@fungi.computer/oyster 0.4.1 → 0.5.0

package/dist/agents.d.ts

@@ -7,6 +7,7 @@
  * transport (`/browser/…`), served by the adapter behind the same App grants.
  */
 import { Hono } from "hono";
+import { type LiveOysterKey } from "./keys.js";
 import type { AppToolPolicy } from "./apps/tools.js";
 import * as Schema from "effect/Schema";
 import { type OysterCapability, type OysterEnv, type OysterPrincipal } from "./host.js";
@@ -125,7 +126,7 @@ export type OysterAgents = Readonly<{
     visit(agentId: string, sessionId: string): Promise<boolean>;
 }>;
 /** Agent adapters admitted against each App's declared capabilities. */
-export declare function agentCapabilities(agents: OysterAgents): readonly OysterCapability[];
+export declare function agentCapabilities(agents: OysterAgents, liveKey: (keyId: string) => Promise<LiveOysterKey | null>): readonly OysterCapability[];
 /** Host-owned direct approval under the admitted owner; never an App capability. */
 export declare function agentApprovalRoutes(agents: OysterAgents): Hono<OysterEnv>;
 /**

package/dist/agents.js

@@ -7,6 +7,7 @@
  * transport (`/browser/…`), served by the adapter behind the same App grants.
  */
 import { Hono } from "hono";
+import { keyAgentAccess } from "./keys.js";
 import * as Schema from "effect/Schema";
 import { z } from "zod";
 import { oysterPrincipalIsOwner, } from "./host.js";
@@ -51,8 +52,8 @@ function refusal(status, error) {
     return Response.json({ error }, { status });
 }
 /** Agent adapters admitted against each App's declared capabilities. */
-export function agentCapabilities(agents) {
-    const routes = createAgentRoutes(agents);
+export function agentCapabilities(agents, liveKey) {
+    const routes = createAgentRoutes(agents, liveKey);
     const shared = { base: "/", routes };
     return [
         {
@@ -134,9 +135,41 @@ export function agentCapabilities(agents) {
         },
     ];
 }
-function createAgentRoutes(agents) {
+function createAgentRoutes(agents, liveKey) {
     const routes = new Hono();
-    routes.get("/agents", async () => Response.json(await agents.list()));
+    // Every Agent and Session lookup shares this live principal-scoped door.
+    const access = async (principal, agentId) => {
+        if (oysterPrincipalIsOwner(principal))
+            return true;
+        if (principal.actor.kind !== "team-key")
+            return false;
+        const key = await liveKey(principal.actor.keyId);
+        return key !== null && keyAgentAccess(key, agentId);
+    };
+    routes.use("/agents/:agentId/*", async (context, next) => {
+        if (!(await access(context.env.principal, context.req.param("agentId"))))
+            return refusal(403, "Agent access denied");
+        await next();
+        return undefined;
+    });
+    routes.use("/agent-policies/:agentId", async (context, next) => {
+        if (!(await access(context.env.principal, context.req.param("agentId"))))
+            return refusal(403, "Agent access denied");
+        await next();
+        return undefined;
+    });
+    routes.get("/agents", async (context) => {
+        const listed = await agents.list();
+        const actor = context.env.principal.actor;
+        if (oysterPrincipalIsOwner(context.env.principal))
+            return Response.json(listed);
+        if (actor.kind !== "team-key")
+            return Response.json([]);
+        const key = await liveKey(actor.keyId);
+        return Response.json(key === null
+            ? []
+            : listed.filter((agent) => keyAgentAccess(key, agent.agentId)));
+    });
     routes.post("/agents", async (context) => {
         const { principal } = context.env;
         if (!oysterPrincipalIsOwner(principal))
@@ -216,19 +249,37 @@ function createAgentRoutes(agents) {
         const response = await agents.fetch(agentId, new Request(target, incoming));
         return response ?? refusal(404, "No such agent");
     });
-    routes.get("/member/inbox", async () => {
+    routes.get("/member/inbox", async (context) => {
         const inbox = await agents.inbox();
+        const principal = context.env.principal;
+        if (oysterPrincipalIsOwner(principal))
+            return Response.json({
+                items: inbox.items,
+                next: null,
+                cursor: inbox.revision,
+            });
+        if (principal.actor.kind !== "team-key")
+            return refusal(403, "Agent access denied");
+        const key = await liveKey(principal.actor.keyId);
         return Response.json({
-            items: inbox.items,
+            items: key === null
+                ? []
+                : inbox.items.filter((item) => "agentId" in item && keyAgentAccess(key, item.agentId)),
             next: null,
-            cursor: inbox.revision,
+            // The global revision changes for ungranted Agents too. Key feeds have
+            // no scoped event stream, so expose neither that revision nor its events.
+            cursor: 0,
         });
     });
-    routes.get("/member/inbox/notices", () => Response.json({ items: [], next: null }));
+    routes.get("/member/inbox/notices", (context) => oysterPrincipalIsOwner(context.env.principal)
+        ? Response.json({ items: [], next: null })
+        : refusal(403, "Agent access denied"));
     routes.post("/member/inbox/visits", async (context) => {
         const body = Schema.decodeUnknownOption(visitSchema)(await context.req.json());
         if (body._tag === "None")
             return refusal(400, "Invalid visit");
+        if (!(await access(context.env.principal, body.value.agentId)))
+            return refusal(403, "Agent access denied");
         return (await agents.visit(body.value.agentId, body.value.sessionId))
             ? new Response(null, { status: 204 })
             : refusal(404, "No such Session");
@@ -236,6 +287,10 @@ function createAgentRoutes(agents) {
     // The feed is small (one person's agents), so a change is announced as a
     // `reset` and the client re-reads the whole inbox.
     routes.get("/member/inbox/events", (context) => {
+        // The unscoped revision also changes for other Agents. Do not expose it
+        // until a principal-scoped revision exists.
+        if (!oysterPrincipalIsOwner(context.env.principal))
+            return refusal(403, "Agent access denied");
         const after = Number(context.req.query("after") ?? "0");
         const signal = context.req.raw.signal;
         const encoder = new TextEncoder();

