shraga 0.1.111 → 0.1.113

package/src/server/claude.ts

@@ -3,7 +3,8 @@ import { summarizeText } from './summarize.ts';
 import { dataSync } from './data-sync.ts';
 import type { McpConfig } from './mcp.ts';
 import type { ClaudeAccountRef } from './claude-account.ts';
-import { loadConversation, saveConversation, appendMessage, getSession, setSessionDirectives, addTriggeredSkills, upsertSession, type ConvMessage, type ConvBlock } from './sessions.ts';
+import { loadConversation, saveConversation, appendMessage, getSession, setSessionDirectives, addTriggeredSkills, upsertSession, setClaudeResume, getSessionFloor, lowerSessionFloor, type ConvMessage, type ConvBlock } from './sessions.ts';
+import { enforcing, TurnGuard } from './security/enforce.ts';
 import { createTurnAccumulator, type TurnStreamHooks } from './turn-stream.ts';
 import {
   resolveDefaultSkillsContent,
@@ -25,6 +26,8 @@ import { getUserContextBlock } from './user-context.ts';
 import { collectTurnContext } from './turn-context.ts';
 import { DATA_DIR, dataPath } from './paths.ts';
 import * as contacts from './contacts.ts';
+import type { Principal } from './security/principal.ts';
+import { security, resolvePrincipal } from './security/runtime.ts';
 import { resolveAndGetEngine, ModelUnavailableError } from './engine/index.ts';
 
 const CONFIG_PATH = dataPath('agent-config.json');
@@ -197,7 +200,10 @@ function applyCompactMarkers(conv: ConvMessage[]): ConvMessage[] {
 
 export interface AttachmentMeta { url: string; name: string; mimeType: string; path: string }
 
