openmausbot 0.1.85 → 0.1.86

package/dist-server/server/request-auth.js

@@ -2,6 +2,83 @@ import { timingSafeEqual } from "node:crypto";
 import { isIP } from "node:net";
 import { denyReason as companionDenial } from "../companion/src/routes.js";
 const LOOPBACK_SCOPES = ["admin", "client"];
+const SERVICE_SCOPES = ["client"];
+/** What a `service`-trust loopback caller may reach, and nothing else:
+ *
+ * - liveness and identity: health, who-am-I, edition and brand;
+ * - the cloud Slack worker (openmaus-cloud server/slack-worker.ts), which
+ *   shares the workspace's network namespace and reads the bot list, a
+ *   thread's messages and a bot's PNG picture, creates a thread, sends
+ *   through the guarded route, watches and stops its exact request,
+ *   withdraws a queued line, and declines a card (the handler refuses any
+ *   other answer from this caller);
+ * - the turn-scoped bot capability routes, whose own bearer token is the
+ *   authorization (checked in the handler), and the test-only capability
+ *   mint that exists only when its private key is set.
+ *
+ * Residual risk, not closed here: a bot's shell is a loopback caller too, so
+ * it can do everything the worker does. It can post into any bot's thread
+ * through the guarded route, including an existing Full-access thread
+ * (`expectedApprovalMode: "full"`), and while the operator's shared Full
+ * access is on it can open new Full-access threads; either way work runs with
+ * Full access and no card, whoever asked the bot. It can also stop a request
+ * and decline a card. It can no longer change settings, keys, instances, MCP
+ * servers, webhooks, sessions, people, budgets or fleet, loosen a bot's
+ * permissions, or approve anything. The planned fix is a relay token that only
+ * the Slack worker holds, so these routes stop answering session-less
+ * loopback at all. */
+export const SERVICE_ALLOW = [
+    { methods: ["GET"], path: /^\/api\/health$/ },
+    { methods: ["GET"], path: /^\/api\/auth\/session$/ },
+    { methods: ["GET"], path: /^\/api\/edition$/ },
+    { methods: ["GET"], path: /^\/api\/brand$/ },
+    { methods: ["GET"], path: /^\/api\/bots$/ },
+    { methods: ["GET"], path: /^\/api\/threads\/[\w-]+\/messages$/ },
+    { methods: ["GET"], path: /^\/api\/attachments\/[\w.-]+$/ },
+    { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/tasks$/ },
+    { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/messages\/guarded$/ },
+    { methods: ["GET"], path: /^\/api\/bots\/[\w-]+\/requests\/[\w-]+$/ },
+    { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/requests\/[\w-]+\/interrupt$/ },
+    { methods: ["DELETE"], path: /^\/api\/bots\/[\w-]+\/queue\/[\w-]+$/ },
+    { methods: ["POST"], path: /^\/api\/threads\/[\w-]+\/respond$/ }, // decline only: see the handler
+    { methods: ["GET", "POST", "PUT", "PATCH", "DELETE"], path: /^\/api\/internal\// }, // capability bearer checked in the handler
+    { methods: ["POST"], path: /^\/api\/testing\/internal-capability$/ }, // exists only with its private key
+];
+export function serviceAllowed(method, path) {
+    const upper = method.toUpperCase();
+    return SERVICE_ALLOW.some((rule) => rule.methods.includes(upper) && rule.path.test(path));
+}
+/** Pick the loopback trust for this process, and say why for the startup log.
+ *
+ * A packaged desktop keeps `owner`: its mutations already need Electron's
+ * per-launch capability, and only its owner uses the machine. Elsewhere the
+ * operator may set OMB_LOOPBACK_TRUST=owner|service. Without it a hosted
+ * workspace (any OMB_ADMIN_* setting, even an incomplete one) defaults to
+ * `service` — shared-workspace Full access is only honoured there, so it needs
+ * no rule of its own — and a headless self-hosted server keeps `owner`. A
+ * value that is neither fails closed. */
+export function resolveLoopbackTrust(input) {
+    const raw = (input.env ?? process.env).OMB_LOOPBACK_TRUST;
+    const requested = raw?.trim().toLowerCase();
+    if (input.desktopManaged) {
