@tpsdev-ai/flair 0.5.2 → 0.5.6

package/dist/cli.js

@@ -7,7 +7,28 @@ import { join, resolve as resolvePath } from "node:path";
 import { spawn } from "node:child_process";
 import { createPrivateKey, sign as nodeCryptoSign, randomUUID } from "node:crypto";
 import { keystore } from "./keystore.js";
-import { signBody } from "../resources/federation-crypto.js";
+// Federation crypto helpers — inlined to avoid cross-boundary imports from
+// src/ into resources/, which don't survive npm packaging (see also
+// resources/federation-crypto.ts; the two must stay in sync).
+function sortKeys(val) {
+    if (val === null || val === undefined || typeof val !== "object")
+        return val;
+    if (Array.isArray(val))
+        return val.map(sortKeys);
+    const sorted = {};
+    for (const key of Object.keys(val).sort()) {
+        sorted[key] = sortKeys(val[key]);
+    }
+    return sorted;
+}
+function canonicalize(obj) {
+    return JSON.stringify(sortKeys(obj));
+}
+function signBody(body, secretKey) {
+    const message = new TextEncoder().encode(canonicalize(body));
+    const sig = nacl.sign.detached(message, secretKey);
+    return Buffer.from(sig).toString("base64url");
+}
 // ─── Defaults ────────────────────────────────────────────────────────────────
 const DEFAULT_PORT = 19926;
 const DEFAULT_OPS_PORT = 19925;
@@ -232,7 +253,7 @@ async function authFetch(baseUrl, agentId, keyPath, method, path, body) {
     });
 }
 async function waitForHealth(httpPort, adminUser, adminPass, timeoutMs) {
-    const url = `http://127.0.0.1:${httpPort}/health`;
+    const url = `http://127.0.0.1:${httpPort}/Health`;
     const deadline = Date.now() + timeoutMs;
     let attempt = 0;
     while (Date.now() < deadline) {
@@ -242,7 +263,9 @@ async function waitForHealth(httpPort, adminUser, adminPass, timeoutMs) {
                 headers: { Authorization: `Basic ${Buffer.from(`${adminUser}:${adminPass}`).toString("base64")}` },
                 signal: AbortSignal.timeout(2000),
             });
-            if (res.status > 0)
+            // 2xx = healthy; 401 = Harper up but credentials wrong — still "reachable"
+            // enough for restart success. Anything else (5xx, 502 during shutdown) keeps polling.
+            if (res.ok || res.status === 401)
                 return;
         }
         catch { /* not ready yet */ }
@@ -250,6 +273,35 @@ async function waitForHealth(httpPort, adminUser, adminPass, timeoutMs) {
     }
     throw new Error(`Harper at port ${httpPort} did not respond within ${timeoutMs}ms (${attempt} attempts)`);
 }
+// Blocks until the given PID is gone (ESRCH from signal 0), or timeout.
+// Used during restart to confirm the old Harper process actually exited before
+// we start polling /Health — otherwise the still-shutting-down old process can
+// answer and we'd declare restart success while a gap is still ahead.
+async function waitForProcessExit(pid, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            process.kill(pid, 0);
+        }
+        catch {
+            return;
+        }
+        await new Promise((r) => setTimeout(r, HEALTH_POLL_INTERVAL_MS));
+    }
+    throw new Error(`Process ${pid} did not exit within ${timeoutMs}ms`);
+}
+function readHarperPid(dataDir) {
+    const pidFile = join(dataDir, "hdb.pid");
+    if (!existsSync(pidFile))
+        return null;
+    try {
+        const n = Number(readFileSync(pidFile, "utf-8").trim());
+        return Number.isInteger(n) && n > 0 ? n : null;
+    }
+    catch {
+        return null;
+    }
+}
 async function seedAgentViaOpsApi(opsPort, agentId, pubKeyB64url, adminUser, adminPass) {
     const url = `http://127.0.0.1:${opsPort}/`;
     const auth = Buffer.from(`${adminUser}:${adminPass}`).toString("base64");
@@ -1283,8 +1335,8 @@ program
         table: "MemoryGrant",
         records: [{
                 id: grantId,
-                fromAgentId: fromAgent,
-                toAgentId: toAgent,
+                ownerId: fromAgent,
+                granteeId: toAgent,
                 scope,
                 createdAt: new Date().toISOString(),
             }],
@@ -2118,11 +2170,16 @@ program
                     execSync(`launchctl load "${plistPath}"`, { stdio: "pipe" });
                 }
                 catch { }
-                // Stop the service — KeepAlive=true in the plist auto-restarts it
+                // Capture the current PID *before* stopping so we can verify exit. Without
+                // this, waitForHealth can race against the still-shutting-down old process
+                // and return success before KeepAlive brings the new one up.
+                const oldPid = readHarperPid(defaultDataDir());
                 try {
                     execSync(`launchctl stop ${label}`, { stdio: "pipe" });
                 }
                 catch { }
+                if (oldPid)
+                    await waitForProcessExit(oldPid, STARTUP_TIMEOUT_MS);
                 await waitForHealth(port, DEFAULT_ADMIN_USER, process.env.HDB_ADMIN_PASSWORD ?? "", STARTUP_TIMEOUT_MS);
                 console.log("✅ Flair restarted");
                 return;
@@ -2157,16 +2214,22 @@ program
             process.exit(1);
         }
         const dataDir = defaultDataDir();
-        const adminPass = process.env.HDB_ADMIN_PASSWORD ?? "";
+        // Match `flair start`: accept either HDB_ADMIN_PASSWORD or FLAIR_ADMIN_PASS.
+        // Without this, `flair init --admin-pass X` (which only exports HDB_*
+        // to the initial Harper spawn) followed by `flair restart` would silently
+        // drop admin credentials — any subsequent auth'd call returns 401.
+        const adminPass = process.env.HDB_ADMIN_PASSWORD || process.env.FLAIR_ADMIN_PASS || "";
         const env = {
             ...process.env,
             ROOTPATH: dataDir,
             DEFAULTS_MODE: "dev",
             HDB_ADMIN_USERNAME: DEFAULT_ADMIN_USER,
-            HDB_ADMIN_PASSWORD: adminPass,
             HTTP_PORT: String(port),
             LOCAL_STUDIO: "false",
         };
+        if (adminPass) {
+            env.HDB_ADMIN_PASSWORD = adminPass;
+        }
         const proc = spawn(process.execPath, [bin, "run", "."], {
             cwd: flairPackageDir(), env, detached: true, stdio: "ignore",
         });

