@volter/teams 0.2.4 → 0.2.6

package/board-process-guard.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// The board's native PreToolUse command policy. No process lookup or signal occurs here.
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+export const processGuardReason = 'Pattern kills are refused for board sessions. Kill only the PID this session recorded when it started that process; use the owning service door for a service.';
+export function patternKill(command) {
+  // Inspect shell bodies as well as nested `sh -c` / substitutions. Removing shell
+  // escapes and quotes catches split words, paths and quoted embedded commands.
+  const text = String(command).replace(/\\\r?\n/g, '').replace(/\\([a-zA-Z-])/g, '$1').replace(/["']/g, '');
+  const head = String.raw`(?:^|[;|&(\n{}]|\s-[a-zA-Z]*c\s+)\s*(?:(?:env|sudo|exec|command|xargs|nohup|do|then|else|!)\s+(?:--?[^\s;|&()]+\s+)*|[A-Za-z_][A-Za-z0-9_]*=[^\s;|&()]+\s+)*(?:[\w./-]+/)?`;
+  return new RegExp(head + String.raw`(?:pkill|killall)(?=$|[\s;|&()])`).test(text) ||
+    new RegExp(head + String.raw`pgrep\s+[^;|&\n)]*(?:--full\b|-[a-zA-Z]*f[a-zA-Z]*(?=$|\s))`).test(text);
+}
+const quote = value => `'${String(value).replaceAll("'", "'\\''")}'`;
+export function boardGuardArguments(kind, args, { cwd, enabled, node = process.execPath } = {}) {
+  if (!enabled) return args;
+  const command = `${quote(node)} ${quote(fileURLToPath(import.meta.url))}`;
+  const hooks = [{ matcher: '^Bash$', hooks: [{ type: 'command', command, timeout: 10 }] }];
+  if (kind === 'claude-code') {
+    const next = [...args], at = next.findIndex(arg => arg === '--settings' || arg.startsWith('--settings='));
+    if (at < 0) return [...next, '--settings', JSON.stringify({ hooks: { PreToolUse: hooks } })];
+    const inline = next[at].startsWith('--settings='), value = inline ? next[at].slice(11) : next[at + 1];
+    const settings = JSON.parse(value?.trimStart().startsWith('{') ? value : readFileSync(resolve(cwd || process.cwd(), value), 'utf8'));
+    settings.hooks ??= {}; settings.hooks.PreToolUse = [...(settings.hooks.PreToolUse ?? []), ...hooks];
+    next.splice(at, inline ? 1 : 2, '--settings', JSON.stringify(settings));
+    return next;
+  }
+  if (kind === 'codex') {
+    // Native Codex rules cannot split substitutions such as kill $(pgrep -f …).
+    // Its synchronous Bash hook can deny the entire command before execution.
+    // This invocation enables and trusts the board-vetted command policy.
+    const handler = `{ matcher = "^Bash$", hooks = [{ type = "command", command = ${JSON.stringify(command)}, timeout = 10 }] }`;
+    // Codex's own flags go before any subcommand (`app-server`, `resume`) or prompt: after `app-server`, Codex
+    // 0.159 refuses --dangerously-bypass-hook-trust and the worker never starts.
+    return [...(args.includes('--dangerously-bypass-hook-trust') ? [] : ['--dangerously-bypass-hook-trust']), '-c', 'features.hooks=true', '-c', `hooks.PreToolUse=[${handler}]`, ...args];
+  }
+  throw new Error(`board process guard is unavailable for ${kind}; no unguarded session was launched`);
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const input = JSON.parse(readFileSync(0, 'utf8'));
+    const command = input.tool_input?.command ?? input.tool_input?.cmd;
+    if (typeof command !== 'string') throw new Error('Bash hook input has no command');
+    if (patternKill(command)) process.stdout.write(JSON.stringify({ hookSpecificOutput: {
+      hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: processGuardReason,
+    } }) + '\n');
+  } catch (error) {
+    process.stderr.write(`Board process policy could not read the command: ${error.message}. ${processGuardReason}\n`);
+    process.exitCode = 2;
+  }
+}

package/event-limits.mjs

@@ -0,0 +1,3 @@
+// What one published event may carry: the server refuses a source event whose `data` serializes above this many
+// bytes, and a publisher fits its snapshot to it before sending.
+export const EVENT_DATA_LIMIT = 262144;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",
@@ -45,8 +45,10 @@
     },
     "./context": "./context.mjs",
     "./event-client": "./event-client.mjs",
+    "./event-limits": "./event-limits.mjs",
     "./machine-door": "./machine-door.mjs",
     "./sender-identity": "./sender-identity.mjs",
+    "./board-process-guard": "./board-process-guard.mjs",
     "./server/agent-authority": "./server/agent-authority.mjs"
   },
   "files": [

