openwork-server 0.18.49 → 0.18.50

package/README.md

@@ -11,6 +11,36 @@ openwork-server --workspace /path/to/workspace --approval auto
 
 `openwork-server` ships as a compiled binary, so Bun is not required at runtime.
 
+### Self-hosted web UI
+
+```bash
+npm install -g openwork-server
+cd /path/to/workspace
+openwork-server web --open
+```
+
+`openwork-server web` serves the OpenWork web UI and API from one origin and
+runs a server-managed OpenCode engine. The npm package bundles the UI and the
+OpenCode plugins; on first run it downloads the exact OpenCode version this
+release was tested with into `~/.openwork/openwork-server/engines/` and reuses
+it afterwards. Updating is `npm i -g openwork-server@latest`; the server prints
+a hint on boot when a newer release exists (`OPENWORK_NO_UPDATE_CHECK=1` to
+silence).
+
+Defaults in `web` mode: bind `127.0.0.1`, approval `auto`, workspace = current
+directory, and the browser is signed in automatically via a bootstrap token
+(pass `--no-bootstrap-token` to require pasting the client token). Tokens are
+persisted in `~/.openwork/openwork-server/web-tokens.json` so they survive
+restarts; `--token`/`--host-token` or `OPENWORK_TOKEN`/`OPENWORK_HOST_TOKEN`
+override them.
+
+To reach it from other machines, keep the server on `127.0.0.1` and put a TLS
+proxy in front (e.g. `tailscale serve --bg --https=8787 http://127.0.0.1:8787`).
+Browsers require a secure context for the UI on any non-localhost origin.
+Set `OPENWORK_OPENCODE_BIN` to use your own OpenCode install instead of the
+managed download; `/health` reports both the pinned `opencodeVersion` and the
+`opencodeInstalledVersion` actually running.
+
 Or from source:
 
 ```bash

package/bin/openwork-server.mjs

@@ -14,7 +14,9 @@ const builtCli = fileURLToPath(new URL("./dist/cli.js", `${new URL("../", import
 const sourceCli = fileURLToPath(new URL("./src/cli.ts", `${new URL("../", import.meta.url)}`));
 
 function run(command, commandArgs) {
-  const result = spawnSync(command, commandArgs, { stdio: "inherit" });
+  // Lets `openwork-server web` find the bundled web UI and plugins next to this launcher.
+  const env = { ...process.env, OPENWORK_PACKAGE_ROOT: process.env.OPENWORK_PACKAGE_ROOT ?? packageRoot };
+  const result = spawnSync(command, commandArgs, { stdio: "inherit", env });
   if (result.error) {
     if (result.error.code === "ENOENT") {
       console.error(`Missing runtime dependency: ${command}`);

package/dist/bin/openwork-server

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/bin/openwork-server
-size: 107032735 bytes
-sha256: d43996d3c3e7323d649c0b7af8bf0850c2a3df53e80faa81f78d0bfd2f0f7cd3
+size: 107054076 bytes
+sha256: dcc228940a40da8e36e1b949c5d01041c0602c4c0185de6f1d8990e3bbdda1e0

package/dist/opencode-plugins/agent-instruction-compose.js

@@ -0,0 +1,81 @@
+/**
+ * Kent-style instruction primitives for OpenWork system-prompt composition.
+ *
+ * create  — build one named section
+ * combine — merge sections in order, one id wins (first non-empty)
+ * delete  — drop a section by id
+ * expand  — replace a section body with derived text when present
+ * compose — combine sections and return their prompt bodies
+ *
+ * Sections are the unit of overlap control: routing/tools/skills/session each
+ * own one id so transforms stop stacking contradictory brochure text.
