openmausbot 0.1.93 → 0.1.95

package/dist-server/server/drivers/acp/core.js

@@ -41,6 +41,12 @@ import { classifyQuiet, describeQuiet, lastSeenPhrase, LogTail, quietKey, sample
 export function skipSubscriptionAuthForLocalInject(model) {
     return Boolean(decodeInjectId(model));
 }
+/** A catalog can contain credential-bearing native configuration, including late replies. */
+export function acpNativeIncomingLogMessage(message, privateResponses) {
+    if (!privateResponses.has(message?.id))
+        return message;
+    return { jsonrpc: message.jsonrpc, id: message.id, ...(message.error !== undefined ? { error: "[MCP catalog error omitted]" } : { result: "[MCP catalog omitted]" }) };
+}
 import { newEventId, newId, TurnNotStartedError } from "../../contracts.js";
 import { augmentedPath } from "../../env-path.js";
 import { supportsApprovalMode } from "../../../shared/approval-mode.js";
@@ -53,6 +59,8 @@ import { redactSecretsInText } from "../../redact.js";
 import { recoveryPromptFor } from "../../resume-recovery.js";
 import { sessionIdlePolicy } from "../session-idle.js";
 import { classifyError } from "../retry.js";
+import { canUseMcpServer, narrowsNativeTools, parseToolScope } from "../../../shared/tool-scope.js";
+import { gateServer } from "../../mcp-gate-config.js";
 const ACCOUNT_ERROR_CODES = new Set([
     "invalid_credentials", "inactive_subscription", "insufficient_funds", "quota_or_region_restriction",
 ]);
@@ -83,10 +91,12 @@ function acpRpcError(value, method) {
     });
 }
 const envOr = (key, fallback) => Number(process.env[key] ?? fallback);
-const INIT_TIMEOUT = envOr("OPENMAUS_ACP_INIT_TIMEOUT_MS", 300_000);
-const SESSION_CONFIG_TIMEOUT = envOr("OPENMAUS_ACP_SESSION_CONFIG_TIMEOUT_MS", 300_000); // configureSession's per-request default
-const NEW_SESSION_TIMEOUT = envOr("OPENMAUS_ACP_NEW_SESSION_TIMEOUT_MS", 300_000);
-const LOAD_SESSION_TIMEOUT = envOr("OPENMAUS_ACP_LOAD_SESSION_TIMEOUT_MS", 120_000); // history replay on a long thread is slow
+const INIT_TIMEOUT = 300_000;
+const SESSION_CONFIG_TIMEOUT = 300_000; // configureSession's per-request default
+const NEW_SESSION_TIMEOUT = 300_000;
+const LOAD_SESSION_TIMEOUT = 120_000; // history replay on a long thread is slow
+/** How long a quiet agent shows no sign of life before it is called stuck. */
+const ACP_STUCK_AFTER_MS = 180_000;
 /** ACP agents may compact their own history without telling the client;
  * re-send the full prompt after this many bare turns as a backstop to
  * compaction detection. */
@@ -133,6 +143,18 @@ function trackRunningTool(current, update, defaultStatus) {
     else if (status === "pending" || status === "in_progress")
         current.runningTools.add(update.toolCallId);
 }
+let unkeyedToolSeq = 0;
+/** Stamp an unkeyed `tool_call` with a synthetic id and queue it for the
+ * call's first terminal update, which carries no id of its own to match.
+ * FIFO is the best available pairing when the agent omits `toolCallId`:
+ * the ids exist to pair start with completion, not to order concurrent
+ * unkeyed calls, and the synthetic id deliberately stays out of
+ * `runningTools` so turn-settle semantics are unchanged. */
+function nextUnkeyedToolId(current) {
+    const id = `acp-tool-unkeyed-${++unkeyedToolSeq}`;
+    current.unkeyedToolIds.push(id);
+    return id;
+}
 const CLIENT_FILE_MAX_BYTES = 8 * 1024 * 1024;
 function acpVariantOption(result) {
     const option = (Array.isArray(result?.configOptions) ? result.configOptions : []).find((entry) => entry?.type === "select" && typeof entry.id === "string"
@@ -509,7 +531,18 @@ export function createAcpDriver(support) {
                     }
                     servers.push({ name, command: server.command, args: server.args, env: acpEnv(server.env) });
                 }
-                return servers;
+                if (turn.toolScope === undefined)
+                    return servers;
+                return servers.filter((server) => canUseMcpServer(turn.toolScope, server.name)).map((server) => {
+                    const original = "url" in server
+                        ? { type: server.type, url: server.url, headers: Object.fromEntries(server.headers.map(({ name, value }) => [name, value])) }
+                        : { command: server.command, args: server.args, env: Object.fromEntries(server.env.map(({ name, value }) => [name, value])) };
+                    const gated = gateServer({ name: server.name, server: original, threadId: turn.threadId, budget: 0,
+                        toolScope: turn.toolScope, nodeEnv: { ELECTRON_RUN_AS_NODE: "1" } });
+                    if (!gated)
+                        throw new Error("Tool selection requires an MCP gate.");
+                    return { name: server.name, command: gated.command, args: gated.args, env: acpEnv(gated.env) };
+                });
             };
             /** While a prompt runs, notice when the agent goes quiet and tell the
              *  person what it is doing: retrying, compressing, waiting on its
@@ -583,7 +616,7 @@ export function createAcpDriver(support) {
                     // "no sign of life" is called only once that has lasted minutes.
