agentschat-mcp 0.36.5 → 0.36.8

package/src/server.ts

@@ -51,11 +51,14 @@ import {
   DEFAULT_GROK_BINDS_FILENAME,
   boundProfileForConversation,
   gateSwitchProfile,
+  grokBindApplies,
+  nonGrokWakeReason,
+  GROK_BINDS_META_FILENAME,
   profileNameFromPath,
   shouldHealBoundIdentity,
 } from "./grok-bind.ts";
 import { decideTermsConsent, TERMS_URL } from "./terms.ts";
-import { annotateTools } from "./tool-annotations.ts";
+import { annotateTools, TOOL_ANNOTATIONS } from "./tool-annotations.ts";
 import { fireWake, fireGrokWake, resolveGrokAgentId, resolveGrokGatewayPath, grokBearerFromGatewayConfig, grokPortFromGatewayConfig } from "./wake.ts";
 import pkg from "../package.json";
 import {
@@ -69,6 +72,15 @@ import { join, dirname } from "path";
 // Atomic + 0600-by-construction profile writer. Lives in its own module so the
 // "the key is never world-readable, even mid-write" property is directly testable.
 import { safeWriteProfile } from "./profile-store.ts";
+import {
+  decideIdentityGuard,
+  advanceGuardRecord,
+  parseGuardRecord,
+  emptyGuardRecord,
+  IDENTITY_GUARD_FILENAME,
+  type GuardIdentity,
+  type IdentityGuardRecord,
+} from "./identity-guard.ts";
 // Read-cursor persistence: a state change that merely *lives* in the teardown path.
 import { flushCursor, loadCursor, persistCursor } from "./read-cursor.ts";
 import { randomUUID } from "crypto";
@@ -194,7 +206,7 @@ function listProfileFiles(): Array<{ name: string; path: string }> {
     let files: string[] = [];
     try { files = readdirSync(dir).filter((f: string) => f.endsWith(".json")); } catch {}
     for (const file of files) {
-      if (file === DEFAULT_GROK_BINDS_FILENAME) continue; // bind map, not a profile
+      if (file === DEFAULT_GROK_BINDS_FILENAME || file === GROK_BINDS_META_FILENAME) continue; // bind map, not a profile
       const name = file.replace(/\.json$/, "");
       if (seen.has(name)) continue;
       seen.add(name);
@@ -223,7 +235,13 @@ function resolveProfile(): { path: string; source: ProfileSource; declaredName?:
   // is a declared identity (source grok-bind) so decideIdentity hard-errors
   // rather than falling through to a sibling bot.
   const grokToken = !!(cliArgs.token || process.env.AGENTCHAT_TOKEN);
-  const conversationId = process.env.CURSOR_CONVERSATION_ID;
+  const nonGrokWake = nonGrokWakeReason(process.env);
+  // A non-Grok wake stack (Antigravity / ZCode / URL wake) may have inherited a
+  // Grok agent's CURSOR_CONVERSATION_ID — never adopt that Grok identity.
+  const conversationId = nonGrokWake ? undefined : process.env.CURSOR_CONVERSATION_ID;
+  if (nonGrokWake && process.env.CURSOR_CONVERSATION_ID) {
+    process.stderr.write(`[agentchat] grok-bind skipped: non-grok wake (${nonGrokWake})\n`);
+  }
   let binds: Record<string, string> = {};
   if (!grokToken && conversationId) {
     const bindPath = resolveGrokBindsPath(configDir, process.env.AGENTCHAT_GROK_BINDS);
@@ -541,6 +559,53 @@ if (!anonymousMode || explicitAgentId !== undefined || hasToken) {
   }
 }
 