+        return { trust: "owner", reason: "desktop app", ...(raw !== undefined ? { warning: "OMB_LOOPBACK_TRUST is ignored in the desktop app" } : {}) };
+    }
+    if (requested === "owner" || requested === "service") {
+        return {
+            trust: requested,
+            reason: "OMB_LOOPBACK_TRUST",
+            ...(requested === "owner" && input.hostedWorkspace
+                ? { warning: "OMB_LOOPBACK_TRUST=owner on a shared workspace: every bot's shell can change settings and approve cards as the owner" }
+                : {}),
+        };
+    }
+    if (raw !== undefined && requested !== "") {
+        return { trust: "service", reason: "OMB_LOOPBACK_TRUST", warning: `OMB_LOOPBACK_TRUST="${raw.replace(/[^\w.-]/g, "").slice(0, 40)}" is not owner or service; using service` };
+    }
+    if (input.hostedWorkspace)
+        return { trust: "service", reason: "hosted workspace" };
+    return { trust: "owner", reason: "self-hosted default" };
+}
 export function isLoopbackHost(host) {
     if (!host)
         return false;
@@ -170,6 +247,8 @@ export const CLIENT_ALLOW = [
     // reads: fleet, transcripts, search (no secrets in any of these)
     { methods: ["GET"], path: /^\/api\/bots$/ },
     { methods: ["GET"], path: /^\/api\/team-map$/ },
+    // a link into the organisation's Admin: identifiers only, and Admin authorizes its own visitor
+    { methods: ["GET"], path: /^\/api\/bots\/[\w-]+\/slack-management$/ },
     { methods: ["GET"], path: /^\/api\/search$/ },
     { methods: ["GET"], path: /^\/api\/threads\/[\w-]+\/messages$/ },
     { methods: ["GET"], path: /^\/api\/threads\/[\w-]+\/messages\/[\w-]+\/image$/ },
@@ -219,6 +298,7 @@ export const CLIENT_ALLOW = [
     { methods: ["PATCH", "DELETE"], path: /^\/api\/routines\/[\w-]+$/ },
     { methods: ["POST"], path: /^\/api\/routines\/[\w-]+\/run$/ },
     { methods: ["POST"], path: /^\/api\/routine-runs\/[\w-]+\/(?:cancel|seen)$/ },
+    { methods: ["POST"], path: /^\/api\/routine-runs\/seen-all$/ },
     // webhook list is secret-free; creating or rotating one is not
     { methods: ["GET"], path: /^\/api\/webhooks$/ },
     // configured-or-not booleans; the handler strips the few identifying fields for clients
@@ -255,6 +335,9 @@ export function clientGroupPatchViolation(body) {
             return key;
     return null;
 }
+const CLI_OWNER_HEADER = "x-openmausbot-cli-owner";
+/** The only routes the serving CLI's secret opens: its pairing code. */
+const CLI_OWNER_ROUTE = /^\/api\/auth\/pairing$/;
 const DESKTOP_OWNER_HEADER = "x-openmausbot-desktop-owner";
 function mutatingPublicRoute(method, path) {
     const upper = method.toUpperCase();
@@ -343,6 +426,19 @@ export function resolveRequestAuth(req, options) {
             !secureTokenMatch(headerValue(req.headers[DESKTOP_OWNER_HEADER]), options.loopbackMutationToken)) {
             return deny(403, "forbidden: this change must come from the desktop app or a paired device");
         }
+        if (options.loopbackMutationToken === undefined && options.loopbackTrust === "service") {
+            // The CLI that started this server may still print a pairing code.
+            if (options.cliOwnerToken && CLI_OWNER_ROUTE.test(path) && ["GET", "POST"].includes(method.toUpperCase()) &&
+                secureTokenMatch(headerValue(req.headers[CLI_OWNER_HEADER]), options.cliOwnerToken)) {
+                return { auth: { kind: "loopback", scopes: LOOPBACK_SCOPES }, status: 401, error: "" };
+            }
+            // On a shared server "local" includes every bot's shell. Default deny:
+            // only the service routes, never an admin change, without a session.
+            if (!serviceAllowed(method, path)) {
+                return deny(403, "forbidden: on this shared server a local request without a session may only use the service routes; sign in to change settings, people or access");
+            }
+            return { auth: { kind: "loopback", scopes: SERVICE_SCOPES, trust: "service" }, status: 401, error: "" };
+        }
         return { auth: { kind: "loopback", scopes: LOOPBACK_SCOPES }, status: 401, error: "" };
     }
     if (proxied) {

