openmausbot 0.1.94 → 0.1.96

package/dist-server/proxy-paths.js

@@ -8,7 +8,8 @@ function resolveProxy(relative) {
   return existsSync(source) ? source : join(SERVER_ROOT, `${relative}.js`);
 }
 var SPAWNED_PROXIES = {
-  browser: resolveProxy("browser-proxy"),
+  // The built-in browser and the cloud computer: argv[2] picks which.
+  harnessMcp: resolveProxy("harness-mcp-proxy"),
   localComputer: resolveProxy("local-computer-proxy"),
   permission: resolveProxy("permission-proxy"),
   containerMcp: resolveProxy("container-mcp"),

package/dist-server/server/account-signin.js

@@ -11,8 +11,6 @@
 // not expose the routes.
 import { resolveCompanionControlPlaneURL } from "../electron/companion-account-service.mjs";
 import { ControlPlaneError, createControlPlaneClient, normalizeAccountEmail } from "../electron/control-plane-client.mjs";
-export const ADMIN_EMAILS_ENV = "OMB_SIGNIN_EMAILS";
-export const MEMBER_EMAILS_ENV = "OMB_SIGNIN_MEMBER_EMAILS";
 /** Commas, spaces or newlines between entries; case does not matter. */
 export function parseAllowList(value) {
     return (value ?? "")

