@inetafrica/open-claudia 3.4.24 → 3.5.0

package/core/loopback.js

@@ -81,7 +81,19 @@ function readBodyToFile(req, dest) {
 }
 
 const SEND_KINDS = new Set(["send-file", "send-voice", "send-photo"]);
+// Loopback kinds that CREATE a background job. Their creator identity is bound
+// to callerOf(payload) (run-attested), not to the payload's forgeable claims.
+const JOB_CREATE_KINDS = new Set(["schedule-wakeup", "cron-add", "watch-add"]);
+// Owner-only kinds gated centrally on the run-attested caller: notes and tasks
+// (private owner context) plus the people reads (the roster and records expose
+// everyone the owner knows). people mutations keep their own inline gate too.
+const OWNER_ONLY_KINDS = new Set([
+  "people-list", "people-show", "people-note",
+  "task-add", "task-plan", "task-update", "task-remove",
+  "task-list", "task-get", "task-tree", "task-clear-completed",
+]);
 const JSON_KINDS = new Set([
+  "whoami",
   "schedule-wakeup", "cron-add", "cron-remove", "job-list",
   "watch-add", "watch-list", "watch-remove", "watch-toggle",
   "task-add", "task-plan", "task-update", "task-remove", "task-list", "task-get", "task-tree", "task-clear-completed",
@@ -91,22 +103,46 @@ const JSON_KINDS = new Set([
   "relay-send", "recent-fetch", "audit-tail",
   "auth-list", "auth-revoke",
   "approval-request",
+  "tool-gate",
   "say", "call-say", "call", "tts", "transcribe",
 ]);
 
-// Owner gate for identity-sensitive kinds. The claimed canonicalUserId comes
-// from the CLI's env, which the agent's shell can rewrite — so the claim only
-// counts when it carries the runner-minted attestation (an HMAC over the id
-// with a per-boot, memory-only secret; see core/speaker-attest). No attest,
-// a wrong attest, or an attest for a different id all fail closed: forging
-// `OC_CANONICAL_USER_ID=<owner-id>` from a guarded external turn no longer
-// reaches the people/auth/intros mutations the relationship guard depends on.
+// Who is calling, decided by the bot: the principal of a LIVE run whose
+// OC_RUN_ATTEST matches (see core/speaker-attest), else UNATTRIBUTED. Nothing
+// the caller's env claims (OC_CHANNEL_*, OC_CANONICAL_USER_ID) is consulted,
+// and unattributed never carries owner powers.
+function callerOf(payload) {
+  const principal = speakerAttest.verifyRun(payload?.originRunId || payload?.runId, payload?.runAttest);
+  if (principal) {
+    const { registeredAt, ...caller } = principal;
+    return { attributed: true, ...caller };
+  }
+  return { attributed: false, owner: false, guarded: true, kind: "unattributed" };
+}
+
+// A durable, run-attested record of who created a job, stamped alongside its
+// identity fields. Distinguishes a job created since this fix (has createdBy)
+// from a legacy job on disk (no createdBy) — the scheduler runs the latter as
+// before, but logs it. Never trusted for authorization; the fire path
+// re-resolves the speaker from the job's channel/user via runPrincipal.
+function jobCreatorRecord(creator) {
+  return {
+    canonicalUserId: creator.canonicalUserId || null,
+    userId: creator.userId || null,
+    channelId: creator.channelId || null,
+    adapterType: creator.adapterType || null,
+    owner: creator.owner === true,
+    name: creator.name || null,
+    at: new Date().toISOString(),
+  };
+}
+
+// Owner gate for every owner-only kind: true only for a LIVE run the bot
+// registered as acting for the owner. The id attest (OC_SPEAKER_ATTEST) is no
+// longer enough: it is valid for the whole boot and can be lifted from another
+// process's environment. Identity fields in the payload are never consulted.
 function callerIsOwner(payload) {
-  const caller = payload?.canonicalUserId;
-  if (!caller) return false;
-  if (!speakerAttest.verify(caller, payload?.speakerAttest)) return false;
-  const person = peopleStore.findByCanonicalUserId(caller);
-  return !!(person && person.isOwner);
+  return callerOf(payload).owner === true;
 }
 
