openmausbot 0.1.85 → 0.1.87

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -3,7 +3,11 @@
 import { Ajv } from "ajv";
 import { Ajv2020 } from "ajv/dist/2020.js";
 import formats from "ajv-formats";
+import { stripControlPlaneEnv } from "../config.js";
+import { augmentedPath } from "../env-path.js";
 import { killCliTree, spawnCli } from "../procs.js";
+import { chatImage } from "./chat-images.js";
+import { ChatBoxClient } from "./chat-box-tools.js";
 /** The transport cannot safely continue this turn. A dispatched operation may
  * already have taken effect, so callers must not retry it through a new round. */
 export class ChatToolSessionError extends Error {
@@ -21,7 +25,16 @@ function object(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function aborted() { return new Error("MCP operation cancelled"); }
+/** These servers are a chat-runtime bot's tools, the counterpart of an engine
+ * CLI's children: the operator's control-plane secrets never ride along. What
+ * the server entry itself names is a deliberate grant and is applied last. */
+export function chatMcpEnvironment(serverEnv, source = process.env) {
+    const env = { ...source, PATH: augmentedPath() };
+    stripControlPlaneEnv(env);
+    return { ...env, ...serverEnv };
+}
 class ChatMcpClient {
+    frameBytes;
     child;
     buffer = "";
     nextId = 1;
@@ -29,10 +42,14 @@ class ChatMcpClient {
     closed = false;
     closing;
     pending = new Map();
-    constructor(server) {
+    constructor(server, computerUse = false) {
+        this.frameBytes = computerUse ? 32 * 1024 * 1024 : FRAME_BYTES;
         try {
+            // The desktop shell inherits Finder's bare PATH, where `npx`-style
+            // servers cannot find `node` and exit at once. Widen it the way the
+            // Claude and Codex drivers do; a PATH the user set on the server wins.
             this.child = spawnCli(server.command, server.args, {
-                stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...server.env },
+                stdio: ["pipe", "pipe", "pipe"], env: chatMcpEnvironment(server.env),
             });
         }
         catch {
@@ -64,7 +81,9 @@ class ChatMcpClient {
             entry.reject(new Error("MCP session closed"));
         this.pending.clear();
         this.buffer = "";
-        this.closing = killCliTree(this.child, 500).then((stopped) => {
+        // Confirm within the codebase-default grace: Windows reaps the tree via
+        // taskkill /T, which can exceed shorter budgets on a loaded machine.
+        this.closing = killCliTree(this.child, 5_000).then((stopped) => {
             if (!stopped)
                 throw new Error("MCP server shutdown could not be confirmed; execution outcome may be uncertain");
         });
@@ -74,7 +93,7 @@ class ChatMcpClient {
         if (this.closed || !this.child.stdin.writable || this.child.stdin.destroyed)
             throw new Error("MCP session closed");
         const encoded = JSON.stringify(frame) + "\n";
-        if (Buffer.byteLength(encoded) > FRAME_BYTES)
+        if (Buffer.byteLength(encoded) > this.frameBytes)
             throw new Error("MCP request exceeds the frame limit");
         this.child.stdin.write(encoded);
     }
@@ -88,7 +107,7 @@ class ChatMcpClient {
             this.buffer = this.buffer.slice(newline + 1);
             if (++this.frames > MAX_FRAMES)
                 return this.fail(new Error("MCP session exceeded the response frame count limit"));
-            if (Buffer.byteLength(line) > FRAME_BYTES)
+            if (Buffer.byteLength(line) > this.frameBytes)
                 return this.fail(new Error("MCP response exceeds the frame limit"));
             if (!line.trim())
                 continue;
@@ -125,7 +144,7 @@ class ChatMcpClient {
             else
                 entry.resolve(message.result);
         }
-        if (Buffer.byteLength(this.buffer) > FRAME_BYTES)
+        if (Buffer.byteLength(this.buffer) > this.frameBytes)
             this.fail(new Error("MCP response exceeds the frame limit"));
     }
     async call(method, params, signal, timeout) {
@@ -229,6 +248,8 @@ function compileSchema(schema) {
     // ajv-formats is CommonJS and exports the plugin as both module.exports
     // and .default; the latter also matches its NodeNext declaration.
