openmausbot 0.1.93 → 0.1.94

package/dist-server/server/drivers/acp/grok.js

@@ -4,10 +4,13 @@
 // The generic protocol runtime lives in acp/core.ts; this file is only the
 // per-harness quirks. Verified against grok 1.0.0.
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { harnessHome } from "../../env-path.js";
+import { dirname, join, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { parse as parseYaml } from "yaml";
+import { harnessHome, splitCliString } from "../../env-path.js";
 import { decodeInjectId, hostApiKey, localHost, mergeLocalInject } from "../local-inject.js";
 import { createAcpDriver } from "./core.js";
+import { allowsTool, canUseMcpServer, narrowsNativeTools, parseToolScope } from "../../../shared/tool-scope.js";
 export const STATIC_GROK_MODELS = {
     default: "grok-4.7",
     options: [
@@ -181,6 +184,140 @@ export function grokAcceptsUnadvertisedImages(init) {
     const version = /^1\.0\.(\d+)$/.exec(meta.agentVersion);
     return Boolean(version && Number(version[1]) >= 25);
 }
+// Original names in the official 1.0.41 default registry, not arbitrary
+// owner strings forwarded into Grok's inherit-all profile allowlist.
+const GROK_NATIVE_TOOLS = [
+    ["read_file", "GrokBuild:read_file"], ["search_replace", "GrokBuild:search_replace"], ["write", "OpenCode:write"],
+    ["run_terminal_command", "GrokBuild:run_terminal_cmd"], ["list_dir", "GrokBuild:list_dir"], ["grep", "GrokBuild:grep"],
+    ["kill_command_or_subagent", "GrokBuild:kill_task"], ["todo_write", "GrokBuild:todo_write"],
+    ["get_command_or_subagent_output", "GrokBuild:get_task_output"], ["spawn_subagent", "GrokBuild:task"],
+    ["scheduler_create", "GrokBuild:scheduler_create"], ["scheduler_delete", "GrokBuild:scheduler_delete"], ["scheduler_list", "GrokBuild:scheduler_list"],
+    ["monitor", "GrokBuild:monitor"], ["search_tool", "GrokBuild:search_tool"], ["use_tool", "GrokBuild:use_tool"],
+    ["workflow", "GrokBuild:workflow"], ["enter_plan_mode", "GrokBuild:enter_plan_mode"], ["exit_plan_mode", "GrokBuild:exit_plan_mode"],
+    ["ask_user_question", "GrokBuild:ask_user_question"], ["send_feedback", "GrokBuild:send_feedback"],
+    ["image_gen", "GrokBuild:image_gen"], ["image_edit", "GrokBuild:image_edit"],
+    ["image_to_video", "GrokBuild:image_to_video"], ["reference_to_video", "GrokBuild:reference_to_video"],
+];
+/** Read a supported on-disk profile rather than overriding its restriction. */
+export function grokInheritedProfile(cli, env, cwd) {
+    const unsupported = () => { throw new Error("Grok's existing agent profile cannot be safely intersected with tool selection. Use a profile file with explicit tools or a separate default Grok account."); };
+    if ((env.GROK_AGENT && env.GROK_AGENT !== "grok-build") || env.GROK_CONFIG || env.GROK_CONFIG_PATH)
+        return unsupported();
+    const args = splitCliString(cli);
+    // Operator filters are applied after ACP's profile by the CLI. Refuse
+    // unverified overrides rather than replacing an inherited restriction.
