openmausbot 0.1.84 → 0.1.86

package/dist-server/server/drivers/openai-compat.js

@@ -28,9 +28,12 @@ function decodeConfig(raw) {
     const config = (raw ?? {});
     if (config.tools !== undefined && typeof config.tools !== "boolean")
         throw new Error("tools must be a boolean");
+    if (config.managedModels !== undefined && (!Array.isArray(config.managedModels) || !config.managedModels.length || config.managedModels.some(model => typeof model !== "string" || !model.trim())))
+        throw new Error("Invalid managed models.");
     const envUrl = process.env.OPENAI_COMPAT_URL;
     return {
         ...(config.tools !== undefined ? { tools: config.tools } : {}),
+        ...(config.managedModels ? { managedModels: config.managedModels } : {}),
         url: (typeof config.url === "string" && config.url ? config.url : envUrl || "https://openrouter.ai/api/v1")
             .replace(/\/+$/, ""),
         apiKeyEnv: typeof config.apiKeyEnv === "string" && config.apiKeyEnv
@@ -74,15 +77,19 @@ export const OpenAICompatDriver = {
             process.env[config.apiKeyEnv] ??
             process.env.OPENAI_COMPAT_API_KEY ??
             "";
-        let catalog = config.model
-            ? {
-                default: config.model,
-                options: DEFAULT_MODELS.options.some((model) => model.id === config.model)
-                    ? DEFAULT_MODELS.options
-                    : [{ id: config.model, label: config.model, custom: true }, ...DEFAULT_MODELS.options],
-            }
-            : DEFAULT_MODELS;
+        let catalog = config.managedModels
+            ? { default: config.managedModels[0], options: config.managedModels.map(id => ({ id, label: id })) }
+            : config.model
+                ? {
+                    default: config.model,
+                    options: DEFAULT_MODELS.options.some((model) => model.id === config.model)
+                        ? DEFAULT_MODELS.options
+                        : [{ id: config.model, label: config.model, custom: true }, ...DEFAULT_MODELS.options],
+                }
+                : DEFAULT_MODELS;
         const fetchModels = async () => {
+            if (config.managedModels)
+                return;
             if (!apiKey)
                 return;
             try {
@@ -132,6 +139,7 @@ export const OpenAICompatDriver = {
                 model,
                 messages,
                 stream,
+                stream_options: stream ? { include_usage: true } : undefined,
                 ...(config.provider && isOpenRouterUrl(config.url)
                     ? { provider: { order: [config.provider], allow_fallbacks: false } }
                     : {}),

