shraga 0.1.111 → 0.1.113

package/src/server/hooks.ts

@@ -7,6 +7,7 @@
  */
 import type { HookCallback, HookCallbackMatcher, HookEvent, PreToolUseHookInput } from '@anthropic-ai/claude-agent-sdk';
 import { rewriteSlackMentions } from './slack/mention-rewrite.ts';
+import { PROTECTED_DATA_MESSAGE, writesProtectedData } from './security/enforce.ts';
 
 /** Patterns that indicate a long-running script the model should background. */
 const LONG_RUNNING_PATTERNS = [
@@ -134,6 +135,23 @@ const guardFirebaseReads: HookCallback = async (input) => {
   };
 };
 
+/** Tamper protection: no agent file tool writes server-owned data (audit, conversations, sessions, security, keys,
+ *  MCP config) — any profile, SECURITY_ENFORCE on or off. A hook, not canUseTool: the SDK auto-approves allowed/
+ *  accept-edits tools without calling canUseTool. See security/enforce.ts PROTECTED_DATA_WRITE. */
+const denyProtectedDataWrites: HookCallback = async (input) => {
+  if (input.hook_event_name !== 'PreToolUse') return {};
+  const { tool_name, tool_input, cwd } = input as PreToolUseHookInput;
+  if (!writesProtectedData(tool_name, (tool_input ?? {}) as Record<string, unknown>, cwd || undefined)) return {};
+  console.log(`[hooks] Denied ${tool_name} on protected data path`);
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse' as const,
+      permissionDecision: 'deny' as const,
+      permissionDecisionReason: PROTECTED_DATA_MESSAGE,
+    },
+  };
+};
+
 /** Build the hooks map to pass into SDK query() options.
  *  `exemptBashCommand` is the one command the turn was explicitly told to run in the foreground
  *  (a `bash` schedule's command) — see forceBackgroundForScripts. */
@@ -143,6 +161,7 @@ export function buildHooks(opts?: { exemptBashCommand?: string }): Partial<Recor
       { matcher: 'Bash', hooks: [forceBackgroundForScripts(opts?.exemptBashCommand)] },
       { matcher: 'mcp__mcp-slack-use__post_slack_.*', hooks: [resolveSlackMentions] },
       { matcher: 'mcp__mcp-firebase-(?:prod|lab)__get_db.*', hooks: [guardFirebaseReads] },
+      { matcher: 'Write|Edit|MultiEdit|NotebookEdit', hooks: [denyProtectedDataWrites] },
     ],
   };
 }

package/src/server/mcp-oauth.ts

@@ -6,18 +6,23 @@
  * of a static `uck_` API key.
  *
  * Provider-agnostic by design: the only place a user proves identity is `/oauth/authorize/consent`,
- * which is guarded by `requireAuth` — the same seam that handles Firebase today and email-password
+ * which is guarded by `requireAuth` AND requires an interactive login (principal kind `user` — never an API key or
+ * internal token, which would otherwise mint themselves a login-equivalent MCP token) — the same seam that handles Firebase today and email-password
  * later. Access/refresh tokens are stateless HMAC tokens (see auth.ts:signMcpToken). No DB:
  * clients live in a flat JSON file, auth codes in a short-TTL in-memory map.
  */
 import type { Express, Request, Response, NextFunction } from 'express';
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { randomBytes, createHash } from 'node:crypto';
-import { requireAuth, signMcpToken, verifyMcpToken, type AuthUser } from './auth.ts';
+import { MCP_TOKEN_TTL, requireAuth, signMcpToken, verifyMcpToken, type AuthUser } from './auth.ts';
 import { dataPath } from './paths.ts';
+import { security } from './security/runtime.ts';
+import { fromAuthUser } from './security/principal.ts';
+import { tokenRevoked } from './security/revocation.ts';
 
-const ACCESS_TTL = 3600; // 1h
-const REFRESH_TTL = 60 * 60 * 24 * 30; // 30d
+// Shared with auth.ts: a legacy token's implied issued-at is exp - TTL, so the TTLs must be the ones signed with.
+const ACCESS_TTL = MCP_TOKEN_TTL.access; // 1h
+const REFRESH_TTL = MCP_TOKEN_TTL.refresh; // 30d
 const CODE_TTL_MS = 60_000; // 1min
 
 const CLIENTS_PATH = () => dataPath('oauth-clients.json');
@@ -48,6 +53,8 @@ interface AuthCode {
   challenge: string;       // PKCE code_challenge (S256)
   resource?: string;
   expiresAt: number;
+  /** Epoch seconds — checked against tokensValidAfter at exchange, so a revocation also kills unexchanged codes. */
+  issuedAt: number;
 }
 const codes = new Map<string, AuthCode>();
 
