openmausbot 0.1.94 → 0.1.95

package/dist-server/proxy-paths.js

@@ -8,7 +8,8 @@ function resolveProxy(relative) {
   return existsSync(source) ? source : join(SERVER_ROOT, `${relative}.js`);
 }
 var SPAWNED_PROXIES = {
-  browser: resolveProxy("browser-proxy"),
+  // The built-in browser and the cloud computer: argv[2] picks which.
+  harnessMcp: resolveProxy("harness-mcp-proxy"),
   localComputer: resolveProxy("local-computer-proxy"),
   permission: resolveProxy("permission-proxy"),
   containerMcp: resolveProxy("container-mcp"),

package/dist-server/server/account-signin.js

@@ -11,8 +11,6 @@
 // not expose the routes.
 import { resolveCompanionControlPlaneURL } from "../electron/companion-account-service.mjs";
 import { ControlPlaneError, createControlPlaneClient, normalizeAccountEmail } from "../electron/control-plane-client.mjs";
-export const ADMIN_EMAILS_ENV = "OMB_SIGNIN_EMAILS";
-export const MEMBER_EMAILS_ENV = "OMB_SIGNIN_MEMBER_EMAILS";
 /** Commas, spaces or newlines between entries; case does not matter. */
 export function parseAllowList(value) {
     return (value ?? "")