package/dist-server/server/enterprise.js

@@ -8,10 +8,11 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 // Neutral hook point for the source-available enterprise layer.
 //
-// The layer lives in ../enterprise (its own LICENSE) and is loaded only if that
+// The layer lives in enterprise/ (its own LICENSE) and is loaded only if that
 // folder is present: delete it and this file still compiles, the server still
 // starts, and /api/edition reports the open-source edition. Core never imports
-// the layer statically, so the bundle and the packaged app carry no trace of it.
+// the layer statically; a build ships it as its own bundled file beside the
+// server (see enterpriseLayerDirs for where it is looked up).
 // The layer's only obligation is `register()`, which turns OMB_LICENSE_KEY into
 // entitlements; core keeps the resulting status and answers `entitled()`.
 import { existsSync } from "node:fs";
@@ -25,7 +26,28 @@ const layerSchema = z.object({
     features: z.array(z.string().min(1)),
     expiresAt: z.string().nullable(),
 });
-const DEFAULT_DIR = join(SERVER_ROOT, "..", "enterprise");
+/** Days before expiry that the startup log, /api/edition and Settings start
+ * saying so, and days after it that the features keep working while the
+ * operator renews. The key and its verification are unchanged: the layer
+ * accepts a key that expired less than the grace period ago. */
+export const LICENSE_WARN_DAYS = 30;
+export const LICENSE_GRACE_DAYS = 7;
+const DAY_MS = 24 * 60 * 60_000;
+/** Where the layer may be, in order. An explicit OMB_ENTERPRISE_DIR is the
+ * only place looked at when set. Otherwise: beside the server root (a
+ * checkout, where server/ and enterprise/ are siblings, and the npm package,
+ * which copies the bundled layer to <package>/enterprise), then inside it
+ * (the Docker image and the packaged desktop ship dist-server/ alone, and
+ * scripts/bundle-server.mjs writes the layer to dist-server/enterprise). */
+export function enterpriseLayerDirs(env = process.env, serverRoot = SERVER_ROOT) {
+    if (env.OMB_ENTERPRISE_DIR)
+        return [env.OMB_ENTERPRISE_DIR];
+    return [join(serverRoot, "..", "enterprise"), join(serverRoot, "enterprise")];
+}
+/** Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts. */
+function layerEntry(dir) {
+    return [join(dir, "server", "index.ts"), join(dir, "server", "index.js")].find((candidate) => existsSync(candidate));
+}
 let current = { edition: "oss", features: [] };
 let workspaceAccessFactory;
 export function hostedWorkspaceConfigured(env = process.env) {
@@ -53,6 +75,26 @@ export function hostedWorkspaceConfiguration(env = process.env) {
         return null;
     }
 }
+/** Who decides who may use this workspace, for Settings → People and
+ * Remote access. On a portal-membership workspace the organisation's Admin
+ * does, and `peopleUrl` opens its People page for this workspace (identifiers
+ * only; Admin authorizes its own visitor). A hosted workspace never issues
+ * pairing codes or email sign-in: people come in through the portal. */
+export function workspaceMembership(env = process.env) {
+    const hosted = hostedWorkspaceConfiguration(env);
+    const pairingCodes = !hostedWorkspaceConfigured(env);
+    if (!hosted?.portalMembership)
+        return { authority: "local", pairingCodes };
+    const people = new URL("/people", hosted.admin);
+    people.search = new URLSearchParams({ workspace: hosted.workspace }).toString();
+    return { authority: "portal", pairingCodes, peopleUrl: people.href };
+}
+/** An operator may authorize new Full tasks only on a dedicated,
+ * portal-managed server. This is not an HTTP setting or a desktop grant. */
+export function sharedWorkspaceFullAccessConfigured(env = process.env) {
+    return env.OMB_SHARED_WORKSPACE_FULL_ACCESS === "1" && env.OMB_DESKTOP_PARENT !== "1" &&
+        hostedWorkspaceConfiguration(env)?.portalMembership === true;
+}
 /** No enterprise import or portal dependency enters the core bundle. A
  * configured server without this hook must refuse hosted access, not fall
  * back to legacy email or QR credentials. */
@@ -69,12 +111,11 @@ function oss(notice) {
  * degrades to the open-source edition with a notice that says what to fix. */
 export async function loadEnterpriseLayer(options = {}) {
     workspaceAccessFactory = undefined;
-    const dir = options.dir ?? process.env.OMB_ENTERPRISE_DIR ?? DEFAULT_DIR;
+    const dirs = options.dir ? [options.dir] : enterpriseLayerDirs(options.env, options.serverRoot);
     const licenseKey = options.licenseKey ?? process.env.OMB_LICENSE_KEY;
-    // Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts.
