@inetafrica/open-claudia 3.4.24 → 3.5.1

package/test-approval-cards.js

@@ -176,6 +176,46 @@ const lastSend = () => sends[sends.length - 1]?.text || "";
   assert.ok(rows.includes(`grl:${ruled.id}:channel`), "channel scope offered");
   assert.ok(rows.includes(`grl:${ruled.id}:global`), "global scope offered");
 
+  // ── grn: standing grants from a card ("Always — here / everywhere") ──
+  const grants = require("./core/grants");
+  const pair = { speakerId: "user-lucy", room: "kazee:ext-channel" };
+
+  // Destructive is never standing: the tap is refused and nothing is written.
+  const destructive = approvals.create({ ...base, ...pair, kind: "action", tier: "destructive", command: "open-claudia tool run infra delete-vm vm-1" });
+  await handleAction(envelopeFor(`grn:${destructive.id}:all`));
+  assert.ok(/^Destructive actions always ask; no standing permission/.test(lastSend()), "owner is told destructive always asks");
+  await handleAction(envelopeFor(`grn:${destructive.id}:room`));
+  assert.ok(/^Destructive actions always ask/.test(lastSend()));
+  assert.strictEqual(grants.list().length, 0, "no grant written from a destructive card");
+
+  // Anonymous or unverifiable principals are refused at the button.
+  const anon = approvals.create({
+    ...base, adapter: "telegram", targetAdapter: "telegram", channelId: "-100555", targetChannel: "-100555",
+    kind: "action", tier: "write", command: "open-claudia tool run kticket create",
+    speakerId: "1087968824", room: "telegram:-100555",
+  });
+  await handleAction(envelopeFor(`grn:${anon.id}:room`));
+  assert.ok(/^No standing permission for an anonymous group admin.*Use Approve once/.test(lastSend()), "anonymous admin refused at the button");
+  const roomAsSender = approvals.create({ ...base, kind: "reply", tier: "reply", payloadText: "Hi.", speakerId: "ext-channel", room: "kazee:ext-channel" });
+  await handleAction(envelopeFor(`grn:${roomAsSender.id}:all`));
+  assert.ok(/^No standing permission for the room itself/.test(lastSend()), "a sender that is really the room is refused");
+  assert.strictEqual(grants.list().length, 0, "no grant written for an unverifiable principal");
+
+  // Only an owner can grant.
+  const write = approvals.create({ ...base, ...pair, kind: "action", tier: "write", command: "open-claudia tool run kticket create" });
+  await handleAction(envelopeFor(`grn:${write.id}:room`, { channelId: "intruder-chat" }));
+  assert.ok(/Owner only/.test(lastSend()));
+  assert.strictEqual(grants.list().length, 0);
+
+  // A write card from one identifiable person grants `act` for that pair.
+  await handleAction(envelopeFor(`grn:${write.id}:room`));
+  assert.ok(/Granted Lucy `act`/.test(lastSend()), "write card grants act");
+  const issued = grants.list();
+  assert.strictEqual(issued.length, 1);
+  assert.strictEqual(issued[0].capability, "act");
+  assert.strictEqual(issued[0].principal.channelId, "user-lucy");
+  assert.strictEqual(issued[0].room, "kazee:ext-channel");
+
   // ── expired card: nothing to decide ──
   await handleAction(envelopeFor("apr:apr_0000_dead:ok"));
   assert.ok(/expired|cleaned up/.test(lastEdit()), "stale card gets a clear ack");

package/test-provider-language.js

@@ -506,7 +506,20 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // wakeups sleep in chunks instead of firing at once; a failed jobs-store write
 // keeps the retry armed; listings say where a fired job stands; loopback says
 // which step failed; the pack-review release gate no longer flakes on 30 s.
-assert.strictEqual(pkg.version, "3.4.24", "release version must remain unchanged without explicit approval");
+// 3.5.0 approved by Sumeet 2026-09-25 14:43 EAT ("yes work through it end to end",
+// the permission redesign, phase 0 security fixes first): the bot decides who a
+// process acts for (run attestation, whoami); staff tool writes are decided and
+// escalated in the bot; undeclared verbs refused; approvals carry their tier;
+// tool/note/keyring/sub-agent changes owner-only; staff follow-ups run at the
+// setter's level; notes/tasks owner-only and search stays in the room; reads
+// screened and the hook fails closed on staff turns; no standing destructive
+// or anonymous grants; canary release tags. Shipped first as canary-v3.5.0.
+// 3.5.1 under the same approval (Sumeet 2026-09-25 14:43 EAT, phase 0 hardening
+// from the adversarial review before any fleet roll): a CLI believes only its
+// own bot (ancestor listener, not started in a staff turn); staff watch checks
+// get an allowlist env and owner checks the bot's env again; a partial chat
+// origin is a non-owner; wider staff shell screen, documented as no boundary.
+assert.strictEqual(pkg.version, "3.5.1", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-parity-e2e.js

