shraga 0.1.112 → 0.1.114

package/src/server/claude.ts

@@ -3,7 +3,8 @@ import { summarizeText } from './summarize.ts';
 import { dataSync } from './data-sync.ts';
 import type { McpConfig } from './mcp.ts';
 import type { ClaudeAccountRef } from './claude-account.ts';
-import { loadConversation, saveConversation, appendMessage, getSession, setSessionDirectives, addTriggeredSkills, upsertSession, setClaudeResume, type ConvMessage, type ConvBlock } from './sessions.ts';
+import { loadConversation, saveConversation, appendMessage, getSession, setSessionDirectives, addTriggeredSkills, upsertSession, setClaudeResume, getSessionFloor, lowerSessionFloor, type ConvMessage, type ConvBlock } from './sessions.ts';
+import { enforcing, TurnGuard } from './security/enforce.ts';
 import { createTurnAccumulator, type TurnStreamHooks } from './turn-stream.ts';
 import {
   resolveDefaultSkillsContent,
@@ -25,35 +26,18 @@ import { getUserContextBlock } from './user-context.ts';
 import { collectTurnContext } from './turn-context.ts';
 import { DATA_DIR, dataPath } from './paths.ts';
 import * as contacts from './contacts.ts';
+import type { Principal } from './security/principal.ts';
+import { security, resolvePrincipal } from './security/runtime.ts';
 import { resolveAndGetEngine, ModelUnavailableError } from './engine/index.ts';
 
-const CONFIG_PATH = dataPath('agent-config.json');
-
 // ── Agent config (shared across users) ──────────────────────────────────────
+// The READ path lives in agent-config.ts (a leaf the security runtime can import without pulling this
+// module's graph); re-exported here so existing importers keep using claude.ts.
 
 export type { AgentSettings as AgentConfig } from './shraga-config.ts';
 import type { AgentSettings as AgentConfig } from './shraga-config.ts';
-
-const DEFAULT_CONFIG: AgentConfig = {
-  /** ToolSearch loads deferred MCP tools; without it, permission prompts / tool graph can block Meta Ads tools. */
-  allowedTools: ['Read', 'Edit', 'Bash', 'WebSearch', 'Glob', 'LS', 'ToolSearch'],
-  permissionMode: 'acceptEdits',
-  maxTurns: 15,
-  // Defaults are what a fresh self-hosted install runs before anyone touches the UI, so they favour
-  // cost/latency over ceiling. Both are overridable per-deployment via agent-config.json and per-send
-  // via directives — an operator who wants a bigger model sets it once; every operator pays for a default.
-  model: 'claude-sonnet-5',
-  effort: 'low',
-};
-
-export function getAgentConfig(): AgentConfig {
-  // agent-config.json (UI-writable, git-tracked) is the single source of truth for agent settings.
-  let config = { ...DEFAULT_CONFIG };
-  if (existsSync(CONFIG_PATH)) {
-    try { Object.assign(config, JSON.parse(readFileSync(CONFIG_PATH, 'utf-8'))); } catch (e) { console.warn('[claude] failed to parse agent-config.json:', e); }
-  }
-  return config;
-}
+import { CONFIG_PATH, getAgentConfig } from './agent-config.ts';
+export { getAgentConfig };
 
 /**
  * Which credentials the claude-code SDK will resolve — process-global, derived from env at call time
@@ -197,7 +181,10 @@ function applyCompactMarkers(conv: ConvMessage[]): ConvMessage[] {
 
 export interface AttachmentMeta { url: string; name: string; mimeType: string; path: string }
 