package/dist-server/server/activity.js

@@ -0,0 +1,201 @@
+// A bot's activity log: what it did, in plain words, with the outcome.
+//
+// Nothing here is captured for the log's sake. Two records already on disk
+// between them know everything a receipt needs: the per-thread runtime
+// events (harness/bus.ts) say what ran and whether it finished, and the
+// fleet-wide decision log (decision-log.ts) says what was asked, with which
+// arguments, and who allowed it. This module reads both back and folds
+// them into one row per thing that happened.
+//
+// Connector calls pass through the harness relay, whose approval and scope
+// decisions share the decision log. Read those alongside native tool runs.
+import { join } from "node:path";
+import { readDecisions } from "./decision-log.js";
+import { isRuntimeEvent, readRecentLines } from "./thread-events.js";
+/** Composio toolkit slugs whose display name is not just a capitalised word. */
+const TOOLKIT_NAMES = {
+    GMAIL: "Gmail",
+    GITHUB: "GitHub",
+    GOOGLESHEETS: "Google Sheets",
+    GOOGLECALENDAR: "Google Calendar",
+    GOOGLEDRIVE: "Google Drive",
+    GOOGLEDOCS: "Google Docs",
+    HUBSPOT: "HubSpot",
+    LINKEDIN: "LinkedIn",
+    YOUTUBE: "YouTube",
+    TWITTER: "X",
+    WHATSAPP: "WhatsApp",
+    ONEDRIVE: "OneDrive",
+};
+/** The agent's own built-in tools, phrased as what they did. */
+const BUILTIN_LABELS = {
+    Bash: "Ran a command",
+    Read: "Read a file",
+    Edit: "Edited a file",
+    MultiEdit: "Edited files",
+    Write: "Wrote a file",
+    Glob: "Searched files",
+    Grep: "Searched files",
+    LS: "Listed a folder",
+    WebSearch: "Searched the web",
+    WebFetch: "Fetched a page",
+    Skill: "Used a skill",
+    Task: "Ran a subagent",
+    Agent: "Ran a subagent",
+    AskUserQuestion: "Asked you a question",
+    TodoWrite: "Updated its task list",
+};
+/** "save_issue" → "Save issue", "TaskUpdate" → "Task update",
+ * "CREATE_AN_ISSUE" → "Create an issue". */
+function humanize(raw) {
+    const spaced = raw
+        .replace(/_+/g, " ")
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/\s+/g, " ")
+        .trim()
+        .toLowerCase();
+    return spaced ? spaced[0].toUpperCase() + spaced.slice(1) : raw;
+}
+function toolkitName(slug) {
+    return TOOLKIT_NAMES[slug] ?? slug[0] + slug.slice(1).toLowerCase();
+}
+/** Composio names its tools TOOLKIT_ACTION_WORDS, all upper case. */
+const COMPOSIO_TOOL = /^([A-Z][A-Z0-9]+)_([A-Z0-9_]+)$/;
+/** Turn a raw tool name into the app it touched and the action, in words. */
+export function describeTool(name) {
+    const builtin = BUILTIN_LABELS[name];
+    if (builtin)
+        return { app: null, label: builtin };
+    if (name.startsWith("mcp__")) {
+        const [, server = "", ...rest] = name.split("__");
+        const action = rest.join("__");
+        if (server === "composio")
+            return describeTool(action);
+        if (server === "computer")
+            return { app: "Computer", label: humanize(action) };
+        if (server === "agents")
+            return { app: "Team", label: humanize(action) };
+        if (server.startsWith("claude_ai_")) {
+            return { app: server.slice("claude_ai_".length).replace(/_/g, " "), label: humanize(action) };
+        }
+        return { app: humanize(server), label: humanize(action) };
+    }
+    const composio = COMPOSIO_TOOL.exec(name);
+    if (composio)
+        return { app: toolkitName(composio[1]), label: humanize(composio[2]) };
+    return { app: null, label: humanize(name) };
+}
+/** How many decision rows to read back before filtering to one bot. The
+ * file is rotation-capped, so this is a ceiling on parse work, not a
+ * window that quietly drops history. */
+const DECISION_SCAN = 20_000;
+/** Runtime events read per thread, newest first; the reader tail-walks. */
+const EVENTS_PER_THREAD = 2_000;
+/** An approval is folded into the tool run it unblocked when the run
+ * started inside this window around the decision. A verdict is written
+ * as the request opens; the run follows it, occasionally by a clock skew's
+ * worth in the other direction. */
