ada-agent 0.6.1 → 0.8.0

package/README.md

@@ -245,6 +245,19 @@ See **[docs/architecture.md](docs/architecture.md)** for the design (adapters, r
 flow, file layout), **[docs/orchestration.md](docs/orchestration.md)** for the agent strategies, and
 **[docs/integrations.md](docs/integrations.md)** for the HTTP API / SDK / ACP.
 
+## Enterprise
+
+`ada-server` doubles as an org **control plane**: per-user seat keys, an org policy (server-enforced
+model allowlist + tool rules pushed to every client), per-user usage metering, and an audit log —
+activated only when you create seats, file-backed, self-hosted in your own network. See
+**[docs/enterprise.md](docs/enterprise.md)** for the 2-minute bootstrap.
+
+**SSO (OIDC)** — federate login to your IdP (Okta, Entra single-tenant, Auth0, Keycloak, Google
+Workspace): `ADA_OIDC_ISSUER=… ada-server`, then developers run `ada login oidc`. The backend
+JIT-provisions a seat for the verified identity and offboarding is immediate. Stdlib-only RS256/JWKS
+verification, no new dependency; fail-closed by construction. See
+**[docs/enterprise-stage2-oidc.md](docs/enterprise-stage2-oidc.md)**.
+
 ## Benchmarks
 
 ada can run **SWE-bench Verified** — it generates patches for real GitHub issues (one isolated repo

