shadok-ai 0.17.27 → 0.17.28

package/README.md

@@ -256,7 +256,9 @@ Enter to skip; you can add it later from the web UI).
   topic too** — a photo as a photo, anything else as a document — so whoever is
   reading there sees what you sent instead of a path. A message can be attachments alone, with no words. The files are
   served back to the browser by `GET /media/<name>` from the same directory
-  Telegram attachments land in.
+  Telegram attachments land in. On a multi-tenant instance each group has its own
+  media directory (`/media/g-<group>/<name>`), readable only by that group's
+  agents and served only to people who can see that group.
 - **Files an agent hands you** — when an agent's result IS a file (a report, an
   export, a screenshot, an archive) it arrives as a download card in the chat,
   inline if it is an image, and as an upload in the Telegram topic. It goes
@@ -1148,9 +1150,10 @@ returns the cwd to start the tweak agent in). The instance-wide writes —
 `DELETE /profiles` — are **admin only, from the browser**; a member sees those
 controls disabled. `PUT /profiles` is admin only on a multi-tenant instance
 (profiles are global there), and `POST /restart-all {sessions:[…]}` stays open,
-narrowed to the agents the caller may drive. Also `/media/<name>` (GET — serves a
-pasted/dropped or Telegram attachment back for inline display; sandboxed, basename
-only), and the sign-in group: `/auth` (GET
+narrowed to the agents the caller may drive. Also `/media/<name>` and
+`/media/g-<group>/<name>` (GET — serves a pasted/dropped or Telegram attachment
+back for inline display; sandboxed, never a symlink, a group's directory only to
+someone who can see that group), and the sign-in group: `/auth` (GET
 — `{loggedIn, email?, subscriptionType?, tokenExpiresAt?, accessExpiresAt?, backend?, backendModel?}`;
 the expiries come from the credentials store, never a token value; `backend:
 "custom"` when the instance runs on another model), `/auth/login`

package/context/scheduler-skill/SKILL.md

@@ -37,7 +37,17 @@ omit the check — the prompt runs every time.
 
 A check does **not** run inside this agent's process. The server runs it with
 `sh -c`, in the CHANNEL's directory, with the secrets of the channel's
-**profile** injected as environment variables.
+**profile** injected as environment variables. On a multi-tenant instance it
+runs as this agent's own OS user, exactly like the agent.
+
+Its environment is otherwise SMALL on purpose: `PATH`, the locale and time
+zone, proxy/CA settings, and `SHADOK_SESSION_ID` / `SHADOK_PORT` /
+`SHADOK_SESSION_KEY` (send the key as `x-shadok-session-key` to call the local
+API). Nothing else from the server's environment reaches it — no token, no
+password, no cookie. A credential the check needs goes in the profile.
+
+You can only schedule on an agent you may drive: on a multi-tenant instance,
+yourself, a sibling of your own group, or a shared (public) agent.
 
 So reference a secret by name (`$MY_API_KEY`) and trust it: never hardcode a
 value into a check script, and never try to source a shell profile to get one.

package/dist/files.d.ts

@@ -36,6 +36,12 @@ export interface OfferedFile {
     /** ms epoch of the offer. */
     at: number;
     caption?: string;
+    /** Identity of the file AT THE OFFER (device + inode). `GET /download`
+     *  compares it, so a path swapped for something else after the offer — a
+     *  symlink repointed, a file replaced — is refused rather than served.
+     *  Absent on an offer recorded before the check existed. */
+    dev?: number;
+    ino?: number;
 }
 /** Biggest file we will register. Beyond this the agent is told, not ignored. */
 export declare const MAX_OFFER_BYTES: number;
@@ -64,6 +70,8 @@ export type OfferVerdict = {
 export type OfferStat = {
     isFile: boolean;
     size: number;
+    dev?: number;
+    ino?: number;
 } | "missing" | "unreadable";
 export declare function offerVerdict(sessionId: string, p: string, stat: OfferStat, now: number, caption?: string): OfferVerdict;
 /**
@@ -91,5 +99,11 @@ export declare function refusalMessage(r: OfferRefusal): string;
 export declare const filesFileFor: (cwd: string) => string;
 export declare function loadOffers(file: string): OfferedFile[];
 export declare function saveOffers(file: string, rows: readonly OfferedFile[]): void;
-/** Stat for `offerVerdict`, keeping absent and unreadable apart. */
+/**
+ * The offer to compare a download against: the newest row of THIS session for
+ * this exact path (rows are superseded, so there is at most one).
+ */
+export declare function offerFor(rows: readonly OfferedFile[], sessionId: string, p: string): OfferedFile | undefined;
+/** Stat for `offerVerdict`, keeping absent and unreadable apart. As the SERVER's
+ *  user — multi-tenant goes through `statAsUserArgv` instead (invariant 60). */
 export declare function statForOffer(p: string): OfferStat;

