openmausbot 0.1.84 → 0.1.86

package/dist-server/server/local-computer.js

@@ -269,7 +269,26 @@ export function validateLinuxDescriptorRuntime(descriptorFile, raw, { uid = proc
         return false;
     }
 }
-export function readCuaConnection({ platform = process.platform, userData = process.env.OMB_USER_DATA, home = homedir(), validateLinuxRuntime = validateLinuxDescriptorRuntime, } = {}) {
+/** Legacy darwin/win32 descriptors still name any command, so at runtime at
+ * least the file itself must be one only this user could have written: a
+ * regular file, not a symlink, owned by this user, and closed against
+ * group/other writes. libuv reports every writable Windows file as uid 0
+ * mode 0o666, so the ownership and permission bits cannot carry meaning
+ * there — only the symlink refusal applies on win32. */
+function validateLegacyDescriptorRuntime(descriptorFile, platform, { uid = process.getuid?.() ?? -1 } = {}) {
+    try {
+        const stat = lstatSync(descriptorFile);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return false;
+        if (platform !== "win32" && (stat.uid !== uid || (stat.mode & 0o022) !== 0))
+            return false;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function readCuaConnection({ platform = process.platform, userData = process.env.OMB_USER_DATA, home = homedir(), validateLinuxRuntime = validateLinuxDescriptorRuntime, validateLegacyRuntime = validateLegacyDescriptorRuntime, } = {}) {
     const candidates = userData ? [join(userData, "cua-connection.json")] : [];
     if (platform === "darwin") {
         // Legacy/dev fallback. Packaged Electron passes its exact userData path.
@@ -287,7 +306,7 @@ export function readCuaConnection({ platform = process.platform, userData = proc
             }
             else {
                 const decoded = decodeLegacyDescriptor(raw, platform);
-                if (decoded)
+                if (decoded && validateLegacyRuntime(file, platform))
                     return decoded;
             }
         }

