mercury-agent 0.18.2 → 0.19.0

package/src/core/runtime.ts

@@ -213,12 +213,36 @@ export class MercuryCoreRuntime {
    * Returns a comma-joined display name of active sensitive connections,
    * or null if none are active. Active means: credential env var set (for
    * env-var-based connections) or any extension state stored (for OAuth connections).
+   *
+   * Scoped to a caller when `spaceId`/`callerRole` are supplied: a connection
+   * this caller cannot reach is not a connection this caller needs to confirm.
+   * Reachability mirrors the env-var injection rule in `executePrompt`
+   * (`ext.permission && !hasPermission(...)` → skip), and it is the same
+   * permission the capability broker enforces — `checkPerm(c, name)` in
+   * src/core/routes/capability.ts gates on the permission whose name equals
+   * the extension's. Without a caller (the startup warning) the scan stays
+   * host-wide, which over-approximates on purpose: a log line should name
+   * every space that *could* be affected.
    */
-  private getActiveSensitiveConnectionName(): string | null {
+  private getActiveSensitiveConnectionName(
+    spaceId?: string,
+    callerRole?: string,
+  ): string | null {
     if (!this.extensionRegistry) return null;
     const names: string[] = [];
     for (const ext of this.extensionRegistry.list()) {
       if (!ext.connection?.sensitive) continue;
+      // An extension that declares no permission is reachable by everyone, so
+      // absence of `permission` must NOT skip the guard — same polarity as the
+      // injection rule this mirrors.
+      if (
+        spaceId !== undefined &&
+        callerRole !== undefined &&
+        ext.permission &&
+        !hasPermission(this.db, spaceId, callerRole, ext.name)
+      ) {
+        continue;
+      }
       const conn = ext.connection;
       let active = false;
       if (conn.credentialEnvVar) {
@@ -235,6 +259,21 @@ export class MercuryCoreRuntime {
   private static readonly PENDING_SENSITIVE_KEY = "security.pending_sensitive";
   private static readonly PENDING_SENSITIVE_TTL_MS = 5 * 60 * 1000;
 
+  /**
+   * Confirmations that have already been given, keyed by caller — a separate
+   * row from PENDING_SENSITIVE_KEY on purpose. `readPendingSensitive` requires
+   * a `prompt` string and drops anything else, so an "already confirmed" marker
+   * cannot ride in that map without loosening a validator that is doing real
+   * work.
+   *
+   * The window is a judgement call, not a derived value: long enough that a
+   * working session is not interrogated on every turn (a container turn alone
+   * can run 20 minutes), short enough that consent expires within the day.
+   */
+  private static readonly CONFIRMED_SENSITIVE_KEY =
+    "security.confirmed_sensitive";
+  private static readonly CONFIRMED_SENSITIVE_TTL_MS = 60 * 60 * 1000;
+
   /**
    * Sensitive connection guard — fires before the container for assistant turns.
    * Returns { action: "proceed" } (proceed, optionally replaying a stored prompt)
@@ -264,7 +303,24 @@ export class MercuryCoreRuntime {
       return { action: "proceed" };
     }
 
-    const sensitiveName = this.getActiveSensitiveConnectionName();
+    // Resolve the caller's role so the scan below can skip connections this
+    // caller cannot reach. resolveRole is idempotent (it upserts the member row
+    // and re-seeds config admins); executePrompt resolves it again later for
+    // its own use, exactly as the media gate at :1797 already does.
+    const seededAdmins = this.config.admins
+      ? this.config.admins
+          .split(",")
+          .map((s) => s.trim())
+          .filter(Boolean)
+      : [];
+    const callerRole = callerId
+      ? resolveRole(this.db, spaceId, callerId, seededAdmins)
+      : undefined;
+
+    const sensitiveName = this.getActiveSensitiveConnectionName(
+      spaceId,
+      callerRole,
+    );
     if (!sensitiveName) return { action: "proceed" };
 
     const locale = resolveLocale(this.db, this.config, spaceId);
@@ -300,6 +356,16 @@ export class MercuryCoreRuntime {
     }
 
