shraga 0.1.112 → 0.1.113

package/src/server/boot.ts

@@ -51,8 +51,13 @@ import { startEventDispatcher } from './events/dispatcher.ts';
 import { seedOperators } from './contacts.ts';
 import { dataSync } from './data-sync.ts';
 import { mountMcpServer } from './mcp-server.ts';
+import { fromInternal, type Principal } from './security/principal.ts';
+import { initSecurity, security, admitTurn, requestIp } from './security/runtime.ts';
+import { writeDenial } from './security/guard.ts';
+import { requireOwner } from './security/owner-only.ts';
+import { flushEscalations } from './security/escalate.ts';
 import { lookupIdempotent, rememberIdempotent } from './idempotency.ts';
-import { createApiKey, deleteApiKey, listApiKeys } from './api-keys.ts';
+import { apiKeyRouter } from './api-key-routes.ts';
 import { addUnread, markRead as markUnread, getUnreads } from './unread.ts';
 
 import { loadShragaConfig, getPublicOrigin } from './shraga-config.ts';
@@ -66,6 +71,7 @@ import { claudeAccountDir } from './claude-account.ts';
 import { ClaudeLogin, ClaudeLoginError } from './claude-login.ts';
 import { getAll as getAllContacts } from './contacts.ts';
 import { artifactsRouter } from './artifacts/artifacts.routes.ts';
+import { ownerRouter } from './security/owner-routes.ts';
 import { handleArtifactToolUse } from './artifacts/artifacts.handler.ts';
 import { registerEngine } from './engine/index.ts';
 import { subscribeEvent } from './events/bus.ts';
@@ -114,6 +120,8 @@ export async function bootServer(__reg: BootRegistrations = {}): Promise<ServerH
 const PASSIVE_FLAG = process.env.SHRAGA_PASSIVE ?? process.env.UNCLAW_PASSIVE;
 const PASSIVE = PASSIVE_FLAG === '1' || PASSIVE_FLAG === 'true';
 if (PASSIVE) console.log('[server] PASSIVE mode — schedulers, consumers and background writers disabled');
+// Flipped by activateConsumers() (blue-green promotion). Declared up here: initSecurity reads it synchronously.
+let activated = !PASSIVE;
 
 // Local-only prep (git config, gitignore, untracking). The NETWORK half — fetch/merge — is
 // deliberately NOT awaited here; it runs via dataSync.syncOnBoot() AFTER listen(). See syncOnBoot().
@@ -125,6 +133,9 @@ function bootDataSync(): void {
   dataSync.syncOnBoot().catch(err => console.error('[data-sync] boot sync error:', (err as Error).message));
 }
 await loadShragaConfig();
+// Process-wide policy + audit (shadow mode: decide + audit, never deny). Audit writes only on the
+// active instance — a PASSIVE standby shares DATA_DIR. `activated` is declared above.
+initSecurity({ isActive: () => !PASSIVE || activated });
 // Programmatic engines register through the same seam an overlay uses — BEFORE initEngines() so
 // getAvailableEngines() includes them and a directive can resolve to one immediately.
 for (const e of __reg.engines ?? []) registerEngine(e);
@@ -175,7 +186,18 @@ app.use(express.urlencoded({
 // drown real request logs. Errors and everything else still logs unconditionally.
 const QUIET_POLL_RE = /\/(cwd|ptys|sessions|workspace\/(pty-owners|layout))(\?|$)/;
 
+/** Package version, read once. Served as the `X-Shraga-Version` identity header on EVERY response
+ *  (see the middleware below) — a response WITHOUT it proves the responder is not this server, which
+ *  is what lets the client tell "shraga 404'd" apart from "something else owns this port". */
+const SHRAGA_VERSION: string = (() => {
+  try {
+    return JSON.parse(readFileSync(path.resolve(__dirname, '../../package.json'), 'utf8')).version ?? 'unknown';
+  } catch { return 'unknown'; }
+})();
+
 app.use((req, _res, next) => {
+  // Set BEFORE any route runs, so it rides on error responses (404/401/5xx) too — not just successes.
+  _res.setHeader('X-Shraga-Version', SHRAGA_VERSION);
   const start = Date.now();
   const orig = _res.end.bind(_res);
   (_res as any).end = (...args: any[]) => {
@@ -193,10 +215,7 @@ const SERVER_BUILD_ID = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}
 // ── REST routes ───────────────────────────────────────────────────────────────
 
 app.get('/api/version', (_req, res) => {
-  try {
-    const pkg = JSON.parse(readFileSync(path.resolve(__dirname, '../../package.json'), 'utf8'));
-    res.json({ version: pkg.version });
-  } catch { res.json({ version: 'unknown' }); }
+  res.json({ version: SHRAGA_VERSION });
 });
 
