clearotron 0.3.3 → 0.4.0-beta.1

package/shared/client-door.mjs

@@ -40,8 +40,10 @@
 // a door — which is now the difference between a box that installs and a box that crash-loops one.
 
 import { join } from "node:path";
+import { homedir } from "node:os";
 import { challengeVerdict, blockedByAccessChallenge, challengeNote } from "./mcp-challenge.mjs";   // — F57
 import { whatHoldsPort } from "./os-advice.mjs";
+import { defaultDenylistPath } from "./scope.mjs";   // — the verifier owns the path; see the re-export below
 
 /** The unit that runs the client door. Installed like any other; started only by this module. */
 export const CLIENT_DOOR_UNIT = "clearotron-client-mcp.service";
@@ -59,7 +61,9 @@ export const CLIENT_DOOR_UNIT = "clearotron-client-mcp.service";
  * file no verifier could read, and a revoked key kept answering 200. The guard existed; one of the two
  * doors was outside it.
  */
-export const defaultDenylistPath = (home) => join(home, ".config", "clearotron", "token-denylist");
+// ONE definition, owned by the verifier (scope.mjs): the file a door reads when the setting is unset is,
+// by construction, the file every revoker here writes.
+export { defaultDenylistPath } from "./scope.mjs";
 
 /**
  * The denylist path a door should be given — the operator's, if they set one.
@@ -617,9 +621,10 @@ export function enablePlan({ env = {}, address, identity, accessFile = null, por
   // ── THE DENYLIST PATH IS NAMED AND CREATED HERE, NEVER ASSUMED ───────────
   //
   // Measured on production, owner 2026-08-31: no denylist is configured anywhere — the variable is
-  // empty in one example env and commented out in the other, and `isRevoked()` returns false when the
-  // path is unset. So a key minted by a connect that assumed a denylist would be UNREVOKABLE, silently:
-  // `disconnect` would write a jti into a file no verifier reads, and every check would look done.
+  // empty in one example env and commented out in the other, and `isRevoked()` then returned false for
+  // every token. So a key minted by a connect that assumed a denylist was UNREVOKABLE, silently:
+  // `disconnect` wrote a jti into a file no verifier read, and every check looked done. `isRevoked()`
+  // now reads the default list when the path is unset; naming it here still pins every door to one file.
   //
   // Armed AT CONNECT TIME, deliberately, not at disconnect: a process reads its environment once, at
   // start. A variable first written when someone disconnects is one the already-running door never
@@ -917,7 +922,7 @@ export function connectKeyReport(grants, { now = Date.now(), revoked = () => fal
  * were recorded".
  */
 export function disablePlan({ env = {}, unitDir, exists, identity = null, recorded = [],
-  denylistPath = null } = {}) {
+  denylistPath = null, home = homedir() } = {}) {
   const door = clientDoorState({ env, unitDir, exists });
   const jtis = (recorded ?? []).map((r) => r.jti).filter(Boolean);
   // The path the running verifiers were BORN with wins; the caller's default only covers the install
@@ -926,7 +931,9 @@ export function disablePlan({ env = {}, unitDir, exists, identity = null, record
   // a revocation the environment cannot deliver retroactively.
   const existing = String(env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim();
   const armedPath = existing || (jtis.length && denylistPath ? String(denylistPath) : null);
-  const lateArm = Boolean(jtis.length && !existing && armedPath);
+  // NOT LATE WHEN IT IS THE DEFAULT LIST: a door with the setting unset reads the install's default list
+  // (isRevoked, shared/scope.mjs), so writing there reaches the running doors now, not from their next start.
+  const lateArm = Boolean(jtis.length && !existing && armedPath && armedPath !== defaultDenylistPath(home));
 