-export async function* streamChat(opts: {
+export interface StreamChatOpts {
+  /** Who this turn runs for. Required so every channel is enumerated by the compiler. Shadow mode:
+   *  resolved + audited (turn.start/turn.end), not yet enforced. */
+  principal: Principal;
   prompt: string;
   attachments?: AttachmentMeta[];
   images?: string[];
@@ -217,7 +204,85 @@ export async function* streamChat(opts: {
    * where an add-on's contributor reads its own keys. */
   turnHints?: Record<string, unknown>;
   context?: Record<string, string>;
-}): AsyncGenerator<WsEvent> {
+}
+
+/** Run one agent turn. Security wrapper: resolves the principal's role/profile and audits turn.start / turn.end.
+ *  SHADOW (SECURITY_ENFORCE off): the turn is unchanged; auditing can never alter or break it.
+ *  ENFORCE: the session floor is lowered to the caller's rank (taint), the turn runs under a TurnGuard whose
+ *  effective profile the engine applies, and it FAILS CLOSED — no runtime, a resolution error, or an effective
+ *  profile with `outbound: false` (e.g. `none`) refuses the turn with an `error` event. */
+export async function* streamChat(opts: StreamChatOpts): AsyncGenerator<WsEvent> {
+  const sec = security();
+  const enforce = enforcing();
+  if (!sec) {
+    if (!enforce) { yield* runTurn(opts); return; }
+    console.error('[security] SECURITY_ENFORCE is on but the security runtime is not initialized — refusing the turn');
+    yield { type: 'error', message: 'Security enforcement is on but not initialized, so this turn was not run.' };
+    return;
+  }
+  const { principal, sessionId } = opts;
+  let role: string | undefined;
+  let guard: TurnGuard | undefined;
+  let refusal: string | undefined;
+  try {
+    const d = sec.decide(principal, sessionId);
+    role = d.role;
+    let enforced: Record<string, unknown> = {};
+    if (enforce) {
+      // A broken policy fails closed at resolve time already; it must not ALSO permanently taint every session it touches.
+      if (sessionId && sec.policy.valid) lowerSessionFloor(sessionId, d.rank);
+      guard = new TurnGuard({ runtime: sec, principal, sessionId, role: d.role, rank: d.rank, floorOf: getSessionFloor });
+      const eff = guard.current();
+      if (!eff.profile.outbound) refusal = `This conversation runs as role "${eff.role}", which is not permitted to run the agent.`;
+      enforced = { enforced: true, effectiveRole: eff.role, effectiveProfile: eff.profileName, floor: sessionId ? getSessionFloor(sessionId) : undefined };
+    }
+    sec.record({ type: 'turn.start', principal: principal.id, role, sessionId, meta: { kind: principal.kind, lane: principal.attrs.lane, source: opts.context?.source, profile: d.profile, rank: d.rank, wouldDeny: d.wouldDeny, ...enforced } });
+  } catch (e: any) {
+    console.error('[security] turn.start audit failed:', e.message);
+    if (enforce) refusal = 'The security check for this turn failed, so it was not run.';
+  }
+  const started = Date.now();
+  let outcome = 'closed';
+  try {
+    if (enforce && (refusal || !guard)) {
+      outcome = 'denied';
+      console.warn(`[security] Refused turn for ${principal.id} session=${sessionId ?? 'new'}: ${refusal}`);
+      yield { type: 'error', message: refusal ?? 'The security check for this turn failed, so it was not run.' };
+      return;
+    }
+    for await (const ev of runTurn(opts, guard)) {
+      if (ev.type === 'done') outcome = 'done';
+      else if (ev.type === 'error') outcome = 'error';
+      yield ev;
+    }
+    if (outcome === 'closed') outcome = 'done';
+  } catch (e) {
+    outcome = 'threw';
+    throw e;
+  } finally {
+    try { sec.record({ type: 'turn.end', principal: principal.id, role, sessionId, reason: outcome, meta: { ms: Date.now() - started } }); }
+    catch (e: any) { console.error('[security] turn.end audit failed:', e.message); }
+  }
+}
+
+/** SECURITY_ENFORCE: `principal`'s rank under the live policy. Undefined in shadow mode, without a runtime, or on an
+ *  invalid (fail-closed) policy — callers then apply no rank-based filtering. */
+export function enforcedRank(principal: Principal): number | undefined {
+  const sec = security();
+  return enforcing() && sec?.policy.valid ? resolvePrincipal(sec.policy, principal).rank : undefined;
+}
+
+/** SECURITY_ENFORCE: input from `principal` entered `sessionId` outside a turn it runs (e.g. another human's Slack
+ *  thread message) — lower the session floor to that principal's rank. No-op in shadow mode, without a runtime, or
+ *  on an invalid (fail-closed) policy. Returns the new floor, or undefined when nothing was done. */
+export async function taintSession(sessionId: string, principal: Principal | (() => Promise<Principal>)): Promise<number | undefined> {
+  const sec = security();
+  if (!enforcing() || !sec?.policy.valid) return undefined;
+  const p = typeof principal === 'function' ? await principal() : principal;
+  return lowerSessionFloor(sessionId, resolvePrincipal(sec.policy, p).rank);
+}
+
+async function* runTurn(opts: StreamChatOpts, guard?: TurnGuard): AsyncGenerator<WsEvent> {
   const config = getAgentConfig();
   const { prompt: cleanPrompt, directives: parsed, unresolvedModel } = parseDirectives(opts.prompt);
 
