openmausbot 0.1.96 → 0.1.98

package/dist-server/permission-proxy.js

@@ -8,7 +8,6 @@ var MAX_OPTIONS = 12;
 var MAX_QUESTION_TEXT = 8e3;
 var MAX_LABEL = 120;
 var MAX_DESCRIPTION = 400;
-var MAX_CUSTOM_ANSWER = 2e3;
 function text(value, limit) {
   if (typeof value !== "string") return void 0;
   const trimmed = value.trim();
@@ -60,9 +59,6 @@ function parseAskQuestions(input) {
   }
   return questions.length ? questions : null;
 }
-var OMB_ASK_FENCE = /(^|\n)[ \t]{0,3}(`{3,}|~{3,})[ \t]*omb-ask[ \t]*\r?\n([\s\S]*?)\r?\n[ \t]{0,3}\2[ \t]*(?=\r?\n|$)/;
-var OMB_ASK_FENCE_GLOBAL = new RegExp(OMB_ASK_FENCE.source, OMB_ASK_FENCE.flags + "g");
-var MAX_ANSWER_ECHO = 6 * MAX_CUSTOM_ANSWER;
 function questionAnswersByQuestion(message, questions) {
   return questionAnswersById(message, questions.map((question) => ({ id: question.question, question })));
 }
@@ -161,6 +157,7 @@ var allowQuestion = allowsTool(selection.scope, { kind: "mcp", server: "ogb", na
 var socketPath = process.argv[2] ?? "";
 var waiting = /* @__PURE__ */ new Map();
 var conn = connect(socketPath);
+conn.setEncoding("utf8");
 var dead = () => {
   for (const resolve of waiting.values()) {
     resolve({ behavior: "deny", message: "OpenMausBot: permission broker unavailable \u2014 skip this action" });
@@ -299,6 +296,7 @@ async function handle(msg) {
   }
 }
 var inBuf = "";
+process.stdin.setEncoding("utf8");
 process.stdin.on("data", (chunk) => {
   inBuf += chunk;
   let nl;

package/dist-server/server/atomic.js

@@ -4,8 +4,15 @@
 // reader always sees either the complete old contents or the complete new
 // ones. Without this, an interrupted writeFileSync produces half-written JSON
 // that fails to parse on next boot and is silently treated as empty state.
+//
+// The fsync is the expensive part: on macOS it is F_FULLFSYNC, about 4 ms of
+// blocked event loop per call. `durable: false` drops only the fsync, for
+// files whose loss after a power cut costs nothing (a derived cache, a
+// session-scoped token). The temp file and rename stay, so an app crash or
+// kill -9 still never leaves a torn file; only a power loss or kernel panic
+// can leave such a file empty.
 import { randomUUID } from "node:crypto";
-import { closeSync, fsyncSync, openSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 /** Windows refuses a rename onto an existing path while anything else holds a
  * handle to either file, and a virus scanner or the search indexer opening a
  * just-closed file for a few milliseconds is enough. It surfaces as EPERM or
@@ -51,7 +58,8 @@ export function writeFileAtomic(path, data, options = {}) {
         // config file visible between the write and a later chmod.
         fd = openSync(tmp, "w", options.mode);
         writeFileSync(fd, data);
-        fsyncSync(fd);
+        if (options.durable !== false)
+            fsyncSync(fd);
         closeSync(fd);
         fd = null;
         renameWithRetry(tmp, path);
@@ -74,3 +82,63 @@ export function writeFileAtomic(path, data, options = {}) {
         throw e;
     }
 }
+/** True only when `path` is already exactly `data`: a regular file (never a
+ * symlink, FIFO or directory), owned by this user, with permissions no
+ * broader than `mode`. Any doubt or error answers false, so the caller falls
+ * back to a full write — this check must never be the reason a save fails.
+ *
+ * It reads the file on disk rather than remembering the last write: a
+ * workspace restore or a hand edit can change the file underneath, and the
+ * next save has to put its own bytes back exactly as before. */
+function holdsExactly(path, data, mode) {
+    let fd = null;
+    try {
+        if (process.platform === "win32") {
+            // No O_NOFOLLOW on Windows; a reparse point is replaced, not read.
+            if (!lstatSync(path).isFile())
+                return false;
+            fd = openSync(path, "r");
+        }
+        else {
+            // Inspect and read the same inode the open landed on, so a swap
+            // between a stat and the read cannot be mistaken for a match.
+            // O_NONBLOCK keeps a FIFO planted at the path from hanging the open.
+            fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        }
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size !== Buffer.byteLength(data))
+            return false;
+        const uid = process.getuid?.();
+        if (uid !== undefined && stat.uid !== uid)
+            return false;
+        // Windows reports 0o666 for any writable file; its mode bits mean nothing.
+        if (mode !== undefined && process.platform !== "win32" && (stat.mode & 0o777 & ~mode) !== 0)
+            return false;
+        // Bytes, not strings: decoding and comparing a megabyte-sized registry as
+        // a JS string costs several times more than a memcmp of the raw bytes.
+        return readFileSync(fd).equals(Buffer.from(data));
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                /* best-effort cleanup */
+            }
+        }
+    }
+}
+/** writeFileAtomic for saves that often repeat what the file already holds.
+ * A save that changes nothing costs one open and read instead of a temp
+ * file, a rename and an fsync; a save whose size differs pays only an
+ * open and fstat before the normal write. Returns whether it wrote. */
+export function writeFileAtomicIfChanged(path, data, options = {}) {
+    if (holdsExactly(path, data, options.mode))
+        return false;
+    writeFileAtomic(path, data, options);
+    return true;
+}