 // ── Self-upgrade (owner only) ────────────────────────────────────────────────
@@ -426,7 +445,8 @@ app.get('/api/mcps', requireAuth, (req, res) => {
   res.json(entries);
 });
 
-app.put('/api/mcps', requireAuth, (req, res) => {
+// Owner-only: an MCP entry can carry a stdio `command` the server spawns.
+app.put('/api/mcps', requireAuth, requireOwner('Only an owner can change MCP servers'), (req, res) => {
   const user = (req as any).user;
   const globalNames = new Set(Object.keys(getGlobalMcpConfig()));
   const incoming = req.body as McpConfig;
@@ -440,14 +460,15 @@ app.put('/api/mcps', requireAuth, (req, res) => {
   res.json({ ok: true });
 });
 
-app.get('/api/config', requireAuth, (_req, res) => {
+app.get('/api/config', requireAuth, (req, res) => {
   // `claudeAuthSource` is derived server state (not persisted config) — the spread always overrides
   // any stale value, so it can never round-trip into agent-config.json even if a client echoes it back.
-  res.json({ ...getAgentConfig(), claudeAuthSource: getClaudeAuthSource() });
+  // `isOwner` is the same kind of derived field: the client hides owner-only controls on it (PUT strips it).
+  res.json({ ...getAgentConfig(), isOwner: !!(req as any).user?.isOwner, claudeAuthSource: getClaudeAuthSource() });
 });
 
-app.put('/api/config', requireAuth, (req, res) => {
-  const { claudeAuthSource: _drop, ...config } = (req.body ?? {}) as AgentConfig & { claudeAuthSource?: string };
+app.put('/api/config', requireAuth, requireOwner('Only an owner can change the agent config'), (req, res) => {
+  const { claudeAuthSource: _drop, isOwner: _dropOwner, ...config } = (req.body ?? {}) as AgentConfig & { claudeAuthSource?: string; isOwner?: boolean };
   saveAgentConfig(config);
   res.json({ ok: true });
 });
@@ -472,7 +493,7 @@ app.get('/api/skills/:name', requireAuth, (req, res) => {
   res.json(skill);
 });
 
-app.put('/api/skills/:name', requireAuth, (req, res) => {
+app.put('/api/skills/:name', requireAuth, requireOwner('Only an owner can change skills'), (req, res) => {
   try {
     const { content } = req.body as { content: string };
     saveSkill(String(req.params.name), content ?? '');
@@ -480,14 +501,14 @@ app.put('/api/skills/:name', requireAuth, (req, res) => {
   } catch (e: any) { res.status(400).json({ error: e.message }); }
 });
 
-app.delete('/api/skills/:name', requireAuth, (req, res) => {
+app.delete('/api/skills/:name', requireAuth, requireOwner('Only an owner can change skills'), (req, res) => {
   try {
     deleteSkill(String(req.params.name));
     res.json({ ok: true });
   } catch (e: any) { res.status(400).json({ error: e.message }); }
 });
 
-app.post('/api/skills/:name/duplicate', requireAuth, (req, res) => {
+app.post('/api/skills/:name/duplicate', requireAuth, requireOwner('Only an owner can change skills'), (req, res) => {
   try {
     const { newName } = req.body as { newName: string };
     const skill = duplicateSkill(String(req.params.name), newName);
@@ -495,7 +516,7 @@ app.post('/api/skills/:name/duplicate', requireAuth, (req, res) => {
   } catch (e: any) { res.status(400).json({ error: e.message }); }
 });
 
-app.post('/api/skills/:name/rename', requireAuth, (req, res) => {
+app.post('/api/skills/:name/rename', requireAuth, requireOwner('Only an owner can change skills'), (req, res) => {
   try {
     const { newName } = req.body as { newName: string };
     renameSkill(String(req.params.name), newName);
@@ -507,7 +528,7 @@ app.get('/api/skills-defaults', requireAuth, (_req, res) => {
   res.json(getDefaultSkills());
 });
 
-app.put('/api/skills-defaults', requireAuth, (req, res) => {
+app.put('/api/skills-defaults', requireAuth, requireOwner('Only an owner can change skills'), (req, res) => {
   setDefaultSkills(req.body);
   res.json({ ok: true });
 });
@@ -669,6 +690,7 @@ async function runChatTurn(
     userName?: string;
     abortController?: AbortController;
     context?: Record<string, string>;
+    principal: Principal;
   },
   hooks?: { onEvent?: (ev: WsEvent) => void },
 ): Promise<RunChatTurnResult> {
@@ -695,6 +717,7 @@ async function runChatTurn(
 
   try {
     const blocks = await consumeStream(streamChat({
+      principal: opts.principal,
       prompt,
       sessionId: sid,
       uid,
@@ -748,17 +771,26 @@ app.post('/api/chat', requireAuth, async (req, res) => {
     if (existing) return void res.json({ sessionId: existing, status: 'duplicate' });
   }
 
