openmausbot 0.1.86 → 0.1.88

package/dist-server/server/connector-advertisement.js

@@ -0,0 +1,165 @@
+// Advertisement filtering for the connector MCP bridge (issue #1737, part
+// of the per-bot Composio tool grants umbrella #1734).
+//
+// Call-time enforcement (connector-verdict.ts, slice 2) stays the
+// authority: it judges the real tool names on the harness relay endpoint,
+// where the loopback token already names the bot. This module is surface
+// only — it trims a tools/list response to the tools the bot was granted,
+// so the model is never offered a call that would be refused a moment
+// later. The allowlist reaches the bridge as JSON in the environment, the
+// same channel every other bridge input uses; whenever filtering cannot
+// run — no env var, malformed env, oversized payload — the bridge relays
+// the list untouched and the grants stay enforced at call time.
+import { CONNECTOR_SLUG_PATTERN, CONNECTOR_TOOL_NAME_PATTERN } from "../shared/wire.js";
+import { serviceSlugFor, serviceSlugForCandidates } from "./connector-verdict.js";
+/** The env var mcpIntegration sets and connector-proxy.ts reads. */
+export const CONNECTOR_ALLOWED_TOOLS_ENV = "OMB_CONNECTOR_ALLOWED_TOOLS";
+/** The env var carrying the connected-service slugs the filter resolves
+ * tool-name prefixes against. Without it the filter falls back to the
+ * plain first-segment split, exactly as when the catalog is unreachable. */
+export const CONNECTOR_SERVICE_SLUGS_ENV = "OMB_CONNECTOR_SERVICE_SLUGS";
+/** Upper bound for the serialized allowlist. Past it the env var is
+ * omitted entirely (mounting must never depend on catalog size) and the
+ * bot keeps the unfiltered list with call-time enforcement only. */
+export const CONNECTOR_ALLOWED_TOOLS_MAX_BYTES = 32 * 1024;
+/** Upper bound for the serialized slug list; past it the env var is
+ * omitted and the filter falls back to the plain split. */
+export const CONNECTOR_SERVICE_SLUGS_MAX_BYTES = 32 * 1024;
+/** The platform meta-tools. They name no connected-app tool themselves —
+ * search and schemas discover, the executor runs what it is told — so
+ * they stay advertised whenever any tool is granted; the executor's
+ * arguments are still judged call-time by connector-verdict.ts. */
+export const CONNECTOR_META_TOOLS = [
+    "COMPOSIO_SEARCH_TOOLS",
+    "COMPOSIO_GET_TOOL_SCHEMAS",
+    "COMPOSIO_MULTI_EXECUTE_TOOL",
+    // Session-level connection meta-tools. COMPOSIO_MANAGE_CONNECTIONS ships
+    // in every Composio session; COMPOSIO_WAIT_FOR_CONNECTIONS is opt-in and
+    // off by default. They prefix as service "composio", which no grant
+    // names, so they ride this list instead of CONNECTION_TOOL_SUFFIXES —
+    // connector-proxy intercepts their calls to surface connection cards.
+    // The filter only keeps names upstream actually lists, so advertising an
+    // opted-out tool changes nothing.
+    "COMPOSIO_MANAGE_CONNECTIONS",
+    "COMPOSIO_WAIT_FOR_CONNECTIONS",
+];
+const CONNECTION_TOOL_SUFFIXES = ["_MANAGE_CONNECTIONS", "_WAIT_FOR_CONNECTIONS"];
+/** Harness side: serialize a grants record for the bridge env, or report
+ * that it exceeded the cap (the caller warns and omits it). */
+export function serializeConnectorAllowedTools(grants) {
+    const env = JSON.stringify(grants);
+    if (Buffer.byteLength(env, "utf8") > CONNECTOR_ALLOWED_TOOLS_MAX_BYTES)
+        return { oversized: true };
+    return { env, oversized: false };
+}
+/** Harness side: serialize the connected-service slugs for the bridge
+ * env, or report that they exceeded the cap. Duplicate or non-slug
+ * entries are dropped rather than failing the whole mount. */
+export function serializeConnectorServiceSlugs(slugs) {
+    const unique = [...new Set(slugs.filter((slug) => CONNECTOR_SLUG_PATTERN.test(slug)))];
+    if (!unique.length)
+        return { oversized: false };
+    const env = JSON.stringify(unique);
+    if (Buffer.byteLength(env, "utf8") > CONNECTOR_SERVICE_SLUGS_MAX_BYTES)
