openmausbot 0.1.97 → 0.1.99

package/dist-server/server/drivers/openai-chat.js

@@ -11,6 +11,7 @@ import { ChatProtocolError, ChatReasoningDetails, ChatToolCalls, object } from "
 import { appendNative } from "./native.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { classifyContinuable, writeTurnHandoff } from "../turn-continuation.js";
+import { KEY_REJECTED_REASON, keyRejected, noteKeyAccepted, noteKeyRejected, rejectsKey } from "../key-rejections.js";
 /** The message of a JSON error body a provider returned with HTTP 200.
  *  MiniMax reports auth, balance, and parameter failures as `base_resp`. */
 function providerError(json) {
@@ -182,6 +183,8 @@ export function createOpenAIChatRuntime(options) {
             });
             if (!response.ok) {
                 const body = await response.text().catch(() => "");
+                if (rejectsKey(response.status, body))
+                    noteKeyRejected(options.apiUrl, options.apiKey);
                 const message = `${options.httpErrorLabel} HTTP ${response.status}${body ? `: ${body.slice(0, 200)}` : ""}`;
                 if (rejectsToolsParameter(response.status, body))
                     throw new UnsupportedChatToolsError(message);
@@ -193,6 +196,7 @@ export function createOpenAIChatRuntime(options) {
                 }
                 throw new Error(message);
             }
+            noteKeyAccepted(options.apiUrl, options.apiKey);
             if (!stream || response.headers.get("content-type")?.includes("application/json")) {
                 const json = await response.json();
                 if (onUsage) {
@@ -462,7 +466,7 @@ export function createOpenAIChatRuntime(options) {
                 if (!parsed.ok)
                     throw new Error(parsed.error);
                 const scope = parsed.scope;
-                tools = await mountChatTools(options.tools === false ? undefined : turn.integrations, abort.signal, options.computerUse, scope);
+                tools = await mountChatTools(options.tools === false ? undefined : turn.integrations, abort.signal, options.computerUse, scope, turn.mcpCallTimeoutMs);
                 const questionAllowed = options.tools !== false && allowsTool(scope, { kind: "native", name: ASK_USER_TOOL });
                 let optionalQuestionOnly = questionAllowed && tools.definitions.length === 0;
                 // The runtime's one built-in tool rides the same list: ask_user is
@@ -751,10 +755,11 @@ export function createOpenAIChatRuntime(options) {
                 if (failure && (!abort.signal.aborted || cleanupFailed)) {
                     emit({ ...base(turn.threadId, turnId), type: "runtime.error", message: failure, terminal: !abort.signal.aborted });
                 }
-                // Automatic continuity: a resumable terminal (budget cap or tool
-                // errors) persists a handoff and raises cap.exhausted so the harness
-                // can start a `Continue:` thread. Interruptions and provider config
-                // errors are excluded by classifyContinuable.
+                // Automatic continuity: a resumable terminal (the step or tool-call
+                // cap) persists a handoff and raises cap.exhausted so the harness
+                // can start a `Continue:` thread. Interruptions, tool errors and
+                // provider errors (a rate limit included) are excluded by
+                // classifyContinuable.
                 if (!ok && !abort.signal.aborted) {
                     const continuable = classifyContinuable(stopReason, failure);
                     if (continuable) {
@@ -791,9 +796,13 @@ export function createOpenAIChatRuntime(options) {
             return options.models();
         },
         ...(options.refreshModels ? { refreshModels: options.refreshModels } : {}),
-        snapshot: async () => options.apiKey
-            ? { state: "available", authenticated: true, version: null, ...(options.billing ? { billing: options.billing } : {}) }
-            : { state: "unavailable", reason: options.unavailableReason },
+        snapshot: async () => {
+            if (!options.apiKey)
+                return { state: "unavailable", reason: options.unavailableReason };
+            if (keyRejected(options.apiUrl, options.apiKey))
+                return { state: "available", authenticated: false, reason: KEY_REJECTED_REASON, version: null };
+            return { state: "available", authenticated: true, version: null, ...(options.billing ? { billing: options.billing } : {}) };
+        },
         adapter: {
             provider: options.driverKind,
             capabilities: { ...(options.computerUse ? { computerMcp: options.tools !== false,

