openmausbot 0.1.87 → 0.1.88

package/dist-server/server/composio.js

@@ -5,6 +5,9 @@ import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { SPAWNED_PROXIES } from "./proxy-paths.js";
 import { managedConnectorUnavailableReason } from "../shared/connector-availability.js";
+import { CONNECTOR_TOOL_NAME_PATTERN } from "../shared/wire.js";
+import { CONNECTOR_ALLOWED_TOOLS_ENV, CONNECTOR_ALLOWED_TOOLS_MAX_BYTES, CONNECTOR_SERVICE_SLUGS_ENV, CONNECTOR_SERVICE_SLUGS_MAX_BYTES, serializeConnectorAllowedTools, serializeConnectorServiceSlugs, } from "./connector-advertisement.js";
+import { serviceSlugFor, serviceSlugForCandidates } from "./connector-verdict.js";
 const DEFAULT_BACKEND_ORIGIN = "https://backend.composio.dev";
 function apiBase() {
     return (process.env.OMB_COMPOSIO_API ?? `${DEFAULT_BACKEND_ORIGIN}/api/v3.1`).replace(/\/$/, "");
@@ -443,6 +446,30 @@ const NEEDS_AUTH_CONFIG = /does not manage auth|auth[_ ]?config/i;
 export async function mcpIntegration(cfg, context) {
     if (!configured(cfg))
         return null;
+    // Connector grants 3/5: a grants record rides to the bridge as a capped
+    // JSON env var so tools/list is filtered down to what the bot may call.
+    // No record (legacy all-tools bots) or one past the cap mounts without
+    // the var — the bridge then relays the unfiltered list and every call is
+    // still judged by the slice-2 verdict on the relay endpoint.
+    const allowlist = context.connectorTools === undefined
+        ? undefined
+        : serializeConnectorAllowedTools(context.connectorTools);
+    if (allowlist?.oversized) {
+        console.warn(`[composio] connector allowlist for bot ${context.botId} exceeds ${CONNECTOR_ALLOWED_TOOLS_MAX_BYTES} bytes;`
+            + " tools/list stays unfiltered and grants are enforced per call");
+    }
+    // The connected-service slugs ride alongside the allowlist so the
+    // bridge resolves underscored services (bland_ai) instead of letting a
+    // plain-prefix grant (bland) widen them. An unreachable catalog omits
+    // the var and the filter keeps its plain-split fallback; legacy
+    // all-tools bots mount without it because their list is unfiltered.
+    const serviceSlugs = context.connectorTools === undefined
+        ? undefined
+        : serializeConnectorServiceSlugs(await connectedServiceSlugs(cfg));
+    if (serviceSlugs?.oversized) {
+        console.warn(`[composio] connector service slugs for bot ${context.botId} exceed ${CONNECTOR_SERVICE_SLUGS_MAX_BYTES} bytes;`
+            + " tools/list falls back to plain-prefix resolution");
+    }
     return {
         command: process.execPath,
         args: [SPAWNED_PROXIES.connectors],
@@ -460,6 +487,8 @@ export async function mcpIntegration(cfg, context) {
             OMB_CONNECTOR_TOKEN: context.commsToken,
             OMB_BOT_ID: context.botId,
             OMB_THREAD_ID: context.threadId,
+            ...(allowlist?.env ? { [CONNECTOR_ALLOWED_TOOLS_ENV]: allowlist.env } : {}),
+            ...(serviceSlugs?.env ? { [CONNECTOR_SERVICE_SLUGS_ENV]: serviceSlugs.env } : {}),
         },
     };
 }
@@ -672,6 +701,266 @@ export async function connectedServices(cfg) {
     ]);
     return allServiceStates(summarizeAccounts(accounts, []), toolkits);
 }
+/** Semantic validation for a connectorTools patch (issue #1737): slugs
+ * must name a connected service, and every listed tool name must carry its
+ * own service prefix (GMAIL_SEND_EMAIL under "gmail") — a mismatched name
+ * would be granted yet permanently refused at call time. The prefix check
+ * resolves against the connected-service slugs, so an underscored service
+ * (bland_ai) keeps its BLAND_AI_* names and a plain-prefix grant cannot
+ * capture them; it always runs, degrading to the plain split when the
+ * connection inventory is unreachable. Only the connection-dependent and
+ * catalog checks fail open — an unreachable connection inventory, the
+ * curated fallback, or a catalog walk that did not reach its end never
+ * block the patch, because call-time enforcement (slice 2) stays the
+ * authority either way. Returns the rejection message or null. */
+export async function validateConnectorGrants(cfg, grants) {
+    const connected = await connectedServices(cfg).catch(() => null);
+    const candidates = connected ? Object.keys(connected) : [];
+    for (const [slug, grant] of Object.entries(grants)) {
+        if (grant.tools === "*")
+            continue;
+        // The prefix check runs against the connected-service slugs, so an
+        // underscored service (bland_ai) accepts its own BLAND_AI_* names —
+        // and a plain-prefix grant cannot capture them while the real service
+        // is connected.