+// ── Identity guard (task_muk0154j_pstaosfn, incident 2026-09-27) ─────────────
+// A host respawn after a WS bounce can resolve a DIFFERENT identity than this
+// machine's MCP was trusted as (explicit selector lost → silent fall to the
+// default profile — wrong-identity posts followed). Compare this boot's identity
+// against the persisted trust record; on the default-fallback pattern, GATE
+// write tools until whoami confirms. Precedence and registration are untouched.
+let identityGateMessage = "";
+const identityGuardFile = join(configDir, IDENTITY_GUARD_FILENAME);
+function persistGuardRecord(rec: IdentityGuardRecord): void {
+  try {
+    mkdirSync(configDir, { recursive: true });
+    safeWriteProfile(identityGuardFile, rec);
+  } catch {}
+}
+function confirmLiveIdentityTrusted(): void {
+  identityGateMessage = "";
+  const live: GuardIdentity = {
+    agentId: AGENT_ID,
+    source: identity.mode === "env-creds" ? "env-creds" : profileSource,
+    ...(declaredName ? { declaredName } : {}),
+  };
+  guardRecord = advanceGuardRecord(guardRecord, live, new Date().toISOString(), true);
+  persistGuardRecord(guardRecord);
+}
+let guardRecord: IdentityGuardRecord = (() => {
+  try { return parseGuardRecord(readFileSync(identityGuardFile, "utf-8")); } catch { return emptyGuardRecord(); }
+})();
+const guardBootIdentity: GuardIdentity = {
+  agentId: AGENT_ID,
+  source: identity.mode === "env-creds" ? "env-creds" : profileSource,
+  ...(declaredName ? { declaredName } : {}),
+};
+{
+  const verdict = AGENT_ID
+    ? decideIdentityGuard(guardRecord, guardBootIdentity)
+    : ({ kind: "ok" } as const); // anonymous: no identity to protect, nothing to persist
+  if (verdict.kind === "gate") {
+    identityGateMessage = verdict.message;
+    process.stderr.write(`\n[agentchat] 🚨 ${verdict.message}\n\n`);
+    guardRecord = advanceGuardRecord(guardRecord, guardBootIdentity, new Date().toISOString(), false);
+  } else {
+    if (verdict.kind === "warn") process.stderr.write(`[agentchat] WARNING: ${verdict.message}\n`);
+    guardRecord = advanceGuardRecord(guardRecord, guardBootIdentity, new Date().toISOString(), true);
+  }
+  if (AGENT_ID) persistGuardRecord(guardRecord);
+}
+
 // Update display name if provided via CLI
 if (cliArgs.name && profile.display_name !== cliArgs.name) {
   profile.display_name = cliArgs.name;
@@ -2059,6 +2124,25 @@ function loadGrokBinds(): Record<string, string> {
   }
 }
 
+/** Explicit profile declared at startup (env / --profile / --name), else null. */
+const explicitStartupProfileName: string | null =
+  profileSource === "env" || profileSource === "legacy-env" || profileSource === "flag-profile" || profileSource === "flag-name"
+    ? (declaredName ?? null)
+    : null;
+
+/**
+ * Whether grok-bind (switch lock + heal) applies to this process right now.
+ * Non-Grok wakes and explicit --profile ≠ bound profile are exempt.
+ */
+function currentGrokBindApplicability(binds: Record<string, string>) {
+  return grokBindApplies({
+    env: process.env,
+    explicitProfileName: explicitStartupProfileName,
+    conversationId: process.env.CURSOR_CONVERSATION_ID,
+    binds,
+  });
+}
+
 /**
  * Apply a profile file as the live identity and reconnect WS.
  * Shared by `switch_profile` and grok-bind heal.
@@ -2080,6 +2164,15 @@ function applyIdentityFromProfile(newProfile: any, targetFile: string): void {
   profile = newProfile;
   activeProfileFile = targetFile;
   anonymousMode = false;
+  // An explicit in-process switch is a TRUSTED identity change — advance the
+  // identity-guard record so the next boot doesn't alarm on it.
+  guardRecord = advanceGuardRecord(
+    guardRecord,
+    { agentId: AGENT_ID, source: "switch_profile", ...(profileNameFromPath(targetFile) ? { declaredName: profileNameFromPath(targetFile)! } : {}) },
+    new Date().toISOString(),
+    true,
+  );
+  persistGuardRecord(guardRecord);
   wsReconnectAttempt = 0;
   heartbeat.start();
   connectWS();
@@ -2093,7 +2186,9 @@ function applyIdentityFromProfile(newProfile: any, targetFile: string): void {
 function ensureGrokBoundIdentity(): void {
   // Runtime recovery must honor the same explicit identity precedence as startup.
   if (profileSource !== "grok-bind" || hasToken || cliArgs.id || process.env.AGENTCHAT_AGENT_ID) return;
-  const boundName = boundProfileForConversation(process.env.CURSOR_CONVERSATION_ID, loadGrokBinds());
+  const healBinds = loadGrokBinds();
+  if (!currentGrokBindApplicability(healBinds).applies) return;
+  const boundName = boundProfileForConversation(process.env.CURSOR_CONVERSATION_ID, healBinds);
   if (!boundName) return;
   const boundPath = nameToPath(boundName);
   if (!existsSync(boundPath)) return;
@@ -2139,6 +2234,13 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     // stole the live profile via switch_profile. No-op when unbound.
     ensureGrokBoundIdentity();
 