   if (!jtis.length) {
     return { possible: false, nothingOpen: true, door,
@@ -965,7 +972,7 @@ export function disablePlan({ env = {}, unitDir, exists, identity = null, record
  * everything. Stopping the unit would additionally break the stdio-free local route for readers who
  * hold no key at all, and would be undone by the next install.
  */
-export function revokeEveryonePlan({ env = {}, grants = null, denylistPath = null } = {}) {
+export function revokeEveryonePlan({ env = {}, grants = null, denylistPath = null, home = homedir() } = {}) {
   const rows = Object.entries(grants?.connectKeys ?? {}).map(([jti, r]) => ({ jti, sub: r?.sub ?? null }));
   const jtis = rows.map((r) => r.jti);
   const people = [...new Set(rows.map((r) => r.sub).filter(Boolean))];
@@ -980,7 +987,7 @@ export function revokeEveryonePlan({ env = {}, grants = null, denylistPath = nul
   return {
     possible: true, nothingOpen: false, jtis, people,
     denylistPath: armedPath,
-    lateArm: Boolean(!existing && armedPath),
+    lateArm: Boolean(!existing && armedPath && armedPath !== defaultDenylistPath(home)),   // see disablePlan
     // THE COUNT IS THE FIRST THING SAID, and it names both dimensions: five keys held by one person and
     // five keys held by five people are the same number and not the same act.
     says: [`This revokes ${jtis.length} issued key(s) held by ${people.length} ${people.length === 1 ? "person" : "people"}`

package/shared/driver-dir.mjs

@@ -40,15 +40,23 @@
 //
 // ── WHAT THIS DELIBERATELY DOES NOT DO ────────────────────────────────────────────────────────────
 //
-// IT DOES NOT SET A MODE, and this change alters no behaviour on disk. Pinning 0o750 here in the same
-// commit would be a semantic change riding inside a seam, and the seam is the part that has to be
-// reviewable by reading nineteen call sites and agreeing they still mean what they meant. The mode is
-// That business, and when it is taken it is one line in this file.
+// ── THE MODE, TAKEN HERE ONCE (2026-09-23) ────────────────────────────────────────────────────────
 //
-// IT WOULD NOT RESTRAIN THE SEAT IF IT DID. The agent runs as the same account that owns these
-// directories, so owner bits apply whatever the group bits say. A tighter mode removes GROUP write,
-// which is worth having on a box with a shared pool group, and nothing more. Said here because a module
-// named for a boundary invites the stronger reading.
+// A new run folder is created 0750: its owner, and the group the deployment reads reports through, and
+// no other account. It used to take whatever the umask gave, 775 on a real run, so on a machine whose
+// home or data folder other accounts can enter, any of them could read client matter. The folder that
+// holds a run is created by the call below (measured by tracing a whole clearance: `ensureDriverDir` is
+// the first write into a new run folder, and the archive is a rename that keeps the mode), so this one
+// line closes the live run and its archived copy. The published copy takes the same constant.
+//
+// A MODE GIVEN TO mkdir, NEVER A chmod. The kernel sets a new folder's set-GID bit from its parent
+// whatever mode is asked for, which is what the set-GID pool root relies on; a chmod by an account
+// outside that group strips the bit silently and every report then answers 403. So nothing here ever
+// changes an existing folder: a folder that already exists keeps the mode it has.
+//
+// IT DOES NOT RESTRAIN THE SEAT. The agent runs as the same account that owns these directories, so owner
+// bits apply whatever the group bits say. Said here because a module named for a boundary invites the
+// stronger reading.
 //
 // IT IS NOT `driverDirs`. `scripts/seat-retry-report.mjs` exports `driverDirs(root)`, which WALKS a tree
 // to find every `_driver` beneath it. Discovery, not construction — a different concern that happens to
@@ -60,6 +68,9 @@ import { join } from "node:path";
 /** The directory's name. The one place the string lives, so renaming it is an edit rather than a sweep. */
 export const DRIVER_DIR = "_driver";
 
