shraga 0.1.111 → 0.1.113

package/src/server/security/runtime.ts

@@ -0,0 +1,174 @@
+// Security runtime: the ONE process-wide Policy + Audit, and the per-turn decision.
+//
+// SHADOW MODE: decide() computes and audits; nothing here denies. Callers never branch on it yet.
+// Uninitialized (tests, embedders that never call initSecurity) ⇒ security() is undefined and every
+// call site no-ops — the audit trail is additive, never a precondition for a turn or a request.
+//
+// Writes are gated on `isActive` (a PASSIVE standby shares DATA_DIR and must not append to data/audit, nor let the
+// Policy migrate/save/mark or judge tamper; `activate()` re-loads the policy on promotion), and noisy events are
+// deduped per key per window, so a busy client isn't one line per request.
+import { OWNER_ROLE, Policy, type PolicyOptions, type Resolved, type TamperReason } from './policy.ts';
+import { Audit, type AuditEvent, type AuditOptions } from './audit.ts';
+import { Guard, type GuardOptions, type TurnAdmission } from './guard.ts';
+import { fromAuthUser, type Principal } from './principal.ts';
+
+/** principal → role. An API key acts for its creator, re-resolved per call (so an OWNERS removal applies at once):
+ *  - no `attrs.role` (a delegated login credential) ⇒ the creator's role, owner included;
+ *  - `attrs.role` set ⇒ min(creator's role, that role, the highest role below owner) — never above the creator, never owner. */
+export function resolvePrincipal(policy: Policy, p: Principal): Resolved {
+  if (p.kind !== 'apikey') return policy.resolve(p);
+  const creator = policy.resolve(fromAuthUser({ uid: String(p.attrs.uid ?? ''), email: p.email }));
+  if (typeof p.attrs.role !== 'string') return creator;
+  const r = creator.role === OWNER_ROLE ? policy.belowOwner() : creator;
+  const cap = policy.effective(Infinity, p.attrs.role); // the named role (unknown ⇒ the policy default)
+  return cap.rank < r.rank ? cap : r;
+}
+
+export interface Decision {
+  role: string;
+  rank: number;
+  profile: string;
+  /** The profile would NOT allow today's behavior (every tool, every MCP, full env, outbound). */
+  wouldDeny: boolean;
+}
+
+export class SecurityRuntimeOptions {
+  policy: Partial<PolicyOptions> = {};
+  audit: Partial<AuditOptions> = {};
+  guard: Partial<GuardOptions> = {};
+  /** Audit writes (and tamper notices) only while this is true. */
+  isActive: () => boolean = () => true;
+  /** A deduped event with the same key is written at most once per window. */
+  dedupeMs: number = 60_000;
+  clock: () => number = Date.now;
+  /** Owner notice. Default: notify-owners (lazy import — keeps this module free of the event bus). */
+  notify: (text: string) => void = (text) => {
+    import('../notify-owners.ts')
+      .then(m => m.notifyOwners('security', text))
+      .catch((e: any) => console.error('[security] owner notice failed:', e?.message ?? e));
+  };
+  log: Pick<Console, 'info' | 'warn' | 'error'> = console;
+}
+
+const MAX_DEDUPE_KEYS = 5000;
+
+export class SecurityRuntime {
+  public options: SecurityRuntimeOptions;
+  public readonly policy: Policy;
+  public readonly audit: Audit;
+  public readonly guard: Guard;
+  private seen = new Map<string, number>();
+
+  public constructor(options?: Partial<SecurityRuntimeOptions>) {
+    this.options = { ...new SecurityRuntimeOptions(), ...options };
+    const { policy, audit, guard, log, clock } = this.options;
+    this.audit = new Audit({
+      log, ...audit,
+      // Standby instances share DATA_DIR: only the active one alerts (false = ask again after promotion).
+      onAnomaly: (info) => {
+        if (audit.onAnomaly?.(info) === false || !this.active()) return false;
+        this.options.notify(`Audit log entry ${info.file} in ${info.dir} is a ${info.kind}, not a regular file — possibly planted to divert or disable auditing. Appends to that month are refused until root removes it (chattr -a the audit dir, rm the entry, re-run harden-audit.sh).`);
+      },
+    });
+    this.policy = new Policy({ log, isActive: () => this.active(), ...policy, onTamper: (info) => { policy.onTamper?.(info); this.onTamper(info); } });
+    this.guard = new Guard({
+      log, clock, isActive: () => this.active(),
+      audit: (e, k) => this.record(e, k),
+      blocklist: (p) => this.policy.blocked(p, this.options.clock() / 1000),
+      ...guard,
+    });
+  }
+
+  /** Passive → active promotion (after `isActive` turns true): re-load the policy and auto-blocks from disk with boot trust. */
+  public activate(): void {
+    this.options.log.info('[security] activated — reloading policy from disk');
+    this.policy.activate();
+    this.guard.activate();
+  }
+
