@inetafrica/open-claudia 3.1.22 → 3.1.24

package/test-external-rule-scopes.js

@@ -0,0 +1,182 @@
+// Scoped external rules (v3.1.23): the three-layer policy — global guardrails
+// → per-channel rules → per-person mandate — plus auto-contacts and the
+// meet-greet lane. These tests pin the security invariants:
+//  - channel rules are keyed generically on (adapterType, channelId) — any
+//    adapter participates by existing, no surface-specific logic;
+//  - auto-contacts NEVER link by display name (spoofable) — every new speaker
+//    gets a fresh record and a UNIQUE entity slug, so two same-named people
+//    can never share a mandate;
+//  - slug-keyed entity upserts land on exactly the record's entity;
+//  - the enforcer prompt carries all three layers and the UNVERIFIED marker,
+//    and its verdict cache busts when the channel layer changes.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "rule-scopes-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.OPEN_CLAUDIA_CONFIG_DIR = tmp;
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+process.env.APPROVALS_DIR = path.join(tmp, "approvals");
+process.env.CHANNEL_RULES_FILE = path.join(tmp, "channel-rules.md");
+
+const cr = require("./core/channel-rules");
+const people = require("./core/people");
+const entities = require("./core/entities");
+const relationship = require("./core/relationship");
+const approvals = require("./core/approvals");
+const { createEnforcerService } = require("./core/enforcer");
+
+// ── channel-rules store ──────────────────────────────────────────────────────
+
+{
+  const r1 = cr.addRule({ adapterType: "Kazee", channelId: "chat123", label: "Dev Team", text: "may share sprint status" });
+  assert.strictEqual(r1.added, true, "rule adds");
+  assert.strictEqual(r1.key, "kazee:chat123", "adapter type is lowercased in the key");
+
+  const dup = cr.addRule({ adapterType: "kazee", channelId: "chat123", text: "May  share sprint   status" });
+  assert.strictEqual(dup.added, false, "normalized duplicate is rejected");
+  assert.strictEqual(dup.duplicate, true);
+
+  const r2 = cr.addRule({ adapterType: "spaces", channelId: "task:t9", label: "Q3 Launch", text: "never discuss budgets" });
+  assert.strictEqual(r2.added, true, "second channel is independent");
+
+  assert.strictEqual(cr.listRules("kazee", "chat123").length, 1);
+  assert.strictEqual(cr.listRules("spaces", "task:t9").length, 1);
+  assert.strictEqual(cr.listRules("kazee", "otherchat").length, 0, "uncovered channel has no rules");
+  assert.strictEqual(cr.loadChannelRulesBlock("kazee", "otherchat"), "", "uncovered channel injects nothing");
+  assert.ok(cr.loadChannelRulesBlock("kazee", "chat123").includes("sprint status"));
+
+  // Rejections: empty, too long, missing channel.
+  assert.strictEqual(cr.addRule({ adapterType: "kazee", channelId: "chat123", text: "  " }).added, false);
+  assert.strictEqual(cr.addRule({ adapterType: "kazee", channelId: "chat123", text: "x".repeat(cr.MAX_RULE_CHARS + 1) }).added, false);
+  assert.strictEqual(cr.addRule({ adapterType: "", channelId: "", text: "orphan rule" }).added, false);
+
+  // The file survives hand-edits: stray prose outside sections is ignored.
+  const raw = fs.readFileSync(cr.CHANNEL_RULES_FILE, "utf-8");
+  const parsed = cr.parseChannels("hand-written preamble\n" + raw + "\ntrailing note outside any section\n");
+  assert.strictEqual(parsed.length, 2, "hand-edited file still parses both sections");
+
+  // Removal: by id anywhere, and by exact text scoped to one channel.
+  assert.strictEqual(cr.removeRule(r1.id), true, "remove by id");
+  assert.strictEqual(cr.listRules("kazee", "chat123").length, 0);
+  assert.strictEqual(cr.removeRule("never discuss budgets", { adapterType: "spaces", channelId: "task:t9" }), true, "remove by text within scope");
+  assert.strictEqual(cr.rulesExist(), false, "store empty again");
+}
+
+// ── auto-contacts: fresh record, unique slug, never link-by-name ────────────
+
+const envLucy = { adapter: { type: "kazee" }, channelId: "chatdoc1", userId: "user-lucy", from: { name: "Lucy Osweta" } };
+const lucy = relationship.ensureContact(envLucy);
+{
+  assert.ok(lucy, "auto-contact created");
+  assert.strictEqual(lucy.name, "Lucy Osweta");
+  assert.strictEqual(lucy.autoCreated, true, "marked auto-created (unverified)");
+  assert.ok(lucy.entitySlug && lucy.entitySlug !== "lucy-osweta", "entity slug is unique, not bare slugified name");
+  assert.ok(people.findByHandle("kazee", "user-lucy"), "handle linked to the sender id");
+
+  const ent = entities.readEntity(lucy.entitySlug);
+  assert.ok(ent, "entity created at the unique slug");
+  assert.strictEqual(ent.relationship, "external", "auto-contact is external (default-deny)");
+
+  assert.strictEqual(relationship.ensureContact(envLucy), null, "idempotent: second sighting is a no-op");
+  assert.strictEqual(people.list().length, 1, "no duplicate record");
+
+  // A same-named IMPOSTOR must get a fresh record and a different slug — never
+  // Lucy's mandate.
