openmausbot 0.1.94 → 0.1.96

package/dist-server/server/tightening-requests.js

@@ -1,435 +0,0 @@
-// propose_tightening: a bot (or a Chief for a section peer) proposes an
-// authority REDUCTION through a human-confirmed card. Same shape as
-// profile-requests.ts: everything is re-validated at confirm time — a card
-// can sit open for days, so the direction is checked against live state
-// again and the revision (a hash of the touched authority surface) must
-// still match. Escalation is inexpressible in the payload and rejected by
-// the validator; restoring authority stays owner-only in Edit Profile.
-import { createHash } from "node:crypto";
-import { z } from "zod";
-import { approvalModeFor } from "../shared/approval-mode.js";
-import { TIGHTENING_MODE_TARGETS, validateTightening, } from "../shared/tightening-request.js";
-import { newId } from "./contracts.js";
-import { recordAuthorityChange } from "./profile-versions.js";
-import { redactSecretsInText } from "./redact.js";
-const MAX_REASON = 500;
-const STALE = "This bot's authority changed after this card was prepared. Ask the bot to review it and propose again.";
-const NO_SUCH_BOT = "That bot no longer exists";
-const CHOOSE_ONE = "Choose at least one tightening intent: approvalMode, composio, browser, approvePeerComms, alwaysAllow, mcpServers, skills";
-const INTENT_KEYS = [
-    "approvalMode",
-    "composio",
-    "browser",
-    "approvePeerComms",
-    "alwaysAllow",
-    "mcpServers",
-    "skills",
-];
-/** Direction is enforced by shape first: the payload cannot name "full" or
- * "custom" as a target, cannot ask to switch composio/browser back on, and
- * the list fields only carry removals. The state-relative remainder (an
- * upward move inside ask/edits/auto, a grant not currently held) is checked
- * by validateTightening against live state at propose and confirm. */
-const intentsSchema = z.object({
-    approvalMode: z.enum(TIGHTENING_MODE_TARGETS, {
-        error: 'approvalMode may only be proposed as "ask", "edits", or "auto"; full and custom stay owner-only',
-    }).optional(),
-    composio: z.literal(false, { error: "composio may only be turned off" }).optional(),
-    browser: z.literal(false, { error: "browser may only be turned off" }).optional(),
-    approvePeerComms: z.literal(true, { error: "approvePeerComms may only be turned on" }).optional(),
-    alwaysAllow: z.array(z.string().min(1).max(200)).max(200).optional(),
-    mcpServers: z.array(z.string().min(1).max(200)).max(100).optional(),
-    skills: z.array(z.string().min(1).max(100)).max(100).optional(),
-});
-export class TighteningRequestError extends Error {
-    status;
-    constructor(message, status = 400) {
-        super(message);
-        this.name = "TighteningRequestError";
-        this.status = status;
-    }
-}
-function reasonText(value) {
-    if (typeof value !== "string")
-        throw new TighteningRequestError("reason is required");
-    const trimmed = value.trim();
-    if (!trimmed)
-        throw new TighteningRequestError("reason is required");
-    if (trimmed.length > MAX_REASON) {
-        throw new TighteningRequestError(`reason must be ${MAX_REASON} characters or fewer`);
-    }
-    return redactSecretsInText(trimmed);
-}
-function parseIntents(input) {
-    if (typeof input !== "object" || input === null || Array.isArray(input)) {
-        throw new TighteningRequestError(CHOOSE_ONE);
-    }
-    const record = input;
-    for (const key of Object.keys(record)) {
-        if (!INTENT_KEYS.includes(key)) {
-            throw new TighteningRequestError(`unsupported tightening field: ${key}`);
-        }
-    }
-    const parsed = intentsSchema.safeParse(input);
-    if (!parsed.success) {
-        throw new TighteningRequestError(parsed.error.issues[0]?.message ?? CHOOSE_ONE);
-    }
-    const intents = parsed.data;
-    // Copy through only the keys the caller sent, so "did this card touch
-    // approvalMode" stays answerable from the payload alone.