-export async function* streamChat(opts: {
+export interface StreamChatOpts {
+  /** Who this turn runs for. Required so every channel is enumerated by the compiler. Shadow mode:
+   *  resolved + audited (turn.start/turn.end), not yet enforced. */
+  principal: Principal;
   prompt: string;
   attachments?: AttachmentMeta[];
   images?: string[];
@@ -217,7 +223,85 @@ export async function* streamChat(opts: {
    * where an add-on's contributor reads its own keys. */
   turnHints?: Record<string, unknown>;
   context?: Record<string, string>;
-}): AsyncGenerator<WsEvent> {
+}
+
+/** Run one agent turn. Security wrapper: resolves the principal's role/profile and audits turn.start / turn.end.
+ *  SHADOW (SECURITY_ENFORCE off): the turn is unchanged; auditing can never alter or break it.
+ *  ENFORCE: the session floor is lowered to the caller's rank (taint), the turn runs under a TurnGuard whose
+ *  effective profile the engine applies, and it FAILS CLOSED — no runtime, a resolution error, or an effective
+ *  profile with `outbound: false` (e.g. `none`) refuses the turn with an `error` event. */
+export async function* streamChat(opts: StreamChatOpts): AsyncGenerator<WsEvent> {
+  const sec = security();
+  const enforce = enforcing();
+  if (!sec) {
+    if (!enforce) { yield* runTurn(opts); return; }
+    console.error('[security] SECURITY_ENFORCE is on but the security runtime is not initialized — refusing the turn');
+    yield { type: 'error', message: 'Security enforcement is on but not initialized, so this turn was not run.' };
+    return;
+  }
+  const { principal, sessionId } = opts;
+  let role: string | undefined;
+  let guard: TurnGuard | undefined;
+  let refusal: string | undefined;
+  try {
+    const d = sec.decide(principal, sessionId);
+    role = d.role;
+    let enforced: Record<string, unknown> = {};
+    if (enforce) {
+      // A broken policy fails closed at resolve time already; it must not ALSO permanently taint every session it touches.
+      if (sessionId && sec.policy.valid) lowerSessionFloor(sessionId, d.rank);
+      guard = new TurnGuard({ runtime: sec, principal, sessionId, role: d.role, rank: d.rank, floorOf: getSessionFloor });
+      const eff = guard.current();
+      if (!eff.profile.outbound) refusal = `This conversation runs as role "${eff.role}", which is not permitted to run the agent.`;
+      enforced = { enforced: true, effectiveRole: eff.role, effectiveProfile: eff.profileName, floor: sessionId ? getSessionFloor(sessionId) : undefined };
+    }
+    sec.record({ type: 'turn.start', principal: principal.id, role, sessionId, meta: { kind: principal.kind, lane: principal.attrs.lane, source: opts.context?.source, profile: d.profile, rank: d.rank, wouldDeny: d.wouldDeny, ...enforced } });
+  } catch (e: any) {
+    console.error('[security] turn.start audit failed:', e.message);
+    if (enforce) refusal = 'The security check for this turn failed, so it was not run.';
+  }
+  const started = Date.now();
+  let outcome = 'closed';
+  try {
+    if (enforce && (refusal || !guard)) {
+      outcome = 'denied';
+      console.warn(`[security] Refused turn for ${principal.id} session=${sessionId ?? 'new'}: ${refusal}`);
+      yield { type: 'error', message: refusal ?? 'The security check for this turn failed, so it was not run.' };
+      return;
+    }
+    for await (const ev of runTurn(opts, guard)) {
+      if (ev.type === 'done') outcome = 'done';
+      else if (ev.type === 'error') outcome = 'error';
+      yield ev;
+    }
+    if (outcome === 'closed') outcome = 'done';
+  } catch (e) {
+    outcome = 'threw';
+    throw e;
+  } finally {
+    try { sec.record({ type: 'turn.end', principal: principal.id, role, sessionId, reason: outcome, meta: { ms: Date.now() - started } }); }
+    catch (e: any) { console.error('[security] turn.end audit failed:', e.message); }
+  }
+}
+
+/** SECURITY_ENFORCE: `principal`'s rank under the live policy. Undefined in shadow mode, without a runtime, or on an
+ *  invalid (fail-closed) policy — callers then apply no rank-based filtering. */
+export function enforcedRank(principal: Principal): number | undefined {
+  const sec = security();
+  return enforcing() && sec?.policy.valid ? resolvePrincipal(sec.policy, principal).rank : undefined;
+}
+
+/** SECURITY_ENFORCE: input from `principal` entered `sessionId` outside a turn it runs (e.g. another human's Slack
+ *  thread message) — lower the session floor to that principal's rank. No-op in shadow mode, without a runtime, or
+ *  on an invalid (fail-closed) policy. Returns the new floor, or undefined when nothing was done. */
+export async function taintSession(sessionId: string, principal: Principal | (() => Promise<Principal>)): Promise<number | undefined> {
+  const sec = security();
+  if (!enforcing() || !sec?.policy.valid) return undefined;
+  const p = typeof principal === 'function' ? await principal() : principal;
+  return lowerSessionFloor(sessionId, resolvePrincipal(sec.policy, p).rank);
+}
+
+async function* runTurn(opts: StreamChatOpts, guard?: TurnGuard): AsyncGenerator<WsEvent> {
   const config = getAgentConfig();
   const { prompt: cleanPrompt, directives: parsed, unresolvedModel } = parseDirectives(opts.prompt);
 
@@ -324,7 +408,10 @@ export async function* streamChat(opts: {
   const stickyNames = opts.sessionId ? getSession(opts.sessionId)?.triggeredSkills ?? [] : [];
   const newTriggerNames = discoveryEnabled ? matchTriggeredSkillNames(effectivePrompt, opts.context) : [];
   const triggeredNames = [...new Set([...stickyNames, ...newTriggerNames])];
-  const triggeredSkills = skillInjectionBlocks(triggeredNames);
+  // Per-name blocks so an engine that resumes across turns can send only newly triggered ones. Joined
+  // exactly as skillInjectionBlocks(triggeredNames) joins them, so contextBlock is byte-identical.
+  const triggeredSkillBlocks = triggeredNames.map((n) => [n, skillInjectionBlocks([n])] as const).filter(([, b]) => b);
+  const triggeredSkills = triggeredSkillBlocks.map(([, b]) => b).join('\n');
 