+        const misplaced = grant.tools.filter((tool) => (serviceSlugForCandidates(tool, candidates) ?? serviceSlugFor(tool)) !== slug);
+        if (misplaced.length) {
+            return `connectorTools.${slug}.tools names tools that belong to another service: ${misplaced.join(", ")}`;
+        }
+    }
+    if (!connected)
+        return null;
+    const unconnected = Object.keys(grants).filter((slug) => !connected[slug]?.connected);
+    if (unconnected.length) {
+        return `connectorTools names services that are not connected: ${unconnected.join(", ")}`;
+    }
+    const catalog = await listToolkits(cfg);
+    // source "curated" means the marketplace was unreachable, and a walk that
+    // never reached its natural end served only part of it — either way there
+    // is nothing trustworthy to cross-check against, and a grant for a service
+    // on a page the walk never saw must not be rejected.
+    if (catalog.source !== "api" || !catalog.pagination?.complete)
+        return null;
+    const known = new Set(catalog.cards.map((card) => card.slug.toLowerCase()));
+    const unknown = Object.keys(grants).filter((slug) => !known.has(slug));
+    if (unknown.length) {
+        return `connectorTools names services missing from the connected-apps catalog: ${unknown.join(", ")}`;
+    }
+    return null;
+}
+/** The grant editor's tool inventory, grouped by service slug. Sourced from
+ * the same MCP endpoint the bots' bridge relays to (initialize + tools/list
+ * through relayMcp), so what the picker offers is exactly what a granted bot
+ * would see — in self-hosted and managed modes alike. Platform meta-tools
+ * and per-service connection flows are not per-tool grants (they ride along
+ * whenever a service is granted), so they never appear in the picker. */
+export async function listConnectorTools(cfg, options = {}) {
+    const identity = connectorToolsIdentity(cfg);
+    if (!options.force && connectorToolsCache?.identity === identity
+        && Date.now() - connectorToolsCache.at < CONNECTOR_TOOLS_CACHE_MS) {
+        return connectorToolsCache.services;
+    }
+    // Concurrent misses share one MCP walk — two editors opening together
+    // must not run the initialize + tools/list sequences twice. force
+    // bypasses the settled cache but still joins a walk already running.