                     if (next.kind === "no-signs") {
                         noSignsSince ??= now;
-                        if (now - noSignsSince < envOr("OMB_ACP_STUCK_AFTER_MS", 180_000))
+                        if (now - noSignsSince < ACP_STUCK_AFTER_MS)
                             next = { kind: "between-requests" };
                     }
                     else {
@@ -667,6 +700,7 @@ export function createAcpDriver(support) {
                     stdio: ["pipe", "pipe", "pipe"],
                 });
                 let nextId = 1;
+                const privateResponses = new Set();
                 const rpcPending = new Map();
                 const send = (obj) => {
                     // A permission/file response resumes an agent that was waiting on us.
@@ -683,6 +717,8 @@ export function createAcpDriver(support) {
                 };
                 const request = (method, params, timeoutMs, receive, idleMs, idleMessage) => new Promise((resolve, reject) => {
                     const id = nextId++;
+                    if (method === "_x.ai/mcp/list")
+                        privateResponses.add(id);
                     let timer = null;
                     if (timeoutMs) {
                         timer = setTimeout(() => {
@@ -1007,7 +1043,7 @@ export function createAcpDriver(support) {
                                 ...base(threadId, current.turnId),
                                 type: "item.started",
                                 itemType: "tool",
-                                itemId: u.toolCallId,
+                                itemId: (typeof u.toolCallId === "string" && u.toolCallId) ? u.toolCallId : nextUnkeyedToolId(current),
                                 title: String(u.rawInput?.command ?? u.title ?? "tool").slice(0, 80),
                                 summary: commandSummary(u.rawInput),
                                 input: toolDetailPreview(u.rawInput),
@@ -1022,7 +1058,7 @@ export function createAcpDriver(support) {
                                     ...base(threadId, current.turnId),
                                     type: "item.completed",
                                     itemType: "tool",
-                                    itemId: u.toolCallId,
+                                    itemId: (typeof u.toolCallId === "string" && u.toolCallId) ? u.toolCallId : current.unkeyedToolIds.shift(),
                                     ok: u.status !== "failed",
                                     output: toolDetailPreview(u.rawOutput ?? u.content),
                                 });
@@ -1084,7 +1120,7 @@ export function createAcpDriver(support) {
                         catch {
                             continue;
                         }
-                        appendNative(threadId, { dir: "in", source: SOURCE, msg: nativeLogMessage(msg) });
+                        appendNative(threadId, { dir: "in", source: SOURCE, msg: nativeLogMessage(acpNativeIncomingLogMessage(msg, privateResponses)) });
                         // Inbound traffic proves the child is alive and making progress,
                         // so every idle deadline restarts; only total silence trips it.
                         lastInboundAt = Date.now();
@@ -1160,6 +1196,13 @@ export function createAcpDriver(support) {
                 return session;
             };
             const sendTurn = async (turn) => {
+                const parsedScope = parseToolScope(turn.toolScope);
+                if (!parsedScope.ok)
+                    throw new Error(parsedScope.error);
+                turn = { ...turn, toolScope: parsedScope.scope };
+                if (narrowsNativeTools(turn.toolScope) && !support.toolScopeSessionParams) {
+                    throw new Error(`${support.displayName}: native tool selection is not supported by this engine. Keep native:* in the selection or choose a supported engine.`);
+                }
                 const { threadId } = turn;
                 if (active.has(threadId))
                     throw new Error("a turn is already running on this thread");
@@ -1190,7 +1233,7 @@ export function createAcpDriver(support) {
                 }
                 const resolvedModel = support.resolveTurnModel?.(turn.model, env);
                 support.applyTurnEnv?.(env, {
-                    model: resolvedModel, requestedModel: turn.model, fullAuto: turnConfig.fullAuto === true, botId: turn.botId, cwd,
+                    model: resolvedModel, requestedModel: turn.model, fullAuto: turnConfig.fullAuto === true, botId: turn.botId, cwd, toolScope: turn.toolScope,
                 });
                 // Rebound once, before the prompt, when a fallbackModel support swaps
                 // a model this session does not offer for one it does.
