openmausbot 0.1.95 → 0.1.97

package/dist-server/permission-proxy.js

@@ -8,7 +8,6 @@ var MAX_OPTIONS = 12;
 var MAX_QUESTION_TEXT = 8e3;
 var MAX_LABEL = 120;
 var MAX_DESCRIPTION = 400;
-var MAX_CUSTOM_ANSWER = 2e3;
 function text(value, limit) {
   if (typeof value !== "string") return void 0;
   const trimmed = value.trim();
@@ -60,9 +59,6 @@ function parseAskQuestions(input) {
   }
   return questions.length ? questions : null;
 }
-var OMB_ASK_FENCE = /(^|\n)[ \t]{0,3}(`{3,}|~{3,})[ \t]*omb-ask[ \t]*\r?\n([\s\S]*?)\r?\n[ \t]{0,3}\2[ \t]*(?=\r?\n|$)/;
-var OMB_ASK_FENCE_GLOBAL = new RegExp(OMB_ASK_FENCE.source, OMB_ASK_FENCE.flags + "g");
-var MAX_ANSWER_ECHO = 6 * MAX_CUSTOM_ANSWER;
 function questionAnswersByQuestion(message, questions) {
   return questionAnswersById(message, questions.map((question) => ({ id: question.question, question })));
 }

package/dist-server/server/admin-activity.js

@@ -20,16 +20,13 @@ import { appendFile, mkdir } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { actorLabel, boundRetentionDays, pruneMonthFiles } from "./decision-log.js";
 import { redactSecrets } from "./redact.js";
-import { csvCell } from "./usage-ledger.js";
+import { csvCell, monthKey } from "./usage-ledger.js";
 export const ADMIN_ACTIVITY_CATEGORIES = ["config", "people", "session", "webhook", "mcp", "engine", "bot", "budget", "visibility"];
 const DIR = "admin-activity";
 const MONTH_FILE = /^(\d{4})-(\d{2})\.ndjson$/;
 const PRUNE_EVERY_MS = 60 * 60_000;
 const writeQueues = new Map();
 const lastPrune = new Map();
-function monthKey(at) {
-    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
-}
 export function adminActivityFileFor(dataDir, at) {
     return join(dataDir, DIR, `${monthKey(at)}.ndjson`);
 }

package/dist-server/server/auto-approve.js

@@ -3,9 +3,11 @@
 // Nothing here decides whether an action is safe. Each approval level is a
 // provider's own permission mode passed straight through (Claude `auto`,
 // Grok `--permission-mode`, Codex `approvalsReviewer`, …), and a request that
-// reaches this process is one the provider left for a person. The only
-// grants the app applies are Full access and the person's exact saved commands.
-// Questions never come through here: a bot's question always reaches a human.
+// reaches this process is one the provider left for a person. The grants the
+// app applies are Full access and the person's exact saved commands. Approve
+// for me also allows a web search, and that is the one action the app itself
+// grants. Questions never come through here: a bot's question always reaches
+// a human.
 import { supportsApprovalMode } from "../shared/approval-mode.js";
 import { isOutboundTool } from "../shared/outbound.js";
 /** A failed delivery is a runtime error, not another permission decision.
@@ -77,12 +79,20 @@ export function delegatedApprovalMode(input) {
 // the permission path in permission-proxy). Approving it there does not
 // produce an answer: the CLI runs the tool with none and the model is told
 // "The user did not answer the questions." — a question silently lost.
-const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user", "omb-ask"]);
+const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user"]);
+// A web search is a low-level read. Approve for me allows these names and
+// nothing wider: a bare search, a page fetch, and every other tool stay a
+// prompt. The name is the same shape as a question — one mcp__<server>__
+// prefix removed, then compared case-insensitively.
+const WEB_SEARCH = new Set(["websearch", "web_search", "web-search", "search_web"]);
+function bareToolName(tool) {
+    return tool.replace(/^mcp__[^_]+__/, "").toLowerCase();
+}
 export function autoVerdict(mode, tool, context) {
     // A question is for a person, whatever channel it arrived on — and
     // whatever the mode: even Full has no answer to give, only an approval
     // that would run the tool with none.
-    if (ASKS_A_PERSON.has(tool.replace(/^mcp__[^_]+__/, "").toLowerCase())) {
+    if (ASKS_A_PERSON.has(bareToolName(tool))) {
         return { approve: null, source: "no-grant" };
     }
     // Full's promise is literal: even a sandbox widening is approved. Entering
@@ -96,6 +106,11 @@ export function autoVerdict(mode, tool, context) {
         return { approve: null, source: "outbound-guard" };
     if (context?.commandAllowed)
         return { approve: `approved ${tool} (saved command)`, source: "command-allowlist" };
+    // The one action the app itself grants. A fetch of an arbitrary URL is not
+    // a search and stays a prompt, in this mode and every other.
+    if (mode === "auto" && WEB_SEARCH.has(bareToolName(tool))) {
+        return { approve: `approved ${tool} (web search)`, source: "web-search" };
+    }
     if (mode === "auto" || mode === "custom")
         return { approve: null, source: "native-approval" };
     return { approve: null, source: "no-grant" };

