shraga 0.1.112 → 0.1.113

package/src/server/data-sync.ts

@@ -4,9 +4,13 @@ import path from 'node:path';
 import { DATA_DIR } from './paths.ts';
 import { notifyOwners } from './notify-owners.ts';
 import { runTextQuery } from './sdk-utils.ts';
+import { GENESIS_HASH, readAuditHead } from './security/audit.ts';
 
 const TAG = '[data-sync]';
 const DEPLOYMENT_ID_FILE = '.deployment-id';
+/** Tracked, append-only, single-writer (security/audit.ts): committed on every flush, never pulled over, never stashed. */
+const AUDIT_DIR = 'audit';
+const NOT_AUDIT = ['--', '.', `:(exclude)${AUDIT_DIR}`];
 
 /** How long the LLM commit-message call may take before we fall back (ms). */
 const COMMIT_MSG_TIMEOUT_MS = 60_000;
@@ -357,11 +361,32 @@ export class DataSync {
       return;
     }
 
-    // Stash dirty + untracked files before merging (untracked can block merge if remote adds same paths)
-    const dirty = !!(await this.git('status', '--porcelain')).trim();
+    // The audit log is append-only with ONE writer, this instance. A remote commit touching audit/ would rewrite the local
+    // chain (and under `chattr +a` git can't even apply it) — refuse the whole pull and alert.
+    let incomingAudit: string;
+    try {
+      incomingAudit = (await this.git('diff', '--name-only', `HEAD...origin/${this.options.branch}`, '--', AUDIT_DIR)).trim();
+    } catch (err) {
+      console.warn(`${TAG} Audit pull check failed, skipping pull:`, (err as Error).message);
+      return;
+    }
+    if (incomingAudit) {
+      console.error(`${TAG} 🚫 Remote commits change the audit log — pull refused:\n${incomingAudit}`);
+      await this.alertOnce('audit-pull', incomingAudit,
+        `🚫 Data sync refused a pull: remote commits change the audit log, which only this instance writes.\n\n${incomingAudit}\n\n` +
+        `Inspect: \`cd data && git log origin/${this.options.branch} -- ${AUDIT_DIR}\``,
+      ).catch(err => console.warn(`${TAG} Audit pull notify failed:`, (err as Error).message));
+      return;
+    }
+    this.clearAlert('audit-pull');
+
+    // Stash dirty + untracked files before merging (untracked can block merge if remote adds same paths) — except audit/:
+    // stashing removes the live log from disk while the server appends to it (lost lines, forked chain) and fails under
+    // `chattr +a`. The merge can't touch audit/ (checked above), so it stays dirty in place.
+    const dirty = !!(await this.git('status', '--porcelain', ...NOT_AUDIT)).trim();
     if (dirty) {
       try {
-        await this.git('stash', 'push', '--include-untracked', '-m', 'data-sync: pre-pull stash');
+        await this.git('stash', 'push', '--include-untracked', '-m', 'data-sync: pre-pull stash', ...NOT_AUDIT);
       } catch (err) {
         console.warn(`${TAG} Stash failed, skipping pull:`, (err as Error).message);
         return;
@@ -441,12 +466,19 @@ export class DataSync {
         }
       }
 
+      // The audit log rides along with every sync commit — the data repo is its offsite copy — and the commit message
+      // anchors its head. Head read BEFORE staging: the committed chain always contains that hash.
+      const auditHead = this.auditHead();
+      if (existsSync(path.join(DATA_DIR, AUDIT_DIR))) {
+        await this.git('add', '--', AUDIT_DIR).catch(err => console.warn(`${TAG} Staging audit log failed:`, (err as Error).message));
+      }
+
       const status = await this.git('status', '--porcelain');
       if (!status.trim()) return;
 
       if (await this.guardMassDeletions('flush')) return;
       const msg = await this.generateCommitMessage(files);
-      await this.git('commit', '-m', msg).catch(() => {});
+      await this.git('commit', '-m', auditHead ? `${msg}\n\naudit-head: ${auditHead}` : msg).catch(() => {});
       const ahead = await this.git('rev-list', '--count', `origin/${this.options.branch}..HEAD`).catch(() => '0');
       if (parseInt(ahead.trim()) === 0) return;
       await this.git('push', 'origin', this.options.branch).catch(async (err) => {
@@ -468,11 +500,23 @@ export class DataSync {
     }
   }
 