@@ -395,6 +460,16 @@ export async function* streamChat(opts: {
     yield { type: 'error', message };
     return;
   }
+  // An engine that doesn't apply the profile can only run a turn that needs no restriction.
+  if (guard && !engine.enforcesProfile) {
+    const { profile, role } = guard.current();
+    if (!(profile.tools.includes('*') && profile.mcps.includes('*') && profile.env.includes('*'))) {
+      const message = `Engine "${engine.name}" does not enforce security profiles, so it cannot run this conversation's role "${role}".`;
+      console.error(`[security] ${message} (user=${opts.uid} session=${sessionId})`);
+      yield { type: 'error', message };
+      return;
+    }
+  }
   console.log(`[stream] engine=${engine.name} user=${opts.uid} session=${sessionId}`);
   // Another engine's turn never reaches the claude-code transcript, so a stored SDK-resume mapping is
   // stale from here on — mark it; the claude-code engine then falls back to a fresh query (engine-switch).
@@ -421,6 +496,7 @@ export async function* streamChat(opts: {
     turnHints: opts.turnHints,
     conversationReset: opts.conversationReset,
     context: opts.context,
+    ...(guard ? { security: guard } : {}),
     directives,
     config,
   });

package/src/server/data-sync.ts

@@ -4,9 +4,13 @@ import path from 'node:path';
 import { DATA_DIR } from './paths.ts';
 import { notifyOwners } from './notify-owners.ts';
 import { runTextQuery } from './sdk-utils.ts';
+import { GENESIS_HASH, readAuditHead } from './security/audit.ts';
 
 const TAG = '[data-sync]';
 const DEPLOYMENT_ID_FILE = '.deployment-id';
+/** Tracked, append-only, single-writer (security/audit.ts): committed on every flush, never pulled over, never stashed. */
+const AUDIT_DIR = 'audit';
+const NOT_AUDIT = ['--', '.', `:(exclude)${AUDIT_DIR}`];
 
 /** How long the LLM commit-message call may take before we fall back (ms). */
 const COMMIT_MSG_TIMEOUT_MS = 60_000;
@@ -357,11 +361,32 @@ export class DataSync {
       return;
     }
 
-    // Stash dirty + untracked files before merging (untracked can block merge if remote adds same paths)
-    const dirty = !!(await this.git('status', '--porcelain')).trim();
+    // The audit log is append-only with ONE writer, this instance. A remote commit touching audit/ would rewrite the local
+    // chain (and under `chattr +a` git can't even apply it) — refuse the whole pull and alert.
+    let incomingAudit: string;
+    try {
+      incomingAudit = (await this.git('diff', '--name-only', `HEAD...origin/${this.options.branch}`, '--', AUDIT_DIR)).trim();
+    } catch (err) {
+      console.warn(`${TAG} Audit pull check failed, skipping pull:`, (err as Error).message);
+      return;
+    }
+    if (incomingAudit) {
+      console.error(`${TAG} 🚫 Remote commits change the audit log — pull refused:\n${incomingAudit}`);
+      await this.alertOnce('audit-pull', incomingAudit,
+        `🚫 Data sync refused a pull: remote commits change the audit log, which only this instance writes.\n\n${incomingAudit}\n\n` +
+        `Inspect: \`cd data && git log origin/${this.options.branch} -- ${AUDIT_DIR}\``,
+      ).catch(err => console.warn(`${TAG} Audit pull notify failed:`, (err as Error).message));
+      return;
+    }
+    this.clearAlert('audit-pull');
+
+    // Stash dirty + untracked files before merging (untracked can block merge if remote adds same paths) — except audit/:
+    // stashing removes the live log from disk while the server appends to it (lost lines, forked chain) and fails under
+    // `chattr +a`. The merge can't touch audit/ (checked above), so it stays dirty in place.
+    const dirty = !!(await this.git('status', '--porcelain', ...NOT_AUDIT)).trim();
     if (dirty) {
       try {
-        await this.git('stash', 'push', '--include-untracked', '-m', 'data-sync: pre-pull stash');
+        await this.git('stash', 'push', '--include-untracked', '-m', 'data-sync: pre-pull stash', ...NOT_AUDIT);
       } catch (err) {
         console.warn(`${TAG} Stash failed, skipping pull:`, (err as Error).message);
         return;
@@ -441,12 +466,19 @@ export class DataSync {
         }
       }
 
