@inetafrica/open-claudia 3.1.24 → 3.1.26

package/test-provider-scheduler.js

@@ -379,7 +379,8 @@ function schedulerHarness(createSchedulerService, seed, options = {}) {
   const state = options.state || {
     userId: "fixture-user",
     currentSession: { name: "other-project", dir: "/workspace/other-project" },
-    settings: { backend: "codex" },
+    settings: { backend: "claude" },
+    providerSettings: { claude: { model: "claude-current", effort: "medium" } },
     activeSessions: { alpha: { claude: "claude-after-compact" } },
     completedCompactions: {
       compacted: {
@@ -436,27 +437,28 @@ function schedulerHarness(createSchedulerService, seed, options = {}) {
   return { service, jobsStore, scheduled, admissions, runCalls, sends, state };
 }
 
-async function immutableTerminalProbe(createSchedulerService) {
+async function firetimeSelectionProbe(createSchedulerService) {
+  // Same provider as origin: the occurrence resumes the recorded (compaction-
+  // rebased) session, but its MODEL tracks the owner's CURRENT selection — a
+  // wakeup pinned to a since-changed or quota-exhausted model must not keep
+  // firing that stale model.
   const terminal = deferred();
-  const h = schedulerHarness(createSchedulerService, [baseJob()], {
+  const same = schedulerHarness(createSchedulerService, [baseJob()], {
     outcomes: [terminal.promise],
-    onSend(state) {
-      state.settings.backend = "codex";
-      state.currentSession = { name: "switched", dir: "/workspace/switched" };
-    },
   });
-  const firing = h.service.fireJob("wake-1");
+  const firing = same.service.fireJob("wake-1");
   await nextTurn();
-  assert.strictEqual(h.admissions.length, 1);
-  assert.strictEqual(h.admissions[0].opts.provider, "claude");
-  assert.strictEqual(h.admissions[0].opts.project.name, "alpha");
-  assert.strictEqual(h.admissions[0].opts.resumeSessionId, "claude-after-compact", "compaction lineage should rebase the saved session");
-  assert.deepStrictEqual(h.admissions[0].opts.providerSettings, { model: "claude-scheduled", effort: "high" });
-  assert.strictEqual(h.admissions[0].opts.occurrenceId, "occ-wake-1");
-  assert.strictEqual(h.admissions[0].opts.scheduledJobId, "wake-1");
-  assert.strictEqual(h.admissions[0].opts.attachSession, true);
-  assert.strictEqual(h.admissions[0].opts.requiredDelivery, true);
-  assert.strictEqual(h.jobsStore.calls.remove.length, 0, "one-shot must survive until terminal settlement");
+  assert.strictEqual(same.admissions.length, 1);
+  assert.strictEqual(same.admissions[0].opts.provider, "claude");
+  assert.strictEqual(same.admissions[0].opts.project.name, "alpha");
+  assert.strictEqual(same.admissions[0].opts.resumeSessionId, "claude-after-compact", "compaction lineage should rebase the saved session");
+  assert.strictEqual(same.admissions[0].opts.providerSettings.model, "claude-current", "model must track the current selection, not the value pinned at creation");
+  assert.notStrictEqual(same.admissions[0].opts.providerSettings.model, "claude-scheduled", "the stale pinned model must not be reused");
+  assert.strictEqual(same.admissions[0].opts.occurrenceId, "occ-wake-1");
+  assert.strictEqual(same.admissions[0].opts.scheduledJobId, "wake-1");
+  assert.strictEqual(same.admissions[0].opts.attachSession, true);
+  assert.strictEqual(same.admissions[0].opts.requiredDelivery, true);
+  assert.strictEqual(same.jobsStore.calls.remove.length, 0, "one-shot must survive until terminal settlement");
   terminal.resolve({
     ok: true,
     status: "succeeded",
@@ -465,7 +467,38 @@ async function immutableTerminalProbe(createSchedulerService) {
   });
   const result = await firing;
   assert.strictEqual(result.ok, true);
-  assert.deepStrictEqual(h.jobsStore.calls.remove, ["wake-1"]);
+  assert.deepStrictEqual(same.jobsStore.calls.remove, ["wake-1"]);
+
+  // Provider switched since creation: the occurrence runs under the CURRENT
+  // provider on a FRESH thread — the origin provider's native session cannot
+  // cross providers, and we deliberately do not hijack the new provider's own
+  // live session — and the fired prompt says so.
+  const switched = schedulerHarness(createSchedulerService, [baseJob({ id: "switched-wake" })], {
+    state: {
+      userId: "fixture-user",
+      currentSession: { name: "other-project", dir: "/workspace/other-project" },
+      settings: { backend: "codex" },
+      providerSettings: { codex: { model: "codex-current", effort: "low" } },
+      activeSessions: { alpha: { claude: "claude-after-compact", codex: "codex-live" } },
+      completedCompactions: {},
+      runningProcess: null,
+      preparingRun: false,
+    },
+    outcomes: [{
+      ok: true,
+      status: "succeeded",
+      persistence: { transcript: { ok: true }, usage: { ok: true }, session: { ok: true } },
+      delivery: { ok: true },
+    }],
+  });
+  const switchedResult = await switched.service.fireJob("switched-wake");
+  assert.strictEqual(switchedResult.ok, true);
+  assert.strictEqual(switched.admissions[0].opts.provider, "codex", "a since-switched provider selection wins over the pinned origin provider");
+  assert.strictEqual(switched.admissions[0].opts.fresh, true);
+  assert.ok(!switched.admissions[0].opts.resumeSessionId, "a provider switch starts a fresh thread, resuming neither provider's session");
+  assert.strictEqual(switched.admissions[0].opts.providerSettings.model, "codex-current", "the switched-to provider's current model applies");
+  assert.match(switched.runCalls[0].prompt, /tracks your current selection/i);
+  assert.match(switched.runCalls[0].prompt, /claude/i);
 }
 
