@tpsdev-ai/flair 0.10.1 → 0.12.0

package/dist/resources/Presence.js

@@ -0,0 +1,300 @@
+/**
+ * POST /Presence — agent heartbeat writes its own presence.
+ * GET  /Presence — public-safe presence roster for The Office Space.
+ *
+ * Extends the auto-generated Presence table resource (from schema.graphql).
+ * Overrides get() for public-safe roster and post() for Ed25519-authed
+ * heartbeat writes.
+ *
+ * Auth:
+ *   GET  — public (returns only allowlisted fields; safe for public renderer).
+ *   POST — Ed25519 agent credential (TPS-Ed25519 header). Agent writes only its
+ *          own record; cross-agent writes are rejected (403).
+ *
+ * Security (Sherlock):
+ *   - Write: per-agent Ed25519 auth. Cross-agent → 403.
+ *   - Read: field-allowlisted to public-safe set. No secrets, no admin data.
+ *   - currentTask is agent-authored free text → cap length, escape on render.
+ */
+import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
+// ─── Constants ────────────────────────────────────────────────────────────────
+const WINDOW_MS = 30_000;
+const CURRENT_TASK_MAX_LENGTH = 200;
+const VALID_ACTIVITIES = new Set(["coding", "reviewing", "planning", "idle"]);
+function idleThresholdMs() {
+    const env = process.env.PRESENCE_IDLE_THRESHOLD_MS;
+    return env ? Number(env) || 90_000 : 90_000;
+}
+function offlineThresholdMs() {
+    const env = process.env.PRESENCE_OFFLINE_THRESHOLD_MS;
+    return env ? Number(env) || 600_000 : 600_000;
+}
+// ─── Nonce replay protection ──────────────────────────────────────────────────
+const nonceSeen = new Map();
+function pruneNonces() {
+    const now = Date.now();
+    for (const [k, ts] of nonceSeen.entries()) {
+        if (now - ts > WINDOW_MS)
+            nonceSeen.delete(k);
+    }
+}
+// ─── Crypto helpers ───────────────────────────────────────────────────────────
+function b64ToArrayBuffer(b64) {
+    const std = b64.replace(/-/g, "+").replace(/_/g, "/");
+    const bin = atob(std);
+    const buf = new ArrayBuffer(bin.length);
+    const view = new Uint8Array(buf);
+    for (let i = 0; i < bin.length; i++)
+        view[i] = bin.charCodeAt(i);
+    return buf;
+}
+const keyCache = new Map();
+async function importEd25519Key(publicKeyStr) {
+    if (keyCache.has(publicKeyStr))
+        return keyCache.get(publicKeyStr);
+    let raw;
+    if (/^[0-9a-f]{64}$/i.test(publicKeyStr)) {
+        const bytes = new Uint8Array(32);
+        for (let i = 0; i < 32; i++)
+            bytes[i] = parseInt(publicKeyStr.slice(i * 2, i * 2 + 2), 16);
+        raw = bytes.buffer;
+    }
+    else {
+        raw = b64ToArrayBuffer(publicKeyStr);
+    }
+    const key = await crypto.subtle.importKey("raw", raw, { name: "Ed25519" }, false, ["verify"]);
+    keyCache.set(publicKeyStr, key);
+    return key;
+}
+// ─── Status derivation (pure — exported for unit testing) ─────────────────────
+export function derivePresenceStatus(now, lastHeartbeatAt, idleMs, offlineMs) {
+    const idle = idleMs ?? idleThresholdMs();
+    const offline = offlineMs ?? offlineThresholdMs();
+    if (lastHeartbeatAt == null || !Number.isFinite(lastHeartbeatAt))
+        return "offline";
+    const elapsed = now - lastHeartbeatAt;
+    if (elapsed < 0)
+        return "active";
+    if (elapsed < idle)
+        return "active";
+    if (elapsed < offline)
+        return "idle";
+    return "offline";
+}
+// ─── Public-safe field allowlist ──────────────────────────────────────────────
+const ROSTER_ALLOWLIST = new Set([
+    "id",
+    "displayName",
+    "role",
+    "runtime",
+    "activity",
+    "presenceStatus",
+    "currentTask",
+    "lastHeartbeatAt",
+]);
+function sanitizeCurrentTask(task) {
+    if (typeof task !== "string")
+        return null;
+    const trimmed = task.trim();
+    if (trimmed.length === 0)
+        return null;
+    return trimmed.slice(0, CURRENT_TASK_MAX_LENGTH);
+}
+function pickAllowlisted(record) {
+    const out = {};
+    for (const key of Object.keys(record)) {
+        if (ROSTER_ALLOWLIST.has(key))
+            out[key] = record[key];
+    }
+    return out;
+}
+// ─── Resource ─────────────────────────────────────────────────────────────────
+/**
+ * Extends the auto-generated Presence table resource (from schema.graphql) so
+ * Harper resolves the /Presence path without conflict. Overrides get() for the