@@ -1234,6 +1277,8 @@ export function createAcpDriver(support) {
                 // riding a child spawned under the old env. Hash it so secrets
                 // never sit in the key itself.
                 const envFingerprint = createHash("sha256").update(JSON.stringify(spawnEnv)).digest("hex").slice(0, 16);
+                const inheritedScopeFingerprint = narrowsNativeTools(turn.toolScope) && support.toolScopeCacheKey
+                    ? createHash("sha256").update(support.toolScopeCacheKey({ config: turnConfig, env, cwd })).digest("hex") : null;
                 // A support that applies the approval mode to the session on every
                 // turn gets the same process whatever the mode: an approval change
                 // is one RPC, not a cold start.
@@ -1241,6 +1286,8 @@ export function createAcpDriver(support) {
                     launch.command, launch.args ?? [], spawnArgs, cwd,
                     support.sessionScopedApproval ? null : turnConfig.fullAuto === true, envFingerprint,
                     support.spawnFingerprint?.(spawnEnv) ?? null,
+                    turn.toolScope ?? null,
+                    inheritedScopeFingerprint,
                 ]);
                 // The new-session default model rides the spawn env but stays out of
                 // the fingerprint above: only session/new reads it, and a pooled
@@ -1259,7 +1306,7 @@ export function createAcpDriver(support) {
                     launchedThisTurn = true;
                     return opened;
                 };
-                const sessionKey = JSON.stringify(mcpServers);
+                const sessionKey = JSON.stringify([mcpServers, turn.toolScope ?? null, inheritedScopeFingerprint]);
                 if (turn.sessionReset) {
                     closeSession(threadId, "reset");
                     sessionAllows.delete(threadId);
@@ -1357,6 +1404,7 @@ export function createAcpDriver(support) {
                     acknowledge,
                     asks,
                     runningTools: new Set(),
+                    unkeyedToolIds: [],
                     interruptTimer: null,
                     stopQuietWatch: null,
                     flushAssistantText,
@@ -1467,10 +1515,12 @@ export function createAcpDriver(support) {
                             // an agent that advertised its transport, so an agent without
                             // http/sse never sees an entry it would refuse the session over
                             const sessionServers = mcpServers.filter((server) => !("type" in server) || init?.agentCapabilities?.mcpCapabilities?.[server.type] === true);
+                            const selectionParams = narrowsNativeTools(turn.toolScope)
+                                ? support.toolScopeSessionParams(turn, init, sessionServers.length > 0, { config: turnConfig, env, cwd }) : {};
                             let loaded = false;
                             if (cursor) {
                                 try {
-                                    await request(support.resumeMethod === "resume" ? "session/resume" : "session/load", { sessionId: cursor, cwd, mcpServers: sessionServers }, LOAD_SESSION_TIMEOUT, (result) => {
+                                    await request(support.resumeMethod === "resume" ? "session/resume" : "session/load", { sessionId: cursor, cwd, mcpServers: sessionServers, ...selectionParams }, LOAD_SESSION_TIMEOUT, (result) => {
                                         if (result) {
                                             loaded = true;
                                             session.sessionId = cursor;
@@ -1526,7 +1576,7 @@ export function createAcpDriver(support) {
                                 promptTurn = { ...turn, text: recovery.text };
                                 rebuiltFromReplay = recovery.replayed;
                             }
-                            sessionResult = await request("session/new", { cwd, mcpServers: sessionServers }, NEW_SESSION_TIMEOUT, (result) => {
+                            sessionResult = await request("session/new", { cwd, mcpServers: sessionServers, ...selectionParams }, NEW_SESSION_TIMEOUT, (result) => {
                                 session.sessionId = typeof result?.sessionId === "string" ? result.sessionId : null;
                                 session.sessionKey = sessionKey;
                                 receiveModelVariants(result);
@@ -1612,6 +1662,7 @@ export function createAcpDriver(support) {
                                     sessionModels: Array.isArray(sessionResult?.models?.availableModels)
                                         ? sessionResult.models.availableModels
                                         : [],
+                                    currentModelId: session.sessionConfigResult?.models?.currentModelId,
                                 });
                                 approvalUnconfirmed = false;
                                 // initialize's currentModelId is the CLI default,

package/dist-server/server/drivers/acp/grok.js

@@ -4,10 +4,13 @@
 // The generic protocol runtime lives in acp/core.ts; this file is only the
 // per-harness quirks. Verified against grok 1.0.0.
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { harnessHome } from "../../env-path.js";
+import { dirname, join, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { parse as parseYaml } from "yaml";
+import { harnessHome, splitCliString } from "../../env-path.js";
 import { decodeInjectId, hostApiKey, localHost, mergeLocalInject } from "../local-inject.js";
 import { createAcpDriver } from "./core.js";
+import { allowsTool, canUseMcpServer, narrowsNativeTools, parseToolScope } from "../../../shared/tool-scope.js";
 export const STATIC_GROK_MODELS = {
     default: "grok-4.7",
     options: [
@@ -181,6 +184,140 @@ export function grokAcceptsUnadvertisedImages(init) {
     const version = /^1\.0\.(\d+)$/.exec(meta.agentVersion);
     return Boolean(version && Number(version[1]) >= 25);
 }
+// Original names in the official 1.0.41 default registry, not arbitrary
+// owner strings forwarded into Grok's inherit-all profile allowlist.