-    const entry = [join(dir, "server", "index.ts"), join(dir, "server", "index.js")].find((candidate) => existsSync(candidate));
+    const entry = dirs.map(layerEntry).find((candidate) => candidate !== undefined);
     if (!entry) {
-        return oss(licenseKey ? `OMB_LICENSE_KEY is set but no enterprise layer exists at ${dir}` : undefined);
+        return oss(licenseKey ? `OMB_LICENSE_KEY is set but no enterprise layer exists at ${dirs.join(" or ")}` : undefined);
     }
     try {
         const loaded = await import(__rewriteRelativeImportExtension(pathToFileURL(entry).href));
@@ -86,7 +127,9 @@ export async function loadEnterpriseLayer(options = {}) {
             throw new Error(`${entry} does not export register()`);
         if (!licenseKey)
             return oss("enterprise layer present but OMB_LICENSE_KEY is not set");
-        const registered = await register({ licenseKey });
+        // graceDays is additive: a layer that ignores it refuses an expired key
+        // at startup exactly as before.
+        const registered = await register({ licenseKey, graceDays: LICENSE_GRACE_DAYS });
         const layer = layerSchema.parse(registered);
         current = {
             edition: "enterprise",
@@ -100,27 +143,65 @@ export async function loadEnterpriseLayer(options = {}) {
         return oss(`enterprise layer disabled: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/** When the key stops being valid, or null for perpetual / open-source. */
+function expiryAt() {
+    if (current.edition !== "enterprise" || !current.expiresAt)
+        return null;
+    const at = new Date(current.expiresAt).getTime();
+    return Number.isFinite(at) ? at : null;
+}
 /** A license that expires while the server keeps running stops granting
- * features at that moment, not at the next restart. */
+ * features once its grace period ends, at that moment, not at the next restart. */
 function expired(now) {
-    if (current.edition !== "enterprise" || !current.expiresAt)
-        return false;
-    return now >= new Date(current.expiresAt).getTime();
+    const at = expiryAt();
+    return at !== null && now >= at + LICENSE_GRACE_DAYS * DAY_MS;
 }
 export function editionStatus(now = Date.now()) {
-    if (!expired(now))
+    const at = expiryAt();
+    if (at === null)
         return current;
+    if (expired(now)) {
+        return {
+            edition: "oss",
+            features: [],
+            notice: `enterprise layer disabled: OMB_LICENSE_KEY expired on ${current.expiresAt}; renew it to keep enterprise features`,
+        };
+    }
+    const expiresInDays = Math.ceil((at - now) / DAY_MS);
+    if (now < at)
+        return { ...current, expiresInDays };
+    const graceEndsAt = new Date(at + LICENSE_GRACE_DAYS * DAY_MS).toISOString().slice(0, 10);
     return {
-        edition: "oss",
-        features: [],
-        notice: `enterprise layer disabled: OMB_LICENSE_KEY expired on ${current.expiresAt}; renew it to keep enterprise features`,
+        ...current,
+        expiresInDays,
+        graceEndsAt,
+        notice: `OMB_LICENSE_KEY expired on ${current.expiresAt}; enterprise features keep working until ${graceEndsAt} while it is renewed`,
     };
 }
+/** The edition as a non-admin session sees it: what is entitled, without
+ * the license's countdown, grace date or operator notice. */
+export function editionForMembers(status) {
+    const { expiresInDays: _days, graceEndsAt: _grace, notice: _notice, ...shared } = status;
+    return shared;
+}
 /** Feature gates in core ask this and nothing else. Unknown ids are simply not
  * granted, and the open-source edition always carries an empty feature list. */
 export function entitled(feature, now = Date.now()) {
     return !expired(now) && current.features.includes(feature);
 }
+/** The startup warning for a key that is about to lapse or already in its
+ * grace period; null when there is nothing to say. */
+export function licenseWarning(status) {
+    if (status.edition !== "enterprise" || !status.expiresAt || status.expiresInDays === undefined)
+        return null;
+    if (status.graceEndsAt) {
+        return `OMB_LICENSE_KEY expired on ${status.expiresAt}; enterprise features keep working until ${status.graceEndsAt} — renew the key before then`;
+    }
+    if (status.expiresInDays > LICENSE_WARN_DAYS)
+        return null;
+    const days = status.expiresInDays === 1 ? "1 day" : `${status.expiresInDays} days`;
+    return `OMB_LICENSE_KEY expires on ${status.expiresAt} (in ${days}); renew it before then to keep enterprise features`;
+}
 /** One line for the startup log. */
 export function describeEdition(status) {
     if (status.edition === "enterprise") {

