@remnic/core 10.0.85 → 10.0.87

package/dist/who-knows-cli.js

@@ -4,28 +4,28 @@ import {
   renderWhoKnows,
   renderWhoKnowsJson,
   renderWhoKnowsText
-} from "./chunk-MNYQVYJ4.js";
-import "./chunk-Y43X3E24.js";
-import "./chunk-ELWI2R6H.js";
+} from "./chunk-QD5R6U5J.js";
+import "./chunk-IBDWYRDR.js";
+import "./chunk-CC4V7HNP.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-IGOW4TJE.js";
+import "./chunk-NT7F7WJQ.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-3ODZLCHC.js";
-import "./chunk-H34INI3P.js";
-import "./chunk-DI5ET2IE.js";
+import "./chunk-KVSOEVAF.js";
+import "./chunk-QEZ3DW5O.js";
+import "./chunk-PFUXPTBT.js";
+import "./chunk-CYEPCZN5.js";
 import "./chunk-DLZGSZVC.js";
 import "./chunk-OVZIYLBZ.js";
 import "./chunk-EXYT52NR.js";
 import "./chunk-DOJBV6WR.js";
-import "./chunk-PFUXPTBT.js";
 import "./chunk-WNEVEMJ3.js";
 import "./chunk-Y5NLBXPV.js";
-import "./chunk-CYEPCZN5.js";
-import "./chunk-QCP75JGO.js";
-import "./chunk-A7Q43EUZ.js";
+import "./chunk-TFA6HPOA.js";
 import "./chunk-F4TWWUMP.js";
 import "./chunk-72A4L5JJ.js";
+import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-PPUNC7UX.js";
 import "./chunk-X3724WL4.js";
@@ -33,19 +33,19 @@ import "./chunk-S2HLHAZ4.js";
 import "./chunk-MRPOZBJC.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
-import "./chunk-S45INSV3.js";
 import "./chunk-QFEDITXM.js";
 import "./chunk-AAD2ZS6P.js";
+import "./chunk-S45INSV3.js";
 import "./chunk-FHGWKODN.js";
+import "./chunk-YXZG5TVN.js";
 import "./chunk-ZIKENA2C.js";
 import "./chunk-3OUGSOJP.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-3ONXXHQO.js";
-import "./chunk-YXZG5TVN.js";
+import "./chunk-3WU7XOFN.js";
 import "./chunk-P4GUQSK3.js";
 import "./chunk-4LZ7SVKM.js";
 import "./chunk-YHTG64XV.js";
-import "./chunk-3WU7XOFN.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ER7XANP3.js";
 import "./chunk-M5GVCJSJ.js";
@@ -54,6 +54,15 @@ import "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
+import "./chunk-ELHJK7LM.js";
+import "./chunk-IUM3VSHI.js";
+import "./chunk-NWA6IXR3.js";
+import "./chunk-VILPVT4S.js";
+import "./chunk-AF2XMJKD.js";
+import "./chunk-OR42ZI54.js";
+import "./chunk-23G5P7TA.js";
+import "./chunk-C64XATK7.js";
+import "./chunk-42JKGUFJ.js";
 import "./chunk-ZU5JDLOH.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -62,16 +71,7 @@ import "./chunk-ZU3NJNO7.js";
 import "./chunk-E2AWJ7KQ.js";
 import "./chunk-7VLBZKNB.js";
 import "./chunk-Y33KJ556.js";
-import "./chunk-WBN66HPI.js";
-import "./chunk-NWA6IXR3.js";
-import "./chunk-VILPVT4S.js";
-import "./chunk-AF2XMJKD.js";
-import "./chunk-OR42ZI54.js";
-import "./chunk-IUM3VSHI.js";
-import "./chunk-C64XATK7.js";
-import "./chunk-42JKGUFJ.js";
-import "./chunk-23G5P7TA.js";
-import "./chunk-WLNWFHX3.js";
+import "./chunk-UXXK523X.js";
 import "./chunk-PJKTFXE2.js";
 import "./chunk-W5BIQOAJ.js";
 import "./chunk-HADD45AR.js";
@@ -108,7 +108,7 @@ import "./chunk-X4OZMANG.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";
-import "./chunk-LGEH473S.js";
+import "./chunk-CJCTKL6Y.js";
 import "./chunk-R2MBW2S4.js";
 import "./chunk-QUIRIG2P.js";
 import "./chunk-LDPPTPO5.js";

