openmausbot 0.1.93 → 0.1.95

package/dist-server/server/mcp-http.js

@@ -17,6 +17,24 @@ const PROTOCOL_VERSION = "2025-06-18";
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+/** Validate private proxy configuration without including secrets in errors. */
+export function remoteMcpSpec(value) {
+    if (!isRecord(value) || (value.type !== "http" && value.type !== "sse") || typeof value.url !== "string")
+        return;
+    try {
+        const url = new URL(value.url);
+        if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username || url.password)
+            return;
+        const headers = value.headers ?? {};
+        if (!isRecord(headers) || !Object.values(headers).every((header) => typeof header === "string"))
+            return;
+        new Headers(headers);
+        return { type: value.type, url: value.url, headers: headers };
+    }
+    catch {
+        return;
+    }
+}
 function unwrap(message) {
     if (message.error !== undefined) {
         const detail = isRecord(message.error) && typeof message.error.message === "string" ? message.error.message : "request failed";
@@ -55,7 +73,7 @@ function parseSseBlock(block) {
 }
 /** Read an event stream until the handler says stop, the server ends it,
  * or the signal fires. Bounded, so a chatty server cannot fill memory. */
-async function readSse(response, signal, onEvent) {
+async function readSse(response, signal, onEvent, maxBytes = MAX_BODY_BYTES) {
     const reader = response.body?.getReader();
     if (!reader)
         throw new McpHttpError("protocol", "empty event stream");
@@ -70,7 +88,7 @@ async function readSse(response, signal, onEvent) {
             if (done)
                 return;
             bytes += value.byteLength;
-            if (bytes > MAX_BODY_BYTES)
+            if (bytes > maxBytes)
                 throw new McpHttpError("protocol", "event stream too large");
             buffer += decoder.decode(value, { stream: true }).replace(/\r\n?/g, "\n");
             let separator;
@@ -89,7 +107,7 @@ async function readSse(response, signal, onEvent) {
         signal.removeEventListener("abort", onAbort);
     }
 }
-async function readBounded(response) {
+async function readBounded(response, maxBytes = MAX_BODY_BYTES) {
     const reader = response.body?.getReader();
     if (!reader)
         return "";
@@ -101,7 +119,7 @@ async function readBounded(response) {
         if (done)
             return text + decoder.decode();
         bytes += value.byteLength;
-        if (bytes > MAX_BODY_BYTES) {
+        if (bytes > maxBytes) {
             await reader.cancel().catch(() => { });
             throw new McpHttpError("protocol", "response too large");
         }
@@ -114,6 +132,8 @@ function drain(response) {
 export class RemoteMcpClient {
     target;
     fetchImpl;
+    maxBytes;
+    onNotification;
     sessionId = null;
     protocolVersion = null;
     nextId = 1;
@@ -125,6 +145,8 @@ export class RemoteMcpClient {
     constructor(target, options = {}) {
         this.target = target;
         this.fetchImpl = options.fetch ?? fetch;
+        this.maxBytes = options.maxBytes ?? MAX_BODY_BYTES;
+        this.onNotification = options.onNotification;
     }
     /** The MCP handshake: initialize, then the initialized notification. */
     async initialize(clientName, signal) {
@@ -141,9 +163,16 @@ export class RemoteMcpClient {
     request(method, params, signal) {
         if (this.closed)
             return Promise.reject(new McpHttpError("protocol", "client closed"));
