openmausbot 0.1.93 → 0.1.95

package/dist-server/server/drivers/codex.js

@@ -38,6 +38,9 @@ import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-r
 import { extractMcpImages } from "../mcp-tool-images.js";
 import { parseProtocolAskQuestions, questionAnswersById, questionChoices } from "../../shared/ask-question.js";
 import { codexVersionBehind, readLatestCodexRelease } from "./codex-release.js";
+import { canUseMcpServer } from "../../shared/tool-scope.js";
+import { assertToolScopeSupported } from "../../shared/tool-scope-support.js";
+import { gateServer } from "../mcp-gate-config.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 export function codexUserError(value, chatgptPlan) {
@@ -621,6 +624,7 @@ export const CodexDriver = {
             createdAt: new Date().toISOString(),
         });
         const sendTurn = async (turn) => {
+            turn = { ...turn, toolScope: assertToolScopeSupported(DRIVER_KIND, turn.toolScope) };
             const generation = planGeneration;
             const assertPlanCurrent = () => {
                 if (disposed)
@@ -691,48 +695,81 @@ export const CodexDriver = {
                 if (planToken)
                     env.OPENMAUSBOT_CHATGPT_TOKEN = planToken;
                 const appServerArgs = ["app-server", ...(plan ? chatgptPlanCodexArgs() : config.managed ? managedCodexArgs(config.managed) : codexLocalProviderArgs(env, turn.model)), ...codexToolSurfaceArgs(),
+                    // Native snapshots can restore inherited variables after the shell
+                    // policy has filtered them. Scoped MCP gate settings must stay private.
+                    ...(turn.toolScope === undefined ? [] : ["-c", "features.shell_snapshot=false"]),
                     // A guest-driven turn (SendTurnInput.guestConfined): no shell and
                     // no file reads, whatever the person's own config says (-c wins
                     // over config files). The turn also starts with no environment.
                     ...(turn.guestConfined ? GUEST_CONFINED_CODEX_ARGS : [])];
+                const selectedMcp = new Map();
+                const selectedApprovals = new Map();
+                const scopedServer = (name, mountName, server) => {
+                    if (!canUseMcpServer(turn.toolScope, name))
+                        return null;
+                    return turn.toolScope === undefined ? server : gateServer({ name, server, threadId, budget: 0, toolScope: turn.toolScope, nodeEnv: { ELECTRON_RUN_AS_NODE: "1" },
+                        configEnvName: `OMB_GATE_CONFIG_${createHash("sha256").update(mountName).digest("hex")}` });
+                };
+                const mountSelected = (name, mountName, server, preApproved = true) => {
+                    const selected = scopedServer(name, mountName, server);
+                    if (selected) {
+                        selectedMcp.set(mountName, selected);
+                        selectedApprovals.set(mountName, preApproved);
+                        mountMcpServer(appServerArgs, env, mountName, selected, preApproved);
+                        if (turn.toolScope !== undefined && !preApproved)
+                            appServerArgs.push("-c", `mcp_servers.${mountName}.default_tools_approval_mode="prompt"`);
+                    }
+                };
                 if (turn.integrations?.composio) {
-                    mountMcpServer(appServerArgs, env, "openmausbot_connectors", turn.integrations.composio);
+                    mountSelected("composio", "openmausbot_connectors", turn.integrations.composio);
                 }
                 if (turn.integrations?.agents) {
-                    mountMcpServer(appServerArgs, env, "agents", turn.integrations.agents);
+                    mountSelected("agents", "agents", turn.integrations.agents);
                 }
                 if (turn.integrations?.localComputer) {
                     // The host daemon and isolated Local VM both arrive as a direct Cua
                     // Driver stdio MCP server. Codex sees the same computer tool surface.
-                    mountMcpServer(appServerArgs, env, "computer", turn.integrations.localComputer);
+                    mountSelected("computer", "computer", turn.integrations.localComputer);
                 }
                 if (turn.integrations?.browser) {
-                    mountMcpServer(appServerArgs, env, "browser", turn.integrations.browser);
+                    mountSelected("browser", "browser", turn.integrations.browser);
                 }
                 // A custom server named like one in the user's own config.toml would
                 // be merged with it by the `-c` override — a stdio command over a
                 // remote url is "invalid configuration" and kills the turn before the
                 // model is asked. Such a server mounts under a name of its own.
                 const declaredInCodexConfig = codexConfigMcpServerNames(env);
+                if (turn.toolScope !== undefined) {
+                    for (const name of declaredInCodexConfig)
+                        appServerArgs.push("-c", `mcp_servers.${name}.enabled=false`);
+                }
                 for (const [name, server] of Object.entries(turn.integrations?.custom ?? {})) {
                     // codex speaks streamable HTTP to a remote server, not the older
                     // SSE transport: such an entry still reaches Claude bots, and is
                     // left out here rather than mounted as something it is not
-                    if ("url" in server && server.type === "sse") {
+                    if (turn.toolScope === undefined && "url" in server && server.type === "sse") {
                         noteSkippedSseServer(name);
                         continue;
                     }
                     const mountName = mountedMcpServerName(name, declaredInCodexConfig);
                     if (mountName !== name)
                         noteRenamedMcpServer(name, mountName);
-                    mountMcpServer(appServerArgs, env, mountName, server, false);
+                    mountSelected(name, mountName, server, false);