package/dist-server/server/managed-desktop.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { lstatSync, mkdirSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 const uuid = z.string().uuid();
@@ -9,9 +9,18 @@ const connectionSchema = z.object({
     email: z.string().email().max(320), deviceId: uuid, token: z.string().regex(/^omg_[A-Za-z0-9_-]{43}$/),
     expiresAt: z.number().finite().int().positive(),
     providers: z.array(z.object({ id: z.enum(["anthropic", "openai", "openrouter"]), configured: z.boolean(), models: z.array(model).max(500) }).strict()).max(3),
+    /** The Admin is up but its operator licence lapsed: keep the instances
+     * listed as unavailable instead of treating it as a revocation. */
+    suspended: z.literal("license-expired").optional(),
 }).strict();
+/** The saved enrollment's identity (never its token), sent before it is
+ * cleared or when it has already expired, so references to its old
+ * device-scoped ids still move to the stable ids. */
+const identitySchema = z.object({ portalOrigin: z.string().max(2048), organizationId: uuid, email: z.string().email().max(320), deviceId: uuid }).strict();
+const PROVIDER_IDS = ["anthropic", "openai", "openrouter"];
 const signature = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 const expiredMessage = "Company access has ended. Reconnect your organization or explicitly choose a personal model; personal billing will not be used automatically.";
+export const LICENSE_EXPIRED_MESSAGE = "Your organisation's OpenMaus Admin licence has expired. Contact your admin.";
 /** Validate only messages received over Electron's private utility-parent port.
  * Never expose this input to renderer HTTP or merge it into saved AppConfig.
  */
@@ -33,10 +42,18 @@ export function parseManagedDesktopConnection(raw, now = Date.now()) {
     return { ...value, portalOrigin: url.origin, email: value.email.toLowerCase(), providers: value.providers.map(provider => ({ ...provider, models: [...new Set(provider.models)] })).sort((a, b) => a.id.localeCompare(b.id)) };
 }
 export function companyInstanceId(connection, provider) {
-    // Device identity prevents an old company's native resume cursor from being
-    // inherited by a different enrollment using the same organization/email.
+    // Stable for one person in one organisation, so re-enrolling this computer
+    // keeps bots' Company model choices and native resume. Another account or
+    // organisation still gets separate ids, homes and cursors.
+    return `company.${signature([connection.portalOrigin, connection.organizationId, connection.email.toLowerCase()]).slice(0, 24)}.${provider}`;
+}
+/** The pre-0.1.86 id, which also hashed the enrollment's deviceId. */
+export function legacyCompanyInstanceId(connection, provider) {
     return `company.${signature([connection.portalOrigin, connection.organizationId, connection.deviceId]).slice(0, 24)}.${provider}`;
 }
+/** Everything that decides which native instances exist and what they hold.
+ * Expiry and licence suspension change availability only, never a process. */
+const instanceSignature = (connection) => signature(connection && (({ expiresAt: _expiresAt, suspended: _suspended, ...identity }) => identity)(connection));
 export function companyInstanceConfigs(connection, runtimeDirectory) {
     const entries = {};
     for (const provider of connection.providers) {
@@ -86,9 +103,18 @@ export class ManagedDesktopProviders {
     known = new Set();
     owns(instanceId) { return this.known.has(instanceId); }
     apply(raw, force = false) {
-        const connection = parseManagedDesktopConnection(raw, this.now()), nextSignature = signature(connection);
-        if (!force && nextSignature === this.currentSignature)
+        const connection = parseManagedDesktopConnection(raw, this.now()), nextSignature = instanceSignature(connection);
+        if (!force && nextSignature === this.currentSignature) {
+            // A renewal or licence change: same processes, new availability.
+            const previous = this.connection;
+            this.connection = connection;
+            if (connection && previous && (connection.expiresAt !== previous.expiresAt || connection.suspended !== previous.suspended)) {
+                clearTimeout(this.timer);
+                this.scheduleExpiry(this.revision);
+                this.options.onAvailability?.();
+            }
             return this.tail;
+        }
         this.currentSignature = nextSignature;
         this.connection = connection;
         const revision = ++this.revision;
@@ -107,6 +133,7 @@ export class ManagedDesktopProviders {
             // workspace backups. Device-scoped ids prevent a new enrollment from
             // inheriting another account's native conversation or credentials.
             const directory = this.ensureDirectory(["providers", "company"]);
+            await this.migrateLegacyIds(connection);
             const configs = companyInstanceConfigs(connection, directory);
             for (const [id, entry] of Object.entries(configs)) {
                 if (this.options.registry.entries().some(existing => existing.instanceId === id))
@@ -117,7 +144,9 @@ export class ManagedDesktopProviders {
                 this.ids.add(id);
                 this.known.add(id);
             }
-            const active = () => revision === this.revision && connection.expiresAt > this.now();
+            // Read the current grant: renewals and licence changes update it in place.