@@ -459,7 +459,9 @@ function runProviderChild(kind) {
 function runSupportSuites(provider) {
   assert.ok(["claude", "codex"].includes(provider));
   const passed = new Set();
-  for (const [key, [script, marker, suiteTimeoutMs = 90000]] of Object.entries(SUPPORT_SUITES)) {
+  // 180 s per suite by default: on a loaded CI runner a suite that takes 20 s
+  // locally overran 90 s (canary-v3.5.0 build job 44463; the retry passed).
+  for (const [key, [script, marker, suiteTimeoutMs = 180000]] of Object.entries(SUPPORT_SUITES)) {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), `open-claudia-parity-suite-${key}-`));
     try {
       fs.mkdirSync(path.join(root, "home"));
@@ -471,7 +473,11 @@ function runSupportSuites(provider) {
         timeout: suiteTimeoutMs,
         maxBuffer: 8 * 1024 * 1024,
       });
-      assert.ifError(result.error);
+      if (result.error) {
+        // Name the suite: a bare "spawnSync ETIMEDOUT" does not say which one.
+        const tail = `${result.stdout || ""}\n${result.stderr || ""}`.trim().split(/\r?\n/).slice(-20).join("\n");
+        assert.fail(`${key} (${script}) did not finish: ${result.error.code || result.error.message} after ${suiteTimeoutMs} ms\n${tail}`);
+      }
       assert.strictEqual(result.status, 0, `${script}\n${result.stderr || result.stdout}`);
       assert.ok(`${result.stdout}\n${result.stderr}`.includes(marker), `${script}: missing ${marker}`);
       passed.add(key);

package/test-provider-scheduler.js

@@ -1544,6 +1544,18 @@ function staticSchedulingProbe() {
   assert.match(source["core/scheduler.js"], /watchExpired/, "scheduler must mark expiry fires distinctly");
   assert.match(source["core/loopback.js"], /expiresAt/, "loopback must pass the watch expiry through");
   assert.match(source["bin/schedule.js"], /--timeout/, "watch-add CLI must expose --timeout");
+
+  // Phase 0 (B2): a watch check must NOT inherit the bot's whole environment,
+  // must build an explicit hardened env, and must register a creator-scoped
+  // run around the poll.
+  assert.ok(!/env:\s*process\.env/.test(source["core/scheduler.js"]), "watch check must not spawn with the bot's whole process env");
+  assert.match(source["core/scheduler.js"], /buildWatchCheckEnv\(process\.env/, "watch check builds an explicit hardened env");
+  assert.match(source["core/scheduler.js"], /registerRun\(checkRunId/, "watch check registers a creator-scoped run");
+  assert.match(source["core/scheduler.js"], /endRun\(checkRunId\)/, "watch check ends its run when the check exits");
+  // Phase 0 (B2): the loopback binds a job's identity to the run-attested
+  // creator, not the payload's claims, and refuses an unattributed caller.
+  assert.match(source["core/loopback.js"], /JOB_CREATE_KINDS/, "loopback must bind job creation to the run-attested caller");
+  assert.match(source["core/loopback.js"], /createdBy/, "jobs must record their creator principal");
 }
 
 async function main() {
@@ -1553,6 +1565,8 @@ async function main() {
   assert.strictEqual(typeof jobsApi.migrateJobsDocument, "function");
   assert.strictEqual(typeof jobsApi.createJobsStore, "function");
   assert.strictEqual(typeof schedulerApi.createSchedulerService, "function");
+  assert.strictEqual(typeof schedulerApi.buildWatchCheckEnv, "function", "scheduler exports the watch-check env builder");
+  assert.strictEqual(typeof schedulerApi.watchCheckPrincipal, "function", "scheduler exports the watch-check principal resolver");
 
