openmausbot 0.1.93 → 0.1.94

package/dist-server/server/drivers/codex.js

@@ -38,6 +38,9 @@ import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-r
 import { extractMcpImages } from "../mcp-tool-images.js";
 import { parseProtocolAskQuestions, questionAnswersById, questionChoices } from "../../shared/ask-question.js";
 import { codexVersionBehind, readLatestCodexRelease } from "./codex-release.js";
+import { canUseMcpServer } from "../../shared/tool-scope.js";
+import { assertToolScopeSupported } from "../../shared/tool-scope-support.js";
+import { gateServer } from "../mcp-gate-config.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 export function codexUserError(value, chatgptPlan) {
@@ -621,6 +624,7 @@ export const CodexDriver = {
             createdAt: new Date().toISOString(),
         });
         const sendTurn = async (turn) => {
+            turn = { ...turn, toolScope: assertToolScopeSupported(DRIVER_KIND, turn.toolScope) };
             const generation = planGeneration;
             const assertPlanCurrent = () => {
                 if (disposed)
@@ -691,48 +695,81 @@ export const CodexDriver = {
                 if (planToken)
                     env.OPENMAUSBOT_CHATGPT_TOKEN = planToken;
                 const appServerArgs = ["app-server", ...(plan ? chatgptPlanCodexArgs() : config.managed ? managedCodexArgs(config.managed) : codexLocalProviderArgs(env, turn.model)), ...codexToolSurfaceArgs(),
+                    // Native snapshots can restore inherited variables after the shell
+                    // policy has filtered them. Scoped MCP gate settings must stay private.
+                    ...(turn.toolScope === undefined ? [] : ["-c", "features.shell_snapshot=false"]),
                     // A guest-driven turn (SendTurnInput.guestConfined): no shell and
                     // no file reads, whatever the person's own config says (-c wins
                     // over config files). The turn also starts with no environment.
                     ...(turn.guestConfined ? GUEST_CONFINED_CODEX_ARGS : [])];
+                const selectedMcp = new Map();
+                const selectedApprovals = new Map();
+                const scopedServer = (name, mountName, server) => {
+                    if (!canUseMcpServer(turn.toolScope, name))
+                        return null;
+                    return turn.toolScope === undefined ? server : gateServer({ name, server, threadId, budget: 0, toolScope: turn.toolScope, nodeEnv: { ELECTRON_RUN_AS_NODE: "1" },
+                        configEnvName: `OMB_GATE_CONFIG_${createHash("sha256").update(mountName).digest("hex")}` });
+                };
+                const mountSelected = (name, mountName, server, preApproved = true) => {
+                    const selected = scopedServer(name, mountName, server);
+                    if (selected) {
+                        selectedMcp.set(mountName, selected);
+                        selectedApprovals.set(mountName, preApproved);
+                        mountMcpServer(appServerArgs, env, mountName, selected, preApproved);
+                        if (turn.toolScope !== undefined && !preApproved)
+                            appServerArgs.push("-c", `mcp_servers.${mountName}.default_tools_approval_mode="prompt"`);
+                    }
+                };
                 if (turn.integrations?.composio) {
-                    mountMcpServer(appServerArgs, env, "openmausbot_connectors", turn.integrations.composio);
+                    mountSelected("composio", "openmausbot_connectors", turn.integrations.composio);
                 }
                 if (turn.integrations?.agents) {
-                    mountMcpServer(appServerArgs, env, "agents", turn.integrations.agents);
+                    mountSelected("agents", "agents", turn.integrations.agents);
                 }
                 if (turn.integrations?.localComputer) {
                     // The host daemon and isolated Local VM both arrive as a direct Cua
                     // Driver stdio MCP server. Codex sees the same computer tool surface.
-                    mountMcpServer(appServerArgs, env, "computer", turn.integrations.localComputer);
+                    mountSelected("computer", "computer", turn.integrations.localComputer);
                 }
                 if (turn.integrations?.browser) {
-                    mountMcpServer(appServerArgs, env, "browser", turn.integrations.browser);
+                    mountSelected("browser", "browser", turn.integrations.browser);
                 }
                 // A custom server named like one in the user's own config.toml would
                 // be merged with it by the `-c` override — a stdio command over a
                 // remote url is "invalid configuration" and kills the turn before the
                 // model is asked. Such a server mounts under a name of its own.
                 const declaredInCodexConfig = codexConfigMcpServerNames(env);
+                if (turn.toolScope !== undefined) {
+                    for (const name of declaredInCodexConfig)
+                        appServerArgs.push("-c", `mcp_servers.${name}.enabled=false`);
+                }
                 for (const [name, server] of Object.entries(turn.integrations?.custom ?? {})) {
                     // codex speaks streamable HTTP to a remote server, not the older
                     // SSE transport: such an entry still reaches Claude bots, and is
                     // left out here rather than mounted as something it is not
-                    if ("url" in server && server.type === "sse") {
+                    if (turn.toolScope === undefined && "url" in server && server.type === "sse") {
                         noteSkippedSseServer(name);
                         continue;
                     }
                     const mountName = mountedMcpServerName(name, declaredInCodexConfig);
                     if (mountName !== name)
                         noteRenamedMcpServer(name, mountName);
-                    mountMcpServer(appServerArgs, env, mountName, server, false);
+                    mountSelected(name, mountName, server, false);