package/dist/files.js

@@ -56,7 +56,11 @@ export function offerVerdict(sessionId, p, stat, now, caption) {
     const name = path.basename(raw);
     return {
         ok: true,
-        file: { sessionId, path: raw, name, size: stat.size, at: now, ...(caption?.trim() ? { caption: caption.trim() } : {}) },
+        file: {
+            sessionId, path: raw, name, size: stat.size, at: now,
+            ...(caption?.trim() ? { caption: caption.trim() } : {}),
+            ...(stat.dev !== undefined && stat.ino !== undefined ? { dev: stat.dev, ino: stat.ino } : {}),
+        },
     };
 }
 /**
@@ -123,11 +127,19 @@ export function saveOffers(file, rows) {
     fs.writeFileSync(tmp, JSON.stringify(rows, null, 2), { mode: 0o600 });
     fs.renameSync(tmp, file);
 }
-/** Stat for `offerVerdict`, keeping absent and unreadable apart. */
+/**
+ * The offer to compare a download against: the newest row of THIS session for
+ * this exact path (rows are superseded, so there is at most one).
+ */
+export function offerFor(rows, sessionId, p) {
+    return rows.find((r) => r.sessionId === sessionId && r.path === p);
+}
+/** Stat for `offerVerdict`, keeping absent and unreadable apart. As the SERVER's
+ *  user — multi-tenant goes through `statAsUserArgv` instead (invariant 60). */
 export function statForOffer(p) {
     try {
         const s = fs.statSync(p);
-        return { isFile: s.isFile(), size: s.size };
+        return { isFile: s.isFile(), size: s.size, dev: s.dev, ino: s.ino };
     }
     catch (e) {
         return e?.code === "ENOENT" ? "missing" : "unreadable";

package/dist/files.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.js","sourceRoot":"","sources":["../src/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAiB,MAAM,eAAe,CAAC;AAExD;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AAYvC,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAkB9B,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,CAAS,EACT,IAAe,EACf,GAAW,EACX,OAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3F,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3E,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,EAAE,CAAC;IACxG,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACxH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAA4B,EAAE,CAAc;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAA4B,EAAE,SAAiB;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,KAA6B;IACtD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,uEAAuE,CAAC;QACvG,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC;QACnC,KAAK,YAAY;YACf,OAAO,GAAG,CAAC,CAAC,IAAI,kCAAkC,CAAC;QACrD,KAAK,YAAY;YACf,OAAO,GAAG,CAAC,CAAC,IAAI,sBAAsB,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,MAAM,GAAG,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAEvG,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAA4B;IACnE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAQ,CAA2B,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IACpF,CAAC;AACH,CAAC"}
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../src/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAiB,MAAM,eAAe,CAAC;AAExD;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AAkBvC,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAkB9B,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,CAAS,EACT,IAAe,EACf,GAAW,EACX,OAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3F,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3E,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,YAAY,eAAe,EAAE,EAAE,CAAC;IACxG,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG;YACpD,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAA4B,EAAE,CAAc;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAA4B,EAAE,SAAiB;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,KAA6B;IACtD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,uEAAuE,CAAC;QACvG,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC;QACnC,KAAK,YAAY;YACf,OAAO,GAAG,CAAC,CAAC,IAAI,kCAAkC,CAAC;QACrD,KAAK,YAAY;YACf,OAAO,GAAG,CAAC,CAAC,IAAI,sBAAsB,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,MAAM,GAAG,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAEvG,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAA4B;IACnE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAA4B,EAAE,SAAiB,EAAE,CAAS;IACjF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAQ,CAA2B,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/group-exec.d.ts

