shraga 0.1.113 → 0.1.115

package/src/client/components/owner/PrincipalsTab.tsx

@@ -0,0 +1,55 @@
+import { useCallback, useEffect, useState } from 'react';
+import { Ban, KeyRound, RefreshCw } from 'lucide-react';
+import { ErrorBox, fmtTs, iconBtn, principalActions, selectCls, tdCls, thCls, useAction, type OwnerCall } from './shared';
+
+interface Row { id: string; kind: string; lastRole?: string; lastSeen: string; turns: number; denies: number }
+
+export function PrincipalsTab({ call, onPolicyChange, ownerIds }: { call: OwnerCall; onPolicyChange: () => Promise<void>; ownerIds: string[] }) {
+  const [days, setDays] = useState(7);
+  const [data, setData] = useState<{ principals: Row[]; truncated: boolean } | null>(null);
+  const { busy, error, run } = useAction();
+  const actions = principalActions(call, onPolicyChange, ownerIds);
+  const load = useCallback(() => run('load', async () => setData(await call(`/principals?days=${days}`))), [call, days]); // eslint-disable-line react-hooks/exhaustive-deps
+  useEffect(() => { load(); }, [load]);
+
+  return (
+    <div className="space-y-2">
+      <div className="flex items-center gap-2">
+        <span className="text-xs text-muted-foreground">Seen in the audit, last</span>
+        <select className={selectCls} value={days} onChange={(e) => setDays(Number(e.target.value))}>
+          {[1, 7, 30, 90].map((d) => <option key={d} value={d}>{d} day{d > 1 ? 's' : ''}</option>)}
+        </select>
+        <button className={iconBtn} title="Refresh" onClick={load}><RefreshCw className={`w-3.5 h-3.5 ${busy === 'load' ? 'animate-spin' : ''}`} /></button>
+        {data?.truncated && <span className="text-[10px] text-amber-500">scan capped — older activity omitted</span>}
+      </div>
+      <ErrorBox error={error} />
+      <div className="border rounded-lg overflow-x-auto">
+        <table className="w-full text-xs">
+          <thead className="bg-muted/40"><tr>
+            <th className={thCls}>Principal</th><th className={thCls}>Kind</th><th className={thCls}>Last role</th>
+            <th className={thCls}>Last seen</th><th className={thCls}>Turns</th><th className={thCls} title="Includes shadow (would-deny) verdicts">Denies</th><th className={thCls} />
+          </tr></thead>
+          <tbody className="divide-y">
+            {data?.principals.map((p) => (
+              <tr key={p.id}>
+                <td className={`${tdCls} font-mono break-all`}>{p.id}</td>
+                <td className={tdCls}>{p.kind}</td>
+                <td className={tdCls}>{p.lastRole ?? '—'}</td>
+                <td className={`${tdCls} whitespace-nowrap`}>{fmtTs(p.lastSeen)}</td>
+                <td className={tdCls}>{p.turns}</td>
+                <td className={`${tdCls} ${p.denies ? 'text-destructive' : ''}`}>{p.denies}</td>
+                <td className={`${tdCls} whitespace-nowrap text-right`}>
+                  {actions.canRevoke(p.id) && (
+                    <button className={`${iconBtn} mr-2`} title="Revoke tokens" disabled={!!busy} onClick={() => run(`rv-${p.id}`, () => actions.revoke(p.id))}><KeyRound className="w-3.5 h-3.5" /></button>
+                  )}
+                  {actions.canBlock(p.id) &&<button className={`${iconBtn} hover:text-destructive`} title="Block" disabled={!!busy} onClick={() => run(`bl-${p.id}`, () => actions.block(p.id))}><Ban className="w-3.5 h-3.5" /></button>}
+                </td>
+              </tr>
+            ))}
+            {data && !data.principals.length && <tr><td colSpan={7} className="text-center text-muted-foreground py-6">No principals in this window.</td></tr>}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  );
+}

