shraga 0.1.113 → 0.1.114

package/src/server/security/enforce.ts

@@ -204,23 +204,58 @@ export const PROTECTED_DATA_WRITE: readonly string[] = [
   'oauth-clients.json', 'mcps/', '.internal-token', '.mcp-oauth-secret', '.local-auth-secret', 'users.json',
   // data-sync's own repo: .git/config (core.fsmonitor, hooks) runs code on its next git call; .gitignore untracks state.
   '.git/', '.gitignore',
+  // Untrusted inbound content held for operator review: the agent must not rewrite it (launder the evidence, or edit
+  // it into something an operator then approves). Reads are denied too — see PROTECTED_DATA_READ.
+  'quarantine/',
 ];
+/** DATA_DIR-relative paths agent file tools may not READ either (same syntax as PROTECTED_DATA_WRITE).
+ *  `quarantine/` holds attacker-controlled inbound text kept for operator review. Not writing it stops the agent
+ *  laundering the evidence; not READING it is the point of the quarantine — ingesting that text into a turn IS the
+ *  prompt-injection vector. What this buys, precisely:
+ *  - RESTRICTED profiles (tools without `*`): a guarantee. No Bash/Grep at all, and Read/Glob/Grep are path-checked
+ *    literally and by realpath, so quarantined text cannot enter the turn through an agent tool.
+ *  - FULL profiles (owner/operator): best-effort, exactly as for secret paths above. Bash is auto-approved before
+ *    canUseTool, so `cat <data>/quarantine/x.json` is not stopped by this (nor by any deny list here); the file-tool
+ *    deny stops accidental ingestion, not a determined turn. Plan step 8 is the OS-level fix.
+ *  - Server-side code is unaffected: the lane that writes quarantine and the owner route that reads it use fs/HTTP,
+ *    never agent tools. This gate only sees agent tool calls.
+ *  Enforcement-only: TurnGuard is the sole caller, so with SECURITY_ENFORCE unset nothing here changes. */
+export const PROTECTED_DATA_READ: readonly string[] = ['quarantine/'];
+export const PROTECTED_DATA_READ_MESSAGE = 'Quarantined inbound content is held for operator review and cannot be read by agent tools.';
 const WRITE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit']);
 export const PROTECTED_DATA_MESSAGE = 'Audit logs, conversations, sessions, security policy, keys and MCP config are server-owned and cannot be modified by agent tools.';
 
-/** Would this file tool write a protected data path? Target and data dir both matched in absolute and realpath form. */
-export function writesProtectedData(tool: string, input: Record<string, unknown>, cwd: string = process.cwd(), dataDir: string = DATA_DIR): boolean {
-  const target = WRITE_TOOLS.has(tool) ? str(input.file_path) ?? str(input.notebook_path) : undefined;
-  if (!target) return false;
+/** Do any of these path forms land on a DATA_DIR entry in `entries`? Absolute forms only (a relative literal would be
+ *  resolved against the process cwd by path.relative, which is not the form we mean); data dir matched in absolute and
+ *  realpath form. */
+function underDataEntry(forms: string[], entries: readonly string[], cwd: string, dataDir: string): boolean {
   const roots = [...new Set(pathForms(dataDir, cwd).slice(1))];
-  return pathForms(target, cwd).slice(1).some(f => roots.some(root => {
+  return forms.filter(f => path.isAbsolute(f)).some(f => roots.some(root => {
     const rel = path.relative(root, f);
     if (!rel || rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) return false;
     const r = rel.split(path.sep).join('/').toLowerCase(); // case-insensitive filesystems (macOS) alias Audit/ to audit/
-    return PROTECTED_DATA_WRITE.some(e => (e.endsWith('/') ? r === e.slice(0, -1) || r.startsWith(e) : r === e));
+    return entries.some(e => (e.endsWith('/') ? r === e.slice(0, -1) || r.startsWith(e) : r === e));
   }));
 }
 