+  /** Audit chain head for the commit anchor; undefined when there's no record yet or it can't be read (logged). */
+  private auditHead(): string | undefined {
+    try {
+      const head = readAuditHead(path.join(DATA_DIR, AUDIT_DIR));
+      return head === GENESIS_HASH ? undefined : head;
+    } catch (err) {
+      console.warn(`${TAG} Audit head unreadable, committing without anchor:`, (err as Error).message);
+      return undefined;
+    }
+  }
+
   private async generateCommitMessage(files: string[]): Promise<string> {
     const fallback = fallbackCommitMessage(files);
     try {
-      const diff = await this.git('diff', '--cached', '--stat').catch(() => '');
-      const diffContent = await this.git('diff', '--cached', '--no-color', '-U2').catch(() => '');
+      // The audit log's appended lines are not "behavioral config" and would crowd the real diff out of the prompt.
+      const diff = await this.git('diff', '--cached', '--stat', ...NOT_AUDIT).catch(() => '');
+      const diffContent = await this.git('diff', '--cached', '--no-color', '-U2', ...NOT_AUDIT).catch(() => '');
       if (!diffContent.trim()) return fallback;
       const truncated = diffContent.slice(0, 3000);
       // Bounded: a hung `claude` subprocess used to wedge flush() forever (it holds the push latch).
@@ -761,7 +805,12 @@ export class DataSync {
     'uploads/', 'repos/', '.tmp/', 'schedules.json.bak', 'git-log.json',
     '.internal-token', 'comms-log.jsonl', 'sessions/', 'unread/', '.DS_Store',
     'scheduler/', '.mcp-catalog.json',
+    'api-keys.json.bak', // pre-hashing plaintext keys (api-keys.ts migration) — never commit
     'workspace/users/*/.claude/', // per-user Claude logins (claude-account.ts) — credentials, never commit
+    // Live security state of the ACTIVE instance, which is its single writer — a pull must never overwrite it:
+    // blocks.json (guard auto-blocks); policy.json + .migrated (the Owner Console writes them; a pulled change trips
+    // the policy provenance/tamper check). Blue-green shares one DATA_DIR on one host, so nothing needs to cross hosts.
+    'security/',
   ];
 
   /** Write or refresh .gitignore, appending any canonical entries it's missing (idempotent). */

package/src/server/directives.ts

@@ -18,10 +18,8 @@ export interface ParsedPrompt {
   unresolvedModel?: string;
 }
 
-/** Model used when neither directives nor config specify one. Always passed
- * explicitly to the SDK — the CLI's own default silently drifts (it picked
- * Opus 4.7), which burns rate limits and budget. */
-export const DEFAULT_MODEL = 'claude-sonnet-5';
+// The default model lives in src/shared/models.ts so the client header names the same one.
+export { DEFAULT_MODEL } from '../shared/models';
 
 // Canonical model aliases + label. Vendored, pure, dependency-free (src/server/model-aliases.ts).
 // Re-exported here so the rest of shraga keeps importing model helpers from one place.

package/src/server/engine/claude-code.ts

@@ -23,6 +23,8 @@ import { APP_ROOT } from '../paths.ts';
 import { writeMcpConfigFile } from './mcp-config-file.ts';
 import { claudeUsageFor } from '../claude-usage.ts';
 import { claudeAccountDir, applyClaudeAccount, claudeAccountRef, type ClaudeAccountRef } from '../claude-account.ts';
+import { buildAgentEnv, builtinTools, filterMcpServers, allowsEscalate, allowsInternalToken, SENSITIVE_PATH_PATTERNS } from '../security/enforce.ts';
+import { escalateMcpServer } from '../security/escalate.ts';
 const IMMUTABLE_SYSTEM_PROMPT = readFileSync(path.resolve(import.meta.dirname, '../../../defaults/system-prompt.md'), 'utf-8');
 const DEFAULT_USER_PROMPT = `You are a helpful assistant with access to MCP tools.`;
 const DEFAULT_ALLOWED_TOOLS = ['Read', 'Edit', 'Bash', 'WebSearch', 'Glob', 'LS', 'ToolSearch'];
@@ -32,10 +34,6 @@ const HISTORY_LIMIT = 50;
 
 const NO_INTERACTIVE_ANSWER = 'No interactive channel is available to answer right now. Use your best judgement to proceed, and surface these options to the user in your reply so they can redirect if needed.';
 
-const SENSITIVE_PATTERNS = [
-  /\.env($|\.)/i, /secrets?\//i, /credentials/i, /\.pem$/i, /\.key$/i,
-  /service.account.*\.json/i, /\/\.claude\/credentials/i,
-];
 const SENSITIVE_BASH_PATTERNS = [
   /\.env\b/i, /\bprintenv\b/i, /\b(env|set)\s*\|/i, /\bsecrets?\//i,
   /credentials/i, /service.account/i, /\.(pem|key)\b/i,
@@ -63,7 +61,7 @@ type DenyResult = { behavior: 'deny'; message: string };
 function checkSensitiveAccess(toolName: string, input: Record<string, unknown>): DenyResult | null {
   const filePath = (input.file_path ?? input.path ?? '') as string;
   if ((toolName === 'Read' || toolName === 'Edit' || toolName === 'Write') && filePath) {
-    if (SENSITIVE_PATTERNS.some(p => p.test(filePath))) {
+    if (SENSITIVE_PATH_PATTERNS.some(p => p.test(filePath))) {
       console.log(`[security] Blocked ${toolName} on sensitive file: ${filePath}`);
       return { behavior: 'deny', message: 'Access to sensitive files (.env, secrets, credentials) is blocked.' };
     }
@@ -242,6 +240,7 @@ async function* buildLegacyImagePrompt(text: string, images: string[], sessionId
 
 export class ClaudeCodeEngine implements AgentEngine {
   readonly name = 'claude-code';
+  readonly enforcesProfile = true;
 
   getModels(): EngineModel[] {
     return [
@@ -329,8 +328,11 @@ export class ClaudeCodeEngine implements AgentEngine {
     const fullPrompt = plan.prompt;
     const permMode = opts.onPermissionRequest ? 'default' : (config.permissionMode ?? 'acceptEdits');
 