+            const active = () => revision === this.revision && Boolean(this.connection && this.connection.expiresAt > this.now() && !this.connection.suspended);
+            const unavailable = () => this.connection?.suspended === "license-expired" ? LICENSE_EXPIRED_MESSAGE : expiredMessage;
             await this.options.registry.load(configs, instance => {
                 const provider = connection.providers.find(provider => companyInstanceId(connection, provider.id) === instance.instanceId);
                 const models = { default: provider.models[0], options: provider.models.map(id => ({ id, label: `${id} (Company)` })) };
@@ -127,17 +156,17 @@ export class ManagedDesktopProviders {
                     startAuthentication: undefined, getAuthentication: undefined, completeAuthentication: undefined, cancelAuthentication: undefined, signOut: undefined,
                     snapshot: async () => {
                         if (!active())
-                            return { state: "unavailable", reason: expiredMessage };
+                            return { state: "unavailable", reason: unavailable() };
                         const snapshot = await instance.snapshot();
                         if (!active())
-                            return { state: "unavailable", reason: expiredMessage };
+                            return { state: "unavailable", reason: unavailable() };
                         return { ...snapshot, authenticated: snapshot.state === "available", billing: "metered", account: { email: connection.email, organization: connection.organizationName, method: "api-key" } };
                     },
                     adapter: {
                         ...instance.adapter,
                         sendTurn: async (input) => {
                             if (!active())
-                                throw new Error(expiredMessage);
+                                throw new Error(unavailable());
                             if (!input.model || !provider.models.includes(input.model))
                                 throw new Error("This model is not enabled by your Company administrator.");
                             return instance.adapter.sendTurn(input);
@@ -147,7 +176,7 @@ export class ManagedDesktopProviders {
             });
             if (revision === this.revision) {
                 this.options.afterReplace?.([...this.ids]);
-                this.scheduleExpiry(connection, revision);
+                this.scheduleExpiry(revision);
             }
         };
         this.tail = this.tail.catch(() => { }).then(replace).catch(async (error) => {
@@ -188,17 +217,53 @@ export class ManagedDesktopProviders {
         }
         return directory;
     }
-    scheduleExpiry(connection, revision) {
+    scheduleExpiry(revision) {
+        const expiresAt = this.connection?.expiresAt;
+        if (expiresAt === undefined)
+            return;
         this.timer = setTimeout(() => {
             if (revision !== this.revision)
                 return;
-            if (connection.expiresAt > this.now())
-                this.scheduleExpiry(connection, revision);
+            if ((this.connection?.expiresAt ?? 0) > this.now())
+                this.scheduleExpiry(revision);
             else
                 void this.apply(null).catch(() => { });
-        }, Math.min(2_147_483_647, Math.max(1, connection.expiresAt - this.now())));
+        }, Math.min(2_147_483_647, Math.max(1, expiresAt - this.now())));
         this.timer.unref?.();
     }
+    /** Moves an enrollment's old device-scoped ids to the stable ids: native
+     * homes are renamed only when the stable one does not exist yet, then saved
+     * references follow. Best effort: a failure is logged and never keeps
+     * Company models down. */
+    async migrateLegacyIds(identity) {
+        try {
+            const directory = this.ensureDirectory(["providers", "company"]);
+            const aliases = PROVIDER_IDS.map(provider => ({ from: legacyCompanyInstanceId(identity, provider), to: companyInstanceId(identity, provider) }));
+            for (const { from, to } of aliases) {
+                const legacy = join(directory, from), stable = join(directory, to);
+                if (!existsSync(legacy) || existsSync(stable))
+                    continue;
+                const stat = lstatSync(legacy);
+                if (stat.isDirectory() && !stat.isSymbolicLink())
+                    renameSync(legacy, stable);
+            }
+            await this.options.migrate?.(aliases);
+        }
+        catch (error) {
+            console.warn(`[company] could not move saved Company model references to their stable ids: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /** Migrates a saved enrollment that is being cleared or has expired. */
+    async migrateIdentity(raw) {
+        const parsed = identitySchema.parse(raw), url = new URL(parsed.portalOrigin);
+        if (url.origin !== parsed.portalOrigin || (url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)))) {
+            throw new Error("Company identity must use an HTTPS origin or loopback fixture.");
+        }
+        const identity = { ...parsed, email: parsed.email.toLowerCase() };
+        const migration = this.tail.catch(() => { }).then(() => this.migrateLegacyIds(identity));
+        this.tail = migration;
+        return migration;
+    }
     async close() {
         await this.apply(null, true);
     }

