@nopeek/agent-bridge 0.1.0 → 0.1.1

package/dist/bot.d.ts

@@ -18,6 +18,9 @@ export declare class BotRunner {
     private refreshTimer;
     private seen;
     private channelCache;
+    private allowed;
+    private accessLoaded;
+    private declined;
     private log;
     private logErr;
     constructor(info: BotInfo, cfg: BridgeConfig);
@@ -25,6 +28,13 @@ export declare class BotRunner {
     start(): void;
     stop(): void;
     private mintSession;
+    /** Fetch (or refresh) the set of users allowed to talk to this bot. Called on
+     *  connect and whenever a grant changes. Best-effort: on failure we keep the
+     *  last-known set, and if we've never loaded one we FAIL CLOSED (owner-only)
+     *  rather than open. */
+    refreshAccess(): Promise<void>;
+    /** Sender permitted to talk to this bot? Fail closed if access never loaded. */
+    private isAllowed;
     private run;
     private connectOnce;
     /** Runtime sessions expire; reconnect with a fresh one shortly before that. */

package/dist/bot.js

@@ -22,6 +22,13 @@ export class BotRunner {
     refreshTimer = null;
     seen = new Set();
     channelCache = new Map();
+    // Access control: bots are PRIVATE by default. `allowed` is the set of user
+    // ids permitted to talk to this bot (owner + workspace members + granted
+    // users), fetched from the server. A sender NOT in this set never reaches the
+    // brain — so a stranger who finds the @handle can't drive the owner's agent.
+    allowed = new Set();
+    accessLoaded = false;
+    declined = new Set(); // (senderId) already told "not authorized" once
     log;
     logErr;
     constructor(info, cfg) {
@@ -67,6 +74,32 @@ export class BotRunner {
         }
         return (await res.json());
     }
+    /** Fetch (or refresh) the set of users allowed to talk to this bot. Called on
+     *  connect and whenever a grant changes. Best-effort: on failure we keep the
+     *  last-known set, and if we've never loaded one we FAIL CLOSED (owner-only)
+     *  rather than open. */
+    async refreshAccess() {
+        try {
+            const res = await fetch(`${this.cfg.apiUrl}/v1/apps/${this.cfg.appId}/bots/${this.info.userId}/access`, { headers: { authorization: `Bearer ${this.cfg.pairingCode}` } });
+            if (!res.ok)
+                throw new Error(`access HTTP ${res.status}`);
+            const j = (await res.json());
+            this.allowed = new Set(j.allowedUserIds ?? []);
+            this.accessLoaded = true;
+            this.log(`access: policy=${j.policy ?? "private"}, ${this.allowed.size} allowed sender(s)`);
+        }
+        catch (err) {
+            this.logErr(`access refresh failed: ${err.message} (keeping last-known allow list)`);
+        }
+    }
+    /** Sender permitted to talk to this bot? Fail closed if access never loaded. */
+    isAllowed(senderUserId) {
+        if (senderUserId === this.info.ownerId)
+            return true; // owner always
+        if (!this.accessLoaded)
+            return false; // fail closed until we know the list
+        return this.allowed.has(senderUserId);
+    }
     async run() {
         this.log(`starting (${this.info.userId}) brain=${this.brainKind}`);
         let delay = 2_000;
@@ -121,6 +154,7 @@ export class BotRunner {
                 this.logErr(`handler error for ${m.messageId}: ${err.message}`);
             });
         }));
+        await this.refreshAccess(); // load the allow list before we answer anyone
         this.scheduleRefresh(session.expiresAt);
     }
     /** Runtime sessions expire; reconnect with a fresh one shortly before that. */
@@ -193,9 +227,22 @@ export class BotRunner {
         }
         if (m.body?.type !== "text" || typeof m.body.text !== "string" || !m.body.text.trim())
             return;
-        // TODO(grants): enforce per-channel grants once bot_grant_changed carries
-        // enough to build an allowlist. v1 answers everyone in any channel the bot
-        // is a member of; the control socket already logs grant changes.
+        // ACCESS CONTROL: a bot is private. If the sender isn't authorized (owner,
+        // workspace member, or explicitly granted), the brain is NEVER invoked — so
+        // a stranger who found the @handle can't make the owner's agent do anything.
+        if (!this.isAllowed(m.senderUserId)) {
+            this.log(`${m.channelId} <- ${m.senderUserId}: BLOCKED (not authorized) — brain not invoked`);
+            if (this.cfg.declineMessage && !this.declined.has(m.senderUserId)) {
+                this.declined.add(m.senderUserId);
+                try {
+                    await (await this.getChannel(m.channelId)).send({ text: this.cfg.declineMessage });
+                }
+                catch {
+                    /* best-effort decline notice */
+                }
+            }
+            return;
+        }
         const text = m.body.text;
         this.log(`${m.channelId} <- ${m.senderUserId}: ${text.slice(0, 120)}`);
         const ch = await this.getChannel(m.channelId);

package/dist/bridge.js

@@ -41,9 +41,12 @@ export async function runBridge(cfg) {
         onAdoptBot: (f) => {
             startBot({ userId: f.botUserId, handle: f.handle, ownerId: f.ownerUserId });
         },
-        onGrantChanged: () => {
-            // v1: logged by ControlSocket. TODO(grants): pass down to the affected
-            // BotRunner and enforce an allowlist before answering.
+        onGrantChanged: (f) => {
+            // Access changed for a bot — re-pull its allow list so enforcement is live
+            // (a revoked user stops being answered within seconds, no restart).
+            const runner = bots.get(f.botUserId);
+            if (runner)
+                void runner.refreshAccess();
         },
     });
     // ---------------------------------------------------------------- health --

package/dist/config.d.ts

@@ -20,6 +20,9 @@ export interface BridgeConfig {
     port: number;
     /** Where per-bot device identity/key stores live (./data by default). */
     dataDir: string;
+    /** Optional reply sent ONCE to an unauthorized sender. Null (default) =
+     *  silently ignore them (most private — doesn't reveal the bot exists). */
+    declineMessage: string | null;
 }
 export declare const DEFAULT_API_URL = "https://d3qweh72vesa98.cloudfront.net";
 export declare const DEFAULT_PORT = 8790;

package/dist/config.js

@@ -149,5 +149,6 @@ export function loadConfig(argv = process.argv.slice(2)) {
         brainTimeoutMs,
         port,
         dataDir: resolve(process.cwd(), get("data-dir") ?? "data"),
+        declineMessage: get("decline-message") ?? null,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nopeek/agent-bridge",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Run your own agents as E2EE NoPeek bots. Pairs with a one-time code, runs every bot you own, and pipes messages to any command or webhook.",
   "type": "module",
   "license": "MIT",