package/dist-server/server/external-runtime.js

@@ -0,0 +1,83 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+const MAX_FILE_BYTES = 1_048_576;
+const ID = /^[\w-]{1,128}$/;
+const fingerprint = (token) => createHash("sha256").update(token).digest("hex");
+const sameFingerprint = (left, right) => {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+};
+/** Read a bounded regular file through the descriptor whose permissions we
+ * checked. A pipe must not block the request loop, nor a pathname swap replace
+ * the checked file before the read. */
+function registrations(file) {
+    let fd;
+    try {
+        fd = openSync(file, constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK));
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_FILE_BYTES)
+            return [];
+        if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) {
+            console.warn("[comms] ignoring external runtime credentials: use a private file (chmod 600)");
+            return [];
+        }
+        const bytes = Buffer.alloc(stat.size + 1);
+        let count = 0;
+        for (;;) {
+            const read = readSync(fd, bytes, count, bytes.length - count, null);
+            if (!read)
+                break;
+            count += read;
+            if (count > stat.size)
+                return []; // changed while being read
+        }
+        const parsed = JSON.parse(bytes.subarray(0, count).toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return [];
+        return Object.entries(parsed).flatMap(([botId, value]) => {
+            if (!ID.test(botId) || !value || typeof value !== "object" || Array.isArray(value))
+                return [];
+            const { token, threadId } = value;
+            if (typeof token !== "string" || token.length < 32 || token.length > 4096 || /\s/.test(token))
+                return [];
+            if (typeof threadId !== "string" || !ID.test(threadId))
+                return [];
+            return [{ botId, tokenHash: fingerprint(token), threadId }];
+        });
+    }
+    catch {
+        return [];
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function resolveRegistration(file, tokenHash, botForId) {
+    const matches = registrations(file).filter(entry => sameFingerprint(entry.tokenHash, tokenHash));
+    // A copied secret must not select a different bot based on JSON key order.
+    if (matches.length !== 1)
+        return null;
+    const registration = matches[0];
+    const bot = botForId(registration.botId);
+    if (!bot || bot.hidden)
+        return null;
+    // There is no durable "main thread": bot.threadId is the UI selection and
+    // new tasks are prepended. Every grant needs an explicit binding.
+    const task = bot.tasks?.find(candidate => candidate.threadId === registration.threadId);
+    if (!task || task.archivedAt !== undefined)
+        return null;
+    return { botId: bot.id, threadId: task.threadId, tokenHash };
+}
+export function authorizeExternalRuntime(file, header, botForId) {
+    if (typeof header !== "string" || !/^Bearer \S{32,4096}$/.test(header))
+        return null;
+    return resolveRegistration(file, fingerprint(header.slice(7)), botForId);
+}
+/** Re-check after every body/approval/poll wait. The captured identity is not
+ * a lease: token rotation, rebinding, deletion and archive take effect now. */
+export function externalRuntimeIsActive(file, grant, botForId) {
+    const current = resolveRegistration(file, grant.tokenHash, botForId);
+    return current?.botId === grant.botId && current.threadId === grant.threadId;
+}

