@forwardimpact/outpost 3.8.1 → 3.9.0

package/config/scheduler.json

@@ -1,32 +1,38 @@
 {
   "agents": {
     "postman": {
-      "kb": "~/Documents/Personal",
+      "kb": "~/.local/share/fit/outpost/Team",
+      "privilege": "full",
       "schedule": { "type": "cron", "expression": "*/15 8-18 * * 1-5" },
       "enabled": true
     },
     "concierge": {
-      "kb": "~/Documents/Personal",
+      "kb": "~/.local/share/fit/outpost/Team",
+      "privilege": "full",
       "schedule": { "type": "cron", "expression": "*/30 8-18 * * 1-5" },
       "enabled": true
     },
     "librarian": {
-      "kb": "~/Documents/Personal",
+      "kb": "~/.local/share/fit/outpost/Team",
+      "privilege": "restricted",
       "schedule": { "type": "cron", "expression": "0 9,12,15,18 * * 1-5" },
       "enabled": true
     },
     "chief-of-staff": {
-      "kb": "~/Documents/Personal",
+      "kb": "~/.local/share/fit/outpost/Team",
+      "privilege": "restricted",
       "schedule": { "type": "cron", "expression": "0 7,18 * * 1-5" },
       "enabled": true
     },
     "recruiter": {
-      "kb": "~/Documents/Personal",
+      "kb": "~/.local/share/fit/outpost/Team",
+      "privilege": "restricted",
       "schedule": { "type": "cron", "expression": "0 8,12,17 * * 1-5" },
       "enabled": true
     },
     "head-hunter": {
-      "kb": "~/Documents/Personal",
+      "kb": "~/.local/share/fit/outpost/Team",
+      "privilege": "restricted",
       "schedule": { "type": "cron", "expression": "0 9 * * 1-5" },
       "enabled": true
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forwardimpact/outpost",
-  "version": "3.8.1",
+  "version": "3.9.0",
   "description": "Personal operations center — context from email, calendar, and knowledge assembled so preparation is continuous, not a morning scramble.",
   "homepage": "https://www.forwardimpact.team",
   "repository": {

package/src/agent-runner.js

@@ -11,6 +11,7 @@ import {
   loadManifest,
   draftSkills,
 } from "./posture.js";
+import { resolvePrivilege, disclaimFor } from "./privilege.js";
 import { buildSpawnEnv } from "./spawn-env.js";
 
 /**
@@ -176,6 +177,24 @@ export class AgentRunner {
    * @param {Record<string, string>} [configEnv] - Extra env vars from config
    */
   async wake(agentName, agent, state, configEnv) {
+    // Resolve the mandatory privilege level before any work. A missing or
+    // invalid level is fail-closed: log and skip the wake — no agent process is
+    // spawned with a guessed privilege. The level lives in the user-only trust
+    // root, so a spawned agent cannot raise its own.
+    let level;
+    try {
+      level = resolvePrivilege(agent);
+    } catch (err) {
+      this.#log(
+        JSON.stringify({
+          event: "outpost.privilege.rejected",
+          agent: agentName,
+          error: err.message,
+        }),
+      );
+      return;
+    }
+
     if (!agent.kb) {
       this.#log(`Agent ${agentName}: no "kb" specified, skipping.`);
       return;
@@ -191,6 +210,13 @@ export class AgentRunner {
     const claude = await this.#findClaude();
 
     this.#log(`Waking agent: ${agentName} (kb: ${agent.kb})`);
+    this.#log(
+      JSON.stringify({
+        event: "outpost.privilege.resolved",
+        agent: agentName,
+        level,
+      }),
+    );
 
     const as = (state.agents[agentName] ||= {});
     as.status = "active";
@@ -226,6 +252,7 @@ export class AgentRunner {
         env,
         kbPath,
         this.#runtime,
+        disclaimFor(level),
       );
       this.#activeChildren.add(pid);
 

package/src/kb-manager.js

@@ -23,6 +23,33 @@ export class KBManager {
     this.#logger = createLogger("outpost", runtime);
   }
 