   // Per-skill turn budget. Resolved HERE, once every invoked skill is known (the slash command and
   // the triggered/sticky set), and GAP-FILLING only: an inline `[turns:N]` or a session-pinned
@@ -347,6 +434,11 @@ export async function* streamChat(opts: {
   const teamRoster = contacts.formatRoster();
   const userContextBlock = getUserContextBlock(contact);
   const contextBlock = [userBlock, userContextBlock, teamRoster, defaultSkills, triggeredSkills, skillIndex, mcpSkills, workspaceTree].filter(Boolean).join('\n');
+  const contextSections: Record<string, string> = Object.fromEntries(Object.entries({
+    user: userBlock, userContext: userContextBlock, roster: teamRoster, defaultSkills,
+    ...Object.fromEntries(triggeredSkillBlocks.map(([n, b]) => [`skill:${n}`, b])),
+    skillIndex, mcpSkills, workspace: workspaceTree,
+  }).filter(([, v]) => v));
 
   // Load conversation for the engine
   const sessionId = opts.sessionId ?? crypto.randomUUID();
@@ -387,12 +479,27 @@ export async function* streamChat(opts: {
     yield { type: 'error', message };
     return;
   }
+  // An engine that doesn't apply the profile can only run a turn that needs no restriction.
+  if (guard && !engine.enforcesProfile) {
+    const { profile, role } = guard.current();
+    if (!(profile.tools.includes('*') && profile.mcps.includes('*') && profile.env.includes('*'))) {
+      const message = `Engine "${engine.name}" does not enforce security profiles, so it cannot run this conversation's role "${role}".`;
+      console.error(`[security] ${message} (user=${opts.uid} session=${sessionId})`);
+      yield { type: 'error', message };
+      return;
+    }
+  }
   console.log(`[stream] engine=${engine.name} user=${opts.uid} session=${sessionId}`);
+  // Another engine's turn never reaches the claude-code transcript, so a stored SDK-resume mapping is
+  // stale from here on — mark it; the claude-code engine then falls back to a fresh query (engine-switch).
+  const resumeState = getSession(sessionId)?.claudeResume;
+  if (engine.name !== 'claude-code' && resumeState && !resumeState.interruptedBy) setClaudeResume(sessionId, undefined, { interruptedBy: engine.name });
 
   yield* engine.stream({
     prompt: turnPrompt,
     conversation,
     contextBlock,
+    contextSections,
     attachments: opts.attachments,
     images: opts.images,
     sessionId,
@@ -408,6 +515,7 @@ export async function* streamChat(opts: {
     turnHints: opts.turnHints,
     conversationReset: opts.conversationReset,
     context: opts.context,
+    ...(guard ? { security: guard } : {}),
     directives,
     config,
   });

package/src/server/data-sync.ts

@@ -4,9 +4,13 @@ import path from 'node:path';
 import { DATA_DIR } from './paths.ts';
 import { notifyOwners } from './notify-owners.ts';
 import { runTextQuery } from './sdk-utils.ts';
+import { GENESIS_HASH, readAuditHead } from './security/audit.ts';
 
 const TAG = '[data-sync]';
 const DEPLOYMENT_ID_FILE = '.deployment-id';
+/** Tracked, append-only, single-writer (security/audit.ts): committed on every flush, never pulled over, never stashed. */
+const AUDIT_DIR = 'audit';
+const NOT_AUDIT = ['--', '.', `:(exclude)${AUDIT_DIR}`];
 
 /** How long the LLM commit-message call may take before we fall back (ms). */
 const COMMIT_MSG_TIMEOUT_MS = 60_000;
@@ -357,11 +361,32 @@ export class DataSync {
       return;
     }
 