+        return { oversized: true };
+    return { env, oversized: false };
+}
+/** Bridge side: decode and shape-check the allowlist env. Anything off —
+ * absent, unparseable, wrong shapes — reads as "no allowlist" so the
+ * bridge degrades to relaying the unfiltered list rather than guessing a
+ * narrower one. Call-time enforcement holds either way. */
+export function parseConnectorAllowedToolsEnv(raw) {
+    if (!raw)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const grants = {};
+    for (const [slug, grant] of Object.entries(value)) {
+        if (!CONNECTOR_SLUG_PATTERN.test(slug))
+            return null;
+        if (!grant || typeof grant !== "object" || Array.isArray(grant))
+            return null;
+        const tools = grant.tools;
+        if (tools === "*") {
+            grants[slug] = { tools: "*" };
+            continue;
+        }
+        if (!Array.isArray(tools) || tools.length === 0)
+            return null;
+        if (!tools.every((tool) => typeof tool === "string" && CONNECTOR_TOOL_NAME_PATTERN.test(tool))) {
+            return null;
+        }
+        grants[slug] = { tools };
+    }
+    return grants;
+}
+/** Bridge side: decode the connected-service slug list. Anything off —
+ * absent, unparseable, or one bad entry — reads as an empty list so the
+ * filter degrades to the plain split instead of trusting a partial
+ * inventory. */
+export function parseConnectorServiceSlugsEnv(raw) {
+    if (!raw)
+        return [];
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(value))
+        return [];
+    return value.every((slug) => typeof slug === "string" && CONNECTOR_SLUG_PATTERN.test(slug))
+        ? value
+        : [];
+}
+/** Whether one advertised tool name survives the filter. A tool is
+ * offered when its service is granted with `"*`", when its exact name is
+ * granted, or when it is that service's connection flow — a card the
+ * person approves, which slice 2 passes through at call time and which a
+ * bot granted a service should still be able to offer for another
+ * account. */
+export function connectorToolAdvertised(name, grants, candidates = []) {
+    if (Object.keys(grants).length > 0 && CONNECTOR_META_TOOLS.includes(name))
+        return true;
+    // The connected-service slugs are the resolver's candidates, so an
+    // underscored service (bland_ai) claims its own tools instead of a
+    // plain-prefix grant (bland) widening them; an unreachable catalog
+    // leaves the list empty and the plain split stands.
+    const service = serviceSlugForCandidates(name, candidates) ?? serviceSlugFor(name);
+    const grant = service === null ? undefined : grants[service];
+    if (!grant)
+        return false;
+    if (grant.tools === "*")
+        return true;
+    if (grant.tools.includes(name))
+        return true;
+    return CONNECTION_TOOL_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+/** Filter one upstream tools/list response — the bridge normalizes SSE and
+ * JSON upstreams to a single frame first, so both shapes flow through
+ * here. Returns a shallow copy with result.tools trimmed; a frame without
+ * a readable tools array passes through unchanged (degrade, never guess).
+ * Entries the filter cannot read a name from are kept as-is. */
+export function filterToolsListFrame(frame, grants, candidates = []) {
+    const result = frame.result;
+    if (!result || typeof result !== "object" || Array.isArray(result))
+        return frame;
+    const tools = result.tools;
+    if (!Array.isArray(tools))
+        return frame;
+    const kept = tools.filter((tool) => {
+        const name = tool && typeof tool === "object" && !Array.isArray(tool)
+            ? tool.name
+            : undefined;
+        return typeof name === "string" ? connectorToolAdvertised(name, grants, candidates) : true;
+    });
+    return { ...frame, result: { ...result, tools: kept } };
+}