     formats.default(compiler);
+    compiler.addFormat("uint32", { type: "number", validate: value => Number.isInteger(value) && value >= 0 && value <= 4294967295 });
+    compiler.addFormat("uint64", { type: "number", validate: value => Number.isSafeInteger(value) && value >= 0 });
     try {
         return compiler.compile(schema);
     }
@@ -245,8 +266,14 @@ function boundedText(value) {
         end -= 1;
     return `${bytes.subarray(0, end).toString()}\n[MCP result truncated at 50KB; request less output.]`;
 }
-export async function mountChatTools(integrations, signal) {
+export async function mountChatTools(integrations, signal, computerUse = false) {
     const servers = [];
+    if (computerUse && integrations?.computer)
+        servers.push(["computer", integrations.computer]);
+    if (computerUse && integrations?.localComputer)
+        servers.push(["computer", integrations.localComputer]);
+    if (computerUse && integrations?.browser)
+        servers.push(["browser", integrations.browser]);
     if (integrations?.agents)
         servers.push(["agents", integrations.agents]);
     if (integrations?.composio)
@@ -285,7 +312,9 @@ export async function mountChatTools(integrations, signal) {
         const mounts = await Promise.allSettled(servers.map(async ([name, descriptor]) => {
             if (signal.aborted || closed)
                 throw aborted();
-            const client = new ChatMcpClient(descriptor);
+            // Every mounted MCP server can return images when the caller enables
+            // image delivery, including custom servers. Text stays bounded below.
+            const client = "boxId" in descriptor ? new ChatBoxClient(descriptor) : new ChatMcpClient(descriptor, computerUse);
             clients.push(client);
             return { name, client, tools: await client.tools(signal) };
         }));
@@ -305,6 +334,18 @@ export async function mountChatTools(integrations, signal) {
                 if (Buffer.byteLength(JSON.stringify(tool.inputSchema)) > SCHEMA_BYTES)
                     throw new Error("MCP tool schema exceeds the 64KB limit");
                 const schema = compileSchema(tool.inputSchema);
+                const parameters = { ...tool.inputSchema };
+                const constraints = {};
+                if (computerUse) {
+                    for (const key of ["anyOf", "oneOf", "allOf", "not"]) {
+                        if (key in parameters) {
+                            constraints[key] = parameters[key];
+                            delete parameters[key];
+                        }
+                    }
+                }
+                const description = (typeof tool.description === "string" ? tool.description : "Configured MCP tool") +
+                    (Object.keys(constraints).length ? " Additional argument constraints (validated before execution): " + JSON.stringify(constraints) : "");
                 const base = `${server}_${tool.name}`.toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 64) || "mcp_tool";
                 let name = base;
                 for (let index = 2; registered.has(name); index += 1) {
@@ -312,7 +353,7 @@ export async function mountChatTools(integrations, signal) {
                     name = base.slice(0, 64 - suffix.length) + suffix;
                 }
                 registered.set(name, { client, name: tool.name, schema });
-                definitions.push({ type: "function", function: { name, description: typeof tool.description === "string" ? tool.description : "Configured MCP tool", parameters: tool.inputSchema } });
+                definitions.push({ type: "function", function: { name, description, parameters } });
                 if (Buffer.byteLength(JSON.stringify(definitions)) > CATALOG_BYTES)
                     throw new Error("MCP tool catalog exceeds the 1MB limit");
             }
@@ -349,12 +390,15 @@ export async function mountChatTools(integrations, signal) {
                 if (!object(result) || !Array.isArray(result.content) || (result.isError !== undefined && typeof result.isError !== "boolean"))
                     throw new Error("MCP tool returned an invalid result; execution outcome may be uncertain");
                 const parts = [];
+                const images = [];
                 let unsupported = 0;
                 for (const item of result.content) {
                     if (!object(item) || typeof item.type !== "string" || (item.type === "text" && typeof item.text !== "string"))
                         throw new Error("MCP tool returned invalid content; execution outcome may be uncertain");
                     if (item.type === "text")
                         parts.push(item.text);
+                    else if (computerUse && item.type === "image")
+                        images.push(chatImage(item));
                     else
                         unsupported += 1;
                 }
@@ -362,7 +406,8 @@ export async function mountChatTools(integrations, signal) {
                     parts.push(JSON.stringify(result.structuredContent));
                 if (unsupported)
                     parts.unshift(`[${unsupported} unsupported MCP content item(s) omitted. The operation may have taken effect, but its full result cannot be represented; inspect its state before retrying.]`);
-                return { text: boundedText(parts.join("\n") || "(empty result)"), ok: result.isError !== true && unsupported === 0 };
+                return { text: boundedText(parts.join("\n") || (images.length ? "Screenshot captured." : "(empty result)")), ok: result.isError !== true && unsupported === 0,
+                    ...(images.length ? { images } : {}) };
             }
             catch (error) {
                 await close();

package/dist-server/server/drivers/chat-tool-approval.js

@@ -1,4 +1,4 @@
-// Per-turn permission gate, adapted from the approval lifecycle in #780.