package/dist-server/server/room-handoffs.js

@@ -243,12 +243,13 @@ export class RoomHandoffs {
         const node = this.nodes.get(generation);
         if (!node || node.status !== "source")
             return;
+        // An accepted assignment belongs to the queue, not the provider that
+        // submitted it. A failed/expired source turn must not erase that work.
+        // Explicit Stop, deletion and revoked routes still cancel separately.
         if (!ok)
-            this.cancelTree(node, "The originating room turn did not finish", "failed");
-        else {
-            node.status = "waiting";
-            this.publish(node);
-        }
+            node.result = "The originating turn ended before its teammates returned.";
+        node.status = "waiting";
+        this.publish(node);
     }
     cancelTree(node, reason, status = "cancelled") {
         for (const child of this.children(node.id))
@@ -347,8 +348,10 @@ export class RoomHandoffs {
             }
             if (n.status !== "queued" && n.status !== "resume")
                 continue;
-            // A newly queued child starts only after its author has settled.
-            if (parent && (parent.status === "source" || parent.status === "running"))
+            // Independent conversations can start as soon as work is accepted.
+            // Same-room speakers still serialize; never overlap their shared chat.
+            if (parent && (parent.status === "source" || parent.status === "running") &&
+                (parent.threadId === n.threadId || (n.groupId && n.groupId === parent.groupId)))
                 continue;
             // A stopped source stops waiting; only work that never started is
             // dropped with it. A teammate mid-turn keeps its process and reports.
@@ -381,10 +384,10 @@ export class RoomHandoffs {
                 if (terminal(n))
                     return;
                 n.result = result.text.slice(0, 12_000);
-                if (!result.ok)
-                    this.cancelTree(n, n.result || "Room agent failed", "failed");
-                else if (this.children(n.id).length > childCount)
+                if (this.children(n.id).length > childCount)
                     n.status = "waiting";
+                else if (!result.ok)
+                    this.cancelTree(n, n.result || "Room agent failed", "failed");
                 else
                     n.status = "completed";
                 // Close the paused span with the settlement itself: work enqueued
@@ -392,7 +395,18 @@ export class RoomHandoffs {
                 // budget, not the still-open pause's overstated runway.
                 this.trackExecutionPauses();
                 this.publish(n);
-            }).catch(e => { this.cancelTree(n, String(e).slice(0, 1000), "failed"); })
+            }).catch(e => {
+                if (terminal(n))
+                    return;
+                n.result = String(e).slice(0, 1000);
+                if (this.children(n.id).length > childCount) {
+                    n.status = "waiting";
+                    this.trackExecutionPauses();
+                    this.publish(n);
+                }
+                else
+                    this.cancelTree(n, n.result, "failed");
+            })
                 .finally(() => this.controllers.delete(n.id));
         }
     }

