openmausbot 0.1.92 → 0.1.94

package/dist-server/local-computer-proxy.js

@@ -130,6 +130,8 @@ function windowsKnownDirs() {
     // x.ai installer
     join(localAppData, "agy", "bin"),
     // Antigravity installer
+    // Cursor installer: cursor-agent.* and its `agent` copies (MOCA-272)
+    join(localAppData, "cursor-agent"),
     join(home, ".local", "bin"),
     // claude native installer
     join(home, ".claude", "local"),
@@ -137,7 +139,9 @@ function windowsKnownDirs() {
     // Factory droid installer (%USERPROFILE%\bin)
     join(home, ".bun", "bin"),
     join(home, ".deno", "bin"),
-    join(home, "go", "bin")
+    join(home, "go", "bin"),
+    join(process.env.ProgramFiles ?? "C:\\Program Files", "Docker", "Docker", "resources", "bin")
+    // Docker Desktop installer
   ];
 }
 var cached = null;

package/dist-server/local-computer.js

@@ -22,6 +22,7 @@ var SPAWNED_PROXIES = {
   dweb: resolveProxy("drivers/dweb-proxy"),
   connectors: resolveProxy("connector-proxy"),
   mcpGate: resolveProxy("mcp-gate"),
+  mcpRemote: resolveProxy("mcp-remote-proxy"),
   phone: resolveProxy("drivers/phone-proxy"),
   hook: resolveProxy("hooks/omb-hook"),
   // Loaded by the external `pi` process via `-e`, not by this server — but

package/dist-server/mcp-gate.js

@@ -4,6 +4,60 @@ import { mkdirSync, readdirSync as readdirSync2, rmSync, statSync as statSync2,
 import { join as join2 } from "node:path";
 import { createInterface } from "node:readline";
 
+// shared/tool-scope.ts
+var SERVER_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+var CONTROL_CHARACTER = /[\x00-\x1f\x7f]/;
+var MAX_SELECTORS = 256;
+var MAX_SELECTOR_LENGTH = 1024;
+function validName(name) {
+  return typeof name === "string" && name.trim().length > 0 && name.length <= MAX_SELECTOR_LENGTH && !CONTROL_CHARACTER.test(name) && !name.includes("*");
+}
+function selectorIdentity(selector) {
+  if (selector.length > MAX_SELECTOR_LENGTH || CONTROL_CHARACTER.test(selector)) return;
+  if (selector.startsWith("native:")) {
+    const name = selector.slice(7);
+    if (name === "*" || validName(name)) return { kind: "native", name };
+  } else if (selector.startsWith("mcp:")) {
+    const separator = selector.indexOf(":", 4);
+    if (separator < 0) return;
+    const server = selector.slice(4, separator);
+    const name = selector.slice(separator + 1);
+    if (SERVER_NAME.test(server) && (name === "*" || validName(name))) {
+      return { kind: "mcp", server, name };
+    }
+  }
+}
+function parseToolScope(value) {
+  if (value === void 0) return { ok: true, scope: void 0 };
+  const invalid = { ok: false, error: "Tool selection must contain only valid allow and deny lists." };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return invalid;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return invalid;
+  const scope2 = {};
+  for (const key of Reflect.ownKeys(value)) {
+    if (key !== "allow" && key !== "deny") return invalid;
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor)) return invalid;
+    const list = descriptor.value;
+    if (!Array.isArray(list) || list.length > MAX_SELECTORS) return invalid;
+    if (!Array.from(list).every((entry) => typeof entry === "string" && selectorIdentity(entry))) return invalid;
+    scope2[key] = [...new Set(list)];
+  }
+  return { ok: true, scope: scope2 };
+}
+function matches(selector, tool) {
+  const selected = selectorIdentity(selector);
+  return selected?.kind === tool.kind && (selected.kind !== "mcp" || tool.kind === "mcp" && selected.server === tool.server) && (selected.name === "*" || selected.name === tool.name);
+}
+function permits(scope2, tool) {
+  if (!validName(tool.name) || tool.kind === "mcp" && !SERVER_NAME.test(tool.server)) return false;
+  return (scope2?.allow === void 0 || scope2.allow.some((selector) => matches(selector, tool))) && !scope2?.deny?.some((selector) => matches(selector, tool));
+}
+function allowsTool(scope2, tool) {
+  const parsed = parseToolScope(scope2);
+  return parsed.ok && permits(parsed.scope, tool);
+}
+
 // server/env-path.ts
 import { execFile } from "node:child_process";
 import { closeSync, existsSync, openSync, readFileSync, readSync, statSync, readdirSync } from "node:fs";
@@ -63,6 +117,8 @@ function windowsKnownDirs() {
     // x.ai installer
     join(localAppData, "agy", "bin"),
     // Antigravity installer
+    // Cursor installer: cursor-agent.* and its `agent` copies (MOCA-272)
+    join(localAppData, "cursor-agent"),
     join(home, ".local", "bin"),
     // claude native installer
     join(home, ".claude", "local"),
@@ -70,7 +126,9 @@ function windowsKnownDirs() {
     // Factory droid installer (%USERPROFILE%\bin)
     join(home, ".bun", "bin"),
     join(home, ".deno", "bin"),
-    join(home, "go", "bin")
+    join(home, "go", "bin"),
+    join(process.env.ProgramFiles ?? "C:\\Program Files", "Docker", "Docker", "resources", "bin")
+    // Docker Desktop installer
   ];
 }
 var cached = null;
@@ -443,21 +501,60 @@ async function stopCliTree(child2, pid, timeoutMs) {
 }
 
