@inetafrica/open-claudia 3.4.24 → 3.5.1

package/core/handlers.js

@@ -1928,13 +1928,19 @@ register({
 
     const live = grants.list();
     if (live.length === 0) {
-      return send("No capability grants yet.\n\nA grant is what lets a non-owner act: it covers ONE person in ONE room, so trusting someone in one group never trusts them elsewhere. Make one from an approval card (\"Always — here\" / \"Always — everywhere\").");
+      return send("No capability grants yet.\n\nA grant is what lets a non-owner act: it covers ONE person in ONE room, so trusting someone in one group never trusts them elsewhere. Make one from an approval card (\"Always — here\" / \"Always — everywhere\"). Destructive actions always ask; they can't be granted.");
     }
     const lines = live.map((g) => {
       const where = g.room === grants.ALL_ROOMS ? "everywhere" : g.room;
       const until = g.expiresAt ? ` · until ${g.expiresAt.slice(0, 10)}` : "";
       const turns = g.turnsRemaining != null ? ` · ${g.turnsRemaining} turn(s) left` : "";
-      return `🔑 [${g.id}] ${g.principal.adapter}:${g.principal.channelId} → ${g.capability} in ${where}${until}${turns}`;
+      // Legacy records: a destructive grant confers act only (destructive
+      // always asks); one for an anonymous or unverifiable sender is ignored.
+      const capability = grants.effectiveCapability(g);
+      const legacy = grants.normalizeCapability(g.capability) !== capability ? ` (stored as ${g.capability}; destructive always asks)` : "";
+      const refusal = grants.principalRefusal({ adapter: g.principal.adapter, senderId: g.principal.channelId, room: g.room });
+      const ignored = refusal ? ` — ignored: ${refusal}` : "";
+      return `🔑 [${g.id}] ${g.principal.adapter}:${g.principal.channelId} → ${capability}${legacy} in ${where}${until}${turns}${ignored}`;
     });
     return send(`Capability grants (${live.length}):\n\n${lines.join("\n")}\n\n/grants revoke <id> · /grants revoke-all <adapter>:<senderId>\nFile: ${grants.GRANTS_FILE}`);
   },

package/core/loopback.js

@@ -81,7 +81,19 @@ function readBodyToFile(req, dest) {
 }
 
 const SEND_KINDS = new Set(["send-file", "send-voice", "send-photo"]);
+// Loopback kinds that CREATE a background job. Their creator identity is bound
+// to callerOf(payload) (run-attested), not to the payload's forgeable claims.
+const JOB_CREATE_KINDS = new Set(["schedule-wakeup", "cron-add", "watch-add"]);
+// Owner-only kinds gated centrally on the run-attested caller: notes and tasks
+// (private owner context) plus the people reads (the roster and records expose
+// everyone the owner knows). people mutations keep their own inline gate too.
+const OWNER_ONLY_KINDS = new Set([
+  "people-list", "people-show", "people-note",
+  "task-add", "task-plan", "task-update", "task-remove",
+  "task-list", "task-get", "task-tree", "task-clear-completed",
+]);
 const JSON_KINDS = new Set([
+  "whoami",
   "schedule-wakeup", "cron-add", "cron-remove", "job-list",
   "watch-add", "watch-list", "watch-remove", "watch-toggle",
   "task-add", "task-plan", "task-update", "task-remove", "task-list", "task-get", "task-tree", "task-clear-completed",
@@ -91,22 +103,46 @@ const JSON_KINDS = new Set([
   "relay-send", "recent-fetch", "audit-tail",
   "auth-list", "auth-revoke",
   "approval-request",
+  "tool-gate",
   "say", "call-say", "call", "tts", "transcribe",
 ]);
 