@@ -0,0 +1,154 @@
+import { type Group, type Viewer } from "./groups.js";
+import type { DeploymentMode } from "./capability.js";
+/**
+ * What the SERVER does on a group's behalf — run a cron guard, read a file an
+ * agent handed over — must be done with that group's rights, never with the
+ * server's. In multi-tenant the server is root, so "run it as the server" means
+ * "run it as root": a cron `check` was a root shell for anyone who could reach
+ * `POST /crons`, and `GET /download` streamed any root-readable file an agent
+ * named. Pure, so every decision here is tested without a server, a root
+ * account or a provisioned OS user (none of which a test machine has).
+ *
+ * Invariant 58.
+ */
+/**
+ * May this caller schedule / edit / delete a cron on (or otherwise act for)
+ * `targetId`? The HTTP twin of the WS `mayDriveSession`, with one rule more for
+ * an AGENT (a request carrying a per-session key): an agent acts on itself, on a
+ * sibling of its OWN group, or on a commons/public agent — never into another
+ * group, whatever principal its key maps to. That keeps the rule right both
+ * while the key still authenticates as the bootstrap admin and after it maps to
+ * an agent principal of its own.
+ *
+ *  - mono-tenant: there is no wall to protect, today's behaviour (true);
+ *  - a target with no channel row: refused in multi-tenant — a cron aimed at an
+ *    unknown session would fire with a GUESSED directory and group;
+ *  - a dangling group id: refused (fail closed, the twin of `canSeeSession`).
+ */
+export declare function mayActOnSession(input: {
+    mode: DeploymentMode;
+    /** The calling agent (per-session key), with its channel's group. */
+    agent: {
+        id: string;
+        group: string | null;
+    } | null;
+    viewer: Viewer | null;
+    targetId: string;
+    channels: readonly {
+        sessionId: string;
+        group?: string | null;
+    }[];
+    groups: readonly Group[];
+}): boolean;
+/**
+ * The group-level half of `mayActOnSession`, reused where the thing asked for
+ * is a GROUP's rather than a session's (a media subdirectory).
+ */
+export declare function mayReachGroup(input: {
+    mode: DeploymentMode;
+    agent: {
+        id: string;
+        group: string | null;
+    } | null;
+    viewer: Viewer | null;
+    group: string | null;
+    groups: readonly Group[];
+    self?: boolean;
+}): boolean;
+/**
+ * The OS user the server must act as for a channel of `groupId` — the SAME
+ * answer as the spawn's drop user (`resolveSpawnIsolation` / `channelStateHome`):
+ * the group's own `sk-*` user, else the commons user (null before migration,
+ * meaning the server's own user, exactly as a commons agent runs then).
+ * A group id that resolves to nothing is REFUSED, never mapped to the commons:
+ * acting for a group we cannot identify is how a private job would end up
+ * running with someone else's rights.
+ */
+export declare function osUserForChannelGroup(groupId: string | null | undefined, groups: readonly Group[], commonsUser: string | null): {
+    ok: true;
+    user: string | null;
+} | {
+    ok: false;
+};
+/**
+ * The server environment names a cron guard may inherit. An ALLOW-list on
