@inetafrica/open-claudia 3.4.24 → 3.5.0

package/project-transcripts.js

@@ -136,9 +136,34 @@ class ProjectTranscripts {
   }
 }
 
+// Who a transcript file belongs to, for the room-scoping guard in the search
+// CLIs. Every project transcript is keyed by (canonicalUserId, projectPath) and
+// records the owning canonicalUserId in its sidecar `.json` (and on each JSONL
+// entry). Reading it back lets a non-owner CLI confirm a transcript it was
+// pointed at is actually the caller's own — an env-forged OC_TRANSCRIPT_PATH
+// aimed at someone else's file resolves to a different canonicalUserId and is
+// refused. Returns null when ownership cannot be established (fail closed).
+function transcriptOwnerOf(transcriptPath) {
+  const file = String(transcriptPath || "");
+  if (!file) return null;
+  const sidecar = file.endsWith(".jsonl") ? `${file.slice(0, -6)}.json` : `${file}.json`;
+  try {
+    const meta = JSON.parse(fs.readFileSync(sidecar, "utf8"));
+    if (meta && meta.canonicalUserId) return String(meta.canonicalUserId);
+  } catch (e) { /* fall through to the JSONL header */ }
+  try {
+    const raw = fs.readFileSync(file, "utf8");
+    const newline = raw.indexOf("\n");
+    const first = JSON.parse(newline === -1 ? raw : raw.slice(0, newline));
+    if (first && first.canonicalUserId) return String(first.canonicalUserId);
+  } catch (e) { /* unreadable → unknown owner */ }
+  return null;
+}
+
 module.exports = {
   ProjectTranscripts,
   normalizeProjectPath,
   projectHash,
   truthy,
+  transcriptOwnerOf,
 };

package/test-approval-async.js

@@ -124,6 +124,28 @@ const approvals = require("./core/approvals");
     "legacy approvals with an undisplayed suffix require a fresh decision",
   );
 
+  // ── an approval carries EXACTLY the tier on the owner's card ──
+  // A write approval never redeems for a run that now resolves destructive
+  // (and the refusal leaves the token intact); the tier a redemption exports
+  // is the record's own, and a record without one falls back to the run's
+  // tier — never to "destructive" by default.
+  const writeRec = approvals.create({ tool: "fleet", verb: "restart", tier: "write", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(writeRec.id, "approved", "c1");
+  const stretched = approvals.consume(writeRec.id, CMD, { tier: "destructive" });
+  assert.strictEqual(stretched.ok, false, "a write approval cannot redeem a destructive run");
+  assert.ok(/covers a write run, but this run is destructive/.test(stretched.reason));
+  assert.strictEqual(approvals.read(writeRec.id).consumedAt, undefined, "the tier refusal does not burn the token");
+  const fits = approvals.consume(writeRec.id, CMD, { tier: "write" });
+  assert.strictEqual(fits.ok, true, "the approved tier redeems");
+  assert.strictEqual(approvals.approvedTier(fits.record, "destructive"), "write", "the record's tier is what the run carries");
+  const untiered = approvals.create({ tool: "fleet", command: CMD, channelId: "c1", adapter: "tg" });
+  assert.strictEqual(untiered.tier, "", "no tier given → none recorded (not destructive)");
+  approvals.decide(untiered.id, "approved", "c1");
+  const legacyRun = approvals.consume(untiered.id, CMD, { tier: "destructive" });
+  assert.strictEqual(legacyRun.ok, true, "a tierless record binds nothing extra");
+  assert.strictEqual(approvals.approvedTier(legacyRun.record, "write"), "write", "a tierless record exports the run's own tier");
+  assert.strictEqual(approvals.approvedTier({ tier: "reply" }, "read-only"), "read-only", "non-tool tiers never widen a run");
+
   const quotedCommand = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "fleet", "purge", "node one", "it's-safe"]);
   assert.strictEqual(quotedCommand, "open-claudia tool run fleet purge 'node one' 'it'\"'\"'s-safe'");
 

package/test-approval-cards.js

@@ -176,6 +176,46 @@ const lastSend = () => sends[sends.length - 1]?.text || "";
   assert.ok(rows.includes(`grl:${ruled.id}:channel`), "channel scope offered");
   assert.ok(rows.includes(`grl:${ruled.id}:global`), "global scope offered");
 