+        if (signal.aborted)
+            return Promise.reject(new McpHttpError("network", "aborted"));
         const id = this.nextId++;
         const frame = { jsonrpc: "2.0", id, method, ...(params === undefined ? {} : { params }) };
-        return this.target.type === "sse" ? this.sseRequest(id, frame, signal) : this.streamableRequest(id, frame, signal);
+        const onAbort = () => {
+            void this.notify("notifications/cancelled", { requestId: id, reason: "Request cancelled" }, AbortSignal.timeout(2_000)).catch(() => { });
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        const reply = this.target.type === "sse" ? this.sseRequest(id, frame, signal) : this.streamableRequest(id, frame, signal);
+        return reply.finally(() => signal.removeEventListener("abort", onAbort));
     }
     async notify(method, params, signal) {
         if (this.closed)
@@ -216,7 +245,8 @@ export class RemoteMcpClient {
         const response = await this.post(this.target.url, frame, signal);
         const type = (response.headers.get("content-type") ?? "").toLowerCase();
         if (type.startsWith("application/json")) {
-            const parsed = parseMessage(await readBounded(response));
+            const parsed = parseMessage(await readBounded(response, this.maxBytes));
+            this.deliverNotifications(parsed);
             const message = (Array.isArray(parsed) ? parsed : parsed ? [parsed] : []).find((entry) => entry.id === id);
             if (!message)
                 throw new McpHttpError("protocol", "response did not answer the request");
@@ -228,12 +258,13 @@ export class RemoteMcpClient {
                 if (event.event !== "message")
                     return undefined;
                 const parsed = parseMessage(event.data);
+                this.deliverNotifications(parsed);
                 const message = (Array.isArray(parsed) ? parsed : parsed ? [parsed] : []).find((entry) => entry.id === id);
                 if (!message)
                     return undefined;
                 found = message;
                 return "stop";
-            });
+            }, this.maxBytes);
             if (signal.aborted)
                 throw new McpHttpError("network", "aborted");
             if (!found)
@@ -286,6 +317,7 @@ export class RemoteMcpClient {
                     if (event.event !== "message")
                         return undefined;
                     const parsed = parseMessage(event.data);
+                    this.deliverNotifications(parsed);
                     for (const message of Array.isArray(parsed) ? parsed : parsed ? [parsed] : []) {
                         const entry = typeof message.id === "number" ? this.pending.get(message.id) : undefined;
                         if (!entry)
@@ -299,7 +331,7 @@ export class RemoteMcpClient {
                         }
                     }
                     return undefined;
-                });
+                }, this.maxBytes);
                 fail(new McpHttpError("network", "event stream ended"));
             })
                 .catch((error) => {
@@ -337,4 +369,10 @@ export class RemoteMcpClient {
             });
         });
     }
+    deliverNotifications(parsed) {
+        for (const message of Array.isArray(parsed) ? parsed : parsed ? [parsed] : []) {
+            if (typeof message.method === "string" && message.id === undefined)
+                this.onNotification?.(message);
+        }
+    }
 }