+/** Would this file tool write a protected data path? Target and data dir both matched in absolute and realpath form. */
+export function writesProtectedData(tool: string, input: Record<string, unknown>, cwd: string = process.cwd(), dataDir: string = DATA_DIR): boolean {
+  const target = WRITE_TOOLS.has(tool) ? str(input.file_path) ?? str(input.notebook_path) : undefined;
+  if (!target) return false;
+  return underDataEntry(pathForms(target, cwd), PROTECTED_DATA_WRITE, cwd, dataDir);
+}
+
+/** Would this call READ or LIST a protected data path (PROTECTED_DATA_READ)? Same path forms as touchesSecretPath, so
+ *  Read/Edit targets, a Glob/Grep search root and a Glob pattern are all covered. Bash is not — best-effort, see above. */
+export function readsProtectedData(tool: string, input: Record<string, unknown>, cwd: string = process.cwd(), dataDir: string = DATA_DIR): boolean {
+  if (tool === 'Bash') return false;
+  const hit = (forms: string[]) => underDataEntry(forms, PROTECTED_DATA_READ, cwd, dataDir);
+  const root = str(input.path);
+  const pattern = tool === 'Glob' ? str(input.pattern) : tool === 'Grep' ? str(input.glob) : undefined;
+  if (pattern && hit(globForms(pattern, root, cwd))) return true;
+  return [str(input.file_path), str(input.notebook_path), root].some(p => p !== undefined && hit(pathForms(p, cwd)));
+}
+
 /** Restricted profiles: does this Glob search outside the workspace root (`cwd`)? Its base is realpath-checked; any
  *  `..` segment in the pattern counts as outside. */
 export function globOutsideWorkspace(input: Record<string, unknown>, cwd: string = process.cwd()): boolean {
@@ -274,6 +309,7 @@ export class TurnGuard {
     }
     const restricted = !eff.profile.tools.includes('*');
     const reason = writesProtectedData(tool, input, cwd) ? 'protected-path'
+      : readsProtectedData(tool, input, cwd) ? 'quarantined-path'
       : touchesSecretPath(tool, input, cwd, restricted) ? 'secret-path'
       : !profileAllowsTool(eff.profile, tool) ? 'profile'
         : restricted && tool === 'Glob' && globOutsideWorkspace(input, cwd) ? 'outside-workspace' : undefined;
@@ -287,6 +323,7 @@ export class TurnGuard {
     if (!reason) return { allow: true };
     log.log(`[security] Denied ${tool} for ${principal.id} (role=${eff.role} profile=${eff.profileName} ${reason}) session=${sessionId ?? 'new'}`);
     if (reason === 'protected-path') return { allow: false, message: PROTECTED_DATA_MESSAGE };
+    if (reason === 'quarantined-path') return { allow: false, message: PROTECTED_DATA_READ_MESSAGE };
     if (reason === 'secret-path') return { allow: false, message: 'Credential and secret files are not accessible.' };
     if (reason === 'outside-workspace') return { allow: false, message: `Glob is limited to the workspace for role "${eff.role}".` };
     const hint = allowsEscalate(eff.profile) ? ` Use the ${ESCALATE_TOOL} tool to hand this request to an owner.` : '';

package/src/server/security/guard.ts

@@ -160,6 +160,14 @@ export class Guard {
     return [...this.blocks.map].filter(([, b]) => b.until > now).map(([key, b]) => ({ key, ...b }));
   }
 
+  /** Clear an auto-block (Owner Console) and its hit window; persists. False when no such block exists. */
+  public unblock(key: string): boolean {
+    if (!this.blocks.map.delete(key)) return false;
+    this.hits.map.delete(key);
+    this.save();
+    return true;
+  }
+
   /** blocklist → auto-blocks → rate. Consumes one token from each applicable bucket only when all pass. */
   public check(input: GuardInput): GuardVerdict {
     const denial = this.evaluate(input);

package/src/server/security/owner-only.ts

@@ -1,6 +1,7 @@
 // Owner gate for admin actions. `isOwner` is set by requireAuth from the OWNERS env (owners.ts), so this
 // must run AFTER requireAuth. Real enforcement (not shadow): only for system-scope mutations.
 import type { Request, Response, RequestHandler } from 'express';
+import { security } from './runtime.ts';
 
 /** True if the caller is an owner; otherwise responds 403 with `message` and returns false. */
 export function ownerOnly(req: Request, res: Response, message = 'Only an owner can do this'): boolean {
@@ -9,7 +10,25 @@ export function ownerOnly(req: Request, res: Response, message = 'Only an owner
   return false;
 }
 