                 }
                 if (turn.integrations?.phone) {
-                    const bridge = turn.integrations.phone;
-                    Object.assign(env, bridge.env);
-                    const prefix = "mcp_servers.openmausbot_phone";
-                    appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
+                    if (turn.toolScope !== undefined) {
+                        mountSelected("phone", "openmausbot_phone", turn.integrations.phone);
+                    }
+                    else {
+                        const bridge = turn.integrations.phone;
+                        Object.assign(env, bridge.env);
+                        const prefix = "mcp_servers.openmausbot_phone";
+                        appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
+                    }
                 }
+                const selectionConfig = turn.toolScope === undefined ? {} : { config: { mcp_servers: Object.fromEntries([...selectedMcp].map(([name, server]) => [name, "command" in server ? {
+                                command: server.command, args: server.args, env_vars: Object.keys(server.env), env: {}, default_tools_approval_mode: selectedApprovals.get(name) ? "auto" : "prompt",
+                            } : {}])) } };
                 const commandCwd = permissionLaunchCwd(turn.cwd ?? homedir());
                 const child = spawnCli(config.cli, appServerArgs, {
                     cwd: turn.cwd ?? homedir(),
@@ -1487,6 +1524,41 @@ export const CodexDriver = {
                             ? "Codex rejected its configuration as invalid. Check ~/.codex/config.toml (or CODEX_HOME) for a broken entry, then retry."
                             : "Could not read Codex configuration; cannot safely update bot instructions. Retry after checking Codex.");
                     }
+                    if (turn.toolScope !== undefined) {
+                        if (effectiveConfig?.features?.shell_snapshot !== false) {
+                            throw new Error("Codex could not disable inherited shell snapshots. No prompt was sent.");
+                        }
+                        // Gate descriptors belong to MCP children, never native shell tools.
+                        // Extend the effective policy for both new and resumed threads so
+                        // local, Company and ChatGPT turns retain the person's exclusions.
+                        const rawPolicy = effectiveConfig?.shell_environment_policy;
+                        if (rawPolicy !== undefined && (!rawPolicy || typeof rawPolicy !== "object" || Array.isArray(rawPolicy))) {
+                            throw new Error("Codex could not confirm its shell environment policy. No prompt was sent.");
+                        }
+                        const policy = (rawPolicy ?? {});
+                        const excluded = policy.exclude === undefined ? [] : policy.exclude;
+                        if (!Array.isArray(excluded) || excluded.some(name => typeof name !== "string")) {
+                            throw new Error("Codex could not confirm its shell environment exclusions. No prompt was sent.");
+                        }
+                        selectionConfig.config["shell_environment_policy.exclude"] = [...new Set([...excluded, "OMB_GATE_CONFIG_*"])];
+                        const catalog = effectiveConfig?.mcp_servers;
+                        if (!catalog || typeof catalog !== "object" || Array.isArray(catalog))
+                            throw new Error("Codex could not confirm its selected MCP configuration. No prompt was sent.");
+                        for (const [name, entry] of Object.entries(catalog)) {
+                            if (entry && typeof entry === "object" && entry.enabled === false)
+                                continue;
+                            const expected = selectedMcp.get(name);
+                            const actual = entry;
+                            if (!expected || !("command" in expected) || actual?.command !== expected.command
+                                || JSON.stringify(actual?.args ?? []) !== JSON.stringify(expected.args ?? [])
+                                || !Array.isArray(actual?.env_vars) || JSON.stringify([...actual.env_vars].sort()) !== JSON.stringify(Object.keys(expected.env).sort())
+                                || actual.default_tools_approval_mode !== (selectedApprovals.get(name) ? "auto" : "prompt")
+                                || (actual.env != null && (typeof actual.env !== "object" || Array.isArray(actual.env) || Object.keys(actual.env).length > 0))
+                                || (actual.tools != null && (typeof actual.tools !== "object" || Array.isArray(actual.tools) || Object.keys(actual.tools).length > 0))) {
+                                throw new Error("Codex has an MCP server outside the selected configuration. Disable native MCP entries for this account before using tool selection. No prompt was sent.");
+                            }
+                        }
+                    }
                     // Proven before the turn starts: a Codex that did not take the
                     // overrides runs nothing for a guest.
                     if (turn.guestConfined && !codexShellDisabled(effectiveConfig)) {
@@ -1534,6 +1606,7 @@ export const CodexDriver = {
                     let promptText = turn.text;
                     if (cursor) {
                         const resumeThread = () => request("thread/resume", {
+                            ...selectionConfig,
                             threadId: cursor,
                             developerInstructions,
                             model: selection.model,
@@ -1581,6 +1654,7 @@ export const CodexDriver = {
                     }
                     if (!codexThreadId) {
                         const startThread = () => request("thread/start", {
+                            ...selectionConfig,
                             developerInstructions,
                             cwd: turn.cwd ?? homedir(),
                             model: selection.model,