 function readBodyAsString(req, max = 64 * 1024) {
@@ -172,6 +208,11 @@ async function handleJson(req, res, url, kind) {
     try { payload = JSON.parse(body); }
     catch (e) { return reply(res, 400, { error: "invalid JSON body" }); }
   }
+  // "Who am I?" needs no chat context: an unattributed caller (a process that
+  // outlived its turn, a stripped env) must still get a definite answer.
+  if (kind === "whoami") return reply(res, 200, { ok: true, caller: callerOf(payload) });
+  // Decided from the verified run alone, so it needs no chat fields either.
+  if (kind === "tool-gate") return handleToolGate(res, payload);
   const channelId = String(payload.channelId || url.searchParams.get("channelId") || "");
   const userId = String(payload.userId || url.searchParams.get("userId") || "");
   const adapterId = String(payload.adapter || url.searchParams.get("adapter") || "");
@@ -179,6 +220,40 @@ async function handleJson(req, res, url, kind) {
   const adapter = registry.findAdapter(adapterId);
   if (!adapter) return reply(res, 400, { error: `unknown adapter ${adapterId}` });
 
+  // A background job belongs to WHOEVER the bot says is running the turn that
+  // created it (callerOf, run-bound) and to THAT person's room — never to the
+  // identity the payload claims (OC_CHANNEL_*/OC_CANONICAL_USER_ID, which the
+  // run's own shell can rewrite) and never to the bot's ambient owner state.
+  // So a follow-up a staff turn schedules fires AS that staff member, in their
+  // room, and all of their guards apply when it runs. An unattributed caller
+  // (a process detached from any live turn) cannot schedule anything.
+  let jobCreator = null;
+  if (JOB_CREATE_KINDS.has(kind)) {
+    const caller = callerOf(payload);
+    if (!caller.attributed) {
+      return reply(res, 403, { error: "background jobs can only be scheduled by an attributed run (no live turn is speaking for this process)" });
+    }
+    const creatorAdapter = caller.adapterId ? registry.findAdapter(caller.adapterId) : null;
+    jobCreator = {
+      canonicalUserId: caller.canonicalUserId || null,
+      userId: caller.userId || null,
+      channelId: caller.channelId || channelId,
+      adapter: (creatorAdapter && creatorAdapter.id) || caller.adapterId || adapterId,
+      adapterType: (creatorAdapter && creatorAdapter.type) || caller.adapterType || adapter.type,
+      owner: caller.owner === true,
+      name: caller.name || null,
+    };
+  }
+
+  // Owner-only kinds: notes, tasks, and the people reads. Tasks and people
+  // notes carry private owner context (plans, contact notes), and the people
+  // roster/record reads expose everyone the owner knows — none of it may be
+  // read or written on a non-owner (or unattributed) turn. Gated on the
+  // run-attested caller, never on payload claims.
+  if (OWNER_ONLY_KINDS.has(kind) && !callerIsOwner(payload)) {
+    return reply(res, 403, { error: "owner only" });
+  }
+
   if (kind === "call-say") {
     try {
       const result = await require("./call-speech").speak({ ...payload, channelId, userId, adapter: adapterId });
@@ -285,11 +360,12 @@ async function handleJson(req, res, url, kind) {
     if (!payload.prompt) return reply(res, 400, { error: "missing prompt" });
     const job = scheduler.addJob({
       kind: "wakeup",
-      adapter: adapterId,
-      adapterType: adapter.type,
-      channelId,
-      canonicalUserId: payload.canonicalUserId || null,
-      userId: payload.userId || null,
+      adapter: jobCreator.adapter,
+      adapterType: jobCreator.adapterType,
+      channelId: jobCreator.channelId,
+      canonicalUserId: jobCreator.canonicalUserId,
+      userId: jobCreator.userId,
+      createdBy: jobCreatorRecord(jobCreator),
       provider: payload.provider || null,
       providerSettings: payload.providerSettings || {},
       project: payload.project || null,
@@ -315,11 +391,12 @@ async function handleJson(req, res, url, kind) {
     if (!payload.schedule || !payload.prompt) return reply(res, 400, { error: "missing schedule/prompt" });
     const job = scheduler.addJob({
       kind: "cron",
-      adapter: adapterId,
-      adapterType: adapter.type,
-      channelId,
-      canonicalUserId: payload.canonicalUserId || null,
-      userId: payload.userId || null,
+      adapter: jobCreator.adapter,
+      adapterType: jobCreator.adapterType,
+      channelId: jobCreator.channelId,
+      canonicalUserId: jobCreator.canonicalUserId,
+      userId: jobCreator.userId,
+      createdBy: jobCreatorRecord(jobCreator),
       provider: payload.provider || null,
       providerSettings: payload.providerSettings || {},
       project: payload.project || null,
@@ -362,11 +439,12 @@ async function handleJson(req, res, url, kind) {
   if (kind === "watch-add") {
     if (!payload.check || !payload.prompt) return reply(res, 400, { error: "missing check/prompt" });
     const job = scheduler.addWatch({
-      adapter: adapterId,
-      adapterType: adapter.type,
-      channelId,
-      canonicalUserId: payload.canonicalUserId || null,
-      userId: payload.userId || null,
+      adapter: jobCreator.adapter,
+      adapterType: jobCreator.adapterType,
+      channelId: jobCreator.channelId,
+      canonicalUserId: jobCreator.canonicalUserId,
+      userId: jobCreator.userId,
+      createdBy: jobCreatorRecord(jobCreator),
       provider: payload.provider || null,
       providerSettings: payload.providerSettings || {},
       project: payload.project || null,
@@ -631,13 +709,13 @@ async function handleJson(req, res, url, kind) {
 