package/dist-server/server/fleet-agent.js

@@ -9,15 +9,28 @@ import { dirname } from "node:path";
 import { defaultFleetDeps, executePlan, loadRegistry, markProvisioningFailed, planFleetAction } from "./fleet-cli.js";
 import { assertSlug, fleetLayout, fleetUser, openRouterModelIds, workspaceDataDir } from "./fleet.js";
 const MAX_BODY = 256 * 1024;
-function readBody(req) {
+export function readBody(req) {
     return new Promise((resolve, reject) => {
-        let text = "";
+        const chunks = [];
+        let bytes = 0;
+        let tooLarge = false;
         req.on("data", (chunk) => {
-            text += chunk.toString("utf8");
-            if (text.length > MAX_BODY)
-                reject(Object.assign(new Error("request too large"), { status: 413 }));
+            if (tooLarge)
+                return;
+            bytes += chunk.length;
+            if (bytes > MAX_BODY) {
+                // Keep draining so the 413 can still be sent, but stop holding bytes.
+                tooLarge = true;
+                chunks.length = 0;
+                return reject(Object.assign(new Error("request too large"), { status: 413 }));
+            }
+            chunks.push(chunk);
         });
         req.on("end", () => {
+            if (tooLarge)
+                return;
+            // Decode once: a character split across two chunks stays whole.
+            const text = Buffer.concat(chunks).toString("utf8");
             if (!text.trim())
                 return resolve({});
             try {

package/dist-server/server/harness/http.js

@@ -20,7 +20,7 @@ export function json(res, status, body) {
 }
 export function readBody(req, limit = 1_000_000) {
     return new Promise((resolve, reject) => {
-        let data = "";
+        const chunks = [];
         let bytes = 0;
         let done = false;
         const fail = (status, msg) => {
@@ -40,11 +40,14 @@ export function readBody(req, limit = 1_000_000) {
                 // receiving the useful 413 response.
                 return fail(413, "body too large");
             }
-            data += c;
+            chunks.push(typeof c === "string" ? Buffer.from(c) : c);
         });
         req.on("end", () => {
             if (done)
                 return;
+            // Decode once, after the last chunk: a character split across two
+            // chunks turns into U+FFFD when each chunk is decoded on its own.
+            const data = Buffer.concat(chunks).toString("utf8");
             let body;
             try {
                 body = data ? JSON.parse(data) : {};