package/docs/enterprise-stage2-oidc.md

@@ -0,0 +1,135 @@
+# Enterprise Stage 2 — OIDC SSO + JIT seat provisioning
+
+Status: **shipped in 0.8.0**. This is the design record; the operator runbook is in
+[enterprise.md](enterprise.md#sso-oidc--federate-login-to-your-idp).
+
+## Why this, and why not SAML
+
+After Stage 1 (seats, model allowlist, provider pinning, metering, audit), the #1 enterprise
+security-review gate for a tool that **holds provider API keys** and **reads source code** is
+centralized identity with provable, timely deprovisioning — *"when Alice is offboarded, is her access
+gone in minutes?"* Static `ada_sk_` seat keys can't answer that.
+
+OIDC beat the alternatives on unblock-value ÷ cost, grounded in the real code:
+
+- **vs SAML** — a terminal has no device grant, so SAML needs a brand-new loopback auth-code+PKCE
+  flow *and* an XML-DSig / exclusive-C14N assertion verifier that Node's stdlib can't provide (forcing
+  a dependency or a hand-rolled, XSW-prone verifier). OIDC reuses the existing RFC 8628 device flow
+  (`oauth.ts`) and needs only stdlib RS256/JWKS verification. Most SAML-mandating IdPs speak OIDC too.
+  SAML is deferred to a fast-follow for a contractually SAML-only account.
+- **vs a seatless verify-only login** — real buyers gate on *demonstrable* deprovisioning (SOC 2
+  CC6.3 / ISO 27001 A.9.2.6). Verify-only bounds revocation by IdP token lifetime with no kill switch.
+  We take exactly one rung more: a JIT seat + an immediate `disable-by-externalId` admin endpoint.
+
+Ranking: **oidc-sso (build now) > SCIM (Stage 3) > audit→SIEM export (Stage 4) > SAML (Stage 5a) >
+durable-store/HA (Stage 5c)**.
+
+## Goals / non-goals
+
+**Goals:** federate login to the org's single-tenant OIDC IdP via the device flow; JIT-provision a
+seat keyed to a stable, non-secret, issuer-scoped `externalId` (`iss#sub`); fail closed everywhere;
+RS256/JWKS verification with **zero new dependencies**; an immediate admin deprovision path.
+
+**Non-goals (sequenced later, and honest about it):** SCIM auto-provisioning (Stage 3); SIEM/audit
+**export** (Stage 4 — Stage 2 only *appends* login events, it makes no SIEM-readiness claim); SAML
+(5a); secrets-at-rest encryption of `credentials.json`/`users.json` (5b); Postgres/HA (5c);
+multi-tenant issuers (rejected at load).
+
+## Architecture — model B (seat key as the durable bearer)
+
+The ID token is a **one-time provisioning artifact**, not a per-request credential. This is what makes
+headless work and keeps the long-lived replayable secret a *server-minted, disableable* seat key
+rather than a stealable `id_token`.
+
+```
+1. Client startup: GET /v1/whoami → 401 (backend locked because ADA_OIDC_ISSUER is set).
+2. Client GET /v1/auth/methods (unauth) → { methods:["oidc"], oidc:{ issuer, clientId,
+   deviceAuthEndpoint, tokenEndpoint, scope, exchangePath } }.   ← client needs NO OIDC env of its own
+3. `ada login oidc` runs the device flow against the IdP (browser; MFA/conditional-access enforced
+   BY the IdP). Gets { id_token, access_token, ... }.
+4. Client POST {exchangePath}  Authorization: Bearer <id_token>
+      backend: verifyOidcToken → isProvisionAllowed (group/domain) → upsertSeatForSSO(iss#sub)
+               → audit sso_login → 200 { seat_key: "ada_sk_…", user, role }
+      client: store the SEAT KEY under the "oidc" credential (not the id_token).
+5. Every later request (chat/embeddings/models/whoami, and ALL of -p / serve / acp) sends the
+   ada_sk_ seat key through the hardened identifySeat hot path. No per-request JWKS/RSA, no network.
+6. Offboarding: admin POST /v1/users/disable-by-external { externalId } → next request 401; re-login
+   refused (disabled seat is never resurrected).
+```
+
+## Files, endpoints, env
+
+**New** `src/server/oidc.ts` (stdlib-only): `oidcEnabled()`, `oidcConfig()` (validates + fails closed),
+`assertOidcConfig()` (startup abort), `discover()` (cached openid-configuration), `verifyOidcToken()`
+(RS256/JWKS with a `getKey`/`now` seam for tests), `isProvisionAllowed()`, `mapIdentityToSeatFields()`.
+
+**Changed** `src/server/enterprise.ts`: `Seat` gains `externalId?`/`iss?`; `seatByExternalId()`,
+`upsertSeatForSSO()`, `disableSeatByExternalId()`. `index.ts`: `locked() += oidcEnabled()`; `identify()`
+skips GitHub/Google when OIDC is on; pre-auth `GET /v1/auth/methods` + `POST /v1/auth/oidc/exchange`;
+admin `POST /v1/users/disable-by-external`; startup `assertOidcConfig()`. `oauth.ts`: `deviceGrant()`
+(returns the raw token response incl. `id_token`); `deviceLogin()` builds on it. `cli.ts`:
+`identityToken()` returns the OIDC seat key; `oidcLogin()` + `ensureAuth()` self-configure from
+`/v1/auth/methods`.
+
