llm-cli-gateway 2.9.0 → 2.10.0

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to the llm-cli-gateway project.
 
 ## Unreleased
 
+## [2.10.0] - 2026-06-15: Per-principal isolation on the request handlers
+
+A follow-up to the 2.9.0 per-principal isolation (F3): the ownership model was
+enforced on the `session_*` / `llm_*` bookkeeping tools but **not** on the
+`*_request` execution handlers, the workspace/worktree resolvers, or the
+`sessions://*` resources. An adversarial multi-LLM review of the 2.9.0 surface
+found two HIGH cross-principal bugs reachable in the opt-in remote/OAuth
+multi-tenant modes; this release closes them. The default local-stdio and shared
+static-bearer paths collapse to a single principal and are unaffected (no
+behaviour change). Provider CLI release targets are unchanged from 2.8.0/2.9.0
+(see `docs/upstream/release-targets.md`).
+
+### Security
+
+- Cross-principal session takeover (F3b, request handlers):
+  `getExistingSessionForProvider` now rejects a caller-supplied session id owned
+  by a different principal — the ownership check is ordered before the
+  provider-type comparison, so a foreign session never leaks its provider. This
+  is the choke point for every `*_request` / `*_request_async` handler (claude,
+  codex, gemini, grok, mistral, grok-api) and `codex_fork_session`. Previously a
+  remote principal could resume or read another principal's conversation by
+  supplying its session id.
+- Global active-session pointer is now owner-filtered at every request-handler
+  adoption site (and in the codex async path, which bypassed the choke point),
+  so a no-`sessionId` request can no longer adopt and resume another principal's
+  active session.
+- Workspace-isolation bypass (F3b, resolvers): `resolveWorktreeForRequest` and
+  `resolveWorkspaceAndWorktreeForRequest` ignore a referenced session the caller
+  does not own, so a foreign session's metadata can no longer select the
+  workspace/worktree working directory or satisfy the remote "registered
+  workspace" gate.
+- `sessions://*` resources are now owner-filtered: `sessions://all` and the five
+  per-provider session resources return only the caller's own rows and active
+  pointer, closing the session-id/metadata enumeration vector.
+
+### Tests
+
+- Adds `src/__tests__/f3b-request-handler-isolation.test.ts` (cross-principal
+  deny-path coverage for the request handlers and the `sessions://*` resources).
+
 ## [2.9.0] - 2026-06-14: MCP-surface red-team remediation
 