 async function duplicateFireProbe(createSchedulerService) {
@@ -550,7 +583,7 @@ async function detachedHistoricalBranchProbe(createSchedulerService) {
   const state = {
     userId: "fixture-user",
     currentSession: { name: "other", dir: "/workspace/other" },
-    settings: { backend: "codex" },
+    settings: { backend: "claude" },
     activeSessions: { alpha: { claude: "unrelated-live-session" } },
     completedCompactions: {},
     runningProcess: null,
@@ -822,7 +855,7 @@ function staticSchedulingProbe() {
     if (file === "core/jobs.js") continue;
     assert.ok(!/\bsessionKey\b/.test(source[file]), `${file} must not use the removed sessionKey scheduling field`);
   }
-  assert.match(source["bin/cli.js"], /selected provider session/i);
+  assert.match(source["bin/cli.js"], /current provider\/model at fire time/i);
 
   // Watch feature must be wired end to end: gate → loopback → CLI surfaces.
   assert.match(source["core/scheduler.js"], /job\.check/, "scheduler must gate firing on a watch check");
@@ -843,7 +876,7 @@ async function main() {
   migrationProbe(jobsApi);
   legacyDefaultsProbe(jobsApi);
   migrationIntegrationProbe(jobsApi, migrationApi);
-  await immutableTerminalProbe(schedulerApi.createSchedulerService);
+  await firetimeSelectionProbe(schedulerApi.createSchedulerService);
   await duplicateFireProbe(schedulerApi.createSchedulerService);
   await failureAndRetryProbe(schedulerApi.createSchedulerService);
   await detachedHistoricalBranchProbe(schedulerApi.createSchedulerService);

package/test-provider-tool-hooks.js

@@ -146,6 +146,10 @@ try {
   assert.match(overrides.projectTrust, /^projects=\{.+trust_level="untrusted".+\}$/);
   assert.match(overrides.preToolUse, /^hooks\.PreToolUse=/);
   assert.match(overrides.preToolUse, /deny-gate-hook/);
+  // Probed live 2026-07-24: Codex file edits arrive as tool_name "apply_patch"
+  // (shell as "Bash"). The matcher must cover both, or guarded external turns
+  // could write files unhooked — sandbox is bypassed on normal runs.
+  assert.match(overrides.preToolUse, /\^\(Bash\|apply_patch\)\$/, "matcher covers Codex's native file-edit tool");
 
   const prepared = prepareCodexHook({ cwd: projectDir });
   assert.strictEqual(verifyPreparedCodexHook(prepared), true);

package/test-tool-guard.js

@@ -14,6 +14,16 @@ const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "tool-guard-"));
 process.env.TOOL_GUARD_LOG = path.join(tmp, "guard.jsonl");
 process.env.DENY_GATE_SETTINGS = path.join(tmp, "deny-gate.settings.json");
 process.env.KEYRING_FILE = path.join(tmp, "keyring.json");
+// Isolated identity stores for the external file-mutation gate cases: the gate
+// lazily resolves relationship→people→config, so these must precede requires.
+process.env.OPEN_CLAUDIA_CONFIG_DIR = tmp;
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+// This suite may itself run inside a bot-spawned shell that carries real
+// channel env — clear it so the dormant-gate baseline is deterministic.
+delete process.env.OC_CHANNEL_ADAPTER;
+delete process.env.OC_CHANNEL_ID;
+delete process.env.OC_CHANNEL_USER_ID;
 
 const guard = require("./core/tool-guard");
 