@@ -133,6 +140,14 @@ export function registerMcpOAuthRoutes(app: Express) {
   // ── Consent → issue authorization code (identity via requireAuth seam) ───────
   app.post('/oauth/authorize/consent', oauthCors, requireAuth, (req: Request, res: Response) => {
     const user = (req as any).user as AuthUser;
+    // Consent mints an OAuth grant AS this identity — only an interactive login may give it. An API key or internal
+    // token must not launder itself into a login-equivalent (possibly owner) MCP token.
+    const kind = user.principal?.kind ?? 'unknown';
+    if (kind !== 'user') {
+      console.warn(`[mcp-oauth] consent refused: non-interactive credential (${kind})`);
+      security()?.authDeny('oauth:consent', `non-interactive:${kind}`, req.ip);
+      return void res.status(403).json({ error: 'access_denied', error_description: 'OAuth consent requires an interactive login' });
+    }
     const { client_id, redirect_uri, code_challenge, code_challenge_method, resource } = (req.body ?? {}) as Record<string, string>;
     if (!client_id || !redirect_uri || !code_challenge) {
       return void res.status(400).json({ error: 'invalid_request', error_description: 'client_id, redirect_uri, code_challenge required' });
@@ -149,7 +164,7 @@ export function registerMcpOAuthRoutes(app: Express) {
     const code = randomBytes(32).toString('hex');
     codes.set(code, {
       uid: user.uid, email: user.email, clientId: client_id, redirectUri: redirect_uri,
-      challenge: code_challenge, resource, expiresAt: Date.now() + CODE_TTL_MS,
+      challenge: code_challenge, resource, expiresAt: Date.now() + CODE_TTL_MS, issuedAt: Math.floor(Date.now() / 1000),
     });
     console.log(`[mcp-oauth] issued auth code for ${user.email} → client ${client_id}`);
     res.json({ code });
@@ -170,6 +185,10 @@ export function registerMcpOAuthRoutes(app: Express) {
       if (!b.code_verifier || !pkceVerify(b.code_verifier, entry.challenge)) {
         return void res.status(400).json({ error: 'invalid_grant', error_description: 'PKCE verification failed' });
       }
+      if (tokenRevoked(fromAuthUser({ uid: entry.uid, email: entry.email }).id, entry.issuedAt)) {
+        console.warn(`[mcp-oauth] auth code for ${entry.email} predates a token revocation — refused`);
+        return void res.status(400).json({ error: 'invalid_grant', error_description: 'authorization revoked — sign in again' });
+      }
       return void res.json({
         access_token: signMcpToken(entry.uid, entry.email, 'access', ACCESS_TTL),
         token_type: 'Bearer',

package/src/server/mcp-server.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { timingSafeEqual } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { json } from 'itty-router';
 import { RouterWrapper, captureMcpProgress } from 'edge.libx.js/build/main.js';
 import type { Application, Request, Response } from 'express';
@@ -11,8 +12,10 @@ import { getAllSessions, loadConversation, isSessionLocked } from './sessions.ts
 import * as scheduler from './scheduler/index.ts';
 import { buildReport } from './downtime.ts';
 import { getAgentConfig, MAX_TURNS_NOTICE } from './claude.ts';
-import { validateApiKey } from './api-keys.ts';
+import { apiKeyPrincipal, validateApiKey } from './api-keys.ts';
 import { verifyMcpToken } from './auth.ts';
+import { fromAuthUser, fromInternal, type Principal } from './security/principal.ts';
+import { security, admitTurn, requestIp } from './security/runtime.ts';
 import { makeProgressEmitter } from './mcp-progress.ts';
 import { lookupIdempotent, rememberIdempotent } from './idempotency.ts';
 import type { WsEvent } from './claude.ts';
@@ -31,6 +34,7 @@ export type RunChatTurn = (
     userName?: string;
     abortController?: AbortController;
     context?: Record<string, string>;
+    principal: Principal;
   },
   hooks?: { onEvent?: (ev: WsEvent) => void },
 ) => Promise<RunChatTurnResult>;
@@ -39,9 +43,21 @@ export interface McpServerDeps {
   runChatTurn: RunChatTurn;
 }
 
