openmausbot 0.1.94 → 0.1.95

package/dist-server/shared/connector-scopes.js

@@ -0,0 +1,78 @@
+// Per-bot connection scopes: which connected apps a bot may use, and
+// whether it may only read them or also write. Absent means what it has
+// always meant — every connected app, read and write — so nothing changes
+// for a bot nobody has scoped. Present means a list: an app not on it is
+// off for this bot, and "read" refuses anything that is not a read.
+//
+// Shared between the harness (which enforces it at the connector relay,
+// seeing through Composio's meta tools) and the app (which shows the
+// control), so both agree on what a scope means.
+// No import from outbound.ts: shared/ is compiled by both the server (which
+// needs .ts extensions) and the app (which forbids them), so shared modules
+// stand alone. The read-verb rule is repeated here in its Composio-only form.
+const READ_VERBS = new Set(["GET", "LIST", "FETCH", "SEARCH", "READ", "FIND", "RETRIEVE", "LOOKUP", "DOWNLOAD", "VIEW", "CHECK", "COUNT"]);
+const TOOLKIT_SLUG = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+/** The toolkit a Composio slug belongs to: the part before the first
+ * underscore, lower-cased. A workbench API proxy belongs to no app. */
+export function toolkitOf(slug) {
+    const cut = slug.indexOf("_");
+    return (cut > 0 ? slug.slice(0, cut) : slug).toLowerCase();
+}
+/** A read verb first means the tool reads. Creating a draft writes to the
+ * account even though it sends nothing, so it is a write here. */
+export function isReadOnlyAction(slug, toolkit) {
+    if (slug === "COMPOSIO_PROXY_EXECUTE")
+        return false;
+    const cut = toolkit ? toolkit.length : slug.indexOf("_");
+    const action = cut > 0 ? slug.slice(cut + 1) : "";
+    const first = action.toUpperCase().split(/[^A-Z0-9]+/).find(Boolean);
+    return first !== undefined && READ_VERBS.has(first);
+}
+/** The stored shape, or null when the value is not one. */
+export function normalizeConnectorScopes(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const raw = value.apps;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const apps = Object.create(null);
+    for (const [key, scope] of Object.entries(raw)) {
+        const slug = key.trim().toLowerCase();
+        if (!TOOLKIT_SLUG.test(slug))
+            return null;
+        if (scope !== "read" && scope !== "write")
+            return null;
+        apps[slug] = scope;
+    }
+    return { apps };
+}
+/** May this bot run these calls? The first refusal wins, so a batch that
+ * mixes an allowed read with a forbidden write is refused whole rather
+ * than half-run. */
+export function connectorAccessDecision(scopes, calls, toolkits = []) {
+    if (!scopes)
+        return { ok: true };
+    for (const call of calls) {
+        const toolkit = toolkits.filter(candidate => call.slug.startsWith(candidate.toUpperCase() + "_"))
+            .sort((a, b) => b.length - a.length)[0] ?? toolkitOf(call.slug);
+        const scope = call.slug === "COMPOSIO_PROXY_EXECUTE" || !Object.hasOwn(scopes.apps, toolkit) ? undefined : scopes.apps[toolkit];
+        if (!scope)
+            return { ok: false, slug: call.slug, toolkit, reason: "app" };
+        if (scope === "read" && !isReadOnlyAction(call.slug, toolkit))
+            return { ok: false, slug: call.slug, toolkit, reason: "write" };
+    }
+    return { ok: true };
+}
+/** One sentence for the bot's prompt, so it does not spend a turn finding
+ * out. Empty when the bot is unscoped. */
+export function describeConnectorScopes(scopes) {
+    if (!scopes)
+        return "";
+    const entries = Object.entries(scopes.apps);
+    if (entries.length === 0)
+        return " This bot has been given no connected apps; do not try to use any.";
+    const listed = entries
+        .map(([slug, scope]) => `${slug} (${scope === "read" ? "read only" : "read and write"})`)
+        .join(", ");
+    return ` This bot may use only these connected apps: ${listed}. Do not try others, and do not write to a read-only one.`;
+}