+const MATCH_BEFORE_MS = 5_000;
+const MATCH_AFTER_MS = 30_000;
+const OUTCOME_OF_DECISION = {
+    "auto-approved": "allowed",
+    "auto-denied": "denied",
+    "user-approved": "allowed",
+    "review-would-approve": "allowed",
+    "user-denied": "denied",
+    "review-would-deny": "denied",
+    "card-shown": "waiting",
+};
+function describeRow(base) {
+    const { app, label } = describeTool(base.tool);
+    return { ...base, app, label };
+}
+/** One row per request: the decision log writes a row when a card is shown
+ * and another when it is answered, and the receipt wants the answer. */
+function foldDecisions(rows) {
+    const byRequest = new Map();
+    rows.forEach((row, index) => {
+        const key = row.requestId ?? `row:${index}`;
+        const group = byRequest.get(key);
+        if (group)
+            group.push(row);
+        else
+            byRequest.set(key, [row]);
+    });
+    const folded = [];
+    for (const group of byRequest.values()) {
+        const opened = group[0];
+        const latest = group[group.length - 1];
+        const summary = group.find((row) => row.summary)?.summary;
+        folded.push(describeRow({
+            at: opened.at,
+            threadId: opened.threadId,
+            requestId: opened.requestId,
+            tool: latest.tool ?? opened.tool ?? "unknown",
+            ...(summary ? { summary } : {}),
+            outcome: OUTCOME_OF_DECISION[latest.decision],
+        }));
+    }
+    return folded;
+}
+function readToolRuns(eventsDir, threadId) {
+    const { lines } = readRecentLines(join(eventsDir, `${threadId}.ndjson`), EVENTS_PER_THREAD, isRuntimeEvent);
+    const runs = new Map();
+    for (const event of lines) {
+        if (event.type === "item.started" && event.itemType === "tool") {
+            const key = JSON.stringify([event.turnId ?? "", event.itemId ?? event.eventId]);
+            runs.set(key, describeRow({
+                at: event.createdAt,
+                threadId,
+                ...(event.turnId ? { turnId: event.turnId } : {}),
+                tool: event.title ?? "unknown",
+                outcome: "running",
+            }));
+        }
+        else if (event.type === "item.completed" && event.itemType === "tool" && event.itemId) {
+            const run = runs.get(JSON.stringify([event.turnId ?? "", event.itemId]));
+            if (run)
+                run.outcome = event.ok ? "ran" : "failed";
+        }
+    }
+    return [...runs.values()];
+}
+/** The bot's activity, newest first: every tool run in the threads named,
+ * and every decision the broker logged for the bot, with an approval folded
+ * into the run it unblocked wherever the two can be matched. */
+export function readBotActivity(input) {
+    const { dataDir, eventsDir, botId, threadIds, limit } = input;
+    const runs = threadIds.flatMap((threadId) => readToolRuns(eventsDir, threadId));
+    const decisions = foldDecisions(readDecisions(dataDir, DECISION_SCAN).filter((row) => row.botId === botId));
+    const matched = new Set();
+    const rows = [...runs];
+    for (const decision of decisions) {
+        if (decision.outcome !== "allowed") {
+            rows.push(decision);
+            continue;
+        }
+        const askedAt = Date.parse(decision.at);
+        let best = null;
+        for (const run of runs) {
+            if (matched.has(run) || run.threadId !== decision.threadId || run.tool !== decision.tool)
+                continue;
+            const delta = Date.parse(run.at) - askedAt;
+            if (delta < -MATCH_BEFORE_MS || delta > MATCH_AFTER_MS)
+                continue;
+            if (!best || Math.abs(delta) < Math.abs(Date.parse(best.at) - askedAt))
+                best = run;
+        }
+        if (best) {
+            matched.add(best);
+            if (decision.summary)
+                best.summary = decision.summary;
+            if (decision.requestId)
+                best.requestId = decision.requestId;
+        }
+        else {
+            rows.push(decision);
+        }
+    }
+    rows.sort((a, b) => (a.at < b.at ? 1 : a.at > b.at ? -1 : 0));
+    return rows.slice(0, Math.max(1, limit));
+}