+  /** Guard a turn start: principal → rank/rate → blocklist, rate, concurrency. Call BEFORE any LLM spend and
+   *  `release()` when the turn ends (try/finally). Shadow unless SECURITY_ENFORCE=true. */
+  public admitTurn(principal: Principal, ctx: { ip?: string; channel?: string } = {}): TurnAdmission {
+    const r = resolvePrincipal(this.policy, principal); // same resolution as decide(): an API key's role cap applies to guard rank/rate
+    return this.guard.admit({ principal, ...ctx, rank: r.rank, rate: r.profile.rate });
+  }
+
+  private active(): boolean {
+    try { return this.options.isActive(); }
+    catch (e: any) { this.options.log.error(`[security] isActive threw — not writing audit: ${e.message}`); return false; }
+  }
+
+  /** Append (active instance only). With `dedupeKey`, at most once per `dedupeMs`. Never throws. */
+  public record(event: AuditEvent, dedupeKey?: string): void {
+    if (!this.active()) return;
+    if (dedupeKey) {
+      const now = this.options.clock(), last = this.seen.get(dedupeKey);
+      if (last !== undefined && now - last < this.options.dedupeMs) return;
+      if (this.seen.size >= MAX_DEDUPE_KEYS) {
+        for (const [k, t] of this.seen) if (now - t >= this.options.dedupeMs) this.seen.delete(k);
+        if (this.seen.size >= MAX_DEDUPE_KEYS) this.seen.clear();
+      }
+      this.seen.set(dedupeKey, now);
+    }
+    this.audit.append(event);
+  }
+
+  /** principal → role/profile, audited as `role.resolve` (deduped per principal+role per window). */
+  public decide(principal: Principal, sessionId?: string): Decision {
+    const r = resolvePrincipal(this.policy, principal);
+    const p = r.profile;
+    const wouldDeny = !(p.tools.includes('*') && p.mcps.includes('*') && p.env.includes('*') && p.outbound);
+    this.record({
+      type: 'role.resolve', principal: principal.id, role: r.role, sessionId,
+      meta: { kind: principal.kind, verified: principal.verified, profile: r.profileName, rank: r.rank, policyValid: this.policy.valid },
+    }, `role.resolve|${principal.id}|${r.role}`);
+    return { role: r.role, rank: r.rank, profile: r.profileName, wouldDeny };
+  }
+
+  /** `via` = the auth branch (e.g. `http:apikey`, `mcp:oauth`, `ws:bearer`). */
+  public authAllow(principal: Principal, via: string): void {
+    this.record({ type: 'auth.allow', principal: principal.id, target: via, meta: { kind: principal.kind } }, `auth.allow|${principal.id}|${via}`);
+  }
+
+  public authDeny(via: string, reason: string, ip?: string): void {
+    this.record({ type: 'auth.deny', target: via, reason, meta: ip ? { ip } : undefined }, `auth.deny|${via}|${reason}|${ip ?? ''}`);
+  }
+
+  private onTamper(info: { path: string; reason: TamperReason; expected: string | null; actual: string | null }): void {
+    if (!this.active()) return;
+    this.audit.append({ type: 'policy.tamper', target: info.path, reason: info.reason, meta: { expected: info.expected, actual: info.actual } });
+    this.options.notify(`Security policy file changed outside the server (${info.reason}): ${info.path}. The last good policy is still in force.`);
+  }
+
+  public close(): void { this.policy.close(); }
+}
+
+let current: SecurityRuntime | undefined;
+
+/** Construct the process-wide runtime (replaces a previous one). Call once at boot, after config load. */
+export function initSecurity(options?: Partial<SecurityRuntimeOptions>): SecurityRuntime {
+  current?.close();
+  current = new SecurityRuntime(options);
+  return current;
+}
+
+/** The process-wide runtime, or undefined when never initialized (call sites then skip auditing). */
+export function security(): SecurityRuntime | undefined { return current; }
+
+/**
+ * Turn-start gate for the core lanes AND add-ons (e.g. a Gmail lane): `admitTurn(principal, { ip, channel })`.
+ * `{ ok: false, status, retryAfter?, reason }` only when enforcing; on ok, call `release()` when the turn ends.
+ * No runtime, or a guard bug ⇒ admitted (logged): the guard limits spend, it is not the auth layer.
+ */
+export function admitTurn(principal: Principal, ctx?: { ip?: string; channel?: string }): TurnAdmission {
+  try { return current ? current.admitTurn(principal, ctx) : { ok: true, release: () => {} }; }
+  catch (e: any) { console.error(`[security] admitTurn threw — admitting: ${e?.message ?? e}`); return { ok: true, release: () => {} }; }
+}
+
+/** Client IP of a request/upgrade, honoring TRUSTED_PROXIES. */
+export function requestIp(req: Parameters<Guard['ipOf']>[0]): string | undefined {
+  return current?.guard.ipOf(req);
+}
+
+/** Test-only: drop the process-wide runtime. */
+export function __resetSecurityForTest(): void { current?.close(); current = undefined; }