package/dist-server/server/auto-approve.js

@@ -79,7 +79,7 @@ export function delegatedApprovalMode(input) {
 // the permission path in permission-proxy). Approving it there does not
 // produce an answer: the CLI runs the tool with none and the model is told
 // "The user did not answer the questions." — a question silently lost.
-const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user", "omb-ask"]);
+const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user"]);
 // A web search is a low-level read. Approve for me allows these names and
 // nothing wider: a bare search, a page fetch, and every other tool stay a
 // prompt. The name is the same shape as a question — one mcp__<server>__

package/dist-server/server/auto-vm-claims.js

@@ -18,6 +18,18 @@ export function startAutoVmClaim(table, threadId, generation) {
     slot.begin = slot.claim().then(() => { slot.claimed = true; }, (error) => {
         slot.failed = true;
         slot.failure = error instanceof Error ? error.message : String(error);
-        slot.onRejected?.(slot.failure);
+        slot.onRejected?.(slot.failure, error);
     });
 }
+/** How long a computer call should wait on its thread's lazy claim, or null
+ * when it should not wait: the first call waits while the claim it fires
+ * lands; a slow claim (graceMs) is waited on by every call until it settles. */
+export function lazyClaimWaitMs(slot, defaultGraceMs) {
+    if (!slot?.lazy)
+        return null;
+    if (!slot.begin)
+        return slot.graceMs ?? defaultGraceMs;
+    if (slot.graceMs !== undefined && !slot.claimed && !slot.failed)
+        return slot.graceMs;
+    return null;
+}

package/dist-server/server/automatic-recovery.js

@@ -3,8 +3,7 @@ import { supportsWorkspaceFiles } from "./workspace.js";
  * its filesystem to another machine. Approval and organisation policy are
  * checked by the ordinary model-switch and turn-admission gates. */
 export function recoveryCapabilityError(from, to) {
-    if (from.capabilities.remoteAgent || to.capabilities.remoteAgent ||
-        supportsWorkspaceFiles(from.driverKind) !== supportsWorkspaceFiles(to.driverKind)) {
+    if (supportsWorkspaceFiles(from.driverKind) !== supportsWorkspaceFiles(to.driverKind)) {
         return "The backup cannot use the same workspace.";
     }
     const tools = ["agentsMcp", "computerMcp", "composioMcp",

