@tpsdev-ai/flair 0.18.0 → 0.19.0

package/dist/resources/Admin.js

@@ -1,12 +1,24 @@
 import { Resource } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /Admin — friendly redirect to /AdminDashboard.
  *
  * Operators bookmark or type the bare /Admin path. Without this resource
  * they hit a 404 and assume the admin UI is broken. The dashboard is the
  * canonical landing surface; redirect there.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): the /Admin* pathname
+ * gate in auth-middleware.ts only 401s when there's NO Authorization header
+ * at all (or Basic creds don't resolve to a real user) — a validly-verified
+ * TPS-Ed25519 agent that is NOT an admin, or a valid-but-non-super_user Basic
+ * user, currently sails through the middleware with no admin resource-level
+ * check at all. allowRead closes that gap the same way WorkspaceLatest.ts /
+ * MemoryReindex.ts already gate their own custom (non-@table) Resources.
  */
 export class Admin extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         return new Response("", {
             status: 302,

package/dist/resources/AdminConnectors.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminConnectors — OAuth clients and active sessions.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminConnectors extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const clients = [];
         try {

package/dist/resources/AdminDashboard.js

@@ -1,9 +1,18 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminDashboard — admin home page with system overview.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts for why
+ * this closes a real gap, not just belt-and-suspenders — a verified
+ * non-admin agent could otherwise read full instance stats (principal/agent/
+ * memory/relationship counts) with no admin check at all.
  */
 export class AdminDashboard extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         let principalCount = 0;
         let memoryCount = 0;

package/dist/resources/AdminIdp.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminIdp — enterprise IdP configuration management.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminIdp extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const idps = [];
         try {

package/dist/resources/AdminInstance.js

@@ -4,6 +4,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * Resolve the public URL operators reach this Flair on.
  *
@@ -83,8 +84,13 @@ function resolveVersion() {
 }
 /**
  * GET /AdminInstance — instance info, public key, version.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminInstance extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const version = resolveVersion();
         // Pass the request through so URL resolution can derive from

package/dist/resources/AdminMemory.js

@@ -1,5 +1,6 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminMemory                browse + search memories (list view)
  * GET /AdminMemory?id=<id>        per-memory detail view with full provenance pane
@@ -19,8 +20,15 @@ import { layout, htmlResponse, esc } from "./admin-layout.js";
  * "memory that follows the agent across orchestrators" — the provenance pane
  * makes that legible: every memory shows where it came from, what it derived
  * from, what it superseded, and which peer it synced from.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts — this
+ * page surfaces full memory content across ALL agents, so the gap it closes
+ * matters more here than on the other Admin* pages.
  */
 export class AdminMemory extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         // Harper v5 does not populate this.request on Resource subclasses —
         // getContext() is the only reliable path (ops-sal4: the previous

package/dist/resources/AdminPrincipals.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminPrincipals — list all principals with kind, trust, status.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminPrincipals extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const principals = [];
         try {

package/dist/resources/Integration.js

@@ -1,7 +1,8 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * Integration records are agent-owned. Auth: the non-rejecting gate annotates the
  * request; this resource self-enforces (resolveAgentAuth → internal/agent/anonymous).
@@ -12,6 +13,50 @@ export class Integration extends databases.flair.Integration {
     _auth() {
         return resolveAgentAuth(this.getContext?.());
     }
+    /**
+     * Self-authorize now that the global gate is non-rejecting (memory-soul-
+     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * WorkspaceState.ts/Relationship.ts). Closes the same P0 leak: Harper
+     * routes `GET /Integration/<id>` to get() and the collection describe
+     * (`GET /Integration`) outside search(), so neither was gated before this
+     * fix — an anonymous caller got a 200 with full record content. Per-record
+     * ownership scoping happens in get() below; the collection scope is still
+     * in search().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate family fix). Never distinguishes
+     * "doesn't exist" from "exists but not yours" — both return 404, never
+     * 403, so a denied caller can't use get() to enumerate other agents'
+     * integration ids.
+     */
+    async get(target) {
+        // Collection / query reads arrive as a RequestTarget with
+        // `isCollection === true`, and are governed by search() (same owner
+        // scoping). Only a genuine by-id get is ownership-checked below — see
+        // Memory.ts's get() for the full rationale (same bug class).
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const auth = await this._auth();
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: only its own integrations.
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        if (record.agentId !== auth.agentId)
+            return NOT_FOUND();
+        return record;
+    }
     async search(query) {
         const auth = await this._auth();
         if (auth.kind === "anonymous")
@@ -66,7 +111,12 @@ export class Integration extends databases.flair.Integration {
         if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id);
         }
-        const record = await this.get(id);
+        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // (a truthy Response) for a non-owner id, which would otherwise defeat
+        // the `if (!record)` check below and mis-route a genuinely-missing
+        // record into the FORBIDDEN branch instead of a clean super.delete(id)
+        // no-op. Mirrors Memory.ts's delete() — same rationale, same fix.
+        const record = await super.get(id);
         if (!record)
             return super.delete(id);
         if (record.agentId !== auth.agentId) {