+    if (args.some(arg => /^(--tools|--disallowed-tools|--disallowedTools|--agent)(=|$)/.test(arg)))
+        return unsupported();
+    const flags = args.flatMap((arg, index) => arg === "--agent-profile" || arg.startsWith("--agent-profile=") ? [index] : []);
+    if (flags.length > 1)
+        return unsupported();
+    const flag = flags[0] ?? -1;
+    let path = flag >= 0 ? (args[flag].includes("=") ? args[flag].slice(args[flag].indexOf("=") + 1) : args[flag + 1]) : undefined;
+    if (flag >= 0 && (!path || path.startsWith("-")))
+        return unsupported();
+    const files = [join(env.GROK_HOME || harnessHome("grok", env), "config.toml")];
+    for (let directory = resolve(cwd);;) {
+        const file = join(directory, ".grok", "config.toml");
+        if (!files.includes(file))
+            files.push(file);
+        const parent = dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
+    }
+    for (const file of files) {
+        if (!existsSync(file))
+            continue;
+        const text = readFileSync(file, "utf8");
+        if (text.length > 262_144)
+            return unsupported();
+        // Support a deliberately small, unambiguous TOML subset. Scan the whole
+        // file: quoted/dotted keys, inline agent tables and multiline constructs
+        // must never be silently missed by a section regex. Unsupported syntax
+        // refuses this scoped turn; ordinary unrestricted turns are unaffected.
+        let section = "";
+        for (const line of text.split(/\r?\n/).map(line => line.trim()).filter(line => line && !line.startsWith("#"))) {
+            const header = /^\[([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)\]\s*(?:#.*)?$/.exec(line);
+            if (header) {
+                section = header[1];
+                if (section.startsWith("agent."))
+                    return unsupported();
+                continue;
+            }
+            const assignment = /^([A-Za-z0-9_-]+)\s*=\s*(.+)$/.exec(line);
+            if (!assignment || /'''|"""/.test(assignment[2]) || (!section && assignment[1] === "agent"))
+                return unsupported();
+            if (section !== "agent")
+                continue;
+            const match = /^(name|definition)\s*=\s*("(?:[^"\\]|\\.)*"|'[^']*')\s*(?:#.*)?$/.exec(line);
+            if (!match)
+                return unsupported();
+            let value;
+            try {
+                value = match[2].startsWith('"') ? JSON.parse(match[2]) : match[2].slice(1, -1);
+            }
+            catch {
+                return unsupported();
+            }
+            // Grok expands environment variables in paths. Do not resolve a
+            // different literal file or fall back when that contract is unknown.
+            if (value.includes("$") || !value)
+                return unsupported();
+            if (match[1] === "name" && value !== "grok-build")
+                return unsupported();
+            if (match[1] === "definition" && flag < 0) {
+                if (path !== undefined && path !== value)
+                    return unsupported();
+                path = value;
+            }
+        }
+    }
+    if (!path)
+        return;
+    const text = readFileSync(resolve(cwd, path), "utf8");
+    if (text.length > 262_144)
+        return unsupported();
+    const match = /^\s*---\r?\n([\s\S]*?)\r?\n---(?:\r?\n([\s\S]*))?$/.exec(text);
+    if (!match)
+        return unsupported();
+    const profile = parseYaml(match[1]);
+    if (!profile || typeof profile.name !== "string" || typeof profile.description !== "string"
+        || (profile.tools !== undefined && (!Array.isArray(profile.tools) || !profile.tools.every((tool) => typeof tool === "string")))
+        || (profile.disallowedTools !== undefined && (!Array.isArray(profile.disallowedTools) || !profile.disallowedTools.every((tool) => typeof tool === "string"))))
+        return unsupported();
+    const toolConfig = profile.toolConfig ?? { tools: GROK_NATIVE_TOOLS.map(([name, id]) => ({ id, name_override: name })) };