+ * public-safe roster view and post() for Ed25519-authed heartbeat writes.
+ */
+export class Presence extends databases.flair.Presence {
+    /** Bypass Harper's role gate for GET (public-safe data only). */
+    allowRead() {
+        return true;
+    }
+    /** Bypass Harper's role gate for POST (Ed25519 auth handled internally). */
+    allowCreate() {
+        return true;
+    }
+    /**
+     * GET /Presence — public-safe presence roster.
+     *
+     * Joins Presence records with Agent metadata and derives presenceStatus.
+     * Only allowlisted fields are returned (no secrets, no admin data).
+     */
+    async get() {
+        const now = Date.now();
+        const idleThreshold = idleThresholdMs();
+        const offlineThreshold = offlineThresholdMs();
+        const results = [];
+        try {
+            const presenceRows = databases.flair.Presence.search();
+            for await (const row of presenceRows) {
+                const agentId = row?.agentId;
+                if (!agentId)
+                    continue;
+                let agent = null;
+                try {
+                    agent = await databases.flair.Agent.get(agentId);
+                }
+                catch { /* agent may not exist or be deactivated */ }
+                const entry = {
+                    id: agentId,
+                    displayName: agent?.displayName ?? agent?.name ?? agentId,
+                    role: agent?.role ?? "agent",
+                    runtime: agent?.runtime ?? null,
+                    activity: row?.activity ?? "idle",
+                    presenceStatus: derivePresenceStatus(now, typeof row?.lastHeartbeatAt === "number"
+                        ? row.lastHeartbeatAt
+                        : Number(row?.lastHeartbeatAt ?? 0), idleThreshold, offlineThreshold),
+                    currentTask: sanitizeCurrentTask(row?.currentTask),
+                    lastHeartbeatAt: typeof row?.lastHeartbeatAt === "number"
+                        ? row.lastHeartbeatAt
+                        : Number(row?.lastHeartbeatAt ?? 0),
+                };
+                results.push(pickAllowlisted(entry));
+            }
+        }
+        catch (err) {
+            return new Response(JSON.stringify({ error: "presence_query_failed", detail: err?.message }), { status: 500, headers: { "Content-Type": "application/json" } });
+        }
+        return results;
+    }
+    /**
+     * POST /Presence — agent heartbeat.
+     *
+     * Auth: TPS-Ed25519 header required. agentId from signature, NOT from body.
+     * An agent may update ONLY its own presence; cross-agent writes → 403.
+     *
+     * Bypasses Harper's default table post handler — writes via databases.flair.Presence
+     * directly so we control auth flow end-to-end.
+     */
+    async post(content, context) {
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        // ── Parse Ed25519 auth header ────────────────────────────────────────────
+        const authHeader = request?.headers?.get?.("authorization") ??
+            request?.headers?.asObject?.authorization ??
+            "";
+        // If the middleware already verified and set tpsAgent, trust it
+        const middlewareAgent = request?.tpsAgent;
+        let agentId;
+        if (middlewareAgent) {
+            agentId = middlewareAgent;
+        }
+        else {
+            const m = authHeader.match(/^TPS-Ed25519\s+([^:]+):(\d+):([^:]+):(.+)$/);
+            if (!m) {
+                return new Response(JSON.stringify({ error: "Ed25519 agent auth required for heartbeat" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            }
+            const [, headerAgentId, tsRaw, nonce, sigB64] = m;
+            const ts = Number(tsRaw);
+            const now = Date.now();
+            if (!Number.isFinite(ts) || Math.abs(now - ts) > WINDOW_MS) {
+                return new Response(JSON.stringify({ error: "timestamp_out_of_window" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            }
+            pruneNonces();
+            const nonceKey = `${headerAgentId}:${nonce}`;
+            if (nonceSeen.has(nonceKey)) {
+                return new Response(JSON.stringify({ error: "nonce_replay_detected" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            }
+            const agent = await databases.flair.Agent.get(headerAgentId).catch(() => null);