package/dist-server/server/drivers/openai-chat.js

@@ -1,5 +1,6 @@
 import { newEventId, newId } from "../contracts.js";
 import { ASK_USER_TOOL, ASK_USER_TOOL_DEFINITION, askQuestionSummary, parseAskQuestions, questionChoices } from "../../shared/ask-question.js";
+import { allowsTool, parseToolScope } from "../../shared/tool-scope.js";
 import { redactSecretsInText } from "../redact.js";
 import { toolDetailPreview } from "../tool-summary.js";
 import { ChatToolSessionError, mountChatTools } from "./chat-mcp-tools.js";
@@ -324,7 +325,7 @@ export function createOpenAIChatRuntime(options) {
             throw new Error(options.missingKeyError);
         if (active.has(turn.threadId))
             throw new Error("a turn is already running on this thread");
-        if (options.computerUse && (turn.images?.length || turn.integrations?.computer || turn.integrations?.localComputer || turn.integrations?.browser))
+        if (options.computerUse && (turn.images?.length || turn.integrations?.localComputer || turn.integrations?.browser))
             assertImageTransport(options.apiUrl);
         const turnId = newId();
         const abort = new AbortController();
@@ -333,7 +334,7 @@ export function createOpenAIChatRuntime(options) {
         for (const message of messages)
             retainImages(message.content);
         const model = turn.model || options.models().default;
-        const secrets = [options.apiKey, turn.integrations?.computer?.token, turn.integrations?.computer?.control?.token].filter((value) => Boolean(value));
+        const secrets = [options.apiKey].filter((value) => Boolean(value));
         for (const integration of Object.values(turn.integrations ?? {})) {
             const entries = object(integration);
             const specs = entries && "command" in entries ? [entries] : Object.values(entries ?? {}).map(object);
@@ -397,14 +398,19 @@ export function createOpenAIChatRuntime(options) {
             const seenCalls = new Set();
             let nudged = false;
             try {
-                tools = await mountChatTools(options.tools === false ? undefined : turn.integrations, abort.signal, options.computerUse);
-                let optionalQuestionOnly = options.tools !== false && tools.definitions.length === 0;
+                const parsed = parseToolScope(turn.toolScope);
+                if (!parsed.ok)
+                    throw new Error(parsed.error);
+                const scope = parsed.scope;
+                tools = await mountChatTools(options.tools === false ? undefined : turn.integrations, abort.signal, options.computerUse, scope);
+                const questionAllowed = options.tools !== false && allowsTool(scope, { kind: "native", name: ASK_USER_TOOL });
+                let optionalQuestionOnly = questionAllowed && tools.definitions.length === 0;
                 // The runtime's one built-in tool rides the same list: ask_user is
                 // how a chat-completions engine reaches a person. An MCP server that
                 // squats the name cannot shadow it — dispatch intercepts the name
                 // before validate — but the definition is then skipped so the list
                 // never advertises two.
-                if (options.tools !== false && !tools.definitions.some((definition) => definition.function.name === ASK_USER_TOOL)) {
+                if (questionAllowed && !tools.definitions.some((definition) => definition.function.name === ASK_USER_TOOL)) {
                     tools.definitions.push(ASK_USER_TOOL_DEFINITION);
                 }
                 for (let round = 0; round < 16; round++) {
@@ -549,6 +555,8 @@ export function createOpenAIChatRuntime(options) {
                                 throw new ChatProtocolError("tool arguments must be a JSON object");
                             const inputPreview = preview(args);
                             if (call.function.name === ASK_USER_TOOL) {
+                                if (!questionAllowed || !allowsTool(scope, { kind: "native", name: ASK_USER_TOOL }))
+                                    throw new Error("Tool selection excludes this tool");
                                 // A question is the person's card, not a permission, so it is
                                 // handled before the gate below: under Full access that gate
                                 // would auto-run an unanswered ask, and under Ask it would
@@ -687,10 +695,7 @@ export function createOpenAIChatRuntime(options) {
         adapter: {
             provider: options.driverKind,
             capabilities: { ...(options.computerUse ? { computerMcp: options.tools !== false,
-                    // Same gate as cloudComputerMcp: with tools off the runtime cannot
-                    // mount the leased Boat descriptor either. The fleet invariant test
-                    // pins usesCloudComputer === (remoteAgent || cloudComputerMcp).
-                    usesCloudComputer: options.tools !== false, cloudComputerMcp: options.tools !== false, localComputerMcp: options.tools !== false,
+                    localComputerMcp: options.tools !== false,
                     browserMcp: options.tools !== false, nativeImageInput: true, images: true } : {}),
                 sessionModelSwitch: "in-session", customMcp: options.tools !== false, agentsMcp: options.tools !== false, composioMcp: options.tools !== false,
                 // The runtime owns the whole tool loop, so it can always take a