package/dist-server/server/boat.js

@@ -86,13 +86,12 @@ function scopedBoatPrefix() {
     scopedBoatPrefixCache = `ogb-${scope}-`;
     return scopedBoatPrefixCache;
 }
-/** Decide lifecycle work before a turn mounts Boat. Auto may observe and
- * attach an already-ready Boat, but only explicit Cloud may create or wake. */
-export function boatTurnLifecycleAction({ explicitCloud, state, }) {
+/** Decide lifecycle work before a turn mounts Boat. Only a turn whose place
+ * is Cloud gets here (Auto never reads the Boat account), so a missing Boat
+ * is created and a sleeping one woken. */
+export function boatTurnLifecycleAction(state) {
     if (state && READY.has(state))
         return "attach";
-    if (!explicitCloud)
-        return "none";
     return state ? "wake" : "provision";
 }
 /** Keep one provider account for the whole logical operation. Settings may
@@ -346,36 +345,46 @@ async function mintDesktopUrl(cfg, boxId, { vncBudgetMs = 60_000 } = {}) {
 }
 async function waitReady(cfg, boxId, budgetMs = 90_000) {
     assertBoatNotDeleting(boxId);
-    const t0 = Date.now();
+    const deadline = Date.now() + budgetMs;
+    // Every request ends with the budget: a relay that accepts the connection
+    // and then stalls must not hold a turn's start past it.
+    const untilDeadline = () => AbortSignal.timeout(Math.max(1, deadline - Date.now()));
+    const outOfTime = (error) => error instanceof Error && error.name === "TimeoutError";
     // Boat's words for the last failed resume, if the wait runs out on them.
     let resumeFailure = null;
-    while (Date.now() - t0 < budgetMs) {
-        assertBoatNotDeleting(boxId);
-        const { body } = await boatJson(cfg, `/boxes/${boxId}`);
-        const state = body?.box?.state;
-        if (READY.has(state))
-            return body.box;
-        if (state === "error")
-            return null;
-        // an archiving boat can't resume until the snapshot lands — nudge after.
-        // A refusal (a plan limit, say) is final: report it now. A server error
-        // is retried on the next poll, as Boat asks; 409 is a state race with a
-        // wake already under way.
-        if (state === "archived") {
-            const resumed = await boatJson(cfg, `/boxes/${boxId}/resume`, { method: "POST" });
-            if (resumed.ok)
-                resumeFailure = null;
-            else if (resumed.status !== 409) {
-                const message = boatErrorMessage(resumed.status, "waking the cloud computer", resumed.body, usesIncludedBoat(cfg));
-                if (resumed.status < 500)
-                    throw new Error(message);
-                resumeFailure = message;
+    try {
+        while (Date.now() < deadline) {
+            assertBoatNotDeleting(boxId);
+            const { body } = await boatJson(cfg, `/boxes/${boxId}`, { signal: untilDeadline() });
+            const state = body?.box?.state;
+            if (READY.has(state))
+                return body.box;
+            if (state === "error")
+                return null;
+            // an archiving boat can't resume until the snapshot lands — nudge after.
+            // A refusal (a plan limit, say) is final: report it now. A server error
+            // is retried on the next poll, as Boat asks; 409 is a state race with a
+            // wake already under way.
+            if (state === "archived") {
+                const resumed = await boatJson(cfg, `/boxes/${boxId}/resume`, { method: "POST", signal: untilDeadline() });
+                if (resumed.ok)
+                    resumeFailure = null;
+                else if (resumed.status !== 409) {
+                    const refusal = boatRefusal(resumed.status, "waking the cloud computer", resumed.body, usesIncludedBoat(cfg));
+                    if (resumed.status < 500)
+                        throw refusal;
+                    resumeFailure = refusal;
+                }
             }
+            await new Promise((r) => setTimeout(r, Math.min(2500, Math.max(0, deadline - Date.now()))));
         }
-        await new Promise((r) => setTimeout(r, 2500));
+    }
+    catch (error) {
+        if (!outOfTime(error))
+            throw error;
     }
     if (resumeFailure)