+  // ── grn: standing grants from a card ("Always — here / everywhere") ──
+  const grants = require("./core/grants");
+  const pair = { speakerId: "user-lucy", room: "kazee:ext-channel" };
+
+  // Destructive is never standing: the tap is refused and nothing is written.
+  const destructive = approvals.create({ ...base, ...pair, kind: "action", tier: "destructive", command: "open-claudia tool run infra delete-vm vm-1" });
+  await handleAction(envelopeFor(`grn:${destructive.id}:all`));
+  assert.ok(/^Destructive actions always ask; no standing permission/.test(lastSend()), "owner is told destructive always asks");
+  await handleAction(envelopeFor(`grn:${destructive.id}:room`));
+  assert.ok(/^Destructive actions always ask/.test(lastSend()));
+  assert.strictEqual(grants.list().length, 0, "no grant written from a destructive card");
+
+  // Anonymous or unverifiable principals are refused at the button.
+  const anon = approvals.create({
+    ...base, adapter: "telegram", targetAdapter: "telegram", channelId: "-100555", targetChannel: "-100555",
+    kind: "action", tier: "write", command: "open-claudia tool run kticket create",
+    speakerId: "1087968824", room: "telegram:-100555",
+  });
+  await handleAction(envelopeFor(`grn:${anon.id}:room`));
+  assert.ok(/^No standing permission for an anonymous group admin.*Use Approve once/.test(lastSend()), "anonymous admin refused at the button");
+  const roomAsSender = approvals.create({ ...base, kind: "reply", tier: "reply", payloadText: "Hi.", speakerId: "ext-channel", room: "kazee:ext-channel" });
+  await handleAction(envelopeFor(`grn:${roomAsSender.id}:all`));
+  assert.ok(/^No standing permission for the room itself/.test(lastSend()), "a sender that is really the room is refused");
+  assert.strictEqual(grants.list().length, 0, "no grant written for an unverifiable principal");
+
+  // Only an owner can grant.
+  const write = approvals.create({ ...base, ...pair, kind: "action", tier: "write", command: "open-claudia tool run kticket create" });
+  await handleAction(envelopeFor(`grn:${write.id}:room`, { channelId: "intruder-chat" }));
+  assert.ok(/Owner only/.test(lastSend()));
+  assert.strictEqual(grants.list().length, 0);
+
+  // A write card from one identifiable person grants `act` for that pair.
+  await handleAction(envelopeFor(`grn:${write.id}:room`));
+  assert.ok(/Granted Lucy `act`/.test(lastSend()), "write card grants act");
+  const issued = grants.list();
+  assert.strictEqual(issued.length, 1);
+  assert.strictEqual(issued[0].capability, "act");
+  assert.strictEqual(issued[0].principal.channelId, "user-lucy");
+  assert.strictEqual(issued[0].room, "kazee:ext-channel");
+
   // ── expired card: nothing to decide ──
   await handleAction(envelopeFor("apr:apr_0000_dead:ok"));
   assert.ok(/expired|cleaned up/.test(lastEdit()), "stale card gets a clear ack");

package/test-provider-language.js

@@ -506,7 +506,15 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // wakeups sleep in chunks instead of firing at once; a failed jobs-store write
 // keeps the retry armed; listings say where a fired job stands; loopback says
 // which step failed; the pack-review release gate no longer flakes on 30 s.
-assert.strictEqual(pkg.version, "3.4.24", "release version must remain unchanged without explicit approval");
+// 3.5.0 approved by Sumeet 2026-09-25 14:43 EAT ("yes work through it end to end",
+// the permission redesign, phase 0 security fixes first): the bot decides who a
+// process acts for (run attestation, whoami); staff tool writes are decided and
+// escalated in the bot; undeclared verbs refused; approvals carry their tier;
+// tool/note/keyring/sub-agent changes owner-only; staff follow-ups run at the
+// setter's level; notes/tasks owner-only and search stays in the room; reads
+// screened and the hook fails closed on staff turns; no standing destructive
+// or anonymous grants; canary release tags. Shipped first as canary-v3.5.0.
+assert.strictEqual(pkg.version, "3.5.0", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-scheduler.js

@@ -1544,6 +1544,18 @@ function staticSchedulingProbe() {
   assert.match(source["core/scheduler.js"], /watchExpired/, "scheduler must mark expiry fires distinctly");
   assert.match(source["core/loopback.js"], /expiresAt/, "loopback must pass the watch expiry through");
   assert.match(source["bin/schedule.js"], /--timeout/, "watch-add CLI must expose --timeout");
+
+  // Phase 0 (B2): a watch check must NOT inherit the bot's whole environment,
+  // must build an explicit hardened env, and must register a creator-scoped
+  // run around the poll.
+  assert.ok(!/env:\s*process\.env/.test(source["core/scheduler.js"]), "watch check must not spawn with the bot's whole process env");
+  assert.match(source["core/scheduler.js"], /buildWatchCheckEnv\(process\.env/, "watch check builds an explicit hardened env");
+  assert.match(source["core/scheduler.js"], /registerRun\(checkRunId/, "watch check registers a creator-scoped run");
+  assert.match(source["core/scheduler.js"], /endRun\(checkRunId\)/, "watch check ends its run when the check exits");
+  // Phase 0 (B2): the loopback binds a job's identity to the run-attested
+  // creator, not the payload's claims, and refuses an unattributed caller.
+  assert.match(source["core/loopback.js"], /JOB_CREATE_KINDS/, "loopback must bind job creation to the run-attested caller");
+  assert.match(source["core/loopback.js"], /createdBy/, "jobs must record their creator principal");
 }
 