package/dist-server/server/drivers/pi.js

@@ -34,6 +34,8 @@ import { newEventId, newId } from "../contracts.js";
 import { parseAskQuestions, parseChoices, questionAnswersByQuestion } from "../../shared/ask-question.js";
 import { decodeInjectId, encodeInjectId, hostApiKey, localHost, mergeLocalInject, } from "./local-inject.js";
 import { appendNative } from "./native.js";
+import { canUseMcpServer, parseToolScope } from "../../shared/tool-scope.js";
+import { gateServer, mcpStdioServer, resultBudget } from "../mcp-gate-config.js";
 const DRIVER_KIND = "piAgent";
 const PI_ARGS = ["--mode", "rpc", "--no-session"];
 const PI_MODEL_UPDATE_ARGS = ["update", "--models", "--no-approve"];
@@ -87,6 +89,9 @@ export function piThinkingLevel(effort) {
  * a JSON-RPC 2.0 stdio server the pi-mcp-extension consumes. Returns null when
  * there is nothing to mount (the common case). */
 export function buildMcpServers(turn) {
+    const parsed = parseToolScope(turn.toolScope);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
     const servers = {};
     if (turn.integrations?.composio)
         servers.composio = { ...turn.integrations.composio };
@@ -112,6 +117,22 @@ export function buildMcpServers(turn) {
             env: { ...NODE_ENV_FLAG, DWEB_URL: turn.integrations.dweb.url },
         };
     }
+    if (turn.integrations?.browser)
+        servers.browser = { ...turn.integrations.browser };
+    for (const [name, server] of Object.entries(turn.integrations?.custom ?? {}))
+        servers[name] = { ...server, scope: "custom" };
+    for (const [name, server] of Object.entries(servers)) {
+        if (parsed.scope !== undefined && !canUseMcpServer(parsed.scope, name)) {
+            delete servers[name];
+            continue;
+        }
+        const gated = gateServer({ name, server, toolScope: parsed.scope, threadId: turn.threadId, budget: name in (turn.integrations?.custom ?? {}) ? resultBudget() : 0, nodeEnv: NODE_ENV_FLAG });
+        const stdio = gated ?? mcpStdioServer(server, { nodeEnv: NODE_ENV_FLAG });
+        if (!stdio)
+            throw new Error("Pi MCP server configuration is invalid");
+        const original = server;
+        servers[name] = { ...stdio, ...(original.scope ? { scope: original.scope } : {}) };
+    }
     return Object.keys(servers).length ? servers : null;
 }
 /** Pure parser: turn a `get_available_models` stdout blob into a catalog.
@@ -428,6 +449,10 @@ export const PiDriver = {
         });
         const sendTurn = async (turn) => {
             const { threadId } = turn;
+            const selection = parseToolScope(turn.toolScope);
+            if (!selection.ok)
+                throw new Error(selection.error);
+            const toolScope = selection.scope;
             if (active.has(threadId))
                 throw new Error("a turn is already running on this thread");
             // Per-bot Ask/Auto is authoritative for harness turns. Preserve the
@@ -469,10 +494,13 @@ export const PiDriver = {
             // into a 0600 temp file removed when the turn settles — never on argv.
             const mcpServers = buildMcpServers(turn);
             let mcpTempDir = null;
-            if (mcpServers) {
+            let scopeReadyPath;
+            if (mcpServers || toolScope !== undefined) {
                 mcpTempDir = mkdtempSync(join(tmpdir(), "omb-pi-mcp-"));
+                if (toolScope !== undefined)
+                    scopeReadyPath = join(mcpTempDir, "scope-ready.json");
                 try {
-                    writeFileSync(join(mcpTempDir, "mcp.json"), JSON.stringify({ mcpServers }), { mode: 0o600 });
+                    writeFileSync(join(mcpTempDir, "mcp.json"), JSON.stringify({ mcpServers: mcpServers ?? {}, toolScope, scopeReadyPath, approvalMode: turn.approvalMode }), { mode: 0o600 });
                 }
                 catch (err) {
                     // A failed write must not leave the temp dir behind — a partial file
@@ -486,7 +514,7 @@ export const PiDriver = {
                     throw err;
                 }
             }
-            const childArgs = mcpServers ? [...PI_ARGS, "-e", SPAWNED_PROXIES.piMcpExtension] : PI_ARGS;
+            const childArgs = mcpTempDir ? [...PI_ARGS, "-e", SPAWNED_PROXIES.piMcpExtension] : PI_ARGS;
             // spawnCli can throw synchronously (unresolvable CLI); if it does, the
             // 0600 temp file with the boat token / composio key / comms token must
             // not be left on disk — settle() never runs because no child existed.
@@ -498,7 +526,7 @@ export const PiDriver = {
                         env: piEnvironment({
                             ...process.env,
                             ...input.environment,
-                            ...(mcpServers && mcpTempDir ? { OMB_MCP_CONFIG: join(mcpTempDir, "mcp.json") } : {}),
+                            ...(mcpTempDir ? { OMB_MCP_CONFIG: join(mcpTempDir, "mcp.json") } : {}),
                         }),
                     });
                 }
@@ -962,6 +990,20 @@ export const PiDriver = {
                     /* keep going on the engine default */
                 }
             }
+            if (scopeReadyPath) {
+                let ready = false;
+                try {
+                    const receipt = JSON.parse(readFileSync(scopeReadyPath, "utf8"));
+                    ready = receipt.ok === true && JSON.stringify(receipt.toolScope) === JSON.stringify(toolScope);
+                }
+                catch { /* Missing or malformed readiness is never a grant. */ }
+                if (!ready) {
+                    const message = "Pi tool selection enforcement is unavailable. Update Pi and check the OpenMausBot extension before retrying.";
+                    emit({ ...base(threadId, turnId), type: "runtime.error", message });
+                    settle(false);
+                    throw new Error(message);
+                }
+            }
             // The stable/volatile split: the full prompt rides only the turn that
             // establishes - or re-instructs, after a soul edit - this pi session,
             // which previously re-sent the whole system prompt on every turn and
@@ -1086,6 +1128,8 @@ export const PiDriver = {
                     computerMcp: true,
                     composioMcp: true,
                     phoneMcp: true,
+                    customMcp: true,
+                    browserMcp: true,
                     // Host control (the user's real Mac) rides the pi-native permission
                     // card (`ctx.ui.confirm` → extension_ui_request) gated in the
                     // extension, so it is offered exactly when the other engines offer