package/dist/resources/Memory.js

@@ -1,12 +1,34 @@
 import { databases } from "@harperfast/harper";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
-import { isAdmin, resolveAgentAuth } from "./agent-auth.js";
+import { isAdmin, resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 import { DEDUP_COSINE_THRESHOLD_DEFAULT, DEDUP_LEXICAL_THRESHOLD_DEFAULT, DEDUP_MIN_CONTENT_LENGTH, computeMatchConfidence, isConservativeMatch, } from "./dedup.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
+/**
+ * Owner ids a non-admin agent may READ: itself, plus any owner who has
+ * granted it a "read" or "search" scoped MemoryGrant. Shared by search()
+ * (collection scoping) and get() (per-id ownership check, memory-soul-read-
+ * gate fix) so the two paths cannot drift apart — this was previously
+ * computed inline only inside search().
+ */
+async function resolveAllowedOwners(authAgentId) {
+    const allowedOwners = [authAgentId];
+    try {
+        for await (const grant of databases.flair.MemoryGrant.search({
+            conditions: [{ attribute: "granteeId", comparator: "equals", value: authAgentId }],
+        })) {
+            if (grant.ownerId && (grant.scope === "read" || grant.scope === "search")) {
+                allowedOwners.push(grant.ownerId);
+            }
+        }
+    }
+    catch { /* MemoryGrant table not yet populated — ignore */ }
+    return allowedOwners;
+}
 /**
  * ─── Server-side conservative-duplicate gate (memory-integrity fix) ──────────
  *
@@ -231,6 +253,65 @@ async function closeSupersededIfNeeded(ctx, content, methodLabel) {
     }
 }
 export class Memory extends databases.flair.Memory {
+    /**
+     * Self-authorize now that the global gate is non-rejecting. Closes the P0
+     * leak: Harper routes `GET /Memory/<id>` to get() and the collection
+     * describe (`GET /Memory`) to a path outside search() — neither was gated
+     * before this fix, so an anonymous caller got a 200 with full record
+     * content / schema even though search() (and the write paths) correctly
+     * 401/403'd. Per-record ownership/grant scoping happens in get() below;
+     * the collection scope is still in search().
+     *
+     * allowCreate/allowUpdate/allowDelete are deliberately NOT added here:
+     * post()/put()/delete() already self-enforce per-agent ownership inline
+     * (resolveAgentAuth + explicit agentId checks in post()/put(), and the
+     * isAdmin durability check in delete()). Adding allow* on top of that,
+     * unverified, risks regressing owner writes/deletes on a P0 security fix
+     * that is scoped to the read leak — left as-is on purpose.
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate fix). Never distinguishes
+     * "doesn't exist" from "exists but not yours" — both return 404, never
+     * 403, so a denied caller can't use get() to enumerate other agents'
+     * memory ids.
+     */
+    async get(target) {
+        // Collection / query reads — the `GET /Memory/?<query>` form and the bare
+        // collection — arrive as a RequestTarget with `isCollection === true`, and
+        // are governed by search() (same owner/grant scoping). Only a genuine by-id
+        // get is ownership-checked below. Without this guard, get() would receive
+        // the query's RequestTarget, super.get() would return the (truthy) result
+        // set, the single-record check would find no `.agentId` on it, and a valid
+        // authenticated self-query would 404 (regression caught by the auth-
+        // middleware e2e "TPS-Ed25519 on GET /Memory/?agentId=X → 200"). A by-id
+        // get (RequestTarget with isCollection false, or a bare id) falls through.
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const ctx = this.getContext?.();
+        const auth = await resolveAgentAuth(ctx);
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: only its own memories, or an owner's memories it holds
+        // a read/search MemoryGrant for (same owner-set as search() — shared
+        // resolveAllowedOwners helper so the two paths cannot drift).
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        const allowedOwners = await resolveAllowedOwners(auth.agentId);
+        if (!allowedOwners.includes(record.agentId))
+            return NOT_FOUND();
+        return record;
+    }
     /**
      * Override search() to scope collection GETs by authenticated agent.
      *
@@ -258,17 +339,7 @@ export class Memory extends databases.flair.Memory {
         }
         // Non-admin agent: scope to own + granted owners.
         const authAgent = auth.agentId;
-        const allowedOwners = [authAgent];
-        try {
-            for await (const grant of databases.flair.MemoryGrant.search({
-                conditions: [{ attribute: "granteeId", comparator: "equals", value: authAgent }],
-            })) {
-                if (grant.ownerId && (grant.scope === "read" || grant.scope === "search")) {
-                    allowedOwners.push(grant.ownerId);
-                }
-            }
-        }
-        catch { /* MemoryGrant table not yet populated — ignore */ }
+        const allowedOwners = await resolveAllowedOwners(authAgent);
         // Build the agentId scope condition
         const agentIdCondition = allowedOwners.length === 1
             ? { attribute: "agentId", comparator: "equals", value: allowedOwners[0] }
@@ -523,7 +594,15 @@ export class Memory extends databases.flair.Memory {
         return buildWriteResponse(content, result, dedupMatch);
     }
     async delete(id) {
-        const record = await this.get(id);
+        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // (a truthy Response) for a non-owner/non-granted id, which would
+        // otherwise short-circuit the `record.durability === "permanent"` check
+        // below (a Response has no .durability) and silently bypass the
+        // admin-only permanent-delete guard for cross-agent deletes. This keeps
+        // delete()'s own pre-existing ownership/admin logic exactly as it was
+        // before the read-gate fix — the read-scoping override must not leak
+        // into delete()'s internal record lookup.
+        const record = await super.get(id);
         if (!record)
             return super.delete(id);
         if (record.durability === "permanent") {