package/dist-server/server/auto-approve.js

@@ -7,6 +7,7 @@
 // grants the app applies are Full access and the person's exact saved commands.
 // Questions never come through here: a bot's question always reaches a human.
 import { supportsApprovalMode } from "../shared/approval-mode.js";
+import { isOutboundTool } from "../shared/outbound.js";
 /** A failed delivery is a runtime error, not another permission decision.
  * An expired ask must never become a fresh Allow/Deny card. */
 export async function deliverFullAccessApproval(adapter, threadId, requestId, turnId, isCurrent = () => false) {
@@ -91,6 +92,8 @@ export function autoVerdict(mode, tool, context) {
         return { approve: `approved ${tool} (full access)`, source: "full-access" };
     if (context?.requiresExplicitApproval)
         return { approve: null, source: "explicit-approval-block" };
+    if (isOutboundTool(tool))
+        return { approve: null, source: "outbound-guard" };
     if (context?.commandAllowed)
         return { approve: `approved ${tool} (saved command)`, source: "command-allowlist" };
     if (mode === "auto" || mode === "custom")
@@ -105,6 +108,7 @@ export function autoVerdict(mode, tool, context) {
  * the server keeps sending: cards saved before the key existed still render,
  * and so do the free-text apply errors that have no key at all. */
 export const HELD_NOTE = {
+    "approval.held.outbound": "This sends something on your behalf, so it always asks first.",
     "approval.held.native": "The provider requires your approval for this action.",
     "approval.held.sandbox": "This changes the provider sandbox, so only Full access can approve it automatically.",
     "approval.held.undeliveredFull": "Full access couldn't deliver this approval.",
@@ -115,6 +119,8 @@ export const HELD_NOTE = {
 export function approvalHeldNote(context) {
     if (!context.permission)
         return undefined;
+    if (context.source === "outbound-guard")
+        return "approval.held.outbound";
     if (context.source === "explicit-approval-block")
         return "approval.held.sandbox";
     if (context.source === "native-approval")