package/dist-server/server/mcp-remote-proxy.js

@@ -0,0 +1,108 @@
+// A stdio facade for selected HTTP/SSE MCP servers. Configuration stays in
+// private environment data; stdout contains only protocol frames.
+import { createInterface } from "node:readline";
+import { RemoteMcpClient, remoteMcpSpec } from "./mcp-http.js";
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function requestKey(id) {
+    return typeof id === "string" || (typeof id === "number" && Number.isFinite(id)) ? `${typeof id}:${id}` : undefined;
+}
+function send(frame) { process.stdout.write(`${JSON.stringify(frame)}\n`); }
+function error(id, code, message) {
+    send({ jsonrpc: "2.0", id: requestKey(id) ? id : null, error: { code, message } });
+}
+let spec;
+try {
+    spec = remoteMcpSpec(JSON.parse(process.env.OMB_REMOTE_MCP_SERVER ?? ""));
+}
+catch { /* invalid private config */ }
+delete process.env.OMB_REMOTE_MCP_SERVER;
+if (!spec) {
+    process.stderr.write("mcp-remote-proxy: invalid remote MCP configuration\n");
+    process.exit(1);
+}
+const client = new RemoteMcpClient(spec, { maxBytes: 32 * 1024 * 1024, onNotification: send });
+const pending = new Map();
+const tasks = new Set();
+let initialized = false;
+let closing = false;
+async function handle(message) {
+    const id = requestKey(message.id);
+    if (typeof message.method !== "string" || message.jsonrpc !== "2.0") {
+        error(message.id, -32600, "Invalid JSON-RPC request");
+        return;
+    }
+    if (message.method === "notifications/cancelled") {
+        const key = isRecord(message.params) ? requestKey(message.params.requestId) : undefined;
+        if (key)
+            pending.get(key)?.abort();
+        return;
+    }
+    if (!id) {
+        // initialize() has already sent this once with its negotiated version.
+        if (message.method === "notifications/initialized" && initialized)
+            return;
+        try {
+            await client.notify(message.method, message.params, AbortSignal.timeout(30_000));
+        }
+        catch { /* notifications have no reply and must not print remote details */ }
+        return;
+    }
+    if (pending.has(id)) {
+        error(message.id, -32600, "Duplicate request ID");
+        return;
+    }
+    const controller = new AbortController();
+    pending.set(id, controller);
+    const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(message.method === "tools/call" ? 120_000 : 30_000)]);
+    try {
+        const result = message.method === "initialize"
+            ? await client.initialize("OpenMausBot tool proxy", signal)
+            : await client.request(message.method, message.params, signal);
+        if (message.method === "initialize")
+            initialized = true;
+        send({ jsonrpc: "2.0", id: message.id, result });
+    }
+    catch {
+        // Remote errors may contain URLs or header values. Do not relay their text.
+        error(message.id, signal.aborted ? -32800 : -32603, signal.aborted ? "MCP request cancelled" : "Remote MCP request failed");
+    }
+    finally {
+        pending.delete(id);
+    }
+}
+const input = createInterface({ input: process.stdin });
+input.on("line", (line) => {
+    if (closing || !line.trim())
+        return;
+    let value;
+    try {
+        value = JSON.parse(line);
+    }
+    catch {
+        error(null, -32700, "Invalid JSON-RPC frame");
+        return;
+    }
+    if (!isRecord(value)) {
+        error(null, -32600, "Invalid JSON-RPC frame");
+        return;
+    }
+    const task = handle(value);
+    tasks.add(task);
+    void task.finally(() => tasks.delete(task));
+});
+async function shutdown() {
+    if (closing)
+        return;
+    closing = true;
+    input.close();
+    for (const controller of pending.values())
+        controller.abort();
+    await Promise.allSettled(tasks);
+    await client.close();
+    process.exit(0);
+}
+input.on("close", () => { void shutdown(); });
+process.on("SIGTERM", () => { void shutdown(); });
+process.on("SIGINT", () => { void shutdown(); });