 // server/mcp-gate.ts
-var NAME = process.env.OMB_GATE_NAME || "mcp";
-var SPILL_DIR = process.env.OMB_GATE_SPILL_DIR || "";
-var BUDGET = Number(process.env.OMB_GATE_BUDGET) > 0 ? Number(process.env.OMB_GATE_BUDGET) : DEFAULT_RESULT_BUDGET;
+function gateEnvironment() {
+  if (process.argv.length === 2) return process.env;
+  try {
+    const key = process.argv[3];
+    if (process.argv.length !== 4 || process.argv[2] !== "--config-env" || !key || !/^OMB_GATE_CONFIG_[a-f0-9]{64}$/.test(key)) throw new Error();
+    const value = JSON.parse(process.env[key] ?? "");
+    if (!value || typeof value !== "object" || Array.isArray(value) || !["OMB_GATE_NAME", "OMB_GATE_UPSTREAM", "OMB_GATE_TOOL_SCOPE"].every((name) => typeof value[name] === "string") || !Object.entries(value).every(([name, setting]) => GATE_ENV_KEYS.includes(name) && typeof setting === "string")) throw new Error();
+    return value;
+  } catch {
+    process.stderr.write("mcp-gate: invalid private configuration\n");
+    process.exit(1);
+  }
+}
+var GATE_ENV_KEYS = ["OMB_GATE_NAME", "OMB_GATE_SPILL_DIR", "OMB_GATE_BUDGET", "OMB_GATE_UPSTREAM", "OMB_GATE_SPILL_HINT", "OMB_GATE_TOOL_SCOPE"];
+var gateEnv = gateEnvironment();
+var NAME = gateEnv.OMB_GATE_NAME || "mcp";
+var SPILL_DIR = gateEnv.OMB_GATE_SPILL_DIR || "";
+var rawBudget = Number(gateEnv.OMB_GATE_BUDGET);
+var BUDGET = Number.isFinite(rawBudget) && rawBudget >= 0 ? rawBudget : DEFAULT_RESULT_BUDGET;
 var SPILL_MAX_AGE_MS = 24 * 60 * 6e4;
-var SPILL_HINT = process.env.OMB_GATE_SPILL_HINT === "1";
-var GATE_ENV_KEYS = ["OMB_GATE_NAME", "OMB_GATE_SPILL_DIR", "OMB_GATE_BUDGET", "OMB_GATE_UPSTREAM", "OMB_GATE_SPILL_HINT"];
+var SPILL_HINT = gateEnv.OMB_GATE_SPILL_HINT === "1";
 function fail(message) {
   process.stderr.write(`mcp-gate(${NAME}): ${message}
 `);
   process.exit(1);
 }
+function toolScope() {
+  const raw = gateEnv.OMB_GATE_TOOL_SCOPE;
+  if (raw === void 0) return;
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    fail("invalid tool selection JSON");
+  }
+  const parsed = parseToolScope(value);
+  if (!parsed.ok || parsed.scope === void 0) fail("invalid tool selection; check the bot's Access settings");
+  if (!/^[a-z][a-z0-9_-]{0,31}$/.test(NAME)) fail("invalid MCP server identity for tool selection");
+  return parsed.scope;
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function requestKey(id) {
+  return typeof id === "string" || typeof id === "number" && Number.isFinite(id) ? `${typeof id}:${id}` : void 0;
+}
+function rejectRequest(id, code, message) {
+  process.stdout.write(`${JSON.stringify({ jsonrpc: "2.0", id: requestKey(id) ? id : null, error: { code, message } })}
+`);
+}
 function upstreamSpec() {
   let parsed;
   try {
-    parsed = JSON.parse(process.env.OMB_GATE_UPSTREAM ?? "");
+    parsed = JSON.parse(gateEnv.OMB_GATE_UPSTREAM ?? "");
   } catch {
     fail("OMB_GATE_UPSTREAM is not valid JSON");
   }
@@ -499,6 +596,7 @@ function spill(tool, text) {
   }
 }
 function trimCallResult(result, tool) {
+  if (BUDGET === 0) return false;
   const content = result.content;
   if (!Array.isArray(content)) return false;
   const textBlocks = content.filter(
@@ -521,10 +619,11 @@ function trimCallResult(result, tool) {
   }
   return trimmed;
 }
+var scope = toolScope();
 var spec = upstreamSpec();
 if (SPILL_DIR) sweepSpill(SPILL_DIR);
 var childEnv = { ...process.env, ...spec.env };
-for (const key of GATE_ENV_KEYS) delete childEnv[key];
+for (const key of Object.keys(childEnv)) if (key.startsWith("OMB_GATE_")) delete childEnv[key];
 var resolved = resolveCliSpawn(spec.command, spec.args ?? []);
 var child = spawn2(resolved.command, resolved.args, {
   stdio: ["pipe", "pipe", "pipe"],
@@ -556,14 +655,35 @@ child.on("error", (error) => {
 child.stderr.pipe(process.stderr);
 var pending = /* @__PURE__ */ new Map();
 createInterface({ input: process.stdin }).on("line", (line) => {
+  let message;
   if (line.trim()) {
     try {
-      const message = JSON.parse(line);
