openmausbot 0.1.86 → 0.1.87

package/dist-server/server/routes/bot-presets.js

@@ -0,0 +1,25 @@
+// Preset bots for New bot (server/presets.ts has the store and the rules).
+// GET lists what New bot offers: the organization's presets first, then
+// imported files', never one from a withdrawn release. DELETE removes an
+// imported preset (the person's own click; no confirm step). Organization
+// presets are Admin's to remove. Both are admin-scoped by default in
+// server/request-auth.ts, like the New bot defaults: a preset adds skills
+// and starter notes to the bot made from it.
+import { listBotPresets, ORG_PRESET_REMOVE_MESSAGE, PRESET_UNAVAILABLE_MESSAGE } from "../presets.js";
+import { PASS } from "./table.js";
+export function createBotPresetRoutes(deps) {
+    return async ({ res, path, method, json }) => {
+        if (path === "/api/bot-presets" && method === "GET") {
+            return json(res, 200, { presets: listBotPresets(deps.presets, deps.orgStatuses()) });
+        }
+        const m = path.match(/^\/api\/bot-presets\/([\w-]+)$/);
+        if (!m || method !== "DELETE")
+            return PASS;
+        const removed = deps.presets.removeFilePreset(m[1]);
+        if (removed === "not_found")
+            return json(res, 404, { error: PRESET_UNAVAILABLE_MESSAGE });
+        if (removed === "organization")
+            return json(res, 409, { error: ORG_PRESET_REMOVE_MESSAGE });
+        return json(res, 200, { ok: true });
+    };
+}

package/dist-server/server/routine-requests.js

@@ -923,7 +923,7 @@ export class RoutineRequestService {
             if (refusal)
                 throw new RoutineRequestError(refusal, 403);
         }
-        await this.requireCloudReadiness(operation);
+        await this.requireCloudReadiness(operation, botId);
         // The readiness probe is asynchronous. Another request can edit or
         // delete the routine while it is in flight, so re-check the captured
         // revision before rendering and persisting the confirmation snapshot.
@@ -1006,7 +1006,7 @@ export class RoutineRequestService {
         }
         throw new RoutineRequestError(result.state === "invalid" ? result.error : "The routine change could not be applied", result.state === "invalid" ? result.status : 409);
     }
-    async requireCloudReadiness(operation) {
+    async requireCloudReadiness(operation, proposerBotId) {
         if (!this.cloudReady || operation.action === "pause" || operation.action === "delete")
             return;
         const definition = effectiveDefinition(operation, this.routines);
@@ -1014,7 +1014,10 @@ export class RoutineRequestService {
             return;
         let readiness;
         try {
-            readiness = await this.cloudReady();
+            const targetBotId = operation.action === "create"
+                ? operation.forBot?.botId ?? proposerBotId
+                : this.routines.listRoutines().find(routine => routine.id === operation.routineId)?.botId ?? proposerBotId;
+            readiness = await this.cloudReady(targetBotId);
         }
         catch (error) {
             const detail = error instanceof Error ? error.message : String(error);