 This release remediates all 17 findings of a multi-LLM red-team of the gateway's

package/dist/index.js

@@ -434,7 +434,7 @@ export async function resolveWorktreeForRequest(worktreeOpt, sessionId, runtime,
         return {};
     const sessionManager = runtime.sessionManager;
     if (sessionId) {
-        const session = await Promise.resolve(sessionManager.getSession(sessionId));
+        const session = await getCallerOwnedSession(sessionManager, sessionId);
         const existingPath = session?.metadata?.worktreePath;
         if (typeof existingPath === "string" && existingPath.length > 0) {
             return {
@@ -477,9 +477,7 @@ function isGatewayAppDirCwd() {
     return process.cwd() === join(homedir(), ".llm-cli-gateway");
 }
 async function resolveWorkspaceAndWorktreeForRequest(args) {
-    const session = args.sessionId
-        ? await Promise.resolve(args.runtime.sessionManager.getSession(args.sessionId))
-        : null;
+    const session = await getCallerOwnedSession(args.runtime.sessionManager, args.sessionId);
     let workspace;
     if (args.workspace ||
         args.runtime.workspaces.defaultAlias ||
@@ -1972,11 +1970,33 @@ function usageFromXaiResult(result) {
         costUsd: result.usage.costUsd,
     };
 }
+function callerCanAccessSession(session) {
+    return principalCanAccess(session.ownerPrincipal, resolveOwnerPrincipal(getRequestContext()));
+}
+async function getCallerOwnedSession(sessionManager, sessionId) {
+    if (!sessionId)
+        return null;
+    const existing = await Promise.resolve(sessionManager.getSession(sessionId));
+    if (!existing || !callerCanAccessSession(existing))
+        return null;
+    return existing;
+}
+async function getCallerOwnedActiveSession(sessionManager, provider) {
+    const active = await Promise.resolve(sessionManager.getActiveSession(provider));
+    if (!active || !callerCanAccessSession(active))
+        return null;
+    return active;
+}
 async function getExistingSessionForProvider(sessionManager, sessionId, provider) {
     if (!sessionId)
         return null;
     const existing = await sessionManager.getSession(sessionId);
-    if (existing && existing.cli !== provider) {
+    if (!existing)
+        return null;
+    if (!callerCanAccessSession(existing)) {
+        throw new Error(`Session ${sessionId} is not accessible`);
+    }
+    if (existing.cli !== provider) {
         throw new Error(`Session ${sessionId} belongs to provider '${existing.cli}', not '${provider}'`);
     }
     return existing;
@@ -2029,7 +2049,7 @@ async function resolveGrokApiSession(params, runtime) {
         return { sessionId: session.id, previousResponseId: previous };
     }
     if (!params.createNewSession) {
-        const active = await runtime.sessionManager.getActiveSession("grok-api");
+        const active = await getCallerOwnedActiveSession(runtime.sessionManager, "grok-api");
         if (active) {
             const previous = typeof active.metadata?.xaiPreviousResponseId === "string"
                 ? active.metadata.xaiPreviousResponseId
@@ -3056,7 +3076,7 @@ export async function handleCodexRequestAsync(deps, params) {
     try {
         let effectiveSessionId = params.sessionId;
         if (!params.createNewSession && !params.sessionId) {
-            const activeSession = await deps.sessionManager.getActiveSession("codex");
+            const activeSession = await getCallerOwnedActiveSession(deps.sessionManager, "codex");
             if (activeSession) {
                 effectiveSessionId = activeSession.id;
             }
@@ -3066,6 +3086,7 @@ export async function handleCodexRequestAsync(deps, params) {
             }
         }
         else if (params.sessionId) {
+            await getExistingSessionForProvider(deps.sessionManager, params.sessionId, "codex");
             await deps.sessionManager.updateSessionUsage(params.sessionId);
         }
         else if (params.createNewSession) {
@@ -3406,7 +3427,7 @@ export function createGatewayServer(deps = {}) {
         let useContinue = continueSession;
         let activeSession = null;
         try {
-            activeSession = await sessionManager.getActiveSession("claude");
+            activeSession = await getCallerOwnedActiveSession(sessionManager, "claude");
         }
         catch (err) {
             logger.warn(`[${corrId}] sessionManager.getActiveSession failed (non-fatal): ${err.message}`);
@@ -3775,7 +3796,7 @@ export function createGatewayServer(deps = {}) {
             wasSuccessful = true;
             let effectiveSessionId = sessionId;
             if (!createNewSession && !sessionId) {
-                const activeSession = await sessionManager.getActiveSession("codex");
+                const activeSession = await getCallerOwnedActiveSession(sessionManager, "codex");
                 if (activeSession) {
                     effectiveSessionId = activeSession.id;
                 }
@@ -4486,7 +4507,7 @@ export function createGatewayServer(deps = {}) {
             try {
                 let effectiveSessionId = sessionId;
                 let useContinue = continueSession;
-                const activeSession = await sessionManager.getActiveSession("claude");
+                const activeSession = await getCallerOwnedActiveSession(sessionManager, "claude");
                 if (!createNewSession && !continueSession && !sessionId && activeSession) {
                     effectiveSessionId = activeSession.id;
                     useContinue = true;

package/dist/resources.d.ts

@@ -33,5 +33,7 @@ export declare class ResourceProvider {
     readCacheStateSession(sessionId: string): SessionCacheStats;
     readCacheStateForPrefix(stablePrefixHash: string): PrefixCacheStats;
     listResources(): ResourceDefinition[];
+    private ownedSessions;
+    private ownedActiveId;
     readResource(uri: string): Promise<ResourceContents | null>;
 }