package/dist-server/server/drivers/retry.js

@@ -17,6 +17,10 @@ const TERMINAL_PATTERNS = [
         pattern: /\b(?:40[13]|unauthorized|forbidden|invalid api key|missing bearer|authentication required|not logged in|logged out)\b/i,
         reason: "auth",
     },
+    // A subscription's usage window is hours away, so its limit is terminal
+    // for this engine even when the provider phrases it as a rate limit;
+    // checked before the transient 429 pattern for that reason.
+    { pattern: /\busage limit\b|\bhit your (?:usage )?limit\b|\b(?:weekly|daily|monthly|subscription|usage) limit reached\b|\bout of credits\b/i, reason: "quota" },
     { pattern: /\b402\b|\bquota\b|\bbilling\b|\bsubscription\b/i, reason: "quota" },
     { pattern: /\bmodel not found\b|\bunknown model\b|\bdoes not exist for model\b|\bunsupported model\b/i, reason: "unknown_model" },
     { pattern: /\b400\b|\b422\b|\binvalid request\b|\bmalformed\b|\bunexpected status\b/i, reason: "invalid_request" },
@@ -50,14 +54,14 @@ export function classifyError(err) {
         const { exitCode: code } = err;
         if (code !== null && code < 0)
             return { transient: false, reason: "interrupted" };
-        for (const { pattern, reason } of TRANSIENT_PATTERNS) {
-            if (pattern.test(text))
-                return { transient: true, reason };
-        }
         for (const { pattern, reason } of TERMINAL_PATTERNS) {
             if (pattern.test(text))
                 return { transient: false, reason };
         }
+        for (const { pattern, reason } of TRANSIENT_PATTERNS) {
+            if (pattern.test(text))
+                return { transient: true, reason };
+        }
         return { transient: false, reason: "terminal_exit" };
     }
     for (const { pattern, reason } of TERMINAL_PATTERNS) {

package/dist-server/server/engine-install.js

@@ -4,7 +4,7 @@
 // driver's own install descriptor and never from a request, npm runs with
 // a fixed argument list, and the binary is found on the engines' PATH
 // afterwards because that directory is registered ahead of everything else.
-import { existsSync, mkdirSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "./config.js";
@@ -169,7 +169,3 @@ function runNpm(args, env, cwd, timeoutMs) {
         });
     });
 }
-/** True once something has been installed here, for status pages. */
-export function enginesInstalled(baseDir = DATA_DIR) {
-    return existsSync(enginesBinDir(baseDir));
-}

package/dist-server/server/environment.js

@@ -102,6 +102,9 @@ export function environmentDescriptor(input) {
             // Never advertise a protocol this server would refuse: the routes are
             // gone unless features.sharedComputers is on, so the capability is too.
             ...(input.sharedComputers === true ? { sharedComputers: true } : {}),
+            // An OMB Cloud home: its pairing page says "Opening your Cloud…" and
+            // where to connect from, not "the code shown on the server".
+            ...(input.cloudHome === true ? { cloudHome: true } : {}),
             selfUpdate: input.desktopManaged ? "desktop-managed" : "operator",
             emailSignIn: input.emailSignIn === true,
         },