+const GROK_NATIVE_TOOLS = [
+    ["read_file", "GrokBuild:read_file"], ["search_replace", "GrokBuild:search_replace"], ["write", "OpenCode:write"],
+    ["run_terminal_command", "GrokBuild:run_terminal_cmd"], ["list_dir", "GrokBuild:list_dir"], ["grep", "GrokBuild:grep"],
+    ["kill_command_or_subagent", "GrokBuild:kill_task"], ["todo_write", "GrokBuild:todo_write"],
+    ["get_command_or_subagent_output", "GrokBuild:get_task_output"], ["spawn_subagent", "GrokBuild:task"],
+    ["scheduler_create", "GrokBuild:scheduler_create"], ["scheduler_delete", "GrokBuild:scheduler_delete"], ["scheduler_list", "GrokBuild:scheduler_list"],
+    ["monitor", "GrokBuild:monitor"], ["search_tool", "GrokBuild:search_tool"], ["use_tool", "GrokBuild:use_tool"],
+    ["workflow", "GrokBuild:workflow"], ["enter_plan_mode", "GrokBuild:enter_plan_mode"], ["exit_plan_mode", "GrokBuild:exit_plan_mode"],
+    ["ask_user_question", "GrokBuild:ask_user_question"], ["send_feedback", "GrokBuild:send_feedback"],
+    ["image_gen", "GrokBuild:image_gen"], ["image_edit", "GrokBuild:image_edit"],
+    ["image_to_video", "GrokBuild:image_to_video"], ["reference_to_video", "GrokBuild:reference_to_video"],
+];
+/** Read a supported on-disk profile rather than overriding its restriction. */
+export function grokInheritedProfile(cli, env, cwd) {
+    const unsupported = () => { throw new Error("Grok's existing agent profile cannot be safely intersected with tool selection. Use a profile file with explicit tools or a separate default Grok account."); };
+    if ((env.GROK_AGENT && env.GROK_AGENT !== "grok-build") || env.GROK_CONFIG || env.GROK_CONFIG_PATH)
+        return unsupported();
+    const args = splitCliString(cli);
+    // Operator filters are applied after ACP's profile by the CLI. Refuse
+    // unverified overrides rather than replacing an inherited restriction.
+    if (args.some(arg => /^(--tools|--disallowed-tools|--disallowedTools|--agent)(=|$)/.test(arg)))
+        return unsupported();
+    const flags = args.flatMap((arg, index) => arg === "--agent-profile" || arg.startsWith("--agent-profile=") ? [index] : []);
+    if (flags.length > 1)
+        return unsupported();
+    const flag = flags[0] ?? -1;
+    let path = flag >= 0 ? (args[flag].includes("=") ? args[flag].slice(args[flag].indexOf("=") + 1) : args[flag + 1]) : undefined;
+    if (flag >= 0 && (!path || path.startsWith("-")))
+        return unsupported();
+    const files = [join(env.GROK_HOME || harnessHome("grok", env), "config.toml")];
+    for (let directory = resolve(cwd);;) {
+        const file = join(directory, ".grok", "config.toml");
+        if (!files.includes(file))
+            files.push(file);
+        const parent = dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
+    }
+    for (const file of files) {
+        if (!existsSync(file))
+            continue;
+        const text = readFileSync(file, "utf8");
+        if (text.length > 262_144)
+            return unsupported();
+        // Support a deliberately small, unambiguous TOML subset. Scan the whole
+        // file: quoted/dotted keys, inline agent tables and multiline constructs
+        // must never be silently missed by a section regex. Unsupported syntax
+        // refuses this scoped turn; ordinary unrestricted turns are unaffected.
+        let section = "";
+        for (const line of text.split(/\r?\n/).map(line => line.trim()).filter(line => line && !line.startsWith("#"))) {
+            const header = /^\[([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)\]\s*(?:#.*)?$/.exec(line);
+            if (header) {
+                section = header[1];
+                if (section.startsWith("agent."))
+                    return unsupported();
+                continue;
+            }
+            const assignment = /^([A-Za-z0-9_-]+)\s*=\s*(.+)$/.exec(line);
+            if (!assignment || /'''|"""/.test(assignment[2]) || (!section && assignment[1] === "agent"))
+                return unsupported();
+            if (section !== "agent")
+                continue;
+            const match = /^(name|definition)\s*=\s*("(?:[^"\\]|\\.)*"|'[^']*')\s*(?:#.*)?$/.exec(line);
+            if (!match)
+                return unsupported();
+            let value;
+            try {
+                value = match[2].startsWith('"') ? JSON.parse(match[2]) : match[2].slice(1, -1);
+            }
+            catch {
+                return unsupported();
+            }
+            // Grok expands environment variables in paths. Do not resolve a
+            // different literal file or fall back when that contract is unknown.
