@volter/teams 0.2.3 → 0.2.5

package/board-process-guard.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// The board's native PreToolUse command policy. No process lookup or signal occurs here.
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+export const processGuardReason = 'Pattern kills are refused for board sessions. Kill only the PID this session recorded when it started that process; use the owning service door for a service.';
+export function patternKill(command) {
+  // Inspect shell bodies as well as nested `sh -c` / substitutions. Removing shell
+  // escapes and quotes catches split words, paths and quoted embedded commands.
+  const text = String(command).replace(/\\\r?\n/g, '').replace(/\\([a-zA-Z-])/g, '$1').replace(/["']/g, '');
+  const head = String.raw`(?:^|[;|&(\n{}]|\s-[a-zA-Z]*c\s+)\s*(?:(?:env|sudo|exec|command|xargs|nohup|do|then|else|!)\s+(?:--?[^\s;|&()]+\s+)*|[A-Za-z_][A-Za-z0-9_]*=[^\s;|&()]+\s+)*(?:[\w./-]+/)?`;
+  return new RegExp(head + String.raw`(?:pkill|killall)(?=$|[\s;|&()])`).test(text) ||
+    new RegExp(head + String.raw`pgrep\s+[^;|&\n)]*(?:--full\b|-[a-zA-Z]*f[a-zA-Z]*(?=$|\s))`).test(text);
+}
+const quote = value => `'${String(value).replaceAll("'", "'\\''")}'`;
+export function boardGuardArguments(kind, args, { cwd, enabled, node = process.execPath } = {}) {
+  if (!enabled) return args;
+  const command = `${quote(node)} ${quote(fileURLToPath(import.meta.url))}`;
+  const hooks = [{ matcher: '^Bash$', hooks: [{ type: 'command', command, timeout: 10 }] }];
+  if (kind === 'claude-code') {
+    const next = [...args], at = next.findIndex(arg => arg === '--settings' || arg.startsWith('--settings='));
+    if (at < 0) return [...next, '--settings', JSON.stringify({ hooks: { PreToolUse: hooks } })];
+    const inline = next[at].startsWith('--settings='), value = inline ? next[at].slice(11) : next[at + 1];
+    const settings = JSON.parse(value?.trimStart().startsWith('{') ? value : readFileSync(resolve(cwd || process.cwd(), value), 'utf8'));
+    settings.hooks ??= {}; settings.hooks.PreToolUse = [...(settings.hooks.PreToolUse ?? []), ...hooks];
+    next.splice(at, inline ? 1 : 2, '--settings', JSON.stringify(settings));
+    return next;
+  }
+  if (kind === 'codex') {
+    // Native Codex rules cannot split substitutions such as kill $(pgrep -f …).
+    // Its synchronous Bash hook can deny the entire command before execution.
+    // This invocation enables and trusts the board-vetted command policy.
+    const handler = `{ matcher = "^Bash$", hooks = [{ type = "command", command = ${JSON.stringify(command)}, timeout = 10 }] }`;
+    // Codex's own flags go before any subcommand (`app-server`, `resume`) or prompt: after `app-server`, Codex
+    // 0.159 refuses --dangerously-bypass-hook-trust and the worker never starts.
+    return [...(args.includes('--dangerously-bypass-hook-trust') ? [] : ['--dangerously-bypass-hook-trust']), '-c', 'features.hooks=true', '-c', `hooks.PreToolUse=[${handler}]`, ...args];
+  }
+  throw new Error(`board process guard is unavailable for ${kind}; no unguarded session was launched`);
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const input = JSON.parse(readFileSync(0, 'utf8'));
+    const command = input.tool_input?.command ?? input.tool_input?.cmd;
+    if (typeof command !== 'string') throw new Error('Bash hook input has no command');
+    if (patternKill(command)) process.stdout.write(JSON.stringify({ hookSpecificOutput: {
+      hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: processGuardReason,
+    } }) + '\n');
+  } catch (error) {
+    process.stderr.write(`Board process policy could not read the command: ${error.message}. ${processGuardReason}\n`);
+    process.exitCode = 2;
+  }
+}