-// Per-request caller identity, set by the /mcp Express handler before forwarding to MCP tool handlers.
-// Safe because Node is single-threaded and the handler awaits the full MCP response.
-let currentCaller: { uid: string; email: string } | null = null;
+export interface McpCaller { uid: string; email: string; principal: Principal; ip?: string }
+
+/** Identity of the legacy raw INTERNAL_API_TOKEN caller — unchanged effective identity, now an internal principal. */
+const LEGACY_INTERNAL_CALLER: McpCaller = {
+  uid: 'agent-internal', email: 'agent@internal',
+  principal: fromInternal({ uid: 'agent-internal', email: 'agent@internal', lane: 'mcp-legacy-token' }),
+};
+
+// Per-request caller identity. AsyncLocalStorage, not a module global: two concurrent /mcp requests
+// (a long sync post_chat + a second caller) used to overwrite — and then null — each other's caller.
+// The store is entered around the WHOLE /mcp handler, SSE pipe included.
+const mcpCallerStore = new AsyncLocalStorage<McpCaller>();
+
+/** The authenticated /mcp caller of the current request — valid anywhere in its async chain, across awaits. */
+export function currentMcpCaller(): McpCaller | undefined { return mcpCallerStore.getStore(); }
 
 function errMessage(e: unknown): string {
   return e instanceof Error ? e.message : String(e);
@@ -286,7 +302,7 @@ export function createShragaMcp(deps: McpServerDeps) {
       const { prompt, sessionId, sync = true, clientRequestId } = body as { prompt?: string; sessionId?: string; sync?: boolean; clientRequestId?: string };
       if (!prompt) return json({ error: 'prompt required' }, { status: 400 });
 
-      const caller = currentCaller || { uid: 'agent-internal', email: 'agent@internal' };
+      const caller = currentMcpCaller() ?? LEGACY_INTERNAL_CALLER;
       const idemKey = clientRequestId || str(req.headers?.get?.('idempotency-key'));
 
       // Idempotency: a retried submit with the same key reuses the session that first
@@ -299,23 +315,33 @@ export function createShragaMcp(deps: McpServerDeps) {
       // Pre-allocate the session id so async callers get a real id back immediately
       // (parity with POST /api/chat). Lets timeout-prone MCP clients recover/continue
       // instead of double-submitting and creating duplicate sessions.
+      // Guard before any spend: blocklist → rate → concurrency (shadow unless SECURITY_ENFORCE).
+      const admission = admitTurn(caller.principal, { ip: caller.ip, channel: 'mcp' });
+      if (!admission.ok) {
+        return json({ error: admission.status === 403 ? 'Forbidden' : 'Too many requests', reason: admission.reason, retryAfter: admission.retryAfter },
+          { status: admission.status, headers: admission.retryAfter ? { 'Retry-After': String(admission.retryAfter) } : undefined });
+      }
+
       const sid = sessionId || `api-${crypto.randomUUID()}`;
       if (idemKey) rememberIdempotent(caller.uid, idemKey, sid);
-      const turn = { prompt, sessionId: sid, uid: caller.uid, userEmail: caller.email, context: { source: 'mcp', user: caller.email } };
+      const turn = { prompt, sessionId: sid, uid: caller.uid, userEmail: caller.email, principal: caller.principal, context: { source: 'mcp', user: caller.email } };
 
       if (sync === false) {
         // Reject a duplicate before responding 'accepted' (lock is acquired inside the turn).
         if (sessionId && isSessionLocked(sid)) {
+          admission.release();
           return json({ error: 'Session is already processing a request' }, { status: 409 });
         }
         // Fire-and-forget: kick off the turn, return the real session id immediately.
-        void deps.runChatTurn(turn);
+        void deps.runChatTurn(turn).finally(admission.release);
         return json({ sessionId: sid, status: 'accepted' });
       }
 
       // Capture the progress channel here (within the tools/call async context) and stream
       // agent events as notifications/progress. No-op unless the client requested progress.
-      const result = await deps.runChatTurn(turn, { onEvent: makeProgressEmitter(captureMcpProgress()) });
+      let result: Awaited<ReturnType<typeof deps.runChatTurn>>;
+      try { result = await deps.runChatTurn(turn, { onEvent: makeProgressEmitter(captureMcpProgress()) }); }
+      finally { admission.release(); }
       if ('status' in result) return json({ error: 'Session is already processing a request' }, { status: 409 });
       if ('error' in result) return json({ error: result.error, sessionId: result.sessionId }, { status: 500 });
       // A turn that hit the step ceiling is a PARTIAL answer. Without this the MCP caller got the
@@ -413,31 +439,37 @@ export function mountMcpServer(app: Application, deps: McpServerDeps) {
     const authHeader = req.headers.authorization?.replace('Bearer ', '');
     const internalToken = req.headers['x-internal-token'] as string | undefined;
 
