openmausbot 0.1.86 → 0.1.88

package/dist-server/shared/profile-request.js

@@ -2,8 +2,9 @@
  * Durable payload carried by a profile confirmation card (propose_profile).
  *
  * The fields a bot may propose for itself (`cwd` is the working folder its
- * tools run in; "" means its private workspace). `before` is the snapshot the
- * user was shown; `expectedRevision` is a hash of the target's whole profile
- * at proposal time so a confirmation fails closed if anything moved.
+ * tools run in; "" means its private workspace; `notifications` and
+ * `speakReplies` are the alert and voice toggles). `before` is the snapshot
+ * the user was shown; `expectedRevision` is a hash of the target's whole
+ * profile at proposal time so a confirmation fails closed if anything moved.
  */
-export const PROFILE_REQUEST_FIELDS = ["name", "title", "description", "soul", "cwd"];
+export const PROFILE_REQUEST_FIELDS = ["name", "title", "description", "soul", "cwd", "notifications", "speakReplies"];

package/dist-server/shared/skill-md.js

@@ -0,0 +1,64 @@
+// SKILL.md reading shared by the server skill store, the package format and
+// the renderer. Pure text only: no filesystem, no Node globals, so the same
+// rules validate a skill wherever it is read (server/skills.ts re-exports
+// these under their historical names).
+/** Spec rule: lowercase alphanumerics with single hyphens, 1-64 chars,
+ * folder name must equal it. The regex IS the traversal gate — no dots, no
+ * slashes, no way to name a skill "..". */
+const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export const SKILL_NAME_MAX = 64;
+export const DESCRIPTION_MAX = 1024;
+/** One SKILL.md may be at most this large; the spec recommends <5k tokens. */
+export const SKILL_FILE_MAX_BYTES = 256 * 1024;
+export function isSkillName(name) {
+    return name.length >= 1 && name.length <= SKILL_NAME_MAX && SKILL_NAME.test(name);
+}
+/** Minimal frontmatter reader for the two required keys plus the two we
+ * display. Deliberately not a YAML engine: values are single-line strings in
+ * every skill the spec's own examples show, and a parser that cannot
+ * evaluate anchors or tags cannot be surprised by them. */
+export function parseSkillMd(raw) {
+    const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+    if (!match)
+        return { error: "SKILL.md has no YAML frontmatter (--- block) at the top" };
+    const fields = {};
+    for (const line of match[1].split(/\r?\n/)) {
+        const kv = line.match(/^([A-Za-z][\w-]*):\s*(.*)$/);
+        if (!kv)
+            continue;
+        fields[kv[1].toLowerCase()] = kv[2].replace(/^["']|["']$/g, "").trim();
+    }
+    const name = fields.name ?? "";
+    const description = fields.description ?? "";
+    if (!isSkillName(name)) {
+        return { error: `frontmatter name ${JSON.stringify(name)} is not a valid skill name (lowercase, hyphens, max ${SKILL_NAME_MAX})` };
+    }
+    if (!description || description.length > DESCRIPTION_MAX) {
+        return { error: `frontmatter description is required and must be at most ${DESCRIPTION_MAX} characters` };
+    }
+    return {
+        name,
+        description,
+        license: fields.license || undefined,
+        compatibility: fields.compatibility || undefined,
+        body: match[2] ?? "",
+    };
+}
+/** Static red flags before a human review. Presence is a warning shown in
+ * the review screen, never a silent rejection — the reviewer decides. These
+ * are the three patterns the public registry audits actually caught. */
+export function scanSkillText(raw) {
+    const warnings = [];
+    if (/[A-Za-z0-9+/]{120,}={0,2}/.test(raw)) {
+        warnings.push("contains a long base64-looking blob — a common wrapper for hidden instructions or payloads");
+    }
+    if (/\b(curl|wget)\b[^\n]{0,200}\|\s*(ba|z|da)?sh\b/.test(raw)) {
+        warnings.push("pipes a download straight into a shell (curl|sh) — never enable without understanding why");
+    }
+    // zero-width and bidi-control characters hide text from the reviewer while
+    // the model still reads it — the invisible-instruction trick
+    if (/[​-‏‪-‮⁠-⁤]/.test(raw)) {
+        warnings.push("contains invisible Unicode characters (zero-width or bidi controls) — text you cannot see");
+    }
+    return warnings;
+}