-/** Middleware form of ownerOnly. */
+/** 403 + `auth.deny` audit unless the caller's principal kind is one of `kinds`. */
+function kindGate(kinds: string[], error: string): RequestHandler {
+  return (req, res, next) => {
+    const kind = (req as any).user?.principal?.kind ?? 'unknown';
+    if (kinds.includes(kind)) return next();
+    console.warn(`[owner-only] ${req.method} ${req.path} refused: ${kind} credential`);
+    security()?.authDeny(`http:${req.path}`, `non-interactive:${kind}`, req.ip);
+    res.status(403).json({ error });
+  };
+}
+
+/** Middleware form of ownerOnly, for policy/config/skills/MCP routes. The agent subprocess carries an owner-signed
+ *  internal token (INTERNAL_API_TOKEN), so an internal principal is never owner HERE — otherwise a prompt-injected turn
+ *  could rewrite its own policy. Owner = interactive login or an uncapped owner API key (CLI terminal). Inline
+ *  `ownerOnly` callers (self-upgrade, schedules, modules) keep accepting the internal token. */
 export function requireOwner(message?: string): RequestHandler {
-  return (req, res, next) => { if (ownerOnly(req, res, message)) next(); };
+  const notInternal = kindGate(['user', 'apikey'], 'Owner access requires an interactive login or an owner API key — not the agent\'s internal token');
+  return (req, res, next) => { if (ownerOnly(req, res, message)) notInternal(req, res, next); };
 }
+
+/** Security-console writes: an interactive login only (no API key, no internal token) — same rule as minting a key. */
+export const requireInteractive = (): RequestHandler => kindGate(['user'], 'This change requires an interactive login');

package/src/server/security/owner-routes.ts

@@ -1,25 +1,155 @@
 // Owner-only admin API (`/api/owner/*`). Each route runs requireAuth + requireOwner itself — never router-wide, so
-// mounting this router can't gate unrelated requests. The Owner Console UI (step 7) is the consumer.
+// mounting this router can't gate unrelated requests. Consumer: the Owner Console (client/components/owner/).
+// Policy writes: validated by Policy's own validatePolicy, saved via policy.save() (provenance holds), audited as
+// `policy.change` with the changed paths only (never values). Every write on a PASSIVE standby → 409.
+import { createHash } from 'node:crypto';
 import { Router, type Request, type Response } from 'express';
 import { requireAuth, type AuthUser } from '../auth.ts';
 import { apiKeyRouter } from '../api-key-routes.ts';
-import { requireOwner } from './owner-only.ts';
+import { apiKeyPrincipal } from '../api-keys.ts';
+import { getOwners } from '../owners.ts';
+import { canonical, type AuditEventType } from './audit.ts';
+import { matches, validatePolicy, type BindingMatch, type PolicyFile } from './policy.ts';
+import { anonymous, fromAuthUser, fromEmailSender, fromInternal, fromSlack, type Principal } from './principal.ts';
+import { requireInteractive, requireOwner } from './owner-only.ts';
 import { revocablePrincipalId, revokeTokens } from './revocation.ts';
+import { resolvePrincipal, security, type SecurityRuntime } from './runtime.ts';
 
+/** Reads: owner via interactive login or uncapped owner API key (never the agent's internal token). */
 const gate = [requireAuth, requireOwner()];
+/** Writes: interactive login only. */
+const writeGate = [...gate, requireInteractive()];
 /** The raw INTERNAL_API_TOKEN's principal (auth.ts) — no issued-at, so tokensValidAfter can never reject it. */
 const LEGACY_INTERNAL_ID = 'internal:agent-internal';
 const userOf = (req: Request) => (req as any).user as AuthUser;
+/** OWNERS as the principals a block could hit: each owner's login and verified email channel. */
+const ownerPrincipals = () => getOwners().flatMap(e => [fromAuthUser({ uid: e, email: e }), fromEmailSender(e, true)]);
 
 const fail = (res: Response, e: any, status = 400) => {
   console.warn(`[owner-routes] ${e?.message ?? e}`);
   res.status(status).json({ error: e?.message ?? String(e) });
 };
 