package/dist-server/server/memory-entries.js

@@ -2,12 +2,21 @@
 // `- YYYY-MM-DD · from <source> · text[ · until YYYY-MM-DD]`, with a
 // struck-through body for a superseded fact. Pure helpers shared by the
 // prompt loader (which hides expired lines), background capture (which
-// must not add a fact the notebook already holds) and the nightly tidy-up.
+// must not add a fact the notebook already holds), the nightly tidy-up and
+// the rule that keeps MEMORY.md within what loads (server/workspace.ts).
 export const UNTIL_DATE = /^\d{4}-\d{2}-\d{2}$/;
 const DATED = /^(- (\d{4}-\d{2}-\d{2}) · (?:from [^·\n]* · )?)(.*)$/;
 const UNTIL_MARK = / · until (\d{4}-\d{2}-\d{2})(?= · |$)/;
-const TRAILING_MARKS = /(?: · (?:updated|confirmed|until|expired|superseded) \d{4}-\d{2}-\d{2})+$/;
+const TRAILING_MARKS = /(?: · (?:updated|confirmed|until|expired|superseded|moved) \d{4}-\d{2}-\d{2})+$/;
 const BULLET = /^\s*(?:[-*•]|\d+[.)])\s+/;
+/** A safety or health fact must load into every turn: neither the organize
+ * step nor the size rule moves one out of MEMORY.md, whatever else happens.
+ * Seen live — a model moved "is vegetarian" into a food topic despite being
+ * told diet is core. */
+const ALWAYS_CORE = /\b(?:allerg\w*|anaphyla\w*|intoleran\w*|vegetarian|vegan|halal|kosher|gluten|lactose|diet\w*|diabet\w*|asthma\w*|epilep\w*|pregnan\w*|medicat\w*|medicine|medical|disabilit\w*|wheelchair|blind|deaf|health)\b/i;
+export function alwaysCore(body) {
+    return ALWAYS_CORE.test(body);
+}
 /** Whether `value` is a real calendar date in YYYY-MM-DD form. */
 export function isMemoryDate(value) {
     if (typeof value !== "string" || !UNTIL_DATE.test(value))
@@ -18,20 +27,41 @@ export function isMemoryDate(value) {
 export function untilMark(until) {
     return until ? ` · until ${until}` : "";
 }
+/** A line with an odd number of fences opens or closes a code block. */
+const togglesFence = (line) => (line.match(/```/g)?.length ?? 0) % 2 === 1;
 /** Every dated entry in a MEMORY.md text, in file order. Hand-written lines
- * without a date are not entries and are never touched by upkeep. */
+ * without a date are not entries and are never touched by upkeep. An entry
+ * also owns the lines under it, up to the next dated line: indented ones
+ * (Markdown's list rule; how an entry with a code block is written) and a
+ * code block it opens, through its closing fence (how such entries were
+ * written before). A fence that never closes claims nothing. */
 export function parseMemoryEntries(text) {
     const out = [];
-    text.split("\n").forEach((raw, line) => {
+    const lines = text.split("\n");
+    for (let line = 0; line < lines.length;) {
+        const raw = lines[line];
         const m = DATED.exec(raw);
-        if (!m)
-            return;
+        if (!m) {
+            line += 1;
+            continue;
+        }
+        let open = togglesFence(raw);
+        let end = line + 1;
+        for (let next = line + 1; next < lines.length && !DATED.test(lines[next]); next += 1) {
+            if (!open && !/^[ \t]/.test(lines[next]) && !lines[next].startsWith("```"))
+                break;
+            if (togglesFence(lines[next]))
+                open = !open;
+            if (!open)
+                end = next + 1;
+        }
         const rest = m[3];
         const struck = rest.startsWith("~~");
         const until = UNTIL_MARK.exec(rest)?.[1] ?? null;
         const body = rest.replace(TRAILING_MARKS, "").replace(/^~~/, "").replace(/~~$/, "").trim();
-        out.push({ line, raw, prefix: m[1], body, date: m[2], until, struck });
-    });
+        out.push({ line, end, raw, prefix: m[1], body, date: m[2], until, struck });
+        line = end;
+    }
     return out;
 }
 /** A live entry whose `until` day has passed. The until day itself still counts. */

package/dist-server/server/memory-organize.js

@@ -8,19 +8,12 @@
 // aliases recall matches. An entry judged core is remembered and not asked
 // about again. Pure here: the caller reads, calls the model, writes and
 // journals.
-import { factIdentity, isExpired, parseMemoryEntries } from "./memory-entries.js";
+import { alwaysCore, factIdentity, isExpired, parseMemoryEntries } from "./memory-entries.js";
 import { topicFileName } from "./memory-capture.js";
 export const ORGANIZE_MARKER = "You are the ORGANIZE step of a memory system";
 /** One pass moves at most this many entries. */
 export const MAX_MOVES = 20;
 const PROMPT_ENTRIES = 60;
-/** Lines the model may not move, whatever it answers: a safety or health
- * fact must load into every turn. Seen live — a model moved "is vegetarian"
- * into a food topic despite being told diet is core. */
-const ALWAYS_CORE = /\b(?:allerg\w*|anaphyla\w*|intoleran\w*|vegetarian|vegan|halal|kosher|gluten|lactose|diet\w*|diabet\w*|asthma\w*|epilep\w*|pregnan\w*|medicat\w*|medicine|medical|disabilit\w*|wheelchair|blind|deaf|health)\b/i;
-export function alwaysCore(body) {
-    return ALWAYS_CORE.test(body);
-}
 /** Live, unexpired entries not already judged core: what the call is asked about. */
 export function organizeCandidates(text, today, core) {
     return parseMemoryEntries(text)