 async function main() {
@@ -1553,6 +1565,8 @@ async function main() {
   assert.strictEqual(typeof jobsApi.migrateJobsDocument, "function");
   assert.strictEqual(typeof jobsApi.createJobsStore, "function");
   assert.strictEqual(typeof schedulerApi.createSchedulerService, "function");
+  assert.strictEqual(typeof schedulerApi.buildWatchCheckEnv, "function", "scheduler exports the watch-check env builder");
+  assert.strictEqual(typeof schedulerApi.watchCheckPrincipal, "function", "scheduler exports the watch-check principal resolver");
 
   migrationProbe(jobsApi);
   legacyDefaultsProbe(jobsApi);

package/test-provider-tool-hooks.js

@@ -95,6 +95,17 @@ try {
   const claudeSettings = buildClaudeHookSettings();
   assert.strictEqual(claudeSettings.hooks.PreToolUse[0].matcher, "Bash");
   assert.match(claudeSettings.hooks.PreToolUse[0].hooks[0].command, /deny-gate-hook/);
+  // Claude's file-reading tools never pass through a shell, so the guarded
+  // read gate needs its own matcher on the same deny-gate entry.
+  const readHook = claudeSettings.hooks.PreToolUse.find((entry) => entry.matcher === "^(Read|Grep|Glob|NotebookRead|LS)$");
+  assert.ok(readHook, "Claude read tools are hooked");
+  assert.strictEqual(readHook.hooks[0].command, claudeSettings.hooks.PreToolUse[0].hooks[0].command);
+  for (const tool of ["Read", "Grep", "Glob", "NotebookRead", "LS"]) {
+    assert.ok(new RegExp(readHook.matcher).test(tool), `${tool} matches the read-gate matcher`);
+  }
+  for (const tool of ["Bash", "Write", "WebFetch", "ReadMcpResourceTool", "Task"]) {
+    assert.ok(!new RegExp(readHook.matcher).test(tool), `${tool} stays out of the read-gate matcher`);
+  }
   assert.match(claudeSettings.hooks.PreToolUse[0].hooks[0].command, new RegExp(process.execPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
   assert.strictEqual(ensureClaudeHookSettings({ settingsFile: claudeSettingsFile }), claudeSettingsFile);
   assert.deepStrictEqual(JSON.parse(fs.readFileSync(claudeSettingsFile, "utf8")), claudeSettings);

package/test-tool-guard.js

@@ -122,7 +122,9 @@ const deny = guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { com
 assert.strictEqual(deny.exit, 2, "deny → exit 2 (blocking)");
 assert.ok(/deny-gate/.test(deny.stderr), "deny → stderr message for the model");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "ls -la" } })).exit, 0, "benign Bash → allow");
-assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Read", tool_input: { file_path: "/etc/hosts" } })).exit, 0, "non-Bash tools are never gated");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Read", tool_input: { file_path: "/etc/hosts" } })).exit, 0, "reads are never gated without channel context");
+// Owner-local (no channel context) fails OPEN; guarded turns fail closed
+// instead (pinned in test-read-guard.js).
 assert.strictEqual(guard.runHook("not json{{{").exit, 0, "unparseable payload fails OPEN");
 assert.strictEqual(guard.runHook(null).exit, 0, "null payload fails OPEN");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash" })).exit, 0, "missing tool_input fails OPEN");
@@ -154,7 +156,7 @@ assert.strictEqual(
   guard.runHook(JSON.stringify({ tool_name: "apply_patch", tool_input: { command: "*** Begin Patch\n*** Add File: /tmp/evil.txt\n+x\n*** End Patch\n" } })).exit, 2,
   "Codex apply_patch equally gated on guarded turns (probed live: file edits arrive under this tool name)");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Read", tool_input: { file_path: "/etc/hosts" } })).exit, 0,
-  "reads stay free on guarded turns");
+  "ordinary reads stay free on guarded turns (protected roots: test-read-guard.js)");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "ls -la" } })).exit, 0,
   "benign Bash unaffected by the file gate (deny-gate rules unchanged)");
 