+  // Guard before any spend: blocklist → rate → concurrency (shadow unless SECURITY_ENFORCE).
+  const admission = admitTurn(user.principal, { ip: requestIp(req), channel: 'api' });
+  if (!admission.ok) return void writeDenial(res, admission);
+
   const sid = reqSid || `api-${crypto.randomUUID()}`;
   if (idemKey) rememberIdempotent(user.uid, idemKey, sid);
   const apiAbortController = new AbortController();
-  const run = () => runChatTurn({
-    prompt,
-    sessionId: sid,
-    uid: user.uid,
-    userEmail: user.email,
-    abortController: apiAbortController,
-    context: { source: 'api', user: user.email },
-  });
+  const run = async () => {
+    try {
+      return await runChatTurn({
+        prompt,
+        sessionId: sid,
+        uid: user.uid,
+        userEmail: user.email,
+        principal: user.principal,
+        abortController: apiAbortController,
+        context: { source: 'api', user: user.email },
+      });
+    } finally { admission.release(); }
+  };
 
   if (sync) {
     const result = await run();
@@ -768,6 +800,7 @@ app.post('/api/chat', requireAuth, async (req, res) => {
   } else {
     // Reject a duplicate before responding 'accepted' (lock is acquired inside run()).
     if (reqSid && isSessionLocked(sid)) {
+      admission.release();
       return void res.status(409).json({ error: 'Session is already processing a request' });
     }
     res.json({ sessionId: sid, status: 'accepted' });
@@ -842,6 +875,7 @@ app.get('/api/data-sync/log', requireAuth, async (_req, res) => {
 });
 
 app.use(artifactsRouter);
+app.use(ownerRouter);
 
 // Runtime feature flags for the client (env-gated, never persisted to agent-config.json).
 // ── Auth mode + local login (PUBLIC — no requireAuth) ────────────────────────
@@ -904,22 +938,7 @@ app.post('/api/push/unregister', requireAuth, (req, res) => {
 });
 
 // ── API Keys ──────────────────────────────────────────────────────────────────
-app.get('/api/api-keys', requireAuth, (req, res) => {
-  res.json({ keys: listApiKeys() });
-});
-app.post('/api/api-keys', requireAuth, (req, res) => {
-  const user = (req as any).user as import('./auth.ts').AuthUser;
-  const { label } = req.body as { label?: string };
-  const key = createApiKey(user.uid, user.email, label || 'Unnamed');
-  res.json(key);
-});
-app.delete('/api/api-keys/:id', requireAuth, (req: express.Request<{ id: string }>, res) => {
-  const user = (req as any).user as import('./auth.ts').AuthUser;
-  const ok = deleteApiKey(req.params.id, user.uid, user.isOwner);
-  if (ok === 'not_found') return void res.status(404).json({ error: 'Key not found' });
-  if (ok === 'forbidden') return void res.status(403).json({ error: 'Cannot delete another user\'s key' });
-  res.json({ ok: true });
-});
+app.use(apiKeyRouter({ base: '/api/api-keys', gate: [requireAuth] }));
 