+            if (value.includes("$") || !value)
+                return unsupported();
+            if (match[1] === "name" && value !== "grok-build")
+                return unsupported();
+            if (match[1] === "definition" && flag < 0) {
+                if (path !== undefined && path !== value)
+                    return unsupported();
+                path = value;
+            }
+        }
+    }
+    if (!path)
+        return;
+    const text = readFileSync(resolve(cwd, path), "utf8");
+    if (text.length > 262_144)
+        return unsupported();
+    const match = /^\s*---\r?\n([\s\S]*?)\r?\n---(?:\r?\n([\s\S]*))?$/.exec(text);
+    if (!match)
+        return unsupported();
+    const profile = parseYaml(match[1]);
+    if (!profile || typeof profile.name !== "string" || typeof profile.description !== "string"
+        || (profile.tools !== undefined && (!Array.isArray(profile.tools) || !profile.tools.every((tool) => typeof tool === "string")))
+        || (profile.disallowedTools !== undefined && (!Array.isArray(profile.disallowedTools) || !profile.disallowedTools.every((tool) => typeof tool === "string"))))
+        return unsupported();
+    const toolConfig = profile.toolConfig ?? { tools: GROK_NATIVE_TOOLS.map(([name, id]) => ({ id, name_override: name })) };
+    if (!Array.isArray(toolConfig.tools) || !toolConfig.tools.every((tool) => typeof tool?.id === "string" && (tool.name_override === undefined || typeof tool.name_override === "string")))
+        return unsupported();
+    return { ...profile, name: profile.name, description: profile.description, toolConfig, ...(match[2]?.trim() ? { promptBody: match[2].trim() } : {}) };
+}
+/** A curated registry: empty/unknown selections never inherit Grok's defaults. */
+export function grokToolScopeProfile(scope, init, inherited, hasMcp = false) {
+    const parsed = parseToolScope(scope);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
+    const meta = init?._meta;
+    if (meta?.grokShell !== true || meta.agentVersion !== "1.0.41") {
+        throw new Error("This Grok runtime does not have verified native tool selection. Use Grok 1.0.41 or Pi; update Grok support before using another version.");
+    }
+    if (hasMcp && (!allowsTool(scope, { kind: "native", name: "search_tool" }) || !allowsTool(scope, { kind: "native", name: "use_tool" }))) {
+        throw new Error("Grok requires native:search_tool and native:use_tool to find and call selected MCP tools. Allow both explicitly or use Pi.");
+    }
+    const candidates = inherited?.toolConfig.tools ?? GROK_NATIVE_TOOLS.map(([name, id]) => ({ id, name_override: name }));
+    const selected = candidates.filter((tool) => {
+        const name = tool.name_override ?? GROK_NATIVE_TOOLS.find(([, id]) => id === tool.id)?.[0];
+        return name !== undefined && allowsTool(scope, { kind: "native", name })
+            && (!inherited?.tools?.length || inherited.tools.includes(name) || inherited.tools.includes(tool.id))
+            && !inherited?.disallowedTools?.some((denied) => denied === name || denied === tool.id);
+    });
+    // Grok rejects an empty curated construction. A real read entry explicitly
+    // disabled by its exact native name constructs an empty final registry.
+    return {
+        ...inherited, name: inherited?.name ?? "openmausbot-tools", description: inherited?.description ?? "Owner-selected tools",
+        injectDefaultTools: false, discoverSkills: false,
+        toolConfig: { ...inherited?.toolConfig, tools: selected.length ? selected : [{ id: "GrokBuild:read_file", name_override: "read_file" }] },
+        tools: [], disallowedTools: [...new Set([...(inherited?.disallowedTools ?? []), ...(selected.length ? [] : ["read_file"])])],
+    };
+}
 const support = {
     driverKind: "grokAgent",
     displayName: "Grok",
@@ -225,17 +362,69 @@ const support = {
             ? "bypassPermissions"
             : turn.approvalMode === "auto" ? "auto" : turn.approvalMode === "edits" ? "acceptEdits" : "default",
         "agent",
+        ...(turn.toolScope !== undefined ? ["--no-leader"] : []),
         ...(turn.model ? ["-m", turn.model] : []),
         // long form on purpose: `--effort` is documented as an alias, and an
         // alias is the part a CLI is free to rename
         ...(turn.effort ? ["--reasoning-effort", turn.effort] : []),
         "stdio",
     ],
+    toolScopeSessionParams: (turn, init, hasMcp, { config, env, cwd }) => {
+        if (!narrowsNativeTools(turn.toolScope))
+            return {};
+        const profile = grokToolScopeProfile(turn.toolScope, init, grokInheritedProfile(config.cli, env, cwd), hasMcp);
+        // Establish on the selected model. Changing harnesses after session/new
+        // can discard an ACP profile and restore the model's default tools.