-        throw new Error(resumeFailure);
+        throw resumeFailure;
     return null;
 }
 // Resolving a bot's boat means LISTing every boat in the account, so it is
@@ -948,6 +957,17 @@ export function boatErrorMessage(status, what, body, included = false) {
     }
     return theirs ? `${what} failed: ${theirs}` : `${what} failed (${status})`;
 }
+/** A refused start as an error that keeps the provider's status and code
+ * (the Admin's own, such as subscription_inactive), so a failed place is
+ * read from the code first and from the words only until every refusal
+ * has one (shared/place-view.ts cloudRefusal). Named apart from `status`,
+ * which a route would answer with. */
+export function boatRefusal(status, what, body, included = false) {
+    const code = body?.error?.code ?? body?.code;
+    return Object.assign(new Error(boatErrorMessage(status, what, body, included)), {
+        boatStatus: status, ...(typeof code === "string" && /^[a-z0-9_]{1,64}$/.test(code) ? { boatCode: code } : {}),
+    });
+}
 /** boat.dev trial accounts reject the normal eight-hour auto-stop with a
  * structured `trial_auto_stop_required` refusal. Retry that one condition
  * once at the provider's advertised maximum (or the documented two-hour
@@ -967,44 +987,13 @@ function idempotentCreateInProgress(result) {
     const code = result.body?.error?.code ?? result.body?.code;
     return result.status === 409 && code === "idempotency_in_progress";
 }
-/** The keys this OpenMausBot already holds, as the environment its bots'
- * agents read on the boat. The boat is created with `noEnv: true`, so the
- * boat.dev account's own logins never land in the guest: the boat has exactly
- * these and nothing else (see "Whose keys" in the Boat integrated-agents docs). */
-export function boatCredentialEnv(cfg, env = process.env) {
-    const out = {};
-    const put = (name, value) => {
-        if (typeof value === "string" && value.trim())
-            out[name] = value.trim();
-    };
-    // The workspace key only: an ANTHROPIC_API_KEY in the server's own env is
-    // never the workspace key (see loadConfig), so it is not forwarded either.
-    put("ANTHROPIC_API_KEY", cfg.anthropic?.key);
-    for (const name of BOAT_FORWARDED_CREDENTIAL_ENV)
-        put(name, env[name]);
-    return out;
-}
-/** Names the boat's agents read (Claude Code, Codex, pi, OpenCode, Prime
- * Agent, Kimi), forwarded verbatim from this server's environment when set. */
-const BOAT_FORWARDED_CREDENTIAL_ENV = [
-    "CLAUDE_CODE_OAUTH_TOKEN",
-    "OPENAI_API_KEY",
-    "OPENROUTER_API_KEY",
-    "LLMGATEWAY_API_KEY",
-    "DEEPSEEK_API_KEY",
-    "MOONSHOT_API_KEY",
-    "KIMI_CODE_ACCESS_TOKEN",
-    "KIMI_CODE_REFRESH_TOKEN",
-];
-async function requestBoatCreate(cfg, botId, ttlSeconds, env) {
-    // The computer needs the user's desktop session, not the account owner's
-    // host credentials. Keep provider-side env injection off; the only keys the
-    // guest ever has are the ones this OpenMausBot forwards (`env`), which its
-    // agents need now that the turn runs on the boat. The idempotency identity
-    // stays the secret-free part: a trial-TTL retry must receive a different
-    // key, and the journal on disk never carries a credential.
+async function requestBoatCreate(cfg, botId, ttlSeconds) {
+    // The computer is a desktop the bot's own engine drives from here, so it
+    // needs no AI sign-in of its own: provider-side env injection stays off and
+    // no key this OpenMausBot holds is ever sent to it. A trial-TTL retry must
+    // receive a different idempotency key, and the journal on disk never
+    // carries a credential.
     const body = JSON.stringify({ ttlSeconds, noEnv: true });
-    const wireBody = JSON.stringify({ ttlSeconds, noEnv: true, ...(Object.keys(env).length ? { env } : {}) });
     let attempt = beginBoatCreate(botId, body);
     let request = attempt.request;
     let createdThisAttempt = attempt.startedNow;
@@ -1034,7 +1023,7 @@ async function requestBoatCreate(cfg, botId, ttlSeconds, env) {
                 method: "POST",
                 headers: { "Idempotency-Key": request.idempotencyKey },
                 signal: AbortSignal.timeout(45_000),
-                body: wireBody,
