@deployfoundation/foundation-deploy 0.2.19 → 0.2.21

package/agent-image/security-overlay.yml

@@ -7,6 +7,10 @@
 # Arrays in omp settings REPLACE — ship complete lists only here or in the
 # per-session project config, never split across layers.
 tools:
+  # Foundation intentionally defers a small set of authorized admin read tools.
+  # Fail hard if OMP cannot mount them; never expose their schemas top-level.
+  xdev: true
+  xdevDocs: catalog
   approvalMode: yolo
   # Global timeout ceiling in seconds — caps every resolved bash/eval timeout
   # (defaults included). NOTE: omp treats `timeout: 0` ("no deadline") as

package/dist/bin/app.js

@@ -8,13 +8,13 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-rhg6yfht.js";
+} from "../chunk-r6djsvkj.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-k2rxb77g.js";
+} from "../chunk-xb5k71tp.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";

package/dist/bin/foundation-deploy.js

@@ -29,7 +29,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-fjbc0ydk.js";
+} from "../chunk-zpjm151m.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -45,7 +45,7 @@ import {
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix
-} from "../chunk-k2rxb77g.js";
+} from "../chunk-xb5k71tp.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
@@ -102,6 +102,8 @@ var MAX_GOOGLE_TOKEN_RESPONSE_BYTES = 128 * 1024;
 