+  const impostor = relationship.ensureContact({ adapter: { type: "kazee" }, channelId: "chatdoc1", userId: "user-impostor", from: { name: "Lucy Osweta" } });
+  assert.ok(impostor && impostor.id !== lucy.id, "impostor gets their own record");
+  assert.ok(impostor.entitySlug !== lucy.entitySlug, "and their own entity");
+
+  // Slug-keyed mandate write lands ONLY on the real Lucy.
+  entities.upsertEntity({ slug: lucy.entitySlug, name: "Lucy Osweta", mandate: "- may ask about invoices" });
+  assert.strictEqual(entities.readEntity(lucy.entitySlug).sections.Mandate, "- may ask about invoices");
+  assert.strictEqual(entities.readEntity(impostor.entitySlug).sections.Mandate, "", "impostor inherits nothing");
+
+  // speakerFor resolves the mandate through the unique slug.
+  const spk = relationship.speakerFor("kazee", "chatdoc1", "user-lucy");
+  assert.strictEqual(spk.relationship, "external");
+  assert.strictEqual(spk.mandate, "- may ask about invoices");
+  assert.strictEqual(spk.slug, lucy.entitySlug);
+  assert.strictEqual(relationship.speakerFor("kazee", "chatdoc1", "user-impostor").mandate, "", "impostor speaker has no mandate");
+
+  // Known people and malformed envelopes never create records.
+  assert.strictEqual(relationship.ensureContact(envLucy), null);
+  assert.strictEqual(relationship.ensureContact({ channelId: "x" }), null, "no adapter → no-op");
+  assert.strictEqual(relationship.ensureContact({ adapter: { type: "kazee" } }), null, "no ids → no-op");
+
+  // Room-keyed envelope (telegram groups: userId === channelId is the ROOM,
+  // from.id is the real sender) must NOT create — it would mint one contact
+  // named after the first speaker and misattribute everyone after.
+  const before = people.list().length;
+  assert.strictEqual(relationship.ensureContact({ adapter: { type: "telegram" }, channelId: "-100", userId: "-100", from: { id: "555", name: "Group Speaker" } }), null, "from.id ≠ userId → coherence guard refuses");
+  assert.strictEqual(people.list().length, before, "no record minted for the room");
+
+  // A nameless sender still gets a usable record (meet-greet learns the name).
+  const ghost = relationship.ensureContact({ adapter: { type: "spaces" }, channelId: "task:t1", userId: "actor-42", from: {} });
+  assert.ok(ghost && ghost.name.startsWith("spaces user"), "fallback display name");
+
+  // Owner records are never auto-duplicated.
+  const owner = people.add({ name: "Ada Owner", isOwner: true });
+  people.linkHandle(owner.id, { adapter: "telegram", channelId: "111" });
+  assert.strictEqual(relationship.ensureContact({ adapter: { type: "telegram" }, channelId: "111", userId: "111", from: { name: "Ada Owner" } }), null);
+}
+
+// ── approvals carry the channel label ───────────────────────────────────────
+
+{
+  const rec = approvals.create({
+    tool: "external-reply", kind: "reply", channelId: "chatdoc1", adapter: "kazee",
+    targetAdapter: "kazee", targetChannel: "chatdoc1",
+    personName: "Lucy Osweta", channelLabel: "Dev Team",
+  });
+  assert.strictEqual(approvals.read(rec.id).channelLabel, "Dev Team", "channelLabel persists on the record");
+  const long = approvals.create({ tool: "external-reply", kind: "reply", channelLabel: "x".repeat(500) });
+  assert.strictEqual(approvals.read(long.id).channelLabel.length, 120, "channelLabel is clipped");
+}
+
+// ── enforcer: three layers in the prompt, unverified marker, cache busting ──
+
+(async () => {
+  let calls = [];
+  const fakeRun = async (userPrompt) => {
+    calls.push(userPrompt);
+    return { json: { decision: "escalate", reason: "test" }, provider: "fake", model: "fake" };
+  };
+  const svc = createEnforcerService({ spawnUtilityAgent: fakeRun, cacheNamespace: "t1" });
+  const speaker = relationship.speakerFor("kazee", "chatdoc1", "user-lucy");
+
+  cr.addRule({ adapterType: "kazee", channelId: "chatdoc1", label: "Dev Team", text: "may share sprint status" });
+  await svc.verdict({ kind: "reply", speaker, payload: "Here is the sprint status." });
+  assert.strictEqual(calls.length, 1);
+  assert.ok(calls[0].includes("CHANNEL RULES"), "prompt has the channel layer");
+  assert.ok(calls[0].includes("may share sprint status"), "channel rule text is injected");
+  assert.ok(calls[0].includes("- may ask about invoices"), "mandate layer still injected");
+  assert.ok(calls[0].includes("(UNVERIFIED — brand-new auto-added contact)"), "auto-contact is flagged unverified");
+
+  // Identical inputs → cached, no second model call.