+ */
+export function createInstructionSection(id, body) {
+    return { id, body: body.trim() };
+}
+export function combineInstructionSections(...groups) {
+    const seen = new Set();
+    const combined = [];
+    for (const group of groups) {
+        if (!group)
+            continue;
+        const sections = Array.isArray(group) ? group : [group];
+        for (const section of sections) {
+            if (!section.body || seen.has(section.id))
+                continue;
+            seen.add(section.id);
+            combined.push(section);
+        }
+    }
+    return combined;
+}
+export function deleteInstructionSection(sections, id) {
+    return sections.filter((section) => section.id !== id);
+}
+export function expandInstructionSection(sections, id, expand) {
+    return sections.map((section) => (section.id === id
+        ? { ...section, body: expand(section.body).trim() }
+        : section)).filter((section) => section.body.length > 0);
+}
+export function composeAgentInstructions(...groups) {
+    const seen = new Set();
+    const instructions = [];
+    for (const group of groups) {
+        if (!group)
+            continue;
+        const sections = Array.isArray(group) ? group : [group];
+        for (const section of sections) {
+            if (seen.has(section.id))
+                continue;
+            const body = section.body;
+            if (!body)
+                continue;
+            seen.add(section.id);
+            instructions.push(body);
+        }
+    }
+    return instructions;
+}
+/**
+ * Extend the engine's system prompt in place from an
+ * `experimental.chat.system.transform` hook.
+ *
+ * OpenCode sends every entry of `system` as its own `role: "system"` message.
+ * Several chat templates behind OpenAI-compatible endpoints reject any system
+ * message after the first ("System message must be at the beginning."), so
+ * OpenWork folds its instructions into the existing entry instead of pushing a
+ * second one. The engine alone sends a single system message; this keeps that
+ * shape intact. Sections are separated by a blank line so each heading starts
+ * its own paragraph instead of trailing the previous sentence.
+ */
+export function appendAgentInstructions(system, ...groups) {
+    const body = composeAgentInstructions(...groups).join("\n\n");
+    if (!body)
+        return;
+    const last = system.length - 1;
+    if (last < 0) {
+        system.push(body);
+        return;
+    }
+    system[last] = system[last] ? `${system[last]}\n\n${body}` : body;
+}

package/dist/opencode-plugins/gmail-attachment-fulfillment.js

@@ -0,0 +1,199 @@
+import { z } from "zod";
+const draftSchema = z.object({
+    to: z.string().trim().min(3).max(320),
+    cc: z.string().trim().min(3).max(1_000).optional(),
+    bcc: z.string().trim().min(3).max(1_000).optional(),
+    subject: z.string().trim().min(1).max(500),
+    body: z.string().min(1).max(50_000),
+    threadId: z.string().trim().min(1).max(512).optional(),
+    attachments: z.array(z.string().min(1).refine((path) => path.trim().length > 0 && !path.includes("\0"))).min(1).max(10),
+}).strict().refine((draft) => !/^\s*(re|fwd?)\s*:/i.test(draft.subject) || !!draft.threadId);
+const markerSchema = z.object({
+    ok: z.literal(false),
+    error: z.literal("file_input_requires_host"),
+    created: z.literal(false),
+    message: z.string(),
+}).strict();
+// Strip unexpected fields so neither inline bytes nor action descriptors can
+// leak from a transport response into the model-visible draft receipt.
+const receiptSchema = z.object({
+    ok: z.literal(true),
+    draftId: z.string().trim().min(1),
+    messageId: z.string().nullable().optional(),
+    draftUrl: z.string().nullable().optional(),
+    threadUrl: z.string().nullable().optional(),
+    to: z.string().optional(),
+    subject: z.string().optional(),
+    threadId: z.string().nullable().optional(),
+    quotedHistoryIncluded: z.boolean().optional(),
+    attachments: z.array(z.object({
+        filename: z.string(),
+        mimeType: z.string(),
+        size: z.number().int().nonnegative(),
+    })).optional(),
+});
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeJson(value) {
+    if (typeof value !== "string")
+        return value;
+    const text = value.trim();
+    if (!text.startsWith("{") && !text.startsWith("["))
+        return value;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return value;
+    }
+}
+const UNKNOWN_OUTCOME = "Gmail draft creation outcome unknown; verify drafts before retrying. Do not retry automatically or create a draft without attachments.";
+const CANCELLED_BEFORE_UPLOAD = "Gmail attachment upload cancelled before dispatch; no draft created.";
+const NATIVE_GMAIL = /^native:(google-workspace|emc_[A-Za-z0-9]+):postCapabilitiesGoogleWorkspaceGmailDrafts$/;
+// These exact code/status pairs are returned before draft creation. In
+// particular, never classify google_api_error, a 5xx, or a lost response here.