package/dist-server/server/automatic-recovery.js

@@ -7,7 +7,7 @@ export function recoveryCapabilityError(from, to) {
         supportsWorkspaceFiles(from.driverKind) !== supportsWorkspaceFiles(to.driverKind)) {
         return "The backup cannot use the same workspace.";
     }
-    const tools = ["agentsMcp", "computerMcp", "cloudComputerMcp", "composioMcp",
+    const tools = ["agentsMcp", "computerMcp", "composioMcp",
         "phoneMcp", "browserMcp", "localComputerMcp", "customMcp", "images"];
     if (tools.some(key => from.capabilities[key] === true && to.capabilities[key] !== true)) {
         return "The backup does not support all of this engine's tools and attachments.";

package/dist-server/server/boat-create-idempotency.js

@@ -388,13 +388,6 @@ export function resolveBoatCreate(request) {
         return { ...resolved };
     });
 }
-/** Read-only deletion guard. Both a key-only request with an ambiguous
- * provider outcome and a known-but-not-yet-named Boat must keep its bot owner. */
-export function hasUnresolvedBoatCreate(botId) {
-    if (!BOT_ID.test(botId))
-        throw new Error("invalid bot id for cloud computer creation");
-    return withJournalLock((requests) => (requests.some((request) => request.botId === botId && request.resolved !== true)));
-}
 /** Sanitized local recovery authority for configuration guards. The fresh,
  * lock-protected read can prove a remembered provider id even while the
  * account-wide LIST endpoint is eventually consistent. Provider request

package/dist-server/server/boat-delete-journal.js

@@ -442,7 +442,6 @@ export function markBoatDeletionBlocked(boxId, value) {
 export function boatDeletionSnapshot() {
     return withJournalLock((records) => records.map(clone));
 }
-export const listBoatDeletions = boatDeletionSnapshot;
 export function getBoatDeletion(boxId) {
     if (!BOAT_ID.test(boxId))
         throw new Error("invalid cloud computer id for deletion");
@@ -451,9 +450,6 @@ export function getBoatDeletion(boxId) {
         return record ? clone(record) : null;
     });
 }
-export function isBoatDeletionPending(boxId) {
-    return getBoatDeletion(boxId) !== null;
-}
 export function hasPendingBoatDeletionForBot(botId) {
     if (!BOT_ID.test(botId))
         throw new Error("invalid bot id for cloud computer deletion");

package/dist-server/server/bot-package.js

@@ -1,15 +1,11 @@
 import { stringify as stringifyYaml } from "yaml";
 import { cronScheduleLabel } from "../shared/cron-label.js";
-import { BOTMRR_MARKDOWN_VERSION, isPackageDocument, PACKAGE_FORMAT, PACKAGE_V1_MAX_SKILLS, PACKAGE_V1_VERSION, parsePackageV1, utf8Bytes, } from "../shared/package-format.js";
+import { BOTMRR_MARKDOWN_VERSION, isPackageDocument, PACKAGE_V1_MAX_SKILLS, parsePackageV1, utf8Bytes, } from "../shared/package-format.js";
 // The package file format (v1 and v2) lives in shared/package-format.ts: one
 // validation gate for the server, the renderer and Admin. This module keeps
 // the v1 names the v1 exporter and its Markdown playbook are written in, and
 // re-exports the v2 reader so server code has one place to import from.
 export { canonicalJson, downgradeToV1, PACKAGE_MAX_BYTES, PACKAGE_VERSION, PackageFormatError, packageKeys, packageScanFindings, packageSecretFindings, packageSummary, parsePackageDocument, redactPackageSecrets, upgradeV1, } from "../shared/package-format.js";
-export const BOT_PACKAGE_FORMAT = PACKAGE_FORMAT;
-export const BOT_PACKAGE_VERSION = PACKAGE_V1_VERSION;
-export { BOTMRR_MARKDOWN_VERSION };
-export const BOT_PACKAGE_SKILLS_VERSION = 1;
 export const BOT_PACKAGE_MAX_SKILLS = PACKAGE_V1_MAX_SKILLS;
 const BOT_PACKAGE_MARKDOWN_MAX_BYTES = 1_000_000;
 export function isBotPackage(value) {
@@ -98,17 +94,3 @@ export function renderBotPackageMarkdown(document) {
         throw new Error("The bot playbook is too large");
     return markdown;
 }
-export function packageAgentAsMember(agent) {
-    return {
-        key: agent.key,
-        name: agent.name,
-        title: agent.title ?? "",
-        description: agent.description ?? "",
-        ...(agent.soul !== undefined ? { soul: agent.soul } : {}),
-        appearance: {
-            color: agent.appearance.color,
-            ...(agent.appearance.mascotExpression ? { mascotExpression: agent.appearance.mascotExpression } : {}),
-            ...(agent.appearance.mascotBody ? { mascotBody: agent.appearance.mascotBody } : {}),
-        },
-    };
-}