+  /**
+   * Resolve a knowledge-base name to its path under the XDG data home,
+   * `~/.local/share/fit/outpost/<name>`. The argument is a single path segment,
+   * never an arbitrary filesystem path, so a provisioned KB always lands outside
+   * TCC-protected folders. The name is validated — not sanitised — against the
+   * same rule as `agent-path.js`: a name carrying `/`, `\`, `..`, NUL, or a
+   * leading `~` could steer the KB back inside `~/Documents`, reopening the TCC
+   * hole, so it is rejected rather than rewritten.
+   * @param {string} name - The KB name (e.g. `Team`, `personal`).
+   * @returns {string} Absolute path under the data home.
+   * @throws {Error} when `name` is empty, non-string, or an unsafe segment.
+   */
+  static kbPathForName(name) {
+    if (
+      typeof name !== "string" ||
+      name.length === 0 ||
+      name.includes("/") ||
+      name.includes("\\") ||
+      name.includes("..") ||
+      name.includes("\0") ||
+      name.startsWith("~")
+    ) {
+      throw new Error(`unsafe KB name: ${JSON.stringify(name)}`);
+    }
+    return join(homedir(), ".local/share/fit/outpost", name);
+  }
+
   /**
    * Test whether a path exists, via the async fs surface.
    * @param {string} p

package/src/outpost.js

@@ -4,7 +4,7 @@
 //   fit-outpost                     Wake due agents once and exit
 //   fit-outpost daemon              Run continuously (poll every 60s)
 //   fit-outpost wake <agent>        Wake a specific agent immediately
-//   fit-outpost init <path>         Initialize a new knowledge base
+//   fit-outpost init [name]         Initialize a knowledge base by name (default: Team)
 //   fit-outpost update [path]       Update KB with latest CLAUDE.md, agents and skills (defaults to current directory)
 //   fit-outpost stop                Gracefully stop daemon and all running agents
 //   fit-outpost validate            Validate agent definitions exist
@@ -58,7 +58,7 @@ function buildDefinition(version) {
       },
       {
         name: "init",
-        args: "<path>",
+        args: "[name]",
         description: "Initialize a new knowledge base",
       },
       {
@@ -433,13 +433,20 @@ export async function run(runtime, version) {
       return 1;
     },
     init: async () => {
-      if (!args[0]) {
-        cli.usageError("missing required argument <path>");
+      // `init [name]` provisions a KB by name under the data home (default
+      // `Team`), never an arbitrary path — so the substrate cannot be
+      // steered back into a TCC-protected folder. An unsafe name is refused.
+      const name = args[0] ?? "Team";
+      let target;
+      try {
+        target = KBManager.kbPathForName(name);
+      } catch {
+        cli.usageError(`invalid KB name "${name}"`);
         return 2;
       }
       const tpl = await requireTemplateDir();
       if (tpl === null) return 1;
-      const result = await kbManager.init(args[0], tpl);
+      const result = await kbManager.init(target, tpl);
       if (!result.ok) {
         proc.stderr.write(result.error + "\n");
         return result.code;

package/src/privilege.js

@@ -0,0 +1,45 @@
+/**
+ * Privilege — resolve an agent's least-privilege execution level and map it to
+ * the hop-2 spawn disclaim flag.
+ *
+ * The level governs the macOS reach the daemon grants a woken agent. `full`
+ * keeps today's single-grant model (the child inherits `fit-outpost.app` as its
+ * responsible process, so Full Disk Access and Automation flow to it); a
+ * `restricted` agent is held responsible for itself, so those grants are not
+ * extended and it can reach only non-TCC-protected substrate.
+ *
+ * The level is mandatory and lives in the same user-only trust root as the
+ * spawn-env allow-set and the state roots, so an agent cannot raise its own
+ * level. Patterned on `posture.js` but with no `effective*` coercion and no
+ * default — a missing or unrecognised value throws.
+ */
+
+/** The two privilege levels, in declaration order. */
+export const PRIVILEGE_LEVELS = ["full", "restricted"];
+
+/**
+ * Resolve an agent's declared privilege level. The level is mandatory: a
+ * missing or unrecognised value throws — there is no default.
+ * @param {{ privilege?: string }} agent - One agent's config.
+ * @returns {"full"|"restricted"} The declared level.
+ * @throws {Error} when `agent.privilege` is not one of {@link PRIVILEGE_LEVELS}.
+ */
+export function resolvePrivilege(agent) {
+  const level = agent?.privilege;
+  if (!PRIVILEGE_LEVELS.includes(level)) {
+    throw new Error(
+      `invalid privilege "${level}"; expected one of ${PRIVILEGE_LEVELS.join(", ")}`,
+    );
+  }
+  return level;
+}
+
+/**
+ * Map a level to the hop-2 disclaim flag: `restricted` self-disclaims (`1`),
+ * `full` keeps the inherited responsible process (`0`).
+ * @param {"full"|"restricted"} level
+ * @returns {0|1}
+ */
+export function disclaimFor(level) {
+  return level === "restricted" ? 1 : 0;
+}