package/dist-server/server/routes/hosted-slack.js

@@ -0,0 +1,20 @@
+// GET /api/bots/:id/slack-management: where, in the organisation's Admin, this
+// bot's Slack app is managed. A deep link only: this server holds no Slack
+// logic, contacts nobody, and the link carries identifiers, never a credential.
+// Client-scoped in server/request-auth.ts, so a member reading Bot Settings
+// gets the same link; Admin authorizes whoever opens it.
+import { hostedSlackManagement } from "../hosted-slack.js";
+import { PASS } from "./table.js";
+export function createHostedSlackRoutes(deps) {
+    return async ({ res, path, method, json }) => {
+        const m = path.match(/^\/api\/bots\/([\w-]+)\/slack-management$/);
+        if (!m || method !== "GET")
+            return PASS;
+        const bot = deps.bot(m[1]);
+        if (!bot || bot.hidden)
+            return json(res, 404, { error: "no such bot" });
+        res.setHeader("cache-control", "no-store");
+        // The id in the link is the stored bot's, not the text from the request.
+        return json(res, 200, hostedSlackManagement(bot.id, deps.hostedReady(), deps.env));
+    };
+}

package/dist-server/server/routes/table.js

@@ -0,0 +1,14 @@
+/** "Not my route": the next handler, then index.ts's inline routes, get a turn. */
+export const PASS = Symbol("route.pass");
+export const ROUTES = [];
+/** Runs handlers in order until one answers; true means stop routing. A
+ * handler that wrote a response but returned PASS by mistake still counts as
+ * answered, so the request can never reach a second handler. */
+export async function dispatchRoutes(routes, ctx) {
+    for (const route of routes) {
+        const out = await route(ctx);
+        if (out !== PASS || ctx.res.headersSent || ctx.res.writableEnded)
+            return true;
+    }
+    return false;
+}

package/dist-server/server/routines.js

@@ -6,6 +6,7 @@ import { DATA_DIR } from "./config.js";
 import { writeFileAtomic } from "./atomic.js";
 import { redactSecretsInText } from "./redact.js";
 import { normalizeCronSchedule, nextCronRuns } from "../shared/routine-schedule.js";
+import { isRoutineProblemRun } from "../shared/routines.js";
 const persistedSourceThreadId = z.string().trim().min(1).optional().catch(undefined);
 const webhookRunReceiptSchema = z.object({
     webhookId: z.string().min(1).max(200),
@@ -1063,6 +1064,27 @@ export class RoutineManager {
         }
         return cloneRun(run);
     }
+    /** Clear every failure indicator at once: stamp seenAt on each unseen
+     * failed/missed run in one committed save, then emit the updated runs so
+     * connected clients drop their dots immediately. A failed save rolls the
+     * stamps back so a retry still finds the unseen runs. */
+    markAllSeen() {
+        if (!this.runs.some((run) => !run.seenAt && isRoutineProblemRun(run)))
+            return [];
+        const stampAt = this.now();
+        const updated = [];
+        this.commitMutation(() => {
+            for (const run of this.runs) {
+                if (run.seenAt || !isRoutineProblemRun(run))
+                    continue;
+                run.seenAt = stampAt;
+                updated.push(run);
+            }
+        });
+        for (const run of updated)
+            this.emitRun(run);
+        return updated.map(cloneRun);
+    }
     get isTicking() { return this.ticking; }
     start() {
         if (this.timer)