package/dist-server/server/connector-proxy.js

@@ -4,15 +4,24 @@
 // to the configured Composio Session, but connection requests are converted
 // into first-class OpenMausBot chat cards. The agent never authors an auth
 // URL and credentials never pass through its transcript.
+// tools/list responses are trimmed to this bot's granted tools as a
+// prompt-time hint; every call is still judged harness-side by the grants
+// relay.
 //
 // stdout is the MCP transport. Never log there.
 import readline from "node:readline";
 import { randomUUID } from "node:crypto";
+import { CONNECTOR_ALLOWED_TOOLS_ENV, CONNECTOR_SERVICE_SLUGS_ENV, filterToolsListFrame, parseConnectorAllowedToolsEnv, parseConnectorServiceSlugsEnv, } from "./connector-advertisement.js";
 const UPSTREAM = process.env.OMB_CONNECTOR_UPSTREAM_URL ?? "";
 const HARNESS = process.env.OMB_HARNESS_URL ?? "http://127.0.0.1:8799";
 const BOT_ID = process.env.OMB_BOT_ID ?? "";
 const THREAD_ID = process.env.OMB_THREAD_ID ?? "";
 const TOKEN = process.env.OMB_CONNECTOR_TOKEN ?? process.env.OMB_COMMS_TOKEN ?? "";
+// The bot's effective tool grants, or null when the harness sent none —
+// legacy bots, oversized allowlists, anything unreadable. null means the
+// upstream list is relayed verbatim; the harness still judges every call.
+const ALLOWED_TOOLS = parseConnectorAllowedToolsEnv(process.env[CONNECTOR_ALLOWED_TOOLS_ENV]);
+const SERVICE_SLUGS = parseConnectorServiceSlugsEnv(process.env[CONNECTOR_SERVICE_SLUGS_ENV]);
 const MAX_RESPONSE_BYTES = 20 * 1024 * 1024;
 const INITIALIZE_RELAY_TIMEOUT_MS = 1_000;
 const RELAY_TIMEOUT_MS = 10 * 60_000;
@@ -210,8 +219,11 @@ async function handle(message) {
     }
     try {
         const response = await relay(message);
-        if (response && id !== undefined)
-            send(response);
+        if (response && id !== undefined) {
+            send(method === "tools/list" && ALLOWED_TOOLS
+                ? filterToolsListFrame(response, ALLOWED_TOOLS, SERVICE_SLUGS)
+                : response);
+        }
     }
     catch (error) {
         if (id === undefined)