+| Endpoint | Auth | Purpose |
+|---|---|---|
+| `GET /v1/auth/methods` | none | advertise enabled login methods + public OIDC endpoints |
+| `POST /v1/auth/oidc/exchange` | Bearer = `id_token` | verify → provision → return a seat key (once). The ONLY JWT entry point. |
+| `POST /v1/users/disable-by-external` | admin | immediate offboarding by `iss#sub` |
+
+| Env | Purpose | Gate |
+|---|---|---|
+| `ADA_OIDC_ISSUER` | master opt-in; `iss` + discovery. **https, single-tenant only.** | unset ⇒ inert; multi-tenant ⇒ refuse start |
+| `ADA_OIDC_CLIENT_ID` | device-flow app id; expected `aud`/`azp` | required with issuer |
+| `ADA_OIDC_ALLOWED_GROUPS` | groups permitted to provision | **unset + no domains ⇒ refuse start** |
+| `ADA_OIDC_ALLOWED_DOMAINS` | alt allow-surface (email domains) | — |
+| `ADA_OIDC_ADMIN_GROUP` | group ⇒ `role:"admin"` | unset ⇒ all `dev` |
+| `ADA_OIDC_GROUP_CLAIM` / `ADA_OIDC_NAME_CLAIM` | claim names | `groups` / email→preferred_username→sub |
+| `ADA_OIDC_JWKS_URI` / `ADA_OIDC_AUDIENCE` / `ADA_OIDC_CLOCK_SKEW_MS` / `ADA_OIDC_SCOPE` | overrides | discovered / =client id / 120000 / `openid profile email` |
+
+## Security model — the fail-closed points (each resolves a red-team finding)
+
+- **Backend locks on OIDC.** `locked()` includes `oidcEnabled()`, so a fresh SSO deployment with zero
+  seats never falls to the dev-open `{user:"dev"}` branch. *(Fails closed at `locked()`.)*
+- **No open provisioning.** `isProvisionAllowed()` requires a **positive** group/domain match, and the
+  server **refuses to start** without an allow-surface — a public issuer can't JIT a seat for every
+  account it will sign a token for. Domain matches require a **verified** email (`email_verified:true`
+  in the token) so a self-service IdP can't provision an unverified `attacker@corp.com`; IdPs that omit
+  the claim must use a group allowlist. *(Fails closed at startup + per exchange.)*
+- **Legacy shared keys refused under SSO.** `ADA_CLIENT_KEYS` is ignored whenever OIDC is on (single
+  identity authority), so a still-configured shared key can't bypass verification before the first
+  seat is minted.
+- **Issuer-scoped identity.** `externalId = iss#sub`; multi-tenant issuers rejected at load — a reused
+  `sub` across tenants can't collapse two people onto one seat. *(Fails closed at config load.)*
+- **Immediate, demonstrable deprovisioning.** Model B + `disableSeatByExternalId` +
+  `/v1/users/disable-by-external`: a disabled seat 401s on the next request and re-login is refused,
+  independent of token lifetime. *(Fails closed in `identifySeat`/`upsertSeatForSSO`.)*
+- **One JWT entry point.** The `id_token` is accepted only at `/v1/auth/oidc/exchange`; it never
+  reaches the per-request identity path, so it can't be forwarded to GitHub/Google verification.
+- **Verifier hardening.** `alg` allowlisted to RS256 (rejects `none`/`HS*` key-confusion); `aud` must
+  include the client id; `azp` (when present) must equal the client id, and a multi-audience token
+  without `azp` is rejected; `exp`/`nbf`/`iat` checked with bounded skew. JWKS fetches are rate-capped
+  (≤1 refetch/60s) so an attacker-chosen `kid` can't amplify fetches; `jwks_uri` must be https and is
+  blocked from loopback/private hosts (a lightweight SSRF guard — origin is not pinned to the issuer
+  because Google Workspace serves JWKS from a different origin).
+- **One identity authority.** GitHub/Google login is disabled while OIDC is on, so a person disabled
+  in the IdP can't re-enter via a still-allowed GitHub account. Admin role is downgraded to dev on a
+  login that no longer carries the admin group (privilege revocation); escalation stays an explicit
+  admin action.
+
+## Verification
+
+`npm run typecheck` + `npm run selfcheck` (hermetic: JIT mint/reuse/no-escalation, immediate
+deprovision-by-externalId, prototype-safe scan, and a full RS256 verify test with a local keypair +
+injected JWKS covering tamper/wrong-aud/`alg=none`/expiry → all `null`). Live-verified: OIDC-locked
+backend 401s a tokenless request, fail-closed startup on missing allow-surface and multi-tenant
+issuer, real-Google discovery + JWKS guard, exchange rejects a bogus token.
+
+## Roadmap
+
+- **Stage 3 — SCIM 2.0**: admin-gated `/scim/v2/Users` driving `createSeat`/`disableSeatByExternalId`
+  on the `iss#sub` index shipped here (no migration). Automates joiner/mover/leaver.
+- **Stage 4 — audit/usage SIEM export**: tee `appendAudit`/`appendUsage` to syslog/webhook/OTLP-JSON;
+  audit hash-chain + `GET /v1/audit/verify`. Carries the Stage 2/3 `sso_*`/`scim_*` events.
+- **Stage 5** — SAML (named account only); secrets-at-rest encryption; Postgres/HA at the `dataDir()`
+  seam.