+    // Identity guard (task_muk0154j_pstaosfn): after a suspect fallback (explicit
+    // identity lost on respawn → default profile), WRITE tools refuse until the
+    // agent looks at whoami and confirms. Read-only tools and whoami stay open.
+    if (identityGateMessage && name !== "whoami" && TOOL_ANNOTATIONS[name]?.readOnlyHint !== true) {
+      return { content: [{ type: "text", text: `🚨 ${identityGateMessage}` }], isError: true };
+    }
+
   if (name === "list_skills") {
     const { chat_id } = (args || {}) as { chat_id?: string };
     const out: any = {
@@ -3052,7 +3154,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         authLine = r.ok ? "REST auth: ok" : `REST auth: failed (${r.status})`;
       } catch { authLine = "REST auth: unknown"; }
     }
-    return { content: [{ type: "text", text: `Profile: ${profile.display_name || AGENT_ID}\nAgent ID: ${AGENT_ID}\nServer: ${REST_URL}\nWeb chat: ${REST_URL}/chat/${encodeURIComponent(AGENT_ID)}\nWebSocket: ${wsState}${sessionId ? `\nSession: ${sessionId.slice(0, 12)}...` : ""}\n${healthLine}\n${authLine}\n${claimedLine}${claimHint ? `\n${claimHint}` : ""}\nCapabilities: ${CAPABILITIES.join(", ")}\nProfile file: ${activeProfileFile ?? (anonymousMode ? "(none — anonymous, no profile written)" : "(none — credentials from environment)")}` }] };
+    // Identity guard: a whoami call IS the confirmation. Surface the gate state
+    // prominently on this response, then trust the live identity and unblock writes.
+    const gateNotice = identityGateMessage
+      ? `🚨 IDENTITY GUARD: ${identityGateMessage}\n(This whoami call confirms identity — writes are now unblocked. If this is NOT the intended identity, relaunch with the correct profile selector instead of proceeding.)\n\n`
+      : "";
+    const wasGated = identityGateMessage !== "";
+    const text = `Profile: ${profile.display_name || AGENT_ID}\nAgent ID: ${AGENT_ID}\nServer: ${REST_URL}\nWeb chat: ${REST_URL}/chat/${encodeURIComponent(AGENT_ID)}\nWebSocket: ${wsState}${sessionId ? `\nSession: ${sessionId.slice(0, 12)}...` : ""}\n${healthLine}\n${authLine}\n${claimedLine}${claimHint ? `\n${claimHint}` : ""}\nCapabilities: ${CAPABILITIES.join(", ")}\nProfile file: ${activeProfileFile ?? (anonymousMode ? "(none — anonymous, no profile written)" : "(none — credentials from environment)")}`;
+    if (wasGated) confirmLiveIdentityTrusted();
+    return { content: [{ type: "text", text: gateNotice + text }] };
   }
 
   if (name === "list_channels") {
@@ -3227,9 +3337,13 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     // when set, or via current profile when Cursor stdio started with --profile
     // and no CURSOR_CONVERSATION_ID. Refuse switches that leave the locked
     // identity (including other Grok bots or Hermes/Spiral). No-op allowed.
-    const switchGate = gateSwitchProfile({
+    // Non-Grok wakes (Antigravity / ZCode) and explicit --profile ≠ bound
+    // profile are exempt: an inherited CURSOR_CONVERSATION_ID must not lock them.
+    const switchBinds = loadGrokBinds();
+    const bindApplies = currentGrokBindApplicability(switchBinds);
+    const switchGate = !bindApplies.applies ? ({ kind: "allow" } as const) : gateSwitchProfile({
       conversationId: process.env.CURSOR_CONVERSATION_ID,
-      binds: loadGrokBinds(),
+      binds: switchBinds,
       requestedProfileName: profile_name,
       currentProfileName: profileNameFromPath(activeProfileFile),
     });