package/src/server/sessions.ts

@@ -5,6 +5,7 @@ import { homedir } from 'node:os';
 import { DATA_DIR, dataPath } from './paths.ts';
 import type { Directives } from './directives.ts';
 import type { ClaudeAccountRef } from './claude-account.ts';
+import { findClaudeTranscript, type ClaudeResumeState } from './engine/claude-resume.ts';
 
 const SESSIONS_PATH = dataPath('sessions.json');
 
@@ -45,7 +46,11 @@ export interface SessionMeta {
   /** Claude login the last turn ran on (claude-code engine, subscription auth only). `personal` = the
    *  requester's own routed login (claude-account.ts), false = the box's shared login. Never a token. */
   lastAccount?: ClaudeAccountRef;
+  /** claude-code engine SDK-resume mapping (opt-in flag) — see engine/claude-resume.ts. */
+  claudeResume?: ClaudeResumeState;
   forkedFrom?: string;
+  /** Security taint (SECURITY_ENFORCE): rank of the lowest-ranked principal that ever contributed. Only lowers. */
+  floorRank?: number;
 }
 
 // ── Index cache ──────────────────────────────────────────────────────────────
@@ -219,6 +224,7 @@ export function upsertSession(sessionId: string, firstPrompt: string, user: { ui
       lastModified: now,
       ...(scope ? { scope } : {}),
       ...(kind ? { kind } : {}),
+      ...floorField(sessionId),
     });
   }
 
@@ -383,6 +389,47 @@ export function setSessionModel(sessionId: string, model: string, engine?: strin
   }
 }
 
+/** Store (or clear, with undefined) the claude-code resume mapping. `patch` merges into the existing one. */
+export function setClaudeResume(sessionId: string, state: ClaudeResumeState | undefined, patch?: Partial<ClaudeResumeState>): void {
+  const sessions = loadIndex();
+  const s = sessions.find((x) => x.sessionId === sessionId);
+  if (!s) return;
+  if (patch) { if (!s.claudeResume) return; s.claudeResume = { ...s.claudeResume, ...patch }; }
+  else if (state) s.claudeResume = state;
+  else if (s.claudeResume) delete s.claudeResume;
+  else return;
+  saveIndex(sessions);
+}
+
+// ── Security taint floor (SECURITY_ENFORCE) ─────────────────────────────────
+// The engine's tool gate re-reads the floor on EVERY tool call, so it's served from this Map (write-through to
+// `floorRank` in the index; single-writer process, see the index cache note). A floor only ever lowers.
+const floors = new Map<string, number>();
+
+/** The session's taint floor, or undefined when none was recorded. */
+export function getSessionFloor(sessionId: string): number | undefined {
+  const cached = floors.get(sessionId);
+  if (cached !== undefined) return cached;
+  const f = loadIndex().find((s) => s.sessionId === sessionId)?.floorRank;
+  if (f !== undefined) floors.set(sessionId, f);
+  return f;
+}
+
+/** Lower the floor to min(floor, rank) — the first contributor sets it. Returns the new floor. Never raises it.
+ *  Works before the index record exists (some channels create it after streaming): creation picks it up. */
+export function lowerSessionFloor(sessionId: string, rank: number): number {
+  const prev = getSessionFloor(sessionId);
+  const next = prev === undefined ? rank : Math.min(prev, rank);
+  floors.set(sessionId, next);
+  const sessions = loadIndex();
+  const s = sessions.find((x) => x.sessionId === sessionId);
+  if (s && s.floorRank !== next) { s.floorRank = next; saveIndex(sessions); }
+  return next;
+}
+
+/** A pending floor for a record being created now. */
+const floorField = (sessionId: string) => (floors.has(sessionId) ? { floorRank: floors.get(sessionId)! } : {});
+
 export function getSessionsByScheduleId(scheduleId: string): SessionMeta[] {
   return loadIndex()
     .filter((s) => s.scheduleId === scheduleId)
@@ -405,6 +452,7 @@ export function createScheduledSession(sessionId: string, scheduleId: string, ti
     scheduleId,
     scheduleRunAt: now,
     scheduleRunStatus: 'running',
+    ...floorField(sessionId),
   });
   saveIndex(sessions);
 }
@@ -528,16 +576,8 @@ export function getSessionAbortController(sessionId: string): AbortController |
   return globalSessionLocks.get(sessionId)?.abortController;
 }
 