 // ../connectors/src/gmail.ts
 var GMAIL_LIST_SUMMARY_MAX_BYTES = 1024 * 1024;
+var MAX_GMAIL_ATTACHMENT_BYTES = 3.5 * 1024 * 1024;
+var MAX_GMAIL_ATTACHMENT_RESPONSE_BYTES = 5 * 1024 * 1024;
 var GMAIL_SCOPES = [
   "https://www.googleapis.com/auth/gmail.compose",
   "https://www.googleapis.com/auth/gmail.modify"
@@ -119,18 +121,132 @@ var GOOGLE_CALENDAR_EVENTS_SCOPE = [
 var GOOGLE_CALENDAR_JSON_MAX_BYTES = 2 * 1024 * 1024;
 // ../connectors/src/otter.ts
 var OTTER_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+// ../connectors/src/remote-mcp.ts
+var REMOTE_MCP_PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26"];
+var REMOTE_MCP_MAX_RESPONSE_BYTES = 1024 * 1024;
+var REMOTE_MCP_MAX_REQUEST_BYTES = 256 * 1024;
+var MAX_URL_CHARS = 2048;
+var MAX_TOKEN_TTL_SECONDS = 31 * 24 * 60 * 60;
+class RemoteMcpResponseTooLargeError extends Error {
+  constructor() {
+    super(`remote MCP response exceeded ${REMOTE_MCP_MAX_RESPONSE_BYTES} bytes`);
+    this.name = "RemoteMcpResponseTooLargeError";
+  }
+}
+class RemoteMcpTimeoutError extends Error {
+  constructor() {
+    super("remote MCP did not answer in time");
+    this.name = "RemoteMcpTimeoutError";
+  }
+}
+function defineRemoteMcpProvider(input) {
+  const protocolVersions = [...input.protocolVersions ?? REMOTE_MCP_PROTOCOL_VERSIONS];
+  if (protocolVersions.length === 0 || new Set(protocolVersions).size !== protocolVersions.length || !protocolVersions.every((version) => /^\d{4}-\d{2}-\d{2}$/.test(version)))
+    throw new Error("remote MCP provider: invalid protocolVersions");
+  if (!/^[A-Za-z0-9_.-]{1,128}$/.test(input.clientName))
+    throw new Error("remote MCP provider: invalid clientName");
+  return Object.freeze({
+    endpoint: httpsUrl(input.endpoint, "remote MCP provider: endpoint"),
+    issuer: httpsUrl(input.issuer, "remote MCP provider: issuer"),
+    tokenUrl: httpsUrl(input.tokenUrl, "remote MCP provider: tokenUrl"),
+    clientName: input.clientName,
+    protocolVersions: Object.freeze(protocolVersions)
+  });
+}
+async function readBoundedRemoteMcpResponse(response, maxBytes = REMOTE_MCP_MAX_RESPONSE_BYTES, signal) {
+  const chunks = [];
+  let total = 0;
+  await consumeBody(response, maxBytes, signal, (chunk) => {
+    chunks.push(chunk);
+    total += chunk.byteLength;
+    return false;
+  });
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+async function consumeBody(response, maxBytes, signal, onChunk) {
+  const declaredBytes = Number(response.headers.get("content-length") ?? "");
+  if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+    await response.body?.cancel().catch(() => {
+      return;
+    });
+    throw new RemoteMcpResponseTooLargeError;
+  }
+  const reader = response.body?.getReader();
+  if (reader === undefined)
+    return 0;
+  const cancel = () => {
+    reader.cancel().catch(() => {
+      return;
+    });
+  };
+  const aborted = () => signal?.aborted === true;
+  if (aborted()) {
+    cancel();
+    throw new RemoteMcpTimeoutError;
+  }
+  signal?.addEventListener("abort", cancel, { once: true });
+  let total = 0;
+  try {
+    while (true) {
+      let next;
+      try {
+        next = await reader.read();
+      } catch {
+        if (aborted())
+          throw new RemoteMcpTimeoutError;
+        throw new Error("remote MCP response could not be read");
+      }
+      if (aborted())
+        throw new RemoteMcpTimeoutError;
+      if (next.done)
+        return total;
+      total += next.value.byteLength;
+      if (total > maxBytes) {
+        cancel();
+        throw new RemoteMcpResponseTooLargeError;
+      }
+      if (onChunk(next.value)) {
+        cancel();
+        return total;
+      }
+    }
+  } finally {
+    signal?.removeEventListener("abort", cancel);
+  }
+}
+function httpsUrl(value, label) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${label} must be an HTTPS URL`);
+  }
+  if (value.length > MAX_URL_CHARS || url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hash !== "" || url.search !== "")
+    throw new Error(`${label} must be an HTTPS URL`);
+  return value;
+}
+
 // ../connectors/src/knock.ts
+var KNOCK_MCP_ENDPOINT = "https://mcp.knock.app/mcp";
+var KNOCK_OAUTH_ISSUER = "https://mcp.knock.app";
+var KNOCK_TOKEN_URL = "https://mcp.knock.app/token";
 var KNOCK_REGISTER_URL = "https://mcp.knock.app/register";
-var KNOCK_MAX_RESPONSE_BYTES = 1024 * 1024;
-var KNOCK_MAX_REQUEST_BYTES = 256 * 1024;
+var KNOCK_MCP_PROTOCOL_VERSION = "2025-06-18";
+var KNOCK_MCP_PROVIDER = defineRemoteMcpProvider({
+  endpoint: KNOCK_MCP_ENDPOINT,
+  issuer: KNOCK_OAUTH_ISSUER,
+  tokenUrl: KNOCK_TOKEN_URL,
+  clientName: "foundation-knock-proxy",
+  protocolVersions: [KNOCK_MCP_PROTOCOL_VERSION]
+});
 var MAX_CLIENT_ID_CHARS = 2048;
 var MAX_REDIRECT_URI_CHARS = 2048;
-class KnockResponseTooLargeError extends Error {
-  constructor() {
-    super(`Knock response exceeded ${KNOCK_MAX_RESPONSE_BYTES} bytes`);
-    this.name = "KnockResponseTooLargeError";
-  }
-}
 function parseKnockOAuthClient(raw) {
   const value = parseJsonObject(raw, "Knock OAuth client");
   const keys = Object.keys(value);
@@ -162,46 +278,12 @@ async function registerKnockPublicClient(args) {
   }
   if (!response.ok)
     throw new Error("Knock OAuth registration was rejected");
-  const body = parseJsonObject(await readBoundedKnockResponse(response), "Knock OAuth registration");
+  const body = parseJsonObject(await readBoundedRemoteMcpResponse(response), "Knock OAuth registration");
   return {
     client_id: requiredOpaqueString(body.client_id, "Knock OAuth registration: missing client_id", MAX_CLIENT_ID_CHARS),
     redirect_uri: redirectUri
   };
 }
-async function readBoundedKnockResponse(response, maxBytes = KNOCK_MAX_RESPONSE_BYTES) {
-  const declaredBytes = Number(response.headers.get("content-length") ?? "");
-  if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
-    await response.body?.cancel().catch(() => {
-      return;
-    });
-    throw new KnockResponseTooLargeError;
-  }
-  const reader = response.body?.getReader();
-  if (reader === undefined)
-    return "";
-  const chunks = [];
-  let total = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done)
-      break;
-    total += value.byteLength;
-    if (total > maxBytes) {
-      await reader.cancel().catch(() => {
-        return;
-      });
-      throw new KnockResponseTooLargeError;
-    }
-    chunks.push(value);
-  }
-  const bytes = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return new TextDecoder().decode(bytes);
-}
 function parseJsonObject(raw, label) {
   let value;
   try {