package/dist-server/server/auto-vm-claims.js

@@ -18,6 +18,18 @@ export function startAutoVmClaim(table, threadId, generation) {
     slot.begin = slot.claim().then(() => { slot.claimed = true; }, (error) => {
         slot.failed = true;
         slot.failure = error instanceof Error ? error.message : String(error);
-        slot.onRejected?.(slot.failure);
+        slot.onRejected?.(slot.failure, error);
     });
 }
+/** How long a computer call should wait on its thread's lazy claim, or null
+ * when it should not wait: the first call waits while the claim it fires
+ * lands; a slow claim (graceMs) is waited on by every call until it settles. */
+export function lazyClaimWaitMs(slot, defaultGraceMs) {
+    if (!slot?.lazy)
+        return null;
+    if (!slot.begin)
+        return slot.graceMs ?? defaultGraceMs;
+    if (slot.graceMs !== undefined && !slot.claimed && !slot.failed)
+        return slot.graceMs;
+    return null;
+}

package/dist-server/server/automatic-recovery.js

@@ -3,8 +3,7 @@ import { supportsWorkspaceFiles } from "./workspace.js";
  * its filesystem to another machine. Approval and organisation policy are
  * checked by the ordinary model-switch and turn-admission gates. */
 export function recoveryCapabilityError(from, to) {
-    if (from.capabilities.remoteAgent || to.capabilities.remoteAgent ||
-        supportsWorkspaceFiles(from.driverKind) !== supportsWorkspaceFiles(to.driverKind)) {
+    if (supportsWorkspaceFiles(from.driverKind) !== supportsWorkspaceFiles(to.driverKind)) {
         return "The backup cannot use the same workspace.";
     }
     const tools = ["agentsMcp", "computerMcp", "composioMcp",