-const CLAUDE_PROJECTS_DIR = path.join(homedir(), '.claude', 'projects');
-
 function findSessionFile(sessionId: string): string | null {
-  if (!existsSync(CLAUDE_PROJECTS_DIR)) return null;
-  for (const dir of readdirSync(CLAUDE_PROJECTS_DIR, { withFileTypes: true })) {
-    if (!dir.isDirectory()) continue;
-    const file = path.join(CLAUDE_PROJECTS_DIR, dir.name, `${sessionId}.jsonl`);
-    if (existsSync(file)) return file;
-  }
-  return null;
+  return findClaudeTranscript(sessionId, path.join(homedir(), '.claude'));
 }
 
 // ── Our own conversation store ───────────────────────────────────────────────
@@ -703,6 +743,8 @@ export function forkSession(sourceId: string, user: { uid: string; email: string
     lastModified: now,
     forkedFrom: sourceId,
     ...(source.directives ? { directives: source.directives } : {}),
+    // The fork copies the source's (possibly tainted) content, so it keeps its floor.
+    ...(getSessionFloor(sourceId) !== undefined ? { floorRank: getSessionFloor(sourceId)! } : {}),
   });
   saveIndex(sessions);
 

package/src/server/shraga-config.ts

@@ -52,6 +52,9 @@ export interface AgentSettings {
   skillDiscovery?: boolean;
   thinking?: 'adaptive' | 'enabled' | 'disabled';
   effort?: 'low' | 'medium' | 'high' | 'max';
+  /** claude-code engine: resume the SDK session across turns instead of re-sending the history
+   *  (prompt-cache savings). Default off; a session's `[resume:on|off]` directive wins. */
+  sdkResume?: boolean;
 }
 
 export interface ShragaConfig {

package/src/server/slack/bot.ts

@@ -6,7 +6,7 @@
 import crypto from 'node:crypto';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { streamChat, type AttachmentMeta, type WsEvent } from '../claude.ts';
+import { streamChat, taintSession, enforcedRank, type AttachmentMeta, type WsEvent } from '../claude.ts';
 import { handleArtifactToolUse } from '../artifacts/artifacts.handler.ts';
 import { getMcpConfig } from '../mcp.ts';
 import { dataPath } from '../paths.ts';
@@ -14,14 +14,16 @@ import { appendMessage, setSlackContext, setRunStatus, setVisibleTo, writePartia
 import { injectFile } from '../file-inject.ts';
 import { createTurnAccumulator } from '../turn-stream.ts';
 import {
-  postMessage, addReaction, removeReaction, getBotUserId, getAgentUserId, getThreadMessages, getMessage,
+  postMessage, addReaction, removeReaction, getBotUserId, getAgentUserId, getThreadMessages,
   getChannelName, getUserName, getUserProfile, resolveUserMentions, isSupportedFile, SUPPORTED_FILE_MIMES,
   downloadSlackFileBuffer,
 } from './api.ts';
 import { pipeAgentReply, type AgentEvent, type IngressMessage } from 'mcp-slack-use/src/ingress.ts';
 import { makeSlackQuestionHandler } from './questions.ts';
 import * as contacts from '../contacts.ts';
-import { getChannelContext, invalidateChannelContext } from './context-cache.ts';
+import { fromInternal, fromSlack, type Principal } from '../security/principal.ts';
+import { admitTurn } from '../security/runtime.ts';
+import { getChannelContext, invalidateChannelContext, trustedMessages, type AuthorTrust } from './context-cache.ts';
 import { noteSlackSeen } from '../downtime.ts';
 import { getOrCreateSession, registerThreadAlias, setLastMessageTs, setUseUserToken, findSlackSessionBySessionId, getProactiveOrigin, hasSessionForThread, isSlackBotPlaceholderEmail } from './sessions.ts';
 