package/event-limits.mjs

@@ -0,0 +1,3 @@
+// What one published event may carry: the server refuses a source event whose `data` serializes above this many
+// bytes, and a publisher fits its snapshot to it before sending.
+export const EVENT_DATA_LIMIT = 262144;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",
@@ -45,8 +45,10 @@
     },
     "./context": "./context.mjs",
     "./event-client": "./event-client.mjs",
+    "./event-limits": "./event-limits.mjs",
     "./machine-door": "./machine-door.mjs",
     "./sender-identity": "./sender-identity.mjs",
+    "./board-process-guard": "./board-process-guard.mjs",
     "./server/agent-authority": "./server/agent-authority.mjs"
   },
   "files": [

package/server/agent-authority.mjs

@@ -1,4 +1,6 @@
 // Live agency and delegation are evaluated from the store; identity labels and environment hints grant nothing.
+// A seed's standing people are a CTE, not a subquery nested under the chain's: a hosted Teams server (a Durable
+// Object) prepares SQL under SQLite's expression-depth cap of 100, and this query is nested inside others (auth.mjs).
 export const AGENT_ACTIVE = `WITH RECURSIVE scope(team,id) AS (VALUES(?,?)), chain(id) AS (
  SELECT a.id FROM agents a,scope s WHERE a.team_id=s.team AND a.id=s.id
  UNION SELECT a.parent_id FROM agents a JOIN chain c ON a.id=c.id,scope s WHERE a.team_id=s.team AND a.parent_id IS NOT NULL
@@ -12,10 +14,11 @@ export const AGENT_ACTIVE = `WITH RECURSIVE scope(team,id) AS (VALUES(?,?)), cha
  UNION SELECT g.seed,json_extract(CASE WHEN j.type='object' THEN j.value ELSE '{}' END,'$.id') FROM agents a JOIN ancestry g ON a.id=g.id,scope s,json_tree(a.lineage_json,'$.starter') j WHERE a.team_id=s.team AND j.type='object' AND json_extract(CASE WHEN j.type='object' THEN j.value ELSE '{}' END,'$.kind')='person'
  UNION SELECT g.seed,ps.sponsor_id FROM agents a JOIN ancestry g ON a.id=g.id JOIN json_tree(a.lineage_json,'$.starter') j ON j.type='object' JOIN principal_sponsors ps ON ps.team_id=a.team_id AND ps.principal_id=json_extract(CASE WHEN j.type='object' THEN j.value ELSE '{}' END,'$.id'),scope s WHERE a.team_id=s.team
  UNION SELECT g.seed,i.installer_id FROM agents a JOIN ancestry g ON a.id=g.id JOIN json_tree(a.lineage_json,'$.starter') j ON j.type='object' JOIN app_installations i ON i.team_id=a.team_id AND i.principal_id=json_extract(CASE WHEN j.type='object' THEN j.value ELSE '{}' END,'$.id') AND i.state='active' JOIN apps app ON app.id=i.app_id AND app.state='active',scope s WHERE a.team_id=s.team
+), standing(seed) AS (
+ SELECT x.seed FROM people x JOIN principals p ON p.id=x.id,scope s WHERE x.seed IS NOT NULL AND p.kind='user' AND
+  (EXISTS(SELECT 1 FROM memberships m WHERE m.team_id=s.team AND m.principal_id=p.id AND m.active=1)
+   OR EXISTS(SELECT 1 FROM identity_principals ip WHERE ip.team_id=s.team AND ip.principal_id=p.id)
+   AND NOT EXISTS(SELECT 1 FROM memberships m WHERE m.team_id=s.team AND m.principal_id=p.id AND m.active=0))
 ) SELECT 1 FROM agents root,scope s WHERE root.id=s.id AND root.team_id=s.team
- AND NOT EXISTS(SELECT 1 FROM chain c LEFT JOIN agents a ON a.id=c.id AND a.team_id=s.team WHERE a.id IS NULL OR a.state!='active' OR NOT EXISTS(
-  SELECT 1 FROM people x JOIN principals p ON p.id=x.id WHERE x.seed=a.id AND p.kind='user' AND
-   (EXISTS(SELECT 1 FROM memberships m WHERE m.team_id=s.team AND m.principal_id=p.id AND m.active=1)
-    OR EXISTS(SELECT 1 FROM identity_principals ip WHERE ip.team_id=s.team AND ip.principal_id=p.id)
-    AND NOT EXISTS(SELECT 1 FROM memberships m WHERE m.team_id=s.team AND m.principal_id=p.id AND m.active=0))))`;
+ AND NOT EXISTS(SELECT 1 FROM chain c LEFT JOIN agents a ON a.id=c.id AND a.team_id=s.team WHERE a.id IS NULL OR a.state!='active' OR a.id NOT IN (SELECT seed FROM standing))`;
 export const AGENT_DESCENDANTS = `WITH RECURSIVE tree(id) AS (SELECT id FROM agents WHERE team_id=? AND id=? UNION SELECT a.id FROM agents a JOIN tree t ON a.parent_id=t.id) SELECT id FROM tree`;