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-fjbc0ydk.js";
-import"../chunk-k2rxb77g.js";
+} from "../chunk-zpjm151m.js";
+import"../chunk-xb5k71tp.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-rhg6yfht.js → chunk-r6djsvkj.js}

@@ -19,7 +19,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-k2rxb77g.js";
+} from "./chunk-xb5k71tp.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -240,6 +240,21 @@ class FoundationAgent extends cdk.Stack {
       resources: [secretArnPattern(knockOauthClient), secretArnPattern(knockCredential)]
     }));
   }
+  denyDirectEmailSecretAccess(role, sharedMailboxSecret, personalSecretPrefix) {
+    const stack = cdk.Stack.of(this);
+    const personalSecrets = stack.formatArn({
+      service: "secretsmanager",
+      resource: "secret",
+      resourceName: `${personalSecretPrefix}/personal/*-??????`,
+      arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+    });
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenyEmailSecret",
+      effect: iam.Effect.DENY,
+      actions: ["secretsmanager:*"],
+      resources: [secretArnPattern(sharedMailboxSecret), personalSecrets]
+    }));
+  }
   pagesPolicy(id, role, instance, options) {
     if (!provisionsIntegration(instance, "pages"))
       return;
@@ -342,6 +357,7 @@ class FoundationAgent extends cdk.Stack {
     });
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
     this.denyDirectKnockSecretAccess(role, props);
+    this.denyDirectEmailSecretAccess(role, props.secrets.googleEmail, instanceNames(props.instance).secretGoogleEmail);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEtradeAccess(role, props);
     this.pagesPolicy("AgentReadOnlyPagesPolicy", role, props.instance, { invoke: false });
@@ -404,6 +420,7 @@ class FoundationAgent extends cdk.Stack {
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
+    this.denyDirectEmailSecretAccess(role, props.secrets.googleEmail, instanceNames(props.instance).secretGoogleEmail);
     this.denyDirectEtradeAccess(role, props);
     this.pagesPolicy("AgentExecutionPagesPolicy", role, props.instance, { invoke: true });
     const releaseRepositoryArn = releaseImageRepositoryArn(this);
@@ -472,12 +489,6 @@ class FoundationAgent extends cdk.Stack {
       actions: ["secretsmanager:GetSecretValue"],
       resources: [secretArnPattern(props.secrets.signing)]
     }));
-    role.addToPolicy(new iam.PolicyStatement({
-      sid: "DenyEmailSecret",
-      effect: iam.Effect.DENY,
-      actions: ["secretsmanager:GetSecretValue"],
-      resources: [secretArnPattern(props.secrets.googleEmail)]
-    }));
     role.addToPolicy(new iam.PolicyStatement({
       sid: "EmailProxyInvoke",
       actions: ["lambda:InvokeFunction"],
@@ -771,7 +782,6 @@ import * as scheduler from "aws-cdk-lib/aws-scheduler";
 import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import * as sns from "aws-cdk-lib/aws-sns";
 import * as sqs from "aws-cdk-lib/aws-sqs";
-import { parse as parseYaml } from "yaml";
 class FoundationApi extends cdk2.Stack {
   api;
   gatewayDlq;
@@ -788,6 +798,8 @@ class FoundationApi extends cdk2.Stack {
     super(scope, id, props);
     const names = instanceNames(props.instance);
     const display = props.instance.displayName;
+    const emailIdentities = emailIdentitiesFor(props.configPath);
+    const personalEmailIdentities = emailIdentities.filter((identity) => identity.owner !== undefined);
     const upwork = provisionsIntegration(props.instance, "upwork") ? upworkConfigForProvisioning(props.configPath) : undefined;
     const upworkSecret = upwork === undefined ? undefined : props.secrets.upwork;
     const upworkApprovalTable = upwork === undefined ? undefined : props.upworkApprovalTable;
@@ -825,6 +837,15 @@ class FoundationApi extends cdk2.Stack {
       retentionPeriod: cdk2.Duration.hours(6),
       deadLetterQueue: { queue: this.invokeDlq, maxReceiveCount: 1 }
     });
+    const personalEmailSecrets = personalEmailIdentities.map((identity) => new secretsmanager.Secret(this, `PersonalEmailSecret${identity.owner}`, {
+      secretName: `${instanceNames(props.instance).secretGoogleEmail}/personal/${identity.owner}`,
+      description: `${display} personal Gmail credential for Slack ${identity.owner}; gateway writes and email proxy reads`,
