+  const header = text(value.header, MAX_LABEL);
+  return {
+    question,
+    ...header ? { header } : {},
+    ...value.multiSelect === true ? { multiSelect: true } : {},
+    options
+  };
+}
+function parseAskQuestions(input) {
+  if (!isRecord(input) || !Array.isArray(input.questions)) return null;
+  const questions = [];
+  for (const raw of input.questions) {
+    const question = parseQuestion(raw);
+    if (!question) continue;
+    questions.push(question);
+    if (questions.length === MAX_QUESTIONS) break;
+  }
+  return questions.length ? questions : null;
+}
+function questionAnswersByQuestion(message, questions) {
+  const answers = {};
+  const known = new Map(questions.map((entry) => [entry.question, entry.question]));
+  for (const block of message.split("\n\n")) {
+    const match = /^Q: ([\s\S]+?)\nA: ([\s\S]+)$/.exec(block.trim());
+    if (!match) continue;
+    const question = known.get(match[1].trim());
+    if (question) answers[question] = match[2].trim();
+  }
+  if (Object.keys(answers).length) return answers;
+  const only = questions.length === 1 ? questions[0] : void 0;
+  const flat = message.trim();
+  return only && flat ? { [only.question]: flat } : {};
+}
+
+// server/permission-proxy.ts
 var socketPath = process.argv[2] ?? "";
 var waiting = /* @__PURE__ */ new Map();
 var conn = connect(socketPath);
@@ -32,6 +106,40 @@ conn.on("data", (chunk) => {
   }
 });
 var send = (obj) => process.stdout.write(JSON.stringify(obj) + "\n");
+function askBroker(ask) {
+  return new Promise((resolve) => {
+    waiting.set(String(ask.id), resolve);
+    if (conn.destroyed) return dead();
+    try {
+      conn.write(JSON.stringify(ask) + "\n");
+    } catch {
+      dead();
+    }
+  });
+}
+var ASK_USER_QUESTION = "AskUserQuestion";
+var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+async function answerNativeQuestions(input) {
+  const questions = parseAskQuestions(input);
+  if (!questions?.length) {
+    return JSON.stringify({
+      behavior: "deny",
+      message: "OpenMausBot: this AskUserQuestion call had no answerable question (each one needs question text), so nobody was shown it. Ask again with a well-formed call, or continue without it."
+    });
+  }
+  const answer = await askBroker({
+    t: "ask",
+    id: randomUUID(),
+    kind: "question",
+    tool: ASK_USER_QUESTION,
+    input: { questions }
+  });
+  if (answer.behavior === "deny") {
+    return JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
+  }
+  const answers = answer.source === "user" && typeof answer.message === "string" ? questionAnswersByQuestion(answer.message, questions) : {};
+  return JSON.stringify({ behavior: "allow", updatedInput: { ...asRecord(input), answers } });
+}
 var TOOLS = [
   {
     name: "approve",
@@ -79,30 +187,27 @@ async function handle(msg) {
   if (msg.method === "tools/call") {
     const name = msg.params?.name;
     const args = msg.params?.arguments ?? {};
+    const reply = (text3) => send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text: text3 }] } });
+    if (name === "approve" && args.tool_name === ASK_USER_QUESTION) {
+      return reply(await answerNativeQuestions(args.input));
+    }
     const askId = randomUUID();
     const isQuestion = name === "ask_user";
     const suggestions = Array.isArray(args.permission_suggestions) ? args.permission_suggestions : Array.isArray(args.suggestions) ? args.suggestions : null;
-    const answer = await new Promise((resolve) => {
-      waiting.set(askId, resolve);
-      if (conn.destroyed) return dead();
-      const ask = isQuestion ? { t: "ask", id: askId, kind: "question", tool: "ask_user", input: { question: args.question, choices: args.choices } } : { t: "ask", id: askId, tool: args.tool_name, input: args.input };
-      try {
-        conn.write(JSON.stringify(ask) + "\n");
-      } catch {
-        dead();
-      }
-    });
-    let text = answer.message || "No answer was given \u2014 use your best judgment.";
+    const answer = await askBroker(
+      isQuestion ? { t: "ask", id: askId, kind: "question", tool: "ask_user", input: { question: args.question, choices: args.choices } } : { t: "ask", id: askId, tool: args.tool_name, input: args.input }
+    );
+    let text2 = answer.message || "No answer was given \u2014 use your best judgment.";
     if (!isQuestion) {
       if (answer.behavior === "allow") {
         const result = { behavior: "allow", updatedInput: args.input ?? {} };
         if (answer.always && suggestions) result.updatedPermissions = suggestions;
-        text = JSON.stringify(result);
+        text2 = JSON.stringify(result);
       } else {
-        text = JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
+        text2 = JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
       }
     }
-    return send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text }] } });
+    return reply(text2);
   }
   if (String(msg.method ?? "").startsWith("notifications/")) return;
   if (msg.id != null) {

package/dist-server/server/agent-tool-policy.js

@@ -6,6 +6,7 @@
  */
 export const READ_ONLY_AGENT_TOOL_NAMES = new Set([
     "list_bots",
+    "list_team_setup",
     "list_rooms",
     "list_threads",
     "check_delegation",