package/dist-server/server/memory-topics.js

@@ -90,8 +90,8 @@ export function readTopicHead(path) {
             closeSync(fd);
     }
 }
-/** One line per topic, capped by count and length. The archive the tidy-up
- * keeps is listed last and labelled, so it is not mistaken for current notes. */
+/** One line per topic, capped by count and length. The archive is listed
+ * last and labelled, so it is not mistaken for current notes. */
 export function renderTopicIndex(topics) {
     if (!topics.length)
         return "";
@@ -104,8 +104,8 @@ export function renderTopicIndex(topics) {
             omitted += 1;
             continue;
         }
-        const about = name === "archive.md" && !header.title && !header.description
-            ? "expired and replaced notes, kept for the record"
+        const about = name === "archive.md"
+            ? "older notes moved out of MEMORY.md, kept for the record"
             : [header.title, header.description].filter(Boolean).join(" — ");
         const also = header.aliases.length ? ` (also: ${header.aliases.join(", ")})` : "";
         const line = `- memory/${name}${about ? ` — ${about}` : ""}${also}`.replace(/\s+/g, " ");

package/dist-server/server/memory-upkeep.js

@@ -25,13 +25,13 @@ import { mergeTopicText } from "./memory-topics.js";
 import { applyMoves, MAX_MOVES, organizeCandidates, organizePrompt, parseMoves } from "./memory-organize.js";
 import { recordMemoryChange } from "./memory-journal.js";
 import { applyTidy, contradictionCandidates, contradictionPrompt, parseContradictions, planChanges, planTidy } from "./memory-tidy.js";
-import { ensureWorkspace, listMemoryTopics, memoryDate, memoryEntry, memoryTopicIndex, readMemoryText, updateMemory, workspaceDir, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
+import { appendMemoryArchive, ARCHIVE_TOPIC, ensureWorkspace, listMemoryTopics, memoryDate, memoryEntry, memoryTopicIndex, readMemoryText, updateMemory, workspaceDir, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
 export const CAPTURE_MAX_TURNS = 6;
 export const MODEL_TIMEOUT_MS = 60_000;
 export const TIDY_CHECK_MS = 10 * 60_000;
 /** Below this many live entries there is nothing a contradiction pass may change. */
 export const MIN_ENTRIES_FOR_CONTRADICTIONS = 5;
-export const ARCHIVE_TOPIC = "archive.md";
+const ARCHIVE_PATH = `memory/${ARCHIVE_TOPIC}`;
 /** A topic file past this size gains nothing more from capture. */
 export const TOPIC_MAX_BYTES = 64 * 1024;
 /** On unless switched off: every bot keeps its memory in shape by default. */
@@ -139,25 +139,25 @@ export function createMemoryUpkeep(deps) {
         // From here to the journal rows there is no await, so no write interleaves.
         if (!upkeepEnabled(deps.bot(bot.id)))
             return off;
-        const { parsed, added, topics, full } = writing(bot.id, () => {
+        const { parsed, added, topics } = writing(bot.id, () => {
             const before = readRaw(bot.id, "MEMORY.md");
+            const archiveBefore = readRaw(bot.id, ARCHIVE_PATH);
             const parsed = parseCandidates(answer, today);
             const fresh = newCandidates(parsed, before ?? "");
             const source = `${deps.sourceLabel(bot.id, batch.threadId)} (noticed)`;
             let added = 0;
-            let full = false;
             const byTopic = new Map();
             for (const candidate of fresh) {
                 if (candidate.topic) {
                     byTopic.set(candidate.topic, [...(byTopic.get(candidate.topic) ?? []), candidate]);
                     continue;
                 }
-                const result = updateMemory(bot.id, { action: "append", text: candidate.text, ...(candidate.until ? { until: candidate.until } : {}) }, { source, now: now() });
-                if (result.ok)
+                if (updateMemory(bot.id, { action: "append", text: candidate.text, ...(candidate.until ? { until: candidate.until } : {}) }, { source, now: now() }).ok)
                     added += 1;
-                else if (result.code === "over-budget")