package/dist-server/server/activity.js

@@ -0,0 +1,201 @@
+// A bot's activity log: what it did, in plain words, with the outcome.
+//
+// Nothing here is captured for the log's sake. Two records already on disk
+// between them know everything a receipt needs: the per-thread runtime
+// events (harness/bus.ts) say what ran and whether it finished, and the
+// fleet-wide decision log (decision-log.ts) says what was asked, with which
+// arguments, and who allowed it. This module reads both back and folds
+// them into one row per thing that happened.
+//
+// Connector calls pass through the harness relay, whose approval and scope
+// decisions share the decision log. Read those alongside native tool runs.
+import { join } from "node:path";
+import { readDecisions } from "./decision-log.js";
+import { isRuntimeEvent, readRecentLines } from "./thread-events.js";
+/** Composio toolkit slugs whose display name is not just a capitalised word. */
+const TOOLKIT_NAMES = {
+    GMAIL: "Gmail",
+    GITHUB: "GitHub",
+    GOOGLESHEETS: "Google Sheets",
+    GOOGLECALENDAR: "Google Calendar",
+    GOOGLEDRIVE: "Google Drive",
+    GOOGLEDOCS: "Google Docs",
+    HUBSPOT: "HubSpot",
+    LINKEDIN: "LinkedIn",
+    YOUTUBE: "YouTube",
+    TWITTER: "X",
+    WHATSAPP: "WhatsApp",
+    ONEDRIVE: "OneDrive",
+};
+/** The agent's own built-in tools, phrased as what they did. */
+const BUILTIN_LABELS = {
+    Bash: "Ran a command",
+    Read: "Read a file",
+    Edit: "Edited a file",
+    MultiEdit: "Edited files",
+    Write: "Wrote a file",
+    Glob: "Searched files",
+    Grep: "Searched files",
+    LS: "Listed a folder",
+    WebSearch: "Searched the web",
+    WebFetch: "Fetched a page",
+    Skill: "Used a skill",
+    Task: "Ran a subagent",
+    Agent: "Ran a subagent",
+    AskUserQuestion: "Asked you a question",
+    TodoWrite: "Updated its task list",
+};
+/** "save_issue" → "Save issue", "TaskUpdate" → "Task update",
+ * "CREATE_AN_ISSUE" → "Create an issue". */
+function humanize(raw) {
+    const spaced = raw
+        .replace(/_+/g, " ")
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/\s+/g, " ")
+        .trim()
+        .toLowerCase();
+    return spaced ? spaced[0].toUpperCase() + spaced.slice(1) : raw;
+}
+function toolkitName(slug) {
+    return TOOLKIT_NAMES[slug] ?? slug[0] + slug.slice(1).toLowerCase();
+}
+/** Composio names its tools TOOLKIT_ACTION_WORDS, all upper case. */
+const COMPOSIO_TOOL = /^([A-Z][A-Z0-9]+)_([A-Z0-9_]+)$/;
+/** Turn a raw tool name into the app it touched and the action, in words. */
+export function describeTool(name) {
+    const builtin = BUILTIN_LABELS[name];
+    if (builtin)
+        return { app: null, label: builtin };
+    if (name.startsWith("mcp__")) {
+        const [, server = "", ...rest] = name.split("__");
+        const action = rest.join("__");
+        if (server === "composio")
+            return describeTool(action);
+        if (server === "computer")
+            return { app: "Computer", label: humanize(action) };
+        if (server === "agents")
+            return { app: "Team", label: humanize(action) };
+        if (server.startsWith("claude_ai_")) {
+            return { app: server.slice("claude_ai_".length).replace(/_/g, " "), label: humanize(action) };
+        }
+        return { app: humanize(server), label: humanize(action) };
+    }
+    const composio = COMPOSIO_TOOL.exec(name);
+    if (composio)
+        return { app: toolkitName(composio[1]), label: humanize(composio[2]) };
+    return { app: null, label: humanize(name) };
+}
+/** How many decision rows to read back before filtering to one bot. The
+ * file is rotation-capped, so this is a ceiling on parse work, not a
+ * window that quietly drops history. */
+const DECISION_SCAN = 20_000;
+/** Runtime events read per thread, newest first; the reader tail-walks. */
+const EVENTS_PER_THREAD = 2_000;
+/** An approval is folded into the tool run it unblocked when the run
+ * started inside this window around the decision. A verdict is written
+ * as the request opens; the run follows it, occasionally by a clock skew's
+ * worth in the other direction. */
+const MATCH_BEFORE_MS = 5_000;
+const MATCH_AFTER_MS = 30_000;
+const OUTCOME_OF_DECISION = {
+    "auto-approved": "allowed",
+    "auto-denied": "denied",
+    "user-approved": "allowed",
+    "review-would-approve": "allowed",
+    "user-denied": "denied",
+    "review-would-deny": "denied",
+    "card-shown": "waiting",
+};
+function describeRow(base) {
+    const { app, label } = describeTool(base.tool);
+    return { ...base, app, label };
+}
+/** One row per request: the decision log writes a row when a card is shown
+ * and another when it is answered, and the receipt wants the answer. */
+function foldDecisions(rows) {
+    const byRequest = new Map();
+    rows.forEach((row, index) => {
+        const key = row.requestId ?? `row:${index}`;
+        const group = byRequest.get(key);
+        if (group)
+            group.push(row);
+        else
+            byRequest.set(key, [row]);
+    });
+    const folded = [];
+    for (const group of byRequest.values()) {
+        const opened = group[0];
+        const latest = group[group.length - 1];
+        const summary = group.find((row) => row.summary)?.summary;
+        folded.push(describeRow({
+            at: opened.at,
+            threadId: opened.threadId,
+            requestId: opened.requestId,
+            tool: latest.tool ?? opened.tool ?? "unknown",
+            ...(summary ? { summary } : {}),
+            outcome: OUTCOME_OF_DECISION[latest.decision],
+        }));
+    }
+    return folded;
+}
+function readToolRuns(eventsDir, threadId) {
+    const { lines } = readRecentLines(join(eventsDir, `${threadId}.ndjson`), EVENTS_PER_THREAD, isRuntimeEvent);
+    const runs = new Map();
+    for (const event of lines) {
+        if (event.type === "item.started" && event.itemType === "tool") {
+            const key = JSON.stringify([event.turnId ?? "", event.itemId ?? event.eventId]);
+            runs.set(key, describeRow({
+                at: event.createdAt,
+                threadId,
+                ...(event.turnId ? { turnId: event.turnId } : {}),
+                tool: event.title ?? "unknown",
+                outcome: "running",
+            }));
+        }
+        else if (event.type === "item.completed" && event.itemType === "tool" && event.itemId) {
+            const run = runs.get(JSON.stringify([event.turnId ?? "", event.itemId]));
+            if (run)
+                run.outcome = event.ok ? "ran" : "failed";
+        }
+    }
+    return [...runs.values()];
+}
+/** The bot's activity, newest first: every tool run in the threads named,
+ * and every decision the broker logged for the bot, with an approval folded
+ * into the run it unblocked wherever the two can be matched. */
+export function readBotActivity(input) {
+    const { dataDir, eventsDir, botId, threadIds, limit } = input;
+    const runs = threadIds.flatMap((threadId) => readToolRuns(eventsDir, threadId));
+    const decisions = foldDecisions(readDecisions(dataDir, DECISION_SCAN).filter((row) => row.botId === botId));
+    const matched = new Set();
+    const rows = [...runs];
+    for (const decision of decisions) {
+        if (decision.outcome !== "allowed") {
+            rows.push(decision);
+            continue;
+        }
+        const askedAt = Date.parse(decision.at);
+        let best = null;
+        for (const run of runs) {
+            if (matched.has(run) || run.threadId !== decision.threadId || run.tool !== decision.tool)
+                continue;
+            const delta = Date.parse(run.at) - askedAt;
+            if (delta < -MATCH_BEFORE_MS || delta > MATCH_AFTER_MS)
+                continue;
+            if (!best || Math.abs(delta) < Math.abs(Date.parse(best.at) - askedAt))
+                best = run;
+        }
+        if (best) {
+            matched.add(best);
+            if (decision.summary)
+                best.summary = decision.summary;
+            if (decision.requestId)
+                best.requestId = decision.requestId;
+        }
+        else {
+            rows.push(decision);
+        }
+    }
+    rows.sort((a, b) => (a.at < b.at ? 1 : a.at > b.at ? -1 : 0));
+    return rows.slice(0, Math.max(1, limit));
+}