 // ── MCP Server ────────────────────────────────────────────────────────────────
 mountMcpServer(app, { runChatTurn });
@@ -953,6 +972,10 @@ const wss = new WebSocketServer({ noServer: true });
 interface WsSession {
   uid: string;
   email: string;
+  /** Set on ws auth; undefined until then. */
+  principal?: Principal;
+  /** Client IP from the upgrade request (TRUSTED_PROXIES-aware). */
+  ip?: string;
   busySessions: Set<string>;
   autoApprove: boolean;
   abortControllers: Map<string, AbortController>;
@@ -1200,7 +1223,7 @@ function proxySidecarWebSocket(req: import('node:http').IncomingMessage, socket:
 server.on('upgrade', (req, socket, head) => {
   if (req.url === '/ws') {
     wss.handleUpgrade(req, socket as any, head, (ws) => {
-      const session: WsSession = { uid: '', email: '', busySessions: new Set(), autoApprove: false, abortControllers: new Map(), pendingPermissions: new Map(), pendingQuestions: new Map(), steerPending: new Map(), lastSessionId: null, viewingSessionId: null, focused: true };
+      const session: WsSession = { uid: '', email: '', ip: requestIp(req), busySessions: new Set(), autoApprove: false, abortControllers: new Map(), pendingPermissions: new Map(), pendingQuestions: new Map(), steerPending: new Map(), lastSessionId: null, viewingSessionId: null, focused: true };
       handleConnection(ws, session);
     });
   } else {
@@ -1325,7 +1348,7 @@ initPolls({
       // NOTHING until it ended — and an add-on engine's subagent events were dropped outright — so a
       // turn that dispatched a worker was indistinguishable from one that only claimed to.
       return await consumeStream(
-        streamChat({ prompt, sessionId, uid, userEmail, mcpServers: getMcpConfig(uid), abortController, onPermissionRequest: async () => ({ allow: true }) }),
+        streamChat({ principal: fromInternal({ uid, email: userEmail, lane: 'wake' }), prompt, sessionId, uid, userEmail, mcpServers: getMcpConfig(uid), abortController, onPermissionRequest: async () => ({ allow: true }) }),
         undefined,
         {
           maxResultChars: STREAMED_RESULT_MAX,
@@ -1381,10 +1404,10 @@ registerSpaCatchAll(app, distPath);
 // ── Runtime promotion (blue-green flip) ──────────────────────────────────────
 // A passive instance can be promoted to active once traffic has been flipped to it:
 // starts every consumer/writer that passive boot skipped. One-way; idempotent-guarded.
-let activated = !PASSIVE;
 async function activateConsumers() {
   activated = true;
   console.log('[server] ACTIVATING — starting consumers and background writers');
+  security()?.activate(); // passive Policy never wrote; now re-load from disk as trusted (migrates if still missing)
   await dataSync.init();
   bootDataSync();
   syncVendorRepos().catch(err => console.warn('[vendor-sync] error:', (err as Error).message));
@@ -1550,6 +1573,7 @@ async function runStream(ws: WebSocket, session: WsSession, sid: string, promptT
   try {
     let eventCount = 0;
     for await (const event of streamChat({
+      principal: session.principal ?? fromInternal({ uid: session.uid, email: session.email, lane: 'ws-unresolved' }),
       prompt: promptText,
       attachments,
       sessionId: sid,
@@ -1748,6 +1772,8 @@ function handleConnection(ws: WebSocket, session: WsSession) {
         const user = await verifyBearer(msg.token); // pluggable (local|firebase), not firebase-only
         session.uid = user.uid;
         session.email = user.email;
+        session.principal = user.principal;
+        security()?.authAllow(user.principal, 'ws:bearer');
         session.autoApprove = getAutoApprove(user.uid);
         console.log(`[ws] Authenticated: ${user.email} (${user.uid}) autoApprove=${session.autoApprove}`);
         send(ws, { type: 'auth_ok', uid: user.uid, email: user.email, buildId: SERVER_BUILD_ID });
@@ -1763,6 +1789,7 @@ function handleConnection(ws: WebSocket, session: WsSession) {
           }
         }
       } catch (err: any) {
+        security()?.authDeny('ws:bearer', 'invalid-bearer');
         console.error(`[ws] Auth failed:`, err.message);
         send(ws, { type: 'auth_error', message: err.message });
         ws.close();
@@ -1836,12 +1863,21 @@ function handleConnection(ws: WebSocket, session: WsSession) {
         session.steerPending.set(steerSid, steerText);
         ac.abort();
       } else {
-        ac.abort();
-        appendMessage(steerSid, { id: crypto.randomUUID(), role: 'user', blocks: [{ type: 'text', text: steerText }], channel: 'web', senderName: session.email.split('@')[0] });
-        console.log(`[ws] External steer takeover for ${steerSid.slice(0, 8)}`);
-        session.busySessions.add(steerSid);
-        session.lastSessionId = steerSid;
-        runStream(ws, session, steerSid, steerText, undefined, getMcpConfig(session.uid), true);
+        // A takeover starts a NEW turn on this connection — same guard as a normal WS turn, checked BEFORE the abort
+        // so a denied steer leaves the running turn alone.