-    const present = {};
-    if (record.approvalMode !== undefined)
-        present.approvalMode = intents.approvalMode;
-    if (record.composio !== undefined)
-        present.composio = intents.composio;
-    if (record.browser !== undefined)
-        present.browser = intents.browser;
-    if (record.approvePeerComms !== undefined)
-        present.approvePeerComms = intents.approvePeerComms;
-    if (record.alwaysAllow !== undefined)
-        present.alwaysAllow = intents.alwaysAllow;
-    if (record.mcpServers !== undefined)
-        present.mcpServers = intents.mcpServers;
-    if (record.skills !== undefined)
-        present.skills = intents.skills;
-    if (Object.keys(present).length === 0)
-        throw new TighteningRequestError(CHOOSE_ONE);
-    return present;
-}
-/** The card revision: a hash of exactly the authority surface a tightening
- * can touch, plus the private receipt (an older, interrupted card cannot
- * apply twice). Sorted lists so an unrelated reorder is not a false stale. */
-export function tighteningRevision(state, lastTighteningRequestId = "") {
-    return createHash("sha256")
-        .update(JSON.stringify({
-        approvalMode: state.approvalMode,
-        composio: state.composio,
-        browser: state.browser,
-        approvePeerComms: state.approvePeerComms,
-        alwaysAllow: [...state.alwaysAllow].sort(),
-        mcpServers: [...state.mcpServers].sort(),
-        skills: [...state.skills].sort(),
-        lastTighteningRequestId,
-    }), "utf8")
-        .digest("hex");
-}
-export function tighteningSnapshot(bot, extras) {
-    return {
-        approvalMode: approvalModeFor(bot),
-        composio: bot.composio !== false,
-        browser: bot.browser !== false,
-        approvePeerComms: bot.approvePeerComms === true,
-        alwaysAllow: bot.alwaysAllow ?? [],
-        mcpServers: extras.mcpServers ?? [...(bot.mcpServers ?? [])],
-        skills: extras.skills ?? [],
-    };
-}
-/** Minimal card copy: the judged facts (field, before, after, names) plus
- * the standing rule that only the owner can grant authority back. */
-export function tighteningCardCopy(target, before, intents, reason) {
-    const checked = validateTightening(before, intents);
-    const after = checked.ok ? checked.after : before;
-    const title = target.crossBot ? `Tighten @${target.name}'s permissions?` : `Tighten ${target.name}'s permissions?`;
-    const lines = target.crossBot ? [`Whose permissions: @${target.name}`, `Why: ${reason}`] : [`Why: ${reason}`];
-    if (intents.approvalMode !== undefined)
-        lines.push(`Approvals: ${before.approvalMode} → ${intents.approvalMode}`);
-    if (intents.composio !== undefined)
-        lines.push("Connected apps: on → off");
-    if (intents.browser !== undefined)
-        lines.push("Browser: on → off");
-    if (intents.approvePeerComms !== undefined)
-        lines.push("Peer contact: no approval → ask first");
-    if (intents.alwaysAllow?.length)
-        lines.push(removalLine("Always-allow grants", "removed", before.alwaysAllow, after.alwaysAllow));
-    if (intents.mcpServers?.length)
-        lines.push(removalLine("MCP servers", "unmounted", before.mcpServers, after.mcpServers));
-    if (intents.skills?.length)
-        lines.push(removalLine("Skills", "disabled", before.skills, after.skills));
-    lines.push(`This reduces ${target.name}'s authority, and the reverse cannot be proposed back.`);
-    const fields = INTENT_KEYS.filter((key) => intents[key] !== undefined);
-    return { title, summary: `${title} · ${fields.join(", ")}`, detail: lines.join("\n") };
-}
-const REMOVED_NAME_CAP = 5;
-/** One line per list field with the counts on both sides and the exact
- * names that go away, capped with a count so a wide card still reads in
- * one pass while the human approves precisely what disappears. */
-function removalLine(label, verb, before, after) {
-    const removed = before.filter((name) => !after.includes(name));
-    const shown = removed.slice(0, REMOVED_NAME_CAP);
-    const more = removed.length - shown.length;
-    const names = shown.join(", ") + (more > 0 ? ` (+${more} more)` : "");
-    return `${label}: ${before.length} → ${after.length} — ${verb}: ${names}`;
-}
-export class TighteningRequestService {
-    store;
-    now;
-    canPersist;
-    autoApply;
-    mountedMcpServers;