+const isObj = (v: unknown): v is Record<string, any> => !!v && typeof v === 'object' && !Array.isArray(v);
+const str = (v: unknown) => (typeof v === 'string' && v.trim() ? v.trim() : undefined);
+
+/** Opaque version of a policy document. A PUT carrying a stale version is refused, so a Console tab opened earlier
+ *  can't silently undo a revoke/block made meanwhile. */
+export const policyVersion = (p: PolicyFile) => createHash('sha256').update(canonical(p)).digest('hex').slice(0, 16);
+
+/** Paths that differ, two levels deep (`profiles.standard`, `bindings.2`, `default`) — names only, never values. */
+export function policyDiff(a: object, b: object, max = 30): string[] {
+  const keys = (x: object, y: object) => [...new Set([...Object.keys(x), ...Object.keys(y)])];
+  const out: string[] = [];
+  for (const k of keys(a, b)) {
+    const x = (a as any)[k], y = (b as any)[k];
+    if (canonical(x) === canonical(y)) continue;
+    if (x && y && typeof x === 'object' && typeof y === 'object') {
+      for (const s of keys(x, y)) if (canonical(x[s]) !== canonical(y[s])) out.push(`${k}.${s}`);
+    } else out.push(k);
+  }
+  return out.length > max ? [...out.slice(0, max), `+${out.length - max} more`] : out;
+}
+
+/** The runtime, or an error response: 503 when uninitialized; 409 for a write on a PASSIVE standby. */
+function runtimeOr(res: Response, write = false): SecurityRuntime | undefined {
+  const sec = security();
+  if (!sec) return void res.status(503).json({ error: 'Security runtime not initialized' });
+  if (write) {
+    let active = false;
+    try { active = sec.options.isActive(); } catch (e: any) { console.warn(`[owner-routes] isActive threw — treating as PASSIVE: ${e?.message ?? e}`); }
+    if (!active) return void res.status(409).json({ error: 'Read-only on a PASSIVE standby — use the active instance' });
+  }
+  return sec;
+}
+
+/** Incremental edits (blocklist) start from the current document — refused in fail-closed mode, where saving would
+ *  replace the broken-but-fixable file with the owners-only fallback. A whole-document PUT is the fix path. */
+function requireValidPolicy(res: Response, sec: SecurityRuntime): boolean {
+  if (sec.policy.valid) return true;
+  res.status(409).json({ error: 'Policy is invalid (fail-closed) — fix it with a full policy save first' });
+  return false;
+}
+
+/** validatePolicy → policy.save() → `policy.change` audit. Responds with the error itself; true on success. */
+function commit(req: Request, res: Response, sec: SecurityRuntime, next: PolicyFile, op: string): boolean {
+  const errors = validatePolicy(next);
+  if (errors.length) {
+    console.warn(`[owner-routes] ${op} refused: ${errors.join('; ')}`);
+    res.status(400).json({ error: `Invalid policy: ${errors.join('; ')}`, errors });
+    return false;
+  }
+  const prev = sec.policy.current;
+  try { sec.policy.save(next); } catch (e: any) { fail(res, e, 500); return false; }
+  sec.record({ type: 'policy.change', principal: userOf(req).principal.id, target: op, meta: { changed: policyDiff(prev, sec.policy.current) } });
+  return true;
+}
+
+const KINDS = ['user', 'email', 'slack', 'apikey', 'internal', 'anonymous'];
+
+/** A principal built by the SAME builders the channels use, from `{ kind, id?, email?, verified?, lane?, role?, attrs? }`.
+ *  `role` (apikey only) = the key's role cap; for an apikey, `email` is the creator. */
+export function principalFromDescriptor(d: any): Principal {
+  const kind = d?.kind, email = str(d?.email), id = str(d?.id);
+  const attrs: Record<string, unknown> = isObj(d?.attrs) ? { ...d.attrs } : {};
+  const lane = str(d?.lane) ?? str(attrs.lane), who = id ?? email;
+  if (!KINDS.includes(kind)) throw new Error(`kind must be one of ${KINDS.join(', ')}`);
+  if (kind !== 'anonymous' && !who) throw new Error('id or email is required');
+  let p: Principal;
+  switch (kind) {
+    case 'user': p = fromAuthUser({ uid: who!, email }); break;
+    case 'email': p = fromEmailSender(who!, d?.verified === true); break;
+    case 'slack': p = fromSlack(who!, { email }); break;
+    case 'apikey': p = apiKeyPrincipal({ id: id ?? 'console-test', uid: str(attrs.uid) ?? who!, email: email ?? '', role: str(d?.role) ?? str(attrs.role) }); break;
+    case 'internal': p = fromInternal({ uid: who!, email, lane }); break;
+    default: p = anonymous();
+  }
+  if (typeof d?.verified === 'boolean') p.verified = d.verified;
+  Object.assign(p.attrs, attrs, lane ? { lane } : {});
+  return p;
+}
+
+const DENY_TYPES = new Set<string>(['auth.deny', 'tool.deny', 'guard.block', 'guard.limit']);
+/** Events whose `role` is the ACTING principal's role. Others carry a different subject's role (key.create: the key's cap). */
+const OWN_ROLE_TYPES = new Set<string>(['role.resolve', 'turn.start', 'turn.end', 'tool.allow', 'tool.deny', 'escalate']);
+const PRINCIPAL_SCAN_CAP = 50_000;
+export interface PrincipalRow { id: string; kind: string; lastRole?: string; lastSeen: string; turns: number; denies: number }
+
+/** Principals in the audit since `sinceMs`, most recently seen first. Denies include shadow (would-deny) verdicts. */
+export function recentPrincipals(sec: SecurityRuntime, sinceMs: number, limit: number): { principals: PrincipalRow[]; truncated: boolean } {
+  const rows = new Map<string, PrincipalRow>();
+  let cursor: string | undefined, scanned = 0;
+  do {
+    const page = sec.audit.query({ from: sinceMs, limit: 1000, cursor });
+    for (const r of page.items) {
+      scanned++;
+      if (!r.principal) continue;
+      let row = rows.get(r.principal);
+      if (!row) rows.set(r.principal, row = { id: r.principal, kind: r.principal.split(':')[0], lastSeen: r.ts, turns: 0, denies: 0 });
+      if (!row.lastRole && r.role && OWN_ROLE_TYPES.has(r.type)) row.lastRole = r.role;
+      if (r.type === 'turn.start') row.turns++;
+      else if (DENY_TYPES.has(r.type)) row.denies++;
+    }
+    cursor = page.nextCursor;
+  } while (cursor && scanned < PRINCIPAL_SCAN_CAP);
+  return { principals: [...rows.values()].slice(0, limit), truncated: !!cursor };
+}
+
+const clampInt = (v: unknown, def: number, min: number, max: number) => Math.max(min, Math.min(max, Math.floor(Number(v)) || def));
+const when = (v: unknown): Date | undefined => {
+  const s = str(v);
+  if (!s) return undefined;
+  const d = new Date(/^\d+$/.test(s) ? Number(s) : s);
+  if (Number.isNaN(d.getTime())) throw new Error(`invalid date "${s}"`);
+  return d;
+};
+
 export const ownerRouter = Router();
 
