openmausbot 0.1.92 → 0.1.94

package/dist-server/server/drivers/cerebras.js

@@ -0,0 +1,108 @@
+import { z } from "zod";
+import { createOpenAIChatRuntime } from "./openai-chat.js";
+// Cerebras serves open models on wafer-scale chips: same OpenAI chat
+// contract, several times the tokens per second of a GPU cloud.
+const DEFAULT_URL = "https://api.cerebras.ai/v1";
+// The account tier is unknown: use the shared free-tier limit, not paid 128K.
+// https://inference-docs.cerebras.ai/models/overview
+const DEFAULT_MODELS = {
+    default: "gpt-oss-120b",
+    options: [
+        { id: "gpt-oss-120b", label: "GPT OSS 120B", contextWindow: 65536 },
+        { id: "qwen-3.8-27b", label: "Qwen3.8 27B", contextWindow: 65536 },
+    ],
+};
+const configSchema = z.object({
+    url: z.string().trim().url().default(DEFAULT_URL),
+    model: z.string().trim().min(1).optional(),
+    tools: z.boolean().optional(),
+});
+function decodeConfig(raw) {
+    const config = configSchema.parse(raw ?? {});
+    config.url = config.url.replace(/\/+$/, "");
+    const url = new URL(config.url);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" &&
+        ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+        throw new Error("Cerebras requires HTTPS, except for a local test endpoint.");
+    }
+    return config;
+}
+const modelCard = z.object({ id: z.string().min(1) });
+/** Cerebras answers "Only 'text' content type can be used" for these. */
+const TEXT_ONLY_MODELS = /^(?:gpt-oss|llama3\.1-8b|llama-3\.3-70b)/i;
+export const CerebrasDriver = {
+    driverKind: "cerebras",
+    metadata: { displayName: "Cerebras (API)", supportsMultipleInstances: true, access: "api" },
+    models: DEFAULT_MODELS,
+    install: {
+        docsUrl: "https://cloud.cerebras.ai/",
+        settings: "connections",
+        signInCommand: "Save a Cerebras API key in Settings → Connections, or set CEREBRAS_API_KEY on the server.",
+    },
+    decodeConfig,
+    defaultConfig: () => decodeConfig({}),
+    async create(input) {
+        const { config } = input;
+        const apiKey = (input.environment.CEREBRAS_API_KEY ?? process.env.CEREBRAS_API_KEY ?? "").trim();
+        const known = new Map(DEFAULT_MODELS.options.map((option) => [option.id, option]));
+        const withConfiguredModel = (options) => {
+            const preferred = config.model ?? DEFAULT_MODELS.default;
+            if (config.model && !options.some((option) => option.id === config.model)) {
+                options = [{ id: config.model, label: config.model }, ...options];
+            }
+            return { default: options.some((option) => option.id === preferred) ? preferred : options[0].id, options };
+        };
+        let catalog = withConfiguredModel(DEFAULT_MODELS.options);
+        const refreshModels = async () => {
+            if (!apiKey)
+                return;
+            try {
+                const response = await fetch(`${config.url}/models`, {
+                    headers: { authorization: `Bearer ${apiKey}` },
+                    redirect: "error",
+                    signal: AbortSignal.timeout(8_000),
+                });
+                if (!response.ok)
+                    return;
+                const json = await response.json();
+                const rows = Array.isArray(json) ? json : z.object({ data: z.array(z.unknown()) }).parse(json).data;
+                const options = [];
+                const seen = new Set();
+                for (const row of rows) {
+                    const parsed = modelCard.safeParse(row);
+                    if (!parsed.success || !parsed.data.id.trim() || seen.has(parsed.data.id))
+                        continue;
+                    seen.add(parsed.data.id);
+                    options.push(known.get(parsed.data.id) ?? { id: parsed.data.id, label: parsed.data.id });
+                }
+                if (options.length)
+                    catalog = withConfiguredModel(options);
+            }
+            catch {
+                // A failed refresh keeps the last usable catalog, including custom models.