package/dist-server/server/connector-verdict.js

@@ -0,0 +1,168 @@
+// The harness-side verdict for connected-app tool calls (issue #1736, part
+// of the per-bot Composio tool grants umbrella #1734).
+//
+// Every Composio tool call crosses POST /api/internal/connectors/mcp: the
+// provider CLIs talk to the stdio bridge, and the bridge forwards each
+// JSON-RPC frame there. So the grants verdict lives on the harness side,
+// where the loopback token already names the bot and the decision log is
+// native — the bridge never sees a key it could have to enforce with.
+//
+// Three shapes reach this module:
+//
+//   * a direct per-toolkit call — params.name is the tool itself, e.g.
+//     GMAIL_SEND_EMAIL;
+//   * the executor meta-tool — COMPOSIO_MULTI_EXECUTE_TOOL, whose
+//     arguments name one or many target tools;
+//   * everything else — connection cards, discovery, notifications —
+//     which passes through untouched (advertisement filtering is slice 3).
+//
+// Unrecognized argument shapes are denied by default: a call whose target
+// tools cannot be read is a call whose tools cannot be checked, and the
+// grants promise — "this bot may call exactly these tools" — must hold
+// even against a model that garbles the protocol.
+import { CONNECTOR_TOOL_NAME_PATTERN } from "../shared/wire.js";
+/** The executor meta-tool: the only meta-tool whose arguments name target
+ * tools. Discovery and connection meta-tools keep their existing flows. */
+export const COMPOSIO_MULTI_EXECUTE_TOOL = "COMPOSIO_MULTI_EXECUTE_TOOL";
+/** The service a Composio tool name belongs to: the upper-snake prefix
+ * before the first underscore, lowercased (GMAIL_SEND_EMAIL to gmail). A
+ * name with no underscore names no service, so no grant can cover it. */
+export function serviceSlugFor(tool) {
+    const underscore = tool.indexOf("_");
+    if (underscore <= 0)
+        return null;
+    return tool.slice(0, underscore).toLowerCase();
+}
+/** The service a Composio tool name belongs to when the caller knows the
+ * real service slugs. Slugs may contain underscores (bland_ai), which the
+ * plain first-segment split above cannot see — BLAND_AI_MAKE_CALL splits
+ * as "bland". When a known candidate matches the name's prefix, the
+ * longest candidate wins (bland_ai over bland), so an underscored service
+ * keeps its own tools; with no matching candidate the caller falls back
+ * to serviceSlugFor. */
+export function serviceSlugForCandidates(tool, candidates) {
+    let match = null;
+    for (const candidate of candidates) {
+        if (tool.startsWith(candidate.toUpperCase() + "_") && (match === null || candidate.length > match.length)) {
+            match = candidate;
+        }
+    }
+    return match;
+}
+/** Classify one relayed JSON-RPC frame. Anything that is not a tools/call,
+ * or is a discovery/connection/platform meta-tool, passes through. */
+export function connectorCallFromFrame(payload) {
+    if (!payload || typeof payload !== "object" || Array.isArray(payload))
+        return { kind: "passthrough" };
+    const frame = payload;
+    if (frame.method !== "tools/call")
+        return { kind: "passthrough" };
+    const params = frame.params;
+    if (!params || typeof params !== "object" || Array.isArray(params)) {
+        return { kind: "unrecognized", invoked: "tools/call", reason: "the call carried no params object" };
+    }
+    const name = params.name;
+    if (typeof name !== "string" || !name) {
+        return { kind: "unrecognized", invoked: "tools/call", reason: "the call named no tool" };
+    }
+    if (name === COMPOSIO_MULTI_EXECUTE_TOOL) {
+        return multiExecuteCall(name, params.arguments);
+    }
+    // Platform meta-tools (search, schemas, remote workbench) are not
+    // connected-app tools; grants are keyed by service slug, and slice 3
+    // owns what the model is even shown.
+    if (name.startsWith("COMPOSIO_"))
+        return { kind: "passthrough" };
+    // Per-service connection cards keep their card flow in any spelling.
+    if (name.endsWith("_MANAGE_CONNECTIONS") || name.endsWith("_WAIT_FOR_CONNECTIONS")) {
+        return { kind: "passthrough" };
+    }
+    if (!CONNECTOR_TOOL_NAME_PATTERN.test(name)) {
+        return { kind: "unrecognized", invoked: name, reason: "the tool name is not a Composio tool name" };
+    }