+    if (!Array.isArray(toolConfig.tools) || !toolConfig.tools.every((tool) => typeof tool?.id === "string" && (tool.name_override === undefined || typeof tool.name_override === "string")))
+        return unsupported();
+    return { ...profile, name: profile.name, description: profile.description, toolConfig, ...(match[2]?.trim() ? { promptBody: match[2].trim() } : {}) };
+}
+/** A curated registry: empty/unknown selections never inherit Grok's defaults. */
+export function grokToolScopeProfile(scope, init, inherited, hasMcp = false) {
+    const parsed = parseToolScope(scope);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
+    const meta = init?._meta;
+    if (meta?.grokShell !== true || meta.agentVersion !== "1.0.41") {
+        throw new Error("This Grok runtime does not have verified native tool selection. Use Grok 1.0.41 or Pi; update Grok support before using another version.");
+    }
+    if (hasMcp && (!allowsTool(scope, { kind: "native", name: "search_tool" }) || !allowsTool(scope, { kind: "native", name: "use_tool" }))) {
+        throw new Error("Grok requires native:search_tool and native:use_tool to find and call selected MCP tools. Allow both explicitly or use Pi.");
+    }
+    const candidates = inherited?.toolConfig.tools ?? GROK_NATIVE_TOOLS.map(([name, id]) => ({ id, name_override: name }));
+    const selected = candidates.filter((tool) => {
+        const name = tool.name_override ?? GROK_NATIVE_TOOLS.find(([, id]) => id === tool.id)?.[0];
+        return name !== undefined && allowsTool(scope, { kind: "native", name })
+            && (!inherited?.tools?.length || inherited.tools.includes(name) || inherited.tools.includes(tool.id))
+            && !inherited?.disallowedTools?.some((denied) => denied === name || denied === tool.id);
+    });
+    // Grok rejects an empty curated construction. A real read entry explicitly
+    // disabled by its exact native name constructs an empty final registry.
+    return {
+        ...inherited, name: inherited?.name ?? "openmausbot-tools", description: inherited?.description ?? "Owner-selected tools",
+        injectDefaultTools: false, discoverSkills: false,
+        toolConfig: { ...inherited?.toolConfig, tools: selected.length ? selected : [{ id: "GrokBuild:read_file", name_override: "read_file" }] },
+        tools: [], disallowedTools: [...new Set([...(inherited?.disallowedTools ?? []), ...(selected.length ? [] : ["read_file"])])],
+    };
+}
 const support = {
     driverKind: "grokAgent",
     displayName: "Grok",
@@ -225,17 +362,69 @@ const support = {
             ? "bypassPermissions"
             : turn.approvalMode === "auto" ? "auto" : turn.approvalMode === "edits" ? "acceptEdits" : "default",
         "agent",
+        ...(turn.toolScope !== undefined ? ["--no-leader"] : []),
         ...(turn.model ? ["-m", turn.model] : []),
         // long form on purpose: `--effort` is documented as an alias, and an
         // alias is the part a CLI is free to rename
         ...(turn.effort ? ["--reasoning-effort", turn.effort] : []),
         "stdio",
     ],
+    toolScopeSessionParams: (turn, init, hasMcp, { config, env, cwd }) => {
+        if (!narrowsNativeTools(turn.toolScope))
+            return {};
+        const profile = grokToolScopeProfile(turn.toolScope, init, grokInheritedProfile(config.cli, env, cwd), hasMcp);
+        // Establish on the selected model. Changing harnesses after session/new
+        // can discard an ACP profile and restore the model's default tools.
+        if (turn.model)
+            profile.model = ensureGrokInjectSlug(turn.model, env);
+        return { _meta: { agentProfile: profile } };
+    },
+    toolScopeCacheKey: ({ config, env, cwd }) => JSON.stringify(grokInheritedProfile(config.cli, env, cwd) ?? null),
     // -m on argv is necessary but not sufficient: session/new still starts on
     // [models].default. Pin the slug over the wire, same as Hermes/Droid.