+        if (turn.model)
+            profile.model = ensureGrokInjectSlug(turn.model, env);
+        return { _meta: { agentProfile: profile } };
+    },
+    toolScopeCacheKey: ({ config, env, cwd }) => JSON.stringify(grokInheritedProfile(config.cli, env, cwd) ?? null),
     // -m on argv is necessary but not sufficient: session/new still starts on
     // [models].default. Pin the slug over the wire, same as Hermes/Droid.
-    async configureSession({ request, sessionId, turn }) {
+    async configureSession({ request, sessionId, turn, currentModelId }) {
+        if (turn.toolScope !== undefined) {
+            const available = new Set([
+                ...(turn.integrations?.agents ? ["agents"] : []), ...(turn.integrations?.composio ? ["composio"] : []),
+                ...(turn.integrations?.browser ? ["browser"] : []), ...(turn.integrations?.localComputer ? ["computer"] : []),
+                ...Object.keys(turn.integrations?.custom ?? {}),
+            ].filter((name) => canUseMcpServer(turn.toolScope, name)));
+            const deadline = Date.now() + 10_000;
+            for (;;) {
+                const reply = await request("_x.ai/mcp/list", { sessionId, cache: true }, 10_000);
+                const catalog = reply?.result;
+                if (!Array.isArray(catalog?.servers))
+                    throw new Error("Grok could not confirm its MCP catalog. No prompt was sent.");
+                for (const server of catalog.servers) {
+                    if (server?.session?.enabled === false)
+                        continue;
+                    if (!available.has(server?.name))
+                        throw new Error("Grok has an MCP connection outside the bot's selection. Disable native MCP connections before using tool selection. No prompt was sent.");
+                    if (Array.isArray(server?.session?.tools) && server.session.tools.some((tool) => typeof tool.name !== "string" || !allowsTool(turn.toolScope, { kind: "mcp", server: server.name, name: tool.name }))) {
+                        throw new Error("Grok could not enforce the selected MCP catalog. No prompt was sent.");
+                    }
+                }
+                if (catalog.sessionMcpResolved === true) {
+                    if ([...available].some((name) => !catalog.servers.some((server) => server.name === name && server.session?.enabled === true && server.session.status === "ready"))) {
+                        throw new Error("Grok could not connect a selected MCP server. No prompt was sent.");
+                    }
+                    break;
+                }
+                if (Date.now() >= deadline)
+                    throw new Error("Grok did not confirm its selected MCP catalog in time. No prompt was sent.");
+                await delay(50);
+            }
+        }
         if (!turn.model)
             return;
+        if (narrowsNativeTools(turn.toolScope)) {
+            if (currentModelId !== turn.model) {
+                throw new Error("Grok could not confirm the selected model without replacing its tool profile. Start a new conversation or choose a model with a supported Grok profile. No prompt was sent.");
+            }
+            // The inline profile already pins this model. Repeating set_model can
+            // rebuild the harness, or reject an otherwise valid resumed profile.
+            return;
+        }
         try {
             await request("session/set_model", { sessionId, modelId: turn.model });
         }
@@ -249,6 +438,22 @@ const support = {
     transformEnv: (env) => {
         delete env.XAI_API_KEY;
     },
+    applyTurnEnv: (env, { toolScope }) => {
+        if (toolScope !== undefined) {
+            // The verified runtime gives these local env switches priority over
+            // account defaults, preventing an unfiltered managed gateway fallback.
+            env.GROK_MANAGED_MCPS_ENABLED = "false";
+            env.GROK_MANAGED_MCP_GATEWAY_TOOLS_ENABLED = "false";
+            if (narrowsNativeTools(toolScope)) {
+                if (env.GROK_AGENT && env.GROK_AGENT !== "grok-build") {
+                    throw new Error("Grok's existing agent profile cannot be safely intersected with tool selection. Use a separate default Grok account.");
+                }
+                // A model's agent_type otherwise takes priority over ACP profiles.
+                // Preserve profile-file restrictions when intersecting them below.
+                env.GROK_AGENT = "grok-build";
+            }
+        }
+    },
     // Bind the grok.com subscription login. No API-key fallback by design —
     // an unauthenticated CLI is a user action, not something to paper over.
     pickAuthMethod: (methods) => (methods.some((m) => m.id === "cached_token") ? "cached_token" : null),

package/dist-server/server/drivers/agents-call.js

@@ -31,7 +31,6 @@ export function toolCallContextFromEnv(env) {
             createdThisTurn: 0,
             roomPostsThisTurn: 0,
             threadsOpenedThisTurn: 0,
-            memoryRefusalsThisTurn: 0,
             delegationTaskIdsThisTurn: new Set(),
         },
     };
@@ -49,11 +48,9 @@ const MAX_ROOM_POSTS_PER_TURN = 3;
 // deciding. The harness holds the same ceiling; this copy exists so the
 // refusal reaches the model without a round trip.
 const MAX_THREADS_PER_TURN = 5;
-// A memory write the harness refused (a stale passage, a full file) needs
-// one re-read and one corrected retry, not a loop of the same append. The
-// third refusal in a turn closes the tool so the turn ends with the person
-// told what did not fit instead of a transcript of retries.