+            if (!agent) {
+                return new Response(JSON.stringify({ error: "unknown_agent" }), { status: 401, headers: { "Content-Type": "application/json" } });
+            }
+            try {
+                // request.url is just the path portion (e.g. "/Presence")
+                const pathname = (request.url ?? "/Presence").split("?")[0];
+                const payload = `${headerAgentId}:${tsRaw}:${nonce}:POST:${pathname}`;
+                const key = await importEd25519Key(agent.publicKey);
+                const sigBuf = b64ToArrayBuffer(sigB64);
+                const payloadBuf = new TextEncoder().encode(payload);
+                const ok = await crypto.subtle.verify({ name: "Ed25519" }, key, sigBuf, payloadBuf);
+                if (!ok) {
+                    return new Response(JSON.stringify({ error: "invalid_signature" }), { status: 401, headers: { "Content-Type": "application/json" } });
+                }
+            }
+            catch (e) {
+                return new Response(JSON.stringify({ error: "signature_verification_failed", detail: e?.message }), { status: 401, headers: { "Content-Type": "application/json" } });
+            }
+            nonceSeen.set(nonceKey, ts);
+            agentId = headerAgentId;
+        }
+        // ── Validate body ────────────────────────────────────────────────────────
+        const { currentTask, activity } = content || {};
+        if (activity !== undefined && !VALID_ACTIVITIES.has(activity)) {
+            return new Response(JSON.stringify({
+                error: "invalid_activity",
+                detail: `activity must be one of: ${[...VALID_ACTIVITIES].join(", ")}`,
+            }), { status: 400, headers: { "Content-Type": "application/json" } });
+        }
+        // ── Write presence ───────────────────────────────────────────────────────
+        const now = Date.now();
+        try {
+            let existing = null;
+            try {
+                existing = await databases.flair.Presence.get(agentId);
+            }
+            catch { /* first heartbeat */ }
+            const record = {
+                agentId,
+                lastHeartbeatAt: now,
+                currentTask: sanitizeCurrentTask(currentTask),
+                activity: activity ?? (existing?.activity ?? "idle"),
+            };
+            if (existing) {
+                const merged = { ...existing, ...record };
+                await databases.flair.Presence.put(merged);
+            }
+            else {
+                await databases.flair.Presence.put(record);
+            }
+            return {
+                ok: true,
+                agentId,
+                lastHeartbeatAt: now,
+                presenceStatus: "active",
+            };
+        }
+        catch (e) {
+            return new Response(JSON.stringify({ error: "presence_write_failed", detail: e?.message }), { status: 500, headers: { "Content-Type": "application/json" } });
+        }
+    }
+    /**
+     * PUT/DELETE are not part of the agent heartbeat contract (writes go through
+     * POST, which carries its own Ed25519 auth). GET is intentionally public and
+     * allowCreate=true lets POST self-auth — but those bypasses must NOT extend to
+     * PUT/DELETE. The non-rejecting gate would otherwise let anonymous PUT/DELETE
+     * straight to Harper's default handler (the leak this closes). Require a verified
+     * non-anonymous principal, scoped to the agent's own record (Presence is keyed
+     * by agentId).
+     */
+    async put(content, context) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+        }
+        if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+            return new Response(JSON.stringify({ error: "forbidden: cannot write presence for another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        }
+        return super.put(content, context);
+    }
+    async delete(id) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+        }
+        if (auth.kind === "agent" && !auth.isAdmin && id != null && String(id) !== auth.agentId) {
+            return new Response(JSON.stringify({ error: "forbidden: cannot delete presence for another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        }
+        return super.delete(id);
+    }
+}