-    const sdkEnv: Record<string, string> = {};
-    for (const [k, v] of Object.entries(process.env)) {
+    // SECURITY_ENFORCE: the effective profile at spawn decides env/tools/MCPs; the per-call gate re-reads it (enforce.ts).
+    const guard = opts.security;
+    const eff = guard?.current();
+    const sdkEnv: Record<string, string> = eff ? buildAgentEnv(process.env, eff.profile) : {};
+    if (!eff) for (const [k, v] of Object.entries(process.env)) {
       if (v !== undefined) sdkEnv[k] = v;
     }
     // Injected for the agent's own tools/scripts. Each is written under both the canonical
@@ -366,12 +368,18 @@ export class ClaudeCodeEngine implements AgentEngine {
     let initModel: string | undefined;
     sdkEnv.INTERNAL_API_TOKEN = signInternalToken(opts.uid, opts.userEmail || 'unknown');
 
+    if (eff && !allowsInternalToken(eff.profile)) delete sdkEnv.INTERNAL_API_TOKEN;
+
     const baseAllowed = config.allowedTools ?? DEFAULT_ALLOWED_TOOLS;
-    const allowedTools = baseAllowed.includes('ToolSearch') ? baseAllowed : [...baseAllowed, 'ToolSearch'];
+    const withToolSearch = baseAllowed.includes('ToolSearch') ? baseAllowed : [...baseAllowed, 'ToolSearch'];
+    // Enforced: built-in tool AVAILABILITY is the profile's (tools outside it are not in the model's context), and
+    // auto-approval never widens it.
+    const available = eff ? builtinTools(eff.profile) : 'all';
+    const allowedTools = available === 'all' ? withToolSearch : withToolSearch.filter((t) => available.includes(t));
     const maxTurns = directives.turns ?? config.maxTurns ?? 50;
 
     const options: Record<string, unknown> = {
-      tools: { type: 'preset', preset: 'claude_code' },
+      tools: available === 'all' ? { type: 'preset', preset: 'claude_code' } : available,
       env: sdkEnv,
       allowedTools,
       cwd,
@@ -391,15 +399,24 @@ export class ClaudeCodeEngine implements AgentEngine {
       skills: listSkills(),
       disallowedTools: ['Skill'],
       agents: loadAgents(),
-      hooks: buildHooks({ exemptBashCommand: opts.foregroundBashCommand }),
+      // Enforced: the profile gate runs FIRST on every tool call — hooks fire even for auto-approved `allowedTools`,
+      // which never reach canUseTool.
+      hooks: ((h) => (guard ? { ...h, PreToolUse: [{ hooks: [guard.hook()] }, ...(h.PreToolUse ?? [])] } : h))(buildHooks({ exemptBashCommand: opts.foregroundBashCommand })),
     };
 
     const userHandler = opts.onPermissionRequest;
     const destructiveHandler = opts.onDestructiveApproval;
     const questionHandler = opts.onUserQuestion;
     options['canUseTool'] = async (toolName: string, input: Record<string, unknown>) => {
-      const denied = checkSensitiveAccess(toolName, input);
+      // Enforced: TurnGuard owns the file-path deny (tightened list); the legacy path list stays flag-OFF behavior only.
+      const denied = guard && toolName !== 'Bash' ? null : checkSensitiveAccess(toolName, input);
       if (denied) return denied;
+      // Enforced: the profile gate (re-reads the session floor) runs before ANY handler below, so an
+      // `onPermissionRequest: allow` call site can never override a profile deny.
+      if (guard) {
+        const gate = guard.check(toolName, input, cwd);
+        if (!gate.allow) return { behavior: 'deny' as const, message: gate.message };
+      }
       if (toolName === 'AskUserQuestion') {
         const questions = (input.questions ?? []) as AskQuestion[];
         const answers = questionHandler
@@ -479,12 +496,25 @@ export class ClaudeCodeEngine implements AgentEngine {
     // server's credentials) on the CLI's argv, where `ps` / `/proc` / journald expose it. See
     // writeMcpConfigFile. Setting both would re-add the argv copy, so it's one or the other.
     let mcpConfigFile: { path: string; cleanup: () => void } | undefined;
-    if (opts.mcpServers && Object.keys(opts.mcpServers).length > 0) {
-      mcpConfigFile = writeMcpConfigFile(opts.mcpServers);
+    // Enforced: servers outside profile.mcps never reach the file, so the CLI never starts them.
+    const mcpServers = eff ? filterMcpServers(opts.mcpServers, eff.profile) : opts.mcpServers;
+    if (mcpServers && Object.keys(mcpServers).length > 0) {
+      mcpConfigFile = writeMcpConfigFile(mcpServers);
       options['extraArgs'] = { ...(options['extraArgs'] as Record<string, string> | undefined), 'mcp-config': mcpConfigFile.path };
     }
+    // `escalate` is an in-process SDK server (no credentials): `options.mcpServers` hands the CLI only its name.
+    if (guard && eff && allowsEscalate(eff.profile)) {
+      const { principal } = guard.options;
+      const lastUser = opts.conversation.findLast((m) => m.role === 'user');
+      const excerpt = lastUser?.blocks.map((b) => (b.type === 'text' ? b.text : '')).filter(Boolean).join('\n') || opts.prompt;
+      const server = escalateMcpServer({
+        principal, role: () => guard.current().role, sessionId: opts.sessionId, excerpt,
+        channel: [principal.kind, principal.attrs.lane, opts.context?.source].filter(Boolean).join(':'),
+      });
+      options['mcpServers'] = { [server.name]: server };
+    }
 