@@ -185,8 +187,11 @@ assert.strictEqual(guard.externalControlPlaneDenial(cpWrite), null, "no OC_CHANN
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: cpWrite } })).exit, 0,
   "owner-local shells keep full config access");
 process.exitCode = 0;
+delete process.env.OC_RUN_ATTEST; // hermetic even when the suite runs inside a live bot turn
 require("./bin/keyring").run(["path"]);
-assert.strictEqual(process.exitCode || 0, 0, "keyring CLI stays open owner-local (no channel env)");
+assert.strictEqual(process.exitCode, 1,
+  "keyring CLI is owner-only even with no channel env: no live owner run behind the process = unattributed (test-cli-owner-gates.js)");
+process.exitCode = 0;
 process.env.OC_CHANNEL_ADAPTER = "telegram";
 process.env.OC_CHANNEL_ID = "999000111";
 process.env.OC_CHANNEL_USER_ID = "999000111";
@@ -288,6 +293,10 @@ assert.strictEqual(pre[1].matcher, "^(Write|Edit|MultiEdit|NotebookEdit)$",
   "file-mutation tools are hooked for the external-speaker gate");
 assert.strictEqual(pre[1].hooks[0].command, pre[0].hooks[0].command,
   "file gate rides the same deny-gate-hook entry (one CLI, one audit path)");
+assert.strictEqual(pre[2].matcher, "^(Read|Grep|Glob|NotebookRead|LS)$",
+  "file-reading tools are hooked for the guarded read gate");
+assert.strictEqual(pre[2].hooks[0].command, pre[0].hooks[0].command,
+  "read gate rides the same deny-gate-hook entry");
 // second call with the file read-only: content-compare must skip the write
 fs.chmodSync(sPath, 0o444);
 assert.strictEqual(guard.ensureHookSettings(), sPath, "unchanged settings are not rewritten");

package/test-tool-manifest.js

@@ -8,7 +8,12 @@ const fs = require("fs");
 const os = require("os");
 const path = require("path");
 
+// The CLI asks the running bot who it acts for; never let this suite (which
+// may run inside a bot turn) reach that bot.
+for (const key of Object.keys(process.env)) if (key.startsWith("OC_")) delete process.env[key];
+
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "tool-manifest-test-"));
+process.env.OPEN_CLAUDIA_CONFIG_DIR = path.join(tmp, "config");
 process.env.TOOLS_DIR = path.join(tmp, "tools");
 process.env.KEYRING_FILE = path.join(tmp, "keyring.json");
 process.env.APPROVALS_DIR = path.join(tmp, "approvals");
@@ -142,6 +147,32 @@ const topLevelEnv = {};
     await toolCli.run(["run", "vaulted", "go", "--approval", b10rec.id]);
     assert.strictEqual(process.exitCode, 0, "the same token redeems once the key exists");
     assert.ok(approvals.read(b10rec.id).consumedAt, "token consumed exactly by the real run");
+
+    // ── an undeclared verb is refused at the CLI before anything else — even
+    // with an approved token for that exact command, which stays unconsumed
+    // (the smart-josephine `whatsapp chats` case used to reach the owner).
+    const chatsCmd = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "fleet", "chats"]);
+    const chatsRec = approvals.create({ tool: "fleet", tier: "write", command: chatsCmd, channelId: "c1", adapter: "tg" });
+    approvals.decide(chatsRec.id, "approved", "c1");
+    errs.length = 0;
+    process.exitCode = 0;
+    await toolCli.run(["run", "fleet", "chats", "--approval", chatsRec.id]);
+    assert.strictEqual(process.exitCode, 3, "undeclared verb refused (exit 3)");
+    assert.ok(errs.some((l) => /no declared verb "chats" — its manifest allows: list, restart, purge/.test(l)), "the refusal lists the declared verbs");
+    assert.strictEqual(approvals.read(chatsRec.id).consumedAt, undefined, "the token is never redeemed for an undeclared verb");
+
+    // ── a redeemed approval exports exactly the approved tier to the tool (a
+    // write approval no longer hands nested tools destructive access) ──
+    const tierSrc = path.join(tmp, "tiered.sh");
+    fs.writeFileSync(tierSrc, `#!/usr/bin/env bash\necho "$OPEN_CLAUDIA_APPROVED_TIER" > ${JSON.stringify(path.join(tmp, "tier.out"))}\n`);
+    tools.addTool(tierSrc, { name: "tiered", description: "reports its approved tier", risk: "write" });
+    const tierCmd = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "tiered", "go"]);
+    const tierRec = approvals.create({ tool: "tiered", tier: "write", command: tierCmd, channelId: "c1", adapter: "tg" });
+    approvals.decide(tierRec.id, "approved", "c1");
+    process.exitCode = 0;
+    await toolCli.run(["run", "tiered", "go", "--approval", tierRec.id]);
+    assert.strictEqual(process.exitCode, 0, "the write approval redeems");
+    assert.strictEqual(fs.readFileSync(path.join(tmp, "tier.out"), "utf-8").trim(), "write", "the run carries the approved tier, not destructive");
   } finally {
     for (const key of approvalKeys) {
       if (savedApprovalEnv[key] === undefined) delete process.env[key];