+// Per-turn ask gate, adapted from the approval lifecycle in #780.
 // Register before publishing: a harness listener may answer synchronously.
 import { newId } from "../contracts.js";
 export function createChatToolApproval(options) {
@@ -10,33 +10,85 @@ export function createChatToolApproval(options) {
                 return Promise.resolve(false);
             const ask = { id: newId(), tool, summary };
             return new Promise((resolve) => {
-                const finish = (allowed, source) => {
-                    if (!pending.delete(ask.id))
-                        return;
-                    clearTimeout(timer);
-                    options.signal.removeEventListener("abort", abort);
-                    options.resolved(ask, allowed, source);
-                    resolve(allowed);
+                let timer;
+                const card = {
+                    kind: "permission",
+                    ask,
+                    finish(source, decision) {
+                        if (!pending.delete(ask.id))
+                            return;
+                        clearTimeout(timer);
+                        options.signal.removeEventListener("abort", abort);
+                        const allowed = decision?.allowed === true;
+                        options.resolved(ask, allowed, source);
+                        resolve(allowed);
+                    },
                 };
-                const abort = () => finish(false, "system");
-                const timer = setTimeout(() => finish(false, "timeout"), options.timeoutMs ?? 15 * 60_000);
+                const abort = () => card.finish("system");
+                timer = setTimeout(() => card.finish("timeout"), options.timeoutMs ?? 15 * 60_000);
                 timer.unref?.();
-                pending.set(ask.id, finish);
+                pending.set(ask.id, card);
                 options.signal.addEventListener("abort", abort, { once: true });
                 options.open(ask);
             });
         },
-        answer(id, behavior) {
-            const finish = pending.get(id);
-            if (!finish || options.signal.aborted || behavior === "answer")
+        question(tool, summary, questions) {
+            if (closed || options.signal.aborted)
+                return Promise.resolve(null);
+            const ask = { id: newId(), tool, summary };
+            return new Promise((resolve) => {
+                let timer;
+                const card = {
+                    kind: "question",
+                    ask,
+                    finish(source, decision) {
+                        if (!pending.delete(ask.id))
+                            return;
+                        clearTimeout(timer);
+                        options.signal.removeEventListener("abort", abort);
+                        // Only the person's reply resolves a question; a timeout or
+                        // abort resolves null so no system note can occupy the answer
+                        // slot the model reads as the person's words.
+                        const reply = typeof decision?.message === "string" && decision.message.length > 0 ? decision.message : null;
+                        options.resolvedQuestion(ask, reply !== null, source);
+                        resolve(reply);
+                    },
+                };
+                const abort = () => card.finish("system");
+                timer = setTimeout(() => card.finish("timeout"), options.timeoutMs ?? 15 * 60_000);
+                timer.unref?.();
+                pending.set(ask.id, card);
+                options.signal.addEventListener("abort", abort, { once: true });
+                options.openQuestion(ask, questions);
+            });
+        },
+        answer(id, behavior, message) {
+            const card = pending.get(id);
+            if (!card || options.signal.aborted)
                 return "unavailable";
-            finish(behavior === "allow", "user");
-            return behavior === "allow" ? "allowed-once" : "rejected";
+            if (behavior === "deny") {
+                card.finish("user");
+                return "rejected";
+            }
+            if (card.kind === "permission") {
+                // An answer is not a permission: only allow or deny settles it.