-    async configureSession({ request, sessionId, turn }) {
+    async configureSession({ request, sessionId, turn, currentModelId }) {
+        if (turn.toolScope !== undefined) {
+            const available = new Set([
+                ...(turn.integrations?.agents ? ["agents"] : []), ...(turn.integrations?.composio ? ["composio"] : []),
+                ...(turn.integrations?.browser ? ["browser"] : []), ...(turn.integrations?.localComputer ? ["computer"] : []),
+                ...Object.keys(turn.integrations?.custom ?? {}),
+            ].filter((name) => canUseMcpServer(turn.toolScope, name)));
+            const deadline = Date.now() + 10_000;
+            for (;;) {
+                const reply = await request("_x.ai/mcp/list", { sessionId, cache: true }, 10_000);
+                const catalog = reply?.result;
+                if (!Array.isArray(catalog?.servers))
+                    throw new Error("Grok could not confirm its MCP catalog. No prompt was sent.");
+                for (const server of catalog.servers) {
+                    if (server?.session?.enabled === false)
+                        continue;
+                    if (!available.has(server?.name))
+                        throw new Error("Grok has an MCP connection outside the bot's selection. Disable native MCP connections before using tool selection. No prompt was sent.");
+                    if (Array.isArray(server?.session?.tools) && server.session.tools.some((tool) => typeof tool.name !== "string" || !allowsTool(turn.toolScope, { kind: "mcp", server: server.name, name: tool.name }))) {
+                        throw new Error("Grok could not enforce the selected MCP catalog. No prompt was sent.");
+                    }
+                }
+                if (catalog.sessionMcpResolved === true) {
+                    if ([...available].some((name) => !catalog.servers.some((server) => server.name === name && server.session?.enabled === true && server.session.status === "ready"))) {
+                        throw new Error("Grok could not connect a selected MCP server. No prompt was sent.");
+                    }
+                    break;
+                }
+                if (Date.now() >= deadline)
+                    throw new Error("Grok did not confirm its selected MCP catalog in time. No prompt was sent.");
+                await delay(50);
+            }
+        }
         if (!turn.model)
             return;
+        if (narrowsNativeTools(turn.toolScope)) {
+            if (currentModelId !== turn.model) {
+                throw new Error("Grok could not confirm the selected model without replacing its tool profile. Start a new conversation or choose a model with a supported Grok profile. No prompt was sent.");
+            }
+            // The inline profile already pins this model. Repeating set_model can
+            // rebuild the harness, or reject an otherwise valid resumed profile.
+            return;
+        }
         try {
             await request("session/set_model", { sessionId, modelId: turn.model });
         }
@@ -249,6 +438,22 @@ const support = {
     transformEnv: (env) => {
         delete env.XAI_API_KEY;
     },
+    applyTurnEnv: (env, { toolScope }) => {
+        if (toolScope !== undefined) {
+            // The verified runtime gives these local env switches priority over
+            // account defaults, preventing an unfiltered managed gateway fallback.
+            env.GROK_MANAGED_MCPS_ENABLED = "false";
+            env.GROK_MANAGED_MCP_GATEWAY_TOOLS_ENABLED = "false";
+            if (narrowsNativeTools(toolScope)) {
+                if (env.GROK_AGENT && env.GROK_AGENT !== "grok-build") {
+                    throw new Error("Grok's existing agent profile cannot be safely intersected with tool selection. Use a separate default Grok account.");
+                }
+                // A model's agent_type otherwise takes priority over ACP profiles.
+                // Preserve profile-file restrictions when intersecting them below.
+                env.GROK_AGENT = "grok-build";
+            }
+        }
+    },
     // Bind the grok.com subscription login. No API-key fallback by design —
     // an unauthenticated CLI is a user action, not something to paper over.