package/dist-server/server/routines.js

@@ -7,7 +7,24 @@ import { writeFileAtomic } from "./atomic.js";
 import { redactSecretsInText } from "./redact.js";
 import { normalizeCronSchedule, nextCronRuns } from "../shared/routine-schedule.js";
 import { isRoutineProblemRun } from "../shared/routines.js";
+import { ROUTINE_PARTS } from "./package-parts.js";
 const persistedSourceThreadId = z.string().trim().min(1).optional().catch(undefined);
+const HASH = /^[a-f0-9]{64}$/;
+function loadInstalledPackage(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const stamp = value;
+    if (typeof stamp.installId !== "string" || !/^[a-f0-9]{32}$/.test(stamp.installId) || typeof stamp.key !== "string" || !stamp.key || stamp.key.length > 80)
+        return undefined;
+    const parts = stamp.parts;
+    if (!parts || typeof parts !== "object" || !ROUTINE_PARTS.every((part) => HASH.test(String(parts[part]?.r)) && HASH.test(String(parts[part]?.w))))
+        return undefined;
+    return {
+        installId: stamp.installId,
+        key: stamp.key,
+        parts: Object.fromEntries(ROUTINE_PARTS.map((part) => [part, { r: parts[part].r, w: parts[part].w }])),
+    };
+}
 const webhookRunReceiptSchema = z.object({
     webhookId: z.string().min(1).max(200),
     deliveryId: z.string().min(1).max(200),
@@ -490,9 +507,12 @@ export class RoutineManager {
                         overlap: routine.overlap === "queue" ? "queue" : undefined,
                         skippedRuns: Number.isSafeInteger(routine.skippedRuns) && routine.skippedRuns > 0 ? routine.skippedRuns : undefined,
                         lastSkippedAt: Number.isSafeInteger(routine.lastSkippedAt) && routine.lastSkippedAt >= 0 && routine.lastSkippedAt <= MAX_DATE_MS ? routine.lastSkippedAt : undefined,
+                        installedPackage: loadInstalledPackage(routine.installedPackage),
                     };
                     if (loaded.timeoutMinutes === undefined)
                         delete loaded.timeoutMinutes;
+                    if (loaded.installedPackage === undefined)
+                        delete loaded.installedPackage;
                     delete loaded.failureStreak;
                     return [loaded];
                 })
@@ -582,7 +602,27 @@ export class RoutineManager {
             .sort((a, b) => (b.finishedAt ?? b.createdAt) - (a.finishedAt ?? a.createdAt) || b.createdAt - a.createdAt);
         const success = outcomes.findIndex(run => run.status === "completed");
         const failures = success < 0 ? outcomes.length : success;
-        return { ...cloneRoutine(routine), ...(failures ? { failureStreak: failures } : {}) };
+        const { installedPackage: _installedPackage, ...visible } = cloneRoutine(routine);
+        return { ...visible, ...(failures ? { failureStreak: failures } : {}) };
+    }
+    /** Routines added from the organization's library, with their stamps. */
+    packageStamps() {
+        return this.routines.flatMap((routine) => routine.installedPackage
+            ? [{ routineId: routine.id, botId: routine.botId, enabled: routine.enabled, stamp: structuredClone(routine.installedPackage) }]
+            : []);
+    }
+    /** Record which organization install a just-created routine belongs to. */
+    stampInstalledPackage(id, stamp) {
+        const clean = loadInstalledPackage(stamp);
+        if (!clean)
+            throw new Error("Invalid routine package stamp");
+        if (!this.routines.some((routine) => routine.id === id))
+            return false;
+        this.commitMutation(() => {
+            const routine = this.routines.find((candidate) => candidate.id === id);
+            routine.installedPackage = clean;
+        });
+        return true;
     }
     /** Whether this computer should stay awake for routines: a run is in
      * flight, or an enabled routine is due within the horizon. The schedule

package/dist-server/server/section-context.js

@@ -9,6 +9,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
+import { renamePublishedTeam } from "./published-teams.js";
 export const SECTION_CONTEXT_MAX_BYTES = 24_000;
 export const SECTION_CONTEXTS_FILE = join(DATA_DIR, "section-contexts.json");
 const sectionContextRecordSchema = z.object({ text: z.string(), updatedAt: z.number().finite() });
@@ -94,6 +95,15 @@ export function changeEmptySection(name, nextName) {
     if (nextName !== null && context)
         data.contexts[nextName] = context;
     saveFile(data);
+    // Every team rename and removal funnels through here, so the team's
+    // published package id and keys follow it (published-teams.ts). The team
+    // itself is already renamed; a failure here costs only key stability.
+    try {
+        renamePublishedTeam(name, nextName);
+    }
+    catch (error) {
+        console.warn(`[teams] Could not move the shared-package record for this team: ${error.message}`);
+    }
 }
 export function readSectionContext(section) {
     const record = loadFile().contexts[sectionContextKey(section)];