-    let authed = false;
-    let caller: { uid: string; email: string } | null = null;
+    let caller: McpCaller | null = null;
+    let via = 'mcp';
     if (internalToken && process.env.INTERNAL_API_TOKEN) {
       const secret = process.env.INTERNAL_API_TOKEN;
-      authed = internalToken.length === secret.length &&
-        timingSafeEqual(Buffer.from(internalToken), Buffer.from(secret));
+      if (internalToken.length === secret.length && timingSafeEqual(Buffer.from(internalToken), Buffer.from(secret))) {
+        caller = LEGACY_INTERNAL_CALLER; via = 'mcp:internal';
+      }
     }
-    if (!authed && authHeader?.startsWith('uck_')) {
-      caller = validateApiKey(authHeader);
-      authed = !!caller;
+    if (!caller && authHeader?.startsWith('uck_')) {
+      const k = validateApiKey(authHeader);
+      if (k) { caller = { uid: k.uid, email: k.email, principal: apiKeyPrincipal(k) }; via = 'mcp:apikey'; }
     }
-    if (!authed && authHeader?.startsWith('mcp_')) {
+    if (!caller && authHeader?.startsWith('mcp_')) {
       const id = verifyMcpToken(authHeader);
-      if (id && id.kind === 'access') { caller = { uid: id.uid, email: id.email }; authed = true; }
+      if (id && id.kind === 'access') { caller = { uid: id.uid, email: id.email, principal: fromAuthUser(id) }; via = 'mcp:oauth'; }
     }
-    if (!authed) {
+    if (!caller) {
+      security()?.authDeny('mcp', authHeader || internalToken ? 'invalid-credential' : 'missing-credential', req.ip);
       // Point MCP clients (claude.ai et al.) at our OAuth discovery so they can run the auth handshake.
       const proto = (req.get('x-forwarded-proto') || req.protocol).split(',')[0];
       const base = `${proto}://${req.get('host')}`;
       res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`);
       return void res.status(401).json({ error: 'Unauthorized — provide API key or complete OAuth' });
     }
-    currentCaller = caller;
+    security()?.authAllow(caller.principal, via);
+    return mcpCallerStore.run({ ...caller, ip: requestIp(req) }, () => bridge(req, res));
+  });
 
-    // Bridge Express Request → Web API Request → MCPAdapter.httpHandler → Express Response.
+  // Bridge Express Request → Web API Request → MCPAdapter.httpHandler → Express Response. Runs inside
+  // the caller's AsyncLocalStorage context (entered above), which the tool handlers read.
+  async function bridge(req: Request, res: Response): Promise<void> {
     const url = `${req.protocol}://${req.get('host')}${req.originalUrl}`;
     const webReq = new globalThis.Request(url, {
       method: req.method,
@@ -454,8 +486,8 @@ export function mountMcpServer(app: Application, deps: McpServerDeps) {
       res.status(webRes.status);
       webRes.headers.forEach((val, key) => res.setHeader(key, val));
       // For a Streamable-HTTP SSE response (progress streaming), pipe the body so frames flush
-      // as the agent emits them. currentCaller stays set until the pipe completes (the tool
-      // handler reads it inside the stream). Otherwise buffer the single JSON response.
+      // as the agent emits them. The caller context spans the pipe (the tool handler reads it inside
+      // the stream). Otherwise buffer the single JSON response.
       if (webRes.body && (webRes.headers.get('content-type') || '').includes('text/event-stream')) {
         (res as any).flushHeaders?.();
         const reader = webRes.body.getReader();
@@ -473,10 +505,8 @@ export function mountMcpServer(app: Application, deps: McpServerDeps) {
       console.error('[mcp-server] handler error:', e);
       if (!res.headersSent) res.status(500).json({ error: 'MCP handler error' });
       else res.end();
-    } finally {
-      currentCaller = null;
     }
-  });
+  }
 
   console.log('[mcp-server] MCP endpoint mounted at /mcp');
 }

package/src/server/modules/routes.ts

@@ -3,13 +3,9 @@
 import type { Express, RequestHandler, Request, Response } from 'express';
 import { loadState, listAvailableModules, installModule, enableModule, disableModule, setModuleConfig, uninstallModule, readManifest, readModuleReadme } from './service.ts';
 import { dataPath } from '../paths.ts';
+import { ownerOnly as ownerGate } from '../security/owner-only.ts';
 