package/dist-server/server/admin-activity.js

@@ -20,16 +20,13 @@ import { appendFile, mkdir } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { actorLabel, boundRetentionDays, pruneMonthFiles } from "./decision-log.js";
 import { redactSecrets } from "./redact.js";
-import { csvCell } from "./usage-ledger.js";
+import { csvCell, monthKey } from "./usage-ledger.js";
 export const ADMIN_ACTIVITY_CATEGORIES = ["config", "people", "session", "webhook", "mcp", "engine", "bot", "budget", "visibility"];
 const DIR = "admin-activity";
 const MONTH_FILE = /^(\d{4})-(\d{2})\.ndjson$/;
 const PRUNE_EVERY_MS = 60 * 60_000;
 const writeQueues = new Map();
 const lastPrune = new Map();
-function monthKey(at) {
-    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
-}
 export function adminActivityFileFor(dataDir, at) {
     return join(dataDir, DIR, `${monthKey(at)}.ndjson`);
 }

package/dist-server/server/auto-approve.js

@@ -3,10 +3,13 @@
 // Nothing here decides whether an action is safe. Each approval level is a
 // provider's own permission mode passed straight through (Claude `auto`,
 // Grok `--permission-mode`, Codex `approvalsReviewer`, …), and a request that
-// reaches this process is one the provider left for a person. The only
-// grants the app applies are Full access and the person's exact saved commands.
-// Questions never come through here: a bot's question always reaches a human.
+// reaches this process is one the provider left for a person. The grants the
+// app applies are Full access and the person's exact saved commands. Approve
+// for me also allows a web search, and that is the one action the app itself
+// grants. Questions never come through here: a bot's question always reaches
+// a human.
 import { supportsApprovalMode } from "../shared/approval-mode.js";
+import { isOutboundTool } from "../shared/outbound.js";
 /** A failed delivery is a runtime error, not another permission decision.
  * An expired ask must never become a fresh Allow/Deny card. */
 export async function deliverFullAccessApproval(adapter, threadId, requestId, turnId, isCurrent = () => false) {
@@ -77,11 +80,19 @@ export function delegatedApprovalMode(input) {
 // produce an answer: the CLI runs the tool with none and the model is told
 // "The user did not answer the questions." — a question silently lost.
 const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user", "omb-ask"]);
+// A web search is a low-level read. Approve for me allows these names and
+// nothing wider: a bare search, a page fetch, and every other tool stay a
+// prompt. The name is the same shape as a question — one mcp__<server>__
+// prefix removed, then compared case-insensitively.
+const WEB_SEARCH = new Set(["websearch", "web_search", "web-search", "search_web"]);
+function bareToolName(tool) {
+    return tool.replace(/^mcp__[^_]+__/, "").toLowerCase();
+}
 export function autoVerdict(mode, tool, context) {
     // A question is for a person, whatever channel it arrived on — and
     // whatever the mode: even Full has no answer to give, only an approval
     // that would run the tool with none.
-    if (ASKS_A_PERSON.has(tool.replace(/^mcp__[^_]+__/, "").toLowerCase())) {
+    if (ASKS_A_PERSON.has(bareToolName(tool))) {
         return { approve: null, source: "no-grant" };
     }
     // Full's promise is literal: even a sandbox widening is approved. Entering
@@ -91,8 +102,15 @@ export function autoVerdict(mode, tool, context) {
         return { approve: `approved ${tool} (full access)`, source: "full-access" };
     if (context?.requiresExplicitApproval)
         return { approve: null, source: "explicit-approval-block" };
+    if (isOutboundTool(tool))
+        return { approve: null, source: "outbound-guard" };
     if (context?.commandAllowed)
         return { approve: `approved ${tool} (saved command)`, source: "command-allowlist" };
+    // The one action the app itself grants. A fetch of an arbitrary URL is not
+    // a search and stays a prompt, in this mode and every other.
+    if (mode === "auto" && WEB_SEARCH.has(bareToolName(tool))) {
+        return { approve: `approved ${tool} (web search)`, source: "web-search" };
+    }
     if (mode === "auto" || mode === "custom")
         return { approve: null, source: "native-approval" };
     return { approve: null, source: "no-grant" };
@@ -105,6 +123,7 @@ export function autoVerdict(mode, tool, context) {
  * the server keeps sending: cards saved before the key existed still render,
  * and so do the free-text apply errors that have no key at all. */
 export const HELD_NOTE = {
+    "approval.held.outbound": "This sends something on your behalf, so it always asks first.",
     "approval.held.native": "The provider requires your approval for this action.",
     "approval.held.sandbox": "This changes the provider sandbox, so only Full access can approve it automatically.",
     "approval.held.undeliveredFull": "Full access couldn't deliver this approval.",
@@ -115,6 +134,8 @@ export const HELD_NOTE = {
 export function approvalHeldNote(context) {
     if (!context.permission)
         return undefined;
+    if (context.source === "outbound-guard")
+        return "approval.held.outbound";
     if (context.source === "explicit-approval-block")
         return "approval.held.sandbox";
     if (context.source === "native-approval")