+      // The audit log rides along with every sync commit — the data repo is its offsite copy — and the commit message
+      // anchors its head. Head read BEFORE staging: the committed chain always contains that hash.
+      const auditHead = this.auditHead();
+      if (existsSync(path.join(DATA_DIR, AUDIT_DIR))) {
+        await this.git('add', '--', AUDIT_DIR).catch(err => console.warn(`${TAG} Staging audit log failed:`, (err as Error).message));
+      }
+
       const status = await this.git('status', '--porcelain');
       if (!status.trim()) return;
 
       if (await this.guardMassDeletions('flush')) return;
       const msg = await this.generateCommitMessage(files);
-      await this.git('commit', '-m', msg).catch(() => {});
+      await this.git('commit', '-m', auditHead ? `${msg}\n\naudit-head: ${auditHead}` : msg).catch(() => {});
       const ahead = await this.git('rev-list', '--count', `origin/${this.options.branch}..HEAD`).catch(() => '0');
       if (parseInt(ahead.trim()) === 0) return;
       await this.git('push', 'origin', this.options.branch).catch(async (err) => {
@@ -468,11 +500,23 @@ export class DataSync {
     }
   }
 
+  /** Audit chain head for the commit anchor; undefined when there's no record yet or it can't be read (logged). */
+  private auditHead(): string | undefined {
+    try {
+      const head = readAuditHead(path.join(DATA_DIR, AUDIT_DIR));
+      return head === GENESIS_HASH ? undefined : head;
+    } catch (err) {
+      console.warn(`${TAG} Audit head unreadable, committing without anchor:`, (err as Error).message);
+      return undefined;
+    }
+  }
+
   private async generateCommitMessage(files: string[]): Promise<string> {
     const fallback = fallbackCommitMessage(files);
     try {
-      const diff = await this.git('diff', '--cached', '--stat').catch(() => '');
-      const diffContent = await this.git('diff', '--cached', '--no-color', '-U2').catch(() => '');
+      // The audit log's appended lines are not "behavioral config" and would crowd the real diff out of the prompt.
+      const diff = await this.git('diff', '--cached', '--stat', ...NOT_AUDIT).catch(() => '');
+      const diffContent = await this.git('diff', '--cached', '--no-color', '-U2', ...NOT_AUDIT).catch(() => '');
       if (!diffContent.trim()) return fallback;
       const truncated = diffContent.slice(0, 3000);
       // Bounded: a hung `claude` subprocess used to wedge flush() forever (it holds the push latch).
@@ -761,7 +805,13 @@ export class DataSync {
     'uploads/', 'repos/', '.tmp/', 'schedules.json.bak', 'git-log.json',
     '.internal-token', 'comms-log.jsonl', 'sessions/', 'unread/', '.DS_Store',
     'scheduler/', '.mcp-catalog.json',
+    'api-keys.json.bak', // pre-hashing plaintext keys (api-keys.ts migration) — never commit
     'workspace/users/*/.claude/', // per-user Claude logins (claude-account.ts) — credentials, never commit
+    // Live security state of the ACTIVE instance, which is its single writer — a pull must never overwrite it:
+    // blocks.json (guard auto-blocks); policy.json + .migrated (the Owner Console writes them; a pulled change trips
+    // the policy provenance/tamper check). Blue-green shares one DATA_DIR on one host, so nothing needs to cross hosts.
+    'security/',
+    'quarantine/', // untrusted inbound content held for operator review — never synced
   ];
 
   /** Write or refresh .gitignore, appending any canonical entries it's missing (idempotent). */

package/src/server/directives.ts

@@ -18,10 +18,8 @@ export interface ParsedPrompt {
   unresolvedModel?: string;
 }
 
-/** Model used when neither directives nor config specify one. Always passed
- * explicitly to the SDK — the CLI's own default silently drifts (it picked
- * Opus 4.7), which burns rate limits and budget. */
-export const DEFAULT_MODEL = 'claude-sonnet-5';
+// The default model lives in src/shared/models.ts so the client header names the same one.
+export { DEFAULT_MODEL } from '../shared/models';
 
 // Canonical model aliases + label. Vendored, pure, dependency-free (src/server/model-aliases.ts).
 // Re-exported here so the rest of shraga keeps importing model helpers from one place.

package/src/server/engine/claude-code.ts

@@ -23,6 +23,8 @@ import { APP_ROOT } from '../paths.ts';
 import { writeMcpConfigFile } from './mcp-config-file.ts';
 import { claudeUsageFor } from '../claude-usage.ts';
 import { claudeAccountDir, applyClaudeAccount, claudeAccountRef, type ClaudeAccountRef } from '../claude-account.ts';
+import { buildAgentEnv, builtinTools, filterMcpServers, allowsEscalate, allowsInternalToken, SENSITIVE_PATH_PATTERNS } from '../security/enforce.ts';
+import { escalateMcpServer } from '../security/escalate.ts';
 const IMMUTABLE_SYSTEM_PROMPT = readFileSync(path.resolve(import.meta.dirname, '../../../defaults/system-prompt.md'), 'utf-8');
 const DEFAULT_USER_PROMPT = `You are a helpful assistant with access to MCP tools.`;
 const DEFAULT_ALLOWED_TOOLS = ['Read', 'Edit', 'Bash', 'WebSearch', 'Glob', 'LS', 'ToolSearch'];
@@ -32,10 +34,6 @@ const HISTORY_LIMIT = 50;
 
 const NO_INTERACTIVE_ANSWER = 'No interactive channel is available to answer right now. Use your best judgement to proceed, and surface these options to the user in your reply so they can redirect if needed.';
 