     pickAuthMethod: (methods) => (methods.some((m) => m.id === "cached_token") ? "cached_token" : null),

package/dist-server/server/drivers/agents-call.js

@@ -507,6 +507,34 @@ export async function callTool(name, args, context) {
             }) });
         return { text: JSON.stringify(r), ...(r.error ? { isError: true } : {}) };
     }
+    if (name === "send_to_bot") {
+        const botId = String(args.bot_id ?? "").trim();
+        const title = String(args.title ?? "").trim();
+        const message = String(args.message ?? "").trim();
+        if (!botId || !title || !message) {
+            return { text: "send_to_bot needs bot_id, title and message.", isError: true };
+        }
+        if (botId === context.botId) {
+            return { text: "send_to_bot is cross-bot only. Use start_thread to send independent work to yourself.", isError: true };
+        }
+        if (turn.threadsOpenedThisTurn >= MAX_THREADS_PER_TURN) {
+            return { text: `You have already opened ${MAX_THREADS_PER_TURN} threads this turn, which is the limit.`, isError: true };
+        }
+        const r = await api("/api/internal/threads", { method: "POST", body: JSON.stringify({
+                fromBotId: context.botId, fromThreadId: context.threadId, toBotId: botId,
+                title, message, depth: context.depth, oneWay: true,
+            }) });
+        if (r.error)
+            return { text: `Couldn't send to that bot: ${String(r.error)}`, isError: true };
+        turn.threadsOpenedThisTurn += 1;
+        const destination = `@${String(r.botName ?? "that bot")} in #${String(r.title ?? title)} [thread id: ${String(r.threadId ?? "")}]`;
+        const state = r.approvalRequired === true
+            ? `Send to ${destination} is pending approval. The person's approval card appears after this turn ends; dispatch starts once approved.`
+            : r.state === "queued"
+                ? `Send to ${destination} is queued ${ordinal(Number(r.position) || 1)} for a free slot and can dispatch after this turn ends.`
+                : `Send to ${destination} is pending until this turn ends, then dispatch starts.`;
+        return { text: `${state} Its result stays in that thread; nothing there will resume you.` };
+    }
     if (name === "list_bots") {
         const r = await api(`/api/internal/agents?self=${encodeURIComponent(BOT_ID)}`);
         const bots = r.bots ?? [];

package/dist-server/server/drivers/agents-catalog.js

@@ -221,6 +221,15 @@ const toolDefinitions = (externalRuntime) => [
                 label: { type: "string", description: "Optional short name (one line, at most 60 characters) for this job. Names the new direct assignment thread." },
             }, required: ["bot_ids", "message", "request_key"] },
     },
+    {
+        name: "send_to_bot",
+        description: "Send work one way to another bot in a fresh thread. This is cross-bot only: use start_thread to send independent work to yourself. The recipient owns the new thread; its results, failures and questions stay there and never resume you. Use coordinate_bots when you need the result returned here.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {
+                bot_id: { type: "string", description: "One reachable teammate id from list_bots or list_room_targets." },
+                title: { type: "string", description: "A short one-line title, at most 80 characters." },
+                message: { type: "string", description: "Complete instructions; the recipient does not inherit this conversation." },
+            }, required: ["bot_id", "title", "message"] },
+    },
     {
         name: "list_bots",
         description: "List the other bots (agents) you may contact in your own team and any additional teams the owner has explicitly allowed you to coordinate, with their team, model and current status. Call this to discover exact teammate IDs before assigning work or requesting advice through your available coordination tools.",
@@ -757,7 +766,7 @@ const VOICE_TOOL_NAMES = new Set(["send_voice_note"]);
 // One teamwork path in room turns; keep all unrelated integrations available.
 // Ordinary direct chats use this same bounded coordinator. Goal-owned turns
 // retain their independent loop and cannot start a second coordinator.