@@ -42,6 +44,14 @@ export function setBroadcast(fn: Broadcast): void { broadcastFn = fn; }
 
 const mdText = (b: ConvBlock): b is { type: 'text'; text: string } => b.type === 'text';
 
+/** SECURITY_ENFORCE: channel context / thread history the invoker may see — only authors ranked ≥ the invoker's rank.
+ *  Undefined in shadow mode (everything is ingested, as before). A failed profile lookup rejects → message excluded. */
+function authorTrust(invoker: Principal): AuthorTrust | undefined {
+  const minRank = enforcedRank(invoker);
+  if (minRank === undefined) return undefined;
+  return { minRank, rankOf: async (u) => enforcedRank(fromSlack(u, { email: (await getUserProfile(u)).email })) };
+}
+
 // ── Semantic gate ─────────────────────────────────────────────────────────────
 // Protocol-level routing (bot echoes, DM identity, dedupe) is the ingress's job. This is the app-side
 // half: agent-channel summon rules + threads the agent already owns. Referenced app session state
@@ -163,6 +173,9 @@ export async function* runAgentTurn(msg: IngressMessage): AsyncGenerator<AgentEv
     contact = contacts.upsert({ slackId: msg.user, email: profile.email || undefined, name: profile.name || undefined });
   }
   const sessionUser = contact?.emails.length ? { uid: contact.id, email: contact.emails[0], name: contact.name } : undefined;
+  // The real human sender; a message with no Slack user falls back to the bot identity, marked internal.
+  const principal = msg.user ? fromSlack(msg.user, { email: contact?.emails[0] }) : fromInternal({ uid: SLACK_UID, lane: 'slack' });
+  const trust = authorTrust(principal);
 
   let isNew: boolean;
   let sessionId: string;
@@ -175,7 +188,7 @@ export async function* runAgentTurn(msg: IngressMessage): AsyncGenerator<AgentEv
     const ctxType = isDM ? 'dm' as const : isMention ? 'mention' as const : 'channel' as const;
     const [channelName, channelCtx] = await Promise.all([
       isDM ? null : getChannelName(channel).catch(err => { console.error('[slack-bot] getChannelName failed:', err.message); return null; }),
-      isDM ? null : getChannelContext(channel).catch(err => { console.error('[slack-bot] getChannelContext failed:', err.message); return null; }),
+      isDM ? null : getChannelContext(channel, trust).catch(err => { console.error('[slack-bot] getChannelContext failed:', err.message); return null; }),
     ]);
     const userName = contact?.name || null;
     const resolvedChannel = isDM ? undefined : (channelName || undefined);
@@ -202,9 +215,11 @@ export async function* runAgentTurn(msg: IngressMessage): AsyncGenerator<AgentEv
       const seen = new Set(getSession(sessionId)?.seenSlackTs ?? []);
       const seedOnly = !isNew && seen.size === 0;
       const processedTs: string[] = [];
+      const fresh = seedOnly ? [] : threadMsgs.filter((m) => m.ts !== msg.ts && !(m.ts && seen.has(m.ts)));
+      const ingest = new Set(trust ? await trustedMessages(fresh, [botId, agentUserId], trust) : fresh);
       for (const m of threadMsgs) {
         if (m.ts) processedTs.push(m.ts);
-        if (m.ts === msg.ts || (m.ts && seen.has(m.ts)) || seedOnly) continue;
+        if (!ingest.has(m)) continue;
         const isBot = m.bot_id || m.user === botId || (agentUserId && m.user === agentUserId);
         const role = isBot ? 'assistant' : 'user';
         let msgText = (m.text || '').replace(new RegExp(`<@${botId}>\\s*`, 'g'), '').trim();
@@ -217,12 +232,13 @@ export async function* runAgentTurn(msg: IngressMessage): AsyncGenerator<AgentEv
       }
       recordSeenSlackTs(sessionId, [...processedTs, msg.ts]);
     } else if (isNew) {
-      const rootText = await getMessage(channel, msg.rawThreadTs, useUserToken).catch(err => {
+      // conversations.replies' first message is the root; keep its author (getMessage returns only the text).
+      const root = await getThreadMessages(channel, msg.rawThreadTs, useUserToken).then((ms) => ms[0] ?? null, (err) => {
         console.error(`[slack] Failed to fetch root message for ${channel}:${msg.rawThreadTs}:`, err?.message || err);
         return null;
       });
-      if (rootText) {
-        let cleanRoot = rootText.replace(new RegExp(`<@${botId}>\\s*`, 'g'), '').trim();
+      if (root?.text && (!trust || (await trustedMessages([root], [botId, agentUserId], trust)).length)) {
+        let cleanRoot = root.text.replace(new RegExp(`<@${botId}>\\s*`, 'g'), '').trim();
         if (agentUserId) cleanRoot = cleanRoot.replace(new RegExp(`<@${agentUserId}>\\s*`, 'g'), '').trim();
         const resolved = await resolveUserMentions(cleanRoot);
         if (resolved) appendMessage(sessionId, { id: crypto.randomUUID(), role: 'user', blocks: [{ type: 'context', label: 'Thread root message', text: resolved }], channel: 'slack' });
@@ -275,6 +291,9 @@ export async function* runAgentTurn(msg: IngressMessage): AsyncGenerator<AgentEv
   ];
   const senderName = contact?.name || contact?.emails[0]?.split('@')[0] || undefined;
   appendMessage(sessionId, { id: crypto.randomUUID(), role: 'user', blocks: userBlocks, channel: 'slack', senderName });
+  // Taint at the append, not only at turn start: if the session is busy below, no turn runs for this message but the
+  // next turn still reads it (SECURITY_ENFORCE only).
+  await taintSession(sessionId, principal);
   setLastMessageTs(channel, threadTs, userMessageTs);
   if (useUserToken) setUseUserToken(channel, threadTs, true);
 