package/dist/resources.js

@@ -1,4 +1,5 @@
 import { CLI_TYPES, PROVIDER_TYPES } from "./session-manager.js";
+import { getRequestContext, principalCanAccess, resolveOwnerPrincipal } from "./request-context.js";
 import { getAvailableCliInfo } from "./model-registry.js";
 import { computeGlobalCacheStats, computePrefixCacheStats, computeSessionCacheStats, computeTtlRemaining, } from "./cache-stats.js";
 import { buildProviderSubcommandsCompactCatalog, getCliSubcommandContract, serializeCliSubcommandContract, } from "./upstream-contracts.js";
@@ -201,13 +202,21 @@ export class ResourceProvider {
             })),
         ];
     }
+    ownedSessions(sessions) {
+        const caller = resolveOwnerPrincipal(getRequestContext());
+        return sessions.filter(s => principalCanAccess(s.ownerPrincipal, caller));
+    }
+    async ownedActiveId(provider) {
+        const active = await Promise.resolve(this.sessionManager.getActiveSession(provider));
+        if (!active)
+            return null;
+        const caller = resolveOwnerPrincipal(getRequestContext());
+        return principalCanAccess(active.ownerPrincipal, caller) ? active.id : null;
+    }
     async readResource(uri) {
         if (uri === "sessions://all") {
-            const sessions = await this.sessionManager.listSessions();
-            const activeSessions = Object.fromEntries(await Promise.all(PROVIDER_TYPES.map(async (provider) => [
-                provider,
-                (await this.sessionManager.getActiveSession(provider))?.id || null,
-            ])));
+            const sessions = this.ownedSessions(await this.sessionManager.listSessions());
+            const activeSessions = Object.fromEntries(await Promise.all(PROVIDER_TYPES.map(async (provider) => [provider, await this.ownedActiveId(provider)])));
             return {
                 uri,
                 mimeType: "application/json",
@@ -225,7 +234,7 @@ export class ResourceProvider {
             };
         }
         if (uri === "sessions://claude") {
-            const sessions = await this.sessionManager.listSessions("claude");
+            const sessions = this.ownedSessions(await this.sessionManager.listSessions("claude"));
             return {
                 uri,
                 mimeType: "application/json",
@@ -233,12 +242,12 @@ export class ResourceProvider {
                     cli: "claude",
                     total: sessions.length,
                     sessions,
-                    activeSession: (await this.sessionManager.getActiveSession("claude"))?.id || null,
+                    activeSession: await this.ownedActiveId("claude"),
                 }, null, 2),
             };
         }
         if (uri === "sessions://codex") {
-            const sessions = await this.sessionManager.listSessions("codex");
+            const sessions = this.ownedSessions(await this.sessionManager.listSessions("codex"));
             return {
                 uri,
                 mimeType: "application/json",
@@ -246,12 +255,12 @@ export class ResourceProvider {
                     cli: "codex",
                     total: sessions.length,
                     sessions,
-                    activeSession: (await this.sessionManager.getActiveSession("codex"))?.id || null,
+                    activeSession: await this.ownedActiveId("codex"),
                 }, null, 2),
             };
         }
         if (uri === "sessions://gemini") {
-            const sessions = await this.sessionManager.listSessions("gemini");
+            const sessions = this.ownedSessions(await this.sessionManager.listSessions("gemini"));
             return {
                 uri,
                 mimeType: "application/json",
@@ -259,12 +268,12 @@ export class ResourceProvider {
                     cli: "gemini",
                     total: sessions.length,
                     sessions,
-                    activeSession: (await this.sessionManager.getActiveSession("gemini"))?.id || null,
+                    activeSession: await this.ownedActiveId("gemini"),
                 }, null, 2),
             };
         }
         if (uri === "sessions://grok") {
-            const sessions = await this.sessionManager.listSessions("grok");
+            const sessions = this.ownedSessions(await this.sessionManager.listSessions("grok"));
             return {
                 uri,
                 mimeType: "application/json",
@@ -272,12 +281,12 @@ export class ResourceProvider {
                     cli: "grok",
                     total: sessions.length,
                     sessions,
-                    activeSession: (await this.sessionManager.getActiveSession("grok"))?.id || null,
+                    activeSession: await this.ownedActiveId("grok"),
                 }, null, 2),
             };
         }
         if (uri === "sessions://mistral") {
-            const sessions = await this.sessionManager.listSessions("mistral");
+            const sessions = this.ownedSessions(await this.sessionManager.listSessions("mistral"));
             return {
                 uri,
                 mimeType: "application/json",
@@ -285,7 +294,7 @@ export class ResourceProvider {
                     cli: "mistral",
                     total: sessions.length,
                     sessions,
-                    activeSession: (await this.sessionManager.getActiveSession("mistral"))?.id || null,
+                    activeSession: await this.ownedActiveId("mistral"),
                 }, null, 2),
             };
         }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "llm-cli-gateway",
-      "version": "2.9.0",
+      "version": "2.10.0",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
   "description": "MCP server providing unified access to Claude Code, Codex, Gemini, Grok, and Mistral Vibe CLIs with session management, retry logic, async job orchestration, durable job results, and cross-LLM validation.",
   "license": "MIT",