+            }
+        };
+        if (apiKey)
+            void refreshModels();
+        return createOpenAIChatRuntime({
+            input, driverKind: "cerebras", apiKey, apiUrl: config.url,
+            tools: config.tools, models: () => catalog, refreshModels, reasoning: true,
+            reasoningReplayField: "reasoning",
+            computerUse: true, imageInput: (model) => !TEXT_ONLY_MODELS.test(model),
+            nudgeAnnouncedAction: true,
+            requestBody: (model, messages, stream) => ({
+                model, messages, stream,
+                ...(stream ? { stream_options: { include_usage: true } } : {}),
+            }),
+            httpErrorLabel: "Cerebras",
+            missingKeyError: "Save a Cerebras API key in Settings → Connections, or set CEREBRAS_API_KEY.",
+            unavailableReason: "No Cerebras API key — open Settings → Connections.",
+            timeoutMs: 180_000, billing: "metered", includeUsageInCompleted: true,
+            nativeLog: {
+                source: "cerebras.chat.completions",
+                outgoing: (_turn, messages, model) => ({ model, messageCount: messages.length }),
+                incoming: ({ text, reasoning, usage }) => ({ textLength: text.length, reasoningLength: reasoning.length, usage }),
+            },
+        });
+    },
+};

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -8,6 +8,8 @@ import { augmentedPath } from "../env-path.js";
 import { killCliTree, spawnCli } from "../procs.js";
 import { chatImage } from "./chat-images.js";
 import { ChatBoatClient } from "./chat-boat-tools.js";
+import { mcpStdioServer } from "../mcp-gate-config.js";
+import { allowsTool, canUseMcpServer, parseToolScope } from "../../shared/tool-scope.js";
 /** The transport cannot safely continue this turn. A dispatched operation may
  * already have taken effect, so callers must not retry it through a new round. */
 export class ChatToolSessionError extends Error {
@@ -190,7 +192,7 @@ class ChatMcpClient {
             throw error;
         }
     }
-    async tools(signal) {
+    async tools(signal, include = () => true) {
         const deadline = Date.now() + STARTUP_MS;
         const remaining = () => {
             if (Date.now() >= deadline)
@@ -212,7 +214,7 @@ class ChatMcpClient {
             const result = await this.call("tools/list", cursor ? { cursor } : {}, signal, remaining());
             if (!object(result) || !Array.isArray(result.tools))
                 throw new Error("MCP tools/list returned an invalid result");
-            tools.push(...result.tools);
+            tools.push(...result.tools.filter(include));
             if (tools.length > TOOL_COUNT)
                 throw new Error("MCP tool count exceeds the 128-tool limit");
             if (result.nextCursor === undefined)
@@ -266,23 +268,46 @@ function boundedText(value) {
         end -= 1;
     return `${bytes.subarray(0, end).toString()}\n[MCP result truncated at 50KB; request less output.]`;
 }
-export async function mountChatTools(integrations, signal, computerUse = false) {
+/** Optional fields a tool documents as "omit to use the default", where a
+ * blank string is an error instead. Smaller models fill optional fields with
+ * "" rather than leaving them out; dropping the blank restores the documented
+ * call. agent_browser_read: "Omit url to read the active tab." */
+const BUILT_IN_BROWSER_BLANK_MEANS_OMITTED = {
+    agent_browser_read: ["url"],
+};
+function omitBlankDefaults(builtInBrowser, tool, args) {
+    if (!builtInBrowser || !object(args))
+        return;
+    for (const field of BUILT_IN_BROWSER_BLANK_MEANS_OMITTED[tool] ?? []) {
+        const value = args[field];
+        if (typeof value === "string" && !value.trim())
+            delete args[field];
+    }
+}
+export async function mountChatTools(integrations, signal, computerUse = false, toolScope) {
+    const parsed = parseToolScope(toolScope);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
+    const scope = parsed.scope;
     const servers = [];
-    if (computerUse && integrations?.computer)
+    const eligible = (server) => scope === undefined || canUseMcpServer(scope, server);
+    if (computerUse && integrations?.computer && eligible("computer"))
         servers.push(["computer", integrations.computer]);
-    if (computerUse && integrations?.localComputer)
+    if (computerUse && integrations?.localComputer && eligible("computer"))
         servers.push(["computer", integrations.localComputer]);
-    if (computerUse && integrations?.browser)
+    if (computerUse && integrations?.browser && eligible("browser"))
         servers.push(["browser", integrations.browser]);
-    if (integrations?.agents)
+    if (integrations?.agents && eligible("agents"))
         servers.push(["agents", integrations.agents]);
-    if (integrations?.composio)
+    if (integrations?.composio && eligible("composio"))
         servers.push(["composio", integrations.composio]);
-    // this client starts its servers and talks over stdio; a remote (url)
-    // entry is skipped here and reaches Claude and Codex bots
     for (const [name, server] of Object.entries(integrations?.custom ?? {})) {
-        if ("command" in server)
-            servers.push([name, server]);
+        if (!eligible(name))
+            continue;
+        const stdio = mcpStdioServer(server, { nodeEnv: { ELECTRON_RUN_AS_NODE: "1" } });
+        if (!stdio)
+            throw new Error("MCP server configuration is invalid");
+        servers.push([name, { command: stdio.command, args: stdio.args ?? [], env: stdio.env ?? {} }]);
     }
     if (servers.length > 32)
         throw new Error("MCP server count exceeds the 32-server limit");
@@ -316,12 +341,14 @@ export async function mountChatTools(integrations, signal, computerUse = false)
             // image delivery, including custom servers. Text stays bounded below.