package/dist-server/server/skills.js

@@ -34,14 +34,11 @@ import { DATA_DIR } from "./config.js";
 import { redactSecretsInText } from "./redact.js";
 import { LEARN_SOURCE_PREFIX } from "./skill-learn.js";
 import { workspaceDir } from "./workspace.js";
-/** Spec rule: lowercase alphanumerics with single hyphens, 1-64 chars,
- * folder name must equal it. The regex IS the traversal gate — no dots, no
- * slashes, no way to name a skill "..". */
-const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-export const SKILL_NAME_MAX = 64;
-export const DESCRIPTION_MAX = 1024;
-/** One SKILL.md may be at most this large; the spec recommends <5k tokens. */
-export const SKILL_FILE_MAX_BYTES = 256 * 1024;
+import { isSkillName, parseSkillMd, scanSkillText, SKILL_FILE_MAX_BYTES } from "../shared/skill-md.js";
+// SKILL.md parsing and the static scan live in shared/ so the package
+// format (Admin and the renderer included) validates skills with the exact
+// same rules; re-exported here under their historical path.
+export { DESCRIPTION_MAX, isSkillName, parseSkillMd, scanSkillText, SKILL_FILE_MAX_BYTES, SKILL_NAME_MAX, } from "../shared/skill-md.js";
 /** Index budget: name+description lines only, ~100 tokens per skill. */
 export const INDEX_MAX_SKILLS = 30;
 export const INDEX_MAX_BYTES = 4_000;
@@ -51,58 +48,6 @@ export const STAGED_GIST_MAX = 240;
 /** Learned skills are duplicated onto their durable review card. Keep that
  * exact review payload bounded while leaving fetched skill imports unchanged. */
 export const STAGED_SKILL_FILE_MAX_BYTES = 32 * 1024;
-export function isSkillName(name) {
-    return name.length >= 1 && name.length <= SKILL_NAME_MAX && SKILL_NAME.test(name);
-}
-/** Minimal frontmatter reader for the two required keys plus the two we
- * display. Deliberately not a YAML engine: values are single-line strings in
- * every skill the spec's own examples show, and a parser that cannot
- * evaluate anchors or tags cannot be surprised by them. */
-export function parseSkillMd(raw) {
-    const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
-    if (!match)
-        return { error: "SKILL.md has no YAML frontmatter (--- block) at the top" };
-    const fields = {};
-    for (const line of match[1].split(/\r?\n/)) {
-        const kv = line.match(/^([A-Za-z][\w-]*):\s*(.*)$/);
-        if (!kv)
-            continue;
-        fields[kv[1].toLowerCase()] = kv[2].replace(/^["']|["']$/g, "").trim();
-    }
-    const name = fields.name ?? "";
-    const description = fields.description ?? "";
-    if (!isSkillName(name)) {
-        return { error: `frontmatter name ${JSON.stringify(name)} is not a valid skill name (lowercase, hyphens, max ${SKILL_NAME_MAX})` };
-    }
-    if (!description || description.length > DESCRIPTION_MAX) {
-        return { error: `frontmatter description is required and must be at most ${DESCRIPTION_MAX} characters` };
-    }
-    return {
-        name,
-        description,
-        license: fields.license || undefined,
-        compatibility: fields.compatibility || undefined,
-        body: match[2] ?? "",
-    };
-}
-/** Static red flags before a human review. Presence is a warning shown in
- * the review screen, never a silent rejection — the reviewer decides. These
- * are the three patterns the public registry audits actually caught. */
-export function scanSkillText(raw) {
-    const warnings = [];
-    if (/[A-Za-z0-9+/]{120,}={0,2}/.test(raw)) {
-        warnings.push("contains a long base64-looking blob — a common wrapper for hidden instructions or payloads");
-    }
-    if (/\b(curl|wget)\b[^\n]{0,200}\|\s*(ba|z|da)?sh\b/.test(raw)) {
-        warnings.push("pipes a download straight into a shell (curl|sh) — never enable without understanding why");
-    }
-    // zero-width and bidi-control characters hide text from the reviewer while
-    // the model still reads it — the invisible-instruction trick
-    if (/[\u200B-\u200F\u202A-\u202E\u2060-\u2064\uFEFF]/.test(raw)) {