+                if (behavior !== "allow")
+                    return "unavailable";
+                card.finish("user", { allowed: true });
+                return "allowed-once";
+            }
+            // And an allow is not an answer: a question settles only on a real
+            // reply, never a blank the model would have to interpret.
+            if (behavior === "answer" && typeof message === "string" && message.trim()) {
+                card.finish("user", { message });
+                return "answered";
+            }
+            return "unavailable";
         },
         close() {
             closed = true;
-            for (const finish of pending.values())
-                finish(false, "system");
+            for (const card of pending.values())
+                card.finish("system");
         },
     };
 }

package/dist-server/server/drivers/claude.js

@@ -6,7 +6,7 @@
 //
 // Integrations become MCP servers on the CLI:
 //   - Composio Sessions (connected apps → tools) over streamable HTTP
-//   - the bot's cloud computer (box.ascii.dev) via server/computer-proxy.ts
+//   - the bot's cloud computer (boat.dev) via server/computer-proxy.ts
 //     — screenshot/exec/open_url, the CUA-on-the-box bridge
 import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -25,6 +25,7 @@ import { askInputSummary, commandSummary, toolDetailPreview } from "../tool-summ
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
+import { permissionCommand, permissionLaunchCwd } from "./permission-command.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
 import { extractMcpImages } from "../mcp-tool-images.js";
 import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, parseChoices, questionChoices, } from "../../shared/ask-question.js";
@@ -322,6 +323,7 @@ export const STATIC_CLAUDE_MODELS = {
     options: [
         { id: "claude-fable-5-1", label: "Claude Fable 5.1" },
         { id: "claude-fable-5", label: "Claude Fable 5" },
+        { id: "claude-opus-5-5", label: "Claude Opus 5.5", contextWindow: 1_000_000 },
         { id: "claude-opus-5", label: "Claude Opus 5" },
         { id: "claude-sonnet-5", label: "Claude Sonnet 5" },
         { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" },
@@ -724,10 +726,13 @@ function decodeConfig(raw) {
     const configDir = typeof o.configDir === "string" ? o.configDir.trim() : undefined;
     if (configDir)
         resolveClaudeConfigDir(configDir);
+    if (o.managedModels !== undefined && (o.managed !== true || !Array.isArray(o.managedModels) || !o.managedModels.length || o.managedModels.some(model => typeof model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(model))))
+        throw new Error("Invalid hosted Claude models.");
     return {
         cli: typeof o.cli === "string" ? o.cli : "claude",
         ...(configDir ? { configDir } : {}),
         ...(o.managed === true ? { managed: true } : {}),
+        ...(o.managedModels ? { managedModels: o.managedModels } : {}),
         permissionMode: mode ?? "acceptEdits",
         ...(tools !== undefined ? { tools } : {}),
         ...(disallowedTools !== undefined ? { disallowedTools } : {}),
@@ -821,7 +826,7 @@ export const ClaudeDriver = {
         if (inheritsUserConfig(catalogEnv)) {
             console.error(`claude (${instanceId}): OMB_CLAUDE_INHERIT_USER_CONFIG=1 — bots inherit this machine's Claude Code MCP servers, skills, hooks and CLAUDE.md on every turn; remove it unless a bot needs a user-scope server`);
         }
-        let models = STATIC_CLAUDE_MODELS;
+        let models = config.managedModels ? { default: config.managedModels[0], options: config.managedModels.map(id => ({ id, label: id })) } : STATIC_CLAUDE_MODELS;
         const refreshModels = async () => {
             if (config.managed)
                 return;
@@ -932,6 +937,8 @@ export const ClaudeDriver = {
         // is a fresh sendTurn, and the attempt cap must survive across launches
         const retryState = new Map();
         const sendTurn = async (turn, logicalTurnId) => {
+            if (config.managedModels && (!turn.model || !config.managedModels.includes(turn.model)))
+                throw new Error("This model is not assigned to this workspace.");
             if (config.managed && (!turn.model || turn.model.includes("::") || !config.configDir ||
                 !input.environment.ANTHROPIC_API_KEY || !input.environment.ANTHROPIC_BASE_URL)) {
                 throw new Error("Company model access is unavailable. Reconnect your organization; personal billing will not be used.");
@@ -1193,6 +1200,7 @@ export const ClaudeDriver = {
             // parallel bot work must use the harness's durable delegate_bot path.