package/dist/resources/MemoryBootstrap.js

@@ -41,24 +41,34 @@ function formatMemory(m, supersedes) {
 }
 export class BootstrapMemories extends Resource {
     async post(data, _context) {
-        const { agentId, currentTask, maxTokens = 4000, includeSoul = true, since, channel, // e.g., "discord", "tps-mail", "claude-code"
+        const { agentId: bodyAgentId, currentTask, maxTokens = 4000, includeSoul = true, since, channel, // e.g., "discord", "tps-mail", "claude-code"
         surface, // e.g., "tps-build", "tps-review", "cli-session"
         subjects, // e.g., ["flair", "auth"] — entities to preload context for
          } = data || {};
-        if (!agentId) {
+        // Authenticated identity lives on getContext().request — `this.request` is
+        // NOT populated on Harper v5 Resources. Reading it returned undefined and
+        // the scope check was silently bypassed, letting a non-admin agent read
+        // another agent's soul + memories by passing the victim's id in the body.
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        const authenticatedAgent = request?.tpsAgent ?? request?.headers?.get?.("x-tps-agent");
+        const callerIsAdmin = request?.tpsAgentIsAdmin === true;
+        if (!bodyAgentId && !authenticatedAgent) {
             return new Response(JSON.stringify({ error: "agentId required" }), {
                 status: 400,
                 headers: { "Content-Type": "application/json" },
             });
         }
-        // Defense-in-depth: agentId must match authenticated agent
-        const authenticatedAgent = this.request?.headers?.get?.("x-tps-agent");
-        const callerIsAdmin = this.request?.tpsAgentIsAdmin === true;
-        if (authenticatedAgent && !callerIsAdmin && agentId !== authenticatedAgent) {
+        if (authenticatedAgent && !callerIsAdmin && bodyAgentId && bodyAgentId !== authenticatedAgent) {
             return new Response(JSON.stringify({
                 error: "forbidden: agentId must match authenticated agent",
             }), { status: 403, headers: { "Content-Type": "application/json" } });
         }
+        // Pin scope to the authenticated agent for non-admins; admins can bootstrap
+        // any agentId (needed for setup scripts and UI impersonation flows).
+        const agentId = (authenticatedAgent && !callerIsAdmin)
+            ? authenticatedAgent
+            : bodyAgentId;
         const sections = {
             soul: [],
             skills: [],