package/docs/enterprise.md

@@ -0,0 +1,134 @@
+# Enterprise: seats, policy, metering, audit
+
+`ada-server` doubles as an org **control plane**: per-user seat keys, an org policy the backend
+enforces (and clients apply locally), per-user usage metering, and an audit log. It's all
+file-backed under `~/.ada/server/` (override with `ADA_DATA_DIR`) — fine to ~50 seats; a database
+is the upgrade path, not the starting point.
+
+**Enterprise mode activates only when a seat exists or `ADA_ADMIN_KEY` is set.** With neither, the
+backend behaves exactly as before (dev-open, or `ADA_CLIENT_KEYS`/login).
+
+## Bootstrap (2 minutes)
+
+```bash
+# 1. start the backend with a bootstrap admin key (any long random string)
+export ADA_ADMIN_KEY=$(openssl rand -hex 24)
+export CLOUDFLARE_ACCOUNT_ID=... CLOUDFLARE_API_TOKEN=...     # your provider keys
+ada-server                     # banner shows: [ENTERPRISE (0 seats + admin key)]
+
+# 2. create a seat per developer — the key is shown ONCE
+curl -s -X POST -H "Authorization: Bearer $ADA_ADMIN_KEY" \
+     -d '{"name":"alice"}' http://localhost:8787/v1/users
+# → { "key": "ada_sk_…", "name": "alice", "role": "dev", "note": "shown once — store it now" }
+```
+
+Each developer sets their seat key and points at the backend:
+
+```bash
+export ADA_BACKEND_URL=https://ada.yourcompany.com/v1
+export ADA_CLIENT_KEY=ada_sk_…
+ada
+```
+
+## Seats
+
+```bash
+GET    /v1/users               # list: name, role, keyPrefix, created, disabled   (admin)
+POST   /v1/users               # {"name":"bob","role":"dev"|"admin"} → full key, once   (admin)
+DELETE /v1/users/<keyPrefix>   # disable a seat (≥12 chars of its key; kept for the audit trail)   (admin)
+```
+
+Full keys are never listed after creation — only a 14-char prefix. `ADA_ADMIN_KEY` is the
+break-glass admin; create an admin *seat* for day-to-day and keep the env key in a vault.
+
+## SSO (OIDC) — federate login to your IdP
+
+Instead of handing out static seat keys, connect your OIDC IdP (Okta, Entra **single-tenant**, Auth0,
+Keycloak, Google Workspace). Developers sign in through the browser via the device flow, and the
+backend **JIT-provisions a seat** for the verified identity. Seats are keyed to a stable, non-secret
+`iss#sub`, so offboarding has a target.
+
+```bash
+# On the backend (all values are non-secret except any confidential-client secret):
+export ADA_OIDC_ISSUER=https://your-tenant.okta.com          # single-tenant issuer URL (https)
+export ADA_OIDC_CLIENT_ID=<device-flow app client id>
+export ADA_OIDC_ALLOWED_GROUPS=ada-users                     # OR ADA_OIDC_ALLOWED_DOMAINS=yourco.com
+export ADA_OIDC_ADMIN_GROUP=ada-admins                       # optional: this group → role "admin"
+ada-server                                                   # banner: [OIDC SSO (0 seats — awaiting first login)]
+```
+
+**Setting `ADA_OIDC_ISSUER` locks the backend immediately** (before any seat exists) — a request
+that doesn't authenticate gets `401`, never dev-open. Two fail-closed guards refuse to start on unsafe
+config: no `ALLOWED_GROUPS`/`ALLOWED_DOMAINS` (would provision every IdP user), or a **multi-tenant**
+issuer (`.../common` or `.../organizations`, where `sub` isn't unique). When OIDC is on, the
+GitHub/Google login path is disabled — the IdP is the single identity authority.
+
+The developer needs **no OIDC config** — the client learns it from the backend:
+
+```bash
+export ADA_BACKEND_URL=https://ada.yourcompany.com/v1
+ada login oidc     # opens the IdP in a browser; on success stores a seat key. Then just `ada`.
+```
+