-                    full = true;
             }
+            // Older entries the appends moved out are journaled first, as the
+            // tidy-up does, so undoing the newest row (MEMORY.md) brings them back.
+            recordMemoryChange(bot.id, { path: ARCHIVE_PATH, actor: "upkeep", via: "capture", threadId: batch.threadId, before: archiveBefore, after: readRaw(bot.id, ARCHIVE_PATH) });
             if (added)
                 recordMemoryChange(bot.id, { path: "MEMORY.md", actor: "upkeep", via: "capture", threadId: batch.threadId, before, after: readRaw(bot.id, "MEMORY.md") });
             // Detail goes to a topic file the bot keeps for that subject, created
@@ -188,7 +188,7 @@ export function createMemoryUpkeep(deps) {
                 existing.set(name.toLowerCase(), name);
                 topics += lines.length;
             }
-            return { parsed, added, topics, full };
+            return { parsed, added, topics };
         });
         // Only the owner's own words reach About me: on a shared workspace
         // another person's facts are not the owner's profile. Every parsed fact
@@ -199,7 +199,7 @@ export function createMemoryUpkeep(deps) {
         // whoever wrote MEMORY.md — the bot, the person or this capture — detail
         // that is not core moves to its topic now, not only at night
         const organized = await organize(bot.id);
-        const report = { at, added, topics, aboutMe, organized, ...(full ? { note: "MEMORY.md is full; the tidy-up or a person needs to make room." } : {}) };
+        const report = { at, added, topics, aboutMe, organized };
         record(bot.id, { lastCapture: report });
         if (added || topics || aboutMe)
             log(`memory upkeep: noticed ${added} fact(s) for MEMORY.md, ${topics} for topic files and ${aboutMe} for About me — ${bot.name} (${bot.id}) from ${batch.threadId}`);
@@ -284,11 +284,9 @@ export function createMemoryUpkeep(deps) {
         });
     }
     function appendArchive(botId, archived) {
-        const archivePath = `memory/${ARCHIVE_TOPIC}`;
-        const archiveBefore = readRaw(botId, archivePath);
-        const head = archiveBefore ?? "---\ntitle: Archive\ndescription: expired notes moved out by the tidy-up\n---\n";
-        writeMemoryTopic(botId, ARCHIVE_TOPIC, `${head}${head.endsWith("\n") ? "" : "\n"}${archived.join("\n")}\n`);
-        recordMemoryChange(botId, { path: archivePath, actor: "upkeep", via: "tidy", before: archiveBefore, after: readRaw(botId, archivePath) });
+        const archiveBefore = readRaw(botId, ARCHIVE_PATH);
+        appendMemoryArchive(botId, archived);
+        recordMemoryChange(botId, { path: ARCHIVE_PATH, actor: "upkeep", via: "tidy", before: archiveBefore, after: readRaw(botId, ARCHIVE_PATH) });
     }
     async function runTidy(botId) {
         const bot = deps.bot(botId);

package/dist-server/server/message-file.js

@@ -259,16 +259,12 @@ function safeDisplayName(value) {
     return boundedDisplayName(clean || "download");
 }
 /**
- * Confirm that a stored user message carries the requested attachment as an
- * exact standalone transport tag. Plain prose, inline examples, fenced code,
- * and near-matching paths do not grant access. The HTTP route pairs this
- * message capability with ATTACHMENTS_DIR containment, so this can never
- * become an arbitrary host-file reader.
+ * The user-facing name of the requested attachment when a stored user
+ * message carries it as an exact standalone transport tag, else null. Plain
+ * prose, inline examples, fenced code, and near-matching paths do not grant
+ * access. The HTTP route pairs this message capability with ATTACHMENTS_DIR
+ * containment, so this can never become an arbitrary host-file reader.
  */
-export function messageReferencesAttachment(text, requested) {
-    return messageAttachmentName(text, requested) !== null;
-}
-/** Return the user-facing name carried by an authorised attachment tag. */
 export function messageAttachmentName(text, requested) {
     let wanted;
     try {