+        const admission = admitTurn(session.principal ?? fromInternal({ uid: session.uid, email: session.email, lane: 'ws-unresolved' }), { ip: session.ip, channel: 'ws' });
+        if (!admission.ok) {
+          return send(ws, { type: 'error', sessionId: steerSid, reason: admission.reason, retryAfter: admission.retryAfter,
+            message: admission.status === 403 ? 'Access blocked' : `Too many requests — try again in ${admission.retryAfter ?? 60}s` });
+        }
+        try {
+          ac.abort();
+          appendMessage(steerSid, { id: crypto.randomUUID(), role: 'user', blocks: [{ type: 'text', text: steerText }], channel: 'web', senderName: session.email.split('@')[0] });
+          console.log(`[ws] External steer takeover for ${steerSid.slice(0, 8)}`);
+          session.busySessions.add(steerSid);
+          session.lastSessionId = steerSid;
+          await runStream(ws, session, steerSid, steerText, undefined, getMcpConfig(session.uid), true);
+        } finally { admission.release(); }
       }
       return;
     }
@@ -1851,68 +1887,76 @@ function handleConnection(ws: WebSocket, session: WsSession) {
       let sid = msg.sessionId || crypto.randomUUID();
       const wantsFork = typeof msg.truncateAt === 'number' && msg.truncateAt >= 0 && (session.busySessions.has(sid) || isSessionLocked(sid));
       if (!wantsFork && (session.busySessions.has(sid) || isSessionLocked(sid))) return send(ws, { type: 'error', message: 'Already processing a request', sessionId: sid });
-      if (!wantsFork) session.busySessions.add(sid);
-      const mcpServers = getMcpConfig(session.uid);
-      // Opaque per-send bag from the client's send-options slot. The core forwards it verbatim to the
-      // turn-context/engine seams and interprets no add-on key (a plain object only — never an array/primitive).
-      const turnHints = msg.turnHints && typeof msg.turnHints === 'object' && !Array.isArray(msg.turnHints)
-        ? (msg.turnHints as Record<string, unknown>) : undefined;
-      // Ephemeral user turn (generic hint): a synthetic, add-on-originated opener (e.g. a voice greeting).
-      // Run it, but DON'T persist it as a user message — the reply is the real turn, not a user turn.
-      const ephemeralUser = turnHints?.ephemeralUser === true;
-      const promptText = msg.text ?? '';
-      session.lastSessionId = sid;
-      session.viewingSessionId = sid;
-      session.focused = true;
-      const isNew = !msg.sessionId;
-      if (isNew) {
-        upsertSession(sid, promptText, { uid: session.uid, email: session.email });
-        send(ws, { type: 'session_id', sessionId: sid });
-        // Immediate prompt-derived title so the tab renames off "New Chat" now; the LLM title refines it later.
-        const t0 = getSession(sid)?.title;
-        if (t0) send(ws, { type: 'session_title_updated', sessionId: sid, title: t0 });
-        console.log(`[ws] New session ${sid.slice(0, 8)} for ${session.email}`);
+      // Guard before any spend: blocklist → rate → concurrency (shadow unless SECURITY_ENFORCE).
+      const admission = admitTurn(session.principal ?? fromInternal({ uid: session.uid, email: session.email, lane: 'ws-unresolved' }), { ip: session.ip, channel: 'ws' });
+      if (!admission.ok) {
+        return send(ws, { type: 'error', sessionId: sid, reason: admission.reason, retryAfter: admission.retryAfter,
+          message: admission.status === 403 ? 'Access blocked' : `Too many requests — try again in ${admission.retryAfter ?? 60}s` });
       }
+      try {
+        if (!wantsFork) session.busySessions.add(sid);
+        const mcpServers = getMcpConfig(session.uid);
+        // Opaque per-send bag from the client's send-options slot. The core forwards it verbatim to the
+        // turn-context/engine seams and interprets no add-on key (a plain object only — never an array/primitive).
+        const turnHints = msg.turnHints && typeof msg.turnHints === 'object' && !Array.isArray(msg.turnHints)
+          ? (msg.turnHints as Record<string, unknown>) : undefined;
+        // Ephemeral user turn (generic hint): a synthetic, add-on-originated opener (e.g. a voice greeting).
+        // Run it, but DON'T persist it as a user message — the reply is the real turn, not a user turn.
+        const ephemeralUser = turnHints?.ephemeralUser === true;
+        const promptText = msg.text ?? '';
+        session.lastSessionId = sid;
+        session.viewingSessionId = sid;
+        session.focused = true;
+        const isNew = !msg.sessionId;
+        if (isNew) {
+          upsertSession(sid, promptText, { uid: session.uid, email: session.email });
+          send(ws, { type: 'session_id', sessionId: sid });
+          // Immediate prompt-derived title so the tab renames off "New Chat" now; the LLM title refines it later.
+          const t0 = getSession(sid)?.title;
+          if (t0) send(ws, { type: 'session_title_updated', sessionId: sid, title: t0 });
+          console.log(`[ws] New session ${sid.slice(0, 8)} for ${session.email}`);
+        }
 