package/dist/resources/MemoryConsolidate.js

@@ -57,13 +57,22 @@ function evaluate(record, now, olderThanMs) {
 }
 export class ConsolidateMemories extends Resource {
     async post(data) {
-        const { agentId, scope = "persistent", olderThan = "30d", limit = 20 } = data || {};
-        if (!agentId)
+        const { agentId: bodyAgentId, scope = "persistent", olderThan = "30d", limit = 20 } = data || {};
+        // See SemanticSearch / MemoryBootstrap — `this.request` isn't populated on
+        // Harper v5 Resources, so the prior actorId check was silently bypassed
+        // and bob could enumerate alice's consolidation candidates (her memory records).
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        const actorId = request?.tpsAgent;
+        const callerIsAdmin = request?.tpsAgentIsAdmin === true
+            || (actorId ? await isAdmin(actorId) : false);
+        if (!bodyAgentId && !actorId) {
             return new Response(JSON.stringify({ error: "agentId required" }), { status: 400 });
-        const actorId = this.request?.tpsAgent;
-        if (actorId && actorId !== agentId && !(await isAdmin(actorId))) {
+        }
+        if (actorId && !callerIsAdmin && bodyAgentId && bodyAgentId !== actorId) {
             return new Response(JSON.stringify({ error: "forbidden: can only consolidate own memories" }), { status: 403 });
         }
+        const agentId = (actorId && !callerIsAdmin) ? actorId : bodyAgentId;
         const olderThanMs = parseDuration(olderThan);
         const now = Date.now();
         const candidates = [];

package/dist/resources/MemoryReflect.js

@@ -30,14 +30,23 @@ const FOCUS_PROMPTS = {
 };
 export class ReflectMemories extends Resource {
     async post(data) {
-        const { agentId, scope = "recent", since, maxMemories = 50, focus = "lessons_learned", tag, } = data || {};
-        if (!agentId)
+        const { agentId: bodyAgentId, scope = "recent", since, maxMemories = 50, focus = "lessons_learned", tag, } = data || {};
+        // Authenticated identity comes from getContext().request, not this.request
+        // (see SemanticSearch / MemoryBootstrap for the same bug class). The prior
+        // check was silently bypassed — bob could reflect on alice's memories and
+        // mutate alice's records via the lastReflected patchRecordSilent below.
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        const actorId = request?.tpsAgent;
+        const callerIsAdmin = request?.tpsAgentIsAdmin === true
+            || (actorId ? await isAdmin(actorId) : false);
+        if (!bodyAgentId && !actorId) {
             return new Response(JSON.stringify({ error: "agentId required" }), { status: 400 });
-        // Auth: agent can only reflect on own memories unless admin
-        const actorId = this.request?.tpsAgent;
-        if (actorId && actorId !== agentId && !(await isAdmin(actorId))) {
+        }
+        if (actorId && !callerIsAdmin && bodyAgentId && bodyAgentId !== actorId) {
             return new Response(JSON.stringify({ error: "forbidden: can only reflect on own memories" }), { status: 403 });
         }
+        const agentId = (actorId && !callerIsAdmin) ? actorId : bodyAgentId;
         const sinceDate = since ? new Date(since) : new Date(Date.now() - 24 * 3600_000);
         const memories = [];
         for await (const record of databases.flair.Memory.search()) {