                 }
                 if (turn.integrations?.phone) {
-                    const bridge = turn.integrations.phone;
-                    Object.assign(env, bridge.env);
-                    const prefix = "mcp_servers.openmausbot_phone";
-                    appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
+                    if (turn.toolScope !== undefined) {
+                        mountSelected("phone", "openmausbot_phone", turn.integrations.phone);
+                    }
+                    else {
+                        const bridge = turn.integrations.phone;
+                        Object.assign(env, bridge.env);
+                        const prefix = "mcp_servers.openmausbot_phone";
+                        appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
+                    }
                 }
+                const selectionConfig = turn.toolScope === undefined ? {} : { config: { mcp_servers: Object.fromEntries([...selectedMcp].map(([name, server]) => [name, "command" in server ? {
+                                command: server.command, args: server.args, env_vars: Object.keys(server.env), env: {}, default_tools_approval_mode: selectedApprovals.get(name) ? "auto" : "prompt",
+                            } : {}])) } };
                 const commandCwd = permissionLaunchCwd(turn.cwd ?? homedir());
                 const child = spawnCli(config.cli, appServerArgs, {
                     cwd: turn.cwd ?? homedir(),
@@ -1487,6 +1524,41 @@ export const CodexDriver = {
                             ? "Codex rejected its configuration as invalid. Check ~/.codex/config.toml (or CODEX_HOME) for a broken entry, then retry."
                             : "Could not read Codex configuration; cannot safely update bot instructions. Retry after checking Codex.");
                     }
+                    if (turn.toolScope !== undefined) {
+                        if (effectiveConfig?.features?.shell_snapshot !== false) {
+                            throw new Error("Codex could not disable inherited shell snapshots. No prompt was sent.");
+                        }
+                        // Gate descriptors belong to MCP children, never native shell tools.
+                        // Extend the effective policy for both new and resumed threads so
+                        // local, Company and ChatGPT turns retain the person's exclusions.
+                        const rawPolicy = effectiveConfig?.shell_environment_policy;
+                        if (rawPolicy !== undefined && (!rawPolicy || typeof rawPolicy !== "object" || Array.isArray(rawPolicy))) {
+                            throw new Error("Codex could not confirm its shell environment policy. No prompt was sent.");
+                        }
+                        const policy = (rawPolicy ?? {});
+                        const excluded = policy.exclude === undefined ? [] : policy.exclude;
+                        if (!Array.isArray(excluded) || excluded.some(name => typeof name !== "string")) {
+                            throw new Error("Codex could not confirm its shell environment exclusions. No prompt was sent.");
+                        }
+                        selectionConfig.config["shell_environment_policy.exclude"] = [...new Set([...excluded, "OMB_GATE_CONFIG_*"])];
+                        const catalog = effectiveConfig?.mcp_servers;
+                        if (!catalog || typeof catalog !== "object" || Array.isArray(catalog))
+                            throw new Error("Codex could not confirm its selected MCP configuration. No prompt was sent.");
+                        for (const [name, entry] of Object.entries(catalog)) {
+                            if (entry && typeof entry === "object" && entry.enabled === false)
+                                continue;
+                            const expected = selectedMcp.get(name);
+                            const actual = entry;
+                            if (!expected || !("command" in expected) || actual?.command !== expected.command
+                                || JSON.stringify(actual?.args ?? []) !== JSON.stringify(expected.args ?? [])
+                                || !Array.isArray(actual?.env_vars) || JSON.stringify([...actual.env_vars].sort()) !== JSON.stringify(Object.keys(expected.env).sort())
+                                || actual.default_tools_approval_mode !== (selectedApprovals.get(name) ? "auto" : "prompt")
+                                || (actual.env != null && (typeof actual.env !== "object" || Array.isArray(actual.env) || Object.keys(actual.env).length > 0))
+                                || (actual.tools != null && (typeof actual.tools !== "object" || Array.isArray(actual.tools) || Object.keys(actual.tools).length > 0))) {
+                                throw new Error("Codex has an MCP server outside the selected configuration. Disable native MCP entries for this account before using tool selection. No prompt was sent.");
+                            }
+                        }
+                    }
                     // Proven before the turn starts: a Codex that did not take the
                     // overrides runs nothing for a guest.
                     if (turn.guestConfined && !codexShellDisabled(effectiveConfig)) {
@@ -1534,6 +1606,7 @@ export const CodexDriver = {
                     let promptText = turn.text;
                     if (cursor) {
                         const resumeThread = () => request("thread/resume", {
+                            ...selectionConfig,
                             threadId: cursor,
                             developerInstructions,
                             model: selection.model,
@@ -1581,6 +1654,7 @@ export const CodexDriver = {
                     }
                     if (!codexThreadId) {
                         const startThread = () => request("thread/start", {
+                            ...selectionConfig,
                             developerInstructions,
                             cwd: turn.cwd ?? homedir(),
                             model: selection.model,