package/dist/resources/MemoryGrant.js

@@ -1,7 +1,8 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * MemoryGrant — an agent (ownerId) grants another (granteeId) scoped access to its
  * memories. Self-authorizes now that the global gate is non-rejecting (previously a
@@ -16,6 +17,52 @@ export class MemoryGrant extends databases.flair.MemoryGrant {
     _auth() {
         return resolveAgentAuth(this.getContext?.());
     }
+    /**
+     * Self-authorize now that the global gate is non-rejecting (memory-soul-
+     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * WorkspaceState.ts/Relationship.ts/Integration.ts). Closes the same P0
+     * leak: Harper routes `GET /MemoryGrant/<id>` to get() and the collection
+     * describe (`GET /MemoryGrant`) outside search(), so neither was gated
+     * before this fix — an anonymous caller got a 200 with full grant content.
+     * Per-record owner/grantee scoping happens in get() below; the collection
+     * scope is still in search().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate family fix). A grant is visible
+     * to either party (ownerId OR granteeId), mirroring search()'s owner-OR-
+     * grantee scope. Never distinguishes "doesn't exist" from "exists but not
+     * yours" — both return 404, never 403, so a denied caller can't use get()
+     * to enumerate other agents' grant ids.
+     */
+    async get(target) {
+        // Collection / query reads arrive as a RequestTarget with
+        // `isCollection === true`, and are governed by search() (same owner/
+        // grantee scoping). Only a genuine by-id get is ownership-checked below
+        // — see Memory.ts's get() for the full rationale (same bug class).
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const auth = await this._auth();
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: visible if it's the owner OR the grantee (parity with
+        // search()'s owner-OR-grantee scope).
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        if (record.ownerId !== auth.agentId && record.granteeId !== auth.agentId)
+            return NOT_FOUND();
+        return record;
+    }
     async search(query) {
         const auth = await this._auth();
         if (auth.kind === "anonymous")
@@ -59,7 +106,13 @@ export class MemoryGrant extends databases.flair.MemoryGrant {
         if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id, context);
         }
-        const record = await this.get(id);
+        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // (a truthy Response) for a non-owner/non-grantee id, which would
+        // otherwise defeat the `if (!record)` check below and mis-route a
+        // genuinely-missing record into the FORBIDDEN branch instead of a clean
+        // super.delete(id, context) no-op. Mirrors Memory.ts's delete() — same
+        // rationale, same fix.
+        const record = await super.get(id);
         if (!record)
             return super.delete(id, context);
         if (record.ownerId !== auth.agentId) {