-    enabledSkills;
-    disableSkill;
-    targetBusy;
-    /** Public: a caller's section membership can change between propose and
-     * confirm, and tests flip this mid-scenario to model that. */
-    validateTarget;
-    constructor(options) {
-        this.store = options.store;
-        this.now = options.now ?? Date.now;
-        this.canPersist = options.canPersist;
-        this.autoApply = options.autoApply;
-        this.mountedMcpServers = options.mountedMcpServers;
-        this.enabledSkills = options.enabledSkills;
-        this.disableSkill = options.disableSkill;
-        this.targetBusy = options.targetBusy;
-        this.validateTarget = options.validateTarget;
-    }
-    snapshotOf(bot) {
-        return tighteningSnapshot(bot, {
-            mcpServers: this.mountedMcpServers?.(bot),
-            skills: this.enabledSkills?.(bot.id) ?? [],
-        });
-    }
-    /** Disable every named skill, or report the first failure together with
-     * the names still outstanding. Shared by the fresh apply and the
-     * receipt-backed retry so both leave the same trail. */
-    applySkillDisables(botId, names) {
-        for (let index = 0; index < names.length; index += 1) {
-            const disabled = this.disableSkill(botId, names[index]);
-            if (!disabled.ok)
-                return { ok: false, error: disabled.error, outstanding: names.slice(index) };
-        }
-        return { ok: true };
-    }
-    propose(args) {
-        return this.prepare(args);
-    }
-    submit(args) {
-        const proposal = this.prepare(args, true);
-        return { ...proposal, state: proposal.result ? "applied" : "pending" };
-    }
-    prepare(args, submitted = false) {
-        const reason = reasonText(args.reason);
-        const intents = parseIntents(args.intents);
-        const targetBotId = args.targetBotId ?? args.botId;
-        const target = this.store.bot(targetBotId);
-        if (!target)
-            throw new TighteningRequestError(NO_SUCH_BOT, 404);
-        const crossBot = targetBotId !== args.botId;
-        if (crossBot && this.validateTarget) {
-            const refusal = this.validateTarget(args.botId, targetBotId);
-            if (refusal)
-                throw new TighteningRequestError(refusal, 403);
-        }
-        const before = this.snapshotOf(target);
-        const checked = validateTightening(before, intents);
-        if (!checked.ok)
-            throw new TighteningRequestError(checked.error, 400);
-        const requestId = newId();
-        const targetName = redactSecretsInText(target.name);
-        const payload = {
-            version: 1,
-            requestId,
-            botId: args.botId,
-            threadId: args.threadId,
-            targetBotId,
-            targetName,
-            createdAt: this.now(),
-            reason,
-            intents,
-            before,
-            expectedRevision: tighteningRevision(before, target.lastTighteningRequestId),
-        };
-        const copy = tighteningCardCopy({ name: targetName, crossBot }, before, intents, reason);
-        const persistence = this.canPersist?.(args.botId, args.threadId);
-        if (persistence && !persistence.ok) {
-            throw new TighteningRequestError(persistence.error, persistence.status);
-        }
-        const automatic = submitted && this.autoApply?.(args.botId, args.threadId) === true;
-        const messageInput = {
-            role: "bot",
-            kind: "options",
-            card: {
-                title: copy.title,
-                subtitle: copy.detail,
-                options: automatic ? [] : ["Confirm", "Cancel"],
-                ...(automatic ? { dismissed: true } : {}),
-                requestId,
-                tool: "tighten_permissions",
-                tighteningRequest: payload,
-            },
-        };
-        if (args.from)
-            messageInput.from = args.from;
-        const message = this.store.appendMessage(args.threadId, messageInput);
-        const proposal = { requestId, messageId: message.id, title: copy.title, summary: copy.summary, detail: copy.detail };
-        if (!automatic)
-            return proposal;
-        // The hidden receipt is persisted before the authority changes. The same
-        // validation and durable commit marker serve both automatic and human decisions.
-        const result = this.resolve({ botId: args.botId, threadId: args.threadId, requestId, behavior: "allow" });
-        if (result.state === "applied")
-            return { ...proposal, result };
-        throw new TighteningRequestError(result.state === "invalid" ? result.error : "The tightening could not be applied", result.state === "invalid" ? result.status : 409);
-    }
-    /** Claims a tightening card even after it was settled, so a duplicate
-     * click never re-applies an already-applied reduction. */
-    resolve(args) {
-        const message = this.store
-            .messagesFor(args.threadId)
-            .find((candidate) => candidate.card?.requestId === args.requestId && candidate.card.tighteningRequest);
-        const card = message?.card;
-        const payload = card?.tighteningRequest;
-        if (!message || !card || !payload)
-            return { claimed: false, state: "not_found" };
-        if (payload.requestId !== card.requestId) {
-            return { claimed: true, state: "invalid", error: "This tightening request does not match its card", status: 409 };
-        }
-        if (args.behavior !== "allow" && args.behavior !== "deny") {
-            return { claimed: true, state: "invalid", error: "Tightening confirmations must be confirmed or cancelled", status: 400 };
-        }
-        if (payload.botId !== args.botId || payload.threadId !== args.threadId) {
-            return { claimed: true, state: "invalid", error: "This tightening request belongs to another conversation", status: 403 };
-        }
-        if (card.answered)
-            return { claimed: true, state: "already_settled", behavior: card.answered };
-        let emergency = false;
-        let outstandingSkills = [];
-        try {
-            const target = this.store.bot(payload.targetBotId);
-            // The authority change and receipt share one durable write. If saving
-            // the card failed afterward, a retry only settles it; it never
-            // reapplies authority — but it does finish any skills a failed
-            // attempt left enabled, so a partial disable can never strand the card.
-            if (target?.lastTighteningRequestId === payload.requestId) {
-                const enabled = new Set(this.enabledSkills?.(payload.targetBotId) ?? []);
-                const remaining = (payload.intents.skills ?? []).filter((name) => enabled.has(name));
-                if (remaining.length && !this.disableSkill) {
-                    throw new TighteningRequestError("Skill changes are not available in this workspace", 400);
-                }
-                const finished = this.applySkillDisables(payload.targetBotId, remaining);
-                if (!finished.ok) {
-                    outstandingSkills = finished.outstanding;
-                    throw new TighteningRequestError(finished.error, 409);
-                }
-                const settled = this.store.patchMessage(args.threadId, message.id, {
-                    card: { ...card, answered: "allow", held: undefined, tighteningRequest: { ...payload, appliedAt: payload.appliedAt ?? this.now() } },
-                });
-                if (!settled)
-                    throw new TighteningRequestError("This tightening confirmation card is no longer available", 409);
-                // The first attempt committed the authority change and the durable
-                // receipt, then died before it could settle the card or record
-                // history. This retry settles the card, so it also writes the row
-                // that attempt never reached — from the card's own frozen inputs,
-                // never the live bot: the revision guard proved live state equaled
-                // payload.before at apply, so the validated post-card state is the
-                // committed change, while a live snapshot could fold in later owner
-                // edits and attribute them to this card.
-                const recorded = validateTightening(payload.before, payload.intents);
-                if (recorded.ok) {
-                    recordAuthorityChange(payload.targetBotId, "bot", `card:${message.id}`, payload.before, recorded.after);
-                }
-                return { claimed: true, state: "already_settled", behavior: "allow" };
-            }
-            if (args.behavior === "deny") {
-                this.store.patchMessage(args.threadId, message.id, { card: { ...card, answered: "deny", held: undefined } });
-                return { claimed: true, state: "denied" };
-            }
-            if (!target)
-                throw new TighteningRequestError(NO_SUCH_BOT, 404);
-            const crossBot = payload.targetBotId !== payload.botId;
-            if (crossBot && this.validateTarget) {
-                const refusal = this.validateTarget(payload.botId, payload.targetBotId);
-                if (refusal)
-                    throw new TighteningRequestError(refusal, 404);
-            }
-            const current = this.snapshotOf(target);
-            if (tighteningRevision(current, target.lastTighteningRequestId) !== payload.expectedRevision) {
-                throw new TighteningRequestError(STALE, 409);
-            }
-            // Direction is re-validated against live state, not trusted from the
-            // card: a card that sat open can only ever apply a reduction.
-            const checked = validateTightening(current, payload.intents);
-            if (!checked.ok)
-                throw new TighteningRequestError(checked.error, 409);
-            emergency = payload.intents.approvalMode !== undefined &&
-                (current.approvalMode === "full" || current.approvalMode === "custom") &&
-                payload.intents.approvalMode === "ask";
-            if (this.targetBusy?.(target.id) && !emergency) {
-                if (payload.intents.approvalMode !== undefined) {
-                    throw new TighteningRequestError("Stop this bot's turn before changing its approval level", 409);
-                }
-                if (payload.intents.mcpServers !== undefined) {
-                    throw new TighteningRequestError("Stop this bot's turns before changing its MCP servers", 409);
-                }
-            }
-            // The capability check runs before any mutation: a workspace that
-            // cannot touch skills must not half-apply the card.
-            if (payload.intents.skills?.length && !this.disableSkill) {
-                throw new TighteningRequestError("Skill changes are not available in this workspace", 400);
-            }
-            const patch = { lastTighteningRequestId: payload.requestId };
-            if (payload.intents.approvalMode !== undefined) {
-                patch.approvalMode = payload.intents.approvalMode;
-                patch.autoApprove = payload.intents.approvalMode === "auto";
-                patch.approvalGrant = undefined;
-            }
-            if (payload.intents.composio !== undefined)
-                patch.composio = false;
-            if (payload.intents.browser !== undefined)
-                patch.browser = false;
-            if (payload.intents.approvePeerComms !== undefined)
-                patch.approvePeerComms = true;
-            if (payload.intents.alwaysAllow !== undefined)
-                patch.alwaysAllow = [...checked.after.alwaysAllow];
-            if (payload.intents.mcpServers !== undefined)
-                patch.mcpServers = [...checked.after.mcpServers];
-            if (!this.store.patchBot(target.id, patch))
-                throw new TighteningRequestError(NO_SUCH_BOT, 404);
-            // Skills disable AFTER the receipt write. Each disable persists on
-            // its own, so a failure midway can leave part of the list done — but
-            // the receipt is already durable, which turns every retry into the
-            // branch above: finish the remainder, never reapply authority, and
-            // never leave the card permanently stale.
-            const skills = this.applySkillDisables(target.id, payload.intents.skills ?? []);
-            if (!skills.ok) {
-                outstandingSkills = skills.outstanding;
-                throw new TighteningRequestError(skills.error, 409);
-            }
-            const appliedAt = this.now();
-            const settled = this.store.patchMessage(args.threadId, message.id, {
-                card: { ...card, answered: "allow", held: undefined, tighteningRequest: { ...payload, appliedAt } },
-            });
-            if (!settled)
-                throw new TighteningRequestError("This tightening confirmation card is no longer available", 409);
-            // Same audit trail as a profile card: the proposing bot is the actor,
-            // the card id is the via, and the rows land in the one History section
-            // manual edits already write to. Fire-and-forget like every history row.
-            recordAuthorityChange(payload.targetBotId, "bot", `card:${message.id}`, current, checked.after);
-            const fields = INTENT_KEYS.filter((key) => payload.intents[key] !== undefined);
-            return { claimed: true, state: "applied", targetBotId: target.id, fields, ...(emergency ? { emergencyStop: true } : {}) };
-        }
-        catch (error) {
-            const status = error instanceof TighteningRequestError ? error.status : 400;
-            const detail = error instanceof Error ? error.message : String(error);
-            const saved = this.store.bot(payload.targetBotId)?.lastTighteningRequestId === payload.requestId;
-            const notice = outstandingSkills.length
-                ? `Permissions tightened. Confirm again to finish disabling: ${redactSecretsInText(outstandingSkills.join(", "))}`
-                : card.dismissed && card.options.length === 0
-                    ? "Permissions tightened. Recording the operation receipt could not finish; the changes will not be applied again."
-                    : "Permissions tightened. Confirm again to finish recording this decision; the changes will not be applied again.";
-            try {
-                this.store.patchMessage(args.threadId, message.id, {
-                    card: { ...card, held: saved ? notice : redactSecretsInText(detail).slice(0, 500) },
-                });
-            }
-            catch { /* The durable receipt still permits a safe retry. */ }
-            if (saved)
-                return {
-                    claimed: true, state: "applied", targetBotId: payload.targetBotId,
-                    fields: INTENT_KEYS.filter((key) => payload.intents[key] !== undefined),
-                    ...(emergency ? { emergencyStop: true } : {}),
-                };
-            return { claimed: true, state: "invalid", error: detail, status };
-        }
-    }
-}

package/dist-server/shared/tightening-request.js

@@ -1,87 +0,0 @@
-/**
- * Durable payload carried by a tightening card (propose_tightening).
- *
- * Authority reductions a bot may propose for itself or (for a Chief) a
- * section peer. Direction is enforced by shape: the intents cannot express
- * an escalation — approvalMode targets stop below full and custom, the
- * booleans only carry their tightening value, and the list fields only
- * carry removals. `validateTightening` then checks the remaining
- * state-relative direction (an upward move inside ask/edits/auto, a grant
- * that is not currently held) against live bot state, at propose AND again
- * at confirm, so a card that sat open can never apply a transition that
- * stopped being a reduction. Escalation stays human-only in Edit Profile.
- */
-import { APPROVAL_MODES } from "./approval-mode.js";
-/** Targets a proposal may name. "full" and "custom" are owner-only. */
-export const TIGHTENING_MODE_TARGETS = ["ask", "edits", "auto"];
-/** Direction check against live state. Pure: the caller supplies the
- * snapshot, at propose and again at confirm. Every rejection names the
- * field and the allowed direction. */
-export function validateTightening(before, intents) {
-    const after = {
-        ...before,
-        alwaysAllow: [...before.alwaysAllow],
-        mcpServers: [...before.mcpServers],
-        skills: [...before.skills],
-    };
-    if (intents.approvalMode !== undefined) {
-        const to = intents.approvalMode;
-        const from = before.approvalMode;
-        const reduces = from === "custom"
-            ? to === "ask"
-            : APPROVAL_MODES.indexOf(to) < APPROVAL_MODES.indexOf(from);
-        if (!reduces) {
-            return {
-                ok: false,
-                error: `approvalMode can only tighten: down the selector order (ask, edits, auto, full), or custom to ask. "${to}" does not reduce "${from}".`,
-            };
-        }
-        after.approvalMode = to;
-    }
-    if (intents.composio !== undefined) {
-        if (!before.composio)
-            return { ok: false, error: "composio is already off; it may only be turned off" };
-        after.composio = false;
-    }
-    if (intents.browser !== undefined) {
-        if (!before.browser)
-            return { ok: false, error: "browser is already off; it may only be turned off" };
-        after.browser = false;
-    }
-    if (intents.approvePeerComms !== undefined) {
-        if (before.approvePeerComms)
-            return { ok: false, error: "approvePeerComms is already on; it may only be turned on" };
-        after.approvePeerComms = true;
-    }
-    if (intents.alwaysAllow !== undefined) {
-        const removals = [...new Set(intents.alwaysAllow)];
-        if (!removals.length)
-            return { ok: false, error: "alwaysAllow must name at least one grant to remove" };
-        const unknown = removals.filter((key) => !before.alwaysAllow.includes(key));
-        if (unknown.length) {
-            return { ok: false, error: `alwaysAllow entries may only be removed, never added; not currently granted: ${unknown.join(", ")}` };
-        }
-        after.alwaysAllow = before.alwaysAllow.filter((key) => !removals.includes(key));
-    }
-    if (intents.mcpServers !== undefined) {
-        const removals = [...new Set(intents.mcpServers)];
-        if (!removals.length)
-            return { ok: false, error: "mcpServers must name at least one server to unmount" };
-        const unknown = removals.filter((name) => !before.mcpServers.includes(name));
-        if (unknown.length) {
-            return { ok: false, error: `mcpServers may only unmount servers this bot currently mounts; not mounted: ${unknown.join(", ")}` };
-        }
-        after.mcpServers = before.mcpServers.filter((name) => !removals.includes(name));
-    }
-    if (intents.skills !== undefined) {
-        const removals = [...new Set(intents.skills)];
-        if (!removals.length)
-            return { ok: false, error: "skills must name at least one skill to disable" };
-        const unknown = removals.filter((name) => !before.skills.includes(name));
-        if (unknown.length) {
-            return { ok: false, error: `skills may only be disabled, never enabled; not currently enabled: ${unknown.join(", ")}` };
-        }
-        after.skills = before.skills.filter((name) => !removals.includes(name));
-    }
-    return { ok: true, after };
-}