             const client = "boxId" in descriptor ? new ChatBoatClient(descriptor) : new ChatMcpClient(descriptor, computerUse);
             clients.push(client);
-            return { name, client, tools: await client.tools(signal) };
+            const include = (tool) => scope === undefined || (object(tool) && typeof tool.name === "string" && allowsTool(scope, { kind: "mcp", server: name, name: tool.name }));
+            const tools = client instanceof ChatMcpClient ? await client.tools(signal, include) : (await client.tools()).filter(include);
+            return { name, client, builtInBrowser: descriptor === integrations?.browser, tools };
         }));
         for (const mount of mounts) {
             if (mount.status === "rejected")
                 throw mount.reason;
-            const { name: server, client, tools } = mount.value;
+            const { name: server, client, builtInBrowser, tools } = mount.value;
             const originalNames = new Set();
             for (const tool of tools) {
                 if (!object(tool) || typeof tool.name !== "string" || !tool.name.trim() || originalNames.has(tool.name))
@@ -352,7 +379,7 @@ export async function mountChatTools(integrations, signal, computerUse = false)
                     const suffix = `_${index}`;
                     name = base.slice(0, 64 - suffix.length) + suffix;
                 }
-                registered.set(name, { client, name: tool.name, schema });
+                registered.set(name, { client, server, builtInBrowser, name: tool.name, schema });
                 definitions.push({ type: "function", function: { name, description, parameters } });
                 if (Buffer.byteLength(JSON.stringify(definitions)) > CATALOG_BYTES)
                     throw new Error("MCP tool catalog exceeds the 1MB limit");
@@ -371,6 +398,9 @@ export async function mountChatTools(integrations, signal, computerUse = false)
         const tool = registered.get(name);
         if (!tool)
             throw new Error("The requested tool was not advertised for this turn");
+        if (scope !== undefined && !allowsTool(scope, { kind: "mcp", server: tool.server, name: tool.name }))
+            throw new Error("Tool selection excludes this tool");
+        omitBlankDefaults(tool.builtInBrowser, tool.name, args);
         if (!object(args) || !tool.schema(args))
             throw new Error("Tool arguments do not match the advertised input schema; use its required fields and types");
     };

package/dist-server/server/drivers/claude.js

@@ -20,6 +20,8 @@ import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
 import { ClaudeLoginController } from "./claude-login-auth.js";
 import { gateServer, resultBudget } from "../mcp-gate-config.js";
+import { canUseMcpServer } from "../../shared/tool-scope.js";
+import { assertToolScopeSupported } from "../../shared/tool-scope-support.js";
 import { newEventId, newId } from "../contracts.js";
 import { askInputSummary, commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
@@ -1032,11 +1034,18 @@ export const ClaudeDriver = {
         // harness snapshots every instance whenever it describes them — app
         // load, the Engines page, and right after `claude update`, which is
         // exactly when the answer changes — so a turn normally finds it filled.
-        // Most turns before any snapshot assume a current CLI. A coordinated
-        // turn checks first because the snapshot-refresh flag is newer than the
+        // Most flags before any snapshot assume a current CLI; autocompact
+        // requires confirmed help support. A coordinated turn checks first
+        // because the snapshot-refresh flag is newer than the
         // other context controls and an unknown flag would reject that request.
         let cliVersion = null;
         let cliVersionChecked = false;
+        // Whether `claude --help` lists --autocompact, read once per CLI version
+        // by snapshot(). The flag is not in every build above its version floor
+        // (2.1.129 rejects it), so the listing wins over the floor; null until
+        // probed, or when the probe fails.