package/dist-server/server/new-bot-defaults.js

@@ -3,6 +3,7 @@ import { profilePatchSchema, fitsOnOneLine } from "./bot-profile.js";
 import { EFFORT_LEVELS } from "../shared/wire.js";
 import { isModelVariant } from "./contracts.js";
 import { normalizeCronSchedule } from "../shared/routine-schedule.js";
+import { parseToolScope } from "../shared/tool-scope.js";
 const strings = (max, length) => z.array(z.string().max(length)).max(max);
 const clock = z.string().regex(/^(?:[01]\d|2[0-3]):[0-5]\d$/);
 const weekdays = z.array(z.number().int().min(0).max(6)).min(1).max(7);
@@ -35,6 +36,8 @@ export const botDefaultsProfileSchema = profilePatchSchema.extend({
     browser: z.boolean().optional(),
     browserProfile: z.string().max(100).nullable().optional(),
     mcpServers: strings(100, 100).nullable().optional(),
+    toolScope: z.custom((value) => value !== undefined && parseToolScope(value).ok, "Invalid tool selection")
+        .transform((value) => { const parsed = parseToolScope(value); return parsed.ok ? parsed.scope : value; }).nullable().optional(),
     parkDirectMessages: z.boolean().optional(),
 }).strict();
 const scheduleSchema = z.discriminatedUnion("type", [

package/dist-server/server/outbound-counts.js

@@ -0,0 +1,79 @@
+// How many outbound calls each bot has made today. The daily cap in a
+// bot's outbound policy is only as good as this number, so it lives on
+// disk (0600, like every other record that names what a bot did) and is
+// keyed by the local day, so it rolls over at midnight and not at the
+// next restart.
+//
+// One day is kept per bot: the count exists to enforce today's cap, and
+// the activity log already keeps the history.
+import { readFileSync } from "node:fs";
+import { writeFileAtomic } from "./atomic.js";
+const dayKey = (date) => `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")}`;
+export class OutboundCounts {
+    file;
+    stored;
+    readable = true;
+    constructor(file) {
+        this.file = file;
+        this.stored = this.load();
+    }
+    load() {
+        try {
+            const value = JSON.parse(readFileSync(this.file, "utf8"));
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                throw new Error("invalid outbound counts");
+            const stored = {};
+            for (const [botId, entry] of Object.entries(value)) {
+                if (!entry || typeof entry !== "object")
+                    throw new Error("invalid outbound count");
+                const { day, count } = entry;
+                if (typeof day === "string" && typeof count === "number" && Number.isInteger(count) && count >= 0) {
+                    stored[botId] = { day, count };
+                }
+                else
+                    throw new Error("invalid outbound count");
+            }
+            return stored;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                this.readable = false;
+            return {};
+        }
+    }
+    save() {
+        writeFileAtomic(this.file, JSON.stringify(this.stored, null, 2), { mode: 0o600 });
+    }
+    /** How many outbound calls this bot has made on the day `now` falls in. */
+    today(botId, now = new Date()) {
+        if (!this.readable)
+            throw new Error("the daily allowance could not be read");
+        const entry = this.stored[botId];
+        return entry && entry.day === dayKey(now) ? entry.count : 0;
+    }
+    /** Count one more, and return the new total for the day. */
+    record(botId, now = new Date()) {
+        return this.reserve(botId, 1, Number.MAX_SAFE_INTEGER, now);
+    }
+    /** Reserve before any provider await. An uncertain send keeps its slot:
+     * refunding transport failures could repeat a send already delivered. */
+    reserve(botId, amount, cap, now = new Date()) {
+        const day = dayKey(now);
+        const entry = this.stored[botId];
+        const count = this.today(botId, now) + amount;
+        if (count > cap)
+            return null;
+        this.stored[botId] = { day, count };
+        try {
+            this.save();
+        }
+        catch (error) {
+            if (entry)
+                this.stored[botId] = entry;
+            else
+                delete this.stored[botId];
+            throw error;
+        }
+        return count;
+    }
+}