+/** The mode a new run folder is created with: owner and group, no other account. See the header. */
+export const RUN_DIR_MODE = 0o750;
+
 /**
  * The path to a run's `_driver/`, or to something inside it.
  *
@@ -91,6 +102,6 @@ export function driverRel(...parts) {
  */
 export function ensureDriverDir(base, ...parts) {
   const dir = driverDir(base, ...parts);
-  mkdirSync(dir, { recursive: true });
+  mkdirSync(dir, { recursive: true, mode: RUN_DIR_MODE });
   return dir;
 }

package/shared/names-in-force.mjs

@@ -32,6 +32,7 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_BRAND_TAGLINE",
   "CLEAROTRON_CARD_CONCURRENCY",
   "CLEAROTRON_CHECKOUT_DIR",
+  "CLEAROTRON_CLARIVATE_ANSWER_MEMORY",
   "CLEAROTRON_CLAUDE_PATH",
   "CLEAROTRON_CLIENT_MCP_URL",
   "CLEAROTRON_CLIENT_OIDC_AUDIENCE",
@@ -163,6 +164,7 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_SCREEN_GATE_UNNAMED",
   "CLEAROTRON_SELFTEST_PATHS_ONLY",
   "CLEAROTRON_SEND_TOOL_PREFIX",
+  "CLEAROTRON_SIGNA_ANSWER_MEMORY",
   "CLEAROTRON_SKILLS_STORE_MAIN_BRANCH",
   "CLEAROTRON_SKILLS_STORE_STRICT",
   "CLEAROTRON_SPAWN_GRACE_MS",

package/shared/scope.mjs

@@ -19,6 +19,8 @@
 
 import { createHmac, timingSafeEqual, randomBytes } from "node:crypto";
 import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { envFrom } from "./env-aliases.mjs";   // — resolves EITHER spelling; names the retired one because that is the live-writable half
 
 const SECRET = () => process.env.TRADEMARK_MCP_TOKEN_SECRET || "";
@@ -29,16 +31,29 @@ const SECRETS = () => [process.env.TRADEMARK_MCP_TOKEN_SECRET, process.env.TRADE
   .filter((s) => typeof s === "string" && s.length > 0);
 const b64u = (buf) => Buffer.from(buf).toString("base64url");
 
-// Emergency revocation: a plain-text denylist file (one `jti` per line, `#` comments), path in
-// TRADEMARK_MCP_TOKEN_DENYLIST. Checked on every token verification. Short TTLs remain the primary
-// control; a missing/unreadable file means "nothing revoked yet" (the denylist must never be able
-// to take ALL token auth down on an fs blip). Legacy tokens carry no jti and are killed by secret
-// rotation instead.
-export function isRevoked(jti, { denylistPath = process.env.TRADEMARK_MCP_TOKEN_DENYLIST } = {}) {
-  if (!jti || !denylistPath) return false;
+// Emergency revocation: a plain-text denylist file (one `jti` per line, `#` comments). Checked on every
+// token verification, ALWAYS: the path is TRADEMARK_MCP_TOKEN_DENYLIST when it is set, and otherwise the
+// install's default below, the same file every revoker writes when the setting is unset (connect,
+// disconnect, `key`, mint-token's own note). Short TTLs remain the primary control. Legacy tokens carry
+// no jti and are killed by secret rotation instead.
+//
+// REVOCATION USED TO BE OFF WHEN THE SETTING WAS UNSET: this returned "not revoked" for every token, so a
+// door started without the variable (by hand, or by a unit that never loaded it) ignored a revocation
+// written to the default file. Now:
+//   - a NAMED list that cannot be read refuses every token (below), as it already did;
+//   - a list that EXISTS and cannot be read refuses every token, named or default;
+//   - the DEFAULT list being ABSENT means nothing has been revoked. Every revocation creates the file
+//     it writes to, and with the setting unset that is this file, so its absence is the proof, not a
+//     gap. It is the one absence read as a negative here, and only for that reason.
+export const defaultDenylistPath = (home) => join(home, ".config", "clearotron", "token-denylist");
+export function isRevoked(jti, { denylistPath = undefined, env = process.env, home = homedir() } = {}) {
+  if (!jti) return false;
+  const named = String(denylistPath ?? env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim();
+  const path = named || defaultDenylistPath(home);
   let text;
-  try { text = readFileSync(denylistPath, "utf8"); }
+  try { text = readFileSync(path, "utf8"); }
   catch (e) {
+    if (!named && e?.code === "ENOENT") return false;   // the default list, never written: nothing revoked
     // FAIL CLOSED (found in review; ruled and recorded for the owner's
     // review with the reversal path, which is this function).
     //
@@ -50,10 +65,10 @@ export function isRevoked(jti, { denylistPath = process.env.TRADEMARK_MCP_TOKEN_
     // The cost is now a VISIBLE outage that names its own cause, rather than an invisible hole. `start`
     // creates this file before any door starts, so reaching this branch means someone removed or
     // unreadable-ified it while the door was running — rare, and worth stopping for.
-    const err = new Error(`revocation could not be checked: the denylist at ${denylistPath} is unreadable `
+    const err = new Error(`revocation could not be checked: the denylist at ${path} is unreadable `
       + `(${e.code ?? e.message}). Refusing the token rather than assuming it was never revoked.`);
     err.code = "REVOCATION_UNCHECKABLE";
-    err.denylistPath = denylistPath;
+    err.denylistPath = path;
     throw err;
   }
   return text.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).includes(jti);