+ * purpose: the server's env holds the GUI password, the Telegram token, a
+ * custom backend's key, the instance auth cookie — and a deny-list is only as
+ * good as the day it was written (invariant 29's lesson about subtraction).
+ * What a shell script legitimately needs from its surroundings is short:
+ * where binaries are, the locale and zone, a temp dir, proxy and CA settings,
+ * and the SSH fallback a container uses (`src/ssh.ts`). Its credentials come
+ * from the PROFILE's secrets, like the agent's own.
+ */
+export declare const CHECK_ENV_ALLOW: RegExp;
+/**
+ * The full environment of a cron guard. Layers, last wins:
+ *  1. the allow-listed part of the server env (+ HOME/USER/LOGNAME when the
+ *     guard runs as the server's own user — they describe that user);
+ *  2. the target profile's secrets (what the check was always promised);
+ *  3. the session plumbing a script needs to call back the local API
+ *     (`SHADOK_SESSION_ID`/`_PORT`/`_KEY` — the agent's own, never the admin
+ *     cookie `SHADOK_AUTH`);
+ *  4. the drop user's HOME/USER/LOGNAME (`dropEnv`), so a dropped guard never
+ *     keeps the server's `HOME=/root`.
+ */
+export declare function cronCheckEnv(input: {
+    base: Record<string, string | undefined>;
+    secrets: Record<string, string>;
+    session: {
+        id: string;
+        port: string;
+        key: string;
+    };
+    user: string | null;
+    home: string | null;
+}): Record<string, string>;
+/** The guard's command: `sh -c <check>`, wrapped in the same `setpriv` drop as
+ *  an agent's spawn when there is a user to drop to. */
+export declare function cronCheckCommand(user: string | null, check: string): {
+    cmd: string;
+    argv: string[];
+};
+/**
+ * `stat` as the drop user: format, size, device and inode on four lines.
+ * `-L` follows a symlink — AS THAT USER, so it can only ever reach what the
+ * user could read anyway; the identity of what it reached is what the offer
+ * records and the download compares.
+ */
+export declare function statAsUserArgv(user: string, p: string): {
+    cmd: string;
+    argv: string[];
+};
+export interface FileIdentity {
+    isFile: boolean;
+    size: number;
+    dev: number;
+    ino: number;
+}
+/** Parse `statAsUserArgv`'s output; null on anything unexpected. */
+export declare function parseStatOutput(out: string): FileIdentity | null;
+/**
+ * Stream the bytes AS the drop user: `dd` opens the file with that user's
+ * rights, so a path an agent named can never be turned into a root read — not
+ * by naming `/root/...`, not by swapping a symlink after the offer. Optional
+ * byte range (inclusive), for the `<video>` seek path.
+ */
+export declare function readAsUserArgv(user: string, p: string, range?: {
+    start: number;
+    end: number;
+} | null): {
+    cmd: string;
+    argv: string[];
+};
+/**
+ * Is the file about to be served the one that was OFFERED? An offer records
+ * device + inode; a later symlink swap, rename or replacement changes them.
+ * An offer from before this check (no identity recorded) is not refused.
+ */
+export declare function sameOfferedFile(offered: {
+    dev?: number;
+    ino?: number;
+} | undefined, now: {
+    dev: number;
+    ino: number;
+}): boolean;