+      removalPolicy: cdk2.RemovalPolicy.DESTROY,
+      generateSecretString: {
+        secretStringTemplate: "{}",
+        generateStringKey: "placeholder"
+      }
+    }));
     const gatewayRole = new iam2.Role(this, "GatewayRole", {
       assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
       description: `${display} gateway Lambda role (least privilege)`,
@@ -851,7 +872,10 @@ class FoundationApi extends cdk2.Stack {
     gatewayRole.addToPolicy(new iam2.PolicyStatement({
       sid: "EmailIdentityConnect",
       actions: ["secretsmanager:PutSecretValue"],
-      resources: [secretArnPattern2(props.secrets.googleEmail)]
+      resources: [
+        secretArnPattern2(props.secrets.googleEmail),
+        ...personalEmailSecrets.map(secretArnPattern2)
+      ]
     }));
     if (props.secrets.knockCredential !== undefined) {
       gatewayRole.addToPolicy(new iam2.PolicyStatement({
@@ -948,9 +972,16 @@ class FoundationApi extends cdk2.Stack {
       FOUNDATION_DISPLAY_NAME: props.instance.displayName,
       FOUNDATION_ITEMS_TABLE_NAME: props.itemsTable.tableName,
       FOUNDATION_GOOGLE_CALENDAR_SECRET_ID: props.secrets.googleCalendar.secretName,
-      FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
+      FOUNDATION_GOOGLE_OAUTH_SECRET_ID: instanceNames(props.instance).secretGoogleOauth,
       FOUNDATION_GOOGLE_DRIVE_SECRET_ID: props.secrets.googleDrive.secretName,
-      FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
+      FOUNDATION_GOOGLE_EMAIL_SECRET_ID: instanceNames(props.instance).secretGoogleEmail,
+      ...personalEmailIdentities.length === 0 ? {} : {
+        FOUNDATION_PERSONAL_EMAIL_IDENTITIES: JSON.stringify(personalEmailIdentities.map(({ address, channel, owner }) => ({
+          address,
+          channel,
+          owner
+        })))
+      },
       ...props.secrets.knockOauthClient === undefined ? {} : { FOUNDATION_KNOCK_OAUTH_CLIENT_SECRET_ID: props.secrets.knockOauthClient.secretName },
       ...props.secrets.knockCredential === undefined ? {} : { FOUNDATION_KNOCK_CREDENTIAL_SECRET_ID: props.secrets.knockCredential.secretName },
       ...upworkSecret === undefined ? {} : { FOUNDATION_UPWORK_SECRET_ID: upworkSecret.secretName },
@@ -1095,7 +1126,9 @@ class FoundationApi extends cdk2.Stack {
       actions: ["secretsmanager:GetSecretValue"],
       resources: [
         secretArnPattern2(props.secrets.googleEmail),
-        secretArnPattern2(props.secrets.googleOauth)
+        secretArnPattern2(props.secrets.googleOauth),
+        secretArnPattern2(props.secrets.signing),
+        ...personalEmailSecrets.map(secretArnPattern2)
       ]
     }));
     emailProxyRole.addToPolicy(new iam2.PolicyStatement({
@@ -1112,9 +1145,11 @@ class FoundationApi extends cdk2.Stack {
       timeout: cdk2.Duration.seconds(30),
       memorySize: 256,
       environment: {
-        FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
-        FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
-        FOUNDATION_EMAIL_IDENTITIES: JSON.stringify(emailIdentitiesFor(props.configPath))
+        FOUNDATION_GOOGLE_EMAIL_SECRET_ID: instanceNames(props.instance).secretGoogleEmail,
+        FOUNDATION_GOOGLE_OAUTH_SECRET_ID: instanceNames(props.instance).secretGoogleOauth,
+        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+        FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
+        FOUNDATION_EMAIL_IDENTITIES: JSON.stringify(emailIdentities)
       }
     });
     const browserDomains = provisionsIntegration(props.instance, "browser") ? browserDomainsFor(props.configPath) : [];
@@ -1622,11 +1657,8 @@ function configTimezoneFor(configPath) {
   return parseInstanceConfig(readFileSync(configPath, "utf8")).timezone;
 }
 function emailIdentitiesFor(configPath) {
-  const doc = parseYaml(readFileSync(configPath, "utf8"));
-  const email = doc.capabilities?.email;
-  if (email?.enabled !== true || !Array.isArray(email.identities))
-    return [];
-  return email.identities;
+  const email = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.email;
+  return email.enabled ? email.identities : [];
 }
 var WEBHOOK_JOBS_MAX_ENV_BYTES = 2048;
 function webhookJobsFor(configPath) {