-    // Stash dirty + untracked files before merging (untracked can block merge if remote adds same paths)
-    const dirty = !!(await this.git('status', '--porcelain')).trim();
+    // The audit log is append-only with ONE writer, this instance. A remote commit touching audit/ would rewrite the local
+    // chain (and under `chattr +a` git can't even apply it) — refuse the whole pull and alert.
+    let incomingAudit: string;
+    try {
+      incomingAudit = (await this.git('diff', '--name-only', `HEAD...origin/${this.options.branch}`, '--', AUDIT_DIR)).trim();
+    } catch (err) {
+      console.warn(`${TAG} Audit pull check failed, skipping pull:`, (err as Error).message);
+      return;
+    }
+    if (incomingAudit) {
+      console.error(`${TAG} 🚫 Remote commits change the audit log — pull refused:\n${incomingAudit}`);
+      await this.alertOnce('audit-pull', incomingAudit,
+        `🚫 Data sync refused a pull: remote commits change the audit log, which only this instance writes.\n\n${incomingAudit}\n\n` +
+        `Inspect: \`cd data && git log origin/${this.options.branch} -- ${AUDIT_DIR}\``,
+      ).catch(err => console.warn(`${TAG} Audit pull notify failed:`, (err as Error).message));
+      return;
+    }
+    this.clearAlert('audit-pull');
+
+    // Stash dirty + untracked files before merging (untracked can block merge if remote adds same paths) — except audit/:
+    // stashing removes the live log from disk while the server appends to it (lost lines, forked chain) and fails under
+    // `chattr +a`. The merge can't touch audit/ (checked above), so it stays dirty in place.
+    const dirty = !!(await this.git('status', '--porcelain', ...NOT_AUDIT)).trim();
     if (dirty) {
       try {
-        await this.git('stash', 'push', '--include-untracked', '-m', 'data-sync: pre-pull stash');
+        await this.git('stash', 'push', '--include-untracked', '-m', 'data-sync: pre-pull stash', ...NOT_AUDIT);
       } catch (err) {
         console.warn(`${TAG} Stash failed, skipping pull:`, (err as Error).message);
         return;
@@ -441,12 +466,19 @@ export class DataSync {
         }
       }
 
+      // The audit log rides along with every sync commit — the data repo is its offsite copy — and the commit message
+      // anchors its head. Head read BEFORE staging: the committed chain always contains that hash.
+      const auditHead = this.auditHead();
+      if (existsSync(path.join(DATA_DIR, AUDIT_DIR))) {
+        await this.git('add', '--', AUDIT_DIR).catch(err => console.warn(`${TAG} Staging audit log failed:`, (err as Error).message));
+      }
+
       const status = await this.git('status', '--porcelain');
       if (!status.trim()) return;
 
       if (await this.guardMassDeletions('flush')) return;
       const msg = await this.generateCommitMessage(files);
-      await this.git('commit', '-m', msg).catch(() => {});
+      await this.git('commit', '-m', auditHead ? `${msg}\n\naudit-head: ${auditHead}` : msg).catch(() => {});
       const ahead = await this.git('rev-list', '--count', `origin/${this.options.branch}..HEAD`).catch(() => '0');
       if (parseInt(ahead.trim()) === 0) return;
       await this.git('push', 'origin', this.options.branch).catch(async (err) => {
@@ -468,11 +500,23 @@ export class DataSync {
     }
   }
 