package/dist-server/shared/outbound.js

@@ -0,0 +1,128 @@
+// Outbound actions: the calls that reach a person outside the app, or move
+// money. Sending an email, replying in a thread, posting to a channel,
+// publishing, inviting, sharing, refunding, charging. These get their own
+// confirmation regardless of approval level, and an optional daily
+// allowance per bot, because the cost of one wrong send is paid by someone
+// who never saw the bot.
+//
+// Shared between the harness (which enforces it) and the app (which shows
+// the setting), so both agree on what "outbound" means.
+export const OUTBOUND_DEFAULT_CAP = 25;
+const OUTBOUND_MAX_CAP = 1_000;
+/** Tools whose action is one of these words send something somewhere. */
+const SEND_VERBS = new Set([
+    "SEND",
+    "SENDS",
+    "REPLY",
+    "RESPOND",
+    "FORWARD",
+    "POST",
+    "PUBLISH",
+    "TWEET",
+    "RETWEET",
+    "BROADCAST",
+    "INVITE",
+    "SHARE",
+    "REFUND",
+    "CHARGE",
+    "PAY",
+    "PAYOUT",
+    "TRANSFER",
+]);
+/** Creating one of these is sending it: a created comment is a comment
+ * someone reads, a created invoice is one someone receives. */
+const CREATE_VERBS = new Set(["CREATE", "CREATION", "ADD", "NEW"]);
+const SENT_NOUNS = new Set(["MESSAGE", "COMMENT", "POST", "EMAIL", "MAIL", "INVOICE", "PAYMENT", "REFUND", "REPLY", "TWEET", "DM"]);
+/** A read verb first means the rest of the name is what is being read:
+ * REDDIT_GET_POST fetches a post, it does not post. */
+const READ_VERBS = new Set(["GET", "LIST", "FETCH", "SEARCH", "READ", "FIND", "RETRIEVE", "LOOKUP", "DOWNLOAD", "VIEW", "CHECK", "COUNT"]);
+/** The action part of a tool name, as upper-case word tokens. Composio's
+ * TOOLKIT_ACTION drops its toolkit; an MCP server's mcp__server__action
+ * drops its server; a bare built-in like Bash stays as it is. */
+function actionTokens(name) {
+    let action = name;
+    if (name.startsWith("mcp__")) {
+        const [, server = "", ...rest] = name.split("__");
+        action = rest.join("_");
+        if (server === "composio")
+            return actionTokens(action);
+    }
+    else if (/^[A-Z][A-Z0-9]*_[A-Z0-9_]+$/.test(name)) {
+        action = name.slice(name.indexOf("_") + 1);
+    }
+    return action
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toUpperCase()
+        .split(/[^A-Z0-9]+/)
+        .filter(Boolean);
+}
+/** Does this tool send something to someone, or move money? */
+export function isOutboundTool(name) {
+    // A raw API call from the workbench can do anything an app tool can, and
+    // nothing here can read which; it is treated as a send.
+    if (name === "COMPOSIO_PROXY_EXECUTE")
+        return true;
+    const tokens = actionTokens(name);
+    if (tokens.length === 0)
+        return false;
+    if (READ_VERBS.has(tokens[0]))
+        return false;
+    if (tokens.some((token) => SEND_VERBS.has(token)))
+        return true;
+    if (tokens.includes("DRAFT"))
+        return false;
+    return tokens.some((token) => CREATE_VERBS.has(token)) && tokens.some((token) => SENT_NOUNS.has(token));
+}
+/** The stored shape, or null when the value is not one. */
+export function normalizeOutboundPolicy(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const { policy, dailyCap } = value;
+    if (policy !== "ask" && policy !== "allow")
+        return null;
+    if (dailyCap === undefined)
+        return { policy, dailyCap: OUTBOUND_DEFAULT_CAP };
+    if (typeof dailyCap !== "number" || !Number.isInteger(dailyCap) || dailyCap < 1 || dailyCap > OUTBOUND_MAX_CAP)
+        return null;
+    return { policy, dailyCap };
+}
+/** What a bot without a stored policy does: ask, every time. */
+export const DEFAULT_OUTBOUND_POLICY = { policy: "ask", dailyCap: OUTBOUND_DEFAULT_CAP };
+const isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+/** Composio's session exposes a handful of meta tools and runs the app
+ * tools inside them: a multi-execute call carries a list of slugs with
+ * arguments. Arbitrary workbench/bash code is opaque: it requires an
+ * explicit unrestricted approval, never an inferred app or send count.
+ * Search, schema lookup, and connection management run no app tools. */
+export function connectorCallsIn(name, args) {
+    if (name === "COMPOSIO_MULTI_EXECUTE_TOOL") {
+        const tools = isRecord(args) && Array.isArray(args.tools) ? args.tools
+            : isRecord(args) && typeof args.tool_slug === "string" ? [args] : [];
+        if (!tools.length)
+            return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+        const calls = [];
+        for (const item of tools) {
+            if (!isRecord(item))
+                return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+            const slug = [item.tool_slug, item.slug, item.name, item.tool].find((value) => typeof value === "string" && value);
+            if (typeof slug !== "string")
+                return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+            calls.push({ slug, ...(item.arguments !== undefined ? { arguments: item.arguments } : {}) });
+        }
+        return calls;
+    }
+    if (name === "COMPOSIO_REMOTE_WORKBENCH" || name === "COMPOSIO_REMOTE_BASH_TOOL") {
+        // Arbitrary code can compute tool names and repeat calls. Its app and
+        // outbound count cannot be inferred from literals in the source.
+        return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+    }
+    if (["COMPOSIO_SEARCH_TOOLS", "COMPOSIO_GET_TOOL_SCHEMAS", "COMPOSIO_MANAGE_CONNECTIONS", "COMPOSIO_WAIT_FOR_CONNECTIONS"].includes(name))
+        return [];
+    if (name.startsWith("COMPOSIO_"))
+        return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+    return [{ slug: name, ...(args !== undefined ? { arguments: args } : {}) }];
+}
+/** The subset of a request's app tools that would send something. */
+export function outboundCallsIn(name, args) {
+    return connectorCallsIn(name, args).filter((call) => isOutboundTool(call.slug));
+}