package/server/http.mjs

@@ -23,7 +23,7 @@ const parseJson=req=>parseRequestJson(req,fail);
 const result=(api,auth,data)=>({version:1,context:{server_id:api.serverId,team_id:auth.team_id,principal_id:auth.principal_id},data});
 function sideEffectStatements(api,res,status,body,now,targetId=null,journal=false){const statements=[];if(status<400&&res._idempotencyRecord){const record=res._idempotencyRecord,safe=redactSecretReplay(record.path,body);statements.push({sql:'INSERT INTO idempotency(team_id,principal_id,route,key,request_digest,response_status,response_json,expires_at) VALUES (?,?,?,?,?,?,?,?)',params:[record.teamId,record.principalId,record.route,record.key,record.requestDigest,status,journal?{$journalJsonValue:safe}:JSON.stringify(safe),now+86400000]});}if(res._auditRecord){const record=res._auditRecord;statements.push({sql:'INSERT INTO audit(team_id,id,actor_id,operation,target_id,outcome,revision,created_at,actor_json) VALUES (?,?,?,?,?,?,?,?,?)',params:[record.teamId,api.ids.next('audit'),record.actorId,record.operation,targetId,status<400?'allowed':'denied',journal?{$journalRevision:true}:null,now,JSON.stringify(record.act??[])]});}return statements;}
 async function persistSideEffects(api,res,status,body){const statements=sideEffectStatements(api,res,status,body,api.clock.nowMs());if(statements.length)await api.store.transaction(statements);}
-function send(res,status,body,requestId,headers={}){const deliver=()=>{res.writeHead(status,{'Content-Type':'application/json; charset=utf-8','Cache-Control':'no-store','X-Request-ID':requestId,...headers});res.end(body===null?'':JSON.stringify(body));};if(!res._sideEffectsCommitted&&res._api&&(res._idempotencyRecord||res._auditRecord))return persistSideEffects(res._api,res,status,body).then(deliver);deliver();}
+function send(res,status,body,requestId,headers={}){const deliver=()=>{res.writeHead(status,{'Content-Type':'application/json; charset=utf-8','Cache-Control':'no-store','X-Request-ID':requestId,...headers});res.end(body===null?'':JSON.stringify(body));};if(!res._sideEffectsCommitted&&res._api&&(res._idempotencyRecord||res._auditRecord))return persistSideEffects(res._api,res,status,body).then(deliver,error=>{if(/UNIQUE constraint failed: idempotency\./.test(error?.message??''))return deliver();if(res.headersSent)return;res.writeHead(500,{'Content-Type':'application/json; charset=utf-8','Cache-Control':'no-store','X-Request-ID':requestId});res.end(JSON.stringify({error:{code:'internal',message:'The request was not recorded.'}}));});deliver();}
 async function guardedMutation(api,res,auth,guards,statements,{status,body,targetId=null,journal=false}){const now=api.clock.nowMs(),all=[...statements,...sideEffectStatements(api,res,status,body,now,targetId,journal)],result=journal?await api.store.journalTransaction(auth.team_id,[...guards,...appAuthGuards(auth,now)],all):await api.store.guardedTransaction([...guards,...appAuthGuards(auth,now)],all);res._sideEffectsCommitted=true;api.events.publish(auth.team_id,{type:'events_available'});return result;}
 const requireRevision=(req,current,label='resource')=>{const expected=Number(String(req.headers['if-match']??'').replaceAll('"',''));if(!Number.isSafeInteger(expected))fail(400,'invalid_request','If-Match is required');if(expected!==current)fail(409,'revision_mismatch',`${label} revision changed`);return expected;};
 const CORS={'Access-Control-Allow-Origin':'*','Access-Control-Expose-Headers':'ETag, X-Request-ID, Content-Range'};

package/server/published-events.mjs

@@ -5,6 +5,7 @@ import { exact } from './request-json.mjs';
 import { canonicalJson } from './wire.mjs';
 import { writeSse } from './events.mjs';
 import { APP_EVENTS, PUBLISHABLE_EVENTS, eventReadAction } from './event-catalogue.mjs';
+import { EVENT_DATA_LIMIT } from '../event-limits.mjs';
 
 const stmt = (sql, ...params) => ({sql, params});
 const fail = (status,code,message) => {throw Object.assign(new Error(message),{status,code});};
@@ -69,7 +70,7 @@ export async function publishedEventRoute(ctx) {
   if(publication&&req.method==='POST'){
     const body=await parseJson(req);exact(body,['id','kind','resource','revision','data','actor']);
     text(body.id,'id');text(body.resource?.id,'resource.id');exact(body.resource,['kind','id']);
-    if(!PUBLISHABLE_EVENTS.includes(body.kind)||body.resource.kind!==body.kind.split('.')[0]||!body.resource.id.startsWith(`${publication[1]}:`)||!Number.isSafeInteger(body.revision)||body.revision<1||!body.data||typeof body.data!=='object'||Array.isArray(body.data)||Buffer.byteLength(JSON.stringify(body.data))>262144)fail(400,'invalid_request','invalid source event or snapshot');
+    if(!PUBLISHABLE_EVENTS.includes(body.kind)||body.resource.kind!==body.kind.split('.')[0]||!body.resource.id.startsWith(`${publication[1]}:`)||!Number.isSafeInteger(body.revision)||body.revision<1||!body.data||typeof body.data!=='object'||Array.isArray(body.data)||Buffer.byteLength(JSON.stringify(body.data))>EVENT_DATA_LIMIT)fail(400,'invalid_request','invalid source event or snapshot');
     // A source can prove only its own principal. A plain session is evidence, never principal identity.
     const actor={principal:auth.principal_id,session:null,lineage:auth.act??[]};
     if(body.actor!=null){exact(body.actor,['session']);if(body.actor.session!=null){text(body.actor.session,'actor.session');if(!body.actor.session.startsWith('session:'))fail(400,'invalid_request','actor.session must name a session');actor.session=body.actor.session;}}