package/dist-server/server/atomic.js

@@ -6,6 +6,42 @@
 // that fails to parse on next boot and is silently treated as empty state.
 import { randomUUID } from "node:crypto";
 import { closeSync, fsyncSync, openSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+/** Windows refuses a rename onto an existing path while anything else holds a
+ * handle to either file, and a virus scanner or the search indexer opening a
+ * just-closed file for a few milliseconds is enough. It surfaces as EPERM or
+ * EACCES from an operation that is correct and would succeed a moment later —
+ * so it is retried rather than reported. Everything else throws immediately;
+ * a real permission problem must not be papered over by a busy-wait.
+ *
+ * Total worst case is ~155 ms across 6 attempts. Kept synchronous because
+ * every caller is a synchronous save path, and making one of them async is a
+ * much larger change than this bug warrants.
+ *
+ * ponytail: fixed backoff, no jitter. If contention turns out to be heavy
+ * enough that these collide, jitter it then. */
+const RENAME_RETRY_DELAYS_MS = [5, 10, 20, 40, 80];
+const RETRYABLE_RENAME_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+function sleepSync(ms) {
+    // No synchronous sleep in Node without a syscall: a zero-length read on a
+    // shared array with a timeout is the standard trick and does not spin the CPU.
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/** `rename` is injectable for tests only — there is no portable way to make a
+ * real filesystem produce a transient EPERM on demand. */
+export function renameWithRetry(tmp, path, rename = renameSync) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            rename(tmp, path);
+            return;
+        }
+        catch (e) {
+            const code = e.code;
+            if (!code || !RETRYABLE_RENAME_CODES.has(code) || attempt >= RENAME_RETRY_DELAYS_MS.length)
+                throw e;
+            sleepSync(RENAME_RETRY_DELAYS_MS[attempt]);
+        }
+    }
+}
 export function writeFileAtomic(path, data, options = {}) {
     const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
     let fd = null;
@@ -18,7 +54,7 @@ export function writeFileAtomic(path, data, options = {}) {
         fsyncSync(fd);
         closeSync(fd);
         fd = null;
-        renameSync(tmp, path);
+        renameWithRetry(tmp, path);
     }
     catch (e) {
         if (fd !== null) {

package/dist-server/server/auto-approve.js

@@ -17,7 +17,22 @@ export function approvalModeForOrigin(mode, origin) {
         return "auto";
     return mode;
 }
+// Tools that ask a PERSON something. A question exists so that a human
+// decides; any mode answering one on their behalf defeats the only reason
+// it was asked. They normally arrive typed as questions and never reach a
+// verdict at all — this is the backstop for the path where one arrives
+// mis-typed as a permission (a malformed AskUserQuestion call falls back to
+// the permission path in permission-proxy). Approving it there does not
+// produce an answer: the CLI runs the tool with none and the model is told
+// "The user did not answer the questions." — a question silently lost.
+const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user"]);
 export function autoVerdict(mode, tool, context) {
+    // A question is for a person, whatever channel it arrived on — and
+    // whatever the mode: even Full has no answer to give, only an approval
+    // that would run the tool with none.
+    if (ASKS_A_PERSON.has(tool.replace(/^mcp__[^_]+__/, "").toLowerCase())) {
+        return { approve: null, source: "no-grant" };
+    }
     // Full's promise is literal: even a sandbox widening is approved. Entering
     // Full is separately consent-gated by the bot PATCH endpoint, and the
     // request.opened caller invokes this for permissions only, never questions.

package/dist-server/server/bot-overview.js

@@ -159,10 +159,14 @@ function reachesLines(facts) {
     if (facts.browserEnabled && facts.engine?.browserMcp && facts.bot.browser !== false && facts.bot.computer !== "off")
         lines.push("Has the built-in browser.");
     if (facts.engine?.agentsMcp && facts.sectionPeers > 0 && facts.bot.peers?.length !== 0) {
-        lines.push(`Can talk to ${facts.sectionPeers} other bot${facts.sectionPeers === 1 ? "" : "s"} in its section.`);
+        const scope = facts.bot.chiefOfStaff && facts.bot.managedSections?.length ? "its allowed teams" : "its section";
+        lines.push(`Can talk to ${facts.sectionPeers} other bot${facts.sectionPeers === 1 ? "" : "s"} in ${scope}.`);
     }
     if (facts.bot.chiefOfStaff)
         lines.push("Coordinates its section as Chief of Staff.");
+    if (facts.bot.chiefOfStaff && facts.bot.managedSections?.length) {
+        lines.push(`May also coordinate these teams: ${facts.bot.managedSections.map(name => name || "General").join(", ")}.`);
+    }
     return lines;
 }
 function wontLines(facts) {