   if (kind === "relay-send") {
     if (!payload.text) return reply(res, 400, { error: "missing text" });
-    // A guarded (external) requester may pass a message TO THE OWNER — that is
-    // the "tell them for me" flow — but never use the bot as a relay to third
+    // A non-owner requester may pass a message TO THE OWNER — that is the
+    // "tell them for me" flow — but never use the bot as a relay to third
     // parties: sending as the bot to anyone else is impersonation surface.
-    try {
-      const relationship = require("./relationship");
-      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
-      if (relationship.guardActive(speaker)) {
+    // Who is requesting is the run-attested caller, not the payload's claims.
+    {
+      const requester = callerOf(payload);
+      if (!requester.owner) {
         const target =
           (payload.targetPersonId && peopleStore.findById(payload.targetPersonId)) ||
           (payload.targetPersonName && peopleStore.findByName(payload.targetPersonName)) ||
@@ -648,7 +726,7 @@ async function handleJson(req, res, url, kind) {
           return reply(res, 403, { error: "relay from an external contact can only go to the owner — messages to anyone else are owner-only" });
         }
       }
-    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
+    }
     try {
       const result = await relay.send({
         text: payload.text,
@@ -667,29 +745,36 @@ async function handleJson(req, res, url, kind) {
   }
 
   if (kind === "recent-fetch") {
-    // Transcript reads are owner-side memory. A guarded (external, non-owner)
-    // requester must not pull other channels' conversations through the CLI —
-    // same default-deny as file/voice egress, same fail direction.
-    try {
-      const relationship = require("./relationship");
-      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
-      if (relationship.guardActive(speaker)) {
-        return reply(res, 403, { error: "transcript access is owner-only — an external contact cannot read other conversations" });
-      }
-    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
+    // Transcript reads are owner-side memory. The owner may pull any channel or
+    // person; a non-owner caller is confined to THEIR OWN room and may never
+    // point this at another conversation or an owner DM. Who is calling is the
+    // run-attested principal, not the payload's forgeable channel/user claims.
+    const caller = callerOf(payload);
     const limit = Math.max(1, Math.min(parseInt(payload.limit || 20, 10) || 20, 200));
     try {
-      let targetAdapter = payload.adapter;
-      let targetChannel = payload.channelId;
-      if (payload.personName || payload.personId) {
-        const person = peopleStore.findById(payload.personId || "") || peopleStore.findByName(payload.personName || "");
-        if (!person) return reply(res, 404, { error: "person not found" });
-        const handle = person.primaryChannel
-          ? (person.handles || []).find((h) => h.adapter === person.primaryChannel.adapter && String(h.channelId) === String(person.primaryChannel.channelId))
-          : (person.handles || [])[0];
-        if (!handle) return reply(res, 404, { error: "person has no handles" });
-        targetAdapter = handle.adapter;
-        targetChannel = handle.channelId;
+      let targetAdapter;
+      let targetChannel;
+      if (caller.owner) {
+        targetAdapter = payload.adapter;
+        targetChannel = payload.channelId;
+        if (payload.personName || payload.personId) {
+          const person = peopleStore.findById(payload.personId || "") || peopleStore.findByName(payload.personName || "");
+          if (!person) return reply(res, 404, { error: "person not found" });
+          const handle = person.primaryChannel
+            ? (person.handles || []).find((h) => h.adapter === person.primaryChannel.adapter && String(h.channelId) === String(person.primaryChannel.channelId))