-      console.log(`[ws] Message from ${session.email}: "${promptText.slice(0, 100)}" session=${sid.slice(0, 8)}`);
+        console.log(`[ws] Message from ${session.email}: "${promptText.slice(0, 100)}" session=${sid.slice(0, 8)}`);
 
-      // Truncate or fork conversation if replaying/editing a previous message
-      if (typeof msg.truncateAt === 'number' && msg.truncateAt >= 0) {
-        if (wantsFork) {
-          // Session is busy — fork instead of destructive truncate to avoid race conditions
-          let forkedId: string | null = null;
-          if (msg.truncateAt > 0) {
-            // forkSession truncateAtIndex is inclusive (slices to index+1), truncateAt is message count to keep
-            forkedId = forkSession(sid, { uid: session.uid, email: session.email, name: session.email.split('@')[0] }, msg.truncateAt - 1);
-          }
-          if (!forkedId) {
-            // truncateAt=0 (restart from scratch) or forkSession failed — create a fresh session
-            forkedId = crypto.randomUUID();
-            upsertSession(forkedId, promptText, { uid: session.uid, email: session.email });
+        // Truncate or fork conversation if replaying/editing a previous message
+        if (typeof msg.truncateAt === 'number' && msg.truncateAt >= 0) {
+          if (wantsFork) {
+            // Session is busy — fork instead of destructive truncate to avoid race conditions
+            let forkedId: string | null = null;
+            if (msg.truncateAt > 0) {
+              // forkSession truncateAtIndex is inclusive (slices to index+1), truncateAt is message count to keep
+              forkedId = forkSession(sid, { uid: session.uid, email: session.email, name: session.email.split('@')[0] }, msg.truncateAt - 1);
+            }
+            if (!forkedId) {
+              // truncateAt=0 (restart from scratch) or forkSession failed — create a fresh session
+              forkedId = crypto.randomUUID();
+              upsertSession(forkedId, promptText, { uid: session.uid, email: session.email });
+            }
+            console.log(`[ws] Forked busy session ${sid.slice(0, 8)} → ${forkedId.slice(0, 8)} (truncateAt=${msg.truncateAt})`);
+            session.busySessions.add(forkedId);
+            sid = forkedId;
+            session.lastSessionId = forkedId;
+            send(ws, { type: 'forked', sourceSessionId: msg.sessionId, sessionId: forkedId });
+          } else {
+            const existing = loadConversation(sid);
+            saveConversation(sid, existing.slice(0, msg.truncateAt));
+            console.log(`[ws] Truncated conversation ${sid.slice(0, 8)} to ${msg.truncateAt} messages`);
           }
-          console.log(`[ws] Forked busy session ${sid.slice(0, 8)} → ${forkedId.slice(0, 8)} (truncateAt=${msg.truncateAt})`);
-          session.busySessions.add(forkedId);
-          sid = forkedId;
-          session.lastSessionId = forkedId;
-          send(ws, { type: 'forked', sourceSessionId: msg.sessionId, sessionId: forkedId });
-        } else {
-          const existing = loadConversation(sid);
-          saveConversation(sid, existing.slice(0, msg.truncateAt));
-          console.log(`[ws] Truncated conversation ${sid.slice(0, 8)} to ${msg.truncateAt} messages`);
         }
-      }
 
-      // Save user message to disk immediately
-      const attachments: AttachmentMeta[] = msg.attachments ?? [];
-      const attBlocks: ConvBlock[] = attachments.map((a: any) =>
-        a.mimeType.startsWith('image/')
-          ? { type: 'image' as const, src: a.url }
-          : { type: 'file' as const, src: a.url, name: a.name, mimeType: a.mimeType }
-      );
-      if (!ephemeralUser) appendMessage(sid, { id: crypto.randomUUID(), role: 'user', blocks: [...attBlocks, { type: 'text', text: promptText }], channel: 'web', senderName: session.email.split('@')[0] });
-
-      const wasReset = typeof msg.truncateAt === 'number' && msg.truncateAt >= 0;
-      await runStream(ws, session, sid, promptText, attachments, mcpServers, false, wasReset, turnHints);
+        // Save user message to disk immediately
+        const attachments: AttachmentMeta[] = msg.attachments ?? [];
+        const attBlocks: ConvBlock[] = attachments.map((a: any) =>
+          a.mimeType.startsWith('image/')
+            ? { type: 'image' as const, src: a.url }
+            : { type: 'file' as const, src: a.url, name: a.name, mimeType: a.mimeType }
+        );
+        if (!ephemeralUser) appendMessage(sid, { id: crypto.randomUUID(), role: 'user', blocks: [...attBlocks, { type: 'text', text: promptText }], channel: 'web', senderName: session.email.split('@')[0] });
+
+        const wasReset = typeof msg.truncateAt === 'number' && msg.truncateAt >= 0;
+        await runStream(ws, session, sid, promptText, attachments, mcpServers, false, wasReset, turnHints);
+      } finally { admission.release(); }
     }
 
     if (msg.type === 'interruption_marker') {
@@ -2000,6 +2044,8 @@ async function retryWebSession(session: SessionMeta, prompt: string) {
     ];
     registerLivePartial(sid, collectPartial);
     for await (const ev of streamChat({
+      // Recovery of an interrupted web turn: no live human, the session's owner marked internal.
+      principal: fromInternal({ uid: session.uid, email: session.userEmail, lane: 'web-retry' }),
       prompt,
       sessionId: sid,
       uid: session.uid,
@@ -2235,6 +2281,14 @@ async function gracefulShutdown(signal: string, opts: { exit?: boolean } = {}) {
 
   console.log(`[server] drain complete — ${getActiveLockCount()} stream(s) still active, closing`);
 