+        let cliHasAutocompact = null;
+        let cliHelpVersion = null;
         const readCliVersion = (env) => new Promise((resolve) => {
             execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout.trim() || null));
         });
@@ -1120,6 +1129,7 @@ export const ClaudeDriver = {
         // is a fresh sendTurn, and the attempt cap must survive across launches
         const retryState = new Map();
         const sendTurn = async (turn, logicalTurnId) => {
+            turn = { ...turn, toolScope: assertToolScopeSupported(DRIVER_KIND, turn.toolScope) };
             if (config.managedModels && (!turn.model || !config.managedModels.includes(turn.model)))
                 throw new Error("This model is not assigned to this workspace.");
             if (config.requireApiKey && !input.environment.ANTHROPIC_API_KEY)
@@ -1193,7 +1203,7 @@ export const ClaudeDriver = {
                 args.push("--disallowedTools", config.disallowedTools.join(","));
             }
             const turnEnvironment = environment();
-            if ((turn.refreshSystemPrompt || turn.guestConfined) && !cliVersionChecked) {
+            if ((turn.refreshSystemPrompt || turn.guestConfined || turn.toolScope !== undefined) && !cliVersionChecked) {
                 const version = await readCliVersion(turnEnvironment);
                 if (version) {
                     cliVersion = parseClaudeCliVersion(version);
@@ -1209,6 +1219,9 @@ export const ClaudeDriver = {
             if (replaysUserMessages)
                 args.push("--replay-user-messages");
             const isolated = !inheritsUserConfig(turnEnvironment);
+            if (turn.toolScope !== undefined && (!isolated || turn.mcpFromUserConfig || cliVersion === null || !claudeCliSupports(cliVersion, "--strict-mcp-config"))) {
+                throw new Error("Claude cannot confirm a restricted MCP configuration for this account. Disable inherited Claude MCP servers and use a current, identifiable Claude CLI before using tool selection.");
+            }
             if (isolated) {
                 // A bot gets the tools and instructions its owner gave it, not
                 // whatever this machine's Claude Code happens to be set up with.
@@ -1230,7 +1243,7 @@ export const ClaudeDriver = {
                     args.push("--setting-sources", "project");
             }
             const compactWindow = autoCompactWindow(turnEnvironment);
-            if (compactWindow && claudeCliSupports(cliVersion, "--autocompact")) {
+            if (compactWindow && cliHasAutocompact === true) {
                 args.push("--autocompact", compactWindow);
             }
             // An old pair conversation can still carry its first assignment in
@@ -1343,11 +1356,16 @@ export const ClaudeDriver = {
             // permission broker, computer, browser, agents, dweb) are already
             // bounded and are deliberately left alone.
             const budget = resultBudget(turnEnvironment);
-            for (const name of botOwned) {
-                const gated = gateServer({ name, server: mcpServers[name], threadId, budget, nodeEnv: NODE_ENV_FLAG });
+            for (const name of turn.toolScope === undefined ? botOwned : Object.keys(mcpServers)) {
+                if (!canUseMcpServer(turn.toolScope, name)) {
+                    delete mcpServers[name];
+                    continue;
+                }
+                const gated = gateServer({ name, server: mcpServers[name], threadId, budget: botOwned.has(name) ? budget : 0, nodeEnv: NODE_ENV_FLAG, toolScope: turn.toolScope });
                 if (gated)
-                    mcpServers[name] = gated;
+                    mcpServers[name] = { ...gated, ...(mcpServers[name]?.alwaysLoad === true ? { alwaysLoad: true } : {}) };
             }
+            allowed.splice(0, allowed.length, ...allowed.filter((name) => Object.hasOwn(mcpServers, name.slice("mcp__".length))));
             // Keep ask_user available even in Full access. Native bypass skips
             // permission prompts, not questions requiring a person's answer.
             let broker;
@@ -1355,7 +1373,8 @@ export const ClaudeDriver = {
             if (permissionMode !== "bypassPermissions") {
                 args.push("--permission-prompt-tool", "mcp__ogb__approve");
             }
-            mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, socketPath], env: { ...NODE_ENV_FLAG }, alwaysLoad: true };
+            const permissionEnv = { ...NODE_ENV_FLAG, ...(turn.toolScope !== undefined ? { OMB_PERMISSION_TOOL_SCOPE: JSON.stringify(turn.toolScope) } : {}) };
+            mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, socketPath], env: permissionEnv, alwaysLoad: true };
             allowed.push("mcp__ogb");
             // A guest's turn pre-allows only the harness's own tools: anything
             // else (the browser can open a file: address) asks the owner first.
@@ -1568,7 +1587,7 @@ export const ClaudeDriver = {
                     // the base path: the nonce is not part of the spawn contract, and a
                     // retained session keeps its own broker object anyway.
                     if (broker.socketPath !== socketPath && mcpConfigPath) {
-                        mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, broker.socketPath], env: { ...NODE_ENV_FLAG }, alwaysLoad: true };
+                        mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, broker.socketPath], env: permissionEnv, alwaysLoad: true };
                     }
                 }
                 // Write once, only after the broker has selected its real endpoint.