-const SENSITIVE_PATTERNS = [
-  /\.env($|\.)/i, /secrets?\//i, /credentials/i, /\.pem$/i, /\.key$/i,
-  /service.account.*\.json/i, /\/\.claude\/credentials/i,
-];
 const SENSITIVE_BASH_PATTERNS = [
   /\.env\b/i, /\bprintenv\b/i, /\b(env|set)\s*\|/i, /\bsecrets?\//i,
   /credentials/i, /service.account/i, /\.(pem|key)\b/i,
@@ -63,7 +61,7 @@ type DenyResult = { behavior: 'deny'; message: string };
 function checkSensitiveAccess(toolName: string, input: Record<string, unknown>): DenyResult | null {
   const filePath = (input.file_path ?? input.path ?? '') as string;
   if ((toolName === 'Read' || toolName === 'Edit' || toolName === 'Write') && filePath) {
-    if (SENSITIVE_PATTERNS.some(p => p.test(filePath))) {
+    if (SENSITIVE_PATH_PATTERNS.some(p => p.test(filePath))) {
       console.log(`[security] Blocked ${toolName} on sensitive file: ${filePath}`);
       return { behavior: 'deny', message: 'Access to sensitive files (.env, secrets, credentials) is blocked.' };
     }
@@ -229,6 +227,10 @@ async function* buildAttachmentPrompt(text: string, attachments: { path: string;
   yield { type: 'user', message: { role: 'user', content }, parent_tool_use_id: null, session_id: sessionId };
 }
 
+async function* buildTextPrompt(text: string, sessionId: string): AsyncIterable<any> {
+  yield { type: 'user', message: { role: 'user', content: text }, parent_tool_use_id: null, session_id: sessionId };
+}
+
 async function* buildLegacyImagePrompt(text: string, images: string[], sessionId: string): AsyncIterable<any> {
   const content: any[] = images.map((dataUrl) => {
     const match = dataUrl.match(/^data:([^;]+);base64,(.+)$/);
@@ -242,6 +244,7 @@ async function* buildLegacyImagePrompt(text: string, images: string[], sessionId
 
 export class ClaudeCodeEngine implements AgentEngine {
   readonly name = 'claude-code';
+  readonly enforcesProfile = true;
 
   getModels(): EngineModel[] {
     return [
@@ -329,8 +332,11 @@ export class ClaudeCodeEngine implements AgentEngine {
     const fullPrompt = plan.prompt;
     const permMode = opts.onPermissionRequest ? 'default' : (config.permissionMode ?? 'acceptEdits');
 
-    const sdkEnv: Record<string, string> = {};
-    for (const [k, v] of Object.entries(process.env)) {
+    // SECURITY_ENFORCE: the effective profile at spawn decides env/tools/MCPs; the per-call gate re-reads it (enforce.ts).
+    const guard = opts.security;
+    const eff = guard?.current();
+    const sdkEnv: Record<string, string> = eff ? buildAgentEnv(process.env, eff.profile) : {};
+    if (!eff) for (const [k, v] of Object.entries(process.env)) {
       if (v !== undefined) sdkEnv[k] = v;
     }
     // Injected for the agent's own tools/scripts. Each is written under both the canonical
@@ -366,12 +372,18 @@ export class ClaudeCodeEngine implements AgentEngine {
     let initModel: string | undefined;
     sdkEnv.INTERNAL_API_TOKEN = signInternalToken(opts.uid, opts.userEmail || 'unknown');
 
+    if (eff && !allowsInternalToken(eff.profile)) delete sdkEnv.INTERNAL_API_TOKEN;
+
     const baseAllowed = config.allowedTools ?? DEFAULT_ALLOWED_TOOLS;
-    const allowedTools = baseAllowed.includes('ToolSearch') ? baseAllowed : [...baseAllowed, 'ToolSearch'];
+    const withToolSearch = baseAllowed.includes('ToolSearch') ? baseAllowed : [...baseAllowed, 'ToolSearch'];
+    // Enforced: built-in tool AVAILABILITY is the profile's (tools outside it are not in the model's context), and
+    // auto-approval never widens it.
+    const available = eff ? builtinTools(eff.profile) : 'all';
+    const allowedTools = available === 'all' ? withToolSearch : withToolSearch.filter((t) => available.includes(t));
     const maxTurns = directives.turns ?? config.maxTurns ?? 50;
 