             env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS = "1";
             const cwd = turn.cwd ?? homedir();
+            const commandCwd = permissionLaunchCwd(cwd);
             // Everything that shapes the process, minus session/turn-specific temp
             // paths. Their contents are represented directly in the key instead.
             const privateFileFlags = new Set(["--mcp-config", "--settings"]);
@@ -1224,6 +1232,8 @@ export const ClaudeDriver = {
                     clearTimeout(live.idleTimer);
                 live.turn = { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false };
                 active.set(threadId, { stop: () => {
+                        if (live.turn)
+                            live.turn.stopRequested = true;
                         closeSession(threadId, "interrupted");
                         retry.cancelled = true;
                         retryAbort.abort();
@@ -1231,12 +1241,13 @@ export const ClaudeDriver = {
                     }, turnId, broker: live.broker });
                 emit({ ...base(threadId, turnId), type: "turn.started" });
                 const volatile = turn.systemVolatile ?? "";
-                const message = volatile === live.volatile
+                const message = volatile === live.volatile && !turn.mentionTurn
                     ? promptMsg
                     : claudeUserMessage(withVolatileNote(turn.text, volatile), turn.images);
                 live.volatile = volatile;
+                const running = live.turn;
                 const written = await writeUser(live, threadId, message);
-                if (!written) {
+                if (!written && !running?.stopRequested) {
                     active.delete(threadId);
                     live.turn = null;
                     closeSession(threadId, "stdin write failed");
@@ -1314,6 +1325,9 @@ export const ClaudeDriver = {
                                 requestType: ask.kind,
                                 tool: ask.tool,
                                 summary: askSummary(ask),
+                                command: ask.kind === "permission" && ask.tool === "Bash"
+                                    ? permissionCommand(ask.input.command, commandCwd) : undefined,
+                                requiresExplicitApproval: ask.kind === "permission" && ask.tool === "Bash" && ask.input.dangerouslyDisableSandbox === true || undefined,
                                 nativeReview,
                                 // the proxy hands Claude its own suggested rules on `always`;
                                 // host control stays one action at a time
@@ -1610,7 +1624,10 @@ export const ClaudeDriver = {
                 // a turn still running when the process died is a failed turn; a
                 // process that exited between turns (idle close, contract change)
                 // is just a session ending
-                if (session.turn && !session.turn.settled) {
+                if (session.turn?.stopRequested && !session.turn.settled) {
+                    settle(false, "interrupted");
+                }
+                else if (session.turn && !session.turn.settled) {
                     // A retained process may be running a later user turn. Its close
                     // handler must retry that request, not the process's first prompt.
                     const { turnId, input: turn, retryAbort } = session.turn;
@@ -1794,6 +1811,8 @@ export const ClaudeDriver = {
                 void session.finishClose();
             });
             const stop = () => {
+                if (session.turn)
+                    session.turn.stopRequested = true;
                 // taskkill is asynchronous on Windows. Retire steering and approvals
                 // now, before a still-connected child can submit more work.
                 closeSession(threadId, "interrupted");
@@ -1807,7 +1826,8 @@ export const ClaudeDriver = {
             // stdin stays OPEN: that is what keeps the session alive for a
             // mid-turn steer or the next turn; closeSession() ends it.