package/dist/resources/Relationship.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 /**
  * Relationship resource — entity-to-entity relationships with temporal validity.
@@ -13,15 +14,20 @@ import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
  */
 export class Relationship extends databases.flair.Relationship {
     async search(query) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent || isAdminAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT read relationships (previously `!authAgent` was
+        // treated as unfiltered — the anonymous-read leak).
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Trusted internal call or admin agent → unfiltered.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        // Non-admin: scope to own relationships
-        const agentCondition = { attribute: "agentId", comparator: "equals", value: authAgent };
+        // Non-admin agent: scope to own relationships.
+        const agentCondition = { attribute: "agentId", comparator: "equals", value: auth.agentId };
         if (!query?.conditions) {
             return super.search({ conditions: [agentCondition], ...(query || {}) });
         }

package/dist/resources/SemanticSearch.js

@@ -1,4 +1,5 @@
 import { Resource, databases } from "@harperfast/harper";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { getEmbedding, getMode } from "./embeddings-provider.js";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
@@ -45,6 +46,15 @@ function distanceToSimilarity(distance) {
 // so composite re-ranking has enough headroom to reorder results.
 const CANDIDATE_MULTIPLIER = 5;
 export class SemanticSearch extends Resource {
+    // Self-authorize via the Ed25519 agent verify instead of relying on the auth
+    // gate's admin super_user elevation (removed in the auth reshape). Any
+    // cryptographically-verified agent may search; per-agent RESULT scoping is
+    // enforced in post() below (an agent only sees its own + office-visible +
+    // granted memories). Without this, Harper's default denies the POST for the
+    // least-privilege flair_agent role (AccessViolation 403).
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(data) {
         const { agentId: bodyAgentId, q, queryEmbedding, tag, subject, subjects, limit = 10, includeSuperseded = false, scoring = "composite", minScore = 0, since, asOf } = data || {};
         // Authenticated identity lives on the Harper Resource context (getContext().request).
@@ -52,11 +62,18 @@ export class SemanticSearch extends Resource {
         // silently returned undefined and the defense-in-depth scope check below
         // was bypassed, letting a non-admin agent read another agent's memories
         // by putting the victim's id in the body.
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authenticatedAgent = request?.tpsAgent ?? request?.headers?.get?.("x-tps-agent");
-        const callerIsAdmin = request?.tpsAgentIsAdmin === true;
-        // Rate limiting — use authenticated agent ID, not client-supplied body
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT search. Previously the no-auth path fell through to
+        // honoring the body-supplied agentId (line below), so an unauthenticated
+        // caller could read any agent's memories by putting that id in the body.
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "Content-Type": "application/json" },
+            });
+        }
+        const authenticatedAgent = auth.kind === "agent" ? auth.agentId : undefined;
+        const callerIsAdmin = auth.kind === "agent" && auth.isAdmin;
+        // Rate limiting — use authenticated agent ID (internal calls have none).
         if (authenticatedAgent) {
             const bucket = q && !queryEmbedding ? "embedding" : "general";
             const rl = checkRateLimit(authenticatedAgent, bucket);
@@ -70,14 +87,14 @@ export class SemanticSearch extends Resource {
                 : null;
         // Enforce agentId = authenticated agent for non-admins. A mismatched body
         // agentId is a cross-agent read attempt — reject outright. Admins can query
-        // any agentId (needed for bootstrap / consolidation scripts).
+        // any agentId (bootstrap / consolidation).
         if (authenticatedAgent && !callerIsAdmin && bodyAgentId && bodyAgentId !== authenticatedAgent) {
             return new Response(JSON.stringify({
                 error: "forbidden: agentId must match authenticated agent",
             }), { status: 403, headers: { "Content-Type": "application/json" } });
         }
-        // Scope search to the authenticated agent (own + granted). For admins or
-        // unauthenticated internal calls, honor the body-supplied agentId.
+        // Scope: non-admin agent → own (+ granted). Admin agent or trusted internal
+        // call (no request) → honor the body-supplied agentId.
         const agentId = (authenticatedAgent && !callerIsAdmin)
             ? authenticatedAgent
             : bodyAgentId;