package/dist/resources/SemanticSearch.js

@@ -46,13 +46,20 @@ function distanceToSimilarity(distance) {
 const CANDIDATE_MULTIPLIER = 5;
 export class SemanticSearch extends Resource {
     async post(data) {
-        const { agentId, q, queryEmbedding, tag, subject, subjects, limit = 10, includeSuperseded = false, scoring = "composite", minScore = 0, since, asOf } = data || {};
-        // Rate limiting — use authenticated agent ID from request context, not client-supplied body
-        const rateLimitAgent = this.request?.headers?.get?.("x-tps-agent")
-            ?? this.request?.tpsAgent;
-        if (rateLimitAgent) {
+        const { agentId: bodyAgentId, q, queryEmbedding, tag, subject, subjects, limit = 10, includeSuperseded = false, scoring = "composite", minScore = 0, since, asOf } = data || {};
+        // Authenticated identity lives on the Harper Resource context (getContext().request).
+        // `this.request` is NOT populated on Harper v5 Resources — prior reads here
+        // silently returned undefined and the defense-in-depth scope check below
+        // was bypassed, letting a non-admin agent read another agent's memories
+        // by putting the victim's id in the body.
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        const authenticatedAgent = request?.tpsAgent ?? request?.headers?.get?.("x-tps-agent");
+        const callerIsAdmin = request?.tpsAgentIsAdmin === true;
+        // Rate limiting — use authenticated agent ID, not client-supplied body
+        if (authenticatedAgent) {
             const bucket = q && !queryEmbedding ? "embedding" : "general";
-            const rl = checkRateLimit(rateLimitAgent, bucket);
+            const rl = checkRateLimit(authenticatedAgent, bucket);
             if (!rl.allowed)
                 return rateLimitResponse(rl.retryAfterMs, "search");
         }
@@ -61,15 +68,19 @@ export class SemanticSearch extends Resource {
             : subject
                 ? new Set([subject.toLowerCase()])
                 : null;
-        // Defense-in-depth: verify agentId matches authenticated agent.
-        const authenticatedAgent = this.request?.headers?.get?.("x-tps-agent");
-        const callerIsAdmin = this.request?.tpsAgentIsAdmin === true;
-        if (authenticatedAgent && !callerIsAdmin && agentId && agentId !== authenticatedAgent) {
+        // Enforce agentId = authenticated agent for non-admins. A mismatched body
+        // agentId is a cross-agent read attempt — reject outright. Admins can query
+        // any agentId (needed for bootstrap / consolidation scripts).
+        if (authenticatedAgent && !callerIsAdmin && bodyAgentId && bodyAgentId !== authenticatedAgent) {
             return new Response(JSON.stringify({
                 error: "forbidden: agentId must match authenticated agent",
             }), { status: 403, headers: { "Content-Type": "application/json" } });
         }
-        // Determine searchable agent IDs (own + granted)
+        // Scope search to the authenticated agent (own + granted). For admins or
+        // unauthenticated internal calls, honor the body-supplied agentId.
+        const agentId = (authenticatedAgent && !callerIsAdmin)
+            ? authenticatedAgent
+            : bodyAgentId;
         const searchAgentIds = new Set();
         if (agentId)
             searchAgentIds.add(agentId);

package/dist/resources/auth-middleware.js

@@ -150,6 +150,12 @@ server.http(async (request, nextLayer) => {
                 request.headers.set("x-tps-agent", "admin");
                 if (request.headers.asObject)
                     request.headers.asObject["x-tps-agent"] = "admin";
+                // Basic admin auth IS admin — resource-level checks (SemanticSearch,
+                // MemoryBootstrap, MemoryReflect, MemoryConsolidate) gate cross-agent
+                // access on this flag. Prior to 0.5.5 the check was a no-op so this
+                // was never needed; now it must be set.
+                request.tpsAgent = "admin";
+                request.tpsAgentIsAdmin = true;
                 return nextLayer(request);
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.5.2",
+  "version": "0.5.6",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",
   "license": "Apache-2.0",
@@ -52,7 +52,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@harperfast/harper": "5.0.0",
+    "@harperfast/harper": "5.0.1",
     "commander": "14.0.3",
     "harper-fabric-embeddings": "0.2.2",
     "jose": "^6.2.2",