package/dist-server/server/managed-policy.js

@@ -0,0 +1,153 @@
+import { z } from "zod";
+/** An organisation's desktop policy, received only over Electron's private
+ * utility-parent port while this desktop is enrolled. It lives in memory: it
+ * is never merged into config.json, and it adds no prompts or approvals —
+ * a disallowed action is simply refused with a sentence saying who manages it. */
+const policySchema = z.object({
+    organizationId: z.string().uuid(),
+    organizationName: z.string().trim().min(1).max(100),
+    expiresAt: z.number().int().positive(),
+    version: z.number().int().min(0).max(2_147_483_647),
+    companyModelsOnly: z.boolean(),
+    allowedEngines: z.union([z.literal("all"), z.array(z.string().regex(/^[A-Za-z][A-Za-z0-9-]{0,63}$/)).max(64)]),
+    mcp: z.object({ allowCustom: z.boolean(), allowlist: z.array(z.string().trim().min(1).max(200)).max(100) }).strict(),
+    computers: z.object({ thisComputer: z.boolean(), localVm: z.boolean(), box: z.boolean(), vps: z.boolean() }).strict(),
+    remoteAccess: z.boolean(),
+}).strict();
+const computerLabels = { thisComputer: "this computer", localVm: "local virtual machines", box: "Box cloud computers", vps: "VPS computers" };
+export function parseManagedPolicy(raw, now = Date.now()) {
+    if (raw === null)
+        return null;
+    const parsed = policySchema.safeParse(raw);
+    if (!parsed.success)
+        throw new Error("Invalid organisation policy from the desktop parent.");
+    return parsed.data.expiresAt > now ? parsed.data : null;
+}
+/** `*` in a host pattern stands for one or more whole labels, never part of
+ * one, so `*.example.com` cannot match `evil.test/x.example.com`. */
+function hostMatches(pattern, host) {
+    if (!pattern.length)
+        return !host.length;
+    if (pattern[0] === "*") {
+        for (let taken = 1; taken <= host.length - (pattern.length - 1); taken++)
+            if (hostMatches(pattern.slice(1), host.slice(taken)))
+                return true;
+        return false;
+    }
+    return host.length > 0 && pattern[0] === host[0] && hostMatches(pattern.slice(1), host.slice(1));
+}
+/** A name entry matches the configured server name. An address entry
+ * (https:// only) is parsed like the server's URL: no credentials, the same
+ * port, the host compared label by label, and the path separately (`*` there
+ * matches any characters). Anything that does not parse never matches. */
+export function mcpEntryMatches(entry, name, url) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(entry))
+        return entry.toLowerCase() === name.toLowerCase();
+    if (!url)
+        return false;
+    let pattern, target;
+    try {
+        pattern = new URL(entry);
+        target = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (pattern.protocol !== "https:" || target.protocol !== "https:" || pattern.username || pattern.password || target.username || target.password ||
+        pattern.search || pattern.hash || pattern.port !== target.port)
+        return false;
+    const labels = pattern.hostname.split(".");
+    if (labels.some(label => !label || (label !== "*" && label.includes("*"))) || labels.every(label => label === "*"))
+        return false;
+    if (!hostMatches(labels, target.hostname.split(".")))
+        return false;
+    const path = pattern.pathname.split("*").map(part => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+    return new RegExp(`^${path}$`).test(target.pathname);
+}
+/** A resource key claimed by bindTurnComputer, mapped to the policy's kind. */
+export function computerKindForResource(resource) {
+    if (resource === "computer:host")
+        return "thisComputer";
+    if (resource.startsWith("computer:vm:"))
+        return "localVm";
+    if (resource.startsWith("computer:box:") || resource.startsWith("computer:box-bot:"))
+        return "box";
+    if (resource.startsWith("computer:vps:"))
+        return "vps";
+}
+export class ManagedDesktopPolicy {
+    policy = null;
+    timer;
+    now;
+    onChange;
+    constructor(options = {}) {
+        this.now = options.now ?? Date.now;
+        this.onChange = options.onChange ?? (() => { });
+    }
+    apply(raw) {
+        const next = parseManagedPolicy(raw, this.now());
+        const changed = JSON.stringify(next) !== JSON.stringify(this.policy);
+        this.policy = next;
+        clearTimeout(this.timer);
+        // The last applied policy holds only as long as the device credential.
+        if (next) {
+            this.timer = setTimeout(() => this.apply(null), Math.min(2_147_483_647, Math.max(1, next.expiresAt - this.now())));
+            this.timer.unref?.();
+        }
+        if (changed)
+            this.onChange();
+    }
+    current() {
+        return this.policy && this.policy.expiresAt > this.now() ? this.policy : null;
+    }
+    close() { clearTimeout(this.timer); this.policy = null; }
+    /** Why this organisation does not allow an instance to run a turn, or undefined. */
+    modelRefusal(instance, company) {
+        const policy = this.current();
+        if (!policy)
+            return;
+        if (policy.companyModelsOnly && !company)
+            return `${policy.organizationName} allows only company models on this computer. Choose a Company model for this bot.`;
+        if (policy.allowedEngines !== "all" && !policy.allowedEngines.includes(instance.driverKind)) {
+            return `${policy.organizationName} does not allow the ${instance.displayName ?? instance.driverKind} engine on this computer. Choose another model for this bot.`;
+        }
+    }
+    mcpAllowed(name, url) {
+        const policy = this.current();
+        return !policy || policy.mcp.allowCustom || policy.mcp.allowlist.some(entry => mcpEntryMatches(entry, name, url));
+    }
+    /** Only approved servers reach engines while custom servers are off. */
+    filterMcp(servers) {
+        if (!this.restrictsMcp())
+            return servers;
+        return Object.fromEntries(Object.entries(servers).filter(([name, server]) => this.mcpAllowed(name, "url" in server && typeof server.url === "string" ? server.url : undefined)));
+    }
+    restrictsMcp() { const policy = this.current(); return Boolean(policy && !policy.mcp.allowCustom); }
+    mcpRefusal(name, url) {
+        const policy = this.current();
+        if (!policy || this.mcpAllowed(name, url))
+            return;
+        return `${policy.organizationName} allows only MCP servers it has approved. Ask your administrator to add this server to the approved list.`;
+    }
+    computerAllowed(kind) { return this.current()?.computers[kind] ?? true; }
+    computerRefusal(kind) {
+        const policy = this.current();
+        if (!policy || policy.computers[kind])
+            return;
+        return `${policy.organizationName} does not allow bots to use ${computerLabels[kind]}.`;
+    }
+    remoteAccessRefusal() {
+        const policy = this.current();
+        if (!policy || policy.remoteAccess)
+            return;
+        return `${policy.organizationName} does not allow remote access to this computer.`;
+    }
+    /** Read-only view for the renderer; carries nothing secret. */
+    summary() {
+        const policy = this.current();
+        if (!policy)
+            return null;
+        const { organizationId: _id, expiresAt: _expires, ...visible } = policy;
+        return visible;
+    }
+}