package/server/auth.mjs

@@ -14,8 +14,10 @@ export const APP_LINEAGE = `WITH RECURSIVE lineage(id) AS (
   UNION SELECT d.parent_credential_id FROM agent_credentials d JOIN lineage l ON d.credential_id=l.id
   UNION SELECT ac.subject_credential_id FROM app_credentials ac JOIN lineage l ON ac.credential_id=l.id WHERE ac.subject_credential_id IS NOT NULL
 )`;
-export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}
-  SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id
+// One compound term per way a lineage is revoked, and each agent's standing over a flat list of the lineage's agents
+// and actors: a hosted Teams server (a Durable Object) prepares SQL under SQLite's expression-depth cap of 100, and the
+// one OR over nested AGENT_ACTIVE subqueries needed about 125.
+const LINEAGE_ROWS = `FROM lineage l JOIN credentials c ON c.id=l.id
   JOIN principals p ON p.id=c.principal_id
   LEFT JOIN memberships m ON m.team_id=c.team_id AND m.principal_id=c.principal_id
   LEFT JOIN app_credentials ac ON ac.credential_id=c.id
@@ -23,16 +25,21 @@ export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}
   LEFT JOIN app_installations i ON i.id=COALESCE(ac.installation_id,ic.installation_id)
   LEFT JOIN apps a ON a.id=i.app_id
   LEFT JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id
-  LEFT JOIN memberships service ON service.team_id=i.team_id AND service.principal_id=i.principal_id
-  WHERE (p.kind='agent' AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT c.team_id,c.principal_id')}))
-    OR EXISTS(SELECT 1 FROM json_each(COALESCE(ac.actor_json,'[]')) actor
-      JOIN agents named ON named.team_id=c.team_id AND named.id=actor.value
-      WHERE actor.type='text' AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT named.team_id,named.id')}))
-    OR EXISTS(SELECT 1 FROM agent_credentials d LEFT JOIN memberships dm ON dm.team_id=d.team_id AND dm.principal_id=c.principal_id WHERE d.parent_credential_id=c.id AND d.credential_id IN(SELECT id FROM lineage) AND COALESCE(dm.active,0)!=1)
+  LEFT JOIN memberships service ON service.team_id=i.team_id AND service.principal_id=i.principal_id`;
+export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}, lineage_actors(team,id) AS (
+  SELECT c.team_id,actor.value FROM lineage l JOIN credentials c ON c.id=l.id JOIN principals p ON p.id=c.principal_id
+  JOIN app_credentials ac ON ac.credential_id=c.id, json_each(COALESCE(ac.actor_json,'[]')) actor WHERE actor.type='text')
+  SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id JOIN principals p ON p.id=c.principal_id
+    WHERE p.kind='agent' AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT c.team_id,c.principal_id')})
+  UNION ALL SELECT 1 FROM lineage_actors x JOIN agents named ON named.team_id=x.team AND named.id=x.id
+    WHERE NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT named.team_id,named.id')})
+  UNION ALL SELECT 1 ${LINEAGE_ROWS}
+    WHERE EXISTS(SELECT 1 FROM agent_credentials d LEFT JOIN memberships dm ON dm.team_id=d.team_id AND dm.principal_id=c.principal_id WHERE d.parent_credential_id=c.id AND d.credential_id IN(SELECT id FROM lineage) AND COALESCE(dm.active,0)!=1)
     OR c.revoked_at IS NOT NULL OR (c.expires_at IS NOT NULL AND c.expires_at<=?)
     OR (c.team_id IS NOT NULL AND COALESCE(m.active,0)!=1)
     OR (i.id IS NOT NULL AND (i.state!='active' OR a.state!='active' OR COALESCE(installer.active,0)!=1
-      OR installer.role NOT IN ('owner','admin') OR COALESCE(service.active,0)!=1)) LIMIT 1`;
+      OR installer.role NOT IN ('owner','admin') OR COALESCE(service.active,0)!=1))
+  LIMIT 1`;
 export function canRead(auth, session, grants = []) {
   if (!auth || !['user','service'].includes(auth.kind) || !auth.active || session.deleted_at != null) return false;
   if (!appGrantAllows(auth, 'session', session.id, 'sessions.read')) return false;