package/dist-server/server/spend.js

@@ -1,33 +1,76 @@
+// Spend limits over the usage ledger: what this workspace has spent this
+// month against its cap, the refusal a turn gets once the cap is reached,
+// and the one-per-month notices when the month crosses the warning
+// threshold and the cap. The figure is every cost in the ledger: what
+// engines reported (on a workspace of personal subscriptions, their
+// equivalents too) plus the estimates booked for engines that report tokens
+// but no price (server/model-prices.ts). A turn on an unpriced model counts
+// nothing. Enforced only with the `budgets` entitlement; without it the
+// setting is inert.
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { entitled } from "./enterprise.js";
-import { readUsage } from "./usage-ledger.js";
+import { readUsage, usageRowKey } from "./usage-ledger.js";
 const DEFAULT_WARN_AT_PERCENT = 80;
 const CACHE_MS = 15_000;
 // Every turn start asks; reading the month file each time would be silly.
+// A read keeps the keys of the rows it summed, so a booked row can be told
+// apart from the same row read back later.
 const cache = new Map();
+// Booked turns whose ledger row may not be on disk yet: dataDir → row key →
+// cost. The append is asynchronous, and a turn that ran longer than CACHE_MS
+// would otherwise be re-read out of the month before its own row landed.
+const unwritten = new Map();
 function monthOf(now) {
     return now.toISOString().slice(0, 7);
 }
-/** Reported cost this month so far, from the ledger, cached briefly. */
+const costOf = (value) => (typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0);
+/** Reported and estimated cost this month so far: the ledger file (read at
+ * most every CACHE_MS) plus turns booked since whose rows have not landed. */
 export function monthToDateSpend(dataDir, now = new Date()) {
     const month = monthOf(now);
-    const hit = cache.get(dataDir);
-    if (hit && hit.month === month && now.getTime() - hit.at < CACHE_MS)
-        return hit.spentUsd;
-    const from = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
-    const spentUsd = readUsage(dataDir, { from, to: now }).reduce((sum, row) => sum + (typeof row.costUsd === "number" && Number.isFinite(row.costUsd) ? row.costUsd : 0), 0);
-    cache.set(dataDir, { at: now.getTime(), month, spentUsd });
-    return spentUsd;
-}
-/** Called right after a turn is booked, so the next check sees it without
- * waiting for the ledger's append to land or the cache to expire. */
-export function noteSpend(dataDir, costUsd, now = new Date()) {
-    const hit = cache.get(dataDir);
-    if (hit && hit.month === monthOf(now) && typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd > 0) {
-        hit.spentUsd += costUsd;
+    let read = cache.get(dataDir);
+    if (!read || read.month !== month || now.getTime() - read.at >= CACHE_MS) {
+        const from = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+        const rows = readUsage(dataDir, { from, to: now });
+        read = { at: now.getTime(), month, fileUsd: rows.reduce((sum, row) => sum + costOf(row.costUsd), 0), keys: new Set(rows.map(usageRowKey)) };
+        cache.set(dataDir, read);
     }
+    let pending = 0;
+    for (const [key, entry] of unwritten.get(dataDir) ?? []) {
+        if (entry.month === month && !read.keys.has(key))
+            pending += entry.costUsd;
+    }
+    return read.fileUsd + pending;
+}
+/** Called as a turn is booked, with the ledger's write for its row
+ * (appendUsage's promise). The cost counts from memory at once; when the
+ * row lands it moves into the cached read, and a re-read that already sees
+ * the row never counts it twice. A write that failed stops counting, as
+ * the ledger has no row for it. */
+export function noteSpend(dataDir, row, written) {
+    const costUsd = costOf(row.costUsd);
+    if (!costUsd)
+        return;
+    const key = usageRowKey(row);
+    const month = row.at.slice(0, 7);
+    const entries = unwritten.get(dataDir) ?? new Map();
+    unwritten.set(dataDir, entries);
+    entries.set(key, { month, costUsd });
+    void written.then((landed) => {
+        entries.delete(key);
+        if (entries.size === 0 && unwritten.get(dataDir) === entries)
+            unwritten.delete(dataDir);
+        const read = cache.get(dataDir);
+        if (landed && read && read.month === month && !read.keys.has(key)) {
+            read.fileUsd += costUsd;
+            read.keys.add(key);
+        }
+    });
 }
 export function resetSpendCacheForTests() {
     cache.clear();
+    unwritten.clear();
 }
 /** The cap and where the month stands against it; null when there is no
  * enforceable cap (no entitlement, or none set). */
@@ -59,3 +102,55 @@ export function assertWithinBudget(cfg, dataDir, now = new Date(), isEntitled =
         return;
     throw Object.assign(new Error(`this workspace has reached its monthly spend limit of $${usd(state.monthlyUsd)} — an admin can raise it under Settings → Usage`), { status: 409, code: "spend_cap" });
 }
+const ALERTS_FILE = "alerts.json";
+function readMarks(dataDir) {
+    try {
+        const value = JSON.parse(readFileSync(join(dataDir, "usage", ALERTS_FILE), "utf8"));
+        if (typeof value !== "object" || value === null)
+            return null;
+        const marks = value;
+        return typeof marks.month === "string" && typeof marks.monthlyUsd === "number" ? marks : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The notice this booking should raise, if any: the cap the first time the
+ * month reaches it, the warning the first time it crosses the threshold, and
+ * nothing again for either that month. A new month, or a different cap, is a
+ * new budget and starts over. Marks live beside the ledger so a restart does
+ * not repeat them; if they cannot be written the notice is still sent once
+ * for this run. */
+export function takeSpendAlert(dataDir, state) {
+    if (!state || (!state.warn && !state.exceeded))
+        return null;
+    const saved = readMarks(dataDir) ?? memoryMarks.get(dataDir) ?? null;
+    const marks = saved && saved.month === state.month && saved.monthlyUsd === state.monthlyUsd
+        ? saved
+        : { month: state.month, monthlyUsd: state.monthlyUsd };
+    const alert = state.exceeded && !marks.cap ? "cap" : state.warn && !marks.warn && !marks.cap ? "warn" : null;
+    if (!alert)
+        return null;
+    // Reaching the cap also answers the warning: one notice, the stronger one.
+    const next = { ...marks, warn: true, ...(alert === "cap" ? { cap: true } : {}) };
+    memoryMarks.set(dataDir, next);
+    try {
+        mkdirSync(join(dataDir, "usage"), { recursive: true, mode: 0o700 });
+        writeFileSync(join(dataDir, "usage", ALERTS_FILE), JSON.stringify(next), { mode: 0o600 });
+    }
+    catch {
+        /* bookkeeping must never take down the turn */
+    }
+    return alert;
+}
+const memoryMarks = new Map();
+export function resetSpendAlertsForTests() {
+    memoryMarks.clear();
+}
+/** The notice's words. English like the server's other notification titles. */
+export function spendAlertText(alert, state) {
+    const spent = `$${state.spentUsd.toFixed(2)} of $${usd(state.monthlyUsd)} spent this month (${state.month})`;
+    return alert === "cap"
+        ? { title: "Monthly spend limit reached", body: `${spent}. New turns are refused until an admin raises the limit under Settings → Usage.` }
+        : { title: `Spend is at ${state.percent}% of the monthly limit`, body: `${spent}. New turns stop when the limit is reached.` };
+}