+            : (person.handles || [])[0];
+          if (!handle) return reply(res, 404, { error: "person has no handles" });
+          targetAdapter = handle.adapter;
+          targetChannel = handle.channelId;
+        }
+      } else {
+        // Non-owner: ignore every target selector and pin to the caller's own
+        // room. Unattributed (no live turn) has no room → refuse.
+        if (!caller.attributed || !caller.adapterType || !caller.channelId) {
+          return reply(res, 403, { error: "transcript access outside your own room is owner-only" });
+        }
+        targetAdapter = caller.adapterType;
+        targetChannel = caller.channelId;
       }
       if (!targetAdapter || !targetChannel) return reply(res, 400, { error: "need adapter+channelId or person" });
       const entries = readRecentTranscript(targetAdapter, targetChannel, limit);
@@ -712,15 +797,13 @@ async function handleJson(req, res, url, kind) {
       // Safety net: this path posts an Approve/Deny for a destructive command to
       // the REQUESTING channel. That must only ever be the owner — external
       // mutating runs are routed to the owner via the enforcer BEFORE reaching a
-      // tool subprocess's chat-approval fallback. If the requester resolves to a
-      // non-owner, refuse: never hand an external the approve button (R8/R10).
-      try {
-        const relationship = require("./relationship");
-        const speaker = relationship.speakerFor(adapter.type, channelId, userId);
-        if (relationship.guardActive(speaker)) {
-          return reply(res, 403, { error: "approval requests are owner-only; external mutating runs escalate through the guardrail" });
-        }
-      } catch (e) { /* if classification fails, fall through — approvals stay owner-scoped by the apr: handler's isChatOwner gate */ }
+      // tool subprocess's chat-approval fallback. The requester is the
+      // run-attested caller (not the payload's forgeable claims); a non-owner
+      // (or unattributed) requester is refused — never hand an external the
+      // approve button (R8/R10).
+      if (!callerOf(payload).owner) {
+        return reply(res, 403, { error: "approval requests are owner-only; external mutating runs escalate through the guardrail" });
+      }
       const approvals = require("./approvals");
       // Spaces-origin runs: Spaces has no inline-button UI and its thread can be
       // watched by non-owners, so the BINDING Approve/Deny goes to the owner's
@@ -812,10 +895,15 @@ function readRecentTranscript(adapter, channelId, limit) {
       for (const line of lines) {
         try {
           const obj = JSON.parse(line);
-          const objAdapter = (obj.adapter || obj.adapterType || "").toLowerCase();
-          const objChannel = String(obj.channelId || "");
-          if (objAdapter && objAdapter !== adapterPrefix) continue;
-          if (objChannel && objChannel !== channelStr) continue;
+          // Project transcripts store the surface under obj.chat ({transport,id}),
+          // not top-level adapter/channelId — the old filter read the latter,
+          // found undefined, and so never actually scoped to the requested
+          // channel (every entry from every file leaked through). Read chat.*
+          // (with a legacy fallback) and REQUIRE a match on both.
+          const objAdapter = String(obj.chat?.transport || obj.adapter || obj.adapterType || "").toLowerCase();
+          const objChannel = String(obj.chat?.id ?? obj.channelId ?? "");
+          if (objAdapter !== adapterPrefix) continue;
+          if (objChannel !== channelStr) continue;
           out.push({
             at: obj.at || obj.timestamp || null,
             role: obj.role || obj.author || null,
@@ -830,6 +918,73 @@ function readRecentTranscript(adapter, channelId, limit) {
   } catch (e) { return []; }
 }
 