package/dist-server/server/guarded-requests.js

@@ -1,3 +1,4 @@
+import { isPersistentQuestionCard } from "../shared/ask-question.js";
 export function requestConflict(message = "The request no longer owns this conversation") {
     return Object.assign(new Error(message), { status: 409, code: "guarded_request_changed" });
 }
@@ -54,7 +55,7 @@ export function requestSourceForCard(messages, messageId) {
     return undefined;
 }
 export function requestNeedsInput(message) {
-    return Boolean((message.card?.requestId && !message.card.answered && !message.card.dismissed && !message.card.expired) ||
+    return Boolean((message.card?.requestId && !message.card.answered && !message.card.dismissed && !message.card.expired && !isPersistentQuestionCard(message.card)) ||
         (message.connector && !message.connector.dismissed && !message.connector.resumed && message.connector.status !== "connected") ||
         (message.secret && !message.secret.provided && !message.secret.dismissed && !message.secret.superseded));
 }

package/dist-server/server/harness/registry.js

@@ -228,7 +228,6 @@ export class ProviderRegistry {
                     modelVariants: inst.adapter.capabilities.modelVariants === true,
                     queueing: inst.adapter.capabilities.queueing === true,
                     localComputerMcp: inst.adapter.capabilities.localComputerMcp === true,
-                    cloudComputerMcp: inst.adapter.capabilities.cloudComputerMcp === true,
                     approvalReview: inst.reviewPermission !== undefined,
                 },
                 access: driver?.metadata.access ?? "subscription",