-const MAX_MEMORY_REFUSALS_PER_TURN = 3;
+/** How many entries a memory_update reply names when its write moved some
+ * to the archive; the rest are counted. */
+const MOVED_ENTRIES_SHOWN = 5;
 const SHORT_WEEKDAYS = {
     mon: "monday",
     tue: "tuesday",
@@ -278,7 +275,7 @@ function routineFields(args) {
     const runOn = destination(args.run_on ?? args.runOn);
     const timeoutMinutes = args.timeout_minutes ?? args.timeoutMinutes;
     if (runOn != null && runOn !== "maus" && runOn !== "cloud") {
-        return { fields, error: 'Use run_on="maus" for the bot’s current model and configured computer (including VPS), or run_on="box" only for the Boat-hosted agent. Legacy "cloud" also means Boat.' };
+        return { fields, error: 'Use run_on="maus" for the bot’s current model and configured computer (including VPS), or run_on="box" only for the bot’s Boat cloud computer. Legacy "cloud" also means Boat.' };
     }
     if (timeoutMinutes != null && (typeof timeoutMinutes !== "number" || !Number.isInteger(timeoutMinutes) || timeoutMinutes < 5 || timeoutMinutes > 240)) {
         return { fields, error: "timeout_minutes must be a whole number from 5 to 240. Use clear_timeout to remove a limit." };
@@ -483,30 +480,54 @@ export async function callTool(name, args, context) {
         // retry needs instead of a generic validation error (#1239).
         const canonical = { ...args };
         delete canonical.botIds;
-        delete canonical.requestKey;
         delete canonical.groupId;
         if (canonical.bot_ids === undefined)
             canonical.bot_ids = args.botIds;
-        if (canonical.request_key === undefined)
-            canonical.request_key = args.requestKey;
         if (canonical.group_id === undefined)
             canonical.group_id = args.groupId;
         const ids = canonical.bot_ids;
         const usable = Array.isArray(ids) && ids.length > 0 && ids.every((id) => typeof id === "string")
-            && typeof canonical.message === "string" && canonical.message.trim().length > 0
-            && typeof canonical.request_key === "string" && canonical.request_key.trim().length > 0;
+            && typeof canonical.message === "string" && canonical.message.trim().length > 0;
         if (!usable) {
             return {
-                text: `coordinate_bots takes snake_case arguments: bot_ids (an array of 1-4 teammate ids), message and request_key are required; group_id, rework and label are optional. Received: ${Object.keys(args).join(", ") || "none"}.`,
+                text: `coordinate_bots takes snake_case arguments: bot_ids (an array of 1-4 teammate ids) and message are required; group_id and rework are optional. Received: ${Object.keys(args).join(", ") || "none"}.`,
                 isError: true,
             };
         }
         const r = await api("/api/internal/coordinate-bots", { method: "POST", body: JSON.stringify({
                 groupId: canonical.group_id, botIds: ids, message: canonical.message,
-                requestKey: canonical.request_key, rework: canonical.rework, label: canonical.label,
+                rework: canonical.rework,
             }) });
         return { text: JSON.stringify(r), ...(r.error ? { isError: true } : {}) };
     }
+    if (name === "send_to_bot") {
+        const botId = String(args.bot_id ?? "").trim();
+        const title = String(args.title ?? "").trim();
+        const message = String(args.message ?? "").trim();
+        if (!botId || !title || !message) {
+            return { text: "send_to_bot needs bot_id, title and message.", isError: true };
+        }
+        if (botId === context.botId) {
+            return { text: "send_to_bot is cross-bot only. Use start_thread to send independent work to yourself.", isError: true };
+        }
+        if (turn.threadsOpenedThisTurn >= MAX_THREADS_PER_TURN) {
+            return { text: `You have already opened ${MAX_THREADS_PER_TURN} threads this turn, which is the limit.`, isError: true };
+        }
+        const r = await api("/api/internal/threads", { method: "POST", body: JSON.stringify({
+                fromBotId: context.botId, fromThreadId: context.threadId, toBotId: botId,
+                title, message, depth: context.depth, oneWay: true,
+            }) });
+        if (r.error)
+            return { text: `Couldn't send to that bot: ${String(r.error)}`, isError: true };
+        turn.threadsOpenedThisTurn += 1;
+        const destination = `@${String(r.botName ?? "that bot")} in #${String(r.title ?? title)} [thread id: ${String(r.threadId ?? "")}]`;
+        const state = r.approvalRequired === true
+            ? `Send to ${destination} is pending approval. The person's approval card appears after this turn ends; dispatch starts once approved.`
+            : r.state === "queued"
+                ? `Send to ${destination} is queued ${ordinal(Number(r.position) || 1)} for a free slot and can dispatch after this turn ends.`
+                : `Send to ${destination} is pending until this turn ends, then dispatch starts.`;