package/dist-server/server/browser-runtime.js

@@ -216,8 +216,7 @@ export class BrowserRuntime {
     options;
     closeBrowser;
     constructor({ closeBrowser, ...options } = {}) {
-        const budget = Number(process.env.OMB_BROWSER_RESULT_BUDGET);
-        this.options = { requestTimeoutMs: 120_000, takeoverTimeoutMs: 15_000, idleMs: 60_000, maxPending: 16, resultBudget: Number.isFinite(budget) && budget > 0 ? budget : DEFAULT_BROWSER_RESULT_BUDGET, ...options };
+        this.options = { requestTimeoutMs: 120_000, takeoverTimeoutMs: 15_000, idleMs: 60_000, maxPending: 16, resultBudget: DEFAULT_BROWSER_RESULT_BUDGET, ...options };
         this.closeBrowser = closeBrowser ?? (async () => false);
     }
     gate(session) {

package/dist-server/server/chief-of-staff.js

@@ -9,7 +9,7 @@ const sectionKey = (section) => section?.trim() || "";
 /** Dynamic system context for a section's Chief of Staff.
  * It names the current team on every turn, while list_bots remains the
  * authoritative tool for IDs and live availability at delegation time. */
-export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpenMausStatus = "", boundedCoordination = false) {
+export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, boundedCoordination = false) {
     const chief = bots.find((bot) => bot.id === chiefId);
     const chiefSection = sectionKey(chief?.section);
     const sectionName = peerName(chiefSection) || "General";
@@ -29,7 +29,7 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
     });
     const delegation = canDelegate
         ? boundedCoordination
-            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Outside a room, each distinct assignment starts a fresh thread for that teammate, using their own model and permissions. Include the context they need in each brief. Busy teammates queue. Give self-contained briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
+            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Give clear briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
             : [
                 "Use list_bots to confirm the live roster and IDs. When assigning work to a teammate, use delegate_bot: it returns immediately, keeps you available to the user, and delivers the teammate's outcome back into this conversation automatically — success or failure. When the result arrives you are woken with it: report it to the user and act. If the teammate fails or stalls, tell the user plainly and decide the next step yourself.",
                 "After delegate_bot accepts the task, acknowledge the handoff and continue with any independent work or end your turn. Do not call wait_delegation or repeatedly poll check_delegation in the same turn.",
@@ -52,6 +52,5 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
         canDelegate ? "When the user asks you to assemble or configure a team, use list_team_setup for the exact authorized teams, bot IDs and model catalog, then propose_team_setup once with all named specialists and their profile/model changes. Include new teams explicitly; the plan covers their creation and your access. Existing thread models and other bots' execution permissions stay unchanged. Follow the tool result: granted Full Access may apply the plan immediately; after an applied result, continue already-requested work without another confirmation. Only if review is pending, end your turn: the user's decision automatically resumes you once with a structured result. Report failed or cancelled results honestly. Do not ask for another yes, poll, or repeat the proposal. After successful setup, use the available coordination tools for already requested work. Use create_bot only for a single specialist when no combined setup was requested. For explicitly requested bot deletion, use propose_bot_deletion separately and follow its applied or pending result too. Do not create duplicate or unnecessary bots." : "",
         chief?.managedSections?.length ? "Reachable teammates in your allowed teams:" : `Current ${sectionName} section team:`,
         roster,
-        trustedOpenMausStatus,
     ].filter(Boolean).join("\n");
 }