+// ── tool-gate: a guarded run's write/destructive tool run, decided HERE ─────
+// `open-claudia tool run` used to pick the speaker from its own env
+// (OC_CHANNEL_*) and to vet + escalate in its own process. A staff turn's CLI
+// has neither the AI credentials (scrubbed from a non-owner run) nor the chat
+// adapters, so its escalations never reached an owner. Now the CLI asks the
+// bot: the caller is the verified live run (callerOf — identity fields in the
+// payload are never read), the speaker is rebuilt from that principal, the
+// mandate vet runs with the bot's credentials, and an escalation posts its card
+// through the bot's own adapters. The CLI treats every answer but allow/held
+// as blocked (fail closed).
+async function handleToolGate(res, body) {
+  const payload = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+  const caller = callerOf(payload);
+  const text = (value) => (value == null ? "" : String(value));
+  const tool = text(payload.tool) || null;
+  const blocked = (reason, extra = {}) => {
+    try { audit.log("tool.gate", { decision: "blocked", tool, runId: caller.runId || null, reason: String(reason).slice(0, 160) }); } catch (_) {}
+    return reply(res, 200, { ok: true, decision: "blocked", reason, ...extra });
+  };
+  if (!caller.attributed) return blocked("not attributed to a live chat turn");
+  if (!caller.guarded) return blocked("not a guarded run — the owner's runs are gated by the tool runner itself");
+  const command = typeof payload.command === "string" ? payload.command : "";
+  const tier = text(payload.tier);
+  if (!command.trim()) return reply(res, 400, { error: "missing command" });
+  if (tier !== "write" && tier !== "destructive") return reply(res, 400, { error: "tier must be write or destructive" });
+
+  const relationship = require("./relationship");
+  let speaker = null;
+  try { speaker = relationship.speakerFor(caller.adapterType, caller.channelId, caller.userId); }
+  catch (e) { speaker = null; }
+  if (!speaker || !relationship.guardActive(speaker)) return blocked("the run's speaker could not be resolved — failing closed");
+  const name = speaker.name || caller.name || "";
+
+  const enforcer = require("./enforcer");
+  let vet;
+  try { vet = await enforcer.vetAction(speaker, { command, tier }); }
+  catch (e) { vet = { decision: "escalate", reason: "vet error — failing closed" }; }
+  if (vet && vet.decision === "allow") {
+    try { audit.log("tool.gate", { decision: "allow", tier, tool, runId: caller.runId, person: name || null }); } catch (_) {}
+    return reply(res, 200, { ok: true, decision: "allow", approvedVia: "mandate", name });
+  }
+  const providerSettings = payload.providerSettings && typeof payload.providerSettings === "object" && !Array.isArray(payload.providerSettings)
+    ? payload.providerSettings : {};
+  let esc;
+  try {
+    esc = await enforcer.escalate({
+      speaker, kind: "action", command, tier, reason: vet && vet.reason,
+      // WHO the approval is for comes from the verified run; the rest only
+      // pins where an approved re-run resumes (provider/project/session).
+      canonicalUserId: caller.canonicalUserId || "",
+      userId: caller.userId || "",
+      provider: text(payload.provider),
+      providerSettings,
+      project: text(payload.project),
+      projectDir: text(payload.projectDir),
+      sessionId: text(payload.sessionId),
+      previousSessionId: text(payload.previousSessionId),
+      originRunId: caller.runId || "",
+    });
+  } catch (e) { esc = { escalated: false, reason: e.message }; }
+  if (esc && esc.escalated && esc.id) {
+    try { audit.log("tool.gate", { decision: "held", tier, tool, runId: caller.runId, person: name || null, approvalId: esc.id }); } catch (_) {}
+    return reply(res, 200, { ok: true, decision: "held", approvalId: esc.id, name });
+  }
+  return blocked(`the owner could not be reached to approve (${(esc && esc.reason) || "escalation failed"})`, { unreachable: true, name });
+}
+
 async function handle(req, res) {
   try {
     if (req.method !== "POST") return reply(res, 405, { error: "method not allowed" });
@@ -867,4 +1022,4 @@ function stop() {
 
 process.on("exit", deleteInfo);
 