-    const mcpNames = opts.mcpServers ? Object.keys(opts.mcpServers) : [];
+    const mcpNames = mcpServers ? Object.keys(mcpServers) : [];
     const activeModel = (options['model'] as string) || 'default';
     const directivesTag = Object.keys(directives).length ? ` directives=${JSON.stringify(directives)}` : '';
     console.log(`[claude] Starting query user=${opts.uid} session=${opts.sessionId ?? 'new'} model=${activeModel} perms=${config.permissionMode} mcps=[${mcpNames.join(',')}]${directivesTag} cwd=${cwd}`);

package/src/server/engine/types.ts

@@ -3,6 +3,7 @@ import type { WsEvent, AttachmentMeta, PermissionHandler, QuestionHandler } from
 import type { ConvMessage } from '../sessions.ts';
 import type { Directives } from '../directives.ts';
 import type { AgentSettings } from '../shraga-config.ts';
+import type { TurnGuard } from '../security/enforce.ts';
 
 export interface EngineStreamOpts {
   /** The user's effective prompt (after directive stripping, slash command expansion, skill/workspace mentions) */
@@ -35,6 +36,9 @@ export interface EngineStreamOpts {
   /** True when the conversation was truncated (user replayed/edited a message) — engines with cached state should reset. */
   conversationReset?: boolean;
   context?: Record<string, string>;
+  /** SECURITY_ENFORCE only: the turn's security context. The engine derives tools/MCP/env from its effective
+   *  profile and gates every tool call through it. Absent (flag off) ⇒ today's behavior, untouched. */
+  security?: TurnGuard;
 
   directives: Directives;
   config: AgentSettings;
@@ -42,6 +46,9 @@ export interface EngineStreamOpts {
 
 export interface AgentEngine {
   readonly name: string;
+  /** True if the engine applies `EngineStreamOpts.security` (profile tools/MCP/env + per-call gate). Under
+   *  SECURITY_ENFORCE an engine without it may only run turns whose effective profile is unrestricted. */
+  readonly enforcesProfile?: boolean;
   stream(opts: EngineStreamOpts): AsyncGenerator<WsEvent>;
   /** Return model options for the UI picker (only called when engine is available) */
   getModels(): EngineModel[];

package/src/server/hooks.ts

@@ -7,6 +7,7 @@
  */
 import type { HookCallback, HookCallbackMatcher, HookEvent, PreToolUseHookInput } from '@anthropic-ai/claude-agent-sdk';
 import { rewriteSlackMentions } from './slack/mention-rewrite.ts';
+import { PROTECTED_DATA_MESSAGE, writesProtectedData } from './security/enforce.ts';
 
 /** Patterns that indicate a long-running script the model should background. */
 const LONG_RUNNING_PATTERNS = [
@@ -134,6 +135,23 @@ const guardFirebaseReads: HookCallback = async (input) => {
   };
 };
 