package/dist-server/server/cloud-backend.js

@@ -1,13 +1,9 @@
 export const CLOUD_BACKEND_CHANGE_ERROR = "stop the active turn before changing the cloud backend";
-export const VPS_ALIAS_CHANGE_ERROR = "stop the active VPS turn before changing the SSH config alias";
 export const BOAT_ACCOUNT_RESOURCES_ERROR = "remove this installation's cloud computers before changing or clearing the Boat account";
 export const VPS_ALIAS_RESOURCES_ERROR = "remove this installation's VPS computers before changing or clearing the SSH config alias";
 export function cloudBackendChangeError(botBusy, activeVpsThread) {
     return botBusy || activeVpsThread ? CLOUD_BACKEND_CHANGE_ERROR : null;
 }
-export function vpsAliasChangeError(currentAlias, nextAlias, activeVpsThread) {
-    return activeVpsThread && currentAlias !== nextAlias ? VPS_ALIAS_CHANGE_ERROR : null;
-}
 /** An old Boat account may be detached only when it owns no local resources.
  * Token rotation is safe when the replacement credential proves access to
  * the exact same provider identities. */

package/dist-server/server/cloud-computer-tools.js

@@ -0,0 +1,110 @@
+import { isolatedRemoteCommand, runCommand, screenshotBoat } from "./boat.js";
+import { CONTROL_REFUSAL_PLAIN } from "./control-client.js";
+import { compileToolSchema } from "./drivers/chat-mcp-tools.js";
+const coordinate = { type: "integer", minimum: 0, maximum: 32767 };
+const tool = (name, description, properties = {}, required = []) => ({ name, description, inputSchema: { type: "object", properties, required, additionalProperties: false } });
+export const CLOUD_COMPUTER_TOOLS = [
+    tool("screenshot", "See the assigned cloud desktop at native pixel resolution."),
+    tool("get_screen_size", "Get the cloud desktop width and height."),
+    tool("click", "Click a point on the cloud desktop.", { x: coordinate, y: coordinate, button: { type: "string", enum: ["left", "middle", "right"] }, count: { type: "integer", minimum: 1, maximum: 3 } }, ["x", "y"]),
+    tool("move", "Move the cloud mouse pointer.", { x: coordinate, y: coordinate }, ["x", "y"]),
+    tool("drag", "Drag on the cloud desktop.", { x: coordinate, y: coordinate, to_x: coordinate, to_y: coordinate }, ["x", "y", "to_x", "to_y"]),
+    tool("type_text", "Type Unicode text into the focused cloud application.", { text: { type: "string", maxLength: 4000 } }, ["text"]),
+    tool("key_press", "Press an X11 key or shortcut.", { key: { type: "string", pattern: "^[A-Za-z0-9_+]+$", minLength: 1, maxLength: 100 } }, ["key"]),
+    tool("scroll", "Scroll at a point on the cloud desktop.", { x: coordinate, y: coordinate, direction: { type: "string", enum: ["up", "down", "left", "right"] }, amount: { type: "integer", minimum: 1, maximum: 30 } }, ["x", "y", "direction"]),
+    tool("open_url", "Request opening an HTTP or HTTPS URL in the cloud desktop browser; inspect the screen to confirm it loaded.", { url: { type: "string", pattern: "^https?://", maxLength: 2000 } }, ["url"]),
+    tool("exec", "Run a shell command on the assigned cloud computer.", { command: { type: "string", minLength: 1, maxLength: 4000 } }, ["command"]),
+];
+const quote = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
+const buttons = { left: 1, middle: 2, right: 3 };
+const scrollButtons = { up: 4, down: 5, left: 6, right: 7 };
+let validators;
+/** Why a call cannot run, or null. Checked before anything else touches the
+ * call: x and y reach the remote shell unquoted, so only the advertised
+ * integer schema stands between a model's arguments and a command line. */
+export function cloudComputerCallProblem(name, args) {
+    validators ??= new Map(CLOUD_COMPUTER_TOOLS.map(entry => [entry.name, compileToolSchema(entry.inputSchema)]));
+    const validate = typeof name === "string" ? validators.get(name) : undefined;
+    if (!validate)
+        return "Unknown cloud computer tool. Use one of the advertised computer tools.";
+    if (!args || typeof args !== "object" || Array.isArray(args) || !validate(args)) {
+        return "Tool arguments do not match the advertised input schema; use its required fields and types.";
+    }
+    return null;
+}
+/** One tool call on the given Boat with the server's own Boat account. The
+ * caller has already checked the arguments and the person's control. */
+export async function runCloudComputerTool(cfg, boxId, name, args, signal) {
+    const problem = cloudComputerCallProblem(name, args);
+    if (problem)
+        return { isError: true, content: [{ type: "text", text: problem }] };
+    signal.throwIfAborted();
+    if (name === "screenshot") {
+        const shot = await screenshotBoat(cfg, "", boxId, { signal, nativeSize: true });
+        signal.throwIfAborted();
+        return { content: [{ type: "image", mimeType: "image/jpeg", data: shot.png }] };
+    }
+    const a = args;
+    const mouse = `xdotool mousemove --sync ${a.x} ${a.y}`;
+    let command;
+    switch (name) {
+        case "get_screen_size":
+            command = "xdotool getdisplaygeometry";
+            break;
+        case "click":
+            command = `${mouse} click --repeat ${a.count ?? 1} --delay 100 ${buttons[String(a.button ?? "left")]}`;
+            break;
+        case "move":
+            command = mouse;
+            break;
+        case "drag":
+            command = `${mouse} mousedown 1 mousemove --sync ${a.to_x} ${a.to_y} mouseup 1`;
+            break;
+        case "type_text":
+            command = `printf %s ${quote(Buffer.from(String(a.text)).toString("base64"))} | base64 -d | xclip -selection clipboard && xdotool key --clearmodifiers ctrl+v`;
+            break;
+        case "key_press":
+            command = `xdotool key --clearmodifiers ${quote(String(a.key))}`;
+            break;
+        case "scroll":
+            command = `${mouse} click --repeat ${a.amount ?? 3} --delay 80 ${scrollButtons[String(a.direction)]}`;
+            break;
+        case "open_url":
+            command = `nohup xdg-open ${quote(String(a.url))} >/dev/null 2>&1 </dev/null &`;
+            break;
+        case "exec":
+            command = String(a.command);
+            break;
+        default: return { isError: true, content: [{ type: "text", text: "Unknown cloud computer tool." }] };
+    }
+    const result = await runCommand(cfg, boxId, isolatedRemoteCommand(command), { signal });
+    signal.throwIfAborted();
+    if (name === "open_url" && result.ok)
+        return { content: [{ type: "text", text: "Browser launch requested. Page loading is not confirmed; inspect the screen before continuing." }] };
+    return { isError: !result.ok, content: [{ type: "text", text: JSON.stringify(result) }] };
+}
+/** One JSON-RPC request from harness-mcp-proxy, answered with its MCP
+ * `result`. The order is the safety argument: arguments are checked before
+ * the control gate (which may claim the seat), a person's control refuses
+ * the call before anything reaches the Boat, and the turn's capability must
+ * still be live before and after the Boat acts. */
+export async function cloudComputerRpc(request, deps) {
+    if (request?.method === "tools/list") {
+        deps.assertActive();
+        return { tools: CLOUD_COMPUTER_TOOLS };
+    }
+    if (request?.method !== "tools/call")
+        throw Object.assign(new Error("unsupported computer method"), { status: 400 });
+    const params = (request.params && typeof request.params === "object" ? request.params : {});
+    const args = params.arguments ?? {};
+    const problem = cloudComputerCallProblem(params.name, args);
+    if (problem)
+        return { isError: true, content: [{ type: "text", text: problem }] };
+    const control = await deps.gate();
+    deps.assertActive();
+    if (control.held)
+        return { isError: true, content: [{ type: "text", text: control.blockedReason || CONTROL_REFUSAL_PLAIN }] };
+    const result = await runCloudComputerTool(deps.cfg, deps.boxId, params.name, args, deps.signal);
+    deps.assertActive();
+    return result;
+}