package/dist-server/server/mcp-bridge.js

@@ -1,6 +1,6 @@
 // The shared stdio bridge for the host computer, Local VM, and BYO VPS.
 //
-// It is almost transparent — bytes in, bytes out — with two deliberate
+// It is almost transparent — bytes in, bytes out — with three deliberate
 // near-side exceptions:
 //
 //   1. `ping`. The bundled cua-driver (through at least v0.22.1) does not
@@ -9,6 +9,11 @@
 //   2. The who-is-driving `gate` (opt-in via `gate`). While the person holds
 //      control of this computer, a `tools/call` from the agent is answered
 //      with a refusal here and never forwarded.
+//   3. `tools/list` schemas. Every engine passes a tool's inputSchema to its
+//      model provider, and strict providers refuse a root that is not a plain
+//      object — failing the whole turn. The answer to a tools/list is
+//      rewritten to a provider-safe root (see mcp-tool-schema.ts); the far
+//      end still validates each call against its own schema.
 //
 // Both behaviors live here so neither entry point can drift:
 //   1. Exit without truncation. `process.exit()` in a close/error handler
@@ -23,6 +28,7 @@ import { spawn } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
 import { CONTROL_REFUSAL_PLAIN, createControlClient } from "./control-client.js";
 import { augmentedPath } from "./env-path.js";
+import { createToolListNormalizer } from "./mcp-tool-schema.js";
 // 45s of TOTAL silence before the bridge even probes. An MCP session is
 // legitimately quiet between tool calls and a slow screenshot can take tens
 // of seconds, so silence alone never kills anything — it only triggers a
@@ -228,8 +234,10 @@ export function runMcpBridge(options) {
             }
             : {}),
     });
+    const toolLists = createToolListNormalizer();
     let pendingInput = Promise.resolve();
     const inbound = createLineSplitter((line) => {
+        toolLists.observeRequest(line);
         const completion = intercept(line);
         if (completion)
             pendingInput = completion;
@@ -245,7 +253,7 @@ export function runMcpBridge(options) {
     // Injected responses and refusals must never land inside one of the
     // child's half-written frames, so the child's stdout is re-emitted at
     // line granularity as well.
-    const outbound = createLineSplitter((line) => process.stdout.write(line + "\n"));
+    const outbound = createLineSplitter((line) => process.stdout.write(toolLists.rewriteResponse(line) + "\n"));
     child.stdout.on("data", (chunk) => outbound.push(chunk));
     child.stdout.on("end", () => outbound.flush());
     const detach = () => {

package/dist-server/server/mcp-tool-images.js

@@ -0,0 +1,37 @@
+const asMcpImage = (c) => !!c &&
+    typeof c === "object" &&
+    c.type === "image" &&
+    typeof c.data === "string" &&
+    typeof c.mimeType === "string"
+    ? c
+    : null;
+// Claude CLI reformats MCP image content into Anthropic Messages API shape
+// before drivers ever see it — {type:"image", source:{type:"base64",
+// media_type, data}} — rather than the MCP-native {type, data, mimeType}.
+// Other drivers (codex/acp) pass the MCP-native shape through unchanged.
+const asAnthropicImage = (c) => {
+    const source = c?.type === "image"
+        ? c.source
+        : null;
+    if (!source || typeof source !== "object")
+        return null;
+    const { type, media_type, data } = source;
+    return type === "base64" && typeof media_type === "string" && typeof data === "string"
+        ? { data, mimeType: media_type }
+        : null;
+};
+const asImageBlock = (c) => asMcpImage(c) ?? asAnthropicImage(c);
+/** MCP tool_result content mixes text/image blocks. toolDetailPreview redacts
+ * the image bytes for the activity-log line (by design — that preview is
+ * never meant to carry raw base64); this pulls the images out separately so
+ * a caller can fold them into the message as attachments instead of losing
+ * them. Accepts either a raw MCP content array or a `{ content: [...] }`
+ * wrapper, since drivers hand this differently-shaped payloads. */
+export function extractMcpImages(value) {
+    const arr = Array.isArray(value)
+        ? value
+        : Array.isArray(value?.content)
+            ? value.content
+            : null;
+    return arr ? arr.map(asImageBlock).filter((v) => v !== null) : [];
+}