@@ -2263,6 +2282,13 @@ export const ClaudeDriver = {
                 return { state: "unavailable", reason: `\`${config.cli}\` CLI not found` };
             cliVersion = parseClaudeCliVersion(version);
             cliVersionChecked = true;
+            if (version !== cliHelpVersion) {
+                const help = await new Promise((resolve) => {
+                    execCli(config.cli, ["--help"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout));
+                });
+                cliHasAutocompact = help === null ? null : /^\s*--autocompact\b/m.test(help);
+                cliHelpVersion = version;
+            }
             const update = claudeCliUpdate(version, config.cli);
             const warning = claudeInheritWarning(env);
             if (config.requireApiKey) {

package/dist-server/server/drivers/codex.js

@@ -38,6 +38,9 @@ import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-r
 import { extractMcpImages } from "../mcp-tool-images.js";
 import { parseProtocolAskQuestions, questionAnswersById, questionChoices } from "../../shared/ask-question.js";
 import { codexVersionBehind, readLatestCodexRelease } from "./codex-release.js";
+import { canUseMcpServer } from "../../shared/tool-scope.js";
+import { assertToolScopeSupported } from "../../shared/tool-scope-support.js";
+import { gateServer } from "../mcp-gate-config.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 export function codexUserError(value, chatgptPlan) {
@@ -621,6 +624,7 @@ export const CodexDriver = {
             createdAt: new Date().toISOString(),
         });
         const sendTurn = async (turn) => {
+            turn = { ...turn, toolScope: assertToolScopeSupported(DRIVER_KIND, turn.toolScope) };
             const generation = planGeneration;
             const assertPlanCurrent = () => {
                 if (disposed)
@@ -691,48 +695,81 @@ export const CodexDriver = {
                 if (planToken)
                     env.OPENMAUSBOT_CHATGPT_TOKEN = planToken;
                 const appServerArgs = ["app-server", ...(plan ? chatgptPlanCodexArgs() : config.managed ? managedCodexArgs(config.managed) : codexLocalProviderArgs(env, turn.model)), ...codexToolSurfaceArgs(),
+                    // Native snapshots can restore inherited variables after the shell
+                    // policy has filtered them. Scoped MCP gate settings must stay private.
+                    ...(turn.toolScope === undefined ? [] : ["-c", "features.shell_snapshot=false"]),
                     // A guest-driven turn (SendTurnInput.guestConfined): no shell and
                     // no file reads, whatever the person's own config says (-c wins
                     // over config files). The turn also starts with no environment.
                     ...(turn.guestConfined ? GUEST_CONFINED_CODEX_ARGS : [])];
+                const selectedMcp = new Map();
+                const selectedApprovals = new Map();
+                const scopedServer = (name, mountName, server) => {
+                    if (!canUseMcpServer(turn.toolScope, name))
+                        return null;
+                    return turn.toolScope === undefined ? server : gateServer({ name, server, threadId, budget: 0, toolScope: turn.toolScope, nodeEnv: { ELECTRON_RUN_AS_NODE: "1" },
+                        configEnvName: `OMB_GATE_CONFIG_${createHash("sha256").update(mountName).digest("hex")}` });
+                };
+                const mountSelected = (name, mountName, server, preApproved = true) => {
+                    const selected = scopedServer(name, mountName, server);
+                    if (selected) {
+                        selectedMcp.set(mountName, selected);
+                        selectedApprovals.set(mountName, preApproved);
+                        mountMcpServer(appServerArgs, env, mountName, selected, preApproved);
+                        if (turn.toolScope !== undefined && !preApproved)
+                            appServerArgs.push("-c", `mcp_servers.${mountName}.default_tools_approval_mode="prompt"`);
+                    }
+                };
                 if (turn.integrations?.composio) {
-                    mountMcpServer(appServerArgs, env, "openmausbot_connectors", turn.integrations.composio);
+                    mountSelected("composio", "openmausbot_connectors", turn.integrations.composio);
                 }
                 if (turn.integrations?.agents) {
-                    mountMcpServer(appServerArgs, env, "agents", turn.integrations.agents);
+                    mountSelected("agents", "agents", turn.integrations.agents);
                 }
                 if (turn.integrations?.localComputer) {
                     // The host daemon and isolated Local VM both arrive as a direct Cua
                     // Driver stdio MCP server. Codex sees the same computer tool surface.