package/dist-server/server/drivers/openai-chat.js

@@ -1,5 +1,6 @@
 import { newEventId, newId } from "../contracts.js";
 import { ASK_USER_TOOL, ASK_USER_TOOL_DEFINITION, askQuestionSummary, parseAskQuestions, questionChoices } from "../../shared/ask-question.js";
+import { allowsTool, parseToolScope } from "../../shared/tool-scope.js";
 import { redactSecretsInText } from "../redact.js";
 import { toolDetailPreview } from "../tool-summary.js";
 import { ChatToolSessionError, mountChatTools } from "./chat-mcp-tools.js";
@@ -397,14 +398,19 @@ export function createOpenAIChatRuntime(options) {
             const seenCalls = new Set();
             let nudged = false;
             try {
-                tools = await mountChatTools(options.tools === false ? undefined : turn.integrations, abort.signal, options.computerUse);
-                let optionalQuestionOnly = options.tools !== false && tools.definitions.length === 0;
+                const parsed = parseToolScope(turn.toolScope);
+                if (!parsed.ok)
+                    throw new Error(parsed.error);
+                const scope = parsed.scope;
+                tools = await mountChatTools(options.tools === false ? undefined : turn.integrations, abort.signal, options.computerUse, scope);
+                const questionAllowed = options.tools !== false && allowsTool(scope, { kind: "native", name: ASK_USER_TOOL });
+                let optionalQuestionOnly = questionAllowed && tools.definitions.length === 0;
                 // The runtime's one built-in tool rides the same list: ask_user is
                 // how a chat-completions engine reaches a person. An MCP server that
                 // squats the name cannot shadow it — dispatch intercepts the name
                 // before validate — but the definition is then skipped so the list
                 // never advertises two.
-                if (options.tools !== false && !tools.definitions.some((definition) => definition.function.name === ASK_USER_TOOL)) {
+                if (questionAllowed && !tools.definitions.some((definition) => definition.function.name === ASK_USER_TOOL)) {
                     tools.definitions.push(ASK_USER_TOOL_DEFINITION);
                 }
                 for (let round = 0; round < 16; round++) {
@@ -549,6 +555,8 @@ export function createOpenAIChatRuntime(options) {
                                 throw new ChatProtocolError("tool arguments must be a JSON object");
                             const inputPreview = preview(args);
                             if (call.function.name === ASK_USER_TOOL) {
+                                if (!questionAllowed || !allowsTool(scope, { kind: "native", name: ASK_USER_TOOL }))
+                                    throw new Error("Tool selection excludes this tool");
                                 // A question is the person's card, not a permission, so it is
                                 // handled before the gate below: under Full access that gate
                                 // would auto-run an unanswered ask, and under Ask it would