package/dist-server/server/guarded-requests.js

@@ -0,0 +1,60 @@
+export function requestConflict(message = "The request no longer owns this conversation") {
+    return Object.assign(new Error(message), { status: 409, code: "guarded_request_changed" });
+}
+export function assertRequestTarget(current, expected) {
+    if (current.messageId !== expected.messageId || current.activeLeafId !== expected.expectedActiveLeafId ||
+        current.activeTurnId !== expected.expectedTurnId || current.executionId !== expected.expectedExecutionId)
+        throw requestConflict();
+}
+/** Never infer ownership from timestamps or the latest assistant text. */
+export function guardedRequestPath(messages, activeLeafId, sendId) {
+    const sources = messages.filter(message => message.sendId === sendId);
+    const source = sources[0];
+    if (sources.length !== 1 || !source || source.role !== "user" || source.kind !== "text" || source.steered || source.peerAsk) {
+        throw requestConflict("No unique acknowledged user request matches this sendId");
+    }
+    const byId = new Map(messages.map(message => [message.id, message]));
+    const path = [];
+    const seen = new Set();
+    let id = activeLeafId;
+    while (id) {
+        if (seen.has(id))
+            throw requestConflict();
+        seen.add(id);
+        const message = byId.get(id);
+        if (!message)
+            throw requestConflict();
+        path.unshift(message);
+        if (message.id === source.id)
+            break;
+        if (path.length >= 500)
+            throw Object.assign(new Error("Open this request in the workspace; its transcript exceeds the response limit"), { status: 413 });
+        id = message.parentId ?? null;
+    }
+    if (path[0]?.id !== source.id || path.slice(1).some(message => message.role === "user"))
+        throw requestConflict();
+    // An abandoned sibling can hold a detached result or approval. A caller
+    // must never receive it as the answer to the current branch.
+    const ancestors = new Set(path.map(message => message.id));
+    if (messages.some(message => message.parentId && ancestors.has(message.parentId) && !seen.has(message.id)))
+        throw requestConflict();
+    return path;
+}
+/** Used only for an explicit control-plane card, never the latest user. */
+export function requestSourceForCard(messages, messageId) {
+    const byId = new Map(messages.map(message => [message.id, message]));
+    const seen = new Set();
+    let message = byId.get(messageId);
+    while (message && !seen.has(message.id)) {
+        seen.add(message.id);
+        if (message.role === "user")
+            return message.peerAsk || message.steered || message.requestCancelled ? undefined : message.id;
+        message = message.parentId ? byId.get(message.parentId) : undefined;
+    }
+    return undefined;
+}
+export function requestNeedsInput(message) {
+    return Boolean((message.card?.requestId && !message.card.answered && !message.card.dismissed) ||
+        (message.connector && !message.connector.dismissed && !message.connector.resumed && message.connector.status !== "connected") ||
+        (message.secret && !message.secret.provided && !message.secret.dismissed));
+}

package/dist-server/server/harness/http.js

@@ -0,0 +1,61 @@
+const jsonHooks = new WeakMap();
+const parsedBodies = new WeakMap();
+/** Pass every JSON body sent on this response through `hook` first (it may
+ * return a narrowed copy). Set once a request is authenticated: index.ts
+ * narrows what a member is sent and notes what an admin change answered.
+ * Hooks added later run after earlier ones. */
+export function onJsonBody(res, hook) {
+    const previous = jsonHooks.get(res);
+    jsonHooks.set(res, previous ? (body) => hook(previous(body)) : hook);
+}
+/** The JSON body readBody parsed for this request, if it read one. */
+export function parsedBodyOf(req) {
+    return parsedBodies.get(req);
+}
+export function json(res, status, body) {
+    const hook = jsonHooks.get(res);
+    const data = JSON.stringify(hook ? hook(body) : body);
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(data);
+}
+export function readBody(req, limit = 1_000_000) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        let bytes = 0;
+        let done = false;
+        const fail = (status, msg) => {
+            if (done)
+                return;
+            done = true;
+            const err = Object.assign(new Error(msg), { status });
+            reject(err);
+        };
+        req.on("data", (c) => {
+            if (done)
+                return;
+            bytes += typeof c === "string" ? Buffer.byteLength(c) : c.length;
+            if (bytes > limit) {
+                // Keep draining the socket, but stop retaining attacker-controlled
+                // bytes. Destroying the request here prevents the caller from
+                // receiving the useful 413 response.
+                return fail(413, "body too large");
+            }
+            data += c;
+        });
+        req.on("end", () => {
+            if (done)
+                return;
+            let body;
+            try {
+                body = data ? JSON.parse(data) : {};
+            }
+            catch {
+                return fail(400, "invalid JSON body");
+            }
+            done = true;
+            parsedBodies.set(req, body);
+            resolve(body);
+        });
+        req.on("error", (e) => fail(400, e instanceof Error ? e.message : String(e)));
+    });
+}