+    return { kind: "tools", invoked: name, names: [name] };
+}
+/** Read the target tools out of COMPOSIO_MULTI_EXECUTE_TOOL arguments:
+ * the upstream schema is a 1-50 item tools array of { tool_slug,
+ * arguments }; a legacy single { tool_slug } object is accepted too.
+ * Anything else cannot be checked, so it is denied. */
+function multiExecuteCall(invoked, args) {
+    if (!args || typeof args !== "object" || Array.isArray(args)) {
+        return { kind: "unrecognized", invoked, reason: "the arguments were not an object" };
+    }
+    const tools = args.tools;
+    const singleSlug = args.tool_slug;
+    if (Array.isArray(tools)) {
+        if (tools.length === 0) {
+            return { kind: "unrecognized", invoked, reason: "the tools list was empty" };
+        }
+        const names = [];
+        for (const item of tools) {
+            const slug = item && typeof item === "object" && !Array.isArray(item)
+                ? item.tool_slug
+                : undefined;
+            if (typeof slug !== "string" || !slug) {
+                return { kind: "unrecognized", invoked, reason: "an entry in the tools list named no tool_slug" };
+            }
+            names.push(slug);
+        }
+        return { kind: "tools", invoked, names };
+    }
+    if (typeof singleSlug === "string" && singleSlug) {
+        return { kind: "tools", invoked, names: [singleSlug] };
+    }
+    return { kind: "unrecognized", invoked, reason: "the arguments named no tools to execute" };
+}
+/** Judge distinct target names against a bot's grants. grants undefined
+ * is the legacy all-tools bot and passes everything; an explicit record —
+ * including the empty one — allows only what it names. Service keys are
+ * read as own properties only: a name like CONSTRUCTOR_X maps to the
+ * "constructor" service, and the inherited property must never pose as
+ * a grant.
+ * candidates are the caller's connected-service slugs: the real backend
+ * slugs, so an underscored service (bland_ai) keeps its own tools instead
+ * of a plain-prefix grant (bland) capturing them. An empty list means the
+ * connected-service catalog was unreachable, and the plain first-segment
+ * split stands as the fallback — call-time enforcement degrades open, the
+ * same way advertisement filtering does. */
+export function evaluateConnectorTools(names, grants, candidates = []) {
+    if (grants === undefined) {
+        return { allowed: true, legacy: true, denials: [], rule: "composio" };
+    }
+    const denials = [];
+    let rule = "";
+    for (const tool of new Set(names)) {
+        const service = serviceSlugForCandidates(tool, candidates) ?? serviceSlugFor(tool);
+        const grant = service !== null && Object.hasOwn(grants, service)
+            ? grants[service]
+            : undefined;
+        if (grant && (grant.tools === "*" || grant.tools.includes(tool))) {
+            if (!rule)
+                rule = "connectorTools." + service;
+            continue;
+        }
+        denials.push({ tool, service, onGrantedService: Boolean(grant) });
+    }
+    return { allowed: denials.length === 0, legacy: false, denials, rule };
+}
+/** Safe to hand straight to the model: names the refused tool and says who
+ * can change it. It never lists what the bot could have called instead —
+ * a refusal that enumerates adjacent grants teaches the model to probe. */
+export function connectorRefusalText(denials) {
+    const named = denials.map((denial) => '"' + denial.tool + '"').join(", ");
+    const one = denials.length === 1;
+    return [
+        named + " " + (one ? "is" : "are") + " not granted to this bot.",
+        "This call was not performed.",
+        "Ask the person to grant " + (one ? "it" : "these tools") + " in OpenMausBot if they want " + (one ? "it" : "them") + " run.",
+    ].join(" ");
+}
+/** The unrecognized-shape refusal: names the meta-tool and what could not
+ * be read, and still points at the person rather than at any tool list. */
+export function connectorUnrecognizedText(invoked, reason) {
+    return [
+        "A " + invoked + " call arrived in a shape OpenMausBot could not read (" + reason + "), so it was not performed.",
+        "Send a well-formed call that names the tools to execute.",
+        "Ask the person to grant any tool this bot needs.",
+    ].join(" ");
+}