@@ -286,20 +305,31 @@ export async function* runAgentTurn(msg: IngressMessage): AsyncGenerator<AgentEv
   if (msg.rawThreadTs) triggerContext.thread = msg.rawThreadTs;
   if (contact?.emails[0]) triggerContext.user = contact.emails[0];
 
+  // Guard before any spend: blocklist → rate → concurrency (shadow unless SECURITY_ENFORCE).
+  const admission = admitTurn(principal, { channel: 'slack' });
+  if (!admission.ok) {
+    console.warn(`[slack-bot] Turn refused for ${principal.id}: ${admission.reason}`);
+    await postMessage(channel, `⏳ _Not now — ${admission.status === 403 ? 'access is blocked' : `too many requests, try again in ${admission.retryAfter ?? 60}s`}._`, threadTs, useUserToken);
+    msg.sessionId = undefined; // nothing to bookkeep — no reply produced
+    return;
+  }
+
   const abortController = new AbortController();
   if (!acquireSessionLock(sessionId, 'slack', abortController)) {
+    admission.release();
     console.warn(`[slack-bot] Session ${sessionId.slice(0, 8)} already locked, queuing in Slack thread`);
     await postMessage(channel, '⏳ _Session is busy — please wait for the current task to finish._', threadTs, useUserToken);
     msg.sessionId = undefined; // nothing to bookkeep — no reply produced
     return;
   }
-  setRunStatus(sessionId, 'running', 'slack');
-  broadcastFn({ type: 'session_messages_changed', sessionId });
-  broadcastFn({ type: 'session_busy', sessionId, busy: true });
 
   try {
+    setRunStatus(sessionId, 'running', 'slack');
+    broadcastFn({ type: 'session_messages_changed', sessionId });
+    broadcastFn({ type: 'session_busy', sessionId, busy: true });
     yield* pumpStream(
       streamChat({
+        principal,
         prompt: resolvedText,
         attachments: attachments.length ? attachments : undefined,
         sessionId,
@@ -316,6 +346,7 @@ export async function* runAgentTurn(msg: IngressMessage): AsyncGenerator<AgentEv
       { partial: true, artifacts: true },
     );
   } finally {
+    admission.release();
     if (releaseSessionLock(sessionId, abortController)) {
       setRunStatus(sessionId, 'idle');
       broadcastFn({ type: 'session_busy', sessionId, busy: false });
@@ -360,6 +391,8 @@ export async function retrySlackSession(session: SessionMeta, prompt: string): P
       { channel, threadTs, useUserToken, transform: undefined, finalTransform: resolveUserMentions },
       pumpStream(
         streamChat({
+          // Recovery has no live human (the Slack sender id isn't persisted): the session's owner, marked internal.
+          principal: fromInternal({ uid: session.uid || SLACK_UID, email: isSlackBotPlaceholderEmail(session.userEmail) ? undefined : session.userEmail, lane: 'slack-retry' }),
           prompt,
           sessionId: session.sessionId,
           uid: SLACK_UID,