+                body,
             });
         }
         catch (error) {
@@ -1067,12 +1056,12 @@ async function requestBoatCreate(cfg, botId, ttlSeconds, env) {
         return { ...last, request, createdThisAttempt };
     }
 }
-async function createBoat(cfg, botId, env) {
-    const first = await requestBoatCreate(cfg, botId, DEFAULT_BOAT_TTL_SECONDS, env);
+async function createBoat(cfg, botId) {
+    const first = await requestBoatCreate(cfg, botId, DEFAULT_BOAT_TTL_SECONDS);
     if (first.ok)
         return first;
     const trialTtl = trialBoatTtlSeconds(first.body);
-    return trialTtl === null ? first : requestBoatCreate(cfg, botId, trialTtl, env);
+    return trialTtl === null ? first : requestBoatCreate(cfg, botId, trialTtl);
 }
 /** A prior explicit delete always wins over provisioning. Reconcile/retry the
  * old immutable target, then require a fresh provision request so one click
@@ -1111,10 +1100,9 @@ export async function boatStatus(cfg, botId) {
 }
 /**
  * Find-or-create the bot's persistent boat, wait for ready, and mint a fresh
- * desktop URL. The boat ships its own computer-use driver and agent runner.
+ * desktop URL. The boat ships its own computer-use driver.
  */
 export async function provisionBoat(cfg, botId, _botName) {
-    const credentialEnv = boatCredentialEnv(cfg);
     cfg = snapshotBoatConfig(cfg);
     if (!boatConfigured(cfg)) {
         throw new Error('box provider not enabled — add {"box":{"token":"…"}} to ~/.openmausbot/config.json');
@@ -1132,9 +1120,9 @@ export async function provisionBoat(cfg, botId, _botName) {
             // Provider-side backstop: archives itself (billing pauses, disk
             // survives) if every stop path dies. Trial accounts get one narrower
             // retry when boat.dev reports their shorter TTL ceiling.
-            const createRes = await createBoat(cfg, botId, credentialEnv);
+            const createRes = await createBoat(cfg, botId);
             if (!createRes.ok || !createRes.body?.box?.id) {
-                throw new Error(boatErrorMessage(createRes.status, "boat create", createRes.body, usesIncludedBoat(cfg)));
+                throw boatRefusal(createRes.status, "boat create", createRes.body, usesIncludedBoat(cfg));
             }
             boat = createRes.body.box;
             createRequest = createRes.request;
@@ -1151,8 +1139,7 @@ export async function provisionBoat(cfg, botId, _botName) {
         const ready = await waitReady(cfg, boat.id);
         if (!ready)
             throw new Error("box did not become ready within 90s — retry in a minute");
-        // Nothing to install: every boat ships its own computer-use driver and
-        // registers it with every harness it runs.
+        // Nothing to install: every boat ships its own computer-use driver.
         const joinUrl = await mintDesktopUrl(cfg, boat.id);
         if (!joinUrl)
             throw new Error("box desktop link could not be created");
@@ -1249,14 +1236,11 @@ export async function execOnBoat(cfg, botId, command) {
 //
 // The frame is for a person: it fills the panel and opens in the chat's
 // image viewer, so it keeps the desktop's native size up to 1080p and a
-// quality where page text stays legible. (Sizing it is now the only say
-// OpenMausBot has over any frame off this box: the turn runs on the boat's
-// own agent, so the model's own captures never pass through here.) Only
-// wider displays are scaled down, with -resize rather than -thumbnail so
-// the resample is not the fast-and-blurry kind meant for icons. The
-// pointer is drawn into the frame (scrot --pointer, ffmpeg -draw_mouse):
-// watching the bot work means seeing where its cursor is, and X11
-// captures leave it out by default.
+// quality where page text stays legible. Only wider displays are scaled
+// down, with -resize rather than -thumbnail so the resample is not the
+// fast-and-blurry kind meant for icons. The pointer is drawn into the frame
+// (scrot --pointer, ffmpeg -draw_mouse): watching the bot work means seeing
+// where its cursor is, and X11 captures leave it out by default.
 const PANEL_PATH = "/tmp/ogb-panel.jpg";
 export const PANEL_FRAME_WIDTH = 1920;
 export const PANEL_FRAME_QUALITY = 85;