package/dist-server/server/automatic-recovery.js

@@ -7,7 +7,7 @@ export function recoveryCapabilityError(from, to) {
         supportsWorkspaceFiles(from.driverKind) !== supportsWorkspaceFiles(to.driverKind)) {
         return "The backup cannot use the same workspace.";
     }
-    const tools = ["agentsMcp", "computerMcp", "cloudComputerMcp", "composioMcp",
+    const tools = ["agentsMcp", "computerMcp", "composioMcp",
         "phoneMcp", "browserMcp", "localComputerMcp", "customMcp", "images"];
     if (tools.some(key => from.capabilities[key] === true && to.capabilities[key] !== true)) {
         return "The backup does not support all of this engine's tools and attachments.";

package/dist-server/server/boat-create-idempotency.js

@@ -388,13 +388,6 @@ export function resolveBoatCreate(request) {
         return { ...resolved };
     });
 }
-/** Read-only deletion guard. Both a key-only request with an ambiguous
- * provider outcome and a known-but-not-yet-named Boat must keep its bot owner. */
-export function hasUnresolvedBoatCreate(botId) {
-    if (!BOT_ID.test(botId))
-        throw new Error("invalid bot id for cloud computer creation");
-    return withJournalLock((requests) => (requests.some((request) => request.botId === botId && request.resolved !== true)));
-}
 /** Sanitized local recovery authority for configuration guards. The fresh,
  * lock-protected read can prove a remembered provider id even while the
  * account-wide LIST endpoint is eventually consistent. Provider request

package/dist-server/server/boat-delete-journal.js

@@ -442,7 +442,6 @@ export function markBoatDeletionBlocked(boxId, value) {
 export function boatDeletionSnapshot() {
     return withJournalLock((records) => records.map(clone));
 }
-export const listBoatDeletions = boatDeletionSnapshot;
 export function getBoatDeletion(boxId) {
     if (!BOAT_ID.test(boxId))
         throw new Error("invalid cloud computer id for deletion");
@@ -451,9 +450,6 @@ export function getBoatDeletion(boxId) {
         return record ? clone(record) : null;
     });
 }
-export function isBoatDeletionPending(boxId) {
-    return getBoatDeletion(boxId) !== null;
-}
 export function hasPendingBoatDeletionForBot(botId) {
     if (!BOT_ID.test(botId))
         throw new Error("invalid bot id for cloud computer deletion");