+Under the hood the ID token is a **one-time provisioning artifact**: `ada login oidc` exchanges it at
+`POST /v1/auth/oidc/exchange` for a durable `ada_sk_` seat key, and every later request (including
+`-p`, `serve`, `acp`) carries that seat key — so long headless runs never expire mid-job, and
+revocation is a seat-disable, not a token-lifetime wait.
+
+**Offboarding (immediate):** disable the seat by its `iss#sub`. The next request 401s and re-login is
+refused (a disabled seat is never resurrected).
+
+```bash
+curl -X POST -H "Authorization: Bearer $ADA_ADMIN_KEY" \
+     -d '{"externalId":"https://your-tenant.okta.com#00u1a2b3c4"}' \
+     http://localhost:8787/v1/users/disable-by-external
+```
+
+`GET /v1/auth/methods` (unauthenticated) advertises the enabled methods. ID-token verification is
+stdlib-only (RS256 + JWKS, `alg` allowlisted, `iss`/`aud`/`azp`/`exp`/`nbf` checked) — no new
+dependency. Full env reference and the security model: [enterprise-stage2-oidc.md](enterprise-stage2-oidc.md).
+
+Automated joiner/mover/leaver (**SCIM**) and audit **export to a SIEM** are the sequenced next stages;
+today login events (`sso_login`, `sso_login_denied`, `seat_created`, `seat_disabled`) are appended to
+the audit log but not yet streamed out.
+
+## Org policy
+
+```bash
+curl -X PUT -H "Authorization: Bearer $ADA_ADMIN_KEY" http://localhost:8787/v1/policy -d '{
+  "models": ["@cf/*", "claude-*"],
+  "permissions": [
+    { "tool": "web_*",  "action": "deny" },
+    { "tool": "bash",   "pattern": "*curl*", "action": "ask" }
+  ]
+}'
+```
+
+- **`models`** — allowlist (`*` wildcards). Enforced **server-side** (403 + audit entry), so a
+  modified client can't route around it. Empty/absent = all models.
+- **`permissions`** — tool rules **pushed to clients** (fetched from `GET /v1/policy` at startup —
+  interactive, `-p` headless, `serve`, and `acp` alike). Merged restrictive-wins with local config:
+  an org `deny` beats any local `allow`, an org `ask` upgrades a local `allow`, and an org `allow`
+  can never *loosen* a local deny or the default gating. **Honest caveat:** tool rules run in the
+  *client*, so they govern well-behaved clients — and only **model-allowlist** denials are audited
+  server-side; tool-rule outcomes are not visible to `/v1/audit`. The **hard, server-enforced**
+  guarantees are: authentication, the model allowlist, provider pinning (when an allowlist is set,
+  the client's `provider` hint is ignored so a request can't be re-routed off-policy), and metering.
+
+## Usage & audit
+
+```bash
+GET /v1/usage?days=30    # totals + per-user + per-model {requests, promptTokens, completionTokens}   (admin)
+GET /v1/audit?limit=200  # seat_created / seat_disabled / policy_updated / policy_denied_model …      (admin)
+```
+
+Metering is captured server-side by teeing every chat response (streamed or not) and recording the
+upstream's reported token usage per user — clients can't underreport. Join with
+`ada catalog` prices for cost.
+
+## Deployment notes
+
+- Run behind TLS (caddy/nginx) — seat keys travel as bearer tokens.
+- `ADA_DATA_DIR` on a persistent volume; back it up (it's 4 small JSON/JSONL files).
+- One deployment = one org. Multi-org/SaaS is deliberately out of scope for v1.
+- Compliance paperwork (SOC 2, DPA) is process, not code — start it when a buyer asks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ada-agent",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "A from-zero terminal coding agent with a Cursor-style routing backend, ~285 skills, MCP connectors, and ask/plan/auto modes",
   "type": "module",
   "license": "MIT",