package/dist/who-knows.js

@@ -9,27 +9,27 @@ import {
   loadWhoKnowsEntities,
   tokenizeTopic,
   validateWhoKnowsInput
-} from "./chunk-Y43X3E24.js";
-import "./chunk-ELWI2R6H.js";
+} from "./chunk-IBDWYRDR.js";
+import "./chunk-CC4V7HNP.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-IGOW4TJE.js";
+import "./chunk-NT7F7WJQ.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-3ODZLCHC.js";
-import "./chunk-H34INI3P.js";
-import "./chunk-DI5ET2IE.js";
+import "./chunk-KVSOEVAF.js";
+import "./chunk-QEZ3DW5O.js";
+import "./chunk-PFUXPTBT.js";
+import "./chunk-CYEPCZN5.js";
 import "./chunk-DLZGSZVC.js";
 import "./chunk-OVZIYLBZ.js";
 import "./chunk-EXYT52NR.js";
 import "./chunk-DOJBV6WR.js";
-import "./chunk-PFUXPTBT.js";
 import "./chunk-WNEVEMJ3.js";
 import "./chunk-Y5NLBXPV.js";
-import "./chunk-CYEPCZN5.js";
-import "./chunk-QCP75JGO.js";
-import "./chunk-A7Q43EUZ.js";
+import "./chunk-TFA6HPOA.js";
 import "./chunk-F4TWWUMP.js";
 import "./chunk-72A4L5JJ.js";
+import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-PPUNC7UX.js";
 import "./chunk-X3724WL4.js";
@@ -37,19 +37,19 @@ import "./chunk-S2HLHAZ4.js";
 import "./chunk-MRPOZBJC.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
-import "./chunk-S45INSV3.js";
 import "./chunk-QFEDITXM.js";
 import "./chunk-AAD2ZS6P.js";
+import "./chunk-S45INSV3.js";
 import "./chunk-FHGWKODN.js";
+import "./chunk-YXZG5TVN.js";
 import "./chunk-ZIKENA2C.js";
 import "./chunk-3OUGSOJP.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-3ONXXHQO.js";
-import "./chunk-YXZG5TVN.js";
+import "./chunk-3WU7XOFN.js";
 import "./chunk-P4GUQSK3.js";
 import "./chunk-4LZ7SVKM.js";
 import "./chunk-YHTG64XV.js";
-import "./chunk-3WU7XOFN.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ER7XANP3.js";
 import "./chunk-M5GVCJSJ.js";
@@ -58,6 +58,15 @@ import "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
+import "./chunk-ELHJK7LM.js";
+import "./chunk-IUM3VSHI.js";
+import "./chunk-NWA6IXR3.js";
+import "./chunk-VILPVT4S.js";
+import "./chunk-AF2XMJKD.js";
+import "./chunk-OR42ZI54.js";
+import "./chunk-23G5P7TA.js";
+import "./chunk-C64XATK7.js";
+import "./chunk-42JKGUFJ.js";
 import "./chunk-ZU5JDLOH.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -66,16 +75,7 @@ import "./chunk-ZU3NJNO7.js";
 import "./chunk-E2AWJ7KQ.js";
 import "./chunk-7VLBZKNB.js";
 import "./chunk-Y33KJ556.js";
-import "./chunk-WBN66HPI.js";
-import "./chunk-NWA6IXR3.js";
-import "./chunk-VILPVT4S.js";
-import "./chunk-AF2XMJKD.js";
-import "./chunk-OR42ZI54.js";
-import "./chunk-IUM3VSHI.js";
-import "./chunk-C64XATK7.js";
-import "./chunk-42JKGUFJ.js";
-import "./chunk-23G5P7TA.js";
-import "./chunk-WLNWFHX3.js";
+import "./chunk-UXXK523X.js";
 import "./chunk-PJKTFXE2.js";
 import "./chunk-W5BIQOAJ.js";
 import "./chunk-HADD45AR.js";
@@ -112,7 +112,7 @@ import "./chunk-X4OZMANG.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";
-import "./chunk-LGEH473S.js";
+import "./chunk-CJCTKL6Y.js";
 import "./chunk-R2MBW2S4.js";
 import "./chunk-QUIRIG2P.js";
 import "./chunk-LDPPTPO5.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "10.0.85",
+  "version": "10.0.87",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3386,7 +3386,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^10.0.85"
+    "@remnic/coding-graph": "^10.0.87"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-boundary.ts