package/dist-server/shared/tool-surface.js

@@ -7,8 +7,9 @@
  * computer is illustrated only after one of these; the built-in browser's
  * read-only calls (snapshot, read, get_text, waits) stay out by the same rule. */
 export const SCREEN_TOUCHING_TOOLS = new Set([
-    // cloud boat / remote computer
-    "screenshot", "click", "type_text", "press_key", "scroll", "computer_batch", "open_url", "browser_click", "browser_fill",
+    // cloud boat / remote computer (server/cloud-computer-tools.ts names its
+    // key tool key_press)
+    "screenshot", "click", "type_text", "press_key", "key_press", "scroll", "computer_batch", "open_url", "browser_click", "browser_fill",
     // built-in browser: the Electron surface's names, kept because a bot on an
     // older remote harness can still call them
     "browser_navigate", "browser_type", "browser_press", "browser_scroll", "browser_hover", "browser_drag",

package/dist-server/vps-container-mcp.js

@@ -16691,7 +16691,8 @@ function resolveProxy(relative) {
   return existsSync2(source) ? source : join3(SERVER_ROOT, `${relative}.js`);
 }
 var SPAWNED_PROXIES = {
-  browser: resolveProxy("browser-proxy"),
+  // The built-in browser and the cloud computer: argv[2] picks which.
+  harnessMcp: resolveProxy("harness-mcp-proxy"),
   localComputer: resolveProxy("local-computer-proxy"),
   permission: resolveProxy("permission-proxy"),
   containerMcp: resolveProxy("container-mcp"),
@@ -16724,7 +16725,6 @@ var DISPLAY = ":1";
 var CUA_SOCKET = "/run/user/1000/openmausbot-cua.sock";
 var CUA_EXECUTABLE = "/usr/local/libexec/openmausbot/cua-driver";
 var MEMORY_BYTES = 4 * 1024 * 1024 * 1024;
-var SHM_BYTES = 512 * 1024 * 1024;
 function cuaExecArgs(args2, options = {}) {
   return [
     "exec",

package/enterprise/server/index.js

@@ -14589,7 +14589,8 @@ function resolveProxy(relative) {
   return existsSync(source) ? source : join(SERVER_ROOT, `${relative}.js`);
 }
 var SPAWNED_PROXIES = {
-  browser: resolveProxy("browser-proxy"),
+  // The built-in browser and the cloud computer: argv[2] picks which.
+  harnessMcp: resolveProxy("harness-mcp-proxy"),
   localComputer: resolveProxy("local-computer-proxy"),
   permission: resolveProxy("permission-proxy"),
   containerMcp: resolveProxy("container-mcp"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.94",
+  "version": "0.1.95",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-CdJX6i8k.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-B_BKNCw5.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};