package/dist-server/server/boat.js

@@ -86,15 +86,12 @@ function scopedBoatPrefix() {
     scopedBoatPrefixCache = `ogb-${scope}-`;
     return scopedBoatPrefixCache;
 }
-/** Decide lifecycle work before a turn mounts Boat. Auto may observe and
- * attach an already-ready Boat, but only explicit Cloud may create or wake. */
-export function boatTurnLifecycleAction({ explicitCloud, canMount, state, }) {
-    if (!canMount)
-        return "none";
+/** Decide lifecycle work before a turn mounts Boat. Only a turn whose place
+ * is Cloud gets here (Auto never reads the Boat account), so a missing Boat
+ * is created and a sleeping one woken. */
+export function boatTurnLifecycleAction(state) {
     if (state && READY.has(state))
         return "attach";
-    if (!explicitCloud)
-        return "none";
     return state ? "wake" : "provision";
 }
 /** Keep one provider account for the whole logical operation. Settings may
@@ -348,36 +345,46 @@ async function mintDesktopUrl(cfg, boxId, { vncBudgetMs = 60_000 } = {}) {
 }
 async function waitReady(cfg, boxId, budgetMs = 90_000) {
     assertBoatNotDeleting(boxId);
-    const t0 = Date.now();
+    const deadline = Date.now() + budgetMs;
+    // Every request ends with the budget: a relay that accepts the connection
+    // and then stalls must not hold a turn's start past it.
+    const untilDeadline = () => AbortSignal.timeout(Math.max(1, deadline - Date.now()));
+    const outOfTime = (error) => error instanceof Error && error.name === "TimeoutError";
     // Boat's words for the last failed resume, if the wait runs out on them.
     let resumeFailure = null;
-    while (Date.now() - t0 < budgetMs) {
-        assertBoatNotDeleting(boxId);
-        const { body } = await boatJson(cfg, `/boxes/${boxId}`);
-        const state = body?.box?.state;
-        if (READY.has(state))
-            return body.box;
-        if (state === "error")
-            return null;
-        // an archiving boat can't resume until the snapshot lands — nudge after.
-        // A refusal (a plan limit, say) is final: report it now. A server error
-        // is retried on the next poll, as Boat asks; 409 is a state race with a
-        // wake already under way.
-        if (state === "archived") {
-            const resumed = await boatJson(cfg, `/boxes/${boxId}/resume`, { method: "POST" });
-            if (resumed.ok)
-                resumeFailure = null;
-            else if (resumed.status !== 409) {
-                const message = boatErrorMessage(resumed.status, "waking the cloud computer", resumed.body, usesIncludedBoat(cfg));
-                if (resumed.status < 500)
-                    throw new Error(message);
-                resumeFailure = message;
+    try {
+        while (Date.now() < deadline) {
+            assertBoatNotDeleting(boxId);
+            const { body } = await boatJson(cfg, `/boxes/${boxId}`, { signal: untilDeadline() });
+            const state = body?.box?.state;
+            if (READY.has(state))
+                return body.box;
+            if (state === "error")
+                return null;
+            // an archiving boat can't resume until the snapshot lands — nudge after.
+            // A refusal (a plan limit, say) is final: report it now. A server error
+            // is retried on the next poll, as Boat asks; 409 is a state race with a
+            // wake already under way.
+            if (state === "archived") {
+                const resumed = await boatJson(cfg, `/boxes/${boxId}/resume`, { method: "POST", signal: untilDeadline() });
+                if (resumed.ok)
+                    resumeFailure = null;
+                else if (resumed.status !== 409) {
+                    const refusal = boatRefusal(resumed.status, "waking the cloud computer", resumed.body, usesIncludedBoat(cfg));
+                    if (resumed.status < 500)
+                        throw refusal;
+                    resumeFailure = refusal;
+                }
             }
+            await new Promise((r) => setTimeout(r, Math.min(2500, Math.max(0, deadline - Date.now()))));
         }
-        await new Promise((r) => setTimeout(r, 2500));
+    }
+    catch (error) {
+        if (!outOfTime(error))
+            throw error;
     }
     if (resumeFailure)
-        throw new Error(resumeFailure);
+        throw resumeFailure;
     return null;
 }
 // Resolving a bot's boat means LISTing every boat in the account, so it is