-// Owner gate for identity-sensitive kinds. The claimed canonicalUserId comes
-// from the CLI's env, which the agent's shell can rewrite — so the claim only
-// counts when it carries the runner-minted attestation (an HMAC over the id
-// with a per-boot, memory-only secret; see core/speaker-attest). No attest,
-// a wrong attest, or an attest for a different id all fail closed: forging
-// `OC_CANONICAL_USER_ID=<owner-id>` from a guarded external turn no longer
-// reaches the people/auth/intros mutations the relationship guard depends on.
+// Who is calling, decided by the bot: the principal of a LIVE run whose
+// OC_RUN_ATTEST matches (see core/speaker-attest), else UNATTRIBUTED. Nothing
+// the caller's env claims (OC_CHANNEL_*, OC_CANONICAL_USER_ID) is consulted,
+// and unattributed never carries owner powers.
+function callerOf(payload) {
+  const principal = speakerAttest.verifyRun(payload?.originRunId || payload?.runId, payload?.runAttest);
+  if (principal) {
+    const { registeredAt, ...caller } = principal;
+    return { attributed: true, ...caller };
+  }
+  return { attributed: false, owner: false, guarded: true, kind: "unattributed" };
+}
+
+// A durable, run-attested record of who created a job, stamped alongside its
+// identity fields. Distinguishes a job created since this fix (has createdBy)
+// from a legacy job on disk (no createdBy) — the scheduler runs the latter as
+// before, but logs it. Never trusted for authorization; the fire path
+// re-resolves the speaker from the job's channel/user via runPrincipal.
+function jobCreatorRecord(creator) {
+  return {
+    canonicalUserId: creator.canonicalUserId || null,
+    userId: creator.userId || null,
+    channelId: creator.channelId || null,
+    adapterType: creator.adapterType || null,
+    owner: creator.owner === true,
+    name: creator.name || null,
+    at: new Date().toISOString(),
+  };
+}
+
+// Owner gate for every owner-only kind: true only for a LIVE run the bot
+// registered as acting for the owner. The id attest (OC_SPEAKER_ATTEST) is no
+// longer enough: it is valid for the whole boot and can be lifted from another
+// process's environment. Identity fields in the payload are never consulted.
 function callerIsOwner(payload) {
-  const caller = payload?.canonicalUserId;
-  if (!caller) return false;
-  if (!speakerAttest.verify(caller, payload?.speakerAttest)) return false;
-  const person = peopleStore.findByCanonicalUserId(caller);
-  return !!(person && person.isOwner);
+  return callerOf(payload).owner === true;
 }
 
 function readBodyAsString(req, max = 64 * 1024) {
@@ -172,6 +208,11 @@ async function handleJson(req, res, url, kind) {
     try { payload = JSON.parse(body); }
     catch (e) { return reply(res, 400, { error: "invalid JSON body" }); }
   }
+  // "Who am I?" needs no chat context: an unattributed caller (a process that
+  // outlived its turn, a stripped env) must still get a definite answer.
+  if (kind === "whoami") return reply(res, 200, { ok: true, caller: callerOf(payload) });
+  // Decided from the verified run alone, so it needs no chat fields either.
+  if (kind === "tool-gate") return handleToolGate(res, payload);
   const channelId = String(payload.channelId || url.searchParams.get("channelId") || "");
   const userId = String(payload.userId || url.searchParams.get("userId") || "");
   const adapterId = String(payload.adapter || url.searchParams.get("adapter") || "");
@@ -179,6 +220,40 @@ async function handleJson(req, res, url, kind) {
   const adapter = registry.findAdapter(adapterId);
   if (!adapter) return reply(res, 400, { error: `unknown adapter ${adapterId}` });
 