package/dist-server/server/bot-overview.js

@@ -147,7 +147,7 @@ export function grantsSummary(connectorTools) {
 function computerReach(computer, cloudHome = false) {
     // A Cloud home never offers either; say so rather than list a preference
     // that every task there refuses.
-    const unavailable = cloudHome ? ", which isn't available on OMB Cloud" : "";
+    const unavailable = cloudHome ? ", which isn't available on My Cloud" : "";
     switch (computer) {
         case "cloud":
             return "Computer preference: cloud computer.";

package/dist-server/server/browser-engine.js

@@ -16,7 +16,7 @@ import { delimiter, dirname, join, resolve } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
 import { browserBundlePaths } from "./browser-bundle-release.js";
-import { browserRuntimeEnv } from "./browser-runtime.js";
+import { BROWSER_VIEWPORT_ARGS, browserRuntimeEnv, ownsBrowserViewport } from "./browser-runtime.js";
 import { SIGN_IN_PROMPT } from "./system-prompt.js";
 import { AGENT_BROWSER_VERSION, agentBrowserReleaseUrl, agentBrowserReleaseVersion, resolveAgentBrowserReleaseAsset, } from "./browser-engine-release.js";
 const ENGINE_DIR = "tools/agent-browser";
@@ -467,6 +467,43 @@ export function agentBrowserIntegration(input) {
     }
     return { command: input.binaryPath, args: ["mcp", "--tools", "core", "--no-webmcp"], env };
 }
+/** Give the session's browser the standard page size, launching it with the
+ * session's own launch environment if it is not running yet. Best effort:
+ * false (and the page keeps whatever size it had) on any failure. */
+export function setBrowserViewport(binaryPath, env, timeoutMs = 30_000) {
+    if (!ownsBrowserViewport(env))
+        return Promise.resolve(true);
+    return new Promise((settle) => {
+        let child;
+        try {
+            child = spawn(binaryPath, [...BROWSER_VIEWPORT_ARGS, "--json", "--no-webmcp"], { env: browserRuntimeEnv(env), stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+        }
+        catch {
+            settle(false);
+            return;
+        }
+        let output = "";
+        let settled = false;
+        const finish = (ok) => { if (!settled) {
+            settled = true;
+            clearTimeout(timer);
+            settle(ok);
+        } };
+        const timer = setTimeout(() => { child.kill("SIGKILL"); finish(false); }, timeoutMs);
+        timer.unref?.();
+        child.stdout?.on("data", (chunk) => { if (output.length < 65_536)
+            output += String(chunk); });
+        child.on("error", () => finish(false));
+        child.on("close", (code) => {
+            try {
+                finish(code === 0 && JSON.parse(output)?.success === true);
+            }
+            catch {
+                finish(false);
+            }
+        });
+    });
+}
 /** How long a settled-frame capture may take before the turn gives up on it.
  * The poller runs beside a live turn, so a hung browser must not hold the
  * transcript open; a missing picture is better than a stuck fold. */