package/src/server/slack/context-cache.ts

@@ -9,15 +9,48 @@ interface CacheEntry {
 const TTL_MS = 5 * 60 * 1000;
 const cache = new Map<string, CacheEntry>();
 
-export async function getChannelContext(channel: string): Promise<string | null> {
-  const cached = cache.get(channel);
-  if (cached && cached.expiresAt > Date.now()) return cached.summary;
+type SlackMessage = { user?: string; bot_id?: string; text?: string };
+/** SECURITY_ENFORCE ingestion floor: only content by authors ranked ≥ `minRank` (the invoking principal's) is kept. */
+export interface AuthorTrust {
+  minRank: number;
+  /** Rank of a Slack user. Rejects/undefined = unresolvable: the message is excluded (never lowers the floor). */
+  rankOf: (user: string) => Promise<number | undefined>;
+}
 
-  const messages = await getChannelHistory(channel, 20).catch(() => []);
-  if (!messages.length) return null;
+/** Keep our own bot/agent output and messages whose human author ranks ≥ `minRank`. Bot/webhook posts and unresolvable
+ *  authors are dropped, not tainted: untrusted content never reaches the model, so the invoker keeps their tools. */
+export async function trustedMessages<M extends SlackMessage>(messages: M[], ownIds: (string | null | undefined)[], trust: AuthorTrust): Promise<M[]> {
+  const own = new Set(ownIds.filter(Boolean));
+  const ranks = new Map<string, Promise<number | undefined>>();
+  const rank = (u: string) => ranks.get(u) ?? ranks.set(u, trust.rankOf(u).catch((err: any) => {
+    console.error(`[slack-context] rank lookup failed for ${u} — excluding their messages:`, err?.message ?? err);
+    return undefined;
+  })).get(u)!;
+  const keep = await Promise.all(messages.map(async (m) => {
+    if (m.user && own.has(m.user)) return true;
+    if (m.bot_id || !m.user) return false;
+    const r = await rank(m.user);
+    return r !== undefined && r >= trust.minRank;
+  }));
+  const kept = messages.filter((_, i) => keep[i]);
+  if (kept.length < messages.length && /(^|,)\s*(\*|SlackContext)\s*(,|$)/.test(process.env.DEBUG ?? '')) {
+    console.log(`[slack-context] dropped ${messages.length - kept.length}/${messages.length} messages (author rank < ${trust.minRank}, bot, or unresolved)`);
+  }
+  return kept;
+}
 
+/** Channel summary of the last 20 messages; with `trust`, summarized from trusted messages only (cached per floor). */
+export async function getChannelContext(channel: string, trust?: AuthorTrust): Promise<string | null> {
+  const key = trust ? `${channel}|${trust.minRank}` : channel;
+  const cached = cache.get(key);
+  if (cached && cached.expiresAt > Date.now()) return cached.summary;
+
+  const history = await getChannelHistory(channel, 20).catch(() => []);
   const botId = await getBotUserId();
   const agentUid = await getAgentUserId();
+  const messages = trust ? await trustedMessages(history, [botId, agentUid], trust) : history;
+  if (!messages.length) return null;
+
   const lines: string[] = [];
   for (const msg of messages) {
     const isBot = !!msg.bot_id || msg.user === botId || (agentUid && msg.user === agentUid);
@@ -33,10 +66,10 @@ export async function getChannelContext(channel: string): Promise<string | null>
   );
   if (!summary) return null;
 