package/src/client/cli.ts

@@ -3,7 +3,8 @@
 import { createInterface } from "node:readline/promises";
 import { spawnSync } from "node:child_process";
 import { basename, dirname, join, resolve } from "node:path";
-import { readFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { stdin, stdout } from "node:process";
 import OpenAI from "openai";
@@ -11,9 +12,9 @@ import { Agent, type AgentEvent, type ApprovalDecision, type OnApprove } from ".
 import { ApprovalRegistry, newId, sseFrame } from "./agent-server.ts";
 import { expandPrompt, loadPrompts } from "./prompts.ts";
 import { Session, list, type SessionMeta } from "./session.ts";
-import { deleteCredential, getCredential, listCredentials } from "../server/credentials.ts";
-import { deviceLogin, oauthConfig } from "../server/oauth.ts";
-import { addTrust, isTrusted, loadSettings, setActiveAgentPermissions, type Settings } from "./settings.ts";
+import { deleteCredential, getCredential, listCredentials, setCredential } from "../server/credentials.ts";
+import { deviceGrant, deviceLogin, oauthConfig } from "../server/oauth.ts";
+import { addTrust, isTrusted, loadSettings, setActiveAgentPermissions, setOrgPermissions, type PermRule, type Settings } from "./settings.ts";
 import { getCommands, loadExtensions } from "./extensions.ts";
 import { registerTool, setAsker } from "./tools.ts";
 import { addRemoteSkill, loadSkills, registerSkillTool } from "./skills.ts";
@@ -35,8 +36,12 @@ type RL = ReturnType<typeof createInterface>;
 
 const BACKEND = process.env.ADA_BACKEND_URL ?? "http://localhost:8787/v1";
 
-/** A stored GitHub/Google login token, sent as the bearer so the backend can identify us. */
+/** A stored login credential, sent as the bearer so the backend can identify us. An OIDC SSO seat
+ *  key (ada_sk_…) wins — it's a durable, server-minted, disableable bearer (see oidcLogin). A seat
+ *  key is only honored by the backend that minted it, so a stray one sent elsewhere just 401s. */
 function identityToken(): string | undefined {
+  const oidc = getCredential("oidc");
+  if (oidc?.type === "oauth" && oidc.key) return oidc.key;
   for (const p of ["github", "google"]) {
     const c = getCredential(p);
     if (c?.type === "oauth" && c.access) return c.access;
@@ -352,8 +357,52 @@ function makeClient(): OpenAI {
   return new OpenAI({ baseURL: BACKEND, apiKey: clientKey(), maxRetries: 0 });
 }
 
-/** Run the device flow for `provider`; returns true on success (token stored). */
+interface AuthMethods {
+  methods: string[];
+  oidc?: { issuer: string; clientId: string; deviceAuthEndpoint: string; tokenEndpoint: string; scope: string; exchangePath: string };
+  oidcError?: string;
+}
+
+/** Ask the backend which login methods it offers (so the client needs no OIDC env of its own). */
+async function fetchAuthMethods(): Promise<AuthMethods | null> {
+  try {
+    const r = await fetch(`${BACKEND}/auth/methods`, { signal: AbortSignal.timeout(4000) });
+    if (!r.ok) return null;
+    return (await r.json()) as AuthMethods;
+  } catch {
+    return null;
+  }
+}
+
+/** OIDC SSO login (model B): device-flow against the org IdP using the backend-advertised config,
+ *  then exchange the id_token for a durable seat key stored under the "oidc" credential. */
+async function oidcLogin(): Promise<boolean> {
+  const m = await fetchAuthMethods();
+  if (!m?.oidc) {
+    console.log(m?.oidcError ? `SSO unavailable: ${m.oidcError}` : "this backend does not offer OIDC SSO.");
+    return false;
+  }
+  const { clientId, deviceAuthEndpoint, tokenEndpoint, scope, exchangePath } = m.oidc;
+  try {
+    const tok = await deviceGrant("SSO", { clientId, deviceUrl: deviceAuthEndpoint, tokenUrl: tokenEndpoint, scope }, (s) => console.log(s));
+    const idToken = tok.id_token as string | undefined;
+    if (!idToken) throw new Error("IdP returned no id_token — ensure the 'openid' scope is granted");
+    const r = await fetch(`${BACKEND}${exchangePath}`, { method: "POST", headers: { authorization: `Bearer ${idToken}` } });
+    if (!r.ok) throw new Error(`exchange failed: HTTP ${r.status} ${await r.text().catch(() => "")}`);
+    const { seat_key, user, role } = (await r.json()) as { seat_key?: string; user?: string; role?: string };
+    if (!seat_key) throw new Error("backend returned no seat_key");
+    await setCredential("oidc", { type: "oauth", key: seat_key });
+    console.log(`Logged in via SSO as ${user} (${role}).`);
+    return true;
+  } catch (e) {
+    console.error(`SSO login failed: ${e instanceof Error ? e.message : e}`);
+    return false;
+  }
+}
+
+/** Run the device flow for `provider`; returns true on success (credential stored). */
 async function loginFlow(provider: string): Promise<boolean> {
+  if (provider === "oidc" || provider === "sso") return oidcLogin();
   const cfg = oauthConfig(provider);
   if (!cfg) {
     console.log(`No OAuth config for ${provider}. Set ADA_OAUTH_${provider.toUpperCase()}_{CLIENT_ID,DEVICE_URL,TOKEN_URL}.`);
@@ -368,6 +417,38 @@ async function loginFlow(provider: string): Promise<boolean> {
   }
 }
 