package/shared/store-in-repo.mjs

@@ -282,6 +282,7 @@ export function commitWithAuditRow({ audit, gitCommit, files, message, by, row }
 // That makes the failure resumable, and it makes "a concurrent editor's staged work survives" true by
 // construction rather than by a careful reset that has to guess whose paths are whose.
 import { execFileSync } from "node:child_process";
+import { BRAND } from "./brand.mjs";
 
 // Lock contention is TRANSIENT and worth retrying. A hook rejection and a full disk are not: retrying
 // them turns one named failure into several and delays the report. The distinction is the reason this
@@ -289,17 +290,39 @@ import { execFileSync } from "node:child_process";
 export const isTransientGitFault = (detail) =>
   /index\.lock|another git process seems to be running|Unable to create/i.test(String(detail ?? ""));
 
+// ── THE PRODUCT NAMES ITS OWN COMMITTER WHEN GIT HAS NONE ───────────────────────────────────────────
+//
+// A save names its author, the person who asked for it. Git also records a COMMITTER, taken from the
+// repository's or the account's configuration, and refuses the commit when it finds none. That is the
+// default state of a service account nobody ran `git config` for, and of a fresh Windows install: every
+// company created in the portal was refused there, with a message telling the person to run git. The
+// person creating a company cannot act on that, and nothing about the save needs them to.
+//
+// So a commit into the store is given the product's own committer whenever git cannot name one, on every
+// commit rather than once: `-c` or an environment variable configures one invocation, not the repository.
+// A store or account that already has an identity keeps it, so a configured install records exactly what
+// it recorded before, signing included.
+export const STORE_COMMITTER = Object.freeze({ name: BRAND.name, email: "store@localhost" });
+
+/** The environment a commit into `repoRoot` runs with: `env` itself when git can name a committer, else `env` plus the product's. */
+export function storeCommitEnv(repoRoot, { env = process.env } = {}) {
+  requireRepoRootPath(repoRoot, "storeCommitEnv");
+  try {
+    execFileSync("git", ["-C", repoRoot, "var", "GIT_COMMITTER_IDENT"], { stdio: ["ignore", "pipe", "pipe"], env });
+    return env;
+  } catch {
+    return { ...env, GIT_COMMITTER_NAME: STORE_COMMITTER.name, GIT_COMMITTER_EMAIL: STORE_COMMITTER.email };
+  }
+}
+
 /**
  * Why a commit into `repoRoot` would be refused, asked BEFORE anything is written; null when it would not
- * be. Read-only: `rev-parse` and `git var` change nothing. `{ code, detail, message }`, where `message` names
- * the store and the command that clears it, in terms an operator acts on rather than git's own words:
+ * be. Read-only: `rev-parse` changes nothing. `{ code, detail, message }`, where `message` names the store
+ * and the command that clears it, in terms an operator acts on rather than git's own words:
  *
- *   not-a-repository — the store is not inside a git repository this process can use;
- *   no-identity      — git has no committer identity here. That is the default state of any machine where
- *                      nobody ran `git config user.email`, a fresh Windows install among them. A save names
- *                      its author; the COMMITTER is the machine's, and git refuses a commit it cannot name
- *                      one for. `git -c user.email=…` on a one-off seed commit does not help: `-c` configures
- *                      that invocation, not the repository, so every save after it fails the same way.
+ *   not-a-repository — the store is not inside a git repository this process can use.
+ *
+ * A missing committer identity is not a refusal: every commit into the store supplies one (storeCommitEnv).
  */
 export function storeCommitRefusal(repoRoot, { env = process.env } = {}) {
   requireRepoRootPath(repoRoot, "storeCommitRefusal");
@@ -313,18 +336,13 @@ export function storeCommitRefusal(repoRoot, { env = process.env } = {}) {
       : `run \`git init\` in ${repoRoot}, or point PROFILE_REPO_ROOT at the repository that holds the store`;
     return { code: "not-a-repository", detail, message: `the store at ${repoRoot} is not a git repository this install can record into (${detail}) — ${fix}` };
   }
-  try { ask("var", "GIT_COMMITTER_IDENT"); }
-  catch (e) {
-    return { code: "no-identity", detail: said(e).pop()?.slice(0, 200) ?? "",
-      message: `the store at ${repoRoot} has no git identity, so nothing saved to it can be recorded — run `
-        + `\`git -C ${repoRoot} config user.email "you@example.com"\` and \`git -C ${repoRoot} config user.name "Your Name"\`` };
-  }
   return null;
 }
 