-        warnings.push("contains invisible Unicode characters (zero-width or bidi controls) — text you cannot see");
-    }
-    return warnings;
-}
 const skillManifestEntrySchema = z.object({
     description: z.string(),
     enabled: z.boolean(),
@@ -115,6 +60,13 @@ const skillManifestEntrySchema = z.object({
     skippedFiles: z.array(z.string()),
     appliedStageId: z.string().optional(),
     storageRevision: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    package: z.object({
+        installId: z.string().regex(/^[a-f0-9]{32}$/),
+        key: z.string().min(1).max(64),
+        release: z.string().min(1).max(40),
+        r: z.string().regex(/^[a-f0-9]{64}$/),
+        w: z.string().regex(/^[a-f0-9]{64}$/),
+    }).optional(),
 });
 const skillManifestSchema = z.record(z.string(), skillManifestEntrySchema);
 const managedLinksSchema = z.array(z.string());
@@ -498,7 +450,7 @@ function skillContentMatches(botId, name, entry) {
     }
 }
 function skillListing(botId, name, entry) {
-    const { appliedStageId, storageRevision: _storageRevision, ...visible } = entry;
+    const { appliedStageId, storageRevision: _storageRevision, package: _package, ...visible } = entry;
     const intact = skillContentMatches(botId, name, entry);
     return {
         name,
@@ -563,6 +515,26 @@ export function installSkill(botId, source, files) {
         return prepared;
     return installPreparedSkill(botId, source, prepared, { enabled: false });
 }
+/** The organization library's path: a skill the organization's Admin
+ * published arrives switched ON (the Admin is the review), with the install
+ * stamp that lets the library find it again. `source` is chosen by the
+ * caller (`org:<ref>@<release>`), never read from the package. */
+export function installOrgSkill(botId, source, skillMd, stamp) {
+    if (!source.startsWith("org:"))
+        return { error: "organization skills need an org: source" };
+    const prepared = preparedSkillFiles([{ path: "SKILL.md", content: skillMd }]);
+    if ("error" in prepared)
+        return prepared;
+    if (prepared.parsed.name !== stamp.key)
+        return { error: `the skill is named "${prepared.parsed.name}", not "${stamp.key}"` };
+    return installPreparedSkill(botId, source, prepared, { enabled: true, package: { ...stamp } });
+}
+/** A bot's skills that an organization install added, with their stamps. */
+export function skillPackageStamps(botId) {
+    return Object.entries(readManifest(botId)).flatMap(([name, entry]) => entry.package
+        ? [{ name, enabled: entry.enabled, stamp: { ...entry.package } }]
+        : []);
+}
 export function setSkillEnabled(botId, name, enabled) {
     if (!isSkillName(name))
         return { error: "invalid skill name" };
@@ -936,6 +908,7 @@ function installPreparedSkill(botId, source, prepared, options) {
         warnings: prepared.warnings,
         skippedFiles: prepared.skippedFiles,
         appliedStageId: options.appliedStageId,
+        ...(options.package ? { package: options.package } : {}),
     };
     const root = ensureSkillsRoot(botId);
     if (!root)

package/dist-server/server/steer-queue.js

@@ -81,14 +81,15 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
     changed();
     return { id };
 }
-/** Where a thread stands among this bot's threads waiting for a free slot:
+/** Where a thread stands among this bot's threads waiting for the bot to
+ * become available (a full slot list or an active room turn):
  * 1 for the next to start. The drain visits queues in insertion order, so
  * insertion order is the line. Null when nothing of this bot's is waiting
  * on that thread. */
 export function queuedThreadPosition(botId, threadId) {
     let position = 0;
     for (const [candidate, entry] of queues) {
-        if (entry.botId !== botId || !entry.items.some((item) => item.reason === "capacity"))
+        if (entry.botId !== botId || !entry.items.some((item) => item.reason === "capacity" || item.reason === "group-turn"))
             continue;
         position += 1;
         if (candidate === threadId)