package/dist-server/server/{browser-proxy.js → harness-mcp-proxy.js}

@@ -1,17 +1,29 @@
-// Per-turn MCP entry point. Only a scoped browser capability crosses into the
-// agent process; engine commands, session names, and credentials stay in OMB.
+// Per-turn MCP entry point for the tools the harness serves itself: the
+// built-in browser and the cloud computer. argv[2] names which one. Only a
+// turn-scoped capability crosses into the agent process; engine commands,
+// session names, and provider credentials (the Boat token) stay in OMB.
 import { pathToFileURL } from "node:url";
 const MAX_INPUT_BYTES = 1_048_576;
 const MAX_OUTPUT_BYTES = 16_777_216;
 const MAX_PENDING = 16;
+const NAMES = { browser: "Browser", computer: "Cloud computer" };
+/** What a model needs after a failed call, per tool family: the failure is
+ * about this one connection, and an uncertain action must be checked first. */
+const RECOVERY = {
+    browser: " This failure does not establish that all browsers are unavailable. Inspect available connections with select_computer if that tool is present. Keep the requested computer and account; do not bypass a permission refusal or human takeover, and do not repeat an uncertain action without checking its result.",
+    computer: " Keep working on the assigned cloud computer only; do not bypass a person's control of it, and take a fresh screenshot before repeating an action whose result is uncertain.",
+};
+export function parseHarnessMcpKind(value) {
+    return value === "browser" || value === "computer" ? value : null;
+}
 function failure(id, method, message, code = -32603) {
     return method === "tools/call"
         ? { jsonrpc: "2.0", id, result: { content: [{ type: "text", text: message }], isError: true } }
         : { jsonrpc: "2.0", id, error: { code, message } };
 }
-async function boundedJson(response) {
+async function boundedJson(response, name) {
     if (!response.body)
-        throw new Error("Browser server returned an empty response.");
+        throw new Error(`${name} server returned an empty response.`);
     const reader = response.body.getReader();
     const chunks = [];
     let size = 0;
@@ -22,7 +34,7 @@ async function boundedJson(response) {
                 break;
             size += value.byteLength;
             if (size > MAX_OUTPUT_BYTES)
-                throw new Error("Browser response exceeded the size limit.");
+                throw new Error(`${name} response exceeded the size limit.`);
             chunks.push(Buffer.from(value));
         }
         return JSON.parse(Buffer.concat(chunks).toString("utf8"));
@@ -31,7 +43,7 @@ async function boundedJson(response) {
         await reader.cancel().catch(() => { });
     }
 }
-export async function browserProxyRequest(frame, connection) {
+export async function harnessMcpRequest(frame, connection) {
     if (!frame || typeof frame !== "object" || Array.isArray(frame))
         return failure(null, null, "Invalid request.", -32600);
     const message = frame;
@@ -40,10 +52,11 @@ export async function browserProxyRequest(frame, connection) {
         return failure(null, null, "Invalid request.", -32600);
     if (!Object.hasOwn(message, "id"))
         return undefined;
+    const name = NAMES[connection.kind];
     if (message.method === "initialize")
         return {
             jsonrpc: "2.0", id,
-            result: { protocolVersion: "2024-11-05", capabilities: { tools: {} }, serverInfo: { name: "openmausbot-browser", version: "1" } },
+            result: { protocolVersion: "2024-11-05", capabilities: { tools: {} }, serverInfo: { name: `openmausbot-${connection.kind}`, version: "1" } },
         };
     if (message.method === "ping")
         return { jsonrpc: "2.0", id, result: {} };
@@ -52,30 +65,30 @@ export async function browserProxyRequest(frame, connection) {
     try {
         const url = new URL(connection.url);
         if (!connection.token || url.protocol !== "http:" || !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