+/** Fetch org policy from an enterprise backend and apply its tool rules locally (restrictive-wins
+ *  merge in settings.permissionFor; the backend enforces the model allowlist regardless). Caches the
+ *  last-good policy under ~/.ada so a transient fetch failure falls back to known rules instead of
+ *  silently dropping them. No-op against a non-enterprise backend. */
+async function applyOrgPolicy(): Promise<void> {
+  const cacheFile = join(homedir(), ".ada", "org-policy.json");
+  const enterprise = clientKey().startsWith("ada_sk_"); // a seat key ⇒ this is an enterprise backend
+  try {
+    const r = await fetch(`${BACKEND}/policy`, { headers: { authorization: `Bearer ${clientKey()}` }, signal: AbortSignal.timeout(3000) });
+    if (!r.ok) throw new Error(`HTTP ${r.status}`);
+    const policy = (await r.json()) as { permissions?: PermRule[] };
+    setOrgPermissions(policy.permissions ?? null);
+    try {
+      mkdirSync(join(homedir(), ".ada"), { recursive: true });
+      writeFileSync(cacheFile, JSON.stringify(policy));
+    } catch {
+      /* cache best-effort */
+    }
+    if (policy.permissions?.length) console.error(`\x1b[2m↳ org policy applied (${policy.permissions.length} rule${policy.permissions.length === 1 ? "" : "s"})\x1b[0m`);
+  } catch (e) {
+    if (!enterprise) return; // non-enterprise backend — local rules only, silently
+    // Enterprise backend unreachable — fall back to the last policy we saw, and say so loudly.
+    try {
+      const cached = JSON.parse(readFileSync(cacheFile, "utf8")) as { permissions?: PermRule[] };
+      setOrgPermissions(cached.permissions ?? null);
+      console.error(`\x1b[33m[warn] could not fetch org policy (${e instanceof Error ? e.message : e}) — using cached rules.\x1b[0m`);
+    } catch {
+      console.error(`\x1b[33m[warn] could not fetch org policy (${e instanceof Error ? e.message : e}) and no cache — org tool rules NOT applied this session.\x1b[0m`);
+    }
+  }
+}
+
 /** Startup login check: probe the backend; if it says 401, offer to sign in and rebuild the client. */
 async function ensureAuth(rl: RL, client: OpenAI): Promise<OpenAI> {
   let status: number;
@@ -378,12 +459,16 @@ async function ensureAuth(rl: RL, client: OpenAI): Promise<OpenAI> {
     return client; // backend unreachable — the model fetch will report it
   }
   if (status !== 401) return client; // 200 = already authorized, or backend is open (dev)
-  const provider = ["github", "google"].find((p) => oauthConfig(p));
+  // Prefer the org IdP if the backend advertises OIDC SSO; else fall back to a locally-configured
+  // GitHub/Google OAuth app.
+  const methods = await fetchAuthMethods();
+  const provider = methods?.methods.includes("oidc") ? "oidc" : ["github", "google"].find((p) => oauthConfig(p));
   if (!provider) {
-    console.log("\x1b[33mthis backend requires login, but no OAuth provider is configured (set ADA_OAUTH_*).\x1b[0m");
+    console.log("\x1b[33mthis backend requires login, but no login method is available (backend offers no SSO and no ADA_OAUTH_* is set).\x1b[0m");
     return client;
   }
-  const ans = (await rl.question(`\x1b[33mnot logged in — sign in with ${provider}? [Y/n] \x1b[0m`)).trim().toLowerCase();
+  const label = provider === "oidc" ? `your org (${methods?.oidc?.issuer ?? "SSO"})` : provider;
+  const ans = (await rl.question(`\x1b[33mnot logged in — sign in with ${label}? [Y/n] \x1b[0m`)).trim().toLowerCase();
   if (ans === "n" || ans === "no") return client;
   return (await loginFlow(provider)) ? makeClient() : client;
 }
@@ -658,6 +743,7 @@ async function main(): Promise<void> {
     registerSkillTool(loadSkills(trusted));
     await loadMcpServers(trusted);
     const client = makeClient();
+    await applyOrgPolicy(); // enterprise org rules apply to acp sessions too
     let model = process.env.ADA_MODEL || settings.model || "";
     if (!model) {
       try {
@@ -741,6 +827,7 @@ async function main(): Promise<void> {
     registerSkillTool(loadSkills(trusted));
     await loadMcpServers(trusted);
     const client = makeClient();
+    await applyOrgPolicy(); // enterprise org rules apply to serve sessions too
     let model = (process.argv[3] && !process.argv[3].startsWith("--") ? process.argv[3] : "") || process.env.ADA_MODEL || settings.model || "";
     if (!model) {
       try {
@@ -1082,6 +1169,7 @@ async function main(): Promise<void> {
   if (flags.print !== undefined) {
     const trusted = isTrusted(process.cwd());
     const settings = loadSettings(trusted);
+    await applyOrgPolicy(); // org tool rules bind headless runs too (CI is the classic bypass path)
     let pm = flags.model ?? process.env.ADA_MODEL ?? settings.model ?? scoped[0] ?? "";
     if (!pm) {
       try {
@@ -1125,6 +1213,7 @@ async function main(): Promise<void> {
   const mcp = await loadMcpServers(includeProject);
 