package/dist-server/server/cloud-home.js

@@ -26,7 +26,6 @@ import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { hostedWorkspaceConfigured } from "./enterprise.js";
 import { formatPairingCode } from "./sessions.js";
-export const CLOUD_HOME_CONTRACT_VERSION = 1;
 /** Any of these switches the server into Cloud home mode; then all are required. */
 export const CLOUD_HOME_KEYS = ["OMB_CLOUD_ROLE", "OMB_CLOUD_MACHINE_ID", "OMB_CLOUD_ADMIN_URL", "OMB_CLOUD_BOOTSTRAP_SECRET"];
 /** A platform model gateway's settings. A Cloud home never uses them: given

package/dist-server/server/cloud-lending.js

@@ -21,9 +21,6 @@ import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.js";
 const personOf = (line) => line?.role === "user" && !line.peerAsk ? line.sender?.id : undefined;
-export function cloudHomeTurnMayLend(turn) {
-    return cloudHomeLendingRefusal(turn) === null;
-}
 export function cloudHomeLendingRefusal(turn) {
     const { request } = turn;
     if (!request?.messageId || request.stopped || !request.generations.has(turn.generation))

package/dist-server/server/composio.js

@@ -244,9 +244,35 @@ function trustedAuthUrl(value, slug) {
     }
     return url.toString();
 }
+/** Composio's own hosts are always trusted. A backend the operator pointed
+ * the app at explicitly (OMB_COMPOSIO_API — a dev or test stub) may hand back
+ * a Session on its own origin, since the API itself was already trusted that
+ * far; any other host is refused. */
+export function trustedSessionMcpUrl(value) {
+    let mcp;
+    try {
+        mcp = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (mcp.protocol === "https:" && (mcp.hostname === "composio.dev" || mcp.hostname.endsWith(".composio.dev")))
+        return true;
+    if (mcp.protocol !== "https:" && !(mcp.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(mcp.hostname)))
+        return false;
+    const override = process.env.OMB_COMPOSIO_API;
+    if (!override)
+        return false;
+    try {
+        return new URL(override).origin === mcp.origin;
+    }
+    catch {
+        return false;
+    }
+}
 function parseSessionResponse(session) {
     const mcp = new URL(session.mcp.url);
-    if (mcp.protocol !== "https:" || (mcp.hostname !== "composio.dev" && !mcp.hostname.endsWith(".composio.dev"))) {
+    if (!trustedSessionMcpUrl(session.mcp.url)) {
         throw new Error("Composio returned an untrusted Session MCP URL");
     }
     return { ...session, mcp: { ...session.mcp, url: mcp.toString() } };
@@ -497,7 +523,7 @@ export async function mcpIntegration(cfg, context) {
         },
     };
 }
-export async function relayMcp(cfg, payload, transportSessionId) {
+export async function relayMcp(cfg, payload, transportSessionId, beforeSend) {
     const apiKey = projectApiKey(cfg);
     let url;
     let identity;
@@ -529,6 +555,9 @@ export async function relayMcp(cfg, payload, transportSessionId) {
     if (forwardedTransportSessionId) {
         headers.set("mcp-session-id", forwardedTransportSessionId);
     }
+    // Session discovery can await network I/O. Turn authority and mutable
+    // permissions must be checked after it, immediately before dispatch.
+    beforeSend?.();
     const response = await fetch(url, {
         method: "POST",
         headers,

package/dist-server/server/computer-control.js

@@ -153,18 +153,3 @@ export class ComputerControl {
         return snapshot;
     }
 }
-/** Safely executes an async tool or desktop control call, catching runtime exceptions gracefully. */
-export async function executeToolSafely(toolName, fn) {
-    try {
-        const data = await fn();
-        return { success: true, data };
-    }
-    catch (err) {
-        const errorMessage = err?.message || String(err) || 'Unknown execution error';
-        console.error(`[Tool Execution Error] Name: ${toolName} | Details: ${errorMessage}`);
-        return {
-            success: false,
-            error: `Tool '${toolName}' failed to execute: ${errorMessage}`
-        };
-    }
-}