     const options: Record<string, unknown> = {
-      tools: { type: 'preset', preset: 'claude_code' },
+      tools: available === 'all' ? { type: 'preset', preset: 'claude_code' } : available,
       env: sdkEnv,
       allowedTools,
       cwd,
@@ -391,15 +403,24 @@ export class ClaudeCodeEngine implements AgentEngine {
       skills: listSkills(),
       disallowedTools: ['Skill'],
       agents: loadAgents(),
-      hooks: buildHooks({ exemptBashCommand: opts.foregroundBashCommand }),
+      // Enforced: the profile gate runs FIRST on every tool call — hooks fire even for auto-approved `allowedTools`,
+      // which never reach canUseTool.
+      hooks: ((h) => (guard ? { ...h, PreToolUse: [{ hooks: [guard.hook()] }, ...(h.PreToolUse ?? [])] } : h))(buildHooks({ exemptBashCommand: opts.foregroundBashCommand })),
     };
 
     const userHandler = opts.onPermissionRequest;
     const destructiveHandler = opts.onDestructiveApproval;
     const questionHandler = opts.onUserQuestion;
     options['canUseTool'] = async (toolName: string, input: Record<string, unknown>) => {
-      const denied = checkSensitiveAccess(toolName, input);
+      // Enforced: TurnGuard owns the file-path deny (tightened list); the legacy path list stays flag-OFF behavior only.
+      const denied = guard && toolName !== 'Bash' ? null : checkSensitiveAccess(toolName, input);
       if (denied) return denied;
+      // Enforced: the profile gate (re-reads the session floor) runs before ANY handler below, so an
+      // `onPermissionRequest: allow` call site can never override a profile deny.
+      if (guard) {
+        const gate = guard.check(toolName, input, cwd);
+        if (!gate.allow) return { behavior: 'deny' as const, message: gate.message };
+      }
       if (toolName === 'AskUserQuestion') {
         const questions = (input.questions ?? []) as AskQuestion[];
         const answers = questionHandler
@@ -479,12 +500,25 @@ export class ClaudeCodeEngine implements AgentEngine {
     // server's credentials) on the CLI's argv, where `ps` / `/proc` / journald expose it. See
     // writeMcpConfigFile. Setting both would re-add the argv copy, so it's one or the other.
     let mcpConfigFile: { path: string; cleanup: () => void } | undefined;
-    if (opts.mcpServers && Object.keys(opts.mcpServers).length > 0) {
-      mcpConfigFile = writeMcpConfigFile(opts.mcpServers);
+    // Enforced: servers outside profile.mcps never reach the file, so the CLI never starts them.
+    const mcpServers = eff ? filterMcpServers(opts.mcpServers, eff.profile) : opts.mcpServers;
+    if (mcpServers && Object.keys(mcpServers).length > 0) {
+      mcpConfigFile = writeMcpConfigFile(mcpServers);
       options['extraArgs'] = { ...(options['extraArgs'] as Record<string, string> | undefined), 'mcp-config': mcpConfigFile.path };
     }
+    // `escalate` is an in-process SDK server (no credentials): `options.mcpServers` hands the CLI only its name.
+    if (guard && eff && allowsEscalate(eff.profile)) {
+      const { principal } = guard.options;
+      const lastUser = opts.conversation.findLast((m) => m.role === 'user');
+      const excerpt = lastUser?.blocks.map((b) => (b.type === 'text' ? b.text : '')).filter(Boolean).join('\n') || opts.prompt;
+      const server = escalateMcpServer({
+        principal, role: () => guard.current().role, sessionId: opts.sessionId, excerpt,
+        channel: [principal.kind, principal.attrs.lane, opts.context?.source].filter(Boolean).join(':'),
+      });
+      options['mcpServers'] = { [server.name]: server };
+    }
 