+    if (connectorToolsRequest?.identity === identity)
+        return connectorToolsRequest.services;
+    const walk = collectConnectorTools(cfg).then((services) => {
+        connectorToolsCache = { at: Date.now(), identity, services };
+        return services;
+    });
+    connectorToolsRequest = { identity, services: walk };
+    try {
+        return await walk;
+    }
+    finally {
+        if (connectorToolsRequest?.services === walk)
+            connectorToolsRequest = null;
+    }
+}
+const CONNECTOR_TOOLS_CACHE_MS = 60_000;
+let connectorToolsCache = null;
+/** Which backend an inventory walk belongs to, mirroring the relay's own
+ * credential fingerprint: a project key or the managed broker. Cached
+ * inventories are keyed by it, so a config switch can never serve the
+ * previous backend's tools for another cache window. */
+function connectorToolsIdentity(cfg) {
+    const apiKey = projectApiKey(cfg);
+    if (apiKey)
+        return backendFingerprint("project-tools", apiBase(), apiKey);
+    const broker = brokerAccess();
+    return broker ? backendFingerprint("managed-tools", broker.url, broker.token) : "none";
+}
+let connectorToolsRequest = null;
+/** The service slugs grant enforcement resolves tool-name prefixes
+ * against: every key of the connection inventory, connected or not,
+ * because the real backend slugs are what separates an underscored
+ * service (bland_ai) from a plain-prefix grant (bland). Cached like the
+ * tool inventory — 60s, keyed by backend identity, one shared in-flight
+ * walk — and an unreachable inventory reads as an empty list without
+ * caching the failure, so callers fall back to the plain split and the
+ * next call retries. */
+export async function connectedServiceSlugs(cfg) {
+    const identity = connectorToolsIdentity(cfg);
+    if (connectorServiceSlugsCache?.identity === identity
+        && Date.now() - connectorServiceSlugsCache.at < CONNECTOR_SERVICE_SLUGS_CACHE_MS) {
+        return connectorServiceSlugsCache.slugs;
+    }
+    if (connectorServiceSlugsRequest?.identity === identity)
+        return connectorServiceSlugsRequest.slugs;
+    const walk = connectedServices(cfg).then((services) => {
+        const slugs = Object.keys(services);
+        connectorServiceSlugsCache = { at: Date.now(), identity, slugs };
+        return slugs;
+    }, () => []);
+    connectorServiceSlugsRequest = { identity, slugs: walk };
+    try {
+        return await walk;
+    }
+    finally {
+        if (connectorServiceSlugsRequest?.slugs === walk)
+            connectorServiceSlugsRequest = null;
+    }
+}
+const CONNECTOR_SERVICE_SLUGS_CACHE_MS = 60_000;
+let connectorServiceSlugsCache = null;
+let connectorServiceSlugsRequest = null;
+/** Tool names longer than any Composio description worth searching. */
+const TOOL_DESCRIPTION_MAX = 240;
+const TOOLS_LIST_PAGES_MAX = 10;
+function connectorToolListing(tool) {
+    if (!tool || typeof tool !== "object" || Array.isArray(tool))
+        return null;
+    const name = tool.name;
+    if (typeof name !== "string" || !CONNECTOR_TOOL_NAME_PATTERN.test(name))
+        return null;
+    if (name.startsWith("COMPOSIO_"))
+        return null;
+    if (name.endsWith("_MANAGE_CONNECTIONS") || name.endsWith("_WAIT_FOR_CONNECTIONS"))
+        return null;
+    const description = tool.description;
+    const trimmed = typeof description === "string"
+        ? description.replace(/\s+/g, " ").trim().slice(0, TOOL_DESCRIPTION_MAX)
+        : "";
+    return trimmed ? { name, description: trimmed } : { name };
+}
+/** One JSON-RPC response frame from a JSON or SSE body, mirroring the
+ * bridge's parseUpstream: SSE data lines are tried in order and the frame
+ * carrying the request id wins. */
+function parseMcpResponse(text, id) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return null;
+    const candidate = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+    if (trimmed.startsWith("{")) {
+        const parsed = JSON.parse(trimmed);
+        return candidate(parsed) ? parsed : null;
+    }
+    const frames = trimmed
+        .split(/\r?\n/)
+        .filter((line) => line.startsWith("data:"))
+        .map((line) => line.slice(5).trim())
+        .filter((line) => line && line !== "[DONE]")
+        .flatMap((line) => {
+        try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        }
+    })
+        .filter(candidate);
+    return frames.findLast((frame) => frame.id === id) ?? frames.at(-1) ?? null;
+}
+async function collectConnectorTools(cfg) {
+    // Connected services are the real slugs, so they resolve underscored
+    // services (bland_ai) the plain split would file under "bland"; an
+    // unreachable inventory degrades to that split.
