openmausbot 0.1.76 → 0.1.77

package/dist-server/server/tool-summary.js

@@ -1,7 +1,59 @@
 // What a tool call is about to do, in words a chip or a permission card can
 // show. Redacted before it is cut: a command line is where credentials get
 // pasted, and a key sliced in half would slip past the shapes redaction knows.
-import { redactSecretsInText } from "./redact.js";
+import { redactSecrets, redactSecretsInText } from "./redact.js";
+/** Display-only excerpt, never the raw protocol payload. Bound traversal and
+ * omit binary bodies before redacting; truncate only AFTER redaction so a
+ * credential cannot be cut in half and escape detection. */
+export function toolDetailPreview(value) {
+    if (value === undefined)
+        return undefined;
+    let budget = 200;
+    let textBudget = 256_000;
+    const bounded = (item, depth = 0) => {
+        if (--budget < 0 || depth > 6)
+            return "[additional data omitted]";
+        if (typeof item === "string") {
+            if (item.length > textBudget)
+                return "[large content omitted]";
+            if (/^data:[^,\s]+;base64,/i.test(item))
+                return "[binary content omitted]";
+            // MCP frequently puts JSON inside text content. Recover its field
+            // names so short credentials get the same masking as native objects.
+            if (/^\s*[[{]/.test(item)) {
+                try {
+                    return bounded(JSON.parse(item), depth + 1);
+                }
+                catch { /* ordinary text/code: use the content redactor below */ }
+            }
+            textBudget -= item.length;
+            return item;
+        }
+        if (typeof item === "bigint")
+            return String(item);
+        if (item === null || typeof item !== "object")
+            return item;
+        if (Array.isArray(item))
+            return item.slice(0, 40).map((child) => bounded(child, depth + 1)).concat(item.length > 40 ? ["[additional items omitted]"] : []);
+        const entries = Object.entries(item);
+        const result = Object.create(null);
+        for (const [key, child] of entries.slice(0, 40)) {
+            result[key] = /token|secret|password|passwd|cookie|authorization|api.?key|(^|[_.-])keys?$/i.test(key)
+                ? "[redacted]"
+                : /^(data|base64|blob)$/i.test(key) && typeof child === "string"
+                    ? "[binary content omitted]"
+                    : bounded(child, depth + 1);
+        }
+        if (entries.length > 40)
+            result["…"] = "[additional fields omitted]";
+        return result;
+    };
+    const safe = redactSecrets(bounded(value));
+    const text = typeof safe === "string" ? safe : JSON.stringify(safe, null, 2);
+    if (!text?.trim() || text === "{}" || text === "[]")
+        return undefined;
+    return text.length > 6_000 ? `${text.slice(0, 6_000)}\n[… preview shortened]` : text;
+}
 const QUESTION_LIMIT = 300;
 const LIMIT = 200;
 function fieldsOf(input) {

package/dist-server/server/workspace-backup.js

@@ -23,6 +23,7 @@ const ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}
 const EXCLUDED = new Set([
     ".backups", "tools", "cache", ".cache", "tmp", ".tmp", "dist-native", "tunnel-runtime",
     ".openmausbot-server-child", "environment-id", "sessions.json", "tunnel-account.json",
+    "team-computers.json",
     "openmausbot-server.lease", "box-create-requests.lock", "messages.db-wal", "messages.db-shm",
 ]);
 const EXCLUSION_NOTES = [

package/dist-server/shared/approval-mode.js

@@ -34,7 +34,10 @@ export function isApprovalMode(value) {
  * behavior: autoApprove=true is safe Auto; everything else asks. Unknown
  * persisted values also fail closed to that legacy behavior. */
 export function approvalModeFor(bot) {
-    if (bot.approvalGrant)
+    const grant = bot.approvalGrant;
+    const otherThread = grant && typeof grant === "object" && "threadOnly" in grant && grant.threadOnly === true &&
+        "threadId" in grant && typeof grant.threadId === "string" && typeof bot.threadId === "string" && grant.threadId !== bot.threadId;
+    if (grant && !otherThread)
         return "ask";
     if (isApprovalMode(bot.approvalMode))
         return bot.approvalMode;

package/dist-server/shared/team-computer.js

@@ -0,0 +1 @@
+export {};

package/dist-server/vps-container-mcp.js

@@ -15112,7 +15112,11 @@ var featureConfigSchema = external_exports.object({
   showToolCalls: external_exports.boolean().optional(),
   /** Experimental built-in browser. Off until explicitly enabled; each bot
    * also has its own switch. */
-  browser: external_exports.boolean().optional()
+  browser: external_exports.boolean().optional(),
+  /** Opt-in computer sharing (a desktop lending folders, a terminal or
+   * computer control to a workspace). Off until explicitly enabled; there is
+   * no Settings toggle — see sharedComputersEnabled. */
+  sharedComputers: external_exports.boolean().optional()
 });
 var onboardingConfigSchema = external_exports.object({
   /** ISO timestamp of finishing (or skipping to the end of) the welcome flow. */

package/enterprise/README.md

@@ -23,8 +23,11 @@ customer, because the key decides the feature set rather than the code.
 { "edition": "oss", "features": [], "notice": "OMB_LICENSE_KEY expired on 2027-09-02; renew it to keep enterprise features" }
 ```
 
-A missing, altered, or expired key never stops the server: it runs the
-open-source edition and the notice says what to fix.
+A missing, altered, or expired key does not stop an ordinary standalone
+server: it runs the open-source edition and the notice says what to fix.
+A workspace explicitly configured for hosted sign-in fails closed for remote
+access when its `admin` entitlement or identity service is unavailable. It
+must not silently fall back to standalone email or pairing credentials.
 
 ## Entitlement ids
 
@@ -32,7 +35,7 @@ open-source edition and the notice says what to fix.
 |---|---|
 | `whitelabel` | product name, tagline, accent colour, logo, favicon and support link from `brand.json` (below) |
 | `sso` | identity-header trust behind an OIDC proxy |
-| `admin` | the admin panel routes |
+| `admin` | Settings → Workspaces and the optional hosted workspace sign-in adapter |
 | `budgets` | per-bot and per-section spend limits |
 
 Core gates a feature with `entitled("id")` from `server/enterprise.ts`.
@@ -59,6 +62,21 @@ working until they expire.
 - Customer-specific brand, skills, packages, connectors? The customer's own
   repo: data and config, never a fork.
 
+## Hosted workspace sign-in (`admin`)
+
+The workspace-side adapter in `server/workspace-access.ts` connects to an
+independently deployed identity service over HTTPS. The service's console,
+invitations, provider gateway and deployment automation are not shipped in
+this repository. The desktop and ordinary self-hosted server do not start
+or depend on a hosted console.
+
+Operators opt a workspace into this protocol using `OMB_ADMIN_URL`,
+`OMB_ADMIN_WORKSPACE` and `OMB_PUBLIC_URL`; a valid `admin` entitlement is
+required. The default keeps the local sign-in allow-list as an additional,
+narrowing check. Operators may explicitly delegate membership for verified
+portal sessions with `OMB_ADMIN_MEMBERSHIP=portal`; this never exempts ordinary
+email or pairing sessions. See the [protocol and isolated verification recipe](../docs/verification/hosted-workspaces.md).
+
 ## White-label (`whitelabel`)
 
 Put a `brand.json` in the server's data dir (`OMB_DATA_DIR`, the `/data`