+  // Batched escalation digests live only in memory: hand them to the owners before exiting. Best-effort, bounded.
+  let flushTimer: ReturnType<typeof setTimeout> | undefined;
+  await Promise.race([
+    flushEscalations().then((n) => { if (n) console.log(`[server] flushed ${n} pending escalation digest(s)`); }),
+    new Promise<void>((r) => { flushTimer = setTimeout(() => { console.warn('[server] escalation flush timed out'); r(); }, 3000); }),
+  ]).catch((e) => console.error('[server] escalation flush failed:', e?.message ?? e));
+  clearTimeout(flushTimer);
+
   for (const [ws, session] of activeConnections) {
     for (const ac of session.abortControllers.values()) ac.abort();
     ws.close();

package/src/server/claude.ts

@@ -3,7 +3,8 @@ import { summarizeText } from './summarize.ts';
 import { dataSync } from './data-sync.ts';
 import type { McpConfig } from './mcp.ts';
 import type { ClaudeAccountRef } from './claude-account.ts';
-import { loadConversation, saveConversation, appendMessage, getSession, setSessionDirectives, addTriggeredSkills, upsertSession, setClaudeResume, type ConvMessage, type ConvBlock } from './sessions.ts';
+import { loadConversation, saveConversation, appendMessage, getSession, setSessionDirectives, addTriggeredSkills, upsertSession, setClaudeResume, getSessionFloor, lowerSessionFloor, type ConvMessage, type ConvBlock } from './sessions.ts';
+import { enforcing, TurnGuard } from './security/enforce.ts';
 import { createTurnAccumulator, type TurnStreamHooks } from './turn-stream.ts';
 import {
   resolveDefaultSkillsContent,
@@ -25,6 +26,8 @@ import { getUserContextBlock } from './user-context.ts';
 import { collectTurnContext } from './turn-context.ts';
 import { DATA_DIR, dataPath } from './paths.ts';
 import * as contacts from './contacts.ts';
+import type { Principal } from './security/principal.ts';
+import { security, resolvePrincipal } from './security/runtime.ts';
 import { resolveAndGetEngine, ModelUnavailableError } from './engine/index.ts';
 
 const CONFIG_PATH = dataPath('agent-config.json');
@@ -197,7 +200,10 @@ function applyCompactMarkers(conv: ConvMessage[]): ConvMessage[] {
 
 export interface AttachmentMeta { url: string; name: string; mimeType: string; path: string }
 