-module.exports = { start, stop, info, INFO_DIR, INFO_FILE };
+module.exports = { start, stop, info, callerOf, INFO_DIR, INFO_FILE };

package/core/providers/claude-hook.js

@@ -31,6 +31,11 @@ function buildClaudeHookSettings(options = {}) {
         // blocks provider file-mutation tools (see tool-guard.js
         // externalFileMutationDenial). Owner/no-context turns pass through.
         { matcher: "^(Write|Edit|MultiEdit|NotebookEdit)$", hooks: [hook] },
+        // Guarded-speaker read gate: on external turns reads and searches that
+        // reach the bot's own state or credential stores are denied (see
+        // tool-guard.js evaluateGuardedRead). NotebookRead and LS exist only
+        // on older Claude Code builds. Owner/no-context turns pass through.
+        { matcher: "^(Read|Grep|Glob|NotebookRead|LS)$", hooks: [hook] },
       ],
     },
   };

package/core/runner.js

@@ -1771,6 +1771,31 @@ async function deliverForegroundResult(result, runContext, state = currentState(
   return { ok: true, chunks: chunks.length };
 }
 
+// The principal a run acts for. With no chat origin (bot-internal work) that
+// is the owner. With a chat origin it is the speaker the relationship layer
+// resolves from the inbound envelope — also for a compaction stage, which
+// summarises that speaker's conversation; if the speaker cannot be resolved
+// the run is treated as a non-owner (fail closed).
+function runPrincipal(runContext) {
+  const origin = runContext.origin || {};
+  const channelId = runContext.channelId != null ? String(runContext.channelId) : origin.channelId;
+  const base = {
+    kind: "turn",
+    purpose: runContext.purpose || null,
+    canonicalUserId: runContext.canonicalUserId || origin.canonicalUserId || null,
+    adapterId: origin.adapterId || null,
+    adapterType: origin.transport || null,
+    channelId: channelId || null,
+    userId: origin.userId || null,
+  };
+  if (!base.adapterType || !base.channelId) return { ...base, owner: true };
+  let speaker = null;
+  try { speaker = require("./relationship").speakerFor(base.adapterType, base.channelId, base.userId); }
+  catch (error) { speaker = null; }
+  if (!speaker) return { ...base, owner: false };
+  return { ...base, owner: speaker.isOwner === true, name: speaker.name || null, room: speaker.room || null };
+}
+
 function decorateForegroundInvocation(invocation, runContext, bundle) {
   const env = { ...invocation.env };
   delete env.OC_CALL_SPEECH_TOKEN;
@@ -1792,6 +1817,22 @@ function decorateForegroundInvocation(invocation, runContext, bundle) {
   }
   env.OC_PROVIDER = runContext.provider;
   env.OC_RUN_ID = runContext.runId;
+  // Run attestation: who this run acts for is decided HERE, in the bot
+  // process, from the inbound origin — never from anything the run's own
+  // shell can change. CLIs ask the loopback "who is this?" with
+  // OC_RUN_ID + OC_RUN_ATTEST; the registration ends with the run (cleanup),
+  // so a process that outlives its turn is unattributed.
+  const principal = runPrincipal(runContext);
+  env.OC_RUN_ATTEST = require("./speaker-attest").registerRun(runContext.runId, principal);
+  // A non-owner's turn never sees the AI service credentials: Claude Code
+  // strips its own auth variables from every subprocess it starts (shell,
+  // hooks) when this is set. The agent process itself keeps them.
+  if (principal.owner !== true) {
+    env.CLAUDE_CODE_SUBPROCESS_ENV_SCRUB = "1";
+    // Read by the permission hook (which inherits the agent's env, not the
+    // agent's shell's) so a guard that cannot load fails closed on this run.
+    env.OC_GUARDED_RUN = "1";
+  } else delete env.OC_GUARDED_RUN;
   if (runContext.project?.name) env.OC_PROJECT = String(runContext.project.name);
   if (runContext.project?.dir) env.OC_PROJECT_DIR = String(runContext.project.dir);
   if (runContext.sessionId) env.OC_SESSION_ID = String(runContext.sessionId);
@@ -2036,6 +2077,9 @@ function createForegroundService({ state, store, stopTyping, capture, ownsAdmiss
     },
     onStderr(chunk) { console.error("PROVIDER STDERR:", redactSensitive(chunk)); },
     cleanup: async (proc, _details, runContext) => {
+      // The run is over: its attest stops speaking for anyone, so a process
+      // it left behind is unattributed from here on.
+      try { require("./speaker-attest").endRun(runContext.runId); } catch (_) {}
       callSpeechLeases.get(runContext.runId)?.close();
       callSpeechLeases.delete(runContext.runId);
       if (state.runningProcess === proc) state.runningProcess = null;
@@ -2422,6 +2466,7 @@ module.exports = {
   streamPreviewAllowed,
   capturedTranscriptMetadata,
   decorateForegroundInvocation,
+  runPrincipal,
   createRunnerService,
   createForegroundService,
   createSideChatService,

package/core/scheduler.js

@@ -73,6 +73,84 @@ function uniqueId(prefix = "occ") {
     : `${prefix}-${Date.now()}-${crypto.randomBytes(6).toString("hex")}`;
 }
 