package/dist/{chunk-k2rxb77g.js → chunk-xb5k71tp.js}

@@ -223,10 +223,26 @@ var RawAwsReadonlyCapability = z.object({
 }).strict().default({});
 var RawEmailIdentity = z.object({
   address: z.string().regex(/^[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$/i),
-  channel: z.string().regex(/^[CG][A-Z0-9]{8,}$/),
+  channel: z.string().regex(/^[CGD][A-Z0-9]{8,}$/),
+  owner: z.string().regex(/^U[A-Z0-9]{8,}$/, "owner must be a Slack U id").optional(),
   signature: z.string().min(1).max(2000),
   sendAsAddresses: z.array(z.string().regex(/^[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$/i)).max(20).default([]).refine((addresses) => new Set(addresses.map((address) => address.toLowerCase())).size === addresses.length, "duplicate send-as address")
-}).strict();
+}).strict().superRefine((identity, ctx) => {
+  if (identity.channel.startsWith("D") && identity.owner === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["owner"],
+      message: "personal email identities in D channels require an owner"
+    });
+  }
+  if (!identity.channel.startsWith("D") && identity.owner !== undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["owner"],
+      message: "shared email identities in C/G channels cannot have an owner"
+    });
+  }
+});
 var RawEmailCapability = z.object({
   enabled: z.boolean().default(false),
   identities: z.array(RawEmailIdentity).default([]),
@@ -246,6 +262,19 @@ var RawEmailCapability = z.object({
       seen.add(key);
     }
   }
+  const personalOwners = new Set;
+  for (const [index, identity] of value.identities.entries()) {
+    if (identity.owner === undefined)
+      continue;
+    if (personalOwners.has(identity.owner)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["identities", index, "owner"],
+        message: `duplicate personal email identity owner: ${identity.owner}`
+      });
+    }
+    personalOwners.add(identity.owner);
+  }
   const owners = new Map;
   for (const [index, identity] of value.identities.entries()) {
     for (const address of [identity.address, ...identity.sendAsAddresses]) {

package/dist/{chunk-fjbc0ydk.js → chunk-zpjm151m.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-k2rxb77g.js";
+} from "./chunk-xb5k71tp.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-rhg6yfht.js";
+} from "../chunk-r6djsvkj.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -43,7 +43,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-k2rxb77g.js";
+} from "../chunk-xb5k71tp.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/stacks/agent-stack.ts

@@ -400,6 +400,33 @@ export class FoundationAgent extends cdk.Stack {
       }),
     );
   }
+  /**
+   * The execution role and its ReadOnlyAccess escape hatch are both
+   * shell-reachable. Keep Gmail credentials behind the proxy even if a future
+   * broad grant is added: the shared secret and all owner-derived personal
+   * secret names are explicitly denied here.
+   */
+  private denyDirectEmailSecretAccess(
+    role: iam.Role,
+    sharedMailboxSecret: secretsmanager.ISecret,
+    personalSecretPrefix: string,
+  ): void {
+    const stack = cdk.Stack.of(this);
+    const personalSecrets = stack.formatArn({
+      service: "secretsmanager",
+      resource: "secret",
+      resourceName: `${personalSecretPrefix}/personal/*-??????`,
+      arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+    });
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "DenyEmailSecret",
+        effect: iam.Effect.DENY,
+        actions: ["secretsmanager:*"],
+        resources: [secretArnPattern(sharedMailboxSecret), personalSecrets],
+      }),
+    );
+  }
 
   /**
    * Hosted pages belong to the conversations that made them, and every read
@@ -558,6 +585,11 @@ export class FoundationAgent extends cdk.Stack {
     });
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
     this.denyDirectKnockSecretAccess(role, props);
+    this.denyDirectEmailSecretAccess(
+      role,
+      props.secrets.googleEmail,
+      namesFor(props.instance).secretGoogleEmail,
+    );
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEtradeAccess(role, props);
     this.pagesPolicy("AgentReadOnlyPagesPolicy", role, props.instance, { invoke: false });
@@ -652,6 +684,11 @@ export class FoundationAgent extends cdk.Stack {
     this.denyDirectCrmTableAccess(role, props.instance, props.crmTable);
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
+    this.denyDirectEmailSecretAccess(
+      role,
+      props.secrets.googleEmail,
+      namesFor(props.instance).secretGoogleEmail,
+    );
     this.denyDirectEtradeAccess(role, props);
     this.pagesPolicy("AgentExecutionPagesPolicy", role, props.instance, { invoke: true });
 
@@ -749,20 +786,6 @@ export class FoundationAgent extends cdk.Stack {
         resources: [secretArnPattern(props.secrets.signing)],
       }),
     );
-    // Email is the sharpest version of the same argument as the signing
-    // secret, and the reason the proxy is a separate Lambda. The scope Google
-    // grants the mailbox (`gmail.compose`) permits SENDING, so a container
-    // that could read this secret could send mail as the company — and the
-    // model's shell can reach the execution role's credentials. Denying the
-    // read is what makes "the teammate cannot send" true rather than merely intended.
-    role.addToPolicy(
-      new iam.PolicyStatement({
-        sid: "DenyEmailSecret",
-        effect: iam.Effect.DENY,
-        actions: ["secretsmanager:GetSecretValue"],
-        resources: [secretArnPattern(props.secrets.googleEmail)],
-      }),
-    );
     // The whole of the agent's email permission: invoke the proxy. Not the
     // Gmail API, not the secret, not the identity list.
     // Built from the NAME rather than from FoundationApi's function object: FoundationApi

package/src/stacks/api-stack.ts

@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs";
 import {
   type CrmOutreachConfig,
+  type EmailIdentity,
   type ScheduledJobBinding,
   type ScheduledJobConfig,
   type WebhookJobBinding,
@@ -132,6 +133,10 @@ export class FoundationApi extends cdk.Stack {
     super(scope, id, props);
     const names = namesFor(props.instance);
     const display = props.instance.displayName;
+    const emailIdentities = emailIdentitiesFor(props.configPath);
+    const personalEmailIdentities = emailIdentities.filter(
+      (identity): identity is EmailIdentity & { owner: string } => identity.owner !== undefined,
+    );
     const upwork = provisionsIntegration(props.instance, "upwork")
       ? upworkConfigForProvisioning(props.configPath)
       : undefined;
@@ -190,6 +195,23 @@ export class FoundationApi extends cdk.Stack {
       deadLetterQueue: { queue: this.invokeDlq, maxReceiveCount: 1 },
     });
 