+  // A background job belongs to WHOEVER the bot says is running the turn that
+  // created it (callerOf, run-bound) and to THAT person's room — never to the
+  // identity the payload claims (OC_CHANNEL_*/OC_CANONICAL_USER_ID, which the
+  // run's own shell can rewrite) and never to the bot's ambient owner state.
+  // So a follow-up a staff turn schedules fires AS that staff member, in their
+  // room, and all of their guards apply when it runs. An unattributed caller
+  // (a process detached from any live turn) cannot schedule anything.
+  let jobCreator = null;
+  if (JOB_CREATE_KINDS.has(kind)) {
+    const caller = callerOf(payload);
+    if (!caller.attributed) {
+      return reply(res, 403, { error: "background jobs can only be scheduled by an attributed run (no live turn is speaking for this process)" });
+    }
+    const creatorAdapter = caller.adapterId ? registry.findAdapter(caller.adapterId) : null;
+    jobCreator = {
+      canonicalUserId: caller.canonicalUserId || null,
+      userId: caller.userId || null,
+      channelId: caller.channelId || channelId,
+      adapter: (creatorAdapter && creatorAdapter.id) || caller.adapterId || adapterId,
+      adapterType: (creatorAdapter && creatorAdapter.type) || caller.adapterType || adapter.type,
+      owner: caller.owner === true,
+      name: caller.name || null,
+    };
+  }
+
+  // Owner-only kinds: notes, tasks, and the people reads. Tasks and people
+  // notes carry private owner context (plans, contact notes), and the people
+  // roster/record reads expose everyone the owner knows — none of it may be
+  // read or written on a non-owner (or unattributed) turn. Gated on the
+  // run-attested caller, never on payload claims.
+  if (OWNER_ONLY_KINDS.has(kind) && !callerIsOwner(payload)) {
+    return reply(res, 403, { error: "owner only" });
+  }
+
   if (kind === "call-say") {
     try {
       const result = await require("./call-speech").speak({ ...payload, channelId, userId, adapter: adapterId });
@@ -285,11 +360,12 @@ async function handleJson(req, res, url, kind) {
     if (!payload.prompt) return reply(res, 400, { error: "missing prompt" });
     const job = scheduler.addJob({
       kind: "wakeup",
-      adapter: adapterId,
-      adapterType: adapter.type,
-      channelId,
-      canonicalUserId: payload.canonicalUserId || null,
-      userId: payload.userId || null,
+      adapter: jobCreator.adapter,
+      adapterType: jobCreator.adapterType,
+      channelId: jobCreator.channelId,
+      canonicalUserId: jobCreator.canonicalUserId,
+      userId: jobCreator.userId,
+      createdBy: jobCreatorRecord(jobCreator),
       provider: payload.provider || null,
       providerSettings: payload.providerSettings || {},
       project: payload.project || null,
@@ -315,11 +391,12 @@ async function handleJson(req, res, url, kind) {
     if (!payload.schedule || !payload.prompt) return reply(res, 400, { error: "missing schedule/prompt" });
     const job = scheduler.addJob({
       kind: "cron",
-      adapter: adapterId,
-      adapterType: adapter.type,
-      channelId,
-      canonicalUserId: payload.canonicalUserId || null,
-      userId: payload.userId || null,
+      adapter: jobCreator.adapter,
+      adapterType: jobCreator.adapterType,
+      channelId: jobCreator.channelId,
+      canonicalUserId: jobCreator.canonicalUserId,
+      userId: jobCreator.userId,
+      createdBy: jobCreatorRecord(jobCreator),
       provider: payload.provider || null,
       providerSettings: payload.providerSettings || {},
       project: payload.project || null,
@@ -362,11 +439,12 @@ async function handleJson(req, res, url, kind) {
   if (kind === "watch-add") {
     if (!payload.check || !payload.prompt) return reply(res, 400, { error: "missing check/prompt" });
     const job = scheduler.addWatch({
-      adapter: adapterId,
-      adapterType: adapter.type,
-      channelId,
-      canonicalUserId: payload.canonicalUserId || null,
-      userId: payload.userId || null,
+      adapter: jobCreator.adapter,
+      adapterType: jobCreator.adapterType,
+      channelId: jobCreator.channelId,
+      canonicalUserId: jobCreator.canonicalUserId,
+      userId: jobCreator.userId,
+      createdBy: jobCreatorRecord(jobCreator),
       provider: payload.provider || null,
       providerSettings: payload.providerSettings || {},
       project: payload.project || null,
@@ -631,13 +709,13 @@ async function handleJson(req, res, url, kind) {
 
   if (kind === "relay-send") {
     if (!payload.text) return reply(res, 400, { error: "missing text" });
-    // A guarded (external) requester may pass a message TO THE OWNER — that is
-    // the "tell them for me" flow — but never use the bot as a relay to third
+    // A non-owner requester may pass a message TO THE OWNER — that is the
+    // "tell them for me" flow — but never use the bot as a relay to third
     // parties: sending as the bot to anyone else is impersonation surface.
-    try {
-      const relationship = require("./relationship");
-      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
-      if (relationship.guardActive(speaker)) {
+    // Who is requesting is the run-attested caller, not the payload's claims.
+    {
+      const requester = callerOf(payload);
+      if (!requester.owner) {
         const target =
           (payload.targetPersonId && peopleStore.findById(payload.targetPersonId)) ||
           (payload.targetPersonName && peopleStore.findByName(payload.targetPersonName)) ||
@@ -648,7 +726,7 @@ async function handleJson(req, res, url, kind) {
           return reply(res, 403, { error: "relay from an external contact can only go to the owner — messages to anyone else are owner-only" });
         }
       }
-    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
+    }
     try {
       const result = await relay.send({
         text: payload.text,
@@ -667,29 +745,36 @@ async function handleJson(req, res, url, kind) {
   }
 
   if (kind === "recent-fetch") {
-    // Transcript reads are owner-side memory. A guarded (external, non-owner)
-    // requester must not pull other channels' conversations through the CLI —
-    // same default-deny as file/voice egress, same fail direction.
-    try {
-      const relationship = require("./relationship");
-      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
-      if (relationship.guardActive(speaker)) {
-        return reply(res, 403, { error: "transcript access is owner-only — an external contact cannot read other conversations" });
-      }
-    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
+    // Transcript reads are owner-side memory. The owner may pull any channel or
+    // person; a non-owner caller is confined to THEIR OWN room and may never
+    // point this at another conversation or an owner DM. Who is calling is the
+    // run-attested principal, not the payload's forgeable channel/user claims.
+    const caller = callerOf(payload);
     const limit = Math.max(1, Math.min(parseInt(payload.limit || 20, 10) || 20, 200));
     try {
-      let targetAdapter = payload.adapter;
-      let targetChannel = payload.channelId;
-      if (payload.personName || payload.personId) {
-        const person = peopleStore.findById(payload.personId || "") || peopleStore.findByName(payload.personName || "");
-        if (!person) return reply(res, 404, { error: "person not found" });
-        const handle = person.primaryChannel
-          ? (person.handles || []).find((h) => h.adapter === person.primaryChannel.adapter && String(h.channelId) === String(person.primaryChannel.channelId))
-          : (person.handles || [])[0];
-        if (!handle) return reply(res, 404, { error: "person has no handles" });
-        targetAdapter = handle.adapter;
-        targetChannel = handle.channelId;
+      let targetAdapter;
+      let targetChannel;
+      if (caller.owner) {
+        targetAdapter = payload.adapter;
+        targetChannel = payload.channelId;
+        if (payload.personName || payload.personId) {
+          const person = peopleStore.findById(payload.personId || "") || peopleStore.findByName(payload.personName || "");
+          if (!person) return reply(res, 404, { error: "person not found" });
+          const handle = person.primaryChannel
+            ? (person.handles || []).find((h) => h.adapter === person.primaryChannel.adapter && String(h.channelId) === String(person.primaryChannel.channelId))
+            : (person.handles || [])[0];
+          if (!handle) return reply(res, 404, { error: "person has no handles" });
+          targetAdapter = handle.adapter;
+          targetChannel = handle.channelId;
+        }
+      } else {
+        // Non-owner: ignore every target selector and pin to the caller's own
+        // room. Unattributed (no live turn) has no room → refuse.
+        if (!caller.attributed || !caller.adapterType || !caller.channelId) {
+          return reply(res, 403, { error: "transcript access outside your own room is owner-only" });
+        }
+        targetAdapter = caller.adapterType;
+        targetChannel = caller.channelId;
       }
       if (!targetAdapter || !targetChannel) return reply(res, 400, { error: "need adapter+channelId or person" });
       const entries = readRecentTranscript(targetAdapter, targetChannel, limit);
@@ -712,15 +797,13 @@ async function handleJson(req, res, url, kind) {
       // Safety net: this path posts an Approve/Deny for a destructive command to
       // the REQUESTING channel. That must only ever be the owner — external
       // mutating runs are routed to the owner via the enforcer BEFORE reaching a
-      // tool subprocess's chat-approval fallback. If the requester resolves to a
-      // non-owner, refuse: never hand an external the approve button (R8/R10).
-      try {
-        const relationship = require("./relationship");
-        const speaker = relationship.speakerFor(adapter.type, channelId, userId);
-        if (relationship.guardActive(speaker)) {
-          return reply(res, 403, { error: "approval requests are owner-only; external mutating runs escalate through the guardrail" });
-        }
-      } catch (e) { /* if classification fails, fall through — approvals stay owner-scoped by the apr: handler's isChatOwner gate */ }
+      // tool subprocess's chat-approval fallback. The requester is the
+      // run-attested caller (not the payload's forgeable claims); a non-owner
+      // (or unattributed) requester is refused — never hand an external the
+      // approve button (R8/R10).
+      if (!callerOf(payload).owner) {
+        return reply(res, 403, { error: "approval requests are owner-only; external mutating runs escalate through the guardrail" });
+      }
       const approvals = require("./approvals");
       // Spaces-origin runs: Spaces has no inline-button UI and its thread can be
       // watched by non-owners, so the BINDING Approve/Deny goes to the owner's
@@ -812,10 +895,15 @@ function readRecentTranscript(adapter, channelId, limit) {
       for (const line of lines) {
         try {
           const obj = JSON.parse(line);
-          const objAdapter = (obj.adapter || obj.adapterType || "").toLowerCase();
-          const objChannel = String(obj.channelId || "");
-          if (objAdapter && objAdapter !== adapterPrefix) continue;
-          if (objChannel && objChannel !== channelStr) continue;
+          // Project transcripts store the surface under obj.chat ({transport,id}),
+          // not top-level adapter/channelId — the old filter read the latter,
+          // found undefined, and so never actually scoped to the requested
+          // channel (every entry from every file leaked through). Read chat.*
+          // (with a legacy fallback) and REQUIRE a match on both.
+          const objAdapter = String(obj.chat?.transport || obj.adapter || obj.adapterType || "").toLowerCase();
+          const objChannel = String(obj.chat?.id ?? obj.channelId ?? "");
+          if (objAdapter !== adapterPrefix) continue;
+          if (objChannel !== channelStr) continue;
           out.push({
             at: obj.at || obj.timestamp || null,
             role: obj.role || obj.author || null,
@@ -830,6 +918,73 @@ function readRecentTranscript(adapter, channelId, limit) {
   } catch (e) { return []; }
 }
 
+// ── tool-gate: a guarded run's write/destructive tool run, decided HERE ─────
+// `open-claudia tool run` used to pick the speaker from its own env
+// (OC_CHANNEL_*) and to vet + escalate in its own process. A staff turn's CLI
+// has neither the AI credentials (scrubbed from a non-owner run) nor the chat
+// adapters, so its escalations never reached an owner. Now the CLI asks the
+// bot: the caller is the verified live run (callerOf — identity fields in the
+// payload are never read), the speaker is rebuilt from that principal, the
+// mandate vet runs with the bot's credentials, and an escalation posts its card
+// through the bot's own adapters. The CLI treats every answer but allow/held
+// as blocked (fail closed).
+async function handleToolGate(res, body) {
+  const payload = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+  const caller = callerOf(payload);
+  const text = (value) => (value == null ? "" : String(value));
+  const tool = text(payload.tool) || null;
+  const blocked = (reason, extra = {}) => {
+    try { audit.log("tool.gate", { decision: "blocked", tool, runId: caller.runId || null, reason: String(reason).slice(0, 160) }); } catch (_) {}
+    return reply(res, 200, { ok: true, decision: "blocked", reason, ...extra });
+  };
+  if (!caller.attributed) return blocked("not attributed to a live chat turn");
+  if (!caller.guarded) return blocked("not a guarded run — the owner's runs are gated by the tool runner itself");
+  const command = typeof payload.command === "string" ? payload.command : "";
+  const tier = text(payload.tier);
+  if (!command.trim()) return reply(res, 400, { error: "missing command" });
+  if (tier !== "write" && tier !== "destructive") return reply(res, 400, { error: "tier must be write or destructive" });
+
+  const relationship = require("./relationship");
+  let speaker = null;
+  try { speaker = relationship.speakerFor(caller.adapterType, caller.channelId, caller.userId); }
+  catch (e) { speaker = null; }
+  if (!speaker || !relationship.guardActive(speaker)) return blocked("the run's speaker could not be resolved — failing closed");
+  const name = speaker.name || caller.name || "";
+
+  const enforcer = require("./enforcer");
+  let vet;
+  try { vet = await enforcer.vetAction(speaker, { command, tier }); }
+  catch (e) { vet = { decision: "escalate", reason: "vet error — failing closed" }; }
+  if (vet && vet.decision === "allow") {
+    try { audit.log("tool.gate", { decision: "allow", tier, tool, runId: caller.runId, person: name || null }); } catch (_) {}
+    return reply(res, 200, { ok: true, decision: "allow", approvedVia: "mandate", name });
+  }
+  const providerSettings = payload.providerSettings && typeof payload.providerSettings === "object" && !Array.isArray(payload.providerSettings)
+    ? payload.providerSettings : {};
+  let esc;
+  try {
+    esc = await enforcer.escalate({
+      speaker, kind: "action", command, tier, reason: vet && vet.reason,
+      // WHO the approval is for comes from the verified run; the rest only
+      // pins where an approved re-run resumes (provider/project/session).
+      canonicalUserId: caller.canonicalUserId || "",
+      userId: caller.userId || "",
+      provider: text(payload.provider),
+      providerSettings,
+      project: text(payload.project),
+      projectDir: text(payload.projectDir),
+      sessionId: text(payload.sessionId),
+      previousSessionId: text(payload.previousSessionId),
+      originRunId: caller.runId || "",
+    });
+  } catch (e) { esc = { escalated: false, reason: e.message }; }
+  if (esc && esc.escalated && esc.id) {
+    try { audit.log("tool.gate", { decision: "held", tier, tool, runId: caller.runId, person: name || null, approvalId: esc.id }); } catch (_) {}
+    return reply(res, 200, { ok: true, decision: "held", approvalId: esc.id, name });
+  }
+  return blocked(`the owner could not be reached to approve (${(esc && esc.reason) || "escalation failed"})`, { unreachable: true, name });
+}
+
 async function handle(req, res) {
   try {
     if (req.method !== "POST") return reply(res, 405, { error: "method not allowed" });
@@ -867,4 +1022,4 @@ function stop() {
 
 process.on("exit", deleteInfo);
 
-module.exports = { start, stop, info, INFO_DIR, INFO_FILE };
+module.exports = { start, stop, info, callerOf, INFO_DIR, INFO_FILE };

package/core/providers/claude-hook.js

@@ -31,6 +31,11 @@ function buildClaudeHookSettings(options = {}) {
         // blocks provider file-mutation tools (see tool-guard.js
         // externalFileMutationDenial). Owner/no-context turns pass through.
         { matcher: "^(Write|Edit|MultiEdit|NotebookEdit)$", hooks: [hook] },
+        // Guarded-speaker read gate: on external turns reads and searches that
+        // reach the bot's own state or credential stores are denied (see
+        // tool-guard.js evaluateGuardedRead). NotebookRead and LS exist only
+        // on older Claude Code builds. Owner/no-context turns pass through.
+        { matcher: "^(Read|Grep|Glob|NotebookRead|LS)$", hooks: [hook] },
       ],
     },
   };

package/core/runner.js

@@ -1771,6 +1771,36 @@ async function deliverForegroundResult(result, runContext, state = currentState(
   return { ok: true, chunks: chunks.length };
 }
 
+// The principal a run acts for. With no chat origin at all (bot-internal work)
+// that is the owner. With a chat origin it is the speaker the relationship
+// layer resolves from the inbound envelope — also for a compaction stage, which
+// summarises that speaker's conversation; if the speaker cannot be resolved,
+// or the origin names someone but not the transport and room it came from, the
+// run is treated as a non-owner (fail closed).
+const ORIGIN_FIELDS = Object.freeze(["adapterId", "transport", "channelId", "userId", "canonicalUserId"]);
+function runPrincipal(runContext) {
+  const origin = runContext.origin || {};
+  const channelId = runContext.channelId != null ? String(runContext.channelId) : origin.channelId;
+  const base = {
+    kind: "turn",
+    purpose: runContext.purpose || null,
+    canonicalUserId: runContext.canonicalUserId || origin.canonicalUserId || null,
+    adapterId: origin.adapterId || null,
+    adapterType: origin.transport || null,
+    channelId: channelId || null,
+    userId: origin.userId || null,
+  };
+  if (!base.adapterType || !base.channelId) {
+    const partial = ORIGIN_FIELDS.some((key) => origin[key] != null && origin[key] !== "");
+    return { ...base, owner: !partial };
+  }
+  let speaker = null;
+  try { speaker = require("./relationship").speakerFor(base.adapterType, base.channelId, base.userId); }
+  catch (error) { speaker = null; }
+  if (!speaker) return { ...base, owner: false };
+  return { ...base, owner: speaker.isOwner === true, name: speaker.name || null, room: speaker.room || null };
+}
+
 function decorateForegroundInvocation(invocation, runContext, bundle) {
   const env = { ...invocation.env };
   delete env.OC_CALL_SPEECH_TOKEN;
@@ -1792,6 +1822,22 @@ function decorateForegroundInvocation(invocation, runContext, bundle) {
   }
   env.OC_PROVIDER = runContext.provider;
   env.OC_RUN_ID = runContext.runId;
+  // Run attestation: who this run acts for is decided HERE, in the bot
+  // process, from the inbound origin — never from anything the run's own
+  // shell can change. CLIs ask the loopback "who is this?" with
+  // OC_RUN_ID + OC_RUN_ATTEST; the registration ends with the run (cleanup),
+  // so a process that outlives its turn is unattributed.
+  const principal = runPrincipal(runContext);
+  env.OC_RUN_ATTEST = require("./speaker-attest").registerRun(runContext.runId, principal);
+  // A non-owner's turn never sees the AI service credentials: Claude Code
+  // strips its own auth variables from every subprocess it starts (shell,
+  // hooks) when this is set. The agent process itself keeps them.
+  if (principal.owner !== true) {
+    env.CLAUDE_CODE_SUBPROCESS_ENV_SCRUB = "1";
+    // Read by the permission hook (which inherits the agent's env, not the
+    // agent's shell's) so a guard that cannot load fails closed on this run.
+    env.OC_GUARDED_RUN = "1";
+  } else delete env.OC_GUARDED_RUN;
   if (runContext.project?.name) env.OC_PROJECT = String(runContext.project.name);
   if (runContext.project?.dir) env.OC_PROJECT_DIR = String(runContext.project.dir);
   if (runContext.sessionId) env.OC_SESSION_ID = String(runContext.sessionId);
@@ -2036,6 +2082,9 @@ function createForegroundService({ state, store, stopTyping, capture, ownsAdmiss
     },
     onStderr(chunk) { console.error("PROVIDER STDERR:", redactSensitive(chunk)); },
     cleanup: async (proc, _details, runContext) => {
+      // The run is over: its attest stops speaking for anyone, so a process
+      // it left behind is unattributed from here on.
+      try { require("./speaker-attest").endRun(runContext.runId); } catch (_) {}
       callSpeechLeases.get(runContext.runId)?.close();
       callSpeechLeases.delete(runContext.runId);
       if (state.runningProcess === proc) state.runningProcess = null;
@@ -2422,6 +2471,7 @@ module.exports = {
   streamPreviewAllowed,
   capturedTranscriptMetadata,
   decorateForegroundInvocation,
+  runPrincipal,
   createRunnerService,
   createForegroundService,
   createSideChatService,