+const LOCAL_NO_WRITE = new Set([
+    "invalid_payload:400", "file_not_found:404", "file_too_large:413", "files_too_large:413",
+    "cloud_not_connected:409", "cloud_endpoint_invalid:409", "gmail_host_unavailable:409",
+    "unauthorized:401", "forbidden:403", "gmail_attachment_cancelled:499",
+]);
+const CLOUD_NO_WRITE = new Set([
+    "invalid_request:400", "invalid_request:413", "missing_thread_id:400",
+    "needs_connection:409", "unauthorized:401", "forbidden:403", "policy_blocked:403",
+    "missing_mcp_token:401", "invalid_mcp_token:401", "wrong_token_use:401", "wrong_mcp_resource:401",
+    "missing_mcp_principal:401", "mcp_grant_revoked:401", "mcp_session_required:401", "mcp_session_revoked:401",
+    "insufficient_mcp_scope:403", "mcp_membership_revoked:403",
+]);
+function noWriteMessage(error) {
+    if (!isRecord(error) || typeof error.message !== "string")
+        return;
+    if (LOCAL_NO_WRITE.has(`${error.code}:${error.status}`))
+        return `${error.message} No draft created.`;
+    if (error.code === "cloud_upload_failed" && isRecord(error.details)
+        && CLOUD_NO_WRITE.has(`${error.details.upstreamCode}:${error.status}`)) {
+        return `${error.message} No draft created.`;
+    }
+}
+export function createGmailAttachmentFulfillment(dependencies, factoryContext = {}) {
+    // Retain invocation guards until disposal, including cancelled preflights.
+    // A later busy event must not revive a previous call's cancelled controller.
+    const calls = new Map();
+    const idleSessions = new Set();
+    let disposed = false;
+    function invocation(sessionID, callID) {
+        const key = JSON.stringify([sessionID, callID]);
+        const existing = calls.get(key);
+        if (existing)
+            return existing;
+        const call = { sessionID, controller: new AbortController(), attempted: false };
+        if (disposed || idleSessions.has(sessionID))
+            call.controller.abort();
+        calls.set(key, call);
+        return call;
+    }
+    const fulfill = async (input, output) => {
+        // OpenCode 1.18.18 McpCatalog.toolName preserves hyphens in server names.
+        if (!isRecord(input) || input.tool !== "openwork-cloud_execute_capability")
+            return;
+        if (!isRecord(input.args) || typeof input.args.name !== "string")
+            return;
+        const native = NATIVE_GMAIL.exec(input.args.name);
+        const connectionId = native?.[1];
+        if (!connectionId || !isRecord(output) || output.isError === true)
+            return;
+        // Only the whole native preflight payload is a marker, never embedded text
+        // or a nested descriptor from an external MCP. Conflicting projections fail closed.
+        if (!Array.isArray(output.content) || output.content.length !== 1)
+            return;
+        const part = output.content[0];
+        if (!isRecord(part) || part.type !== "text" || typeof part.text !== "string")
+            return;
+        if (!markerSchema.safeParse(normalizeJson(part.text)).success)
+            return;
+        if (output.structuredContent !== undefined && !markerSchema.safeParse(output.structuredContent).success)
+            return;
+        const draft = draftSchema.safeParse(normalizeJson(input.args.body));
+        if (!draft.success)
+            throw new Error("Invalid Gmail attachment draft arguments; no upload attempted.");
+        if (typeof input.sessionID !== "string" || !input.sessionID.trim()
+            || typeof input.callID !== "string" || !input.callID.trim()) {
+            throw new Error("Gmail attachment fulfillment requires invocation sessionID and callID; no upload attempted.");
+        }
+        const call = invocation(input.sessionID, input.callID);
+        if (call.attempted)
+            throw new Error(`Gmail attachment invocation already attempted. ${UNKNOWN_OUTCOME}`);
+        if (call.controller.signal.aborted)
+            throw new Error(CANCELLED_BEFORE_UPLOAD);
+        call.attempted = true;
+        const { attachments, ...fields } = draft.data;
+        let result;
+        try {
+            result = await dependencies.callExtension({
+                extensionId: "openwork-cloud-uploads",
+                action: "gmail_create_draft_with_attachments",
+                args: { ...fields, paths: attachments, connectionId },
+                context: { ...factoryContext, sessionId: input.sessionID, callId: input.callID },
+            }, call.controller.signal);
+        }
+        catch (error) {
+            const message = noWriteMessage(error);
+            if (message)
+                throw new Error(message);
+            // A lost response cannot prove that Gmail did not create the draft.