+    // Personal grants are separate deployment-owned shells with exact proxy
+    // reads. Removing a personal identity deletes its stored refresh token;
+    // re-enabling it requires fresh Google consent instead of adopting a stale
+    // retained credential. Google-side revocation remains the account owner's.
+    const personalEmailSecrets = personalEmailIdentities.map(
+      (identity) =>
+        new secretsmanager.Secret(this, `PersonalEmailSecret${identity.owner}`, {
+          secretName: `${namesFor(props.instance).secretGoogleEmail}/personal/${identity.owner}`,
+          description: `${display} personal Gmail credential for Slack ${identity.owner}; gateway writes and email proxy reads`,
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+          generateSecretString: {
+            secretStringTemplate: "{}",
+            generateStringKey: "placeholder",
+          },
+        }),
+    );
+
     const gatewayRole = new iam.Role(this, "GatewayRole", {
       assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
       description: `${display} gateway Lambda role (least privilege)`,
@@ -229,11 +251,15 @@ export class FoundationApi extends cdk.Stack {
     gatewayRole.addToPolicy(
       new iam.PolicyStatement({
         sid: "EmailIdentityConnect",
-        // The same shape, and here it matters more: the mailbox credential is
-        // the one thing in the system that could SEND mail. A read grant would
-        // put it one injection away from an internet-facing Lambda.
+        // The same shape, and here it matters more: a mailbox credential is
+        // the one thing in the system that could SEND mail. The gateway may
+        // write the shared mailbox and these exact configured personal shells,
+        // but never read either one.
         actions: ["secretsmanager:PutSecretValue"],
-        resources: [secretArnPattern(props.secrets.googleEmail)],
+        resources: [
+          secretArnPattern(props.secrets.googleEmail),
+          ...personalEmailSecrets.map(secretArnPattern),
+        ],
       }),
     );
     if (props.secrets.knockCredential !== undefined) {
@@ -376,9 +402,22 @@ export class FoundationApi extends cdk.Stack {
       FOUNDATION_DISPLAY_NAME: props.instance.displayName,
       FOUNDATION_ITEMS_TABLE_NAME: props.itemsTable.tableName,
       FOUNDATION_GOOGLE_CALENDAR_SECRET_ID: props.secrets.googleCalendar.secretName,
-      FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
+      FOUNDATION_GOOGLE_OAUTH_SECRET_ID: namesFor(props.instance).secretGoogleOauth,
       FOUNDATION_GOOGLE_DRIVE_SECRET_ID: props.secrets.googleDrive.secretName,
-      FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
+      FOUNDATION_GOOGLE_EMAIL_SECRET_ID: namesFor(props.instance).secretGoogleEmail,
+      ...(personalEmailIdentities.length === 0
+        ? {}
+        : {
+            // The gateway needs no signatures or aliases; this compact mapping
+            // is enough to bind a slash command and callback to one owner/DM.
+            FOUNDATION_PERSONAL_EMAIL_IDENTITIES: JSON.stringify(
+              personalEmailIdentities.map(({ address, channel, owner }) => ({
+                address,
+                channel,
+                owner,
+              })),
+            ),
+          }),
       ...(props.secrets.knockOauthClient === undefined
         ? {}
         : { FOUNDATION_KNOCK_OAUTH_CLIENT_SECRET_ID: props.secrets.knockOauthClient.secretName }),
@@ -593,11 +632,10 @@ export class FoundationApi extends cdk.Stack {
     }
 