     const now = Date.now();
+
+    // Already confirmed inside the window: proceed without asking again. This
+    // is checked BEFORE the pending map so a caller who has consented is never
+    // re-interrogated — the defect that made the guard cost one round-trip per
+    // message, forever, because the pending entry is consumed on every `yes`.
+    // An expired or absent entry falls through to the prompt: absence denies.
+    if (this.hasConfirmedSensitive(spaceId, callerId, now)) {
+      return { action: "proceed" };
+    }
+
     const pending = this.readPendingSensitive(spaceId, now);
     // Own-key lookup only: a caller id such as `constructor` must not find an
     // inherited function and walk past the warning with an undefined prompt.
@@ -313,6 +379,9 @@ export class MercuryCoreRuntime {
       if (words.no.includes(text)) {
         delete pending[callerId];
         this.writePendingSensitive(spaceId, pending);
+        // An explicit refusal revokes any standing consent: saying no must not
+        // leave an earlier `yes` still waving turns through.
+        this.clearConfirmedSensitive(spaceId, callerId);
         return {
           action: "block",
           reason: formatSystemMessage(locale, "sensitive_cancelled"),
@@ -321,6 +390,7 @@ export class MercuryCoreRuntime {
       if (words.yes.includes(text)) {
         delete pending[callerId];
         this.writePendingSensitive(spaceId, pending);
+        this.recordConfirmedSensitive(spaceId, callerId, now);
         return { action: "proceed", replayPrompt: mine.prompt };
       }
       // A new message from the same caller mid-confirmation replaces their
@@ -399,6 +469,98 @@ export class MercuryCoreRuntime {
     );
   }
 
+  /**
+   * The live (unexpired, well-formed) confirmations of a space, keyed by
+   * caller. Same null-prototype and validation discipline as the pending map:
+   * caller ids are untrusted strings, an unreadable row is treated as empty,
+   * and anything malformed or expired is simply absent — which denies.
+   */
+  private readConfirmedSensitive(
+    spaceId: string,
+    now: number,
+  ): Record<string, { at: number }> {
+    const out: Record<string, { at: number }> = Object.create(null);
+    const raw = this.db.getSpaceConfig(
+      spaceId,
+      MercuryCoreRuntime.CONFIRMED_SENSITIVE_KEY,
+    );
+    if (!raw) return out;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (error) {
+      logger.warn("Sensitive guard: discarding unreadable confirmed state", {
+        spaceId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return out;
+    }
+    if (!parsed || typeof parsed !== "object") return out;
+    for (const [id, entry] of Object.entries(
+      parsed as Record<string, unknown>,
+    )) {
+      if (!entry || typeof entry !== "object") continue;
+      const { at } = entry as { at?: unknown };
+      if (typeof at !== "number") continue;
+      if (now - at > MercuryCoreRuntime.CONFIRMED_SENSITIVE_TTL_MS) continue;
+      out[id] = { at };
+    }
+    return out;
+  }
+
+  private writeConfirmedSensitive(
+    spaceId: string,
+    confirmed: Record<string, { at: number }>,
+  ): void {
+    if (Object.keys(confirmed).length === 0) {
+      this.db.deleteSpaceConfig(
+        spaceId,
+        MercuryCoreRuntime.CONFIRMED_SENSITIVE_KEY,
+      );
+      return;
+    }
+    this.db.setSpaceConfig(
+      spaceId,
+      MercuryCoreRuntime.CONFIRMED_SENSITIVE_KEY,
+      JSON.stringify(confirmed),
+      "system",
+    );
+  }
+
+  /** True when this caller confirmed in this space inside the TTL. */
+  private hasConfirmedSensitive(
+    spaceId: string,
+    callerId: string,
+    now: number,
+  ): boolean {
+    if (!callerId) return false;
+    const confirmed = this.readConfirmedSensitive(spaceId, now);
+    // Own-key lookup only, for the same reason the pending map uses it: a
+    // caller id such as `constructor` must not find an inherited function.
+    return Object.hasOwn(confirmed, callerId);
+  }
+
+  private recordConfirmedSensitive(
+    spaceId: string,
+    callerId: string,
+    now: number,
+  ): void {
+    if (!callerId) return;
+    const confirmed = this.readConfirmedSensitive(spaceId, now);
+    confirmed[callerId] = { at: now };
+    this.writeConfirmedSensitive(spaceId, confirmed);
+  }
+
+  private clearConfirmedSensitive(spaceId: string, callerId: string): void {
+    if (!callerId) return;
+    // Always writes back, even when this caller had no live entry: the read
+    // drops expired ones, so this is also what sweeps a stale row instead of
+    // leaving it to sit until someone else confirms.
+    const confirmed = this.readConfirmedSensitive(spaceId, Date.now());
+    delete confirmed[callerId];
+    this.writeConfirmedSensitive(spaceId, confirmed);
+  }
+
   /** Log a startup warning for group spaces with active sensitive connections but no admin enable. */
   private warnUncoveredSensitiveSpaces(): void {
     const sensitiveName = this.getActiveSensitiveConnectionName();