package/dist/group-exec.js

@@ -0,0 +1,161 @@
+import { dropArgv, dropEnv, osUserFor } from "./osusers.js";
+import { canSeeGroup } from "./groups.js";
+/**
+ * What the SERVER does on a group's behalf — run a cron guard, read a file an
+ * agent handed over — must be done with that group's rights, never with the
+ * server's. In multi-tenant the server is root, so "run it as the server" means
+ * "run it as root": a cron `check` was a root shell for anyone who could reach
+ * `POST /crons`, and `GET /download` streamed any root-readable file an agent
+ * named. Pure, so every decision here is tested without a server, a root
+ * account or a provisioned OS user (none of which a test machine has).
+ *
+ * Invariant 58.
+ */
+// ── Who may act on a session ────────────────────────────────────────────────
+/**
+ * May this caller schedule / edit / delete a cron on (or otherwise act for)
+ * `targetId`? The HTTP twin of the WS `mayDriveSession`, with one rule more for
+ * an AGENT (a request carrying a per-session key): an agent acts on itself, on a
+ * sibling of its OWN group, or on a commons/public agent — never into another
+ * group, whatever principal its key maps to. That keeps the rule right both
+ * while the key still authenticates as the bootstrap admin and after it maps to
+ * an agent principal of its own.
+ *
+ *  - mono-tenant: there is no wall to protect, today's behaviour (true);
+ *  - a target with no channel row: refused in multi-tenant — a cron aimed at an
+ *    unknown session would fire with a GUESSED directory and group;
+ *  - a dangling group id: refused (fail closed, the twin of `canSeeSession`).
+ */
+export function mayActOnSession(input) {
+    if (input.mode !== "multi-tenant")
+        return true;
+    if (!input.targetId)
+        return false;
+    const ch = input.channels.find((c) => c.sessionId === input.targetId);
+    if (!ch)
+        return false;
+    return mayReachGroup({ ...input, group: ch.group ?? null, self: input.agent?.id === input.targetId });
+}
+/**
+ * The group-level half of `mayActOnSession`, reused where the thing asked for
+ * is a GROUP's rather than a session's (a media subdirectory).
+ */
+export function mayReachGroup(input) {
+    if (input.mode !== "multi-tenant")
+        return true;
+    if (input.self)
+        return true;
+    const g = input.group ? input.groups.find((x) => x.id === input.group) : null;
+    if (input.group && !g)
+        return false; // dangling → fail closed
+    // Group-less = the commons, visible to everyone (today's rule).
+    if (!g || g.nature === "public")
+        return true;
+    if (input.agent)
+        return (input.agent.group ?? null) === g.id;
+    return canSeeGroup(g, input.viewer);
+}
+/**
+ * The OS user the server must act as for a channel of `groupId` — the SAME
+ * answer as the spawn's drop user (`resolveSpawnIsolation` / `channelStateHome`):
+ * the group's own `sk-*` user, else the commons user (null before migration,
+ * meaning the server's own user, exactly as a commons agent runs then).
+ * A group id that resolves to nothing is REFUSED, never mapped to the commons:
+ * acting for a group we cannot identify is how a private job would end up
+ * running with someone else's rights.
+ */
+export function osUserForChannelGroup(groupId, groups, commonsUser) {
+    if (!groupId)
+        return { ok: true, user: commonsUser };
+    const g = groups.find((x) => x.id === groupId);
+    if (!g)
+        return { ok: false };
+    return { ok: true, user: osUserFor(g) ?? commonsUser };
+}
+// ── Cron guard execution ────────────────────────────────────────────────────
+/**
+ * The server environment names a cron guard may inherit. An ALLOW-list on
+ * purpose: the server's env holds the GUI password, the Telegram token, a
+ * custom backend's key, the instance auth cookie — and a deny-list is only as
+ * good as the day it was written (invariant 29's lesson about subtraction).
+ * What a shell script legitimately needs from its surroundings is short:
