run_turn was scheduled with asyncio.create_task and a try/finally with no
except: an unexpected exception escaping engine.run() or retry() died as an
unretrieved task exception and the GUI saw only a bare turn_done — a silently
dead turn with zero feedback. Broadcast an error event first, mirroring the
background-turn path in deliver_to_session. Fixes#367.
The Intel sidecar and program died on their first import; two libssl copies were bundled under one name.
The DMG build now starts the sidecar once (openworker-server --check).
Session auto-titling calls the provider from a background thread at the
start of turn 1, racing the turn for ScriptedProvider's next reply. Under
full-suite load it sometimes took the write_file tool call, so
test_ws_set_mode_auto_skips_approval never wrote a.py. The scripted
provider now answers title requests itself, and the one test that budgeted
an extra "Session title" turn for the race drops it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The human's ticks on the staffing card are the worker's grant; approvals follow the lead's mode.
A lead answers a worker's parked call; team and work-item gates keep their payload in the Inbox.
The title rides the user message the moment it lands — a long agentic turn no longer holds the session name hostage; an opener signature keeps the completion hook (background turns) from burning duplicate attempts.
Approval origins (reviewer/user/bypass, notes, grants) ride the tool message display sidecar so chips and deny blocks survive reload.
The Auto-Approve explainer is persisted once per session server-side with new shorter copy; later switches persist one-line markers.
swe-lead (minimal tools, coordination verbs) + swe/design/test workers with the shared worker contract; workers never surface in the picker — they're staffed, not started.
Staffing card rides the approval slot; workers nest under the lead's ONE expandable RECENT entry in both sidebar layouts.
Per-session coworker+folder chips replace the sidebar split-button picker; code family gets a send-time folder dialog with git-ready temp dirs and Save as project.
Builtins ship enabled; user-facing noun is Coworker; personas flag now defaults on.
WorkspaceTrustStore.set_trusted protected its state file with a bare
os.chmod(tmp, 0o600). On Windows that is a silent no-op, because os.chmod
only toggles the read-only bit there, so workspace_trust.json kept the broad
ACEs it inherited from its parent directory:
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
<user>:(I)(F)
coworker/secrets.py already documents this hazard and solves it in
_restrict_to_user() via icacls /inheritance:r /grant:r, exposed as the
write_private_text() helper. server/run.py uses that helper for the sidecar
auth token, but the trust store did not. Since this file is the allowlist
deciding which workspaces get auto-approved command execution, route it
through the same helper. Afterwards the file carries a single ACE:
<user>:(F)
The two tests meant to catch this asserted st_mode & 0o777 == 0o600, which is
unsatisfiable on Windows. os.stat cannot see ACLs there, so every writable
file reports 0o666, including the correctly protected sidecar token. Replace
both with a shared assert_user_only() that checks mode bits on POSIX and the
DACL on Windows.
Boundary-hardening pass addressing three audit findings on the local sidecar.
Shell command allowlist (andrewyng/openworker#28):
- Replace prefix-string matching in PermissionEngine._command_allowed with
argv-aware matching: reject any command containing shell operators
(; & | > < ` $( ( and newlines) before consulting the allowlist, then require
the allowlisted entry's tokens to be an exact argv prefix. This closes the
auto-run bypass where an allowlisted "git status" also auto-ran
"git status && rm -rf ~", pipes, redirection, and command substitution.
- Drop language interpreters / package managers (python, python3, node, npm,
npx) from DEFAULT_ALLOWED_COMMANDS — allowlisting an interpreter allowlists
arbitrary code (python3 -c "..."), defeating approval gating. Read-only
inspection commands and pytest remain.
MCP OAuth loopback (andrewyng/openworker#29):
- Verify the OAuth state at the loopback boundary. The MCP SDK already validates
state (compare_digest), so this is not a CSRF fix but defense-in-depth: capture
the state from the authorize URL and have deliver_callback ignore a callback
whose state does not match WITHOUT consuming the pending future, so a stray or
forged local hit can no longer abort a user's in-progress sign-in. Falls back to
prior accept-any behavior when no state was captured.
WebSocket ingestion caps (andrewyng/openworker#38):
- Bound a single user_message frame in the session WS loop: max text length,
max attachment count, and max total attachment bytes. Oversized frames get a
visible error frame and are dropped instead of being buffered into a turn; the
socket stays alive. Guards the unauthenticated loopback socket against cheap
memory spikes.
Tests:
- Allowlist: reject operator chaining (8 variants), argv-boundary matching, and
interpreters-not-auto-allowed-by-default.
- OAuth: state extraction, and mismatched/missing state ignored without consuming
the flow while the matching state still resolves it.
- WS: oversized text and too-many-attachments rejected with an error frame, and a
normal message still works afterwards.
Full suite: 865 passed (1 pre-existing unrelated failure in
test_provider_router::test_manager_curated_models, present on origin/main).
Gmail/Calendar/Drive show a disabled Coming-soon button; the server refuses the flow too.
Manual token connect and already-connected accounts are untouched.
Picker stays live for the session; switches persist a model_switch notice (§17 revised).
Rebinds refused mid-turn; images become placeholders for non-vision targets at send time.
Engine appends a display-only notice message on error/interrupted; providers never see it.
New retry frame re-runs a failed turn with no new user message, guarded on the error tail.
GUI renders persisted notices on reload and a Retry button on the trailing error.
Imported from andrewyng/aisuite@1b4bbf303e
(contents of its platform/ directory, hoisted to the repo root).
Development history prior to this commit lives in that repository.
Co-authored-by: Devika <devikaverma11@gmail.com>
Mumit Khan