   migrationProbe(jobsApi);
   legacyDefaultsProbe(jobsApi);

package/test-provider-tool-hooks.js

@@ -95,6 +95,17 @@ try {
   const claudeSettings = buildClaudeHookSettings();
   assert.strictEqual(claudeSettings.hooks.PreToolUse[0].matcher, "Bash");
   assert.match(claudeSettings.hooks.PreToolUse[0].hooks[0].command, /deny-gate-hook/);
+  // Claude's file-reading tools never pass through a shell, so the guarded
+  // read gate needs its own matcher on the same deny-gate entry.
+  const readHook = claudeSettings.hooks.PreToolUse.find((entry) => entry.matcher === "^(Read|Grep|Glob|NotebookRead|LS)$");
+  assert.ok(readHook, "Claude read tools are hooked");
+  assert.strictEqual(readHook.hooks[0].command, claudeSettings.hooks.PreToolUse[0].hooks[0].command);
+  for (const tool of ["Read", "Grep", "Glob", "NotebookRead", "LS"]) {
+    assert.ok(new RegExp(readHook.matcher).test(tool), `${tool} matches the read-gate matcher`);
+  }
+  for (const tool of ["Bash", "Write", "WebFetch", "ReadMcpResourceTool", "Task"]) {
+    assert.ok(!new RegExp(readHook.matcher).test(tool), `${tool} stays out of the read-gate matcher`);
+  }
   assert.match(claudeSettings.hooks.PreToolUse[0].hooks[0].command, new RegExp(process.execPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
   assert.strictEqual(ensureClaudeHookSettings({ settingsFile: claudeSettingsFile }), claudeSettingsFile);
   assert.deepStrictEqual(JSON.parse(fs.readFileSync(claudeSettingsFile, "utf8")), claudeSettings);

package/test-tool-guard.js

@@ -122,7 +122,9 @@ const deny = guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { com
 assert.strictEqual(deny.exit, 2, "deny → exit 2 (blocking)");
 assert.ok(/deny-gate/.test(deny.stderr), "deny → stderr message for the model");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "ls -la" } })).exit, 0, "benign Bash → allow");
-assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Read", tool_input: { file_path: "/etc/hosts" } })).exit, 0, "non-Bash tools are never gated");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Read", tool_input: { file_path: "/etc/hosts" } })).exit, 0, "reads are never gated without channel context");
+// Owner-local (no channel context) fails OPEN; guarded turns fail closed
+// instead (pinned in test-read-guard.js).
 assert.strictEqual(guard.runHook("not json{{{").exit, 0, "unparseable payload fails OPEN");
 assert.strictEqual(guard.runHook(null).exit, 0, "null payload fails OPEN");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash" })).exit, 0, "missing tool_input fails OPEN");
@@ -154,7 +156,7 @@ assert.strictEqual(
   guard.runHook(JSON.stringify({ tool_name: "apply_patch", tool_input: { command: "*** Begin Patch\n*** Add File: /tmp/evil.txt\n+x\n*** End Patch\n" } })).exit, 2,
   "Codex apply_patch equally gated on guarded turns (probed live: file edits arrive under this tool name)");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Read", tool_input: { file_path: "/etc/hosts" } })).exit, 0,
-  "reads stay free on guarded turns");
+  "ordinary reads stay free on guarded turns (protected roots: test-read-guard.js)");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "ls -la" } })).exit, 0,
   "benign Bash unaffected by the file gate (deny-gate rules unchanged)");
 