+// ── Tokens + API keys ─────────────────────────────────────────────────────────
+
 /** Invalidate every token issued to a principal until now. Body: { principalId: "user:<email|uid>" | "internal:<uid>" }. */
-ownerRouter.post('/api/owner/tokens/revoke', ...gate, (req, res) => {
+ownerRouter.post('/api/owner/tokens/revoke', ...writeGate, (req, res) => {
   const { principalId } = (req.body ?? {}) as { principalId?: unknown };
   const id = typeof principalId === 'string' ? revocablePrincipalId(principalId) : null;
   if (!id) {
@@ -40,4 +170,116 @@ ownerRouter.post('/api/owner/tokens/revoke', ...gate, (req, res) => {
   } catch (e: any) { fail(res, e, 409); }
 });
 
-ownerRouter.use(apiKeyRouter({ base: '/api/owner/api-keys', gate, asOwner: true }));
+ownerRouter.use(apiKeyRouter({ base: '/api/owner/api-keys', gate, writeGate: [requireInteractive()], asOwner: true }));
+
+// ── Policy ────────────────────────────────────────────────────────────────────
+
+ownerRouter.get('/api/owner/policy', ...gate, (_req, res) => {
+  const sec = runtimeOr(res);
+  if (!sec) return;
+  const policy = sec.policy.current;
+  // ownerIds: a UI hint (hide Block on owner rows); the block route enforces it.
+  res.json({ policy, version: policyVersion(policy), valid: sec.policy.valid, ownerIds: ownerPrincipals().map(p => p.id) });
+});
+
+/** Body: { policy, version } — the whole document; `version` (from GET, required) guards against overwriting a newer
+ *  save. `tokensValidAfter` and `blocklist` always come from the CURRENT policy — they change only via their own routes,
+ *  so a PUT can't un-revoke or un-block. */
+ownerRouter.put('/api/owner/policy', ...writeGate, (req, res) => {
+  const sec = runtimeOr(res, true);
+  if (!sec) return;
+  const { policy, version } = (req.body ?? {}) as { policy?: unknown; version?: unknown };
+  if (!isObj(policy)) return void res.status(400).json({ error: 'Body must be { policy, version }' });
+  const current = sec.policy.current;
+  if (version !== policyVersion(current)) {
+    return void res.status(409).json({ error: version === undefined ? 'version is required — GET the policy first' : 'The policy changed since you loaded it — reload and re-apply your edit' });
+  }
+  const next = { ...policy, tokensValidAfter: current.tokensValidAfter, blocklist: current.blocklist } as PolicyFile;
+  if (commit(req, res, sec, next, 'policy')) res.json({ ok: true, version: policyVersion(sec.policy.current), valid: sec.policy.valid });
+});
+
+/** Resolve a descriptor exactly as a turn would (resolvePrincipal — decide()'s path), without auditing `role.resolve`. */
+ownerRouter.post('/api/owner/policy/test', ...gate, (req, res) => {
+  const sec = runtimeOr(res);
+  if (!sec) return;
+  let p: Principal;
+  try { p = principalFromDescriptor(req.body); } catch (e: any) { return fail(res, e); }
+  const r = resolvePrincipal(sec.policy, p);
+  res.json({ principal: p.id, role: r.role, rank: r.rank, profile: r.profileName, capabilities: r.profile, blocked: sec.policy.blocked(p) ?? null });
+});
+
+// ── Principals ────────────────────────────────────────────────────────────────
+
+/** Query: days (1–90, default 7), limit (1–500, default 200). */
+ownerRouter.get('/api/owner/principals', ...gate, (req, res) => {
+  const sec = runtimeOr(res);
+  if (!sec) return;
+  const days = clampInt(req.query.days, 7, 1, 90), limit = clampInt(req.query.limit, 200, 1, 500);
+  try { res.json({ days, ...recentPrincipals(sec, Date.now() - days * 86_400_000, limit) }); } catch (e: any) { fail(res, e, 500); }
+});
+
+// ── Blocklist ─────────────────────────────────────────────────────────────────
+
+/** Manual entries (policy blocklist, `until` epoch SECONDS) + guard auto-blocks (`until` epoch MS). */
+ownerRouter.get('/api/owner/blocks', ...gate, (_req, res) => {
+  const sec = runtimeOr(res);
+  if (!sec) return;