+// ── watch-check environment ────────────────────────────────────────────────
+// A watch's `check` runs a shell command. It used to inherit `env:
+// process.env` — every secret the bot process holds (provider credentials,
+// bot tokens, the loopback token), so a staff member's check could read them
+// all. Build the env explicitly instead: keep the harmless shell essentials
+// and the Open Claudia config dir (so `open-claudia ...` resolves its config),
+// then drop anything that looks like a credential (a broad denylist pattern)
+// plus the known-secret names the provider env-isolation layer already
+// strips. A short-lived, creator-scoped run is stamped on top (below) so the
+// check's reusable tools still attribute to whoever created the watch.
+const WATCH_CHECK_ENV_KEEP = new Set([
+  "PATH", "HOME", "USER", "LOGNAME", "SHELL",
+  "LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "TZ",
+  "TERM", "COLORTERM", "NO_COLOR", "FORCE_COLOR",
+  "TMPDIR", "TMP", "TEMP",
+  "OPEN_CLAUDIA_CONFIG_DIR",
+  "SystemRoot", "ComSpec", "PATHEXT", "WINDIR",
+]);
+const WATCH_CHECK_SECRET_PATTERN = /(TOKEN|SECRET|PASSWORD|PASSWD|API[_-]?KEY|APIKEY|OAUTH|CREDENTIAL|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|CLIENT[_-]?SECRET|SESSION[_-]?KEY|BEARER)/i;
+let KNOWN_SECRET_ENV_KEYS = null;
+function knownSecretEnvKeys() {
+  if (KNOWN_SECRET_ENV_KEYS) return KNOWN_SECRET_ENV_KEYS;
+  const set = new Set();
+  try { for (const key of require("./providers/env").ALWAYS_STRIPPED_KEYS) set.add(key); } catch (_) {}
+  KNOWN_SECRET_ENV_KEYS = set;
+  return set;
+}
+function isSecretCheckEnvKey(key) {
+  if (WATCH_CHECK_ENV_KEEP.has(key)) return false;
+  if (knownSecretEnvKeys().has(key)) return true;
+  return WATCH_CHECK_SECRET_PATTERN.test(key);
+}
+function buildWatchCheckEnv(source, stamp = {}) {
+  const env = {};
+  for (const [key, value] of Object.entries(source || {})) {
+    if (value == null) continue;
+    if (isSecretCheckEnvKey(key)) continue;
+    env[key] = String(value);
+  }
+  for (const [key, value] of Object.entries(stamp)) {
+    if (value == null || value === "") continue;
+    env[key] = String(value);
+  }
+  return env;
+}
+
+// The principal a watch-check's short-lived run acts for: the job's creator,
+// resolved from its stored channel/user the same way runPrincipal resolves a
+// turn's speaker. Owner → the check attributes as the owner (unchanged); a
+// staff creator → the check runs at their level. Fail closed to non-owner.
+function watchCheckPrincipal(job) {
+  const adapterType = job && job.adapterType ? String(job.adapterType) : null;
+  const channelId = job && job.channelId != null ? String(job.channelId) : null;
+  const userId = job && job.userId != null ? String(job.userId) : null;
+  let owner = false;
+  let name = null;
+  let room = null;
+  if (adapterType && channelId) {
+    try {
+      const sp = require("./relationship").speakerFor(adapterType, channelId, userId);
+      owner = !!(sp && sp.isOwner === true);
+      name = (sp && sp.name) || null;
+      room = (sp && sp.room) || null;
+    } catch (_) { owner = false; }
+  }
+  return {
+    kind: "watch-check",
+    owner,
+    canonicalUserId: job && job.canonicalUserId ? String(job.canonicalUserId) : null,
+    name,
+    adapterId: job && job.adapter ? String(job.adapter) : null,
+    adapterType,
+    channelId,
+    userId,
+    room,
+  };
+}
+
 function parseFallbacks(value) {
   if (Array.isArray(value)) return [...new Set(value.map((item) => String(item).trim().toLowerCase()).filter(Boolean))];
   return [...new Set(String(value || "").split(",").map((item) => item.trim().toLowerCase()).filter(Boolean))];