package/dist/apps/gate.d.ts

@@ -36,6 +36,10 @@ export declare const gateRequestSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.Zod
     kind: z.ZodLiteral<"capability-route">;
     capability: z.ZodPipe<z.ZodUnknown, z.ZodTransform<"approvals" | "agent.list" | "agent.manage" | "agent.rename" | "agent.avatar" | "agent.toolPolicy" | "agent.read" | "agent.send" | "computer.list" | "computer.readFile" | "computer.writeFile" | "computer.execute" | "llm.generation" | "media.generation" | "games:servers" | "git.repository" | "apps.open" | "apps.call" | "app.storage" | "app.events.emit" | "team.workbenchHost" | "marketplace.browse" | "marketplace.purchase" | "workflow.run" | "workflow.publish" | "workflow.arm" | "world" | "channels.read" | "channels.personal.manage", unknown>>;
     operation: z.ZodString;
+    effect: z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"binding">;
     binding: z.ZodPipe<z.ZodUnknown, z.ZodTransform<"BACKGROUND" | "GIT" | "EVENTS" | "APPS" | "WORKFLOWS" | "APP_STORAGE" | "MEDIA" | "COMPUTER" | "INBOX" | "AGENTS", unknown>>;

package/dist/apps/gate.js

@@ -26,6 +26,7 @@ export const gateRequestSchema = z.lazy(() => z.discriminatedUnion("kind", [
         kind: z.literal("capability-route"),
         capability: ownerCodec(appCapabilityIdSchema),
         operation: z.string().min(1),
+        effect: z.enum(["read", "write"]),
     }),
     z.strictObject({
         kind: z.literal("binding"),
@@ -259,6 +260,8 @@ export function admits(facts, rawRequest) {
         case "capability-route": {
             if (visitor)
                 return refusal("visitor_read_only");
+            if (request.effect === "write" && facts.access?.level === "read")
+                return refusal("level_too_low");
             if (!request.operation.startsWith("route:") ||
                 !facts.declaration.capabilities.includes(request.capability) ||
                 facts.declaredOperations.capabilities