-const ROOM_ONLY_TOOLS = new Set(["list_room_targets", "coordinate_bots"]);
+const ROOM_ONLY_TOOLS = new Set(["list_room_targets", "coordinate_bots", "send_to_bot"]);
 const ROOM_REPLACED_TOOLS = new Set(["ask_bot", "delegate_bot", "check_delegation", "wait_delegation", "start_thread", "send_to_thread", "wait_thread"]);
 const EXTERNAL_TOOL_NAMES = new Set(["list_bots", "ask_bot", "delegate_bot", "check_delegation", "wait_delegation"]);
 const WATCHER_TOOL_NAMES = new Set(["create_options_card"]);

package/dist-server/server/drivers/boatagent.js

@@ -1,6 +1,7 @@
 import { newEventId, newId } from "../contracts.js";
 import { boatCredential, boatProviderApi } from "../included-services.js";
 import { appendNative } from "./native.js";
+import { assertToolScopeSupported } from "../../shared/tool-scope-support.js";
 import { OMB_ASK_TOOL, answerWithoutPreamble, askQuestionSummary, capAnswerEcho, ombAskProtocolPrompt, parseOmbAskQuestions, questionChoices, stripOmbAskBlock, } from "../../shared/ask-question.js";
 // "boxAgent" is Boat's historical driver kind (catalog and wire); keep it.
 const DRIVER_KIND = "boxAgent";
@@ -96,6 +97,7 @@ export const BoatAgentDriver = {
             return body;
         };
         const sendTurn = async (turn) => {
+            turn = { ...turn, toolScope: assertToolScopeSupported(DRIVER_KIND, turn.toolScope) };
             const { threadId } = turn;
             const computer = turn.integrations?.computer;
             const boxId = computer && (!computer.kind || computer.kind === "box") ? computer.boxId : undefined;

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -8,6 +8,8 @@ import { augmentedPath } from "../env-path.js";
 import { killCliTree, spawnCli } from "../procs.js";
 import { chatImage } from "./chat-images.js";
 import { ChatBoatClient } from "./chat-boat-tools.js";
+import { mcpStdioServer } from "../mcp-gate-config.js";
+import { allowsTool, canUseMcpServer, parseToolScope } from "../../shared/tool-scope.js";
 /** The transport cannot safely continue this turn. A dispatched operation may
  * already have taken effect, so callers must not retry it through a new round. */
 export class ChatToolSessionError extends Error {
@@ -190,7 +192,7 @@ class ChatMcpClient {
             throw error;
         }
     }
-    async tools(signal) {
+    async tools(signal, include = () => true) {
         const deadline = Date.now() + STARTUP_MS;
         const remaining = () => {
             if (Date.now() >= deadline)
@@ -212,7 +214,7 @@ class ChatMcpClient {
             const result = await this.call("tools/list", cursor ? { cursor } : {}, signal, remaining());
             if (!object(result) || !Array.isArray(result.tools))
                 throw new Error("MCP tools/list returned an invalid result");
-            tools.push(...result.tools);
+            tools.push(...result.tools.filter(include));
             if (tools.length > TOOL_COUNT)
                 throw new Error("MCP tool count exceeds the 128-tool limit");
             if (result.nextCursor === undefined)
@@ -282,23 +284,30 @@ function omitBlankDefaults(builtInBrowser, tool, args) {
             delete args[field];
     }
 }
-export async function mountChatTools(integrations, signal, computerUse = false) {
+export async function mountChatTools(integrations, signal, computerUse = false, toolScope) {
+    const parsed = parseToolScope(toolScope);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
+    const scope = parsed.scope;
     const servers = [];
-    if (computerUse && integrations?.computer)
+    const eligible = (server) => scope === undefined || canUseMcpServer(scope, server);
+    if (computerUse && integrations?.computer && eligible("computer"))
         servers.push(["computer", integrations.computer]);
-    if (computerUse && integrations?.localComputer)
+    if (computerUse && integrations?.localComputer && eligible("computer"))
         servers.push(["computer", integrations.localComputer]);
-    if (computerUse && integrations?.browser)
+    if (computerUse && integrations?.browser && eligible("browser"))
         servers.push(["browser", integrations.browser]);
-    if (integrations?.agents)
+    if (integrations?.agents && eligible("agents"))
         servers.push(["agents", integrations.agents]);
-    if (integrations?.composio)
+    if (integrations?.composio && eligible("composio"))
         servers.push(["composio", integrations.composio]);
-    // this client starts its servers and talks over stdio; a remote (url)
-    // entry is skipped here and reaches Claude and Codex bots
     for (const [name, server] of Object.entries(integrations?.custom ?? {})) {
-        if ("command" in server)
-            servers.push([name, server]);
+        if (!eligible(name))
+            continue;
+        const stdio = mcpStdioServer(server, { nodeEnv: { ELECTRON_RUN_AS_NODE: "1" } });
+        if (!stdio)
+            throw new Error("MCP server configuration is invalid");
+        servers.push([name, { command: stdio.command, args: stdio.args ?? [], env: stdio.env ?? {} }]);
     }
     if (servers.length > 32)
         throw new Error("MCP server count exceeds the 32-server limit");
@@ -332,7 +341,9 @@ export async function mountChatTools(integrations, signal, computerUse = false)
             // image delivery, including custom servers. Text stays bounded below.