+/** Tamper protection: no agent file tool writes server-owned data (audit, conversations, sessions, security, keys,
+ *  MCP config) — any profile, SECURITY_ENFORCE on or off. A hook, not canUseTool: the SDK auto-approves allowed/
+ *  accept-edits tools without calling canUseTool. See security/enforce.ts PROTECTED_DATA_WRITE. */
+const denyProtectedDataWrites: HookCallback = async (input) => {
+  if (input.hook_event_name !== 'PreToolUse') return {};
+  const { tool_name, tool_input, cwd } = input as PreToolUseHookInput;
+  if (!writesProtectedData(tool_name, (tool_input ?? {}) as Record<string, unknown>, cwd || undefined)) return {};
+  console.log(`[hooks] Denied ${tool_name} on protected data path`);
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse' as const,
+      permissionDecision: 'deny' as const,
+      permissionDecisionReason: PROTECTED_DATA_MESSAGE,
+    },
+  };
+};
+
 /** Build the hooks map to pass into SDK query() options.
  *  `exemptBashCommand` is the one command the turn was explicitly told to run in the foreground
  *  (a `bash` schedule's command) — see forceBackgroundForScripts. */
@@ -143,6 +161,7 @@ export function buildHooks(opts?: { exemptBashCommand?: string }): Partial<Recor
       { matcher: 'Bash', hooks: [forceBackgroundForScripts(opts?.exemptBashCommand)] },
       { matcher: 'mcp__mcp-slack-use__post_slack_.*', hooks: [resolveSlackMentions] },
       { matcher: 'mcp__mcp-firebase-(?:prod|lab)__get_db.*', hooks: [guardFirebaseReads] },
+      { matcher: 'Write|Edit|MultiEdit|NotebookEdit', hooks: [denyProtectedDataWrites] },
     ],
   };
 }

package/src/server/mcp-oauth.ts

@@ -6,18 +6,23 @@
  * of a static `uck_` API key.
  *
  * Provider-agnostic by design: the only place a user proves identity is `/oauth/authorize/consent`,
- * which is guarded by `requireAuth` — the same seam that handles Firebase today and email-password
+ * which is guarded by `requireAuth` AND requires an interactive login (principal kind `user` — never an API key or
+ * internal token, which would otherwise mint themselves a login-equivalent MCP token) — the same seam that handles Firebase today and email-password
  * later. Access/refresh tokens are stateless HMAC tokens (see auth.ts:signMcpToken). No DB:
  * clients live in a flat JSON file, auth codes in a short-TTL in-memory map.
  */
 import type { Express, Request, Response, NextFunction } from 'express';
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { randomBytes, createHash } from 'node:crypto';
-import { requireAuth, signMcpToken, verifyMcpToken, type AuthUser } from './auth.ts';
+import { MCP_TOKEN_TTL, requireAuth, signMcpToken, verifyMcpToken, type AuthUser } from './auth.ts';
 import { dataPath } from './paths.ts';
+import { security } from './security/runtime.ts';
+import { fromAuthUser } from './security/principal.ts';
+import { tokenRevoked } from './security/revocation.ts';
 
-const ACCESS_TTL = 3600; // 1h
-const REFRESH_TTL = 60 * 60 * 24 * 30; // 30d
+// Shared with auth.ts: a legacy token's implied issued-at is exp - TTL, so the TTLs must be the ones signed with.
+const ACCESS_TTL = MCP_TOKEN_TTL.access; // 1h
+const REFRESH_TTL = MCP_TOKEN_TTL.refresh; // 30d
 const CODE_TTL_MS = 60_000; // 1min
 
 const CLIENTS_PATH = () => dataPath('oauth-clients.json');
@@ -48,6 +53,8 @@ interface AuthCode {
   challenge: string;       // PKCE code_challenge (S256)
   resource?: string;
   expiresAt: number;
+  /** Epoch seconds — checked against tokensValidAfter at exchange, so a revocation also kills unexchanged codes. */
+  issuedAt: number;
 }
 const codes = new Map<string, AuthCode>();
 
@@ -133,6 +140,14 @@ export function registerMcpOAuthRoutes(app: Express) {
   // ── Consent → issue authorization code (identity via requireAuth seam) ───────
   app.post('/oauth/authorize/consent', oauthCors, requireAuth, (req: Request, res: Response) => {
     const user = (req as any).user as AuthUser;
+    // Consent mints an OAuth grant AS this identity — only an interactive login may give it. An API key or internal
+    // token must not launder itself into a login-equivalent (possibly owner) MCP token.
+    const kind = user.principal?.kind ?? 'unknown';
+    if (kind !== 'user') {
+      console.warn(`[mcp-oauth] consent refused: non-interactive credential (${kind})`);
+      security()?.authDeny('oauth:consent', `non-interactive:${kind}`, req.ip);
+      return void res.status(403).json({ error: 'access_denied', error_description: 'OAuth consent requires an interactive login' });
+    }
     const { client_id, redirect_uri, code_challenge, code_challenge_method, resource } = (req.body ?? {}) as Record<string, string>;
     if (!client_id || !redirect_uri || !code_challenge) {
       return void res.status(400).json({ error: 'invalid_request', error_description: 'client_id, redirect_uri, code_challenge required' });
@@ -149,7 +164,7 @@ export function registerMcpOAuthRoutes(app: Express) {
     const code = randomBytes(32).toString('hex');
     codes.set(code, {
       uid: user.uid, email: user.email, clientId: client_id, redirectUri: redirect_uri,
-      challenge: code_challenge, resource, expiresAt: Date.now() + CODE_TTL_MS,
+      challenge: code_challenge, resource, expiresAt: Date.now() + CODE_TTL_MS, issuedAt: Math.floor(Date.now() / 1000),
     });
     console.log(`[mcp-oauth] issued auth code for ${user.email} → client ${client_id}`);
     res.json({ code });
@@ -170,6 +185,10 @@ export function registerMcpOAuthRoutes(app: Express) {
       if (!b.code_verifier || !pkceVerify(b.code_verifier, entry.challenge)) {
         return void res.status(400).json({ error: 'invalid_grant', error_description: 'PKCE verification failed' });
       }
+      if (tokenRevoked(fromAuthUser({ uid: entry.uid, email: entry.email }).id, entry.issuedAt)) {
+        console.warn(`[mcp-oauth] auth code for ${entry.email} predates a token revocation — refused`);
+        return void res.status(400).json({ error: 'invalid_grant', error_description: 'authorization revoked — sign in again' });
+      }
       return void res.json({
         access_token: signMcpToken(entry.uid, entry.email, 'access', ACCESS_TTL),
         token_type: 'Bearer',