package/dist-server/server/mcp-tool-schema.js

@@ -0,0 +1,108 @@
+const ROOT_COMBINATORS = ["anyOf", "oneOf", "allOf", "not"];
+function isObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function branches(value) {
+    return Array.isArray(value) ? value.filter(isObject) : [];
+}
+/** The object shape a schema implies, gathered through its combinators.
+ * Its own declarations win over a branch's narrower copy; a property that
+ * only a branch declares is kept so the model still knows it exists. A name
+ * is required when the schema or an allOf branch requires it, or when every
+ * anyOf/oneOf choice does — a requirement of only one choice is not. */
+function objectShape(schema) {
+    const properties = isObject(schema.properties) ? { ...schema.properties } : {};
+    const required = new Set(Array.isArray(schema.required) ? schema.required.filter((key) => typeof key === "string") : []);
+    const adopt = (shape) => {
+        for (const [key, value] of Object.entries(shape.properties))
+            if (!(key in properties))
+                properties[key] = value;
+    };
+    for (const branch of branches(schema.allOf)) {
+        const shape = objectShape(branch);
+        adopt(shape);
+        for (const key of shape.required)
+            required.add(key);
+    }
+    for (const keyword of ["anyOf", "oneOf"]) {
+        const choices = branches(schema[keyword]).map(objectShape);
+        if (choices.length === 0)
+            continue;
+        for (const choice of choices)
+            adopt(choice);
+        for (const key of choices[0].required) {
+            if (choices.every((choice) => choice.required.includes(key)))
+                required.add(key);
+        }
+    }
+    return { properties, required: [...required] };
+}
+function describesObject(type) {
+    return type === undefined || type === "object" || (Array.isArray(type) && type.includes("object"));
+}
+/** A strict-provider-safe version of an MCP tool's inputSchema. A schema
+ * that is already safe is returned as the same object, so callers can tell
+ * whether anything changed. The input is never mutated. */
+export function providerSafeInputSchema(schema) {
+    if (!isObject(schema) || !describesObject(schema.type))
+        return { type: "object", properties: {} };
+    if (schema.type === "object" && ROOT_COMBINATORS.every((keyword) => !(keyword in schema)))
+        return schema;
+    const { properties, required } = objectShape(schema);
+    const safe = { ...schema, type: "object", properties };
+    for (const keyword of ROOT_COMBINATORS)
+        delete safe[keyword];
+    if (required.length > 0)
+        safe.required = required;
+    else
+        delete safe.required;
+    return safe;
+}
+/** Rewrites tools/list responses on an MCP stdio stream. Only a response to
+ * a tools/list the agent actually sent is touched; every other line — tool
+ * results, notifications, errors, non-JSON — passes through byte-for-byte. */
+export function createToolListNormalizer() {
+    // JSON-RPC ids may be numbers or strings, and 7 is not "7".
+    const pending = new Set();
+    const idKey = (id) => `${typeof id}:${String(id)}`;
+    return {
+        observeRequest(line) {
+            let frame;
+            try {
+                frame = JSON.parse(line);
+            }
+            catch {
+                return;
+            }
+            if (isObject(frame) && frame.method === "tools/list" && (typeof frame.id === "number" || typeof frame.id === "string")) {
+                pending.add(idKey(frame.id));
+            }
+        },
+        rewriteResponse(line) {
+            if (pending.size === 0)
+                return line;
+            let frame;
+            try {
+                frame = JSON.parse(line);
+            }
+            catch {
+                return line;
+            }
+            if (!isObject(frame) || "method" in frame || !pending.delete(idKey(frame.id)))
+                return line;
+            if (!isObject(frame.result) || !Array.isArray(frame.result.tools))
+                return line;
+            let changed = false;
+            const tools = frame.result.tools.map((tool) => {
+                if (!isObject(tool))
+                    return tool;
+                const inputSchema = providerSafeInputSchema(tool.inputSchema);
+                if (inputSchema === tool.inputSchema)
+                    return tool;
+                changed = true;
+                return { ...tool, inputSchema };
+            });
+            return changed ? JSON.stringify({ ...frame, result: { ...frame.result, tools } }) : line;
+        },
+    };
+}