             const client = "boxId" in descriptor ? new ChatBoatClient(descriptor) : new ChatMcpClient(descriptor, computerUse);
             clients.push(client);
-            return { name, client, builtInBrowser: descriptor === integrations?.browser, tools: await client.tools(signal) };
+            const include = (tool) => scope === undefined || (object(tool) && typeof tool.name === "string" && allowsTool(scope, { kind: "mcp", server: name, name: tool.name }));
+            const tools = client instanceof ChatMcpClient ? await client.tools(signal, include) : (await client.tools()).filter(include);
+            return { name, client, builtInBrowser: descriptor === integrations?.browser, tools };
         }));
         for (const mount of mounts) {
             if (mount.status === "rejected")
@@ -368,7 +379,7 @@ export async function mountChatTools(integrations, signal, computerUse = false)
                     const suffix = `_${index}`;
                     name = base.slice(0, 64 - suffix.length) + suffix;
                 }
-                registered.set(name, { client, builtInBrowser, name: tool.name, schema });
+                registered.set(name, { client, server, builtInBrowser, name: tool.name, schema });
                 definitions.push({ type: "function", function: { name, description, parameters } });
                 if (Buffer.byteLength(JSON.stringify(definitions)) > CATALOG_BYTES)
                     throw new Error("MCP tool catalog exceeds the 1MB limit");
@@ -387,6 +398,8 @@ export async function mountChatTools(integrations, signal, computerUse = false)
         const tool = registered.get(name);
         if (!tool)
             throw new Error("The requested tool was not advertised for this turn");
+        if (scope !== undefined && !allowsTool(scope, { kind: "mcp", server: tool.server, name: tool.name }))
+            throw new Error("Tool selection excludes this tool");
         omitBlankDefaults(tool.builtInBrowser, tool.name, args);
         if (!object(args) || !tool.schema(args))
             throw new Error("Tool arguments do not match the advertised input schema; use its required fields and types");

package/dist-server/server/drivers/claude.js

@@ -20,6 +20,8 @@ import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
 import { ClaudeLoginController } from "./claude-login-auth.js";
 import { gateServer, resultBudget } from "../mcp-gate-config.js";
+import { canUseMcpServer } from "../../shared/tool-scope.js";
+import { assertToolScopeSupported } from "../../shared/tool-scope-support.js";
 import { newEventId, newId } from "../contracts.js";
 import { askInputSummary, commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
@@ -1127,6 +1129,7 @@ export const ClaudeDriver = {
         // is a fresh sendTurn, and the attempt cap must survive across launches
         const retryState = new Map();
         const sendTurn = async (turn, logicalTurnId) => {
+            turn = { ...turn, toolScope: assertToolScopeSupported(DRIVER_KIND, turn.toolScope) };
             if (config.managedModels && (!turn.model || !config.managedModels.includes(turn.model)))
                 throw new Error("This model is not assigned to this workspace.");
             if (config.requireApiKey && !input.environment.ANTHROPIC_API_KEY)
@@ -1200,7 +1203,7 @@ export const ClaudeDriver = {
                 args.push("--disallowedTools", config.disallowedTools.join(","));
             }
             const turnEnvironment = environment();
-            if ((turn.refreshSystemPrompt || turn.guestConfined) && !cliVersionChecked) {
+            if ((turn.refreshSystemPrompt || turn.guestConfined || turn.toolScope !== undefined) && !cliVersionChecked) {
                 const version = await readCliVersion(turnEnvironment);