+  /** Audit chain head for the commit anchor; undefined when there's no record yet or it can't be read (logged). */
+  private auditHead(): string | undefined {
+    try {
+      const head = readAuditHead(path.join(DATA_DIR, AUDIT_DIR));
+      return head === GENESIS_HASH ? undefined : head;
+    } catch (err) {
+      console.warn(`${TAG} Audit head unreadable, committing without anchor:`, (err as Error).message);
+      return undefined;
+    }
+  }
+
   private async generateCommitMessage(files: string[]): Promise<string> {
     const fallback = fallbackCommitMessage(files);
     try {
-      const diff = await this.git('diff', '--cached', '--stat').catch(() => '');
-      const diffContent = await this.git('diff', '--cached', '--no-color', '-U2').catch(() => '');
+      // The audit log's appended lines are not "behavioral config" and would crowd the real diff out of the prompt.
+      const diff = await this.git('diff', '--cached', '--stat', ...NOT_AUDIT).catch(() => '');
+      const diffContent = await this.git('diff', '--cached', '--no-color', '-U2', ...NOT_AUDIT).catch(() => '');
       if (!diffContent.trim()) return fallback;
       const truncated = diffContent.slice(0, 3000);
       // Bounded: a hung `claude` subprocess used to wedge flush() forever (it holds the push latch).
@@ -761,7 +805,12 @@ export class DataSync {
     'uploads/', 'repos/', '.tmp/', 'schedules.json.bak', 'git-log.json',
     '.internal-token', 'comms-log.jsonl', 'sessions/', 'unread/', '.DS_Store',
     'scheduler/', '.mcp-catalog.json',
+    'api-keys.json.bak', // pre-hashing plaintext keys (api-keys.ts migration) — never commit
     'workspace/users/*/.claude/', // per-user Claude logins (claude-account.ts) — credentials, never commit
+    // Live security state of the ACTIVE instance, which is its single writer — a pull must never overwrite it:
+    // blocks.json (guard auto-blocks); policy.json + .migrated (the Owner Console writes them; a pulled change trips
+    // the policy provenance/tamper check). Blue-green shares one DATA_DIR on one host, so nothing needs to cross hosts.
+    'security/',
   ];
 
   /** Write or refresh .gitignore, appending any canonical entries it's missing (idempotent). */

package/src/server/directives.ts

@@ -4,6 +4,8 @@ export interface Directives {
   thinking?: 'adaptive' | 'enabled' | 'disabled';
   effort?: 'low' | 'medium' | 'high' | 'max';
   engine?: string;
+  /** claude-code SDK session resume for this conversation (overrides agent-config `sdkResume`). */
+  resume?: boolean;
 }
 
 export interface ParsedPrompt {
@@ -16,10 +18,8 @@ export interface ParsedPrompt {
   unresolvedModel?: string;
 }
 
-/** Model used when neither directives nor config specify one. Always passed
- * explicitly to the SDK — the CLI's own default silently drifts (it picked
- * Opus 4.7), which burns rate limits and budget. */
-export const DEFAULT_MODEL = 'claude-sonnet-5';
+// The default model lives in src/shared/models.ts so the client header names the same one.
+export { DEFAULT_MODEL } from '../shared/models';
 
 // Canonical model aliases + label. Vendored, pure, dependency-free (src/server/model-aliases.ts).
 // Re-exported here so the rest of shraga keeps importing model helpers from one place.
@@ -28,7 +28,7 @@ import { MODEL_ALIASES } from './model-aliases.ts';
 
 const DIRECTIVE_RE = /^\s*\[([^\]]*)\]\s*([\s\S]*)/;
 
-const DIRECTIVE_KEYS = ['model', 'turns', 'thinking', 'think', 'effort', 'engine'];
+const DIRECTIVE_KEYS = ['model', 'turns', 'thinking', 'think', 'effort', 'engine', 'resume'];
 
 /** MODEL_ALIASES only covers the bare Anthropic shorthands. A `provider/model` id
  *  (`cursor/composer-2.5`, `openai/gpt-5.6`) is already concrete — gating it on the alias table
@@ -179,6 +179,11 @@ function applyDirective(d: Directives, key: string, val: string): string | undef
     case 'engine':
       d.engine = val;
       break;
+    case 'resume':
+      if (['on', 'true', '1'].includes(val)) d.resume = true;
+      else if (['off', 'false', '0'].includes(val)) d.resume = false;
+      else console.warn(`[directives] Invalid resume value: "${val}"`);
+      break;
     default:
       console.warn(`[directives] Unknown directive key: "${key}"`);
   }