+  await svc.verdict({ kind: "reply", speaker, payload: "Here is the sprint status." });
+  assert.strictEqual(calls.length, 1, "verdict cache hit");
+
+  // A channel-rule edit busts the cache: same payload re-judged.
+  cr.addRule({ adapterType: "kazee", channelId: "chatdoc1", text: "never discuss salaries" });
+  await svc.verdict({ kind: "reply", speaker, payload: "Here is the sprint status." });
+  assert.strictEqual(calls.length, 2, "channel-rule change re-judges");
+  assert.ok(calls[1].includes("never discuss salaries"));
+
+  // A speaker on an uncovered channel gets the (none) placeholder — rules from
+  // other channels never leak in.
+  const elsewhere = { ...speaker, adapterType: "kazee", channelId: "otherchat" };
+  await svc.verdict({ kind: "reply", speaker: elsewhere, payload: "Hello." });
+  assert.ok(calls[2].includes("(none — the owner has set no rules for this channel)"), "no cross-channel leak");
+
+  // Guard prompt documents the union + meet-greet lane.
+  const enforcerSrc = fs.readFileSync(path.join(__dirname, "core", "enforcer.js"), "utf-8");
+  assert.ok(enforcerSrc.includes("UNION of the layers"), "system prompt unions all layers");
+  assert.ok(enforcerSrc.includes("Meet-and-greet lane"), "system prompt carries the meet-greet lane");
+
+  console.log("OK test-external-rule-scopes");
+})().catch((e) => { console.error(e); process.exit(1); });

package/test-provider-language.js

@@ -271,7 +271,38 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // uses a recent-page window), rendered Spaces-style with sender attribution,
 // so the chatter the gate stayed silent through is caught up exactly once:
 // the gate keeps the bot reply-silent, never context-blind.
-assert.strictEqual(pkg.version, "3.1.22", "release version must remain unchanged without explicit approval");
+// 3.1.23 approved by Sumeet 2026-07-23 ("ok you building it in a extendable
+// way for multi channels groups and public domains?"): scoped external rules —
+// the make-a-rule card now offers three scopes (this person / this channel /
+// everyone), with per-channel rules stored in channel-rules.md keyed
+// generically on adapter:channelId so any surface participates by existing;
+// the enforcer judges the UNION of security floor + global guardrails +
+// channel rules + per-person mandate (any layer permits, any prohibition
+// wins, default-deny) and busts its verdict cache on any layer edit;
+// auto-contacts — the first authorized speaker with no people record gets a
+// fresh one (never linked by spoofable display name; unique entity slug so
+// same-named people can never share a mandate; room-keyed envelopes where
+// from.id ≠ userId are refused so telegram groups never mint a misattributed
+// contact) tagged autoCreated/unverified; meet-greet lane — brand-new
+// unverified contacts get warm introductions (who they are, how they know the
+// owner) without explicit coverage while disclosure, commitments, and actions
+// stay held for escalation; approval cards say where the message came from
+// via the optional adapter channelLabel (kazee chat name, spaces task title).
+// 3.1.24 approved by Sumeet 2026-07-24 ("Okay, I think that makes sense, so go
+// ahead and implement that and then push it out"): catalog-first recall — the
+// proven 4-layer candidate-starvation (diag-recall-ranking.js: lexical seed
+// scoring, junk-seed fire threshold, hub fan-out topK, and a dream-tuned
+// walker cap of 10 vs exactly 10 seeds leaving graph-activated nodes ZERO
+// slots since 2026-07-09) is fixed by inverting the contract: the walker's
+// SYSTEM prompt now carries the ENTIRE pack/entity/tool index (one-liners,
+// warm-session cached, exempt from the warm per-message char budget) so
+// nothing is ever cut before a model sees it; lexical seeds + graph
+// activation demote to per-turn ranking HINTS (top-K excerpts); the walker
+// may keep ANY catalog id; cascade + tool pack-riding bypass under catalog
+// mode; recall query mirrors it and the CLI banner reports honest
+// hint-survival instead of raw expansion counts; catalog knob (dream-tunable,
+// RECALL_CATALOG pin) restores the legacy menu.
+assert.strictEqual(pkg.version, "3.1.24", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }