@inetafrica/open-claudia 3.4.24 → 3.5.1

package/core/scheduler.js

@@ -73,6 +73,74 @@ function uniqueId(prefix = "occ") {
     : `${prefix}-${Date.now()}-${crypto.randomBytes(6).toString("hex")}`;
 }
 
+// ── watch-check environment ────────────────────────────────────────────────
+// A watch's `check` runs a shell command in the bot's process tree. Whose
+// environment it gets depends on who set the watch:
+//   • a staff member's check gets an ALLOWLIST — the shell essentials and the
+//     Open Claudia config dir, nothing else — plus OC_GUARDED_RUN=1 so hooks
+//     and CLIs below it know they run for a non-owner. A denylist was not
+//     enough: any credential whose name matched no pattern (DATABASE_URL,
+//     MONGO_URI, …) reached a staff check (Phase 0 review, MEDIUM);
+//   • the owner's check keeps the bot's environment as it always had, so an
+//     owner watch that reads a credential from env keeps working.
+// Either way a short-lived, creator-scoped run is stamped on top (below) so
+// the check's reusable tools attribute to whoever created the watch.
+const WATCH_CHECK_ENV_KEEP = new Set([
+  "PATH", "HOME", "USER", "LOGNAME", "SHELL",
+  "LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "TZ",
+  "TERM", "COLORTERM", "NO_COLOR", "FORCE_COLOR",
+  "TMPDIR", "TMP", "TEMP",
+  "OPEN_CLAUDIA_CONFIG_DIR",
+  "SystemRoot", "ComSpec", "PATHEXT", "WINDIR",
+]);
+function buildWatchCheckEnv(source, stamp = {}, { owner = false } = {}) {
+  const env = {};
+  for (const [key, value] of Object.entries(source || {})) {
+    if (value == null) continue;
+    if (!owner && !WATCH_CHECK_ENV_KEEP.has(key)) continue;
+    env[key] = String(value);
+  }
+  for (const [key, value] of Object.entries(stamp)) {
+    if (value == null || value === "") continue;
+    env[key] = String(value);
+  }
+  if (owner) delete env.OC_GUARDED_RUN;
+  else env.OC_GUARDED_RUN = "1";
+  return env;
+}
+
+// The principal a watch-check's short-lived run acts for: the job's creator,
+// resolved from its stored channel/user the same way runPrincipal resolves a
+// turn's speaker. Owner → the check attributes as the owner (unchanged); a
+// staff creator → the check runs at their level. Fail closed to non-owner.
+function watchCheckPrincipal(job) {
+  const adapterType = job && job.adapterType ? String(job.adapterType) : null;
+  const channelId = job && job.channelId != null ? String(job.channelId) : null;
+  const userId = job && job.userId != null ? String(job.userId) : null;
+  let owner = false;
+  let name = null;
+  let room = null;
+  if (adapterType && channelId) {
+    try {
+      const sp = require("./relationship").speakerFor(adapterType, channelId, userId);
+      owner = !!(sp && sp.isOwner === true);
+      name = (sp && sp.name) || null;
+      room = (sp && sp.room) || null;
+    } catch (_) { owner = false; }
+  }
+  return {
+    kind: "watch-check",
+    owner,
+    canonicalUserId: job && job.canonicalUserId ? String(job.canonicalUserId) : null,
+    name,
+    adapterId: job && job.adapter ? String(job.adapter) : null,
+    adapterType,
+    channelId,
+    userId,
+    room,
+  };
+}
+
 function parseFallbacks(value) {
   if (Array.isArray(value)) return [...new Set(value.map((item) => String(item).trim().toLowerCase()).filter(Boolean))];
   return [...new Set(String(value || "").split(",").map((item) => item.trim().toLowerCase()).filter(Boolean))];
@@ -155,23 +223,50 @@ function createSchedulerService(dependencies = {}) {
   const timers = new Map();
   const checksInFlight = new Set();
   const firesInFlight = new Set();
+  // Jobs already on disk before the creator-binding fix carry no `createdBy`.
+  // We keep running them AS THEY ARE (their stored channel/user is what the
+  // fire path resolves the speaker from — the owner's own watches and wakeups
+  // must not silently break), but log the first time each fires so an audit
+  // can spot a pre-fix job that outranks a non-owner. Logged once per id/boot.
+  const loggedLegacyCreators = new Set();
+  function noteLegacyCreatorOnce(job) {
+    if (!job || job.createdBy || loggedLegacyCreators.has(job.id)) return;
+    loggedLegacyCreators.add(job.id);
+    try {
+      console.warn(`[scheduler] job ${job.id} (${job.kind}${job.check ? "/watch" : ""}) predates creator binding — running with its stored identity ${job.canonicalUserId || "?"} in ${job.adapterType || "?"}:${job.channelId || "?"}`);
+    } catch (_) { /* logging is best-effort */ }
+  }
   // Poll a watch's `check`: exit 0 → the watched condition is met, wake the
   // agent; non-zero → still idle, skip silently. Runs in the job's project
-  // dir with the process env, output discarded (exit code is the contract),
+  // dir with its creator's env (buildWatchCheckEnv: an allowlist for staff)
+  // and a short-lived run is registered for the job's creator so reusable
+  // tools attribute correctly — output discarded (exit code is the contract),
   // hard-capped by WATCH_CHECK_TIMEOUT_MS. Injectable so tests stay hermetic.
   const runWatchCheck = dependencies.runWatchCheck || ((command, job) => new Promise((resolve) => {
     const cwd = (job && projectDescriptor(job).dir) || workspace || process.cwd();
+    const attest = require("./speaker-attest");
+    const checkRunId = uniqueId("watch-check");
+    const principal = watchCheckPrincipal(job);
+    let runAttest = "";
+    try { runAttest = attest.registerRun(checkRunId, principal); } catch (_) { runAttest = ""; }
+    let lb = null;
+    try { lb = require("./loopback").info(); } catch (_) { lb = null; }
+    const stamp = { OC_RUN_ID: checkRunId, OC_RUN_ATTEST: runAttest };
+    if (lb && lb.url) { stamp.OC_SEND_URL = lb.url; stamp.OC_SEND_TOKEN = lb.token; }
+    const env = buildWatchCheckEnv(process.env, stamp, { owner: principal.owner === true });
     let settled = false;
     const finish = (code, timedOut) => {
       if (settled) return;
       settled = true;
       try { clearTimer(timer); } catch (_) {}
+      try { attest.endRun(checkRunId); } catch (_) {}
       resolve({ code, timedOut: !!timedOut });
     };
     let child;
     try {
-      child = spawn("sh", ["-c", String(command)], { cwd, env: process.env, stdio: "ignore" });
+      child = spawn("sh", ["-c", String(command)], { cwd, env, stdio: "ignore" });
     } catch (error) {
+      try { attest.endRun(checkRunId); } catch (_) {}
       return resolve({ code: 127, timedOut: false });
     }
     const timer = setTimer(() => { try { child.kill("SIGKILL"); } catch (_) {} finish(124, true); }, WATCH_CHECK_TIMEOUT_MS);
@@ -624,6 +719,7 @@ function createSchedulerService(dependencies = {}) {
     };
 
     return runInChat(chat, async () => {
+      noteLegacyCreatorOnce(job);
       const state = stateForUser(canonicalUserId);
       if (state.runningProcess || state.preparingRun || state.isCompacting) {
         try { return markBusy(job); }
@@ -974,6 +1070,8 @@ module.exports = {
   createSchedulerService,
   parseFallbacks,
   terminalRunSucceeded,
+  buildWatchCheckEnv,
+  watchCheckPrincipal,
   setAdapters,
   initScheduler,
   scheduleJob: service.scheduleJob,

package/core/speaker-attest.js

@@ -53,4 +53,85 @@ function verify(canonicalUserId, attest) {
   try { return crypto.timingSafeEqual(a, b); } catch (e) { return false; }
 }
 
-module.exports = { mint, verify };
+// ── Run attestation ─────────────────────────────────────────────────────────
+// The id attest above says "the runner stamped this canonical id". It is not
+// bound to a run: a copy lifted from another process's environment stays valid
+// for the whole boot. And the CLIs that decided the speaker locally (tool,
+// keyring, entity) read OC_CHANNEL_* from their own env, so a shell that
+// simply unset or rewrote those variables was treated as the owner.
+//
+// A run attestation binds a LIVE run to the principal it acts for, decided in
+// the bot process: the runner registers every agent run it spawns
+// (runId -> principal) and stamps OC_RUN_ID + OC_RUN_ATTEST into the run's
+// env; the loopback answers "who is this?" only for a registered, still-live
+// run whose attest matches. Anything else (no attest, a wrong one, a run that
+// has ended, a detached process that outlived its turn) is UNATTRIBUTED, and
+// unattributed never carries owner powers.
+const RUN_TTL_MS = 12 * 60 * 60 * 1000;
+const runs = new Map();
+
+function runSignature(runId) {
+  return crypto.createHmac("sha256", secret()).update(`run\0${runId}`).digest("hex");
+}
+
+function principalOf(principal = {}) {
+  // Bot-internal work with no speaker (compaction, owner jobs) acts for the
+  // owner; a run is guarded exactly when it acts for someone who is not.
+  const owner = principal.owner === true;
+  const text = (value) => (value == null || value === "" ? null : String(value));
+  return {
+    kind: text(principal.kind) || "turn",
+    owner,
+    guarded: !owner,
+    canonicalUserId: text(principal.canonicalUserId),
+    name: text(principal.name),
+    adapterId: text(principal.adapterId),
+    adapterType: text(principal.adapterType),
+    channelId: text(principal.channelId),
+    userId: text(principal.userId),
+    room: text(principal.room),
+    purpose: text(principal.purpose),
+  };
+}
+
+function pruneRuns(now = Date.now()) {
+  for (const [id, record] of runs) {
+    if (now - record.registeredAt > RUN_TTL_MS) runs.delete(id);
+  }
+}
+
+// Returns the attest to stamp as OC_RUN_ATTEST. Re-registering a run (a retry
+// of the same runId) replaces its principal.
+function registerRun(runId, principal = {}) {
+  const id = String(runId || "");
+  if (!id) return "";
+  pruneRuns();
+  runs.set(id, { ...principalOf(principal), runId: id, registeredAt: Date.now() });
+  return runSignature(id);
+}
+
+function endRun(runId) {
+  runs.delete(String(runId || ""));
+}
+
+// The principal of a live run whose attest matches, or null (fail closed).
+function verifyRun(runId, attest) {
+  const id = String(runId || "");
+  const sig = String(attest || "");
+  if (!id || !sig) return null;
+  const record = runs.get(id);
+  if (!record) return null;
+  if (Date.now() - record.registeredAt > RUN_TTL_MS) { runs.delete(id); return null; }
+  const a = Buffer.from(sig, "utf-8");
+  const b = Buffer.from(runSignature(id), "utf-8");
+  if (a.length !== b.length) return null;
+  try { if (!crypto.timingSafeEqual(a, b)) return null; } catch (e) { return null; }
+  return { ...record };
+}
+
+function liveRuns() {
+  pruneRuns();
+  return Array.from(runs.values(), (record) => ({ ...record }));
+}
+
+module.exports = { mint, verify, registerRun, endRun, verifyRun, liveRuns, principalOf };