+ * where binaries are, the locale and zone, a temp dir, proxy and CA settings,
+ * and the SSH fallback a container uses (`src/ssh.ts`). Its credentials come
+ * from the PROFILE's secrets, like the agent's own.
+ */
+export const CHECK_ENV_ALLOW = /^(PATH|LANG|LANGUAGE|LC_[A-Z_]+|TZ|TERM|TMPDIR|SHELL|GIT_SSH_COMMAND|SSL_CERT_FILE|SSL_CERT_DIR|NODE_EXTRA_CA_CERTS|HTTPS?_PROXY|https?_proxy|NO_PROXY|no_proxy|ALL_PROXY|all_proxy)$/;
+/** Identity names kept only when the guard runs as the server's own user
+ *  (mono-tenant, or the commons before migration) — they are that user's. */
+const SELF_IDENTITY = new Set(["HOME", "USER", "LOGNAME"]);
+/**
+ * The full environment of a cron guard. Layers, last wins:
+ *  1. the allow-listed part of the server env (+ HOME/USER/LOGNAME when the
+ *     guard runs as the server's own user — they describe that user);
+ *  2. the target profile's secrets (what the check was always promised);
+ *  3. the session plumbing a script needs to call back the local API
+ *     (`SHADOK_SESSION_ID`/`_PORT`/`_KEY` — the agent's own, never the admin
+ *     cookie `SHADOK_AUTH`);
+ *  4. the drop user's HOME/USER/LOGNAME (`dropEnv`), so a dropped guard never
+ *     keeps the server's `HOME=/root`.
+ */
+export function cronCheckEnv(input) {
+    const env = {};
+    for (const [k, v] of Object.entries(input.base)) {
+        if (v === undefined)
+            continue;
+        if (CHECK_ENV_ALLOW.test(k) || (!input.user && SELF_IDENTITY.has(k)))
+            env[k] = v;
+    }
+    Object.assign(env, input.secrets);
+    env.SHADOK_SESSION_ID = input.session.id;
+    env.SHADOK_PORT = input.session.port;
+    env.SHADOK_SESSION_KEY = input.session.key;
+    Object.assign(env, dropEnv(input.user, input.home));
+    return env;
+}
+/** The guard's command: `sh -c <check>`, wrapped in the same `setpriv` drop as
+ *  an agent's spawn when there is a user to drop to. */
+export function cronCheckCommand(user, check) {
+    return user ? dropArgv(user, "sh", ["-c", check]) : { cmd: "sh", argv: ["-c", check] };
+}
+// ── Reading a file AS a group's user ────────────────────────────────────────
+/**
+ * `stat` as the drop user: format, size, device and inode on four lines.
+ * `-L` follows a symlink — AS THAT USER, so it can only ever reach what the
+ * user could read anyway; the identity of what it reached is what the offer
+ * records and the download compares.
+ */
+export function statAsUserArgv(user, p) {
+    return dropArgv(user, "stat", ["-L", "--printf=%F\\n%s\\n%d\\n%i\\n", "--", p]);
+}
+/** Parse `statAsUserArgv`'s output; null on anything unexpected. */
+export function parseStatOutput(out) {
+    const [kind, size, dev, ino] = String(out ?? "").split("\n");
+    const n = [Number(size), Number(dev), Number(ino)];
+    if (!kind || n.some((x) => !Number.isFinite(x) || x < 0))
+        return null;
+    return { isFile: /^regular( empty)? file$/.test(kind.trim()), size: n[0], dev: n[1], ino: n[2] };
+}
+/**
+ * Stream the bytes AS the drop user: `dd` opens the file with that user's
+ * rights, so a path an agent named can never be turned into a root read — not
+ * by naming `/root/...`, not by swapping a symlink after the offer. Optional
+ * byte range (inclusive), for the `<video>` seek path.
+ */
+export function readAsUserArgv(user, p, range) {
+    const ops = [`if=${p}`, "bs=65536", "status=none"];
+    if (range)
+        ops.push("iflag=skip_bytes,count_bytes,fullblock", `skip=${range.start}`, `count=${range.end - range.start + 1}`);
+    return dropArgv(user, "dd", ops);
+}
+/**
+ * Is the file about to be served the one that was OFFERED? An offer records
+ * device + inode; a later symlink swap, rename or replacement changes them.
+ * An offer from before this check (no identity recorded) is not refused.
+ */
+export function sameOfferedFile(offered, now) {
+    if (!offered || offered.dev === undefined || offered.ino === undefined)
+        return true;
+    return offered.dev === now.dev && offered.ino === now.ino;
+}
+//# sourceMappingURL=group-exec.js.map