package/dist-server/server/boat.js

@@ -88,9 +88,7 @@ function scopedBoatPrefix() {
 }
 /** Decide lifecycle work before a turn mounts Boat. Auto may observe and
  * attach an already-ready Boat, but only explicit Cloud may create or wake. */
-export function boatTurnLifecycleAction({ explicitCloud, canMount, state, }) {
-    if (!canMount)
-        return "none";
+export function boatTurnLifecycleAction({ explicitCloud, state, }) {
     if (state && READY.has(state))
         return "attach";
     if (!explicitCloud)
@@ -828,7 +826,9 @@ export async function findBoat(cfg, botId) {
     if (cachedId) {
         let direct = null;
         try {
-            direct = await boatJson(cfg, `/boxes/${cachedId}`);
+            // Bounded like every other Boat read: a relay that accepts the
+            // connection and stalls must not hold a turn's setup for minutes.
+            direct = await boatJson(cfg, `/boxes/${cachedId}`, { signal: AbortSignal.timeout(20_000) });
         }
         catch {
             // A direct read can fail while the account listing still succeeds.

package/dist-server/server/bot-package.js

@@ -1,15 +1,11 @@
 import { stringify as stringifyYaml } from "yaml";
 import { cronScheduleLabel } from "../shared/cron-label.js";
-import { BOTMRR_MARKDOWN_VERSION, isPackageDocument, PACKAGE_FORMAT, PACKAGE_V1_MAX_SKILLS, PACKAGE_V1_VERSION, parsePackageV1, utf8Bytes, } from "../shared/package-format.js";
+import { BOTMRR_MARKDOWN_VERSION, isPackageDocument, PACKAGE_V1_MAX_SKILLS, parsePackageV1, utf8Bytes, } from "../shared/package-format.js";
 // The package file format (v1 and v2) lives in shared/package-format.ts: one
 // validation gate for the server, the renderer and Admin. This module keeps
 // the v1 names the v1 exporter and its Markdown playbook are written in, and
 // re-exports the v2 reader so server code has one place to import from.
 export { canonicalJson, downgradeToV1, PACKAGE_MAX_BYTES, PACKAGE_VERSION, PackageFormatError, packageKeys, packageScanFindings, packageSecretFindings, packageSummary, parsePackageDocument, redactPackageSecrets, upgradeV1, } from "../shared/package-format.js";
-export const BOT_PACKAGE_FORMAT = PACKAGE_FORMAT;
-export const BOT_PACKAGE_VERSION = PACKAGE_V1_VERSION;
-export { BOTMRR_MARKDOWN_VERSION };
-export const BOT_PACKAGE_SKILLS_VERSION = 1;
 export const BOT_PACKAGE_MAX_SKILLS = PACKAGE_V1_MAX_SKILLS;
 const BOT_PACKAGE_MARKDOWN_MAX_BYTES = 1_000_000;
 export function isBotPackage(value) {
@@ -98,17 +94,3 @@ export function renderBotPackageMarkdown(document) {
         throw new Error("The bot playbook is too large");
     return markdown;
 }
-export function packageAgentAsMember(agent) {
-    return {
-        key: agent.key,
-        name: agent.name,
-        title: agent.title ?? "",
-        description: agent.description ?? "",
-        ...(agent.soul !== undefined ? { soul: agent.soul } : {}),
-        appearance: {
-            color: agent.appearance.color,
-            ...(agent.appearance.mascotExpression ? { mascotExpression: agent.appearance.mascotExpression } : {}),
-            ...(agent.appearance.mascotBody ? { mascotBody: agent.appearance.mascotBody } : {}),
-        },
-    };
-}

package/dist-server/server/browser-runtime.js

@@ -216,8 +216,7 @@ export class BrowserRuntime {
     options;
     closeBrowser;
     constructor({ closeBrowser, ...options } = {}) {
-        const budget = Number(process.env.OMB_BROWSER_RESULT_BUDGET);
-        this.options = { requestTimeoutMs: 120_000, takeoverTimeoutMs: 15_000, idleMs: 60_000, maxPending: 16, resultBudget: Number.isFinite(budget) && budget > 0 ? budget : DEFAULT_BROWSER_RESULT_BUDGET, ...options };
+        this.options = { requestTimeoutMs: 120_000, takeoverTimeoutMs: 15_000, idleMs: 60_000, maxPending: 16, resultBudget: DEFAULT_BROWSER_RESULT_BUDGET, ...options };
         this.closeBrowser = closeBrowser ?? (async () => false);
     }
     gate(session) {