-    const mcpNames = opts.mcpServers ? Object.keys(opts.mcpServers) : [];
+    const mcpNames = mcpServers ? Object.keys(mcpServers) : [];
     const activeModel = (options['model'] as string) || 'default';
     const directivesTag = Object.keys(directives).length ? ` directives=${JSON.stringify(directives)}` : '';
     console.log(`[claude] Starting query user=${opts.uid} session=${opts.sessionId ?? 'new'} model=${activeModel} perms=${config.permissionMode} mcps=[${mcpNames.join(',')}]${directivesTag} cwd=${cwd}`);
@@ -494,11 +528,22 @@ export class ClaudeCodeEngine implements AgentEngine {
     const sessionKey = opts.sessionId ?? crypto.randomUUID();
     const hasAttachments = opts.attachments && opts.attachments.length > 0;
     const hasLegacyImages = opts.images && opts.images.length > 0;
-    const prompt = hasAttachments
+    const source = hasAttachments
       ? buildAttachmentPrompt(fullPrompt, opts.attachments!, sessionKey)
       : hasLegacyImages
         ? buildLegacyImagePrompt(fullPrompt, opts.images!, sessionKey)
-        : fullPrompt;
+        : buildTextPrompt(fullPrompt, sessionKey);
+    // Streaming input, held open until the turn is over. A string prompt runs the CLI one-shot: it exits after
+    // the first result and kills `run_in_background` jobs ~5s later. Open, the job keeps running and its
+    // task_notification gets the model a follow-up turn, as interactive Claude Code does. The uuid is echoed on
+    // the result that answers THIS prompt (`user_message_uuids`), telling it apart from a resumed session's stale one.
+    const promptUuid = crypto.randomUUID();
+    let closeInput!: () => void;
+    const inputClosed = new Promise<void>((r) => { closeInput = r; });
+    const prompt = (async function* () {
+      for await (const msg of source) yield { ...msg, uuid: promptUuid };
+      await inputClosed;
+    })();
 
     const q = query({ prompt, options: options as any });
     // The CLI writes this prompt to the transcript before any output: from here a cancel can't un-deliver it.
@@ -516,6 +561,9 @@ export class ClaudeCodeEngine implements AgentEngine {
     const iter = q[Symbol.asyncIterator]();
     let pendingNext: Promise<IteratorResult<any>> | null = null;
     let waitingForBg = false;
+    // Has the result answering THIS prompt arrived? Later results are the model's follow-ups on bg-task completions.
+    let answered = false;
+    let turnBreak = false;
     let bgTimer: Promise<'__bgtimeout'> | null = null;
     let bgTimerHandle: ReturnType<typeof setTimeout> | null = null;
     let bgHeartbeat: ReturnType<typeof setInterval> | null = null;
@@ -592,7 +640,8 @@ export class ClaudeCodeEngine implements AgentEngine {
         if (m.type === 'system' && m.subtype === 'task_notification') {
           outstandingTasks.delete(m.task_id);
           console.log(`[claude] Background task ${m.status}: ${m.task_id} (${outstandingTasks.size} pending) (${elapsed()})`);
-          if (outstandingTasks.size === 0) { waitingForBg = false; clearBgTimer(); }
+          // Not the end of the turn: the CLI now runs a follow-up turn on the result, whose own result ends it
+          // (still bounded by the bg timer).
           continue;
         }
 
@@ -602,6 +651,15 @@ export class ClaudeCodeEngine implements AgentEngine {
         if (m.type === 'rate_limit_event') { claudeUsageFor(accountDir).observeRateLimit(m.rate_limit_info); continue; }
 
         if (m.type === 'result') {
+          // A resumed session first replays a pending task_notification as its own zero-turn result, before
+          // our prompt runs — ending on it drops the user's message. Skip any result that is not ours until
+          // ours arrives (older CLIs don't echo the uuid: then only a zero-turn result counts as stale).
+          const echoed = m.user_message_uuids ?? (m.user_message_uuid ? [m.user_message_uuid] : undefined);
+          if (!answered && !m.is_error && (echoed ? !echoed.includes(promptUuid) : !m.num_turns)) {
+            console.log(`[claude] Skipping result of an earlier turn: turns=${m.num_turns ?? 0} result_index=${m.result_index ?? '?'} (${elapsed()})`);
+            continue;
+          }
+          answered = true;
           lastSessionId = m.session_id || lastSessionId;
           const sdkTurns = m.num_turns ?? 0;
           const raw = m.subtype ?? 'unknown';
@@ -617,6 +675,7 @@ export class ClaudeCodeEngine implements AgentEngine {
               bgHeartbeat = setInterval(() => console.log(`[claude] Still holding for ${outstandingTasks.size} bg task(s): ${[...outstandingTasks].join(',')} (${elapsed()})`), BG_HEARTBEAT_MS);
               bgHeartbeat.unref?.();
             }
+            turnBreak = textDeltaCount > 0;
             continue;
           }
           // The SDK reports `subtype: 'success'` even when the API call failed (e.g. an org spend
@@ -657,6 +716,7 @@ export class ClaudeCodeEngine implements AgentEngine {
           if (event?.type === 'content_block_delta' && event.delta?.type === 'text_delta') {
             textDeltaCount++;
             sawOutput = true;
+            if (turnBreak) { turnBreak = false; yield { type: 'text_delta', text: '\n\n' }; }
             yield { type: 'text_delta', text: event.delta.text };
           }
           if (event?.type === 'content_block_start' && event.content_block?.type === 'tool_use') {
@@ -772,6 +832,7 @@ export class ClaudeCodeEngine implements AgentEngine {
       return;
     } finally {
       clearBgTimer();
+      closeInput();
       // The CLI has read the file by now (it loads MCP config at startup); holding it any longer just
       // widens the window in which the credentials sit on disk.
       mcpConfigFile?.cleanup();