-function ownerOnly(req: Request, res: Response): boolean {
-  const user = (req as any).user;
-  if (user?.isOwner) return true;
-  res.status(403).json({ error: 'Only an owner can manage modules' });
-  return false;
-}
+const ownerOnly = (req: Request, res: Response): boolean => ownerGate(req, res, 'Only an owner can manage modules');
 
 export function registerModuleRoutes(app: Express, requireAuth: RequestHandler): void {
   app.get('/api/modules', requireAuth, (_req, res) => {

package/src/server/notify-owners.ts

@@ -10,23 +10,11 @@ import { emitEvent } from './events/bus.ts';
 
 export type Owner = { name?: string; slackId: string };
 
-/** The OWNERS env list, lowercased. THE definition of "an owner of this deployment" — every
- *  medium joins on it, each through whatever identity it happens to hold. */
-export function ownerEmails(): string[] {
-  return (process.env.OWNERS ?? '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
-}
-
-/** Is this email address an owner of this deployment?
- *
- *  Exported because a medium that is not Slack cannot use `resolveOwners`: that returns Slack ids
- *  (OWNERS ∩ contacts WITH a Slack id), which is a Slack-shaped answer. A webhook-lane add-on, for
- *  instance, holds a shraga uid + the email of the API key that opened the link, so it joins on the
- *  email instead. An empty/unknown address is NOT an owner — the fail-closed direction, since the
- *  alternative is fanning a deploy report out to whoever happened to open a link. */
-export function isOwnerEmail(email: string | undefined | null): boolean {
-  const e = String(email ?? '').trim().toLowerCase();
-  return !!e && ownerEmails().includes(e);
-}
+// OWNERS parsing lives in ./owners.ts (single definition). Re-exported under the historical names:
+// `isOwnerEmail` joins media that hold an email rather than a Slack id (e.g. webhook-lane); an
+// empty/unknown address is NOT an owner — fail-closed.
+export { getOwners as ownerEmails, isOwnerEmail } from './owners.ts';
+import { isOwnerEmail } from './owners.ts';
 
 /** Owners of THIS deployment (OWNERS env ∩ contacts that have a Slack id). */
 export async function resolveOwners(): Promise<Owner[]> {

package/src/server/owners.ts

@@ -0,0 +1,14 @@
+// The root of trust for "who owns this deployment": the OWNERS env var. Dependency-free on
+// purpose — auth, notify-owners and the security policy all join on it, so it must not import any
+// of them.
+
+/** OWNERS="email1,email2" → lowercased, trimmed, de-duplicated list. Read per call (env may change in tests). */
+export function getOwners(): string[] {
+  return [...new Set((process.env.OWNERS ?? '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean))];
+}
+
+/** Is this email an owner? Empty/unknown is NOT an owner (fail-closed). */
+export function isOwnerEmail(email: string | undefined | null): boolean {
+  const e = String(email ?? '').trim().toLowerCase();
+  return !!e && getOwners().includes(e);
+}

package/src/server/scheduler/builtins.ts

@@ -8,7 +8,9 @@ import type { Schedule } from './types.ts';
 // which it is NOT for an npm-consumer app.
 const SUMMARIZER_CMD = `bun run ${fileURLToPath(new URL('../../scripts/summarize-conversations.ts', import.meta.url))}`;
 
-export const SYSTEM_UID = '__system__';
+// Single definition lives with the security principal (a system lane resolves to operator there).
+import { SYSTEM_UID } from '../security/principal.ts';
+export { SYSTEM_UID };
 export const NIGHTLY_RECONCILE_SCHEDULE_ID = 'builtin-nightly-reconcile';
 export const DAILY_GARDEN_SCHEDULE_ID = 'builtin-daily-garden';
 export const HOURLY_SUMMARIZER_SCHEDULE_ID = 'builtin-conversation-summarizer';

package/src/server/scheduler/runner.ts

@@ -3,6 +3,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { dirname, resolve, isAbsolute } from 'node:path';
 import { DATA_DIR } from '../paths.ts';
 import { streamChat, type PermissionHandler } from '../claude.ts';
+import { fromInternal } from '../security/principal.ts';
 import { getMcpConfig } from '../mcp.ts';
 import { appendMessage, createScheduledSession, updateScheduledSessionStatus, setRunStatus, registerLivePartial, unregisterLivePartial, writePartial, clearPartial, acquireSessionLock, releaseSessionLock, type ConvBlock } from '../sessions.ts';
 import type { Schedule, ScheduleRunSummary } from './types.ts';
@@ -303,6 +304,8 @@ export async function runSchedule(
       toolUses.clear();
       try {
         for await (const ev of streamChat({
+          // No human at run time: the creator's identity, marked internal (re-resolved per run).
+          principal: fromInternal({ uid: schedule.createdBy.uid, email: schedule.createdBy.email, lane: 'scheduler' }),
           prompt,
           sessionId,
           uid: schedule.createdBy.uid,