package/src/server/mcp-server.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { timingSafeEqual } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { json } from 'itty-router';
 import { RouterWrapper, captureMcpProgress } from 'edge.libx.js/build/main.js';
 import type { Application, Request, Response } from 'express';
@@ -11,8 +12,10 @@ import { getAllSessions, loadConversation, isSessionLocked } from './sessions.ts
 import * as scheduler from './scheduler/index.ts';
 import { buildReport } from './downtime.ts';
 import { getAgentConfig, MAX_TURNS_NOTICE } from './claude.ts';
-import { validateApiKey } from './api-keys.ts';
+import { apiKeyPrincipal, validateApiKey } from './api-keys.ts';
 import { verifyMcpToken } from './auth.ts';
+import { fromAuthUser, fromInternal, type Principal } from './security/principal.ts';
+import { security, admitTurn, requestIp } from './security/runtime.ts';
 import { makeProgressEmitter } from './mcp-progress.ts';
 import { lookupIdempotent, rememberIdempotent } from './idempotency.ts';
 import type { WsEvent } from './claude.ts';
@@ -31,6 +34,7 @@ export type RunChatTurn = (
     userName?: string;
     abortController?: AbortController;
     context?: Record<string, string>;
+    principal: Principal;
   },
   hooks?: { onEvent?: (ev: WsEvent) => void },
 ) => Promise<RunChatTurnResult>;
@@ -39,9 +43,21 @@ export interface McpServerDeps {
   runChatTurn: RunChatTurn;
 }
 
-// Per-request caller identity, set by the /mcp Express handler before forwarding to MCP tool handlers.
-// Safe because Node is single-threaded and the handler awaits the full MCP response.
-let currentCaller: { uid: string; email: string } | null = null;
+export interface McpCaller { uid: string; email: string; principal: Principal; ip?: string }
+
+/** Identity of the legacy raw INTERNAL_API_TOKEN caller — unchanged effective identity, now an internal principal. */
+const LEGACY_INTERNAL_CALLER: McpCaller = {
+  uid: 'agent-internal', email: 'agent@internal',
+  principal: fromInternal({ uid: 'agent-internal', email: 'agent@internal', lane: 'mcp-legacy-token' }),
+};
+
+// Per-request caller identity. AsyncLocalStorage, not a module global: two concurrent /mcp requests
+// (a long sync post_chat + a second caller) used to overwrite — and then null — each other's caller.
+// The store is entered around the WHOLE /mcp handler, SSE pipe included.
+const mcpCallerStore = new AsyncLocalStorage<McpCaller>();
+
+/** The authenticated /mcp caller of the current request — valid anywhere in its async chain, across awaits. */
+export function currentMcpCaller(): McpCaller | undefined { return mcpCallerStore.getStore(); }
 
 function errMessage(e: unknown): string {
   return e instanceof Error ? e.message : String(e);
@@ -286,7 +302,7 @@ export function createShragaMcp(deps: McpServerDeps) {
       const { prompt, sessionId, sync = true, clientRequestId } = body as { prompt?: string; sessionId?: string; sync?: boolean; clientRequestId?: string };
       if (!prompt) return json({ error: 'prompt required' }, { status: 400 });
 
-      const caller = currentCaller || { uid: 'agent-internal', email: 'agent@internal' };
+      const caller = currentMcpCaller() ?? LEGACY_INTERNAL_CALLER;
       const idemKey = clientRequestId || str(req.headers?.get?.('idempotency-key'));
 