@@ -828,7 +835,9 @@ export async function findBoat(cfg, botId) {
     if (cachedId) {
         let direct = null;
         try {
-            direct = await boatJson(cfg, `/boxes/${cachedId}`);
+            // Bounded like every other Boat read: a relay that accepts the
+            // connection and stalls must not hold a turn's setup for minutes.
+            direct = await boatJson(cfg, `/boxes/${cachedId}`, { signal: AbortSignal.timeout(20_000) });
         }
         catch {
             // A direct read can fail while the account listing still succeeds.
@@ -948,6 +957,17 @@ export function boatErrorMessage(status, what, body, included = false) {
     }
     return theirs ? `${what} failed: ${theirs}` : `${what} failed (${status})`;
 }
+/** A refused start as an error that keeps the provider's status and code
+ * (the Admin's own, such as subscription_inactive), so a failed place is
+ * read from the code first and from the words only until every refusal
+ * has one (shared/place-view.ts cloudRefusal). Named apart from `status`,
+ * which a route would answer with. */
+export function boatRefusal(status, what, body, included = false) {
+    const code = body?.error?.code ?? body?.code;
+    return Object.assign(new Error(boatErrorMessage(status, what, body, included)), {
+        boatStatus: status, ...(typeof code === "string" && /^[a-z0-9_]{1,64}$/.test(code) ? { boatCode: code } : {}),
+    });
+}
 /** boat.dev trial accounts reject the normal eight-hour auto-stop with a
  * structured `trial_auto_stop_required` refusal. Retry that one condition
  * once at the provider's advertised maximum (or the documented two-hour
@@ -967,44 +987,13 @@ function idempotentCreateInProgress(result) {
     const code = result.body?.error?.code ?? result.body?.code;
     return result.status === 409 && code === "idempotency_in_progress";
 }
-/** The keys this OpenMausBot already holds, as the environment its bots'
- * agents read on the boat. The boat is created with `noEnv: true`, so the
- * boat.dev account's own logins never land in the guest: the boat has exactly
- * these and nothing else (see "Whose keys" in the Boat integrated-agents docs). */
-export function boatCredentialEnv(cfg, env = process.env) {
-    const out = {};
-    const put = (name, value) => {
-        if (typeof value === "string" && value.trim())
-            out[name] = value.trim();
-    };
-    // The workspace key only: an ANTHROPIC_API_KEY in the server's own env is
-    // never the workspace key (see loadConfig), so it is not forwarded either.
-    put("ANTHROPIC_API_KEY", cfg.anthropic?.key);
-    for (const name of BOAT_FORWARDED_CREDENTIAL_ENV)
-        put(name, env[name]);
-    return out;
-}
-/** Names the boat's agents read (Claude Code, Codex, pi, OpenCode, Prime
- * Agent, Kimi), forwarded verbatim from this server's environment when set. */
-const BOAT_FORWARDED_CREDENTIAL_ENV = [
-    "CLAUDE_CODE_OAUTH_TOKEN",
-    "OPENAI_API_KEY",
-    "OPENROUTER_API_KEY",
-    "LLMGATEWAY_API_KEY",
-    "DEEPSEEK_API_KEY",
-    "MOONSHOT_API_KEY",
-    "KIMI_CODE_ACCESS_TOKEN",
-    "KIMI_CODE_REFRESH_TOKEN",
-];
-async function requestBoatCreate(cfg, botId, ttlSeconds, env) {
-    // The computer needs the user's desktop session, not the account owner's
-    // host credentials. Keep provider-side env injection off; the only keys the
-    // guest ever has are the ones this OpenMausBot forwards (`env`), which its
-    // agents need now that the turn runs on the boat. The idempotency identity
-    // stays the secret-free part: a trial-TTL retry must receive a different
-    // key, and the journal on disk never carries a credential.
+async function requestBoatCreate(cfg, botId, ttlSeconds) {
+    // The computer is a desktop the bot's own engine drives from here, so it
+    // needs no AI sign-in of its own: provider-side env injection stays off and
+    // no key this OpenMausBot holds is ever sent to it. A trial-TTL retry must
+    // receive a different idempotency key, and the journal on disk never
+    // carries a credential.
     const body = JSON.stringify({ ttlSeconds, noEnv: true });
-    const wireBody = JSON.stringify({ ttlSeconds, noEnv: true, ...(Object.keys(env).length ? { env } : {}) });
     let attempt = beginBoatCreate(botId, body);
     let request = attempt.request;
     let createdThisAttempt = attempt.startedNow;
@@ -1034,7 +1023,7 @@ async function requestBoatCreate(cfg, botId, ttlSeconds, env) {