-  cache.set(channel, { summary, expiresAt: Date.now() + TTL_MS });
+  cache.set(key, { summary, expiresAt: Date.now() + TTL_MS });
   return summary;
 }
 
 export function invalidateChannelContext(channel: string): void {
-  cache.delete(channel);
+  for (const key of cache.keys()) if (key === channel || key.startsWith(`${channel}|`)) cache.delete(key);
 }

package/src/server/webhook-lane/feature.ts

@@ -45,7 +45,10 @@ import {
   appendMessage, upsertSession, setRunStatus, acquireSessionLock, releaseSessionLock,
   type ConvBlock,
 } from '../sessions.ts';
-import { validateApiKey } from '../api-keys.ts';
+import { apiKeyPrincipal, validateApiKey } from '../api-keys.ts';
+import type { Principal } from '../security/principal.ts';
+import { admitTurn, requestIp } from '../security/runtime.ts';
+import { writeDenial } from '../security/guard.ts';
 import { WebhookStreamer, type WebhookTarget } from './streamer.ts';
 
 /** One receiver connection, as learned from a turn. Handed to `onTurnAccepted` so an add-on can
@@ -107,9 +110,11 @@ export async function runWebhookTurn(args: {
   callback: WebhookTarget; convId: string; msgId: string; sessionId: string; prompt: string;
   uid: string; userEmail: string; sendSegments: boolean;
   channel: string; source: string;
+  /** Who the turn runs for — the API key holder for the built-in ingress. */
+  principal: Principal;
   streamer?: WebhookLaneOptions['streamer'];
 }): Promise<void> {
-  const { callback, convId, msgId, sessionId, prompt, uid, userEmail, sendSegments, channel, source } = args;
+  const { callback, convId, msgId, sessionId, prompt, uid, userEmail, sendSegments, channel, source, principal } = args;
   const streamer = new WebhookStreamer({ callback, convId, msgId, sendSegments, ...(args.streamer ?? {}) });
   const abortController = new AbortController();
 
@@ -130,7 +135,7 @@ export async function runWebhookTurn(args: {
   let text = '';
   try {
     for await (const ev of streamChat({
-      prompt, sessionId, uid, userEmail,
+      principal, prompt, sessionId, uid, userEmail,
       mcpServers: getMcpConfig(uid),
       abortController,
       context: { source, user: userEmail },
@@ -203,6 +208,11 @@ export function createWebhookLaneFeature(opts: WebhookLaneOptions): ServerFeatur
           if (u.protocol !== 'https:' && u.hostname !== 'localhost' && u.hostname !== '127.0.0.1') throw new Error('https required');
         } catch { return void res.status(400).json({ error: 'callback.url must be a valid HTTPS URL' }); }
 
+        // Guard before any spend: blocklist → rate → concurrency (shadow unless SECURITY_ENFORCE).
+        const principal = apiKeyPrincipal(caller); // carries the key's role cap, so guard rank and the turn's role agree
+        const admission = admitTurn(principal, { ip: requestIp(req), channel });
+        if (!admission.ok) return void writeDenial(res, admission);
+
         const cb: WebhookTarget = { url: callback.url, secret: callback.secret, connId };
         try {
           opts.onTurnAccepted?.({ ...cb, convId, at: Date.now(), uid: caller.uid, email: caller.email });
@@ -212,13 +222,14 @@ export function createWebhookLaneFeature(opts: WebhookLaneOptions): ServerFeatur
 
         // ACCEPT, then run. The answer arrives on the callback, so holding this response open would
         // only give the caller's trigger a socket to time out on.
-        res.json({ status: 'accepted', sessionId: sessionId || convId });
+        try { res.json({ status: 'accepted', sessionId: sessionId || convId }); }
+        catch (err) { admission.release(); throw err; }
         void runWebhookTurn({
           callback: cb, convId, msgId, sessionId: sessionId || convId, prompt,
-          uid: caller.uid, userEmail: caller.email,
+          uid: caller.uid, userEmail: caller.email, principal,
           sendSegments: Array.isArray(accepts) && accepts.includes('segments'),
           channel, source, streamer: opts.streamer,
-        });
+        }).finally(admission.release);
       });
 
       console.log(`[${opts.name}] turn ingress mounted at POST ${opts.route}`);

package/src/shared/models.ts

@@ -0,0 +1,11 @@
+/** Model used when neither directives nor config specify one. Always passed
+ * explicitly to the SDK — the CLI's own default silently drifts (it picked
+ * Opus 4.7), which burns rate limits and budget.
+ *
+ * Shared because the UI must name the SAME default the server will actually run:
+ * a second literal in the client drifts out of date and makes the header report a
+ * model no turn would use. */
+export const DEFAULT_MODEL = 'claude-sonnet-5';
+
+/** Default for the `cursor` engine, named here for the same reason. */
+export const DEFAULT_CURSOR_MODEL = 'cursor/composer-2.5';