             if (!(await writeUser(session, threadId, promptMsg))) {
-                settle(false, "stdin_write_failed");
+                if (!session.turn?.stopRequested)
+                    settle(false, "stdin_write_failed");
                 closeSession(threadId, "stdin write failed");
             }
             return { turnId };
@@ -1844,9 +1864,9 @@ export const ClaudeDriver = {
          * `claude -p "prompt"` shape is not safe for review. No tools or MCP
          * servers are mounted in this isolated process. */
         const generateReview = (prompt, signal) => new Promise((resolve, reject) => {
-            const child = spawnCli(config.cli, ["-p", "--model", "claude-haiku-4-5", "--output-format", "text"], {
+            const child = spawnCli(config.cli, ["-p", "--model", config.managedModels?.[0] ?? "claude-haiku-4-5", "--output-format", "text"], {
                 stdio: ["pipe", "pipe", "pipe"],
-                env: environment("claude-haiku-4-5"),
+                env: environment(config.managedModels?.[0] ?? "claude-haiku-4-5"),
             });
             let stdout = "";
             let stderr = "";

package/dist-server/server/drivers/codex-instructions.js

@@ -1,10 +1,35 @@
-// Codex owns history; this receipt only remembers which bot rules it accepted.
+// Codex owns history; this receipt only remembers which bot rules and which
+// volatile context digest the native thread last carried.
 import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { DATA_DIR } from "../config.js";
 import { writeFileAtomic } from "../atomic.js";
 const digest = (value) => createHash("sha256").update(value).digest("hex");
+const isFingerprint = (value) => /^[0-9a-f]{64}$/.test(value);
+function parseReceipt(raw) {
+    if (!raw)
+        return null;
+    const trimmed = raw.trim();
+    if (isFingerprint(trimmed))
+        return { instructions: trimmed };
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            const record = parsed;
+            if (typeof record.instructions === "string" && isFingerprint(record.instructions)) {
+                return {
+                    instructions: record.instructions,
+                    ...(typeof record.volatile === "string" && isFingerprint(record.volatile) ? { volatile: record.volatile } : {}),
+                };
+            }
+        }
+    }
+    catch {
+        /* a corrupt receipt is simply unknown */
+    }
+    return null;
+}
 /** Preserve native configured rules when overriding Codex's developer slot. */
 export function codexDeveloperInstructions(config, botInstructions) {
     if (!config || typeof config !== "object" || Array.isArray(config)) {
@@ -20,19 +45,21 @@ export function codexDeveloperInstructions(config, botInstructions) {
         ? `${botInstructions || "No OpenMausBot bot-specific instructions remain."}\n\n${configured}`
         : botInstructions;
 }
-export async function syncCodexInstructions(key, nativeThreadId, instructions, resumed, request) {
+export async function syncCodexInstructions(key, nativeThreadId, instructions, volatile, resumed, request, mentionTurn = false) {
     const directory = join(DATA_DIR, "codex-instructions");
     const path = join(directory, `${digest(JSON.stringify([key, nativeThreadId]))}.sha256`);
     const fingerprint = digest(instructions);
+    const volatileFingerprint = digest(volatile);
     let previous;
     try {
-        previous = readFileSync(path, "utf8");
+        previous = parseReceipt(readFileSync(path, "utf8"));
     }
     catch (error) {
         if (error.code !== "ENOENT")
             throw error;
+        previous = null;
     }
-    if (resumed && previous !== fingerprint) {
+    if (resumed && previous?.instructions !== fingerprint) {
         // thread/resume config overrides are used after compaction, but Codex
         // 0.153.4 keeps the old initial developer message until then. Append a
         // developer update ONLY on change (or first adoption of an old session).
@@ -59,8 +86,23 @@ export async function syncCodexInstructions(key, nativeThreadId, instructions, r
             throw error;
         }
     }
-    if (!resumed || previous !== fingerprint) {
+    // A mention describes the turn it rides: deliver it on every tagged turn,
+    // even when the volatile text is byte-identical to the previous turn's.
