@synapsor/runner 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -1,6 +1,19 @@
 # Changelog
 
-## 1.1.0 (prepared, not published)
+## 1.1.1 (prepared, not published)
+
+### Resource Read Authorization
+
+- Reauthorizes local MCP proposal, evidence, and replay reads against the
+  owning capability's trusted tenant and principal before returning content.
+- Returns the same generic `RESOURCE_NOT_FOUND` result for missing resources,
+  cross-tenant access, cross-principal access, and incomplete legacy ownership
+  metadata so a leaked handle does not become bearer authority.
+- Adds shared-store and Streamable HTTP regressions proving owner access still
+  works while cross-session resource reads fail closed.
+- Stages only `@synapsor/runner@1.1.1`; canonical Spec and DSL remain `1.1.0`.
+
+## 1.1.0
 
 ### Fleet Safety And Operations
 

package/README.md

@@ -161,6 +161,9 @@ trust boundaries, covered threats, non-goals, and required operator controls.
 - [Conformance fixtures](docs/conformance.md) prove trusted context, scoped
   reads, kept-out fields, proposal boundaries, approval, receipts, and replay
   behavior rather than only validating JSON shape.
+- MCP proposal, evidence, and replay handles are references rather than bearer
+  authority: resource reads re-check the owning tenant and principal against
+  the current trusted session.
 - `corepack pnpm test:live-apply` runs disposable Postgres and MySQL scenarios.
   It proves source rows stay unchanged before approval, guarded writeback
   applies once, idempotent retry does not duplicate the effect, and a stale row

package/THREAT_MODEL.md

@@ -59,6 +59,10 @@ idempotency boundary for effects.
 - Model-callable approval: approval/commit tools are not exposed to MCP clients by default.
 - Claims/environment confusion: an `http_claims` server fails before serving
   if a capability resolves an environment/static contract context.
+- Leaked local resource handle: proposal, evidence, and replay reads resolve
+  the owning capability context again and require the same trusted tenant and
+  principal; missing or mismatched ownership returns the same generic
+  `RESOURCE_NOT_FOUND` response.
 - JWT algorithm/key confusion: networked sessions use an explicit RS256/ES256
   allowlist, issuer/audience/time checks, `kid`, and bounded public-key/JWKS
   loading.
@@ -98,6 +102,8 @@ idempotency boundary for effects.
   configured `max_entries` safety bound.
 - Use verified `signed_key` or `jwt_oidc` reviewers for production-like shared
   queues; `dev_env` is unverified.
+- Treat proposal/evidence/replay handles as identifiers, not authorization;
+  preserve verified per-session context on every networked resource read.
 
 ## Release Blockers
 

package/dist/runner.mjs

@@ -7259,7 +7259,7 @@ function createMcpRuntime(config, options = {}) {
     },
     readResource: async (uri) => {
       assertStoreAvailable();
-      return readLocalResource(store, uri);
+      return readLocalResource(store, uri, config, env, trustedContext);
     },
     poolMetrics: () => resources.poolMetrics(),
     rateLimitMetrics: () => resources.rateLimitMetrics(),
@@ -9253,7 +9253,7 @@ function diffFromChangeSet(changeSet) {
   }
   return diff;
 }
-async function readLocalResource(store, uri) {
+async function readLocalResource(store, uri, config, env, trustedContext) {
   const parsed = new URL(uri);
   const parts = parsed.pathname.split("/").filter(Boolean);
   const collection = parsed.hostname;
@@ -9261,19 +9261,48 @@ async function readLocalResource(store, uri) {
   if (!id) throw new McpRuntimeError("RESOURCE_ID_MISSING", `Resource id missing in ${uri}.`);
   if (collection === "proposals") {
     const proposal = await store.getProposal(id);
-    if (!proposal) throw new McpRuntimeError("RESOURCE_NOT_FOUND", `Proposal not found: ${id}`);
+    if (!proposal) throw localResourceNotFound();
+    assertLocalResourceAccess(config, env, trustedContext, {
+      tenant_id: proposal.tenant_id,
+      principal: proposal.principal ?? proposal.change_set.principal.id,
+      capability: proposal.capability ?? proposal.action
+    });
     return { proposal, events: await store.events(id), receipts: await store.receipts(id) };
   }
   if (collection === "evidence") {
     const evidence2 = await store.getEvidenceBundle(id);
-    if (!evidence2) throw new McpRuntimeError("RESOURCE_NOT_FOUND", `Evidence bundle not found: ${id}`);
+    if (!evidence2) throw localResourceNotFound();
+    assertLocalResourceAccess(config, env, trustedContext, {
+      tenant_id: evidence2.tenant_id,
+      principal: evidence2.principal,
+      capability: evidence2.capability
+    });
     return evidence2;
   }
   if (collection === "replay") {
     const proposalId = id.startsWith("replay_") ? id.slice("replay_".length) : id;
+    const proposal = await store.getProposal(proposalId);
+    if (!proposal) throw localResourceNotFound();
+    assertLocalResourceAccess(config, env, trustedContext, {
+      tenant_id: proposal.tenant_id,
+      principal: proposal.principal ?? proposal.change_set.principal.id,
+      capability: proposal.capability ?? proposal.action
+    });
     return await store.replay(proposalId);
   }
-  throw new McpRuntimeError("RESOURCE_NOT_FOUND", `Unsupported Synapsor resource: ${uri}`);
+  throw localResourceNotFound();
+}
+function assertLocalResourceAccess(config, env, trustedContext, owner) {
+  if (!owner.tenant_id || !owner.principal || !owner.capability) throw localResourceNotFound();
+  const capability = localCapabilities(config).find((item) => item.name === owner.capability);
+  if (!capability) throw localResourceNotFound();
+  const context = resolveTrustedContext(config, env, capability, trustedContext);
+  if (context.tenant_id !== owner.tenant_id || context.principal !== owner.principal) {
+    throw localResourceNotFound();
+  }
+}
+function localResourceNotFound() {
+  return new McpRuntimeError("RESOURCE_NOT_FOUND", "Synapsor resource not found.");
 }
 async function resourceResult(uri, reader) {
   const payload = await reader(uri);
@@ -12585,7 +12614,7 @@ function isRecord7(value) {
 // apps/runner/package.json
 var package_default = {
   name: "@synapsor/runner",
-  version: "1.1.0",
+  version: "1.1.1",
   description: "Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.",
   license: "Apache-2.0",
   type: "module",

package/docs/security-boundary.md

@@ -37,6 +37,13 @@ Trusted context comes from local configuration, environment bindings, or Cloud
 session context in Cloud mode. Tenant, principal, and authorization scope must
 not be accepted from the model as authority.
 
+Proposal, evidence, and replay handles are references, not bearer credentials.
+Before returning a local MCP resource, Runner resolves the resource's owning
+capability context again and requires both tenant and principal to match the
+current trusted session. Missing resources and ownership mismatches return the
+same generic `RESOURCE_NOT_FOUND` result. Local operator CLI access remains an
+explicit host-level administrative boundary.
+
 Proposal tools read the current row through the read credential, store evidence
 and an exact before/after diff, and leave the source database unchanged.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synapsor/runner",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.",
   "license": "Apache-2.0",
   "type": "module",