-            throw new Error("Browser connection is not configured. Start a new bot turn from OpenMausBot.");
+            throw new Error(`${name} connection is not configured. Start a new bot turn from OpenMausBot.`);
         }
         const body = JSON.stringify({ method: message.method, params: message.params ?? {} });
         if (Buffer.byteLength(body) > MAX_INPUT_BYTES)
-            throw new Error("Browser request exceeded the size limit.");
-        const response = await fetch(new URL("/api/internal/browser/mcp", url), {
+            throw new Error(`${name} request exceeded the size limit.`);
+        const response = await fetch(new URL(`/api/internal/${connection.kind}/mcp`, url), {
             method: "POST", redirect: "error",
             headers: { "content-type": "application/json", authorization: `Bearer ${connection.token}` },
             body, signal: AbortSignal.timeout(130_000),
         });
-        const payload = await boundedJson(response);
+        const payload = await boundedJson(response, name);
         if (!response.ok || !payload || typeof payload !== "object" || !Object.hasOwn(payload, "result")) {
-            throw new Error(typeof payload?.error === "string" ? payload.error.slice(0, 2_000) : "Browser server is unavailable. Start a new bot turn or try again.");
+            throw new Error(typeof payload?.error === "string" ? payload.error.slice(0, 2_000) : `${name} server is unavailable. Start a new bot turn or try again.`);
         }
         return { jsonrpc: "2.0", id, result: payload.result };
     }
     catch (error) {
         const detail = error instanceof Error && !/fetch failed|abort|timeout/i.test(error.message)
-            ? error.message : "Browser connection was interrupted. Do not repeat the action until its state is checked.";
-        return failure(id, message.method, detail + " This failure does not establish that all browsers are unavailable. Inspect available connections with select_computer if that tool is present. Keep the requested computer and account; do not bypass a permission refusal or human takeover, and do not repeat an uncertain action without checking its result.");
+            ? error.message : `${name} connection was interrupted. Do not repeat the action until its state is checked.`;
+        return failure(id, message.method, detail + RECOVERY[connection.kind]);
     }
 }
-function run() {
-    const connection = { url: process.env.OMB_HARNESS_URL ?? "", token: process.env.OMB_BROWSER_TOKEN ?? "" };
+function run(kind) {
+    const connection = { url: process.env.OMB_HARNESS_URL ?? "", token: process.env.OMB_MCP_TOKEN ?? "", kind };
     let input = Buffer.alloc(0);
     let pending = 0;
     const output = (message) => {
@@ -114,11 +127,11 @@ function run() {
             if (pending >= MAX_PENDING) {
                 const request = frame;
                 if (request && Object.hasOwn(request, "id"))
-                    output(failure(request.id ?? null, request.method, "Too many pending browser requests."));
+                    output(failure(request.id ?? null, request.method, `Too many pending ${kind} requests.`));
                 continue;
             }
             pending++;
-            void browserProxyRequest(frame, connection).then(output).finally(() => { pending--; });
+            void harnessMcpRequest(frame, connection).then(output).finally(() => { pending--; });
         }
         if (input.length > MAX_INPUT_BYTES) {
             process.stdin.destroy();
@@ -126,5 +139,12 @@ function run() {
         }
     });
 }
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
-    run();
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    const kind = parseHarnessMcpKind(process.argv[2]);
+    if (!kind) {
+        process.stderr.write("usage: harness-mcp-proxy browser|computer\n");
+        process.exitCode = 2;
+    }
+    else
+        run(kind);
+}