@@ -18,6 +18,7 @@
 import { z } from "zod";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
 import {
+  assertNamespaceAllowed,
   assertOperationAuthorizationAllowed,
   tokenCapabilityStore,
 } from "./access-token-capabilities.js";
@@ -493,6 +494,20 @@ export function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOpe
         throw new EngramAccessInputError(formatZodIssues(parseResult.error));
       }
       assertOperationAuthorizationAllowed(tokenCapabilityStore.getStore(), spec);
+      // Post-parse namespace re-check (issue #3225 B1): the transports authorize
+      // the RAW namespace before preprocessing. Re-check the PARSED value so a
+      // namespace that only appears after validation cannot bypass the token
+      // allow-list. Absent namespaces keep the transport check; no default is
+      // invented here.
+      if (operationRequiresAuthorizedNamespace(spec.name)) {
+        // SAFETY: namespace-bearing schemas parse `namespace` as a non-empty
+        // string, an explicit null (transport null-for-absent idiom), or
+        // undefined; falsy spellings mean absent and keep the transport check.
+        const parsedNamespace = (parseResult.data as { namespace?: string | null }).namespace;
+        if (parsedNamespace) {
+          assertNamespaceAllowed(tokenCapabilityStore.getStore(), parsedNamespace);
+        }
+      }
       return spec.handler(parseResult.data, { ...ctx, rawInput });
     },
   };

package/src/access-errors.ts

@@ -35,6 +35,28 @@ export class NamespaceNotWritableError extends EngramAccessInputError {
   }
 }
 
+// ─── Reserved argument keys (issue #3225 B1) ──────────────────────────────
+
+/**
+ * Dictionary keys that change object shape or prototype resolution. A JSON
+ * body can carry them as own members; the request preprocessors reject them
+ * before copying, so a decoded `__proto__` member cannot become an inherited
+ * schema field. Lives in this lowest module so the boundary and wire schema
+ * layers share one implementation without an import cycle.
+ */
+export const RESERVED_PROTO_KEYS: readonly string[] = ["__proto__", "constructor", "prototype"];
+
+/**
+ * Reject the reserved keys with the input-error type, so a client that
+ * submits a magic dictionary key gets a validation error instead of a
+ * silently reshaped request object.
+ */
+export function rejectReservedArgumentKey(key: string): void {
+  if (RESERVED_PROTO_KEYS.includes(key)) {
+    throw new EngramAccessInputError(`${key} is not a permitted argument key`);
+  }
+}
+
 // ─── Levenshtein distance ─────────────────────────────────────────────────
 