package/dist-server/server/harness/registry.js

@@ -35,6 +35,9 @@ export class ProviderRegistry {
     /** decoded per-instance `cli` overrides, for describe() — drivers spawn
      * from their own config; this map only reports what was configured */
     cliByInstance = new Map();
+    /** What describe() last read of each live instance. A turn's start checks
+     * a thread's own engine against it without waiting on that engine's CLI. */
+    lastSnapshots = new Map();
     driversByKind;
     /** Where Settings-driven npm installs go; the data directory by default. */
     enginesBaseDir;
@@ -47,59 +50,87 @@ export class ProviderRegistry {
         this.driversByKind = new Map(drivers.map((d) => [d.driverKind, d]));
     }
     async load(configs, decorate) {
-        for (const [instanceId, entry] of Object.entries(configs)) {
-            // Account edits replace only their own process/session state.
-            await this.dispose(instanceId);
-            const driver = this.driversByKind.get(entry.driver);
-            if (!driver) {
-                this.byId.set(instanceId, {
-                    instanceId,
-                    shadow: {
-                        instanceId,
-                        driverKind: entry.driver,
-                        displayName: entry.displayName,
-                        cli: cliOfRaw(entry.config),
-                        shadow: true,
-                        reason: `unknown driver "${entry.driver}" — kept as configured, unavailable here`,
-                    },
-                });
+        // Create instances concurrently: a driver's create may probe its CLI with
+        // a multi-second timeout, and N slow CLIs must not queue on each other.
+        // Each entry resolves to the RegistryEntry it becomes — a create or
+        // decode failure stays local to its instance, exactly as before.
+        const loaded = await Promise.all(Object.entries(configs).map(async ([instanceId, entry]) => {
+            const ready = await this.createEntry(instanceId, entry, decorate);
+            // Usable as soon as it is ready, not after the slowest CLI.
+            this.byId.set(instanceId, ready);
+            return ready;
+        }));
+        // Config order, not completion order: entries()/describe() are the UI's
+        // list and must not shuffle when a slow CLI lands last. An entry that a
+        // dispose replaced or removed meanwhile is no longer this load's to place.
+        for (const entry of loaded) {
+            if (this.byId.get(entry.instanceId) !== entry)
                 continue;
-            }
-            try {
-                const config = entry.config === undefined ? driver.defaultConfig() : driver.decodeConfig(entry.config);
-                // Override detection is on the RAW config, never the decoded one:
-                // decodeConfig fills in the driver default ("claude", "codex", …),
-                // so reading `cli` there would flag every instance as overridden.
-                const rawCli = cliOfRaw(entry.config);
-                if (rawCli)
-                    this.cliByInstance.set(instanceId, rawCli);
-                const live = await driver.create({
+            this.byId.delete(entry.instanceId);
+            this.byId.set(entry.instanceId, entry);
+        }
+    }
+    async createEntry(instanceId, entry, decorate) {
+        // Account edits replace only their own process/session state.
+        await this.dispose(instanceId);
+        const driver = this.driversByKind.get(entry.driver);
+        if (!driver) {
+            return {
+                instanceId,
+                shadow: {
                     instanceId,
-                    displayName: entry.displayName ?? driver.metadata.displayName,
-                    environment: entry.environment ?? {},
-                    enabled: entry.enabled ?? true,
-                    config,
-                });
-                this.byId.set(instanceId, { instanceId, live: decorate ? decorate(live) : live });
-            }
-            catch (e) {
-                this.byId.set(instanceId, {
+                    driverKind: entry.driver,
+                    displayName: entry.displayName,
+                    cli: cliOfRaw(entry.config),
+                    shadow: true,
+                    reason: `unknown driver "${entry.driver}" — kept as configured, unavailable here`,
+                },
+            };
+        }
+        try {
+            const config = entry.config === undefined ? driver.defaultConfig() : driver.decodeConfig(entry.config);
+            // Override detection is on the RAW config, never the decoded one:
+            // decodeConfig fills in the driver default ("claude", "codex", …),
+            // so reading `cli` there would flag every instance as overridden.
+            const rawCli = cliOfRaw(entry.config);
+            if (rawCli)
+                this.cliByInstance.set(instanceId, rawCli);
+            const live = await driver.create({
+                instanceId,
+                displayName: entry.displayName ?? driver.metadata.displayName,
+                environment: entry.environment ?? {},
+                enabled: entry.enabled ?? true,
+                config,
+            });
+            return { instanceId, live: decorate ? decorate(live) : live };
+        }
+        catch (e) {
+            return {
+                instanceId,
+                shadow: {
                     instanceId,
-                    shadow: {
-                        instanceId,
-                        driverKind: entry.driver,
-                        displayName: entry.displayName ?? driver.metadata.displayName,
-                        cli: cliOfRaw(entry.config),
-                        shadow: true,
-                        reason: e instanceof Error ? e.message : String(e),
-                    },
-                });
-            }
+                    driverKind: entry.driver,
+                    displayName: entry.displayName ?? driver.metadata.displayName,
+                    cli: cliOfRaw(entry.config),
+                    shadow: true,
+                    reason: e instanceof Error ? e.message : String(e),
+                },
+            };
         }
     }
     get(instanceId) {
         return this.byId.get(instanceId)?.live ?? null;
     }
+    /** The snapshot describe() last read of this live instance; absent before
+     * the first read, or for an instance that is not live. */
+    lastSnapshot(instanceId) {
+        return this.byId.get(instanceId)?.live ? this.lastSnapshots.get(instanceId) : undefined;
+    }
+    /** How the instance's driver is presented and paid for (EngineAccess). */
+    access(instanceId) {
+        const entry = this.byId.get(instanceId);
+        return entry ? this.driversByKind.get(entry.shadow?.driverKind ?? entry.live.driverKind)?.metadata.access ?? "subscription" : undefined;
+    }
     /** The configured executable for instance-scoped maintenance actions.
      * This deliberately comes from the registry/config, never an HTTP body. */
     cliTarget(instanceId) {
@@ -211,6 +242,10 @@ export class ProviderRegistry {
             catch (e) {
                 snapshot = { state: "unavailable", reason: e instanceof Error ? e.message : String(e) };
             }
+            // Only while this is still the live instance: a reload may have
+            // replaced it during the read.
+            if (this.byId.get(inst.instanceId)?.live === inst)
+                this.lastSnapshots.set(inst.instanceId, snapshot);
             return {
                 instanceId: inst.instanceId,
                 driverKind: inst.driverKind,
@@ -256,11 +291,13 @@ export class ProviderRegistry {
         await Promise.allSettled(this.instances().map((i) => i.dispose()));
         this.byId.clear();
         this.cliByInstance.clear();
+        this.lastSnapshots.clear();
     }
     async dispose(instanceId) {
         const entry = this.byId.get(instanceId);
         this.byId.delete(instanceId);
         this.cliByInstance.delete(instanceId);
+        this.lastSnapshots.delete(instanceId);
         await entry?.live?.dispose();
     }
 }