+  res.json({ manual: sec.policy.current.blocklist.map((b, index) => ({ index, ...b })), auto: sec.guard.list() });
+});
+
+/** Body: { match, until?: epoch seconds | null, reason? } — a manual block. */
+ownerRouter.post('/api/owner/blocks', ...writeGate, (req, res) => {
+  const sec = runtimeOr(res, true);
+  if (!sec || !requireValidPolicy(res, sec)) return;
+  const { match, until = null, reason } = (req.body ?? {}) as { match?: unknown; until?: unknown; reason?: unknown };
+  const owner = isObj(match) && ownerPrincipals().find(p => matches(match as BindingMatch, p));
+  if (owner) return void res.status(400).json({ error: `This block would match the owner ${owner.email ?? owner.id} — owners can't be blocked (change OWNERS instead)` });
+  if (until !== null && (typeof until !== 'number' || until >= 1e11)) return void res.status(400).json({ error: 'until must be epoch SECONDS or null' });
+  if (typeof until === 'number' && until <= Date.now() / 1000) return void res.status(400).json({ error: 'until is in the past' });
+  const next = sec.policy.current;
+  next.blocklist = [...next.blocklist, { match: match as BindingMatch, until, ...(str(reason) ? { reason: str(reason) } : {}) }];
+  if (commit(req, res, sec, next, 'blocklist.add')) res.json({ ok: true, index: next.blocklist.length - 1 });
+});
+
+/** Body: { source: "manual", index, match } (match must still equal the entry at index) | { source: "auto", key }. */
+ownerRouter.delete('/api/owner/blocks', ...writeGate, (req, res) => {
+  const sec = runtimeOr(res, true);
+  if (!sec) return;
+  const b = (req.body ?? {}) as { source?: unknown; index?: unknown; match?: unknown; key?: unknown };
+  if (b.source === 'auto') {
+    if (typeof b.key !== 'string' || !sec.guard.unblock(b.key)) return void res.status(404).json({ error: 'No such auto-block' });
+    sec.record({ type: 'policy.change', principal: userOf(req).principal.id, target: `auto-block:${b.key}`, meta: { op: 'auto-block.clear' } });
+    return void res.json({ ok: true });
+  }
+  if (b.source !== 'manual') return void res.status(400).json({ error: 'source must be "manual" or "auto"' });
+  if (!requireValidPolicy(res, sec)) return;
+  const next = sec.policy.current;
+  const entry = typeof b.index === 'number' && Number.isInteger(b.index) ? next.blocklist[b.index] : undefined;
+  if (!entry) return void res.status(404).json({ error: 'No such manual block' });
+  if (canonical(entry.match) !== canonical(b.match)) return void res.status(409).json({ error: 'The blocklist changed since you loaded it — reload' });
+  next.blocklist = next.blocklist.filter((_, i) => i !== b.index);
+  if (commit(req, res, sec, next, 'blocklist.remove')) res.json({ ok: true });
+});
+
+// The console deliberately exposes no conversation-delete route: the audit log is append-only, and removing a
+// conversation is a manual, on-box operation. The `session.delete` audit type stays for those out-of-band removals.
+
+// ── Audit ─────────────────────────────────────────────────────────────────────
+
+/** Query: from, to (ISO or epoch ms), type (comma list), principal, limit (1–500, default 100), cursor. Newest first. */
+ownerRouter.get('/api/owner/audit', ...gate, (req, res) => {
+  const sec = runtimeOr(res);
+  if (!sec) return;
+  try {
+    const type = str(req.query.type)?.split(',').map(s => s.trim()).filter(Boolean) as AuditEventType[] | undefined;
+    res.json(sec.audit.query({
+      from: when(req.query.from), to: when(req.query.to), type, principal: str(req.query.principal),
+      limit: clampInt(req.query.limit, 100, 1, 500), cursor: str(req.query.cursor),
+    }));
+  } catch (e: any) { fail(res, e, /cursor|date/.test(e?.message ?? '') ? 400 : 500); }
+});
+
+ownerRouter.get('/api/owner/audit/verify', ...gate, (_req, res) => {
+  const sec = runtimeOr(res);
+  if (sec) res.json(sec.audit.verify());
+});