   client = await ensureAuth(rl, client); // always check login at startup; prompt if the backend says 401
+  await applyOrgPolicy(); // enterprise backends push org tool rules; no-op otherwise
 
   let session: Session;
   let history: Msg[] = [];

package/src/client/settings.ts

@@ -66,9 +66,15 @@ export function setActiveAgentPermissions(rules: PermRule[] | null): void {
   activeAgentPerms = rules;
 }
 
-/** Evaluate the configured permission rules for a tool call. null = no matching rule (use defaults). */
-export function permissionFor(toolName: string, summary: string): PermAction | null {
-  const rules = activeAgentPerms ?? loadSettings(isTrusted(process.cwd())).permissions ?? [];
+// Org policy pushed by an enterprise backend (fetched from /v1/policy at startup). Merged
+// restrictive-wins: an org "deny" beats any local "allow"; an org "ask" upgrades a local "allow".
+// A local "deny" always stands — the org can tighten a user's setup, never loosen it.
+let orgPerms: PermRule[] | null = null;
+export function setOrgPermissions(rules: PermRule[] | null): void {
+  orgPerms = rules?.length ? rules : null;
+}
+
+function evalRules(rules: PermRule[], toolName: string, summary: string): PermAction | null {
   let result: PermAction | null = null;
   for (const r of rules) {
     const toolOk = !r.tool || r.tool === toolName || globMatch(r.tool, toolName);
@@ -78,6 +84,18 @@ export function permissionFor(toolName: string, summary: string): PermAction | n
   return result;
 }
 
+const STRICTNESS: Record<PermAction, number> = { allow: 0, ask: 1, deny: 2 };
+
+/** Evaluate the configured permission rules for a tool call. null = no matching rule (use defaults). */
+export function permissionFor(toolName: string, summary: string): PermAction | null {
+  const local = evalRules(activeAgentPerms ?? loadSettings(isTrusted(process.cwd())).permissions ?? [], toolName, summary);
+  if (!orgPerms) return local;
+  const org = evalRules(orgPerms, toolName, summary);
+  if (org === null) return local;
+  if (local === null) return org === "allow" ? null : org; // org can't LOOSEN the default gating, only tighten
+  return STRICTNESS[org] > STRICTNESS[local] ? org : local;
+}
+
 export function addTrust(dir: string): void {
   const g = readJson(GLOBAL);
   const dirs = new Set(g.trustedDirs ?? []);