package/dist-server/server/chief-of-staff.js

@@ -1,4 +1,4 @@
-import { renderRoster, reachablePeers } from "./peer-roster.js";
+import { peerName, renderRoster, reachablePeers } from "./peer-roster.js";
 // The Chief's roster stays wider than an ordinary bot's (peer-roster.ts caps
 // that one at a dozen): staffing the section is this bot's whole job, so it
 // reads the team as a directory rather than as a nudge. The field-level caps
@@ -9,10 +9,10 @@ const sectionKey = (section) => section?.trim() || "";
 /** Dynamic system context for a section's Chief of Staff.
  * It names the current team on every turn, while list_bots remains the
  * authoritative tool for IDs and live availability at delegation time. */
-export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpenMausStatus = "") {
+export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpenMausStatus = "", boundedCoordination = false) {
     const chief = bots.find((bot) => bot.id === chiefId);
     const chiefSection = sectionKey(chief?.section);
-    const sectionName = chiefSection || "General";
+    const sectionName = peerName(chiefSection) || "General";
     // A Chief with its own allow-list is bound by it here too: the roster and
     // the endpoints must agree, or the prompt names teammates the tools will
     // then refuse to reach.
@@ -28,21 +28,26 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
         about: true,
     });
     const delegation = canDelegate
-        ? [
-            "Use list_bots to confirm the live roster and IDs. When assigning work to a teammate, use delegate_bot: it returns immediately, keeps you available to the user, and delivers the teammate's outcome back into this conversation automatically — success or failure. When the result arrives you are woken with it: report it to the user and act. If the teammate fails or stalls, tell the user plainly and decide the next step yourself.",
-            "After delegate_bot accepts the task, acknowledge the handoff and continue with any independent work or end your turn. Do not call wait_delegation or repeatedly poll check_delegation in the same turn.",
-            "Use ask_bot only for a brief consultation whose answer you must have before writing your current response. Never use ask_bot for an assigned task, background work, or anything potentially long-running.",
-            "When the user asks you to assemble a team, use create_bot for each genuinely useful specialist. Give each one a clear role and instructions, then use delegate_bot to assign its work. Do not create duplicate or unnecessary bots.",
-            "Delegate with a clear, self-contained brief. Say that the task is assigned, not completed; only claim completion after the teammate's result has actually arrived.",
-            "You may assign work to more than one teammate when the request genuinely benefits. Stay responsive while they work, then combine their returned results when the user asks for a synthesis.",
-        ].join(" ")
+        ? boundedCoordination
+            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Outside a room, each assignment gets a separate conversation using the recipient's own model and permissions. Busy teammates queue. Give self-contained briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran."
+            : [
+                "Use list_bots to confirm the live roster and IDs. When assigning work to a teammate, use delegate_bot: it returns immediately, keeps you available to the user, and delivers the teammate's outcome back into this conversation automatically — success or failure. When the result arrives you are woken with it: report it to the user and act. If the teammate fails or stalls, tell the user plainly and decide the next step yourself.",
+                "After delegate_bot accepts the task, acknowledge the handoff and continue with any independent work or end your turn. Do not call wait_delegation or repeatedly poll check_delegation in the same turn.",
+                "Use ask_bot only for a brief consultation whose answer you must have before writing your current response. Never use ask_bot for an assigned task, background work, or anything potentially long-running.",
+                "Delegate with a clear, self-contained brief. Say that the task is assigned, not completed; only claim completion after the teammate's result has actually arrived.",
+                "You may assign work to more than one teammate when the request genuinely benefits. Stay responsive while they work, then combine their returned results when the user asks for a synthesis.",
+            ].join(" ")
         : "Your current engine cannot contact teammates. Be honest about that limitation and ask the user to choose a delegation-compatible engine before promising coordinated work.";
     return [
         `You are the Chief of Staff for the ${sectionName} section. You are the user's primary contact for this section's team of bots.`,
+        chief?.managedSections?.length
+            ? `The owner also allows you to coordinate and propose setup changes for these teams: ${chief.managedSections.map(s => peerName(s) || "General").join(", ")}. You remain the user's single point of contact. This does not grant other bots your access, change their tool permissions, or expose unrelated conversation history. Use list_bots for the actual reachable roster.`
+            : "",
         "Own the outcome: understand the request, decide what to handle yourself, coordinate the right specialists when useful, and return one concise consolidated answer.",
         "Do not delegate trivial work merely to appear busy. Never invent a teammate's progress or result. Normal permission and approval rules still apply.",
         delegation,
-        `Current ${sectionName} section team:`,
+        canDelegate ? "When the user asks you to assemble or configure a team, use list_team_setup for the exact authorized teams, bot IDs and model catalog, then propose_team_setup once with all named specialists and their profile/model changes. Include new teams explicitly; the combined card reviews their creation and your access. Existing thread models stay unchanged. End your turn after the proposal: the user's decision automatically resumes you once with a structured result. Do not ask for another yes, poll, or repeat the proposal. After successful setup, use the available coordination tools for already requested work. Use create_bot only for a single specialist when no combined setup was requested. For explicitly requested bot deletion, use propose_bot_deletion separately. Do not create duplicate or unnecessary bots." : "",
+        chief?.managedSections?.length ? "Reachable teammates in your allowed teams:" : `Current ${sectionName} section team:`,
         roster,
         trustedOpenMausStatus,
     ].filter(Boolean).join("\n");