package/dist/group-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-exec.js","sourceRoot":"","sources":["../src/group-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,WAAW,EAA2B,MAAM,aAAa,CAAC;AAGnE;;;;;;;;;;GAUG;AAEH,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,KAQ/B;IACC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAO7B;IACC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,yBAAyB;IAC9D,gEAAgE;IAChE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAkC,EAClC,MAAwB,EACxB,WAA0B;IAE1B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,uLAAuL,CAAC;AAE1L;6EAC6E;AAC7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAM5B;IACC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;wDACwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,IAAmB,EAAE,KAAa;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,CAAS;IACpD,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AASD,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,CAAS,EACT,KAA6C;IAE7C,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACnD,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,QAAQ,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7H,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAmD,EACnD,GAAiC;IAEjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC"}

package/dist/media-scope.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Where a pasted / Telegram attachment lives, per GROUP. Pure.
+ *
+ * Multi-tenant used to put every group's media in ONE directory under the
+ * shared pot, mode 2775 group `shadok-shared` — and every `sk-*` user is in
+ * that group. So any agent could read another group's screenshots, overwrite
+ * them, or plant `x.png -> /root/.shadok-ai/secrets.json`, which `/media`
+ * (served as root, following symlinks) then handed to the browser. The pot is
+ * also group-WRITABLE with no sticky bit, so the media directory itself could
+ * be renamed away and replaced.
+ *
+ * Now: a root-owned media ROOT outside the pot (0711 — traversable, not
+ * listable), and one subdirectory per group, `g-<key>`, owned root:<that
+ * group's OS user's group>, mode 2750. Only root writes there; only that
+ * group's user (and root) reads. Mono-tenant keeps its single flat directory.
+ *
+ * Invariant 58.
+ */
+/** Prefix of a group media subdirectory; a flat (legacy / mono) file never
+ *  sits in a directory with this shape, so the two cannot be confused. */
+export declare const MEDIA_GROUP_PREFIX = "g-";
+export declare const MEDIA_GROUP_DIR_RE: RegExp;
+/** The subdirectory name of a group. A group id that is already a safe name is
+ *  used as is (readable on disk: `g-main`, `g-<uuid>`); anything else is hashed
+ *  rather than sanitised, because a lossy sanitising could map two ids to ONE
+ *  directory — the very sharing this exists to end. */
+export declare function mediaGroupKey(groupId: string | null | undefined): string;
+/** The directory a new attachment of this group is written to. */
+export declare function mediaDirForGroup(root: string, groupId: string | null | undefined, multiTenant: boolean): string;
+/** Mode of a file the server writes into the media tree: the group's user reads
+ *  it in multi-tenant (the directory's setgid group), only the server otherwise. */
+export declare function mediaFileMode(multiTenant: boolean): number;
+/**
+ * Split a `/media` request into the directory it names and the file. `key` is
+ * null for a flat (legacy / mono-tenant) file. Anything that is not exactly one
+ * or two plain path segments is refused (`null`).
+ */
+export declare function parseMediaRequest(segments: readonly string[]): {
+    key: string | null;
+    name: string;
+} | null;
+/** The group a media key belongs to, among the known groups (null if none). */
+export declare function groupForMediaKey(key: string, groupIds: readonly string[]): string | null;
+/** A user's primary gid from `/etc/passwd` text, or null. */
+export declare function passwdGid(passwd: string, user: string): number | null;
+/**
+ * How a group media directory must look. No drop user (commons before
+ * migration, whose agents run as the server) → 0700, server only. Otherwise
+ * setgid 2750 on the user's group, so frames ffmpeg writes beside a video
+ * inherit that group too.
+ */
+export declare function mediaDirSpec(gid: number | null): {
+    gid: number | null;
+    mode: number;
+};
+/**
+ * May a directory entry found where a group media directory should be, be kept?
+ * Only a real directory owned by the server. Anything else (a symlink, a file,
+ * a directory an agent created while the old media dir was group-writable) is
+ * moved aside and recreated — never written through.
+ */
+export declare function mediaDirTrusted(st: {
+    isDirectory: boolean;
+    isSymbolicLink: boolean;
+    uid: number;
+}, serverUid: number): boolean;
+/**
+ * May `/media` serve this entry (from `lstat`)? A regular file, never a
+ * symlink; in multi-tenant also one the SERVER wrote — a file an agent planted
+ * in the old shared directory is not media anyone uploaded.
+ */
+export declare function mediaServable(st: {
+    isFile: boolean;
+    isSymbolicLink: boolean;
+    uid: number;
+}, multiTenant: boolean, serverUid: number): boolean;