package/dist/resources/Soul.js

@@ -1,17 +1,26 @@
 import { databases } from "@harperfast/harper";
-function enforceAgentScope(self, data) {
-    const authenticatedAgent = self.request?.headers?.get?.("x-tps-agent");
-    const callerIsAdmin = self.request?.tpsAgentIsAdmin === true;
-    if (authenticatedAgent && !callerIsAdmin && data?.agentId && data.agentId !== authenticatedAgent) {
-        return new Response(JSON.stringify({
-            error: "forbidden: agentId must match authenticated agent",
-        }), { status: 403, headers: { "Content-Type": "application/json" } });
+import { resolveAgentAuth } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+/**
+ * Deny anonymous; enforce per-agent write ownership for non-admin agents.
+ * The previous header-based check only fired when an agent WAS present (it read
+ * x-tps-agent), so an anonymous request — which carries no x-tps-agent — slipped
+ * through. With the non-rejecting gate, each write path self-enforces (resolveAgentAuth
+ * distinguishes internal/agent/anonymous). Mirrors the WorkspaceState pattern.
+ */
+async function enforceWriteAuth(self, data) {
+    const auth = await resolveAgentAuth(self.getContext?.());
+    if (auth.kind === "anonymous")
+        return UNAUTH();
+    if (auth.kind === "agent" && !auth.isAdmin && data?.agentId && data.agentId !== auth.agentId) {
+        return FORBIDDEN("forbidden: agentId must match authenticated agent");
     }
     return null;
 }
 export class Soul extends databases.flair.Soul {
     async post(content, context) {
-        const denied = enforceAgentScope(this, content);
+        const denied = await enforceWriteAuth(this, content);
         if (denied)
             return denied;
         content.durability ||= "permanent";
@@ -20,7 +29,7 @@ export class Soul extends databases.flair.Soul {
         return super.post(content, context);
     }
     async put(content, context) {
-        const denied = enforceAgentScope(this, content);
+        const denied = await enforceWriteAuth(this, content);
         if (denied)
             return denied;
         content.updatedAt = new Date().toISOString();

package/dist/resources/SoulFeed.js

@@ -1,5 +1,12 @@
 import { Resource, databases } from '@harperfast/harper';
+import { allowVerified } from './agent-auth.js';
 export class FeedSouls extends Resource {
+    // Self-authorize the subscription via the Ed25519 agent verify (auth reshape
+    // removes the gate's admin elevation). FeedSouls extends Resource (not a Table),
+    // so getContext().request is reachable in allow* — same pattern as SemanticSearch.
+    async allowRead() {
+        return allowVerified(this.getContext?.());
+    }
     async *connect(target, incomingMessages) {
         const subscription = await databases.flair.Soul.subscribe(target);
         if (!incomingMessages) {

package/dist/resources/WorkspaceLatest.js

@@ -5,7 +5,14 @@
  * Auth: requesting agent must match agentId in path (or be admin).
  */
 import { Resource, databases } from "@harperfast/harper";
+import { allowVerified } from "./agent-auth.js";
 export class WorkspaceLatest extends Resource {
+    // Self-authorize via the Ed25519 agent verify (auth reshape removes the gate's
+    // admin elevation). Any verified agent may read; the path-vs-agent ownership
+    // check stays in get().
+    async allowRead() {
+        return allowVerified(this.getContext?.());
+    }
     async get(pathInfo) {
         const request = this.context?.request ?? this.request;
         const callerAgent = request?.tpsAgent;