package/src/server/security/policy.ts

@@ -39,6 +39,9 @@ export type TamperReason = 'hash-mismatch' | 'deleted';
 export const OWNER_ROLE = 'owner';
 /** Role of no-human system lanes (see resolve). */
 export const OPERATOR_ROLE = 'operator';
+/** Trust watermark: at or above this rank a principal is a known human of the deployment. Below it
+ *  (guest, anonymous) the sender is untrusted — see `mayReplyTo` (runtime.ts). */
+export const MEMBER_ROLE = 'member';
 const NONE_PROFILE: Profile = { tools: [], mcps: [], env: [], outbound: false, readScope: 'none', rate: '0' };
 const FULL_PROFILE: Profile = { tools: ['*'], mcps: ['*'], env: ['*'], outbound: true, readScope: 'all', rate: '600/h' };
 
@@ -124,7 +127,7 @@ export function validatePolicy(p: any): string[] {
   return errs;
 }
 
-function matches(m: BindingMatch, p: Principal): boolean {
+export function matches(m: BindingMatch, p: Principal): boolean {
   if (m.kind !== undefined && m.kind !== p.kind) return false;
   if (m.id !== undefined && m.id !== p.id) return false;
   if (m.verified !== undefined && m.verified !== p.verified) return false;

package/src/server/security/runtime.ts

@@ -7,7 +7,8 @@
 // Writes are gated on `isActive` (a PASSIVE standby shares DATA_DIR and must not append to data/audit, nor let the
 // Policy migrate/save/mark or judge tamper; `activate()` re-loads the policy on promotion), and noisy events are
 // deduped per key per window, so a busy client isn't one line per request.
-import { OWNER_ROLE, Policy, type PolicyOptions, type Resolved, type TamperReason } from './policy.ts';
+import { MEMBER_ROLE, OWNER_ROLE, Policy, type PolicyOptions, type Resolved, type TamperReason } from './policy.ts';
+import { getAgentConfig } from '../agent-config.ts';
 import { Audit, type AuditEvent, type AuditOptions } from './audit.ts';
 import { Guard, type GuardOptions, type TurnAdmission } from './guard.ts';
 import { fromAuthUser, type Principal } from './principal.ts';
@@ -165,6 +166,57 @@ export function admitTurn(principal: Principal, ctx?: { ip?: string; channel?: s
   catch (e: any) { console.error(`[security] admitTurn threw — admitting: ${e?.message ?? e}`); return { ok: true, release: () => {} }; }
 }
 