-                    mountMcpServer(appServerArgs, env, "computer", turn.integrations.localComputer);
+                    mountSelected("computer", "computer", turn.integrations.localComputer);
                 }
                 if (turn.integrations?.browser) {
-                    mountMcpServer(appServerArgs, env, "browser", turn.integrations.browser);
+                    mountSelected("browser", "browser", turn.integrations.browser);
                 }
                 // A custom server named like one in the user's own config.toml would
                 // be merged with it by the `-c` override — a stdio command over a
                 // remote url is "invalid configuration" and kills the turn before the
                 // model is asked. Such a server mounts under a name of its own.
                 const declaredInCodexConfig = codexConfigMcpServerNames(env);
+                if (turn.toolScope !== undefined) {
+                    for (const name of declaredInCodexConfig)
+                        appServerArgs.push("-c", `mcp_servers.${name}.enabled=false`);
+                }
                 for (const [name, server] of Object.entries(turn.integrations?.custom ?? {})) {
                     // codex speaks streamable HTTP to a remote server, not the older
                     // SSE transport: such an entry still reaches Claude bots, and is
                     // left out here rather than mounted as something it is not
-                    if ("url" in server && server.type === "sse") {
+                    if (turn.toolScope === undefined && "url" in server && server.type === "sse") {
                         noteSkippedSseServer(name);
                         continue;
                     }
                     const mountName = mountedMcpServerName(name, declaredInCodexConfig);
                     if (mountName !== name)
                         noteRenamedMcpServer(name, mountName);
-                    mountMcpServer(appServerArgs, env, mountName, server, false);
+                    mountSelected(name, mountName, server, false);
                 }
                 if (turn.integrations?.phone) {
-                    const bridge = turn.integrations.phone;
-                    Object.assign(env, bridge.env);
-                    const prefix = "mcp_servers.openmausbot_phone";
-                    appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
+                    if (turn.toolScope !== undefined) {
+                        mountSelected("phone", "openmausbot_phone", turn.integrations.phone);
+                    }
+                    else {
+                        const bridge = turn.integrations.phone;
+                        Object.assign(env, bridge.env);
+                        const prefix = "mcp_servers.openmausbot_phone";
+                        appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
+                    }
                 }
+                const selectionConfig = turn.toolScope === undefined ? {} : { config: { mcp_servers: Object.fromEntries([...selectedMcp].map(([name, server]) => [name, "command" in server ? {
+                                command: server.command, args: server.args, env_vars: Object.keys(server.env), env: {}, default_tools_approval_mode: selectedApprovals.get(name) ? "auto" : "prompt",
+                            } : {}])) } };
                 const commandCwd = permissionLaunchCwd(turn.cwd ?? homedir());
                 const child = spawnCli(config.cli, appServerArgs, {
                     cwd: turn.cwd ?? homedir(),
@@ -1487,6 +1524,41 @@ export const CodexDriver = {
                             ? "Codex rejected its configuration as invalid. Check ~/.codex/config.toml (or CODEX_HOME) for a broken entry, then retry."
                             : "Could not read Codex configuration; cannot safely update bot instructions. Retry after checking Codex.");
                     }
+                    if (turn.toolScope !== undefined) {
+                        if (effectiveConfig?.features?.shell_snapshot !== false) {
+                            throw new Error("Codex could not disable inherited shell snapshots. No prompt was sent.");
+                        }
+                        // Gate descriptors belong to MCP children, never native shell tools.
+                        // Extend the effective policy for both new and resumed threads so
+                        // local, Company and ChatGPT turns retain the person's exclusions.