package/dist/resources/WorkspaceState.js

@@ -8,30 +8,30 @@
  * Use this.getContext() to access request context (tpsAgent, tpsAgentIsAdmin).
  */
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
 export class WorkspaceState extends databases.flair.WorkspaceState {
-    /**
-     * Helper to extract auth info from Harper's Resource instance context.
-     */
-    _authInfo() {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        return {
-            agentId: request?.tpsAgent,
-            isAdmin: request?.tpsAgentIsAdmin ?? false,
-        };
+    /** Auth verdict from the request context. internal = trusted in-process call;
+     *  agent = verified Ed25519; anonymous = HTTP with no valid agent → deny. */
+    _auth() {
+        return resolveAgentAuth(this.getContext?.());
     }
     /**
-     * Override search() to scope collection GETs to the authenticated agent's
-     * own workspace state records. Admin agents see all records.
+     * Override search() to scope collection GETs to the authenticated agent's own
+     * records. Internal calls + admin agents see all; anonymous is denied
+     * (previously `!authAgent` was treated as unfiltered — the anonymous-read leak).
      */
     async search(query) {
-        const { agentId: authAgent, isAdmin: isAdminAgent } = this._authInfo();
-        if (!authAgent || isAdminAgent) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        const agentIdCondition = { attribute: "agentId", comparator: "equals", value: authAgent };
-        // Harper passes `query` as a request target object (with pathname, id, isCollection, etc.)
-        // Inject scope condition into its `.conditions` array so Table.search() processes it correctly.
+        const agentIdCondition = { attribute: "agentId", comparator: "equals", value: auth.agentId };
+        // Harper passes `query` as a request target object (pathname, id, isCollection…).
+        // Inject the scope condition into its `.conditions` array.
         if (query && typeof query === "object" && !Array.isArray(query)) {
             const existing = query.conditions ?? [];
             query.conditions = Array.isArray(existing)
@@ -45,31 +45,41 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
         return super.search(conditions);
     }
     async post(content) {
-        const { agentId, isAdmin: isAdminAgent } = this._authInfo();
-        // Agent-scoped: agentId in body must match authenticated agent
-        if (agentId && !isAdminAgent && content.agentId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: cannot write workspace state for another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        const auth = await this._auth();
+        // Anonymous must NOT write (previously the agentId check was skipped when
+        // there was no authenticated agent, so anonymous could write any record).
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot write workspace state for another agent");
         }
         content.createdAt = new Date().toISOString();
         content.timestamp ||= content.createdAt;
         return super.post(content);
     }
     async put(content) {
-        const { agentId, isAdmin: isAdminAgent } = this._authInfo();
-        if (agentId && !isAdminAgent && content.agentId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: cannot write workspace state for another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot write workspace state for another agent");
         }
         return super.put(content);
     }
     async delete(id) {
-        const { agentId, isAdmin: isAdminAgent } = this._authInfo();
-        if (!agentId)
+        const auth = await this._auth();
+        // Anonymous must NOT delete (previously `!agentId → super.delete` let anonymous
+        // delete any record).
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id);
+        }
         const record = await this.get(id);
         if (!record)
             return super.delete(id);
-        if (!isAdminAgent && record.agentId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: cannot delete workspace state for another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        if (record.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot delete workspace state for another agent");
         }
         return super.delete(id);
     }

package/dist/resources/XAA.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
 import { createHash, randomBytes } from "node:crypto";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 /**
@@ -252,6 +253,13 @@ export async function handleJwtBearerGrant(data) {
  * Admin-only access.
  */
 export class IdpConfig extends databases.flair.IdpConfig {
+    // Admin-only on every path (the "Admin-only" comment was previously unenforced —
+    // a pure put() override with no auth check, so the non-rejecting gate let
+    // anonymous through to Harper's handler). allowAdmin permits admin + internal.
+    allowRead() { return allowAdmin(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
     async put(content) {
         const now = nowISO();
         content.enabled ??= true;