package/dist-server/server/harness-capabilities.js

@@ -9,10 +9,12 @@
 // never drifts from what a turn is actually shown.
 import { APPROVAL_MODES, supportsApprovalMode as driverKindSupportsApprovalMode } from "../shared/approval-mode.js";
 import { availableTools } from "./drivers/agents-catalog.js";
-/** The widest turn the harness can build: every optional integration on and
- * a coordinating (room) turn, where the room-only coordination tools exist.
- * Both sides of a comparison get the same profile; only the driver's own
- * capability can differ. */
+/** The widest turn the harness can build: every optional integration on, a
+ * Chief of Staff (the only role shown the Chief-only tools) and a
+ * coordinating (room) turn, where the room-only coordination tools exist.
+ * So the count is an upper bound, not one bot's catalog. Both sides of a
+ * comparison get the same profile; only the driver's own capability can
+ * differ. */
 const ENVELOPE = {
     externalRuntime: false,
     coordinating: true,
@@ -22,6 +24,7 @@ const ENVELOPE = {
     voiceNotes: true,
     // Not a tool it adds: a Cloud home only hides its Local VM shell.
     cloudHome: false,
+    chief: true,
     botId: "",
 };
 /** Extra card lines for an engine switch, empty when nothing changes. */

package/dist-server/server/hosted-models.js

@@ -138,12 +138,14 @@ export function hostedModelPolicy(dataDirectory, env = process.env) {
                 const previousDefault = bot.modelSelection;
                 const nextDefault = select(previousDefault);
                 for (const task of store.tasks(bot.id)) {
+                    // A thread without a model of its own follows the bot onto its
+                    // assigned model; a thread's own model is moved onto one itself.
                     const current = task.modelSelection ?? previousDefault;
                     const next = select(current);
                     const changed = JSON.stringify(next) !== JSON.stringify(current);
                     if (changed || changedRoute)
                         store.patchTask(bot.id, task.threadId, {
-                            modelSelection: next, resumeCursors: {}, lastInstanceId: undefined, rewound: true,
+                            ...(task.modelSelection ? { modelSelection: next } : {}), resumeCursors: {}, lastInstanceId: undefined, rewound: true,
                             lastContextModel: undefined, appliedCompactionId: undefined,
                         });
                 }