+        return { text: `${state} Its result stays in that thread; nothing there will resume you.` };
+    }
     if (name === "list_bots") {
         const r = await api(`/api/internal/agents?self=${encodeURIComponent(BOT_ID)}`);
         const bots = r.bots ?? [];
@@ -1087,12 +1108,6 @@ export async function callTool(name, args, context) {
             || (args.action !== "append" && (typeof args.old_text !== "string" || !args.old_text.trim()))) {
             return { text: "Use memory_update action=append with text, replace or supersede with text and old_text, or remove with old_text.", isError: true };
         }
-        if (turn.memoryRefusalsThisTurn >= MAX_MEMORY_REFUSALS_PER_TURN) {
-            return {
-                text: `Memory updates are closed for the rest of this turn: ${MAX_MEMORY_REFUSALS_PER_TURN} were refused. Do not retry. Tell the person what you wanted to keep and why it did not fit; they can tidy MEMORY.md in Settings, and you can try again in your next turn.`,
-                isError: true,
-            };
-        }
         const { body: r } = await apiResponse("/api/internal/memory", {
             method: "POST",
             body: JSON.stringify({
@@ -1104,16 +1119,23 @@ export async function callTool(name, args, context) {
                 ...(typeof args.until === "string" && args.until.trim() ? { until: args.until.trim() } : {}),
             }),
         });
-        if (r.error || r.ok !== true) {
-            turn.memoryRefusalsThisTurn += 1;
-            const recent = Array.isArray(r.recent) ? r.recent.filter((line) => typeof line === "string") : [];
-            // A full file: the refusal carries the newest entries so the model
-            // can merge them in this same turn without a read round trip.
-            const tail = r.code === "over-budget" && recent.length ? `\n\nMost recent entries, oldest first:\n${recent.join("\n")}` : "";
-            return { text: `${String(r.error ?? "Memory update was not confirmed.")}${tail}`, isError: true };
-        }
+        if (r.error || r.ok !== true)
+            return { text: String(r.error ?? "Memory update was not confirmed."), isError: true };
         const entry = typeof r.entry === "string" && r.entry ? ` Entry: ${r.entry}` : "";
-        return { text: `Memory updated.${entry}${r.truncated ? " MEMORY.md exceeds the prompt load budget; keep it short and curated." : ""}` };
+        const moved = Array.isArray(r.moved) ? r.moved.filter((line) => typeof line === "string") : [];
+        // A write never fails for size: the bot hears where older notes went,
+        // and the one case it cannot fix itself, in one plain sentence.
+        const full = r.truncated
+            ? "\nSaved, but the lines that never move out of MEMORY.md (hand-written ones, health and safety facts) fill what loads each session, so the newest entries do not load. Ask the person to trim MEMORY.md in Settings."
+            : "";
+        // Named by their first line, a few at most: a file grown far past the
+        // budget by hand can move hundreds in one write.
+        const shown = moved.slice(0, MOVED_ENTRIES_SHOWN).map((text) => text.split("\n")[0]);
+        const more = moved.length > shown.length ? `\n…and ${moved.length - shown.length} more` : "";
+        const movedNote = moved.length
+            ? `\nTo stay within what loads each session, moved ${moved.length === 1 ? "1 older entry" : `${moved.length} older entries`} to memory/archive.md (session_search finds them):\n${shown.join("\n")}${more}`
+            : "";
+        return { text: `Memory updated.${entry}${full}${movedNote}` };
     }
     if (name === "retry_thread") {
         const botId = String(args.bot_id ?? "").trim();
@@ -1141,6 +1163,25 @@ export async function callTool(name, args, context) {
             return { text: String(r.error ?? "The log line was not confirmed."), isError: true };
         return { text: `Logged to ${String(r.file)}: ${String(r.line)}` };
     }
+    if (name === "propose_team_memory") {
+        const kind = String(args.kind ?? "").trim();
+        const entryName = String(args.name ?? "").trim();
+        const detail = String(args.detail ?? "").trim();
+        if (!kind || !entryName || !detail)
+            return { text: "propose_team_memory needs kind, name, and detail.", isError: true };
+        const r = await api("/api/internal/team-memory", {
+            method: "POST",
+            body: JSON.stringify({
+                fromBotId: BOT_ID,
+                fromThreadId: THREAD_ID,
+                kind,
+                name: entryName,
+                detail,
+                aliases: Array.isArray(args.aliases) ? args.aliases.filter((alias) => typeof alias === "string") : undefined,
+            }),
+        });
+        return confirmationResult(r, `remembering ${entryName} for the team`, "entry");
+    }
     if (name === "session_search") {
         const q = String(args.query ?? "").trim();
         const since = typeof args.since === "string" ? args.since.trim() : "";