package/dist-server/shared/team-backup.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { CONNECTOR_SLUG_PATTERN, CONNECTOR_TOOL_NAME_PATTERN } from "./wire.js";
 export const MAX_TEAM_BACKUP_BYTES = 50 * 1024 * 1024;
 export const TEAM_BACKUP_CONTENTS = "Bot profiles, instructions, sections, rooms, playbooks, routines, each bot's memory (MEMORY.md, topic notes and daily logs) and conversation text (all tasks and branches).";
 export const TEAM_BACKUP_EXCLUSIONS = "Files, images, custom avatars, account connections, model settings and permissions are not included. Action cards are saved as text. Memory is saved with secrets removed. Imported routines start paused.";
@@ -57,6 +58,11 @@ const memory = z.object({
     topics: z.array(z.object({ name: z.string().regex(/^[\w][\w .-]{0,199}\.md$/), text: memoryText })).max(1_000),
     logs: z.array(z.object({ name: z.string().regex(/^\d{4}-\d{2}-\d{2}\.md$/), text: memoryText })).max(10_000),
 });
+/** The private backup is the one portable format grants travel in, so the
+ * shape is checked with the same patterns the store validates patches
+ * against. Shareable exports never carry grants at all, and an import
+ * always lands bots grant-less whatever the file says. */
+const connectorTools = z.record(z.string().regex(CONNECTOR_SLUG_PATTERN), z.object({ tools: z.union([z.literal("*"), z.array(z.string().regex(CONNECTOR_TOOL_NAME_PATTERN)).min(1).max(500)]) }));
 const backupSchema = z.object({
     format: z.literal("openmaus.backup"),
     version: z.literal(1),
@@ -77,6 +83,7 @@ const backupSchema = z.object({
         chiefOfStaff: z.boolean(),
         hidden: z.boolean(),
         playbooks: z.array(playbook).max(200),
+        connectorTools: connectorTools.optional(),
         memory: memory.optional(),
     })).min(1).max(200),
     groups: z.array(z.object({

package/dist-server/shared/tightening-request.js

@@ -0,0 +1,87 @@
+/**
+ * Durable payload carried by a tightening card (propose_tightening).
+ *
+ * Authority reductions a bot may propose for itself or (for a Chief) a
+ * section peer. Direction is enforced by shape: the intents cannot express
+ * an escalation — approvalMode targets stop below full and custom, the
+ * booleans only carry their tightening value, and the list fields only
+ * carry removals. `validateTightening` then checks the remaining
+ * state-relative direction (an upward move inside ask/edits/auto, a grant
+ * that is not currently held) against live bot state, at propose AND again
+ * at confirm, so a card that sat open can never apply a transition that
+ * stopped being a reduction. Escalation stays human-only in Edit Profile.
+ */
+import { APPROVAL_MODES } from "./approval-mode.js";
+/** Targets a proposal may name. "full" and "custom" are owner-only. */
+export const TIGHTENING_MODE_TARGETS = ["ask", "edits", "auto"];
+/** Direction check against live state. Pure: the caller supplies the
+ * snapshot, at propose and again at confirm. Every rejection names the
+ * field and the allowed direction. */
+export function validateTightening(before, intents) {
+    const after = {
+        ...before,
+        alwaysAllow: [...before.alwaysAllow],
+        mcpServers: [...before.mcpServers],
+        skills: [...before.skills],
+    };
+    if (intents.approvalMode !== undefined) {
+        const to = intents.approvalMode;
+        const from = before.approvalMode;
+        const reduces = from === "custom"
+            ? to === "ask"
+            : APPROVAL_MODES.indexOf(to) < APPROVAL_MODES.indexOf(from);
+        if (!reduces) {
+            return {
+                ok: false,
+                error: `approvalMode can only tighten: down the selector order (ask, edits, auto, full), or custom to ask. "${to}" does not reduce "${from}".`,
+            };
+        }
+        after.approvalMode = to;
+    }
+    if (intents.composio !== undefined) {
+        if (!before.composio)
+            return { ok: false, error: "composio is already off; it may only be turned off" };
+        after.composio = false;
+    }
+    if (intents.browser !== undefined) {
+        if (!before.browser)
+            return { ok: false, error: "browser is already off; it may only be turned off" };
+        after.browser = false;
+    }
+    if (intents.approvePeerComms !== undefined) {
+        if (before.approvePeerComms)
+            return { ok: false, error: "approvePeerComms is already on; it may only be turned on" };
+        after.approvePeerComms = true;
+    }
+    if (intents.alwaysAllow !== undefined) {
+        const removals = [...new Set(intents.alwaysAllow)];
+        if (!removals.length)
+            return { ok: false, error: "alwaysAllow must name at least one grant to remove" };
+        const unknown = removals.filter((key) => !before.alwaysAllow.includes(key));
+        if (unknown.length) {
+            return { ok: false, error: `alwaysAllow entries may only be removed, never added; not currently granted: ${unknown.join(", ")}` };
+        }
+        after.alwaysAllow = before.alwaysAllow.filter((key) => !removals.includes(key));
+    }
+    if (intents.mcpServers !== undefined) {
+        const removals = [...new Set(intents.mcpServers)];
+        if (!removals.length)
+            return { ok: false, error: "mcpServers must name at least one server to unmount" };
+        const unknown = removals.filter((name) => !before.mcpServers.includes(name));
+        if (unknown.length) {
+            return { ok: false, error: `mcpServers may only unmount servers this bot currently mounts; not mounted: ${unknown.join(", ")}` };
+        }
+        after.mcpServers = before.mcpServers.filter((name) => !removals.includes(name));
+    }
+    if (intents.skills !== undefined) {
+        const removals = [...new Set(intents.skills)];
+        if (!removals.length)
+            return { ok: false, error: "skills must name at least one skill to disable" };
+        const unknown = removals.filter((name) => !before.skills.includes(name));
+        if (unknown.length) {
+            return { ok: false, error: `skills may only be disabled, never enabled; not currently enabled: ${unknown.join(", ")}` };
+        }
+        after.skills = before.skills.filter((name) => !removals.includes(name));
+    }
+    return { ok: true, after };
+}