 /**

package/src/access-fleet-wide-work-peer.test.ts

@@ -0,0 +1,236 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import "./access-operations-batch.js"; // registration side effect: the real operations
+import { getOperation } from "./access-boundary.js";
+import { EngramAccessService } from "./access-service.js";
+import { EngramAccessForbiddenError } from "./access-errors.js";
+import { tokenCapabilityStore, type TokenCapabilities } from "./access-token-capabilities.js";
+import { Orchestrator } from "./orchestrator.js";
+import { parseConfig } from "./config.js";
+import { writePeer, writePeerProfile } from "./peers/index.js";
+import { WorkStorage } from "./work/storage.js";
+
+// Issue #3225 B3: work_task / work_project / work_board and the six peer
+// operations run against GLOBAL stores, so a namespace argument cannot
+// isolate them. They must carry fleetWide: true like the other cross-fleet
+// operations, and the HTTP peer routes must enforce the same policy.
+
+const PEER_ID = "b3-target-peer";
+const NOW = "2026-11-11T00:00:00.000Z";
+
+/** The nine operations that touch a global store (issue #3225 B3). */
+const GLOBAL_OPS = [
+  "work_task",
+  "work_project",
+  "work_board",
+  "peer_list",
+  "peer_get",
+  "peer_set",
+  "peer_delete",
+  "peer_profile_get",
+  "peer_forget",
+] as const;
+
+type GlobalOpName = (typeof GLOBAL_OPS)[number];
+
+/** Envelope fields the operations under test read; their schemas pass open objects through. */
+interface OpEnvelope {
+  action?: string;
+  id?: string;
+  title?: string;
+  name?: string;
+  projectId?: string;
+  snapshotJson?: string;
+  kind?: string;
+  displayName?: string;
+  confirm?: string;
+}
+
+/** Every registered handler answers with a `result` envelope. */
+interface OpOutput<T> {
+  result: T;
+}
+
+interface Fixture {
+  root: string;
+  service: EngramAccessService;
+  cleanup: () => Promise<void>;
+}
+
+async function createFixture(): Promise<Fixture> {
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-b3-fleet-wide-"));
+  const orchestrator = new Orchestrator(
+    parseConfig({ memoryDir: root, namespacesEnabled: false, defaultNamespace: "global" }),
+  );
+  const storage = await orchestrator.getStorage();
+  await storage.ensureDirectories();
+  const service = new EngramAccessService(orchestrator);
+  return { root, service, cleanup: () => rm(root, { recursive: true, force: true }) };
+}
+
+/** Seed one synthetic record in each global store the nine operations touch. */
+async function seedGlobalRecords(root: string): Promise<void> {
+  const work = new WorkStorage(root);
+  await work.ensureDirectories();
+  await work.createTask({ title: "seeded task", description: "seeded" });
+  await work.createProject({ name: "seeded project", description: "seeded" });
+  await writePeer(root, {
+    id: PEER_ID,
+    kind: "agent",
+    displayName: "seeded peer",
+    createdAt: NOW,
+    updatedAt: NOW,
+  });
+  await writePeerProfile(root, {
+    peerId: PEER_ID,
+    updatedAt: NOW,
+    fields: { communication_style: "seeded" },
+    provenance: {},
+  });
+}
+
+/** Sorted relpath:content lines for every file under root (mutation detector). */
+async function snapshotDir(root: string): Promise<string[]> {
+  const entries = await readdir(root, { recursive: true, withFileTypes: true });
+  const lines: string[] = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const abs = path.join(entry.parentPath, entry.name);
+    const content = await readFile(abs, "utf8");
+    lines.push(`${path.relative(root, abs)}:${content}`);
+  }
+  return lines.sort();
+}
+
+/**
+ * Run the real registered operation under an optional capability record.
+ * The generic T names the registered handler's documented result shape.
+ */
+async function runOp<T>(
+  name: GlobalOpName,
+  input: OpEnvelope,
+  service: EngramAccessService,
+  capabilities?: TokenCapabilities,
+): Promise<OpOutput<T>> {
+  const op = getOperation(name);
+  assert.ok(op, `operation must be registered: ${name}`);
+  const run = () => op.run(input, { service });
+  // SAFETY: the boundary validates the envelope, then the handler returns its
+  // documented `{ result }` shape; T is that shape as named by the caller.
+  const output = (capabilities === undefined ? await run() : await tokenCapabilityStore.run(capabilities, run)) as OpOutput<T>;