package/dist-server/server/container-computer.js

@@ -310,7 +310,7 @@ function statusProblem(status) {
     if (status.security === "unsafe")
         return "The existing Local VM is missing safety limits; recreate it";
     if (status.persistence === "unsafe")
-        return "The existing Local VM is missing its durable workspace; recreate it";
+        return "The existing Local VM is missing its durable folder; recreate it";
     if (status.container === "stopped")
         return "This desktop image cannot safely resume; recreate the Local VM";
     if (status.desktop_error)
@@ -808,6 +808,66 @@ export async function containerComputerScreenshot(runner = sh, platform = proces
 }
 const screenshotStatusCache = new Map();
 const containerMcpPath = SPAWNED_PROXIES.containerMcp;
+const EXEC_DEFAULT_SECONDS = 60;
+const EXEC_MAX_SECONDS = 300;
+const EXEC_OUTPUT_LIMIT = 20_000;
+/** Keep the start and the end: a failure message is nearly always at the end. */
+export function clipExecOutput(text, limit = EXEC_OUTPUT_LIMIT) {
+    if (text.length <= limit)
+        return text;
+    const head = Math.floor(limit / 5);
+    return `${text.slice(0, head)}\n… ${text.length - limit} characters omitted …\n${text.slice(text.length - (limit - head))}`;
+}
+const defaultExecRunner = async (command, args, options) => {
+    const resolved = resolveCliSpawn(command, args);
+    try {
+        const { stdout, stderr } = await run(resolved.command, resolved.args, {
+            timeout: options.timeout,
+            encoding: "utf8",
+            maxBuffer: 64 * 1024 * 1024,
+            env: { ...process.env, PATH: augmentedPath() },
+        });
+        return { stdout, stderr, code: 0 };
+    }
+    catch (error) {
+        const failure = error;
+        // A non-zero exit still carries the output; anything else (runtime missing,
+        // client killed) is a real failure to run at all.
+        if (typeof failure.code === "number") {
+            return { stdout: failure.stdout ?? "", stderr: failure.stderr ?? "", code: failure.code };
+        }
+        throw Object.assign(new Error(failure.killed ? "the command client timed out" : failure.message ?? "could not run the command"), { status: 502 });
+    }
+};
+/** Run one shell command inside a Local VM as the desktop user, in its durable
+ * workspace, and return the exit code and text output. Bots use this instead of
+ * typing into a terminal window and reading screenshots. The limit is enforced
+ * inside the container so a runaway process is really stopped. */
+export async function containerExec(target, command, options = {}) {
+    if (!command.trim())
+        throw Object.assign(new Error("command is required"), { status: 400 });
+    if (command.length > 20_000)
+        throw Object.assign(new Error("command is too long"), { status: 400 });
+    if (options.timeoutSeconds !== undefined && !Number.isFinite(options.timeoutSeconds)) {
+        throw Object.assign(new Error("timeout_seconds must be finite"), { status: 400 });
+    }
+    const runtime = options.runtime ?? (await containerRuntimeStatus()).runtime;
+    if (!runtime)
+        throw Object.assign(new Error("No container runtime is available for the Local VM"), { status: 409 });
+    const seconds = Math.min(Math.max(Math.floor(options.timeoutSeconds ?? EXEC_DEFAULT_SECONDS), 1), EXEC_MAX_SECONDS);
+    const result = await (options.exec ?? defaultExecRunner)(runtime, [
+        "exec",
+        "-u", "cua",
+        "-w", VM_WORKSPACE_GUEST,
+        "-e", "HOME=/home/cua",
+        "-e", `DISPLAY=${DISPLAY}`,
+        target.containerName,
+        "timeout", "-k", "5", String(seconds),
+        "sh", "-lc", command,
+    ], { timeout: (seconds + 20) * 1000 });
+    const timedOut = result.code === 124 || result.code === 137;
+    return { exitCode: result.code, stdout: clipExecOutput(result.stdout), stderr: clipExecOutput(result.stderr), timedOut };
+}
 export function containerComputerMcp(runtime, control, target = SHARED_LOCAL_VM_TARGET) {
     return {
         command: process.execPath,

package/dist-server/server/contracts.js

@@ -17,6 +17,28 @@ export function isModelVariant(value) {
     return typeof value === "string" && value.length > 0 && value.length <= 256 &&
         value.trim() === value && !/\p{Cc}/u.test(value);
 }
+/** The picker label for a model id when the catalog row carries no display
+ * name: split on the word breaks the catalog treats as separators and
+ * capitalize each part ("gpt-5.4-mini" → "Gpt 5.4 Mini"). Each harness
+ * passes its own break class so existing labels stay byte-for-byte. */
+export function titleCaseModelId(id, wordBreaks) {
+    return id
+        .split(wordBreaks)
+        .filter(Boolean)
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+        .join(" ");
+}
+/** A picker label that carries a second facet — a display name, a provider
+ * host — beside the model id, unless the facet is already what the id says.
+ * `redundantWhen` decides what counts as "already said" and `decorate` how
+ * the facet is appended, so every harness's labels stay exactly what they
+ * were while the shape is written once. */
+export function qualifiedModelLabel(id, qualifier, options = {}) {
+    const { redundantWhen = () => false, decorate = (facet) => ` — ${facet}` } = options;
+    if (!qualifier || redundantWhen(id, qualifier))
+        return id;
+    return `${id}${decorate(qualifier)}`;
+}
 let eventCounter = 0;
 export const newEventId = () => `ev-${Date.now().toString(36)}-${(eventCounter++).toString(36)}`;
 export const newId = () => crypto.randomUUID();

package/dist-server/server/default-model-selection.js

@@ -37,3 +37,12 @@ export function selectDefaultModelSelection(instances, preferred, context = {})
     }
     return { instanceId: pick?.instanceId ?? "", model: pick?.models.default ?? "" };
 }
+/** Complete a new bot's selection with the workspace's new-bot effort. An
+ * explicit effort or model variant is the caller's choice and wins; an engine
+ * that does not offer the level keeps sending none rather than failing turn 1. */
+export function withNewBotEffort(selection, effort, offered) {
+    if (!effort || selection.effort !== undefined || selection.variant !== undefined || !offered?.includes(effort)) {
+        return selection;
+    }
+    return { ...selection, effort };
+}