       // Idempotency: a retried submit with the same key reuses the session that first
@@ -299,23 +315,33 @@ export function createShragaMcp(deps: McpServerDeps) {
       // Pre-allocate the session id so async callers get a real id back immediately
       // (parity with POST /api/chat). Lets timeout-prone MCP clients recover/continue
       // instead of double-submitting and creating duplicate sessions.
+      // Guard before any spend: blocklist → rate → concurrency (shadow unless SECURITY_ENFORCE).
+      const admission = admitTurn(caller.principal, { ip: caller.ip, channel: 'mcp' });
+      if (!admission.ok) {
+        return json({ error: admission.status === 403 ? 'Forbidden' : 'Too many requests', reason: admission.reason, retryAfter: admission.retryAfter },
+          { status: admission.status, headers: admission.retryAfter ? { 'Retry-After': String(admission.retryAfter) } : undefined });
+      }
+
       const sid = sessionId || `api-${crypto.randomUUID()}`;
       if (idemKey) rememberIdempotent(caller.uid, idemKey, sid);
-      const turn = { prompt, sessionId: sid, uid: caller.uid, userEmail: caller.email, context: { source: 'mcp', user: caller.email } };
+      const turn = { prompt, sessionId: sid, uid: caller.uid, userEmail: caller.email, principal: caller.principal, context: { source: 'mcp', user: caller.email } };
 
       if (sync === false) {
         // Reject a duplicate before responding 'accepted' (lock is acquired inside the turn).
         if (sessionId && isSessionLocked(sid)) {
+          admission.release();
           return json({ error: 'Session is already processing a request' }, { status: 409 });
         }
         // Fire-and-forget: kick off the turn, return the real session id immediately.
-        void deps.runChatTurn(turn);
+        void deps.runChatTurn(turn).finally(admission.release);
         return json({ sessionId: sid, status: 'accepted' });
       }
 
       // Capture the progress channel here (within the tools/call async context) and stream
       // agent events as notifications/progress. No-op unless the client requested progress.
-      const result = await deps.runChatTurn(turn, { onEvent: makeProgressEmitter(captureMcpProgress()) });
+      let result: Awaited<ReturnType<typeof deps.runChatTurn>>;
+      try { result = await deps.runChatTurn(turn, { onEvent: makeProgressEmitter(captureMcpProgress()) }); }
+      finally { admission.release(); }
       if ('status' in result) return json({ error: 'Session is already processing a request' }, { status: 409 });
       if ('error' in result) return json({ error: result.error, sessionId: result.sessionId }, { status: 500 });
       // A turn that hit the step ceiling is a PARTIAL answer. Without this the MCP caller got the
@@ -413,31 +439,37 @@ export function mountMcpServer(app: Application, deps: McpServerDeps) {
     const authHeader = req.headers.authorization?.replace('Bearer ', '');
     const internalToken = req.headers['x-internal-token'] as string | undefined;
 
-    let authed = false;
-    let caller: { uid: string; email: string } | null = null;
+    let caller: McpCaller | null = null;
+    let via = 'mcp';
     if (internalToken && process.env.INTERNAL_API_TOKEN) {
       const secret = process.env.INTERNAL_API_TOKEN;
-      authed = internalToken.length === secret.length &&
-        timingSafeEqual(Buffer.from(internalToken), Buffer.from(secret));
+      if (internalToken.length === secret.length && timingSafeEqual(Buffer.from(internalToken), Buffer.from(secret))) {
+        caller = LEGACY_INTERNAL_CALLER; via = 'mcp:internal';
+      }
     }
-    if (!authed && authHeader?.startsWith('uck_')) {
-      caller = validateApiKey(authHeader);
-      authed = !!caller;
+    if (!caller && authHeader?.startsWith('uck_')) {
+      const k = validateApiKey(authHeader);
+      if (k) { caller = { uid: k.uid, email: k.email, principal: apiKeyPrincipal(k) }; via = 'mcp:apikey'; }
     }
-    if (!authed && authHeader?.startsWith('mcp_')) {
+    if (!caller && authHeader?.startsWith('mcp_')) {
       const id = verifyMcpToken(authHeader);
-      if (id && id.kind === 'access') { caller = { uid: id.uid, email: id.email }; authed = true; }
+      if (id && id.kind === 'access') { caller = { uid: id.uid, email: id.email, principal: fromAuthUser(id) }; via = 'mcp:oauth'; }
     }
-    if (!authed) {
+    if (!caller) {
+      security()?.authDeny('mcp', authHeader || internalToken ? 'invalid-credential' : 'missing-credential', req.ip);
       // Point MCP clients (claude.ai et al.) at our OAuth discovery so they can run the auth handshake.
       const proto = (req.get('x-forwarded-proto') || req.protocol).split(',')[0];
       const base = `${proto}://${req.get('host')}`;
       res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`);
       return void res.status(401).json({ error: 'Unauthorized — provide API key or complete OAuth' });
     }
-    currentCaller = caller;
+    security()?.authAllow(caller.principal, via);
+    return mcpCallerStore.run({ ...caller, ip: requestIp(req) }, () => bridge(req, res));
+  });
 