+                        const rawPolicy = effectiveConfig?.shell_environment_policy;
+                        if (rawPolicy !== undefined && (!rawPolicy || typeof rawPolicy !== "object" || Array.isArray(rawPolicy))) {
+                            throw new Error("Codex could not confirm its shell environment policy. No prompt was sent.");
+                        }
+                        const policy = (rawPolicy ?? {});
+                        const excluded = policy.exclude === undefined ? [] : policy.exclude;
+                        if (!Array.isArray(excluded) || excluded.some(name => typeof name !== "string")) {
+                            throw new Error("Codex could not confirm its shell environment exclusions. No prompt was sent.");
+                        }
+                        selectionConfig.config["shell_environment_policy.exclude"] = [...new Set([...excluded, "OMB_GATE_CONFIG_*"])];
+                        const catalog = effectiveConfig?.mcp_servers;
+                        if (!catalog || typeof catalog !== "object" || Array.isArray(catalog))
+                            throw new Error("Codex could not confirm its selected MCP configuration. No prompt was sent.");
+                        for (const [name, entry] of Object.entries(catalog)) {
+                            if (entry && typeof entry === "object" && entry.enabled === false)
+                                continue;
+                            const expected = selectedMcp.get(name);
+                            const actual = entry;
+                            if (!expected || !("command" in expected) || actual?.command !== expected.command
+                                || JSON.stringify(actual?.args ?? []) !== JSON.stringify(expected.args ?? [])
+                                || !Array.isArray(actual?.env_vars) || JSON.stringify([...actual.env_vars].sort()) !== JSON.stringify(Object.keys(expected.env).sort())
+                                || actual.default_tools_approval_mode !== (selectedApprovals.get(name) ? "auto" : "prompt")
+                                || (actual.env != null && (typeof actual.env !== "object" || Array.isArray(actual.env) || Object.keys(actual.env).length > 0))
+                                || (actual.tools != null && (typeof actual.tools !== "object" || Array.isArray(actual.tools) || Object.keys(actual.tools).length > 0))) {
+                                throw new Error("Codex has an MCP server outside the selected configuration. Disable native MCP entries for this account before using tool selection. No prompt was sent.");
+                            }
+                        }
+                    }
                     // Proven before the turn starts: a Codex that did not take the
                     // overrides runs nothing for a guest.
                     if (turn.guestConfined && !codexShellDisabled(effectiveConfig)) {
@@ -1534,6 +1606,7 @@ export const CodexDriver = {
                     let promptText = turn.text;
                     if (cursor) {
                         const resumeThread = () => request("thread/resume", {
+                            ...selectionConfig,
                             threadId: cursor,
                             developerInstructions,
                             model: selection.model,
@@ -1581,6 +1654,7 @@ export const CodexDriver = {
                     }
                     if (!codexThreadId) {
                         const startThread = () => request("thread/start", {
+                            ...selectionConfig,
                             developerInstructions,
                             cwd: turn.cwd ?? homedir(),
                             model: selection.model,

package/dist-server/server/drivers/openai-chat.js

@@ -1,5 +1,6 @@
 import { newEventId, newId } from "../contracts.js";
 import { ASK_USER_TOOL, ASK_USER_TOOL_DEFINITION, askQuestionSummary, parseAskQuestions, questionChoices } from "../../shared/ask-question.js";
+import { allowsTool, parseToolScope } from "../../shared/tool-scope.js";
 import { redactSecretsInText } from "../redact.js";
 import { toolDetailPreview } from "../tool-summary.js";
 import { ChatToolSessionError, mountChatTools } from "./chat-mcp-tools.js";
@@ -30,6 +31,17 @@ const usageFrom = (usage) => usage
 const asError = (value) => value instanceof Error ? value : new Error(String(value));
 class UnsupportedChatToolsError extends Error {
 }
+const NUDGE_ANNOUNCED_ACTION = "You said what you would do next but called no tool. Do it now with your tools, or reply with your final answer if nothing is left to do.";
+/** A short reply that only announces a next step, with nothing to answer. */
+export function announcesAction(text) {
+    const reply = text.trim();
+    if (!reply || reply.length > 400 || reply.includes("?"))
+        return false;
+    return /(?:[:\u2014\u2013]|\.\.\.|\u2026)$/.test(reply) ||
+        /^(?:checking|let me|i'll|i will|i'm going to|i am going to|opening|pulling|looking|searching|navigating|reading|fetching|loading|now (?:i'll|let me|opening|checking|pulling|reading))\b/i.test(reply);
+}
+const TEXT_ONLY_ATTACHMENT_NOTE = "[The person attached image(s), but this model cannot see images. Say so if the request depends on them.]";
+const TEXT_ONLY_SCREENSHOT_NOTE = "[Screenshot not shown: this model cannot see images. Read the page with a snapshot or a text tool instead.]";
 function rejectsToolsParameter(status, body) {
     if (status !== 400 && status !== 422)
         return false;
@@ -282,6 +294,7 @@ export function createOpenAIChatRuntime(options) {
                 clearTimeout(idleTimer);
         }
     };
+    const seesImages = (turn) => options.imageInput?.(turn.model || options.models().default) ?? true;
     const messagesFor = (turn) => {
         // The system message is the head of the resent prefix, so only the
         // stable half belongs there: a volatile edit must not re-price the