+            throw new Error(UNKNOWN_OUTCOME);
+        }
+        if (call.controller.signal.aborted)
+            throw new Error(UNKNOWN_OUTCOME);
+        if (isRecord(result) && result.ok === false) {
+            throw new Error(UNKNOWN_OUTCOME);
+        }
+        const receipt = receiptSchema.safeParse(result);
+        if (!receipt.success)
+            throw new Error(UNKNOWN_OUTCOME);
+        const text = JSON.stringify(receipt.data);
+        // The pinned engine projects content AFTER this hook, not output. Keep
+        // both consistent for consumers that already have a text projection.
+        output.content = [{ type: "text", text }];
+        output.structuredContent = receipt.data;
+        if ("output" in output)
+            output.output = text;
+        output.isError = false;
+        delete output._meta;
+    };
+    return Object.assign(fulfill, {
+        before: async (input, output) => {
+            if (!isRecord(input) || input.tool !== "openwork-cloud_execute_capability"
+                || typeof input.sessionID !== "string" || typeof input.callID !== "string"
+                || !isRecord(output) || !isRecord(output.args) || typeof output.args.name !== "string"
+                || !NATIVE_GMAIL.test(output.args.name))
+                return;
+            const body = normalizeJson(output.args.body);
+            if (isRecord(body) && Array.isArray(body.attachments))
+                invocation(input.sessionID, input.callID);
+        },
+        event: async (input) => {
+            // OpenCode 1.18.18 Runner.cancel -> onIdle -> SessionStatus.set;
+            // Plugin.event receives { event: { type, properties } }. No input.abort exists.
+            if (!isRecord(input) || !isRecord(input.event) || input.event.type !== "session.status")
+                return;
+            const props = input.event.properties;
+            if (!isRecord(props) || typeof props.sessionID !== "string" || !isRecord(props.status))
+                return;
+            if (props.status.type === "busy")
+                idleSessions.delete(props.sessionID);
+            if (props.status.type !== "idle")
+                return;
+            idleSessions.add(props.sessionID);
+            for (const call of calls.values()) {
+                if (call.sessionID === props.sessionID)
+                    call.controller.abort();
+            }
+        },
+        dispose: async () => {
+            disposed = true;
+            for (const call of calls.values())
+                call.controller.abort();
+        },
+    });
+}

package/dist/opencode-plugins/managed-policy-client.js

@@ -0,0 +1,39 @@
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function record(value) { return isRecord(value) ? value : {}; }
+export async function checkManagedTool(tool, raw, evaluate = check) {
+    const input = record(raw);
+    let action;
+    if (tool === "bash" || tool === "shell")
+        action = "shell";
+    else if (["write", "edit", "apply_patch", "patch"].includes(tool))
+        action = "file_write";
+    else if (tool === "webfetch" || tool === "websearch")
+        action = tool;
+    else if (tool === "browser_navigate" || tool === "browser_open")
+        action = "browser";
+    else if (tool === "openwork_execute") {
+        if (input.id === "browser.open_url")
+            return evaluate("browser", record(input.args));
+        if (typeof input.id === "string" && /^(?:plugin|skill|mcp)\.(?:install|add|update|remove)/.test(input.id))
+            action = "extensions";
+    }
+    // Even read-only tools synchronize policy, so unknown identities cannot keep
+    // running with a previous member's loaded configuration.
+    await evaluate(action ?? "sync", input);
+}
+export async function check(action, input) {
+    const base = process.env.OPENWORK_SERVER_URL;
+    const token = process.env.OPENWORK_POLICY_TOKEN;
+    if (!base || !token)
+        throw new Error("OpenWork policy service is unavailable.");
+    const response = await fetch(`${base}/managed-policy/evaluate`, {
+        method: "POST", headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ action, input }), signal: AbortSignal.timeout(15_000),
+    });
+    if (!response.ok) {
+        const payload = record(await response.json());
+        throw new Error(typeof payload.message === "string" ? payload.message : "Your organization blocked this action.");
+    }
+}