-    // Bridge Express Request → Web API Request → MCPAdapter.httpHandler → Express Response.
+  // Bridge Express Request → Web API Request → MCPAdapter.httpHandler → Express Response. Runs inside
+  // the caller's AsyncLocalStorage context (entered above), which the tool handlers read.
+  async function bridge(req: Request, res: Response): Promise<void> {
     const url = `${req.protocol}://${req.get('host')}${req.originalUrl}`;
     const webReq = new globalThis.Request(url, {
       method: req.method,
@@ -454,8 +486,8 @@ export function mountMcpServer(app: Application, deps: McpServerDeps) {
       res.status(webRes.status);
       webRes.headers.forEach((val, key) => res.setHeader(key, val));
       // For a Streamable-HTTP SSE response (progress streaming), pipe the body so frames flush
-      // as the agent emits them. currentCaller stays set until the pipe completes (the tool
-      // handler reads it inside the stream). Otherwise buffer the single JSON response.
+      // as the agent emits them. The caller context spans the pipe (the tool handler reads it inside
+      // the stream). Otherwise buffer the single JSON response.
       if (webRes.body && (webRes.headers.get('content-type') || '').includes('text/event-stream')) {
         (res as any).flushHeaders?.();
         const reader = webRes.body.getReader();
@@ -473,10 +505,8 @@ export function mountMcpServer(app: Application, deps: McpServerDeps) {
       console.error('[mcp-server] handler error:', e);
       if (!res.headersSent) res.status(500).json({ error: 'MCP handler error' });
       else res.end();
-    } finally {
-      currentCaller = null;
     }
-  });
+  }
 
   console.log('[mcp-server] MCP endpoint mounted at /mcp');
 }

package/src/server/modules/routes.ts

@@ -3,13 +3,9 @@
 import type { Express, RequestHandler, Request, Response } from 'express';
 import { loadState, listAvailableModules, installModule, enableModule, disableModule, setModuleConfig, uninstallModule, readManifest, readModuleReadme } from './service.ts';
 import { dataPath } from '../paths.ts';
+import { ownerOnly as ownerGate } from '../security/owner-only.ts';
 
-function ownerOnly(req: Request, res: Response): boolean {
-  const user = (req as any).user;
-  if (user?.isOwner) return true;
-  res.status(403).json({ error: 'Only an owner can manage modules' });
-  return false;
-}
+const ownerOnly = (req: Request, res: Response): boolean => ownerGate(req, res, 'Only an owner can manage modules');
 
 export function registerModuleRoutes(app: Express, requireAuth: RequestHandler): void {
   app.get('/api/modules', requireAuth, (_req, res) => {

package/src/server/notify-owners.ts

@@ -10,23 +10,11 @@ import { emitEvent } from './events/bus.ts';
 
 export type Owner = { name?: string; slackId: string };
 
-/** The OWNERS env list, lowercased. THE definition of "an owner of this deployment" — every
- *  medium joins on it, each through whatever identity it happens to hold. */
-export function ownerEmails(): string[] {
-  return (process.env.OWNERS ?? '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
-}
-
-/** Is this email address an owner of this deployment?
- *
- *  Exported because a medium that is not Slack cannot use `resolveOwners`: that returns Slack ids
- *  (OWNERS ∩ contacts WITH a Slack id), which is a Slack-shaped answer. A webhook-lane add-on, for
- *  instance, holds a shraga uid + the email of the API key that opened the link, so it joins on the
- *  email instead. An empty/unknown address is NOT an owner — the fail-closed direction, since the
- *  alternative is fanning a deploy report out to whoever happened to open a link. */
-export function isOwnerEmail(email: string | undefined | null): boolean {
-  const e = String(email ?? '').trim().toLowerCase();
-  return !!e && ownerEmails().includes(e);
-}
+// OWNERS parsing lives in ./owners.ts (single definition). Re-exported under the historical names:
+// `isOwnerEmail` joins media that hold an email rather than a Slack id (e.g. webhook-lane); an
+// empty/unknown address is NOT an owner — fail-closed.
+export { getOwners as ownerEmails, isOwnerEmail } from './owners.ts';
+import { isOwnerEmail } from './owners.ts';
 
 /** Owners of THIS deployment (OWNERS env ∩ contacts that have a Slack id). */
 export async function resolveOwners(): Promise<Owner[]> {

package/src/server/owners.ts

@@ -0,0 +1,14 @@
+// The root of trust for "who owns this deployment": the OWNERS env var. Dependency-free on
+// purpose — auth, notify-owners and the security policy all join on it, so it must not import any
+// of them.
+
+/** OWNERS="email1,email2" → lowercased, trimmed, de-duplicated list. Read per call (env may change in tests). */
+export function getOwners(): string[] {
+  return [...new Set((process.env.OWNERS ?? '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean))];
+}
+
+/** Is this email an owner? Empty/unknown is NOT an owner (fail-closed). */
+export function isOwnerEmail(email: string | undefined | null): boolean {
+  const e = String(email ?? '').trim().toLowerCase();
+  return !!e && getOwners().includes(e);
+}