package/dist-server/shared/wire.js

@@ -6,3 +6,7 @@ export const EFFORT_LEVELS = ["none", "low", "medium", "high", "xhigh", "max"];
 export function isEffortLevel(value) {
     return typeof value === "string" && EFFORT_LEVELS.includes(value);
 }
+/** Lowercased Composio service slug, e.g. `gmail`. */
+export const CONNECTOR_SLUG_PATTERN = /^[a-z0-9][a-z0-9_-]{0,80}$/;
+/** Composio tool names are upper-snake, e.g. `GMAIL_SEND_EMAIL`. */
+export const CONNECTOR_TOOL_NAME_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;

package/dist-server/src/lib/composer-attachments.js

@@ -426,6 +426,11 @@ export function isPrivateAttachmentPath(path) {
     return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.[a-z0-9]+$/i
         .test(attachmentBasename(path));
 }
+/** The exact wrapper lines composeMessage writes around a pasted block. The
+ * bot needs them to tell pasted from typed text; a person reading their own
+ * message does not. Anything else on the line keeps the tag visible. */
+const PASTED_TEXT_OPEN = /^ {0,3}<pasted-text(?:[\t ]+index="\d+")?[\t ]*>[\t ]*$/i;
+const PASTED_TEXT_CLOSE = /^[\t ]*<\/pasted-text>[\t ]*$/i;
 /** Recognise CommonMark-style fenced code without pulling a Markdown parser
  * into the composer bundle. An unterminated fence deliberately protects the
  * rest of the message: examples must never turn into actionable attachments. */
@@ -511,8 +516,10 @@ function transcriptBlockStarting(line) {
 }
 const TRANSCRIPT_ATTACHMENT_TAG = /^<attached-(image|file)[\t ]+path="([^"\r\n]*)"(?:[\t ]+name="([^"\r\n]*)")?[\t ]*\/>[\t ]*$/;
 /** Split a stored user message into its display text and attachments for
- * transcript rendering. Markdown exports preserve whitespace; bubbles trim it. */
-export function splitTranscriptAttachments(text, trimDisplay = true) {
+ * transcript rendering. Markdown exports preserve whitespace; bubbles trim it.
+ * Bubbles also hide the `<pasted-text>` wrapper lines and show only what was
+ * pasted; exports keep the message exactly as the bot received it. */
+export function splitTranscriptAttachments(text, trimDisplay = true, hidePasteWrappers = true) {
     const images = [];
     const files = [];
     let display = "";
@@ -541,6 +548,8 @@ export function splitTranscriptAttachments(text, trimDisplay = true) {
                     block = null;
             }
             else if (line.toLowerCase().includes(block.closingToken)) {
+                if (block.hiddenWrapper && PASTED_TEXT_CLOSE.test(line))
+                    consumed = true;
                 block = null;
             }
         }
@@ -565,8 +574,13 @@ export function splitTranscriptAttachments(text, trimDisplay = true) {
                     consumed = true;
                 }
             }
-            if (!consumed)
+            if (!consumed) {
                 block = transcriptBlockStarting(line);
+                if (hidePasteWrappers && block?.kind === "untilToken" && block.closingToken === "</pasted-text>" && PASTED_TEXT_OPEN.test(line)) {
+                    block = { ...block, hiddenWrapper: true };
+                    consumed = true;
+                }
+            }
         }
         if (!consumed)
             display += text.slice(cursor, wholeLineEnd);
@@ -635,6 +649,14 @@ export function attachmentImageUrl(path) {
         return null;
     return `/api/attachments/${encodeURIComponent(name)}`;
 }
+/** Voice notes park as bare generated .mp3 filenames; anything else stays
+ * out of an <audio> src rather than 404ing on a private path. */
+export function attachmentAudioUrl(path) {
+    const name = attachmentBasename(path);
+    if (!/^[A-Za-z0-9-]+\.mp3$/.test(name))
+        return null;
+    return `/api/attachments/${encodeURIComponent(name)}`;
+}
 /** One intake path for files arriving by drop OR by the composer's attach
  * button, so a picked file and a dropped one can never behave differently.
  * Uploaders are injected for deterministic tests: callers own the network,