-export async function* streamChat(opts: {
+export interface StreamChatOpts {
+  /** Who this turn runs for. Required so every channel is enumerated by the compiler. Shadow mode:
+   *  resolved + audited (turn.start/turn.end), not yet enforced. */
+  principal: Principal;
   prompt: string;
   attachments?: AttachmentMeta[];
   images?: string[];
@@ -217,7 +223,85 @@ export async function* streamChat(opts: {
    * where an add-on's contributor reads its own keys. */
   turnHints?: Record<string, unknown>;
   context?: Record<string, string>;
-}): AsyncGenerator<WsEvent> {
+}
+
+/** Run one agent turn. Security wrapper: resolves the principal's role/profile and audits turn.start / turn.end.
+ *  SHADOW (SECURITY_ENFORCE off): the turn is unchanged; auditing can never alter or break it.
+ *  ENFORCE: the session floor is lowered to the caller's rank (taint), the turn runs under a TurnGuard whose
+ *  effective profile the engine applies, and it FAILS CLOSED — no runtime, a resolution error, or an effective
+ *  profile with `outbound: false` (e.g. `none`) refuses the turn with an `error` event. */
+export async function* streamChat(opts: StreamChatOpts): AsyncGenerator<WsEvent> {
+  const sec = security();
+  const enforce = enforcing();
+  if (!sec) {
+    if (!enforce) { yield* runTurn(opts); return; }
+    console.error('[security] SECURITY_ENFORCE is on but the security runtime is not initialized — refusing the turn');
+    yield { type: 'error', message: 'Security enforcement is on but not initialized, so this turn was not run.' };
+    return;
+  }
+  const { principal, sessionId } = opts;
+  let role: string | undefined;
+  let guard: TurnGuard | undefined;
+  let refusal: string | undefined;
+  try {
+    const d = sec.decide(principal, sessionId);
+    role = d.role;
+    let enforced: Record<string, unknown> = {};
+    if (enforce) {
+      // A broken policy fails closed at resolve time already; it must not ALSO permanently taint every session it touches.
+      if (sessionId && sec.policy.valid) lowerSessionFloor(sessionId, d.rank);
+      guard = new TurnGuard({ runtime: sec, principal, sessionId, role: d.role, rank: d.rank, floorOf: getSessionFloor });
+      const eff = guard.current();
+      if (!eff.profile.outbound) refusal = `This conversation runs as role "${eff.role}", which is not permitted to run the agent.`;
+      enforced = { enforced: true, effectiveRole: eff.role, effectiveProfile: eff.profileName, floor: sessionId ? getSessionFloor(sessionId) : undefined };
+    }
+    sec.record({ type: 'turn.start', principal: principal.id, role, sessionId, meta: { kind: principal.kind, lane: principal.attrs.lane, source: opts.context?.source, profile: d.profile, rank: d.rank, wouldDeny: d.wouldDeny, ...enforced } });
+  } catch (e: any) {
+    console.error('[security] turn.start audit failed:', e.message);
+    if (enforce) refusal = 'The security check for this turn failed, so it was not run.';
+  }
+  const started = Date.now();
+  let outcome = 'closed';
+  try {
+    if (enforce && (refusal || !guard)) {
+      outcome = 'denied';
+      console.warn(`[security] Refused turn for ${principal.id} session=${sessionId ?? 'new'}: ${refusal}`);
+      yield { type: 'error', message: refusal ?? 'The security check for this turn failed, so it was not run.' };
+      return;
+    }
+    for await (const ev of runTurn(opts, guard)) {
+      if (ev.type === 'done') outcome = 'done';
+      else if (ev.type === 'error') outcome = 'error';
+      yield ev;
+    }
+    if (outcome === 'closed') outcome = 'done';
+  } catch (e) {
+    outcome = 'threw';
+    throw e;
+  } finally {
+    try { sec.record({ type: 'turn.end', principal: principal.id, role, sessionId, reason: outcome, meta: { ms: Date.now() - started } }); }
+    catch (e: any) { console.error('[security] turn.end audit failed:', e.message); }
+  }
+}
+
+/** SECURITY_ENFORCE: `principal`'s rank under the live policy. Undefined in shadow mode, without a runtime, or on an
+ *  invalid (fail-closed) policy — callers then apply no rank-based filtering. */
+export function enforcedRank(principal: Principal): number | undefined {
+  const sec = security();
+  return enforcing() && sec?.policy.valid ? resolvePrincipal(sec.policy, principal).rank : undefined;
+}
+
+/** SECURITY_ENFORCE: input from `principal` entered `sessionId` outside a turn it runs (e.g. another human's Slack
+ *  thread message) — lower the session floor to that principal's rank. No-op in shadow mode, without a runtime, or
+ *  on an invalid (fail-closed) policy. Returns the new floor, or undefined when nothing was done. */
+export async function taintSession(sessionId: string, principal: Principal | (() => Promise<Principal>)): Promise<number | undefined> {
+  const sec = security();
+  if (!enforcing() || !sec?.policy.valid) return undefined;
+  const p = typeof principal === 'function' ? await principal() : principal;
+  return lowerSessionFloor(sessionId, resolvePrincipal(sec.policy, p).rank);
+}
+
+async function* runTurn(opts: StreamChatOpts, guard?: TurnGuard): AsyncGenerator<WsEvent> {
   const config = getAgentConfig();
   const { prompt: cleanPrompt, directives: parsed, unresolvedModel } = parseDirectives(opts.prompt);
 
@@ -395,6 +479,16 @@ export async function* streamChat(opts: {
     yield { type: 'error', message };
     return;
   }
+  // An engine that doesn't apply the profile can only run a turn that needs no restriction.
+  if (guard && !engine.enforcesProfile) {
+    const { profile, role } = guard.current();
+    if (!(profile.tools.includes('*') && profile.mcps.includes('*') && profile.env.includes('*'))) {
+      const message = `Engine "${engine.name}" does not enforce security profiles, so it cannot run this conversation's role "${role}".`;
+      console.error(`[security] ${message} (user=${opts.uid} session=${sessionId})`);
+      yield { type: 'error', message };
+      return;
+    }
+  }
   console.log(`[stream] engine=${engine.name} user=${opts.uid} session=${sessionId}`);
   // Another engine's turn never reaches the claude-code transcript, so a stored SDK-resume mapping is
   // stale from here on — mark it; the claude-code engine then falls back to a fresh query (engine-switch).
@@ -421,6 +515,7 @@ export async function* streamChat(opts: {
     turnHints: opts.turnHints,
     conversationReset: opts.conversationReset,
     context: opts.context,
+    ...(guard ? { security: guard } : {}),
     directives,
     config,
   });