package/dist-server/server/steer-queue.js

@@ -72,6 +72,8 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
         reason: options.reason,
         unattended: options.unattended,
         peerAsk: options.peerAsk,
+        sender: options.sender,
+        trigger: options.trigger,
     };
     saveChatFollowup({ id, kind: "bot", ownerId: botId, threadId, payload: item });
     entry.items.push(item);
@@ -140,6 +142,7 @@ export function drainSteeredMessages(store, run, isBlocked) {
                 sendId: item.sendId,
                 queueId: item.messageId,
                 peerAsk: item.peerAsk,
+                sender: item.sender,
             }));
         }
         const last = appended.at(-1);
@@ -153,7 +156,9 @@ export function drainSteeredMessages(store, run, isBlocked) {
         const running = run(entry.botId, threadId, prompt, last, appended.map((message) => message.id), 
         // one unattended line makes the whole drained turn unattended: a
         // person's words in the same queue cannot re-attend a bot's own
-        entry.items.some((item) => item.unattended === true));
+        entry.items.some((item) => item.unattended === true), 
+        // the first waiting line is the one that starts this turn
+        { trigger: entry.items[0].trigger, sender: entry.items[0].sender, peerAsk: entry.items[0].peerAsk });
         void Promise.resolve(running).then(() => settleChatFollowups(ids, null), () => settleChatFollowups(ids, "interrupted")).catch((error) => console.warn("steer-queue: could not settle durable follow-up", error));
     }
 }