 export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retries = 3, waitMs = 50 }) {
   requireRepoRootPath(repoRoot, "makeStoreCommit");
-  const git = (...args) => execFileSync("git", ["-C", repoRoot, ...args], { encoding: "utf8" }).toString().trim();
+  const run = (env, args) => execFileSync("git", ["-C", repoRoot, ...args], { encoding: "utf8", ...(env ? { env } : {}) }).toString().trim();
+  const git = (...args) => run(null, args);
   // ── IS THIS A REPOSITORY WE CAN USE? ASKED FIRST ─────────────────────────────
   //
   // Outside a repository git falls back to `--no-index` mode, which has no `--cached` — so the very
@@ -351,13 +369,16 @@ export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retr
       log(`${what}: the store is not a usable git repository, so this save CANNOT be committed — ${refusal}`);
       throw new Error(`the store at ${repoRoot} is not a usable git repository: ${refusal}`);
     }
+    // Asked per commit, so an identity somebody configures while the service runs is used from then on.
+    const committing = storeCommitEnv(repoRoot);
+    const gitCommit = (...args) => run(committing, args);
     // (1) Complete what an earlier failed save left staged. BEST EFFORT: if this fails too — the same
     // hook is still rejecting, the disk is still full — it must not stop the save that is happening now,
     // and it must not touch the index either. The paths simply stay staged for the next attempt.
     try {
       const found = git("diff", "--cached", "--name-only").split("\n").filter(Boolean);
       if (found.length) {
-        git("commit", "-m", `Complete a store save left staged by an earlier failure (${found.length} path(s))`,
+        gitCommit("commit", "-m", `Complete a store save left staged by an earlier failure (${found.length} path(s))`,
             "--author", `${author} <${author}>`);
         log(`${what}: completed a commit left staged by an earlier failed save — ${found.join(", ")}`);
       }
@@ -369,7 +390,7 @@ export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retr
     git("add", ...files);
     for (let attempt = 1; ; attempt++) {
       try {
-        git("commit", "-m", message, "--author", `${author} <${author}>`);
+        gitCommit("commit", "-m", message, "--author", `${author} <${author}>`);
         return git("rev-parse", "HEAD");
       } catch (e) {
         const detail = detailOf(e);