                 if (version) {
                     cliVersion = parseClaudeCliVersion(version);
@@ -1216,6 +1219,9 @@ export const ClaudeDriver = {
             if (replaysUserMessages)
                 args.push("--replay-user-messages");
             const isolated = !inheritsUserConfig(turnEnvironment);
+            if (turn.toolScope !== undefined && (!isolated || turn.mcpFromUserConfig || cliVersion === null || !claudeCliSupports(cliVersion, "--strict-mcp-config"))) {
+                throw new Error("Claude cannot confirm a restricted MCP configuration for this account. Disable inherited Claude MCP servers and use a current, identifiable Claude CLI before using tool selection.");
+            }
             if (isolated) {
                 // A bot gets the tools and instructions its owner gave it, not
                 // whatever this machine's Claude Code happens to be set up with.
@@ -1350,11 +1356,16 @@ export const ClaudeDriver = {
             // permission broker, computer, browser, agents, dweb) are already
             // bounded and are deliberately left alone.
             const budget = resultBudget(turnEnvironment);
-            for (const name of botOwned) {
-                const gated = gateServer({ name, server: mcpServers[name], threadId, budget, nodeEnv: NODE_ENV_FLAG });
+            for (const name of turn.toolScope === undefined ? botOwned : Object.keys(mcpServers)) {
+                if (!canUseMcpServer(turn.toolScope, name)) {
+                    delete mcpServers[name];
+                    continue;
+                }
+                const gated = gateServer({ name, server: mcpServers[name], threadId, budget: botOwned.has(name) ? budget : 0, nodeEnv: NODE_ENV_FLAG, toolScope: turn.toolScope });
                 if (gated)
-                    mcpServers[name] = gated;
+                    mcpServers[name] = { ...gated, ...(mcpServers[name]?.alwaysLoad === true ? { alwaysLoad: true } : {}) };
             }
+            allowed.splice(0, allowed.length, ...allowed.filter((name) => Object.hasOwn(mcpServers, name.slice("mcp__".length))));
             // Keep ask_user available even in Full access. Native bypass skips
             // permission prompts, not questions requiring a person's answer.
             let broker;
@@ -1362,7 +1373,8 @@ export const ClaudeDriver = {
             if (permissionMode !== "bypassPermissions") {
                 args.push("--permission-prompt-tool", "mcp__ogb__approve");
             }
-            mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, socketPath], env: { ...NODE_ENV_FLAG }, alwaysLoad: true };
+            const permissionEnv = { ...NODE_ENV_FLAG, ...(turn.toolScope !== undefined ? { OMB_PERMISSION_TOOL_SCOPE: JSON.stringify(turn.toolScope) } : {}) };
+            mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, socketPath], env: permissionEnv, alwaysLoad: true };
             allowed.push("mcp__ogb");
             // A guest's turn pre-allows only the harness's own tools: anything
             // else (the browser can open a file: address) asks the owner first.
@@ -1575,7 +1587,7 @@ export const ClaudeDriver = {
                     // the base path: the nonce is not part of the spawn contract, and a
                     // retained session keeps its own broker object anyway.
                     if (broker.socketPath !== socketPath && mcpConfigPath) {
-                        mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, broker.socketPath], env: { ...NODE_ENV_FLAG }, alwaysLoad: true };
+                        mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, broker.socketPath], env: permissionEnv, alwaysLoad: true };
                     }
                 }
                 // Write once, only after the broker has selected its real endpoint.