@@ -302,7 +315,9 @@ export function createOpenAIChatRuntime(options) {
                 role: message.role,
                 content: message.text,
             })),
-            { role: "user", content: options.computerUse ? chatUserContent(userTurn) : userTurn.text },
+            { role: "user", content: !options.computerUse ? userTurn.text
+                    : seesImages(turn) ? chatUserContent(userTurn)
+                        : userTurn.images?.length ? `${userTurn.text}\n\n${TEXT_ONLY_ATTACHMENT_NOTE}` : userTurn.text },
         ];
     };
     const sendTurn = async (turn) => {
@@ -381,15 +396,21 @@ export function createOpenAIChatRuntime(options) {
             let toolFailed = false;
             const denials = [];
             const seenCalls = new Set();
+            let nudged = false;
             try {
-                tools = await mountChatTools(options.tools === false ? undefined : turn.integrations, abort.signal, options.computerUse);
-                let optionalQuestionOnly = options.tools !== false && tools.definitions.length === 0;
+                const parsed = parseToolScope(turn.toolScope);
+                if (!parsed.ok)
+                    throw new Error(parsed.error);
+                const scope = parsed.scope;
+                tools = await mountChatTools(options.tools === false ? undefined : turn.integrations, abort.signal, options.computerUse, scope);
+                const questionAllowed = options.tools !== false && allowsTool(scope, { kind: "native", name: ASK_USER_TOOL });
+                let optionalQuestionOnly = questionAllowed && tools.definitions.length === 0;
                 // The runtime's one built-in tool rides the same list: ask_user is
                 // how a chat-completions engine reaches a person. An MCP server that
                 // squats the name cannot shadow it — dispatch intercepts the name
                 // before validate — but the definition is then skipped so the list
                 // never advertises two.
-                if (options.tools !== false && !tools.definitions.some((definition) => definition.function.name === ASK_USER_TOOL)) {
+                if (questionAllowed && !tools.definitions.some((definition) => definition.function.name === ASK_USER_TOOL)) {
                     tools.definitions.push(ASK_USER_TOOL_DEFINITION);
                 }
                 for (let round = 0; round < 16; round++) {
@@ -490,6 +511,11 @@ export function createOpenAIChatRuntime(options) {
                         if (completion.finishReason && completion.finishReason !== "stop") {
                             throw new ChatProtocolError(`provider did not finish the response (${completion.finishReason})`);
                         }
+                        if (options.nudgeAnnouncedAction && !nudged && tools.definitions.length && announcesAction(completion.text)) {
+                            nudged = true;
+                            messages.push({ role: "assistant", content: completion.text }, { role: "user", content: NUDGE_ANNOUNCED_ACTION });
+                            continue;
+                        }
                         if (toolFailed) {
                             stopReason = "tool_error";
                             throw new ChatProtocolError("One or more tool operations failed or were denied. See the tool results; the final response is not an execution receipt.");
@@ -508,7 +534,7 @@ export function createOpenAIChatRuntime(options) {
                     if (seenCalls.size > MAX_CHAT_TOOL_CALLS)
                         throw new ChatProtocolError("tool-call limit reached");
                     messages.push({ role: "assistant", content: completion.text || null, tool_calls: completion.toolCalls,
-                        ...(completion.protocolReasoning && !reasoningReplayRejected.has(model) ? { reasoning_content: completion.protocolReasoning } : {}),
+                        ...(completion.protocolReasoning && !reasoningReplayRejected.has(model) ? { [options.reasoningReplayField ?? "reasoning_content"]: completion.protocolReasoning } : {}),
                         ...(completion.protocolReasoningDetails.length ? { reasoning_details: completion.protocolReasoningDetails } : {}),
                     });
                     const screenshotParts = [];
@@ -529,6 +555,8 @@ export function createOpenAIChatRuntime(options) {
                                 throw new ChatProtocolError("tool arguments must be a JSON object");
                             const inputPreview = preview(args);
                             if (call.function.name === ASK_USER_TOOL) {
+                                if (!questionAllowed || !allowsTool(scope, { kind: "native", name: ASK_USER_TOOL }))
+                                    throw new Error("Tool selection excludes this tool");
                                 // A question is the person's card, not a permission, so it is
                                 // handled before the gate below: under Full access that gate
                                 // would auto-run an unanswered ask, and under Ask it would
@@ -573,6 +601,10 @@ export function createOpenAIChatRuntime(options) {
                                 started = true;
                                 if (allowed) {
                                     result = await tools.execute(call.function.name, args, abort.signal);
+                                    if (result.images?.length && !seesImages(turn)) {
+                                        const { images: _dropped, ...rest } = result;
+                                        result = { ...rest, text: `${rest.text}\n${TEXT_ONLY_SCREENSHOT_NOTE}` };
+                                    }
                                     if (result.images?.length) {
                                         try {
                                             assertImageTransport(options.apiUrl);