+    const connected = await connectedServices(cfg).catch(() => null);
+    const candidates = connected ? Object.keys(connected) : [];
+    const initialize = await relayMcp(cfg, {
+        jsonrpc: "2.0",
+        id: "omb-grants-initialize",
+        method: "initialize",
+        params: {
+            protocolVersion: "2025-03-26",
+            capabilities: {},
+            clientInfo: { name: "openmausbot-grant-editor", version: "1" },
+        },
+    });
+    if (initialize.status !== 200) {
+        throw new Error(await responseErrorFromBytes(initialize.status, initialize.bytes));
+    }
+    const transportSessionId = initialize.transportSessionId;
+    // Streamable-HTTP servers expect the handshake notification before the
+    // first request; it carries no response, so failures are not fatal.
+    await relayMcp(cfg, {
+        jsonrpc: "2.0",
+        method: "notifications/initialized",
+    }, transportSessionId).catch(() => undefined);
+    const grouped = new Map();
+    let cursor;
+    for (let page = 0; page < TOOLS_LIST_PAGES_MAX; page += 1) {
+        const list = await relayMcp(cfg, {
+            jsonrpc: "2.0",
+            id: "omb-grants-tools",
+            method: "tools/list",
+            params: cursor ? { cursor } : {},
+        }, transportSessionId);
+        if (list.status !== 200) {
+            throw new Error(await responseErrorFromBytes(list.status, list.bytes));
+        }
+        const frame = parseMcpResponse(new TextDecoder().decode(list.bytes), "omb-grants-tools");
+        const error = frame && typeof frame.error === "object" && frame.error !== null
+            ? frame.error.message
+            : undefined;
+        if (typeof error === "string" && error)
+            throw new Error(error);
+        const result = frame && typeof frame.result === "object" && frame.result !== null
+            ? frame.result
+            : undefined;
+        if (!result || !Array.isArray(result.tools)) {
+            throw new Error("Composio returned a tools/list response without a tools array");
+        }
+        for (const tool of result.tools) {
+            const listing = connectorToolListing(tool);
+            if (!listing)
+                continue;
+            const slug = serviceSlugForCandidates(listing.name, candidates) ?? serviceSlugFor(listing.name);
+            if (!slug)
+                continue;
+            const bucket = grouped.get(slug) ?? [];
+            if (!bucket.some((existing) => existing.name === listing.name))
+                bucket.push(listing);
+            grouped.set(slug, bucket);
+        }
+        cursor = typeof result.nextCursor === "string" && result.nextCursor ? result.nextCursor : undefined;
+        if (!cursor)
+            break;
+    }
+    for (const bucket of grouped.values())
+        bucket.sort((a, b) => a.name.localeCompare(b.name));
+    return Object.fromEntries([...grouped.entries()].sort(([a], [b]) => a.localeCompare(b)));
+}
+async function responseErrorFromBytes(status, bytes) {
+    try {
+        const body = JSON.parse(new TextDecoder().decode(bytes));
+        const message = body && typeof body === "object" && !Array.isArray(body)
+            ? body.error
+            : undefined;
+        if (message && typeof message === "object" && !Array.isArray(message)) {
+            const text = message.message;
+            if (typeof text === "string" && text)
+                return text;
+        }
+        if (typeof message === "string" && message)
+            return message;
+    }
+    catch {
+        // fall through to the generic status line
+    }
+    return `Composio tools/list: HTTP ${status}`;
+}
 export async function connectionStatus(cfg, slugs) {
     const canonicalSlugs = [...new Set(slugs.map(canonicalToolkitSlug))];
     const apiKey = projectApiKey(cfg);
@@ -989,9 +1278,16 @@ export async function listToolkits(cfg) {
                 const pagingStoppedEarly = lastReportedPage !== undefined
                     && reportedTotalPages !== undefined
                     && lastReportedPage < reportedTotalPages;
-                const pagination = { items: uniqueCards.length, stalled: shortOfReportedTotal || pagingStoppedEarly };
+                const stalled = shortOfReportedTotal || pagingStoppedEarly;
+                // "end" and "total-reached" are the walk's natural finishes; every
+                // other stop reason left pages unread even when the API reports no
+                // totals for stalled to compare against.