                 method: "POST",
                 headers: { "Idempotency-Key": request.idempotencyKey },
                 signal: AbortSignal.timeout(45_000),
-                body: wireBody,
+                body,
             });
         }
         catch (error) {
@@ -1067,12 +1056,12 @@ async function requestBoatCreate(cfg, botId, ttlSeconds, env) {
         return { ...last, request, createdThisAttempt };
     }
 }
-async function createBoat(cfg, botId, env) {
-    const first = await requestBoatCreate(cfg, botId, DEFAULT_BOAT_TTL_SECONDS, env);
+async function createBoat(cfg, botId) {
+    const first = await requestBoatCreate(cfg, botId, DEFAULT_BOAT_TTL_SECONDS);
     if (first.ok)
         return first;
     const trialTtl = trialBoatTtlSeconds(first.body);
-    return trialTtl === null ? first : requestBoatCreate(cfg, botId, trialTtl, env);
+    return trialTtl === null ? first : requestBoatCreate(cfg, botId, trialTtl);
 }
 /** A prior explicit delete always wins over provisioning. Reconcile/retry the
  * old immutable target, then require a fresh provision request so one click
@@ -1111,10 +1100,9 @@ export async function boatStatus(cfg, botId) {
 }
 /**
  * Find-or-create the bot's persistent boat, wait for ready, and mint a fresh
- * desktop URL. The boat ships its own computer-use driver and agent runner.
+ * desktop URL. The boat ships its own computer-use driver.
  */
 export async function provisionBoat(cfg, botId, _botName) {
-    const credentialEnv = boatCredentialEnv(cfg);
     cfg = snapshotBoatConfig(cfg);
     if (!boatConfigured(cfg)) {
         throw new Error('box provider not enabled — add {"box":{"token":"…"}} to ~/.openmausbot/config.json');
@@ -1132,9 +1120,9 @@ export async function provisionBoat(cfg, botId, _botName) {
             // Provider-side backstop: archives itself (billing pauses, disk
             // survives) if every stop path dies. Trial accounts get one narrower
             // retry when boat.dev reports their shorter TTL ceiling.
-            const createRes = await createBoat(cfg, botId, credentialEnv);
+            const createRes = await createBoat(cfg, botId);
             if (!createRes.ok || !createRes.body?.box?.id) {
-                throw new Error(boatErrorMessage(createRes.status, "boat create", createRes.body, usesIncludedBoat(cfg)));
+                throw boatRefusal(createRes.status, "boat create", createRes.body, usesIncludedBoat(cfg));
             }
             boat = createRes.body.box;
             createRequest = createRes.request;
@@ -1151,8 +1139,7 @@ export async function provisionBoat(cfg, botId, _botName) {
         const ready = await waitReady(cfg, boat.id);
         if (!ready)
             throw new Error("box did not become ready within 90s — retry in a minute");
-        // Nothing to install: every boat ships its own computer-use driver and
-        // registers it with every harness it runs.
+        // Nothing to install: every boat ships its own computer-use driver.
         const joinUrl = await mintDesktopUrl(cfg, boat.id);
         if (!joinUrl)
             throw new Error("box desktop link could not be created");
@@ -1249,14 +1236,11 @@ export async function execOnBoat(cfg, botId, command) {
 //
 // The frame is for a person: it fills the panel and opens in the chat's
 // image viewer, so it keeps the desktop's native size up to 1080p and a
-// quality where page text stays legible. (Sizing it is now the only say
-// OpenMausBot has over any frame off this box: the turn runs on the boat's
-// own agent, so the model's own captures never pass through here.) Only
-// wider displays are scaled down, with -resize rather than -thumbnail so
-// the resample is not the fast-and-blurry kind meant for icons. The
-// pointer is drawn into the frame (scrot --pointer, ffmpeg -draw_mouse):
-// watching the bot work means seeing where its cursor is, and X11
-// captures leave it out by default.
+// quality where page text stays legible. Only wider displays are scaled
+// down, with -resize rather than -thumbnail so the resample is not the
+// fast-and-blurry kind meant for icons. The pointer is drawn into the frame
+// (scrot --pointer, ffmpeg -draw_mouse): watching the bot work means seeing
+// where its cursor is, and X11 captures leave it out by default.
 const PANEL_PATH = "/tmp/ogb-panel.jpg";
 export const PANEL_FRAME_WIDTH = 1920;
 export const PANEL_FRAME_QUALITY = 85;