package/src/server/engine/types.ts

@@ -3,6 +3,7 @@ import type { WsEvent, AttachmentMeta, PermissionHandler, QuestionHandler } from
 import type { ConvMessage } from '../sessions.ts';
 import type { Directives } from '../directives.ts';
 import type { AgentSettings } from '../shraga-config.ts';
+import type { TurnGuard } from '../security/enforce.ts';
 
 export interface EngineStreamOpts {
   /** The user's effective prompt (after directive stripping, slash command expansion, skill/workspace mentions) */
@@ -35,6 +36,9 @@ export interface EngineStreamOpts {
   /** True when the conversation was truncated (user replayed/edited a message) — engines with cached state should reset. */
   conversationReset?: boolean;
   context?: Record<string, string>;
+  /** SECURITY_ENFORCE only: the turn's security context. The engine derives tools/MCP/env from its effective
+   *  profile and gates every tool call through it. Absent (flag off) ⇒ today's behavior, untouched. */
+  security?: TurnGuard;
 
   directives: Directives;
   config: AgentSettings;
@@ -42,6 +46,9 @@ export interface EngineStreamOpts {
 
 export interface AgentEngine {
   readonly name: string;
+  /** True if the engine applies `EngineStreamOpts.security` (profile tools/MCP/env + per-call gate). Under
+   *  SECURITY_ENFORCE an engine without it may only run turns whose effective profile is unrestricted. */
+  readonly enforcesProfile?: boolean;
   stream(opts: EngineStreamOpts): AsyncGenerator<WsEvent>;
   /** Return model options for the UI picker (only called when engine is available) */
   getModels(): EngineModel[];

package/src/server/hooks.ts

@@ -7,6 +7,7 @@
  */
 import type { HookCallback, HookCallbackMatcher, HookEvent, PreToolUseHookInput } from '@anthropic-ai/claude-agent-sdk';
 import { rewriteSlackMentions } from './slack/mention-rewrite.ts';
+import { PROTECTED_DATA_MESSAGE, writesProtectedData } from './security/enforce.ts';
 
 /** Patterns that indicate a long-running script the model should background. */
 const LONG_RUNNING_PATTERNS = [
@@ -134,6 +135,23 @@ const guardFirebaseReads: HookCallback = async (input) => {
   };
 };
 
+/** Tamper protection: no agent file tool writes server-owned data (audit, conversations, sessions, security, keys,
+ *  MCP config) — any profile, SECURITY_ENFORCE on or off. A hook, not canUseTool: the SDK auto-approves allowed/
+ *  accept-edits tools without calling canUseTool. See security/enforce.ts PROTECTED_DATA_WRITE. */
+const denyProtectedDataWrites: HookCallback = async (input) => {
+  if (input.hook_event_name !== 'PreToolUse') return {};
+  const { tool_name, tool_input, cwd } = input as PreToolUseHookInput;
+  if (!writesProtectedData(tool_name, (tool_input ?? {}) as Record<string, unknown>, cwd || undefined)) return {};
+  console.log(`[hooks] Denied ${tool_name} on protected data path`);
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse' as const,
+      permissionDecision: 'deny' as const,
+      permissionDecisionReason: PROTECTED_DATA_MESSAGE,
+    },
+  };
+};
+
 /** Build the hooks map to pass into SDK query() options.
  *  `exemptBashCommand` is the one command the turn was explicitly told to run in the foreground
  *  (a `bash` schedule's command) — see forceBackgroundForScripts. */
@@ -143,6 +161,7 @@ export function buildHooks(opts?: { exemptBashCommand?: string }): Partial<Recor
       { matcher: 'Bash', hooks: [forceBackgroundForScripts(opts?.exemptBashCommand)] },
       { matcher: 'mcp__mcp-slack-use__post_slack_.*', hooks: [resolveSlackMentions] },
       { matcher: 'mcp__mcp-firebase-(?:prod|lab)__get_db.*', hooks: [guardFirebaseReads] },
+      { matcher: 'Write|Edit|MultiEdit|NotebookEdit', hooks: [denyProtectedDataWrites] },
     ],
   };
 }