@@ -155,23 +233,49 @@ function createSchedulerService(dependencies = {}) {
   const timers = new Map();
   const checksInFlight = new Set();
   const firesInFlight = new Set();
+  // Jobs already on disk before the creator-binding fix carry no `createdBy`.
+  // We keep running them AS THEY ARE (their stored channel/user is what the
+  // fire path resolves the speaker from — the owner's own watches and wakeups
+  // must not silently break), but log the first time each fires so an audit
+  // can spot a pre-fix job that outranks a non-owner. Logged once per id/boot.
+  const loggedLegacyCreators = new Set();
+  function noteLegacyCreatorOnce(job) {
+    if (!job || job.createdBy || loggedLegacyCreators.has(job.id)) return;
+    loggedLegacyCreators.add(job.id);
+    try {
+      console.warn(`[scheduler] job ${job.id} (${job.kind}${job.check ? "/watch" : ""}) predates creator binding — running with its stored identity ${job.canonicalUserId || "?"} in ${job.adapterType || "?"}:${job.channelId || "?"}`);
+    } catch (_) { /* logging is best-effort */ }
+  }
   // Poll a watch's `check`: exit 0 → the watched condition is met, wake the
   // agent; non-zero → still idle, skip silently. Runs in the job's project
-  // dir with the process env, output discarded (exit code is the contract),
+  // dir with a HARDENED env — the bot's secrets are dropped (buildWatchCheckEnv)
+  // and a short-lived run is registered for the job's creator so reusable
+  // tools attribute correctly — output discarded (exit code is the contract),
   // hard-capped by WATCH_CHECK_TIMEOUT_MS. Injectable so tests stay hermetic.
   const runWatchCheck = dependencies.runWatchCheck || ((command, job) => new Promise((resolve) => {
     const cwd = (job && projectDescriptor(job).dir) || workspace || process.cwd();
+    const attest = require("./speaker-attest");
+    const checkRunId = uniqueId("watch-check");
+    let runAttest = "";
+    try { runAttest = attest.registerRun(checkRunId, watchCheckPrincipal(job)); } catch (_) { runAttest = ""; }
+    let lb = null;
+    try { lb = require("./loopback").info(); } catch (_) { lb = null; }
+    const stamp = { OC_RUN_ID: checkRunId, OC_RUN_ATTEST: runAttest };
+    if (lb && lb.url) { stamp.OC_SEND_URL = lb.url; stamp.OC_SEND_TOKEN = lb.token; }
+    const env = buildWatchCheckEnv(process.env, stamp);
     let settled = false;
     const finish = (code, timedOut) => {
       if (settled) return;
       settled = true;
       try { clearTimer(timer); } catch (_) {}
+      try { attest.endRun(checkRunId); } catch (_) {}
       resolve({ code, timedOut: !!timedOut });
     };
     let child;
     try {
-      child = spawn("sh", ["-c", String(command)], { cwd, env: process.env, stdio: "ignore" });
+      child = spawn("sh", ["-c", String(command)], { cwd, env, stdio: "ignore" });
     } catch (error) {
+      try { attest.endRun(checkRunId); } catch (_) {}
       return resolve({ code: 127, timedOut: false });
     }
     const timer = setTimer(() => { try { child.kill("SIGKILL"); } catch (_) {} finish(124, true); }, WATCH_CHECK_TIMEOUT_MS);
@@ -624,6 +728,7 @@ function createSchedulerService(dependencies = {}) {
     };
 
     return runInChat(chat, async () => {
+      noteLegacyCreatorOnce(job);
       const state = stateForUser(canonicalUserId);
       if (state.runningProcess || state.preparingRun || state.isCompacting) {
         try { return markBusy(job); }
@@ -974,6 +1079,9 @@ module.exports = {
   createSchedulerService,
   parseFallbacks,
   terminalRunSucceeded,
+  buildWatchCheckEnv,
+  isSecretCheckEnvKey,
+  watchCheckPrincipal,
   setAdapters,
   initScheduler,
   scheduleJob: service.scheduleJob,