openmausbot 0.1.86 → 0.1.87

package/dist-server/shared/skill-md.js

@@ -0,0 +1,64 @@
+// SKILL.md reading shared by the server skill store, the package format and
+// the renderer. Pure text only: no filesystem, no Node globals, so the same
+// rules validate a skill wherever it is read (server/skills.ts re-exports
+// these under their historical names).
+/** Spec rule: lowercase alphanumerics with single hyphens, 1-64 chars,
+ * folder name must equal it. The regex IS the traversal gate — no dots, no
+ * slashes, no way to name a skill "..". */
+const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export const SKILL_NAME_MAX = 64;
+export const DESCRIPTION_MAX = 1024;
+/** One SKILL.md may be at most this large; the spec recommends <5k tokens. */
+export const SKILL_FILE_MAX_BYTES = 256 * 1024;
+export function isSkillName(name) {
+    return name.length >= 1 && name.length <= SKILL_NAME_MAX && SKILL_NAME.test(name);
+}
+/** Minimal frontmatter reader for the two required keys plus the two we
+ * display. Deliberately not a YAML engine: values are single-line strings in
+ * every skill the spec's own examples show, and a parser that cannot
+ * evaluate anchors or tags cannot be surprised by them. */
+export function parseSkillMd(raw) {
+    const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+    if (!match)
+        return { error: "SKILL.md has no YAML frontmatter (--- block) at the top" };
+    const fields = {};
+    for (const line of match[1].split(/\r?\n/)) {
+        const kv = line.match(/^([A-Za-z][\w-]*):\s*(.*)$/);
+        if (!kv)
+            continue;
+        fields[kv[1].toLowerCase()] = kv[2].replace(/^["']|["']$/g, "").trim();
+    }
+    const name = fields.name ?? "";
+    const description = fields.description ?? "";
+    if (!isSkillName(name)) {
+        return { error: `frontmatter name ${JSON.stringify(name)} is not a valid skill name (lowercase, hyphens, max ${SKILL_NAME_MAX})` };
+    }
+    if (!description || description.length > DESCRIPTION_MAX) {
+        return { error: `frontmatter description is required and must be at most ${DESCRIPTION_MAX} characters` };
+    }
+    return {
+        name,
+        description,
+        license: fields.license || undefined,
+        compatibility: fields.compatibility || undefined,
+        body: match[2] ?? "",
+    };
+}
+/** Static red flags before a human review. Presence is a warning shown in
+ * the review screen, never a silent rejection — the reviewer decides. These
+ * are the three patterns the public registry audits actually caught. */
+export function scanSkillText(raw) {
+    const warnings = [];
+    if (/[A-Za-z0-9+/]{120,}={0,2}/.test(raw)) {
+        warnings.push("contains a long base64-looking blob — a common wrapper for hidden instructions or payloads");
+    }
+    if (/\b(curl|wget)\b[^\n]{0,200}\|\s*(ba|z|da)?sh\b/.test(raw)) {
+        warnings.push("pipes a download straight into a shell (curl|sh) — never enable without understanding why");
+    }
+    // zero-width and bidi-control characters hide text from the reviewer while
+    // the model still reads it — the invisible-instruction trick
+    if (/[​-‏‪-‮⁠-⁤]/.test(raw)) {
+        warnings.push("contains invisible Unicode characters (zero-width or bidi controls) — text you cannot see");
+    }
+    return warnings;
+}

package/dist-server/shared/team-backup.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { CONNECTOR_SLUG_PATTERN, CONNECTOR_TOOL_NAME_PATTERN } from "./wire.js";
 export const MAX_TEAM_BACKUP_BYTES = 50 * 1024 * 1024;
 export const TEAM_BACKUP_CONTENTS = "Bot profiles, instructions, sections, rooms, playbooks, routines, each bot's memory (MEMORY.md, topic notes and daily logs) and conversation text (all tasks and branches).";
 export const TEAM_BACKUP_EXCLUSIONS = "Files, images, custom avatars, account connections, model settings and permissions are not included. Action cards are saved as text. Memory is saved with secrets removed. Imported routines start paused.";
@@ -57,6 +58,11 @@ const memory = z.object({
     topics: z.array(z.object({ name: z.string().regex(/^[\w][\w .-]{0,199}\.md$/), text: memoryText })).max(1_000),
     logs: z.array(z.object({ name: z.string().regex(/^\d{4}-\d{2}-\d{2}\.md$/), text: memoryText })).max(10_000),
 });
+/** The private backup is the one portable format grants travel in, so the
+ * shape is checked with the same patterns the store validates patches
+ * against. Shareable exports never carry grants at all, and an import
+ * always lands bots grant-less whatever the file says. */
+const connectorTools = z.record(z.string().regex(CONNECTOR_SLUG_PATTERN), z.object({ tools: z.union([z.literal("*"), z.array(z.string().regex(CONNECTOR_TOOL_NAME_PATTERN)).min(1).max(500)]) }));
 const backupSchema = z.object({
     format: z.literal("openmaus.backup"),
     version: z.literal(1),
@@ -77,6 +83,7 @@ const backupSchema = z.object({
         chiefOfStaff: z.boolean(),
         hidden: z.boolean(),
         playbooks: z.array(playbook).max(200),
+        connectorTools: connectorTools.optional(),
         memory: memory.optional(),
     })).min(1).max(200),
     groups: z.array(z.object({

package/dist-server/shared/wire.js

@@ -6,3 +6,7 @@ export const EFFORT_LEVELS = ["none", "low", "medium", "high", "xhigh", "max"];
 export function isEffortLevel(value) {
     return typeof value === "string" && EFFORT_LEVELS.includes(value);
 }
+/** Lowercased Composio service slug, e.g. `gmail`. */
+export const CONNECTOR_SLUG_PATTERN = /^[a-z0-9][a-z0-9_-]{0,80}$/;
+/** Composio tool names are upper-snake, e.g. `GMAIL_SEND_EMAIL`. */
+export const CONNECTOR_TOOL_NAME_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;