代办与 Doorman

在隔离的沙箱中完成比价、填表与预订，经由 Doorman 隔离凭证并管控出网请求。

在 OpenMousse app 的对话列表中点开默认启用的「代办」，或在「主对话」中直接交办预订、比价与填表任务即可使用。

代办 Agent 负责替你在外部网页上完成比价、填表、预订与购买等事务。为了防止外部网页上的恶意内容窃取你的密码或擅自执行操作，代办 Agent 运行在隔离的沙箱中，且所有出网请求与账号凭证均由守门组件 Doorman 独立管控。

运作机制与三道防线

当你把一项外部事务交给代办 Agent 时，系统通过三道防线保障安全：

1.隔离沙箱与出网管控：代办 Agent 在隔离的沙箱环境中打开网页、读取外部内容、比价与填写表单。沙箱无法直接访问互联网，所有网络请求必须经过 Doorman 才能发出；外部网页的内容也仅由沙箱内的代办 Agent 读取，不接触系统的其他部分。
2.凭证占位符替换：你的网站账号与密码由 Doorman 独立保管，代办 Agent 本身拿不到真实密码，只持有一个占位符。仅当网络请求经过 Doorman 离开服务器的那一刻，Doorman 才会将占位符替换为真实值，且严格限制只发往该凭证绑定的目标网站。
3.撤不回的操作先问你：查询与比价可在沙箱内自动完成；一旦涉及表单提交、对外发送、账号登录或付款，代办 Agent 会立即停下来生成一张锁定参数的确认卡，放入收件箱与「今天 → 待处理」，等你批准后才按原参数执行。

Doorman 的其他职责

除了管控代办 Agent 的出网请求与密码替换外，Doorman 还负责复查「管家」的对外回复：当好友或好友的管家向你的管家提问时，管家生成的每一句回复在发出前都要经 Doorman 检查；若 Doorman 发现回复中有不妥内容（如包含未开放的个人信息），会将其扣下并交由你决定照发、修改或不发。

不在这里的东西

•代办 Agent 看不到你的真实密码：密码明文或密文均不进入代办 Agent 的上下文，也不会发往你所选的模型服务。
•外部网页无法触发内部工具：沙箱外的系统数据、世界树与各功能 Agent 的记忆均与外部网页隔离。

另见

•先问你（收件箱）：了解确认卡的参数锁定与批准流程。
•数据与安全：了解全系统的外部连接清单与外来信息隔离机制。
•好友与播客：了解管家对外回复时 Doorman 的复查流程。

最后更新于 2026-10-19这一页有帮助吗？

For a complete index of the docs, see llms.txt. Append .md to any URL for the Markdown version; this page's Markdown is at errands.md.

Features

Errands and Doorman

Compare prices, fill forms, and book in an isolated sandbox while Doorman isolates credentials and governs outbound requests.

Open the default Errand agent in the OpenMousse app's conversation list, or hand off booking, price comparison, and form-filling tasks directly in Main chat.

The Errands agent handles external web tasks such as comparing prices, filling out forms, booking, and making purchases on your behalf. To prevent malicious content on external web pages from stealing your passwords or performing unauthorized actions, the Errands agent runs in an isolated sandbox, and all outbound requests and account credentials are independently governed by the gatekeeper component Doorman.

How It Works and Three Lines of Defense

When you hand an external task to the Errands agent, the system protects your security through three lines of defense:

1.Isolated sandbox and outbound governance: The Errands agent opens web pages, reads external content, compares prices, and fills out forms inside an isolated sandbox environment. The sandbox cannot access the internet directly; all network requests must pass through Doorman to be sent out. Content from external web pages is read only by the Errands agent inside the sandbox and never touches the rest of the system.
2.Credential placeholder substitution: Your website usernames and passwords are kept independently by Doorman. The Errands agent never receives the real password and holds only a placeholder. Only at the exact moment a network request passes through Doorman to leave the server does Doorman replace the placeholder with the real value, and it strictly restricts the credential to be sent only to the target website to which it is bound.
3.Irreversible actions ask you first: Lookups and price comparisons can complete automatically inside the sandbox. As soon as a task involves submitting a form, sending something externally, logging in to an account, or making a payment, the Errands agent stops immediately, generates a parameter-locked approval card, and places it in the inbox and Today → To do. It executes with the original parameters only after you approve.

Doorman's Other Responsibilities

In addition to governing outbound requests and password substitution for the Errands agent, Doorman also reviews outbound replies from the Butler: when a friend or a friend's Butler asks your Butler a question, every reply your Butler generates must be inspected by Doorman before it is sent. If Doorman finds inappropriate content in a reply (such as personal information you have not shared), it holds the reply back and lets you decide whether to send it as is, edit it, or discard it.

What Is Not Here

•The Errands agent cannot see your real passwords: Neither plaintext nor encrypted passwords ever enter the Errands agent's context, nor are they sent to your chosen model provider.
•External web pages cannot trigger internal tools: System data outside the sandbox, the memory tree, and the memories of functional agents are isolated from external web pages.