package/server/published-events.mjs

@@ -5,6 +5,7 @@ import { exact } from './request-json.mjs';
 import { canonicalJson } from './wire.mjs';
 import { writeSse } from './events.mjs';
 import { APP_EVENTS, PUBLISHABLE_EVENTS, eventReadAction } from './event-catalogue.mjs';
+import { EVENT_DATA_LIMIT } from '../event-limits.mjs';
 
 const stmt = (sql, ...params) => ({sql, params});
 const fail = (status,code,message) => {throw Object.assign(new Error(message),{status,code});};
@@ -69,7 +70,7 @@ export async function publishedEventRoute(ctx) {
   if(publication&&req.method==='POST'){
     const body=await parseJson(req);exact(body,['id','kind','resource','revision','data','actor']);
     text(body.id,'id');text(body.resource?.id,'resource.id');exact(body.resource,['kind','id']);
-    if(!PUBLISHABLE_EVENTS.includes(body.kind)||body.resource.kind!==body.kind.split('.')[0]||!body.resource.id.startsWith(`${publication[1]}:`)||!Number.isSafeInteger(body.revision)||body.revision<1||!body.data||typeof body.data!=='object'||Array.isArray(body.data)||Buffer.byteLength(JSON.stringify(body.data))>262144)fail(400,'invalid_request','invalid source event or snapshot');
+    if(!PUBLISHABLE_EVENTS.includes(body.kind)||body.resource.kind!==body.kind.split('.')[0]||!body.resource.id.startsWith(`${publication[1]}:`)||!Number.isSafeInteger(body.revision)||body.revision<1||!body.data||typeof body.data!=='object'||Array.isArray(body.data)||Buffer.byteLength(JSON.stringify(body.data))>EVENT_DATA_LIMIT)fail(400,'invalid_request','invalid source event or snapshot');
     // A source can prove only its own principal. A plain session is evidence, never principal identity.
     const actor={principal:auth.principal_id,session:null,lineage:auth.act??[]};
     if(body.actor!=null){exact(body.actor,['session']);if(body.actor.session!=null){text(body.actor.session,'actor.session');if(!body.actor.session.startsWith('session:'))fail(400,'invalid_request','actor.session must name a session');actor.session=body.actor.session;}}