package/dist-server/server/hooks/omb-hook.js

@@ -0,0 +1,103 @@
+// omb-hook — the one command OpenMausBot registers for Claude Code hooks
+// (PostToolUse, PreCompact, SessionStart, Stop). Claude Code runs it with the
+// hook's JSON on stdin and waits for it, so it obeys three rules learned
+// the hard way by other harnesses:
+//
+//   1. It ALWAYS exits 0. A hook that fails or times out can block the
+//      agent's next step; the harness observing is never worth that.
+//   2. It has a hard budget (OMB_HOOK_TIMEOUT_MS, default 4000) below Claude
+//      Code's own per-hook timeout, and speaks only to the loopback harness.
+//   3. It is dependency-free and does no work itself: it forwards the event
+//      to POST /api/internal/hook with the turn's capability token (read
+//      from OMB_HOOK_TOKEN_FILE at run time — the token rotates per turn
+//      while the CLI process, and its environment, live on) and prints the
+//      harness's `hookSpecificOutput`, if any, for Claude Code to apply.
+//
+// stdout is the hook channel — never console.log anything else here.
+import { readFileSync } from "node:fs";
+const CONTEXT_EVENTS = new Set(["SessionStart", "UserPromptSubmit"]);
+const requestedBudget = Number(process.env.OMB_HOOK_TIMEOUT_MS);
+const budgetMs = Number.isFinite(requestedBudget) && requestedBudget > 0 ? Math.min(requestedBudget, 4_000) : 4_000;
+const MAX_INPUT_BYTES = 1024 * 1024;
+const url = process.env.OMB_HOOK_URL ?? "";
+const tokenFile = process.env.OMB_HOOK_TOKEN_FILE ?? "";
+const done = (out) => {
+    if (out === undefined)
+        process.exit(0);
+    process.stdout.write(out, () => process.exit(0));
+};
+process.stdout.on("error", () => process.exit(0));
+// the outer fuse: whatever is still pending when this fires, we leave
+const fuse = setTimeout(() => done(), budgetMs);
+fuse.unref();
+function readStdin() {
+    return new Promise((resolve) => {
+        let data = "";
+        let bytes = 0;
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            bytes += Buffer.byteLength(chunk);
+            if (bytes > MAX_INPUT_BYTES)
+                return done();
+            data += chunk;
+        });
+        process.stdin.on("end", () => resolve(data));
+        process.stdin.on("error", () => resolve(data));
+    });
+}
+async function main() {
+    const raw = await readStdin();
+    let payload;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return done();
+        payload = parsed;
+    }
+    catch {
+        return done();
+    }
+    const event = typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
+    if (!event || !/^https?:\/\/127\.0\.0\.1(:\d+)?$/.test(url) || !tokenFile)
+        return done();
+    let token = "";
+    try {
+        token = readFileSync(tokenFile, "utf8").trim();
+    }
+    catch {
+        return done();
+    }
+    if (!token)
+        return done();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), Math.max(200, budgetMs - 300));
+    try {
+        const response = await fetch(`${url}/api/internal/hook`, {
+            method: "POST",
+            headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+            body: JSON.stringify({ event, payload }),
+            redirect: "error",
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return done();
+        const body = (await response.json().catch(() => null));
+        if (body && typeof body === "object" && body.hookSpecificOutput && typeof body.hookSpecificOutput === "object") {
+            return done(JSON.stringify({ hookSpecificOutput: body.hookSpecificOutput }));
+        }
+        // On SessionStart (and UserPromptSubmit) Claude Code reads plain-text
+        // stdout as context the model sees; on every other event stdout is
+        // only a debug line, so a context body is printed nowhere else.
+        if (body && typeof body === "object" && typeof body.context === "string" && body.context && CONTEXT_EVENTS.has(event)) {
+            return done(body.context);
+        }
+        return done();
+    }
+    catch {
+        return done();
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+void main();