@@ -185,8 +187,11 @@ assert.strictEqual(guard.externalControlPlaneDenial(cpWrite), null, "no OC_CHANN
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: cpWrite } })).exit, 0,
   "owner-local shells keep full config access");
 process.exitCode = 0;
+delete process.env.OC_RUN_ATTEST; // hermetic even when the suite runs inside a live bot turn
 require("./bin/keyring").run(["path"]);
-assert.strictEqual(process.exitCode || 0, 0, "keyring CLI stays open owner-local (no channel env)");
+assert.strictEqual(process.exitCode, 1,
+  "keyring CLI is owner-only even with no channel env: no live owner run behind the process = unattributed (test-cli-owner-gates.js)");
+process.exitCode = 0;
 process.env.OC_CHANNEL_ADAPTER = "telegram";
 process.env.OC_CHANNEL_ID = "999000111";
 process.env.OC_CHANNEL_USER_ID = "999000111";
@@ -288,6 +293,10 @@ assert.strictEqual(pre[1].matcher, "^(Write|Edit|MultiEdit|NotebookEdit)$",
   "file-mutation tools are hooked for the external-speaker gate");
 assert.strictEqual(pre[1].hooks[0].command, pre[0].hooks[0].command,
   "file gate rides the same deny-gate-hook entry (one CLI, one audit path)");
+assert.strictEqual(pre[2].matcher, "^(Read|Grep|Glob|NotebookRead|LS)$",
+  "file-reading tools are hooked for the guarded read gate");
+assert.strictEqual(pre[2].hooks[0].command, pre[0].hooks[0].command,
+  "read gate rides the same deny-gate-hook entry");
 // second call with the file read-only: content-compare must skip the write
 fs.chmodSync(sPath, 0o444);
 assert.strictEqual(guard.ensureHookSettings(), sPath, "unchanged settings are not rewritten");

package/test-tool-manifest.js

@@ -8,7 +8,12 @@ const fs = require("fs");
 const os = require("os");
 const path = require("path");
 
+// The CLI asks the running bot who it acts for; never let this suite (which
+// may run inside a bot turn) reach that bot.
+for (const key of Object.keys(process.env)) if (key.startsWith("OC_")) delete process.env[key];
+
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "tool-manifest-test-"));
+process.env.OPEN_CLAUDIA_CONFIG_DIR = path.join(tmp, "config");
 process.env.TOOLS_DIR = path.join(tmp, "tools");
 process.env.KEYRING_FILE = path.join(tmp, "keyring.json");
 process.env.APPROVALS_DIR = path.join(tmp, "approvals");
@@ -142,6 +147,32 @@ const topLevelEnv = {};
     await toolCli.run(["run", "vaulted", "go", "--approval", b10rec.id]);
     assert.strictEqual(process.exitCode, 0, "the same token redeems once the key exists");
     assert.ok(approvals.read(b10rec.id).consumedAt, "token consumed exactly by the real run");
+
+    // ── an undeclared verb is refused at the CLI before anything else — even
+    // with an approved token for that exact command, which stays unconsumed
+    // (the smart-josephine `whatsapp chats` case used to reach the owner).
+    const chatsCmd = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "fleet", "chats"]);
+    const chatsRec = approvals.create({ tool: "fleet", tier: "write", command: chatsCmd, channelId: "c1", adapter: "tg" });
+    approvals.decide(chatsRec.id, "approved", "c1");
+    errs.length = 0;
+    process.exitCode = 0;
+    await toolCli.run(["run", "fleet", "chats", "--approval", chatsRec.id]);
+    assert.strictEqual(process.exitCode, 3, "undeclared verb refused (exit 3)");
+    assert.ok(errs.some((l) => /no declared verb "chats" — its manifest allows: list, restart, purge/.test(l)), "the refusal lists the declared verbs");
+    assert.strictEqual(approvals.read(chatsRec.id).consumedAt, undefined, "the token is never redeemed for an undeclared verb");
+
+    // ── a redeemed approval exports exactly the approved tier to the tool (a
+    // write approval no longer hands nested tools destructive access) ──
+    const tierSrc = path.join(tmp, "tiered.sh");
+    fs.writeFileSync(tierSrc, `#!/usr/bin/env bash\necho "$OPEN_CLAUDIA_APPROVED_TIER" > ${JSON.stringify(path.join(tmp, "tier.out"))}\n`);
+    tools.addTool(tierSrc, { name: "tiered", description: "reports its approved tier", risk: "write" });
+    const tierCmd = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "tiered", "go"]);
+    const tierRec = approvals.create({ tool: "tiered", tier: "write", command: tierCmd, channelId: "c1", adapter: "tg" });
+    approvals.decide(tierRec.id, "approved", "c1");
+    process.exitCode = 0;
+    await toolCli.run(["run", "tiered", "go", "--approval", tierRec.id]);
+    assert.strictEqual(process.exitCode, 0, "the write approval redeems");
+    assert.strictEqual(fs.readFileSync(path.join(tmp, "tier.out"), "utf-8").trim(), "write", "the run carries the approved tier, not destructive");
   } finally {
     for (const key of approvalKeys) {
       if (savedApprovalEnv[key] === undefined) delete process.env[key];