+    const deliverVolatile = !resumed || previous?.volatile !== volatileFingerprint || mentionTurn;
+    const hadVolatile = typeof previous?.volatile === "string" && previous.volatile !== digest("");
+    if (!resumed || previous?.instructions !== fingerprint) {
+        // Instructions-only, and only after inject_items acknowledged: the
+        // volatile digest stays pending until the driver commits it after the
+        // provider accepts the turn, so a submission the provider rejected
+        // redelivers its context on the next attempt.
         mkdirSync(directory, { recursive: true });
-        writeFileAtomic(path, fingerprint, { mode: 0o600 });
+        writeFileAtomic(path, JSON.stringify({ instructions: fingerprint }), { mode: 0o600 });
     }
+    const commitVolatile = previous?.instructions === fingerprint && previous?.volatile === volatileFingerprint
+        ? null
+        : () => {
+            mkdirSync(directory, { recursive: true });
+            writeFileAtomic(path, JSON.stringify({ instructions: fingerprint, volatile: volatileFingerprint }), { mode: 0o600 });
+        };
+    return { deliverVolatile, hadVolatile, commitVolatile };
 }

package/dist-server/server/drivers/codex-mcp-names.js

@@ -0,0 +1,44 @@
+// MCP server names the user already declared in their own Codex config.
+//
+// Custom MCP servers reach codex as `-c mcp_servers.<name>.…` overrides, and
+// codex merges an override into any same-named table in config.toml. A stdio
+// command laid over a remote `url` entry is "invalid configuration": codex
+// falls back to defaults, config/read fails, and the whole turn dies before
+// the model is even asked. Mounting a colliding server under a name of its
+// own keeps both definitions usable.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const HEADER = /^[ \t]*\[[ \t]*mcp_servers[ \t]*\.[ \t]*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))[ \t]*[.\]]/gm;
+/** Names declared as `[mcp_servers.<name>]` (or a sub-table of one). Inline
+ * tables are not scanned; a collision there still surfaces as codex's own
+ * configuration error. */
+export function mcpServerNamesInToml(toml) {
+    const names = new Set();
+    for (const match of toml.matchAll(HEADER)) {
+        const name = match[1] !== undefined ? match[1].replace(/\\(.)/g, "$1") : match[2] ?? match[3];
+        if (name)
+            names.add(name);
+    }
+    return names;
+}
+/** Server names in the config.toml of the Codex home this child will use. */
+export function codexConfigMcpServerNames(env) {
+    const codexHome = env.CODEX_HOME || join(env.HOME || env.USERPROFILE || homedir(), ".codex");
+    try {
+        return mcpServerNamesInToml(readFileSync(join(codexHome, "config.toml"), "utf8"));
+    }
+    catch {
+        return new Set();
+    }
+}
+/** The name to mount a custom server under: its own, unless the user's Codex
+ * config already has a server by that name. */
+export function mountedMcpServerName(name, taken) {
+    if (!taken.has(name))
+        return name;
+    let candidate = `${name}_openmausbot`;
+    for (let i = 2; taken.has(candidate); i++)
+        candidate = `${name}_openmausbot${i}`;
+    return candidate;
+}

package/dist-server/server/drivers/codex-tool-surface.js

@@ -0,0 +1,20 @@
+// OpenMausBot owns computer selection and mounts its scoped MCP servers.
+// Keep the standalone Codex installation untouched: these overrides apply
+// only to the child process, including resumed conversations and retries.
+// The desktop-app browser is not available in Codex CLI. Enabling its tool
+// without a desktop connection exposes an unusable route; native search is
+// independent and must remain governed by the user's/provider's config.
+// https://developers.openai.com/codex/browser
+export function codexToolSurfaceArgs() {
+    return [
+        "-c", "features.browser_use=false",
+        "-c", "features.browser_use_external=false",
+        "-c", "features.computer_use=false",
+        // Disable the matching instructions as well as the native tool. Use an
+        // inline table: quoted dotted keys are interpreted literally by some CLIs.
+        "-c", 'plugins={ "browser@openai-bundled" = { enabled = false }, "computer-use@openai-bundled" = { enabled = false }, "unified-computer-use@openai-bundled" = { enabled = false } }',
+        // Native web search does not require the desktop browser connection.
+        // Preserve the user's/provider's search mode instead of disabling it for
+        // every OpenMausBot process after a failure in one search route.
+    ];
+}