@@ -117,10 +127,114 @@ assert.strictEqual(guard.runHook("not json{{{").exit, 0, "unparseable payload fa
 assert.strictEqual(guard.runHook(null).exit, 0, "null payload fails OPEN");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash" })).exit, 0, "missing tool_input fails OPEN");
 
+// ── external file-mutation gate: Write/Edit blocked on guarded turns only ──
+// Dormant without channel env — owner-local turns keep full file access (R9/R14).
+assert.strictEqual(guard.externalFileMutationDenial("Write"), null, "no OC_CHANNEL_* env → gate dormant");
+for (const tool of ["Write", "Edit", "MultiEdit", "NotebookEdit", "apply_patch"]) {
+  assert.strictEqual(
+    guard.runHook(JSON.stringify({ tool_name: tool, tool_input: { file_path: "/tmp/x" } })).exit, 0,
+    `${tool} without channel context stays ungated (owner-local)`,
+  );
+}
+
+// Guarded turn: an id unknown to the (isolated, empty) people store resolves
+// external → file mutations are denied with a redirect, reads/benign Bash stay free.
+process.env.OC_CHANNEL_ADAPTER = "telegram";
+process.env.OC_CHANNEL_ID = "999000111";
+process.env.OC_CHANNEL_USER_ID = "999000111";
+const extDeny = guard.runHook(JSON.stringify({ tool_name: "Write", tool_input: { file_path: "/tmp/evil.txt" } }));
+assert.strictEqual(extDeny.exit, 2, "external speaker → Write denied");
+assert.ok(/External-speaker guard/.test(extDeny.stderr), "denial names the guard");
+assert.ok(/write-tier tool/.test(extDeny.stderr), "denial redirects to the owner-approval channel");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Edit", tool_input: { file_path: "/tmp/x.js" } })).exit, 2,
+  "Edit equally gated on guarded turns");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "NotebookEdit", tool_input: { notebook_path: "/tmp/x.ipynb" } })).exit, 2,
+  "NotebookEdit equally gated on guarded turns");
+assert.strictEqual(
+  guard.runHook(JSON.stringify({ tool_name: "apply_patch", tool_input: { command: "*** Begin Patch\n*** Add File: /tmp/evil.txt\n+x\n*** End Patch\n" } })).exit, 2,
+  "Codex apply_patch equally gated on guarded turns (probed live: file edits arrive under this tool name)");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Read", tool_input: { file_path: "/etc/hosts" } })).exit, 0,
+  "reads stay free on guarded turns");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "ls -la" } })).exit, 0,
+  "benign Bash unaffected by the file gate (deny-gate rules unchanged)");
+
+// The owner on the same transport is never gated: guardActive is a strict no-op.
+{
+  const people = require("./core/people");
+  const owner = people.add({ name: "Owner", isOwner: true });
+  people.linkHandle(owner.id, { adapter: "telegram", channelId: "111222333", approvedBy: "test" });
+  process.env.OC_CHANNEL_ID = "111222333";
+  process.env.OC_CHANNEL_USER_ID = "111222333";
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Write", tool_input: { file_path: "/tmp/ok.txt" } })).exit, 0,
+    "owner turns keep full file access even with channel env present");
+}
+delete process.env.OC_CHANNEL_ADAPTER;
+delete process.env.OC_CHANNEL_ID;
+delete process.env.OC_CHANNEL_USER_ID;
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Write", tool_input: { file_path: "/tmp/x" } })).exit, 0,
+  "gate re-dormant once channel env is gone");
+
+// ── external control-plane gate: Bash touching config/package denied on guarded turns ──
+// F2's Write/Edit denial must not be routable-around with one Bash heredoc: on
+// guarded turns any shell command referencing the config dir, the installed
+// package source, or a .open-claudia path is denied (reads included — policy
+// text must not leak into the vetted surface). Dormant without channel env;
+// the authorised channels stay exempt (bin/tool.js speaker-gates them itself).
+const cpWrite = `printf '* * * * * evil\\n' >> ${tmp}/crons.json`;
+assert.strictEqual(guard.externalControlPlaneDenial(cpWrite), null, "no OC_CHANNEL_* env → control-plane gate dormant");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: cpWrite } })).exit, 0,
+  "owner-local shells keep full config access");
+process.exitCode = 0;
+require("./bin/keyring").run(["path"]);
+assert.strictEqual(process.exitCode || 0, 0, "keyring CLI stays open owner-local (no channel env)");
+process.env.OC_CHANNEL_ADAPTER = "telegram";
+process.env.OC_CHANNEL_ID = "999000111";