package/dist-server/server/bot-overview.js

@@ -147,7 +147,7 @@ export function grantsSummary(connectorTools) {
 function computerReach(computer, cloudHome = false) {
     // A Cloud home never offers either; say so rather than list a preference
     // that every task there refuses.
-    const unavailable = cloudHome ? ", which isn't available on OMB Cloud" : "";
+    const unavailable = cloudHome ? ", which isn't available on My Cloud" : "";
     switch (computer) {
         case "cloud":
             return "Computer preference: cloud computer.";

package/dist-server/server/browser-engine.js

@@ -16,7 +16,7 @@ import { delimiter, dirname, join, resolve } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
 import { browserBundlePaths } from "./browser-bundle-release.js";
-import { browserRuntimeEnv } from "./browser-runtime.js";
+import { BROWSER_VIEWPORT_ARGS, browserRuntimeEnv, ownsBrowserViewport } from "./browser-runtime.js";
 import { SIGN_IN_PROMPT } from "./system-prompt.js";
 import { AGENT_BROWSER_VERSION, agentBrowserReleaseUrl, agentBrowserReleaseVersion, resolveAgentBrowserReleaseAsset, } from "./browser-engine-release.js";
 const ENGINE_DIR = "tools/agent-browser";
@@ -467,6 +467,43 @@ export function agentBrowserIntegration(input) {
     }
     return { command: input.binaryPath, args: ["mcp", "--tools", "core", "--no-webmcp"], env };
 }
+/** Give the session's browser the standard page size, launching it with the
+ * session's own launch environment if it is not running yet. Best effort:
+ * false (and the page keeps whatever size it had) on any failure. */
+export function setBrowserViewport(binaryPath, env, timeoutMs = 30_000) {
+    if (!ownsBrowserViewport(env))
+        return Promise.resolve(true);
+    return new Promise((settle) => {
+        let child;
+        try {
+            child = spawn(binaryPath, [...BROWSER_VIEWPORT_ARGS, "--json", "--no-webmcp"], { env: browserRuntimeEnv(env), stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+        }
+        catch {
+            settle(false);
+            return;
+        }
+        let output = "";
+        let settled = false;
+        const finish = (ok) => { if (!settled) {
+            settled = true;
+            clearTimeout(timer);
+            settle(ok);
+        } };
+        const timer = setTimeout(() => { child.kill("SIGKILL"); finish(false); }, timeoutMs);
+        timer.unref?.();
+        child.stdout?.on("data", (chunk) => { if (output.length < 65_536)
+            output += String(chunk); });
+        child.on("error", () => finish(false));
+        child.on("close", (code) => {
+            try {
+                finish(code === 0 && JSON.parse(output)?.success === true);
+            }
+            catch {
+                finish(false);
+            }
+        });
+    });
+}
 /** How long a settled-frame capture may take before the turn gives up on it.
  * The poller runs beside a live turn, so a hung browser must not hold the
  * transcript open; a missing picture is better than a stuck fold. */