     // --- email proxy -----------------------------------------------------
-    // The permission barrier for Gmail, and the reason the design puts it in
-    // a Lambda rather than a broker inside the agent container: this role is
-    // the ONLY principal in the account that can read the mailbox secret, and
-    // the agent's execution role carries an explicit Deny on it. A fully
-    // hijacked session can invoke the four operations and nothing more.
+    // The permission barrier for Gmail. Only this role can read the mailbox
+    // grants; the agent's execution and assumed read-only roles explicitly
+    // deny those secrets. Personal access also verifies a short-lived signed
+    // owner/DM/session claim before reading its separate credential.
     const emailProxyRole = new iam.Role(this, "EmailProxyRole", {
       assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
       description: `${display} email proxy Lambda role (the only reader of the mailbox secret)`,
@@ -609,11 +647,13 @@ export class FoundationApi extends cdk.Stack {
       new iam.PolicyStatement({
         sid: "EmailProxyCredentials",
         actions: ["secretsmanager:GetSecretValue"],
-        // Exactly two: the mailbox, and the OAuth client its token is minted
-        // with. Nothing else in the account is readable by this role.
+        // Exact shared, OAuth, signing, and configured personal secret ARNs:
+        // a config sync cannot grant a future owner's mailbox.
         resources: [
           secretArnPattern(props.secrets.googleEmail),
           secretArnPattern(props.secrets.googleOauth),
+          secretArnPattern(props.secrets.signing),
+          ...personalEmailSecrets.map(secretArnPattern),
         ],
       }),
     );
@@ -638,12 +678,14 @@ export class FoundationApi extends cdk.Stack {
       // below its minimum", 2026-09-06). Gmail-side rate is bounded
       // by the hourly routine and one turn per channel at a time instead.
       environment: {
-        FOUNDATION_GOOGLE_EMAIL_SECRET_ID: props.secrets.googleEmail.secretName,
-        FOUNDATION_GOOGLE_OAUTH_SECRET_ID: props.secrets.googleOauth.secretName,
+        FOUNDATION_GOOGLE_EMAIL_SECRET_ID: namesFor(props.instance).secretGoogleEmail,
+        FOUNDATION_GOOGLE_OAUTH_SECRET_ID: namesFor(props.instance).secretGoogleOauth,
+        FOUNDATION_SLACK_SIGNING_SECRET_ID: props.secrets.signing.secretName,
+        FOUNDATION_SLACK_TEAM_ID: props.instance.slack.teamId,
         // Read at SYNTH from the instance's config file. The identity list a
         // turn can draft as is therefore fixed at deploy time and cannot be
         // widened by anything the agent sends or by a config sync alone.
-        FOUNDATION_EMAIL_IDENTITIES: JSON.stringify(emailIdentitiesFor(props.configPath)),
+        FOUNDATION_EMAIL_IDENTITIES: JSON.stringify(emailIdentities),
       },
     });
 
@@ -1297,21 +1339,16 @@ function configTimezoneFor(configPath: string): string {
 }
 
 /**
- * The mailbox identities to bake into the proxy, read from the instance's own
- * config file at synth.
+ * The mailbox identities to bake into the proxy and personal OAuth gateway
+ * policy, parsed with the runtime schema at synth.
  *
- * A plain file read: the CDK app must synthesize with no credentials and no
- * network. A disabled capability yields an empty list, and so does a config
- * that does not mention email at all — the proxy then refuses every identity,
- * which is the correct behaviour for a capability nobody has turned on.
+ * A disabled capability yields an empty list. Parsing here deliberately makes
+ * malformed owner/channel bindings a deployment failure rather than allowing a
+ * looser raw YAML shape into an IAM policy or Lambda environment.
  */
-export function emailIdentitiesFor(configPath: string): unknown[] {
-  const doc = parseYaml(readFileSync(configPath, "utf8")) as {
-    capabilities?: { email?: { enabled?: unknown; identities?: unknown } };
-  };
-  const email = doc.capabilities?.email;
-  if (email?.enabled !== true || !Array.isArray(email.identities)) return [];
-  return email.identities;
+export function emailIdentitiesFor(configPath: string): EmailIdentity[] {
+  const email = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.email;
+  return email.enabled ? email.identities : [];
 }
 
 /**