+process.env.OC_CHANNEL_USER_ID = "999000111";
+{
+  const denyWrite = guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: cpWrite } }));
+  assert.strictEqual(denyWrite.exit, 2, "external speaker → config-dir write denied");
+  assert.ok(/External-speaker guard/.test(denyWrite.stderr), "denial names the guard");
+  assert.ok(/control plane/.test(denyWrite.stderr), "denial says what was protected");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: `cat ${tmp}/entities/sharon.md` } })).exit, 2,
+    "config reads equally denied on guarded turns (read-then-quote leaks policy)");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "cat ~/.open-claudia/lessons.md" } })).exit, 2,
+    ".open-claudia paths denied regardless of resolved config dir");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: `sed -i '' 's/a/b/' ${__dirname}/core/enforcer.js` } })).exit, 2,
+    "installed package source is control plane too");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "ls -la /tmp" } })).exit, 0,
+    "unrelated shell work stays free on guarded turns");
+  assert.strictEqual(guard.externalControlPlaneDenial(`open-claudia tool run oc-admin crons list --file ${tmp}/crons.json`), null,
+    "authorised channel (tool run) stays exempt — bin/tool.js gates externals itself");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: `open-claudia tool run oc-admin ping && cat ${tmp}/crons.json` } })).exit, 2,
+    "an authorised prefix cannot smuggle a raw control-plane suffix");
+  // keyring exec is exempt above as an authorised channel, so the speaker
+  // gate lives inside the keyring CLI itself — every verb is owner-only
+  // (exec carries the FULL keyring into an arbitrary command's env).
+  const keyringCli = require("./bin/keyring");
+  process.exitCode = 0;
+  keyringCli.run(["path"]);
+  assert.strictEqual(process.exitCode, 1, "keyring CLI refuses guarded external speakers outright");
+  process.exitCode = 0;
+}
+// The owner on a linked channel is never gated.
+process.env.OC_CHANNEL_ID = "111222333";
+process.env.OC_CHANNEL_USER_ID = "111222333";
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: cpWrite } })).exit, 0,
+  "owner turns keep full control-plane access with channel env present");
+delete process.env.OC_CHANNEL_ADAPTER;
+delete process.env.OC_CHANNEL_ID;
+delete process.env.OC_CHANNEL_USER_ID;
+
 // ── audit trail: denies + bypasses land in the guard log (5c KPI source) ──
 guard.logGuardEvent({ kind: "bypass", reason: "no tool yet", command: "curl x" });
 const lines = fs.readFileSync(process.env.TOOL_GUARD_LOG, "utf-8").trim().split("\n").map((l) => JSON.parse(l));
 assert.ok(lines.some((l) => l.kind === "deny" && l.rule === "inet-central-api"), "runHook deny is logged");
+assert.ok(lines.some((l) => l.kind === "deny" && l.rule === "external-file-write" && l.tool === "Write"),
+  "external file-mutation deny is audited with tool + rule");
+assert.ok(lines.some((l) => l.kind === "deny" && l.rule === "external-control-plane" && /crons\.json/.test(l.command || "")),
+  "external control-plane deny is audited with the command");
+assert.ok(lines.some((l) => l.kind === "deny" && l.rule === "external-keyring"),
+  "external keyring refusal is audited");
 assert.ok(lines.some((l) => l.kind === "bypass" && l.reason === "no tool yet"), "keyring exec bypass is logged");
 assert.ok(lines.every((l) => l.ts), "every guard event is timestamped");
 
@@ -170,6 +284,10 @@ assert.strictEqual(pre[0].matcher, "Bash", "hook is scoped to the Bash tool");
 assert.ok(/deny-gate-hook/.test(pre[0].hooks[0].command), "hook invokes the CLI hook entry");
 assert.ok(pre[0].hooks[0].command.includes(process.execPath), "hook uses an absolute node path (subprocess PATH independent)");
 assert.ok(pre[0].hooks[0].timeout > 0, "hook carries a timeout so a hung gate fails open");
+assert.strictEqual(pre[1].matcher, "^(Write|Edit|MultiEdit|NotebookEdit)$",
+  "file-mutation tools are hooked for the external-speaker gate");
+assert.strictEqual(pre[1].hooks[0].command, pre[0].hooks[0].command,
+  "file gate rides the same deny-gate-hook entry (one CLI, one audit path)");
 // second call with the file read-only: content-compare must skip the write
 fs.chmodSync(sPath, 0o444);
 assert.strictEqual(guard.ensureHookSettings(), sPath, "unchanged settings are not rewritten");