+                const complete = (stop === "end" || stop === "total-reached") && !stalled;
+                const pagination = { items: uniqueCards.length, stalled, complete };
                 if (reportedTotalItems !== undefined)
                     pagination.totalItems = reportedTotalItems;
+                if (pagination.stalled)
+                    pagination.reason = stop;
                 if (pagination.stalled) {
                     console.warn(`[composio] marketplace catalog paging stopped early (${stop}) after ${uniqueCards.length} toolkits`
                         + (reportedTotalItems !== undefined ? ` of ~${reportedTotalItems}` : "")

package/dist-server/server/config.js

@@ -33,7 +33,7 @@ export const MAX_THREAD_EVENT_LOG_BYTES = 4 * 1024 * 1024 * 1024;
 export const DEFAULT_LOCAL_VM_MODE = "shared";
 export const DEFAULT_LOCAL_VM_MAX_INSTANCES = 2;
 export const MIN_LOCAL_VM_MAX_INSTANCES = 1;
-export const MAX_LOCAL_VM_MAX_INSTANCES = 4;
+export const MAX_LOCAL_VM_MAX_INSTANCES = 8;
 export function isValidSshAlias(value) {
     return typeof value === "string" && SSH_ALIAS.test(value);
 }
@@ -683,13 +683,35 @@ function migrateLegacyFeatureFlags() {
         console.error(`[config] could not rename features.skillRecorder: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/** The last "config.json is being ignored" warning, so a file that stays
+ * broken is reported once rather than on every loadConfig() call. */
+let lastIgnoredConfigWarning = "";
 export function loadConfig() {
     let cfg = {};
     try {
         cfg = parseStoredConfig(parseJson(readFileSync(join(DATA_DIR, "config.json"), "utf8")));
+        lastIgnoredConfigWarning = "";
     }
-    catch {
-        /* first run — env fallbacks below */
+    catch (error) {
+        // No file yet is a normal first run: env fallbacks below. Any other failure
+        // (unreadable file, invalid JSON, a schema error in one field) means the
+        // whole file is being ignored for this process — every instance, account
+        // and setting in it — so say why instead of silently running on defaults.
+        // saveConfig() still merges into the raw file, so nothing on disk is lost;
+        // the user just needs to know which field to fix.
+        if (error?.code !== "ENOENT") {
+            // JSON.parse includes a fragment of the input in some error messages.
+            // A malformed credential must never be copied into the server log.
+            const reason = error instanceof SyntaxError ? "invalid JSON"
+                : error instanceof Error ? error.message : "unable to read configuration";
+            const warning = `config: ignoring ${join(DATA_DIR, "config.json")} and using defaults: ${reason}`;
+            if (warning !== lastIgnoredConfigWarning)
+                console.warn(warning);
+            lastIgnoredConfigWarning = warning;
+        }
+        else {
+            lastIgnoredConfigWarning = "";
+        }
     }
     // Env wins over the file for every credential. The desktop shell keeps
     // these secrets OS-encrypted and hands them to this process as env at

package/dist-server/server/connector-advertisement.js

@@ -0,0 +1,165 @@
+// Advertisement filtering for the connector MCP bridge (issue #1737, part
+// of the per-bot Composio tool grants umbrella #1734).
+//
+// Call-time enforcement (connector-verdict.ts, slice 2) stays the
+// authority: it judges the real tool names on the harness relay endpoint,
+// where the loopback token already names the bot. This module is surface
+// only — it trims a tools/list response to the tools the bot was granted,
+// so the model is never offered a call that would be refused a moment
+// later. The allowlist reaches the bridge as JSON in the environment, the
+// same channel every other bridge input uses; whenever filtering cannot
+// run — no env var, malformed env, oversized payload — the bridge relays
+// the list untouched and the grants stay enforced at call time.
+import { CONNECTOR_SLUG_PATTERN, CONNECTOR_TOOL_NAME_PATTERN } from "../shared/wire.js";
+import { serviceSlugFor, serviceSlugForCandidates } from "./connector-verdict.js";
+/** The env var mcpIntegration sets and connector-proxy.ts reads. */
+export const CONNECTOR_ALLOWED_TOOLS_ENV = "OMB_CONNECTOR_ALLOWED_TOOLS";
+/** The env var carrying the connected-service slugs the filter resolves
+ * tool-name prefixes against. Without it the filter falls back to the
+ * plain first-segment split, exactly as when the catalog is unreachable. */
+export const CONNECTOR_SERVICE_SLUGS_ENV = "OMB_CONNECTOR_SERVICE_SLUGS";
+/** Upper bound for the serialized allowlist. Past it the env var is
+ * omitted entirely (mounting must never depend on catalog size) and the
+ * bot keeps the unfiltered list with call-time enforcement only. */
+export const CONNECTOR_ALLOWED_TOOLS_MAX_BYTES = 32 * 1024;
+/** Upper bound for the serialized slug list; past it the env var is
+ * omitted and the filter falls back to the plain split. */
+export const CONNECTOR_SERVICE_SLUGS_MAX_BYTES = 32 * 1024;
+/** The platform meta-tools. They name no connected-app tool themselves —
+ * search and schemas discover, the executor runs what it is told — so
+ * they stay advertised whenever any tool is granted; the executor's
+ * arguments are still judged call-time by connector-verdict.ts. */
+export const CONNECTOR_META_TOOLS = [
+    "COMPOSIO_SEARCH_TOOLS",
+    "COMPOSIO_GET_TOOL_SCHEMAS",
+    "COMPOSIO_MULTI_EXECUTE_TOOL",
+    // Session-level connection meta-tools. COMPOSIO_MANAGE_CONNECTIONS ships
+    // in every Composio session; COMPOSIO_WAIT_FOR_CONNECTIONS is opt-in and
+    // off by default. They prefix as service "composio", which no grant
+    // names, so they ride this list instead of CONNECTION_TOOL_SUFFIXES —
+    // connector-proxy intercepts their calls to surface connection cards.
+    // The filter only keeps names upstream actually lists, so advertising an
+    // opted-out tool changes nothing.
+    "COMPOSIO_MANAGE_CONNECTIONS",
+    "COMPOSIO_WAIT_FOR_CONNECTIONS",
+];
+const CONNECTION_TOOL_SUFFIXES = ["_MANAGE_CONNECTIONS", "_WAIT_FOR_CONNECTIONS"];
+/** Harness side: serialize a grants record for the bridge env, or report
+ * that it exceeded the cap (the caller warns and omits it). */
+export function serializeConnectorAllowedTools(grants) {
+    const env = JSON.stringify(grants);
+    if (Buffer.byteLength(env, "utf8") > CONNECTOR_ALLOWED_TOOLS_MAX_BYTES)
+        return { oversized: true };
+    return { env, oversized: false };
+}
+/** Harness side: serialize the connected-service slugs for the bridge
+ * env, or report that they exceeded the cap. Duplicate or non-slug
+ * entries are dropped rather than failing the whole mount. */
+export function serializeConnectorServiceSlugs(slugs) {
+    const unique = [...new Set(slugs.filter((slug) => CONNECTOR_SLUG_PATTERN.test(slug)))];
+    if (!unique.length)
+        return { oversized: false };
+    const env = JSON.stringify(unique);
+    if (Buffer.byteLength(env, "utf8") > CONNECTOR_SERVICE_SLUGS_MAX_BYTES)
+        return { oversized: true };
+    return { env, oversized: false };
+}
+/** Bridge side: decode and shape-check the allowlist env. Anything off —
+ * absent, unparseable, wrong shapes — reads as "no allowlist" so the
+ * bridge degrades to relaying the unfiltered list rather than guessing a
+ * narrower one. Call-time enforcement holds either way. */
+export function parseConnectorAllowedToolsEnv(raw) {
+    if (!raw)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const grants = {};
+    for (const [slug, grant] of Object.entries(value)) {
+        if (!CONNECTOR_SLUG_PATTERN.test(slug))
+            return null;
+        if (!grant || typeof grant !== "object" || Array.isArray(grant))
+            return null;
+        const tools = grant.tools;
+        if (tools === "*") {
+            grants[slug] = { tools: "*" };
+            continue;
+        }
+        if (!Array.isArray(tools) || tools.length === 0)
+            return null;
+        if (!tools.every((tool) => typeof tool === "string" && CONNECTOR_TOOL_NAME_PATTERN.test(tool))) {
+            return null;
+        }
+        grants[slug] = { tools };
+    }
+    return grants;
+}
+/** Bridge side: decode the connected-service slug list. Anything off —
+ * absent, unparseable, or one bad entry — reads as an empty list so the
+ * filter degrades to the plain split instead of trusting a partial
+ * inventory. */
+export function parseConnectorServiceSlugsEnv(raw) {
+    if (!raw)
+        return [];
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(value))
+        return [];
+    return value.every((slug) => typeof slug === "string" && CONNECTOR_SLUG_PATTERN.test(slug))
+        ? value
+        : [];
+}
+/** Whether one advertised tool name survives the filter. A tool is
+ * offered when its service is granted with `"*`", when its exact name is
+ * granted, or when it is that service's connection flow — a card the
+ * person approves, which slice 2 passes through at call time and which a
+ * bot granted a service should still be able to offer for another
+ * account. */
+export function connectorToolAdvertised(name, grants, candidates = []) {
+    if (Object.keys(grants).length > 0 && CONNECTOR_META_TOOLS.includes(name))
+        return true;
+    // The connected-service slugs are the resolver's candidates, so an
+    // underscored service (bland_ai) claims its own tools instead of a
+    // plain-prefix grant (bland) widening them; an unreachable catalog
+    // leaves the list empty and the plain split stands.
+    const service = serviceSlugForCandidates(name, candidates) ?? serviceSlugFor(name);
+    const grant = service === null ? undefined : grants[service];
+    if (!grant)
+        return false;
+    if (grant.tools === "*")
+        return true;
+    if (grant.tools.includes(name))
+        return true;
+    return CONNECTION_TOOL_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+/** Filter one upstream tools/list response — the bridge normalizes SSE and
+ * JSON upstreams to a single frame first, so both shapes flow through
+ * here. Returns a shallow copy with result.tools trimmed; a frame without
+ * a readable tools array passes through unchanged (degrade, never guess).
+ * Entries the filter cannot read a name from are kept as-is. */
+export function filterToolsListFrame(frame, grants, candidates = []) {
+    const result = frame.result;
+    if (!result || typeof result !== "object" || Array.isArray(result))
+        return frame;
+    const tools = result.tools;
+    if (!Array.isArray(tools))
+        return frame;
+    const kept = tools.filter((tool) => {
+        const name = tool && typeof tool === "object" && !Array.isArray(tool)
+            ? tool.name
+            : undefined;
+        return typeof name === "string" ? connectorToolAdvertised(name, grants, candidates) : true;
+    });
+    return { ...frame, result: { ...result, tools: kept } };
+}

package/dist-server/server/connector-proxy.js

@@ -4,15 +4,24 @@
 // to the configured Composio Session, but connection requests are converted
 // into first-class OpenMausBot chat cards. The agent never authors an auth
 // URL and credentials never pass through its transcript.
+// tools/list responses are trimmed to this bot's granted tools as a
+// prompt-time hint; every call is still judged harness-side by the grants
+// relay.
 //
 // stdout is the MCP transport. Never log there.
 import readline from "node:readline";
 import { randomUUID } from "node:crypto";
+import { CONNECTOR_ALLOWED_TOOLS_ENV, CONNECTOR_SERVICE_SLUGS_ENV, filterToolsListFrame, parseConnectorAllowedToolsEnv, parseConnectorServiceSlugsEnv, } from "./connector-advertisement.js";
 const UPSTREAM = process.env.OMB_CONNECTOR_UPSTREAM_URL ?? "";
 const HARNESS = process.env.OMB_HARNESS_URL ?? "http://127.0.0.1:8799";
 const BOT_ID = process.env.OMB_BOT_ID ?? "";
 const THREAD_ID = process.env.OMB_THREAD_ID ?? "";
 const TOKEN = process.env.OMB_CONNECTOR_TOKEN ?? process.env.OMB_COMMS_TOKEN ?? "";
+// The bot's effective tool grants, or null when the harness sent none —
+// legacy bots, oversized allowlists, anything unreadable. null means the
+// upstream list is relayed verbatim; the harness still judges every call.
+const ALLOWED_TOOLS = parseConnectorAllowedToolsEnv(process.env[CONNECTOR_ALLOWED_TOOLS_ENV]);
+const SERVICE_SLUGS = parseConnectorServiceSlugsEnv(process.env[CONNECTOR_SERVICE_SLUGS_ENV]);
 const MAX_RESPONSE_BYTES = 20 * 1024 * 1024;
 const INITIALIZE_RELAY_TIMEOUT_MS = 1_000;
 const RELAY_TIMEOUT_MS = 10 * 60_000;
@@ -210,8 +219,11 @@ async function handle(message) {
     }
     try {
         const response = await relay(message);
-        if (response && id !== undefined)
-            send(response);
+        if (response && id !== undefined) {
+            send(method === "tools/list" && ALLOWED_TOOLS
+                ? filterToolsListFrame(response, ALLOWED_TOOLS, SERVICE_SLUGS)
+                : response);
+        }
     }
     catch (error) {
         if (id === undefined)

package/dist-server/server/connector-verdict.js

@@ -33,6 +33,22 @@ export function serviceSlugFor(tool) {
         return null;
     return tool.slice(0, underscore).toLowerCase();
 }
+/** The service a Composio tool name belongs to when the caller knows the
+ * real service slugs. Slugs may contain underscores (bland_ai), which the
+ * plain first-segment split above cannot see — BLAND_AI_MAKE_CALL splits
+ * as "bland". When a known candidate matches the name's prefix, the
+ * longest candidate wins (bland_ai over bland), so an underscored service
+ * keeps its own tools; with no matching candidate the caller falls back
+ * to serviceSlugFor. */
+export function serviceSlugForCandidates(tool, candidates) {
+    let match = null;
+    for (const candidate of candidates) {
+        if (tool.startsWith(candidate.toUpperCase() + "_") && (match === null || candidate.length > match.length)) {
+            match = candidate;
+        }
+    }
+    return match;
+}
 /** Classify one relayed JSON-RPC frame. Anything that is not a tools/call,
  * or is a discovery/connection/platform meta-tool, passes through. */
 export function connectorCallFromFrame(payload) {
@@ -99,16 +115,27 @@ function multiExecuteCall(invoked, args) {
 }
 /** Judge distinct target names against a bot's grants. grants undefined
  * is the legacy all-tools bot and passes everything; an explicit record —
- * including the empty one — allows only what it names. */
-export function evaluateConnectorTools(names, grants) {
+ * including the empty one — allows only what it names. Service keys are
+ * read as own properties only: a name like CONSTRUCTOR_X maps to the
+ * "constructor" service, and the inherited property must never pose as
+ * a grant.
+ * candidates are the caller's connected-service slugs: the real backend
+ * slugs, so an underscored service (bland_ai) keeps its own tools instead
+ * of a plain-prefix grant (bland) capturing them. An empty list means the
+ * connected-service catalog was unreachable, and the plain first-segment
+ * split stands as the fallback — call-time enforcement degrades open, the
+ * same way advertisement filtering does. */
+export function evaluateConnectorTools(names, grants, candidates = []) {
     if (grants === undefined) {
         return { allowed: true, legacy: true, denials: [], rule: "composio" };
     }
     const denials = [];
     let rule = "";
     for (const tool of new Set(names)) {
-        const service = serviceSlugFor(tool);
-        const grant = service === null ? undefined : grants[service];
+        const service = serviceSlugForCandidates(tool, candidates) ?? serviceSlugFor(tool);
+        const grant = service !== null && Object.hasOwn(grants, service)
+            ? grants[service]
+            : undefined;
         if (grant && (grant.tools === "*" || grant.tools.includes(tool))) {
             if (!rule)
                 rule = "connectorTools." + service;