+/**
+ * May the agent send an AUTOMATIC outbound reply to this inbound principal? For channels and add-ons
+ * (mail, chat) to call before handing the model's text back to the sender.
+ *
+ * `false` when `allowUntrustedReplies` is off (the default) and the principal is either UNVERIFIED or
+ * resolves BELOW `member` rank — guest, anonymous, a spoofable sender. Suppressing the reply does not drop
+ * the turn: it still runs, and `escalate` still reaches owners. A verified member/operator/owner is always
+ * replyable, and this never gates a human operator's own turns.
+ *
+ * WHY `verified` and not rank alone: a binding on `domain`/`emailIn` matches the CLAIMED `From:`, which
+ * nothing has authenticated, so `{ match: { domain: 'x' }, role: 'member' }` would otherwise let a spoofer
+ * promote himself to member rank and earn an automatic reply. Kinds whose identity is proven by construction
+ * set `verified: true` in their builder — `fromAuthUser` (user), `fromApiKey` (apikey), `fromInternal`
+ * (internal, incl. the no-human lanes) and `fromSlack` (slack) — so requiring `verified` never silences a
+ * logged-in user, an API key, an internal lane or a signature-verified Slack sender. Only `fromEmailSender`
+ * with an unaligned DKIM/DMARC result, and `anonymous()`, carry `verified: false`.
+ *
+ * Independent of `SECURITY_ENFORCE` — it gates outbound replies, not tools, so it applies in shadow mode too.
+ *
+ * FAILS CLOSED: no runtime, an invalid/fail-closed policy (no `member` role), or a throw ⇒ `false`.
+ *
+ * AUDIT DEDUPE — pass `turnId`: a value that changes per inbound MESSAGE (a Gmail `messageId`, a webhook
+ * delivery id…). Like `turn.start`, the row is once per turn because the discriminator is a per-turn
+ * IDENTITY, not a time window, so a sustained campaign down one thread produces one row per message while a
+ * turn retried internally still collapses to one. `sessionId` is a poor key on its own — a Gmail `sessionId`
+ * is per-THREAD and permanent, so every later suppression in that thread fell inside the dedupe window and
+ * vanished. Omitting `turnId` keeps the old (per-session) behavior for callers that have no per-message id.
+ */
+export function mayReplyTo(principal: Principal, ctx: { sessionId?: string; turnId?: string; channel?: string } = {}): boolean {
+  try {
+    if (getAgentConfig().allowUntrustedReplies === true) return true;
+    const rt = current;
+    if (!rt || !rt.policy.valid) return false;
+    // A fail-closed policy keeps only owner+anonymous, and resolving an unknown role falls back to the
+    // DEFAULT role — whose rank would wrongly admit a guest. So require a real `member` role.
+    const member = rt.policy.effective(Infinity, MEMBER_ROLE);
+    if (member.role !== MEMBER_ROLE) return false;
+    const r = resolvePrincipal(rt.policy, principal);
+    if (principal.verified && r.rank >= member.rank) return true;
+    rt.record({
+      type: 'guard.limit', principal: principal.id, role: r.role, sessionId: ctx.sessionId,
+      target: ctx.channel ?? 'reply', reason: 'untrusted-reply',
+      meta: { kind: principal.kind, verified: principal.verified, rank: r.rank, memberRank: member.rank },
+    }, `reply.suppressed|${ctx.turnId ?? ctx.sessionId ?? principal.id}`);
+    return false;
+  } catch (e: any) {
+    console.error(`[security] mayReplyTo threw — suppressing the reply: ${e?.message ?? e}`);
+    return false;
+  }
+}
+
 /** Client IP of a request/upgrade, honoring TRUSTED_PROXIES. */
 export function requestIp(req: Parameters<Guard['ipOf']>[0]): string | undefined {
   return current?.guard.ipOf(req);

package/src/server/sessions.ts

@@ -576,6 +576,9 @@ export function getSessionAbortController(sessionId: string): AbortController |
   return globalSessionLocks.get(sessionId)?.abortController;
 }
 
+// Deleting a conversation is deliberately not exposed by the app (no route, no helper): the audit log is
+// append-only and an owner who really means to remove one does it by hand on the box.
+
 function findSessionFile(sessionId: string): string | null {
   return findClaudeTranscript(sessionId, path.join(homedir(), '.claude'));
 }

package/src/server/shraga-config.ts

@@ -55,6 +55,19 @@ export interface AgentSettings {
   /** claude-code engine: resume the SDK session across turns instead of re-sending the history
    *  (prompt-cache savings). Default off; a session's `[resume:on|off]` directive wins. */
   sdkResume?: boolean;
+  /**
+   * Allow an AUTOMATIC outbound reply to a low-trust inbound principal — one whose resolved role ranks
+   * below `member` (guest, anonymous, an unverified sender). Default OFF.
+   *
+   * Off does NOT drop the message: the turn still runs and `escalate` still reaches owners. Only the
+   * automatic reply back to that sender is suppressed, because a turn's prompt carries roster/skill/
+   * workspace context and a channel that mails the model's text back to an unverified sender is a
+   * disclosure path. A human operator's own turns are never gated by this.
+   *
+   * Orthogonal to `SECURITY_ENFORCE`: this gates OUTBOUND REPLIES, not tools, so it applies whether or
+   * not enforcement is on (shadow mode included). Channels/add-ons ask `mayReplyTo(principal)`.
+   */
+  allowUntrustedReplies?: boolean;
 }
 
 export interface ShragaConfig {