package/dist/resources/Relationship.js

@@ -1,6 +1,7 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * Relationship resource — entity-to-entity relationships with temporal validity.
  *
@@ -13,6 +14,53 @@ import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
  * Admin agents can query across all agents.
  */
 export class Relationship extends databases.flair.Relationship {
+    /**
+     * Self-authorize now that the global gate is non-rejecting (memory-soul-
+     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * WorkspaceState.ts). Closes the same P0 leak: Harper routes
+     * `GET /Relationship/<id>` to get() and the collection describe
+     * (`GET /Relationship`) outside search(), so neither was gated before this
+     * fix — an anonymous caller got a 200 with full record content. Per-record
+     * ownership scoping happens in get() below; the collection scope is still
+     * in search().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate family fix). Never distinguishes
+     * "doesn't exist" from "exists but not yours" — both return 404, never
+     * 403, so a denied caller can't use get() to enumerate other agents'
+     * relationship ids.
+     */
+    async get(target) {
+        // Collection / query reads arrive as a RequestTarget with
+        // `isCollection === true`, and are governed by search() (same owner
+        // scoping). Only a genuine by-id get is ownership-checked below — see
+        // Memory.ts's get() for the full rationale (same bug class: without this
+        // guard, a query's RequestTarget would flow into super.get(), return the
+        // whole result set, and the single-record ownership check below would
+        // find no `.agentId` on it).
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: only its own relationships.
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        if (record.agentId !== auth.agentId)
+            return NOT_FOUND();
+        return record;
+    }
     async search(query) {
         const auth = await resolveAgentAuth(this.getContext?.());
         // Anonymous HTTP must NOT read relationships (previously `!authAgent` was

package/dist/resources/Soul.js

@@ -1,5 +1,5 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
 /**
@@ -19,6 +19,17 @@ async function enforceWriteAuth(self, data) {
     return null;
 }
 export class Soul extends databases.flair.Soul {
+    /**
+     * Self-authorize now that the global gate is non-rejecting. Closes the P0
+     * leak: Harper routes `GET /Soul/<id>` to get() and the collection
+     * describe (`GET /Soul`) to a path outside search()/allow* — neither was
+     * gated before this fix, so an anonymous caller got a 200 with full soul
+     * content. Deliberately NO get() override / per-agent scoping on top of
+     * this: souls are identity/discovery data, intentionally readable by any
+     * verified agent — same posture as Agent.ts's allowRead. Write ownership
+     * is unaffected — enforceWriteAuth() below already gates post()/put().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
     async post(content, context) {
         const denied = await enforceWriteAuth(this, content);
         if (denied)

package/dist/resources/WorkspaceState.js

@@ -8,15 +8,64 @@
  * Use this.getContext() to access request context (tpsAgent, tpsAgentIsAdmin).
  */
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 export class WorkspaceState extends databases.flair.WorkspaceState {
     /** Auth verdict from the request context. internal = trusted in-process call;
      *  agent = verified Ed25519; anonymous = HTTP with no valid agent → deny. */
     _auth() {
         return resolveAgentAuth(this.getContext?.());
     }
+    /**
+     * Self-authorize now that the global gate is non-rejecting (memory-soul-
+     * read-gate family fix, ops-oox7 — applying the Memory.ts/Soul.ts pattern
+     * to WorkspaceState/Relationship/Integration/MemoryGrant). Closes the same
+     * P0 leak: Harper routes `GET /WorkspaceState/<id>` to get() and the
+     * collection describe (`GET /WorkspaceState`) to a path outside search(),
+     * so neither was gated before this fix — an anonymous caller got a 200 with
+     * full record content. Per-record ownership scoping happens in get() below;
+     * the collection scope is still in search().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate family fix). Never distinguishes
+     * "doesn't exist" from "exists but not yours" — both return 404, never
+     * 403, so a denied caller can't use get() to enumerate other agents'
+     * workspace-state ids.
+     */
+    async get(target) {
+        // Collection / query reads — the `GET /WorkspaceState/?<query>` form and
+        // the bare collection — arrive as a RequestTarget with `isCollection ===
+        // true`, and are governed by search() (same owner scoping). Only a
+        // genuine by-id get is ownership-checked below. Without this guard,
+        // get() would receive the query's RequestTarget, super.get() would
+        // return the (truthy) result set, and the single-record ownership check
+        // would find no `.agentId` on it (see Memory.ts's get() for the full
+        // rationale — same bug class).
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const auth = await this._auth();
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: only its own workspace-state records.
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        if (record.agentId !== auth.agentId)
+            return NOT_FOUND();
+        return record;
+    }
     /**
      * Override search() to scope collection GETs to the authenticated agent's own
      * records. Internal calls + admin agents see all; anonymous is denied
@@ -85,7 +134,12 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
         if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id);
         }
-        const record = await this.get(id);
+        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // (a truthy Response) for a non-owner id, which would otherwise defeat
+        // the `if (!record)` check below and mis-route a genuinely-missing
+        // record into the FORBIDDEN branch instead of a clean super.delete(id)
+        // no-op. Mirrors Memory.ts's delete() — same rationale, same fix.
+        const record = await super.get(id);
         if (!record)
             return super.delete(id);
         if (record.agentId !== auth.agentId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",
   "license": "Apache-2.0",