package/dist-server/server/drivers/pi.js

@@ -34,6 +34,8 @@ import { newEventId, newId } from "../contracts.js";
 import { parseAskQuestions, parseChoices, questionAnswersByQuestion } from "../../shared/ask-question.js";
 import { decodeInjectId, encodeInjectId, hostApiKey, localHost, mergeLocalInject, } from "./local-inject.js";
 import { appendNative } from "./native.js";
+import { canUseMcpServer, parseToolScope } from "../../shared/tool-scope.js";
+import { gateServer, mcpStdioServer, resultBudget } from "../mcp-gate-config.js";
 const DRIVER_KIND = "piAgent";
 const PI_ARGS = ["--mode", "rpc", "--no-session"];
 const PI_MODEL_UPDATE_ARGS = ["update", "--models", "--no-approve"];
@@ -87,6 +89,9 @@ export function piThinkingLevel(effort) {
  * a JSON-RPC 2.0 stdio server the pi-mcp-extension consumes. Returns null when
  * there is nothing to mount (the common case). */
 export function buildMcpServers(turn) {
+    const parsed = parseToolScope(turn.toolScope);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
     const servers = {};
     if (turn.integrations?.composio)
         servers.composio = { ...turn.integrations.composio };
@@ -112,6 +117,22 @@ export function buildMcpServers(turn) {
             env: { ...NODE_ENV_FLAG, DWEB_URL: turn.integrations.dweb.url },
         };
     }
+    if (turn.integrations?.browser)
+        servers.browser = { ...turn.integrations.browser };
+    for (const [name, server] of Object.entries(turn.integrations?.custom ?? {}))
+        servers[name] = { ...server, scope: "custom" };
+    for (const [name, server] of Object.entries(servers)) {
+        if (parsed.scope !== undefined && !canUseMcpServer(parsed.scope, name)) {
+            delete servers[name];
+            continue;
+        }
+        const gated = gateServer({ name, server, toolScope: parsed.scope, threadId: turn.threadId, budget: name in (turn.integrations?.custom ?? {}) ? resultBudget() : 0, nodeEnv: NODE_ENV_FLAG });
+        const stdio = gated ?? mcpStdioServer(server, { nodeEnv: NODE_ENV_FLAG });
+        if (!stdio)
+            throw new Error("Pi MCP server configuration is invalid");
+        const original = server;
+        servers[name] = { ...stdio, ...(original.scope ? { scope: original.scope } : {}) };
+    }
     return Object.keys(servers).length ? servers : null;
 }
 /** Pure parser: turn a `get_available_models` stdout blob into a catalog.
@@ -428,6 +449,10 @@ export const PiDriver = {
         });
         const sendTurn = async (turn) => {
             const { threadId } = turn;
+            const selection = parseToolScope(turn.toolScope);
+            if (!selection.ok)
+                throw new Error(selection.error);
+            const toolScope = selection.scope;
             if (active.has(threadId))
                 throw new Error("a turn is already running on this thread");
             // Per-bot Ask/Auto is authoritative for harness turns. Preserve the
@@ -469,10 +494,13 @@ export const PiDriver = {
             // into a 0600 temp file removed when the turn settles — never on argv.
             const mcpServers = buildMcpServers(turn);
             let mcpTempDir = null;
-            if (mcpServers) {
+            let scopeReadyPath;
+            if (mcpServers || toolScope !== undefined) {
                 mcpTempDir = mkdtempSync(join(tmpdir(), "omb-pi-mcp-"));
+                if (toolScope !== undefined)
+                    scopeReadyPath = join(mcpTempDir, "scope-ready.json");
                 try {
-                    writeFileSync(join(mcpTempDir, "mcp.json"), JSON.stringify({ mcpServers }), { mode: 0o600 });
+                    writeFileSync(join(mcpTempDir, "mcp.json"), JSON.stringify({ mcpServers: mcpServers ?? {}, toolScope, scopeReadyPath, approvalMode: turn.approvalMode }), { mode: 0o600 });
                 }
                 catch (err) {
                     // A failed write must not leave the temp dir behind — a partial file
@@ -486,7 +514,7 @@ export const PiDriver = {
                     throw err;
                 }
             }
-            const childArgs = mcpServers ? [...PI_ARGS, "-e", SPAWNED_PROXIES.piMcpExtension] : PI_ARGS;
+            const childArgs = mcpTempDir ? [...PI_ARGS, "-e", SPAWNED_PROXIES.piMcpExtension] : PI_ARGS;
             // spawnCli can throw synchronously (unresolvable CLI); if it does, the
             // 0600 temp file with the boat token / composio key / comms token must
             // not be left on disk — settle() never runs because no child existed.
@@ -498,7 +526,7 @@ export const PiDriver = {
                         env: piEnvironment({
                             ...process.env,
                             ...input.environment,
-                            ...(mcpServers && mcpTempDir ? { OMB_MCP_CONFIG: join(mcpTempDir, "mcp.json") } : {}),
+                            ...(mcpTempDir ? { OMB_MCP_CONFIG: join(mcpTempDir, "mcp.json") } : {}),
                         }),
                     });
                 }
@@ -962,6 +990,20 @@ export const PiDriver = {
                     /* keep going on the engine default */
                 }
             }
+            if (scopeReadyPath) {
+                let ready = false;
+                try {
+                    const receipt = JSON.parse(readFileSync(scopeReadyPath, "utf8"));
+                    ready = receipt.ok === true && JSON.stringify(receipt.toolScope) === JSON.stringify(toolScope);
+                }
+                catch { /* Missing or malformed readiness is never a grant. */ }
+                if (!ready) {
+                    const message = "Pi tool selection enforcement is unavailable. Update Pi and check the OpenMausBot extension before retrying.";
+                    emit({ ...base(threadId, turnId), type: "runtime.error", message });
+                    settle(false);
+                    throw new Error(message);
+                }
+            }
             // The stable/volatile split: the full prompt rides only the turn that
             // establishes - or re-instructs, after a soul edit - this pi session,
             // which previously re-sent the whole system prompt on every turn and
@@ -1086,6 +1128,8 @@ export const PiDriver = {
                     computerMcp: true,
                     composioMcp: true,
                     phoneMcp: true,
+                    customMcp: true,
+                    browserMcp: true,
                     // Host control (the user's real Mac) rides the pi-native permission
                     // card (`ctx.ui.confirm` → extension_ui_request) gated in the
                     // extension, so it is offered exactly when the other engines offer