package/dist-server/server/outbound-requests.js

@@ -0,0 +1,60 @@
+// Outbound calls held for a person's answer.
+//
+// The connector relay opens one of these when a bot's tool call would send
+// something and the bot's policy says ask. The relay then waits on
+// `answer`; the respond route resolves it when the card is answered. The
+// contract mirrors the other card services: a request is claimed exactly
+// once, a second answer says so instead of doing anything, and nothing
+// waits forever — the relay has its own deadline, so the hold has one too.
+//
+// In-memory on purpose. A restart drops every held relay along with the
+// proxy process that was waiting on it; the card left on the thread then
+// settles as unavailable, the same way an engine's own request does.
+import { randomUUID } from "node:crypto";
+export class OutboundRequestService {
+    held = new Map();
+    /** Hold one call. `answer` settles with the person's verdict or a timeout. */
+    open(input) {
+        const requestId = randomUUID();
+        let settle;
+        const answer = new Promise((resolve) => {
+            settle = resolve;
+        });
+        const timer = setTimeout(() => this.settle(requestId, "timeout"), input.timeoutMs);
+        timer.unref?.();
+        this.held.set(requestId, { botId: input.botId, threadId: input.threadId, tool: input.tool, settle, timer });
+        return { requestId, answer };
+    }
+    settle(requestId, answer) {
+        const entry = this.held.get(requestId);
+        if (!entry || entry.answered)
+            return;
+        entry.answered = answer;
+        clearTimeout(entry.timer);
+        entry.settle(answer);
+    }
+    /** The person's answer, from the respond route. */
+    resolve(input) {
+        const entry = this.held.get(input.requestId);
+        if (!entry || entry.threadId !== input.threadId)
+            return { claimed: false };
+        if (entry.answered)
+            return { claimed: true, state: "already_settled", behavior: entry.answered };
+        const answer = input.behavior === "allow" ? "allow" : "deny";
+        this.settle(input.requestId, answer);
+        return { claimed: true, state: answer === "allow" ? "allowed" : "denied" };
+    }
+    /** Requests still waiting in a thread, oldest first. */
+    pending(threadId) {
+        return [...this.held.entries()]
+            .filter(([, entry]) => entry.threadId === threadId && !entry.answered)
+            .map(([requestId]) => requestId);
+    }
+    /** Forget a settled request once its waiter has read the answer. */
+    forget(requestId) {
+        const entry = this.held.get(requestId);
+        if (entry)
+            clearTimeout(entry.timer);
+        this.held.delete(requestId);
+    }
+}

package/dist-server/server/package-import.js

@@ -41,7 +41,7 @@ export class PackageImportError extends Error {
 export function orgInstallId(adminOrigin, organizationId, packageId) {
     return createHash("sha256").update(`omb-install:v1\n${adminOrigin}\n${organizationId}\n${packageId}`, "utf8").digest("hex").slice(0, 32);
 }
-function memberFromAgent(agent) {
+export function memberFromAgent(agent) {
     return {
         key: agent.key,
         name: agent.name,

package/dist-server/server/peer-delivery.js

@@ -43,6 +43,7 @@ export function peerDeliveryReceipt(receipt) {
         detail: clip(receipt.detail) || "no detail recorded",
         ...(receipt.taskId ? { taskId: receipt.taskId } : {}),
         ...(receipt.requestId ? { requestId: receipt.requestId } : {}),
+        ...(receipt.threadId ? { threadId: receipt.threadId } : {}),
     };
 }
 const named = (receipt) => peerName(receipt.botName ?? "") || peerName(receipt.botId) || "teammate";