-      if (message.method === "tools/call" && message.id !== void 0 && message.id !== null) {
-        const params = message.params;
-        pending.set(String(message.id), typeof params?.name === "string" ? params.name : "tool");
-      }
+      const parsed = JSON.parse(line);
+      if (isRecord(parsed)) message = parsed;
     } catch {
+      if (scope) return rejectRequest(null, -32700, "Invalid JSON-RPC frame");
+    }
+    if (scope && (!message || message.jsonrpc !== "2.0")) return rejectRequest(message?.id, -32600, "Invalid JSON-RPC frame");
+  }
+  const id = requestKey(message?.id);
+  const params = isRecord(message?.params) ? message.params : void 0;
+  if (scope && message?.method === "tools/call") {
+    if (!id || typeof params?.name !== "string" || params.arguments !== void 0 && !isRecord(params.arguments)) {
+      return rejectRequest(message.id, -32602, "Invalid tool call");
+    }
+    if (!allowsTool(scope, { kind: "mcp", server: NAME, name: params.name })) {
+      return rejectRequest(message.id, -32602, "Tool selection excludes this tool. Check the bot's Access settings.");
+    }
+  }
+  if (scope && message?.method === "tools/list" && !id) {
+    return rejectRequest(message.id, -32600, "Tool listing needs a request ID");
+  }
+  if (id && typeof message?.method === "string") {
+    if (scope && pending.has(id)) fail("duplicate request ID on a restricted connection");
+    if (message.method === "tools/call") {
+      pending.set(id, { kind: "call", tool: typeof params?.name === "string" ? params.name : "tool" });
+    } else if (scope) {
+      pending.set(id, { kind: message.method === "tools/list" ? "list" : "other" });
     }
   }
   child.stdin.write(`${line}
@@ -574,24 +694,36 @@ createInterface({ input: child.stdout }).on("line", (line) => {
   if (!line.trim()) return;
   let message;
   try {
-    message = JSON.parse(line);
+    const parsed = JSON.parse(line);
+    if (isRecord(parsed)) message = parsed;
   } catch {
+    if (scope) fail("unreadable upstream frame on a restricted connection");
+  }
+  if (!message || scope && message.jsonrpc !== "2.0") {
+    if (scope) fail("invalid upstream frame on a restricted connection");
     process.stdout.write(`${line}
 `);
     return;
   }
-  const id = message.id === void 0 || message.id === null ? void 0 : String(message.id);
-  const tool = id === void 0 ? void 0 : pending.get(id);
+  const id = typeof message.method === "string" ? void 0 : requestKey(message.id);
+  const request = id === void 0 ? void 0 : pending.get(id);
+  if (scope && id !== void 0 && !request) fail("unrequested upstream response on a restricted connection");
   if (id !== void 0) pending.delete(id);
   const result = message.result;
-  if (tool && result && typeof result === "object" && !Array.isArray(result)) {
+  if (scope && request?.kind === "list" && message.error === void 0) {
+    if (!isRecord(result) || !Array.isArray(result.tools) || !result.tools.every((tool) => isRecord(tool) && typeof tool.name === "string" && tool.name.trim().length > 0) || result.nextCursor !== void 0 && typeof result.nextCursor !== "string") {
+      return rejectRequest(message.id, -32603, "Invalid tool catalog on a restricted connection");
+    }
+    result.tools = result.tools.filter((tool) => allowsTool(scope, { kind: "mcp", server: NAME, name: tool.name }));
+  }
+  if (request?.kind === "call" && isRecord(result)) {
     try {
-      if (trimCallResult(result, tool)) {
-        process.stderr.write(`mcp-gate(${NAME}): trimmed ${tool} to ${BUDGET} chars
+      if (trimCallResult(result, request.tool)) {
+        process.stderr.write(`mcp-gate(${NAME}): trimmed ${request.tool} to ${BUDGET} chars
 `);
       }
     } catch (error) {
-      process.stderr.write(`mcp-gate(${NAME}): could not trim ${tool}: ${String(error)}
+      process.stderr.write(`mcp-gate(${NAME}): could not trim ${request.tool}: ${String(error)}
 `);
       process.stdout.write(`${line}
 `);