package/dist-server/server/environment.js

@@ -102,6 +102,9 @@ export function environmentDescriptor(input) {
             // Never advertise a protocol this server would refuse: the routes are
             // gone unless features.sharedComputers is on, so the capability is too.
             ...(input.sharedComputers === true ? { sharedComputers: true } : {}),
+            // An OMB Cloud home: its pairing page says "Opening your Cloud…" and
+            // where to connect from, not "the code shown on the server".
+            ...(input.cloudHome === true ? { cloudHome: true } : {}),
             selfUpdate: input.desktopManaged ? "desktop-managed" : "operator",
             emailSignIn: input.emailSignIn === true,
         },

package/dist-server/server/guarded-requests.js

@@ -1,3 +1,4 @@
+import { isPersistentQuestionCard } from "../shared/ask-question.js";
 export function requestConflict(message = "The request no longer owns this conversation") {
     return Object.assign(new Error(message), { status: 409, code: "guarded_request_changed" });
 }
@@ -54,7 +55,7 @@ export function requestSourceForCard(messages, messageId) {
     return undefined;
 }
 export function requestNeedsInput(message) {
-    return Boolean((message.card?.requestId && !message.card.answered && !message.card.dismissed && !message.card.expired) ||
+    return Boolean((message.card?.requestId && !message.card.answered && !message.card.dismissed && !message.card.expired && !isPersistentQuestionCard(message.card)) ||
         (message.connector && !message.connector.dismissed && !message.connector.resumed && message.connector.status !== "connected") ||
         (message.secret && !message.secret.provided && !message.secret.dismissed && !message.secret.superseded));
 }