+  return output;
+}
+
+test("B3: a one-namespace token is denied on every global work and peer op BEFORE any read or mutation", async () => {
+  const fixture = await createFixture();
+  try {
+    await seedGlobalRecords(fixture.root);
+    const before = await snapshotDir(fixture.root);
+
+    const mutatingInput = {
+      work_task: { action: "create", title: "intruder task" },
+      work_project: { action: "create", name: "intruder project" },
+      work_board: { action: "import_snapshot", projectId: "proj-x", snapshotJson: "{}" },
+      peer_list: {},
+      peer_get: { id: PEER_ID },
+      peer_set: { id: PEER_ID, displayName: "hijacked" },
+      peer_delete: { id: PEER_ID },
+      peer_profile_get: { id: PEER_ID },
+      peer_forget: { id: PEER_ID, confirm: "yes" },
+    };
+
+    for (const namespaces of [["ns_a"], []]) {
+      const caps: TokenCapabilities = { version: 1, namespaces };
+      for (const name of GLOBAL_OPS) {
+        await assert.rejects(
+          () => runOp(name, mutatingInput[name], fixture.service, caps),
+          (err: Error) =>
+            err instanceof EngramAccessForbiddenError && /scoped to specific namespaces/.test(err.message),
+          `${name} must reject a token restricted to ${JSON.stringify(namespaces)}`,
+        );
+      }
+    }
+
+    const after = await snapshotDir(fixture.root);
+    assert.deepEqual(after, before, "denials must not change any file in any global store");
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
+test("B3: an ops-scoped token without a namespace axis may use its permitted global ops", async () => {
+  const fixture = await createFixture();
+  try {
+    const caps: TokenCapabilities = { version: 1, ops: [...GLOBAL_OPS] };
+
+    const created = await runOp<{ task: { id: string } }>(
+      "work_task",
+      { action: "create", title: "ops token task" },
+      fixture.service,
+      caps,
+    );
+    assert.ok(created.result.task.id, "ops-scoped token creates a work task");
+
+    const listed = await runOp<{ count: number }>("work_task", { action: "list" }, fixture.service, caps);
+    assert.equal(listed.result.count, 1, "ops-scoped token reads its own created task");
+
+    const peer = await runOp<{ created: boolean }>(
+      "peer_set",
+      { id: "ops-token-peer", kind: "agent" },
+      fixture.service,
+      caps,
+    );
+    assert.equal(peer.result.created, true, "ops-scoped token registers a peer");
+
+    const got = await runOp<{ found: boolean }>("peer_get", { id: "ops-token-peer" }, fixture.service, caps);
+    assert.equal(got.result.found, true, "ops-scoped token reads a peer");
+
+    const forgotten = await runOp<{ purged: boolean }>(
+      "peer_forget",
+      { id: "ops-token-peer", confirm: "yes" },
+      fixture.service,
+      caps,
+    );
+    assert.equal(forgotten.result.purged, true, "ops-scoped token may run the destructive purge it is granted");
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
+test("B3: a legacy unrestricted token (no capability record) retains access to global ops", async () => {
+  const fixture = await createFixture();
+  try {
+    await seedGlobalRecords(fixture.root);
+
+    const listed = await runOp<{ count: number }>("work_task", { action: "list" }, fixture.service);
+    assert.equal(listed.result.count, 1, "legacy token lists work tasks");
+
+    const peers = await runOp<{ peers: { id: string }[] }>("peer_list", {}, fixture.service);
+    assert.deepEqual(
+      peers.result.peers.map((p) => p.id),
+      [PEER_ID],
+      "legacy token lists the seeded peer",
+    );
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
+test("B3: peer_forget confirmation requirement is unchanged through the boundary", async () => {
+  const fixture = await createFixture();
+  try {
+    await seedGlobalRecords(fixture.root);
+    await assert.rejects(
+      () => runOp("peer_forget", { id: PEER_ID, confirm: "no" }, fixture.service),
+      (err: Error) => /confirm must be 'yes'/.test(err.message),
+    );
+    const files = await snapshotDir(fixture.root);
+    assert.ok(files.some((line) => line.includes(`${PEER_ID}/identity.md`)), "peer survives a rejected confirmation");
+  } finally {
+    await fixture.cleanup();
+  }
+});