package/dist/media-scope.js

@@ -0,0 +1,103 @@
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { MAIN_GROUP_ID } from "./groups.js";
+/**
+ * Where a pasted / Telegram attachment lives, per GROUP. Pure.
+ *
+ * Multi-tenant used to put every group's media in ONE directory under the
+ * shared pot, mode 2775 group `shadok-shared` — and every `sk-*` user is in
+ * that group. So any agent could read another group's screenshots, overwrite
+ * them, or plant `x.png -> /root/.shadok-ai/secrets.json`, which `/media`
+ * (served as root, following symlinks) then handed to the browser. The pot is
+ * also group-WRITABLE with no sticky bit, so the media directory itself could
+ * be renamed away and replaced.
+ *
+ * Now: a root-owned media ROOT outside the pot (0711 — traversable, not
+ * listable), and one subdirectory per group, `g-<key>`, owned root:<that
+ * group's OS user's group>, mode 2750. Only root writes there; only that
+ * group's user (and root) reads. Mono-tenant keeps its single flat directory.
+ *
+ * Invariant 58.
+ */
+/** Prefix of a group media subdirectory; a flat (legacy / mono) file never
+ *  sits in a directory with this shape, so the two cannot be confused. */
+export const MEDIA_GROUP_PREFIX = "g-";
+export const MEDIA_GROUP_DIR_RE = /^g-[A-Za-z0-9_-]{1,64}$/;
+/** The subdirectory name of a group. A group id that is already a safe name is
+ *  used as is (readable on disk: `g-main`, `g-<uuid>`); anything else is hashed
+ *  rather than sanitised, because a lossy sanitising could map two ids to ONE
+ *  directory — the very sharing this exists to end. */
+export function mediaGroupKey(groupId) {
+    const id = groupId || MAIN_GROUP_ID;
+    if (/^[A-Za-z0-9_-]{1,64}$/.test(id))
+        return MEDIA_GROUP_PREFIX + id;
+    return MEDIA_GROUP_PREFIX + "h" + createHash("sha256").update(id).digest("hex").slice(0, 32);
+}
+/** The directory a new attachment of this group is written to. */
+export function mediaDirForGroup(root, groupId, multiTenant) {
+    return multiTenant ? path.join(root, mediaGroupKey(groupId)) : root;
+}
+/** Mode of a file the server writes into the media tree: the group's user reads
+ *  it in multi-tenant (the directory's setgid group), only the server otherwise. */
+export function mediaFileMode(multiTenant) {
+    return multiTenant ? 0o640 : 0o600;
+}
+/**
+ * Split a `/media` request into the directory it names and the file. `key` is
+ * null for a flat (legacy / mono-tenant) file. Anything that is not exactly one
+ * or two plain path segments is refused (`null`).
+ */
+export function parseMediaRequest(segments) {
+    const ok = (s) => !!s && s !== "." && s !== ".." && !/[/\\\0]/.test(s);
+    if (segments.length === 1 && ok(segments[0]))
+        return { key: null, name: segments[0] };
+    if (segments.length === 2 && MEDIA_GROUP_DIR_RE.test(segments[0]) && ok(segments[1]))
+        return { key: segments[0], name: segments[1] };
+    return null;
+}
+/** The group a media key belongs to, among the known groups (null if none). */
+export function groupForMediaKey(key, groupIds) {
+    for (const id of [MAIN_GROUP_ID, ...groupIds])
+        if (mediaGroupKey(id) === key)
+            return id;
+    return null;
+}
+/** A user's primary gid from `/etc/passwd` text, or null. */
+export function passwdGid(passwd, user) {
+    for (const line of String(passwd ?? "").split("\n")) {
+        const f = line.split(":");
+        if (f.length >= 4 && f[0] === user) {
+            return /^\d+$/.test(f[3]) ? Number(f[3]) : null;
+        }
+    }
+    return null;
+}
+/**
+ * How a group media directory must look. No drop user (commons before
+ * migration, whose agents run as the server) → 0700, server only. Otherwise
+ * setgid 2750 on the user's group, so frames ffmpeg writes beside a video
+ * inherit that group too.
+ */
+export function mediaDirSpec(gid) {
+    return gid == null ? { gid: null, mode: 0o700 } : { gid, mode: 0o2750 };
+}
+/**
+ * May a directory entry found where a group media directory should be, be kept?
+ * Only a real directory owned by the server. Anything else (a symlink, a file,
+ * a directory an agent created while the old media dir was group-writable) is
+ * moved aside and recreated — never written through.
+ */
+export function mediaDirTrusted(st, serverUid) {
+    return st.isDirectory && !st.isSymbolicLink && st.uid === serverUid;
+}
+/**
+ * May `/media` serve this entry (from `lstat`)? A regular file, never a
+ * symlink; in multi-tenant also one the SERVER wrote — a file an agent planted
+ * in the old shared directory is not media anyone uploaded.
+ */
+export function mediaServable(st, multiTenant, serverUid) {
+    if (st.isSymbolicLink || !st.isFile)
+        return false;
+    return !multiTenant || st.uid === serverUid;
+}
+//# sourceMappingURL=media-scope.js.map

package/dist/media-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-scope.js","sourceRoot":"","sources":["../src/media-scope.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AAEH;0EAC0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D;;;uDAGuD;AACvD,MAAM,UAAU,aAAa,CAAC,OAAkC;IAC9D,MAAM,EAAE,GAAG,OAAO,IAAI,aAAa,CAAC;IACpC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,kBAAkB,GAAG,EAAE,CAAC;IACrE,OAAO,kBAAkB,GAAG,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAkC,EAAE,WAAoB;IACrG,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,aAAa,CAAC,WAAoB;IAChD,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B;IAC3D,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAA2B;IACvE,KAAK,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC;QAAE,IAAI,aAAa,CAAC,EAAE,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY;IACpD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAAkE,EAAE,SAAiB;IACnH,OAAO,EAAE,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,EAA6D,EAC7D,WAAoB,EACpB,SAAiB;IAEjB,IAAI,EAAE,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC;AAC9C,CAAC"}