package/src/client/components/owner/RolesTab.tsx

@@ -0,0 +1,132 @@
+import { useEffect, useState } from 'react';
+import { Check, Loader2, Plus, Trash2, Undo2 } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { CsvInput, ErrorBox, iconBtn, inputCls, selectCls, useAction, type Policy, type PolicyDoc, type Profile, type SavePolicy } from './shared';
+
+/** The part of the policy a PUT writes (blocklist/tokensValidAfter have their own routes; the server keeps them). */
+const editable = (p: Policy) => { const { blocklist: _b, tokensValidAfter: _t, ...rest } = p; return JSON.stringify(rest); };
+
+/** A whole-document policy draft: edit locally, Save = PUT with the version the draft started from (server validates;
+ *  errors stay on screen). A refresh never wipes edits: a clean draft follows it; a dirty one adopts the new version only
+ *  when the editable part is unchanged (a block/revoke meanwhile) — otherwise Save still 409s instead of overwriting. */
+export function usePolicyDraft(doc: PolicyDoc, save: SavePolicy, onDirty?: (dirty: boolean) => void) {
+  const [base, setBase] = useState(doc);
+  const [draft, setDraft] = useState<Policy>(() => structuredClone(doc.policy));
+  const dirty = editable(draft) !== editable(base.policy);
+  useEffect(() => {
+    if (!dirty || editable(doc.policy) === editable(draft)) { setBase(doc); setDraft(structuredClone(doc.policy)); }
+    else if (editable(doc.policy) === editable(base.policy)) setBase(doc);
+  }, [doc]); // eslint-disable-line react-hooks/exhaustive-deps
+  useEffect(() => { onDirty?.(dirty); }, [dirty, onDirty]);
+  useEffect(() => () => onDirty?.(false), [onDirty]);
+  const action = useAction();
+  const saveBar = (
+    <div className="flex items-center gap-2 sticky -bottom-3 z-10 -mx-3 -mb-3 px-3 pt-2 pb-3 bg-background border-t">
+      <Button size="sm" className="h-7 text-xs" disabled={!dirty || !!action.busy} onClick={() => action.run('save', () => save(draft, base.version))}>
+        {action.busy ? <Loader2 className="w-3 h-3 mr-1 animate-spin" /> : <Check className="w-3 h-3 mr-1" />} Save policy
+      </Button>
+      <Button size="sm" variant="ghost" className="h-7 text-xs" disabled={!dirty} onClick={() => { setBase(doc); setDraft(structuredClone(doc.policy)); }}>
+        <Undo2 className="w-3 h-3 mr-1" /> Discard
+      </Button>
+      {dirty && <span className="text-[10px] text-amber-500">unsaved changes</span>}
+    </div>
+  );
+  return { draft, setDraft, error: action.error, saveBar };
+}
+
+export function RolesTab({ doc, save, onDirty }: { doc: PolicyDoc; save: SavePolicy; onDirty: (dirty: boolean) => void }) {
+  const { draft, setDraft, error, saveBar } = usePolicyDraft(doc, save, onDirty);
+  const [newRole, setNewRole] = useState('');
+  const [newProfile, setNewProfile] = useState('');
+  const profileNames = Object.keys(draft.profiles);
+
+  const setRole = (name: string, patch: Partial<Policy['roles'][string]>) =>
+    setDraft((d) => ({ ...d, roles: { ...d.roles, [name]: { ...d.roles[name], ...patch } } }));
+  const setProfile = (name: string, patch: Partial<Profile>) =>
+    setDraft((d) => ({ ...d, profiles: { ...d.profiles, [name]: { ...d.profiles[name], ...patch } } }));
+  const without = <T,>(o: Record<string, T>, k: string) => Object.fromEntries(Object.entries(o).filter(([n]) => n !== k));
+
+  return (
+    <div className="space-y-4">
+      <ErrorBox error={error} />
+      <section className="space-y-2">
+        <h3 className="text-xs font-medium text-muted-foreground uppercase tracking-wide">Roles</h3>
+        <p className="text-[11px] text-muted-foreground">Owners come only from the OWNERS env; this row only picks their rank and profile.</p>
+        <div className="border rounded-lg divide-y">
+          {Object.entries(draft.roles).sort((a, b) => b[1].rank - a[1].rank).map(([name, r]) => (
+            <div key={name} className="flex items-center gap-2 p-2">
+              <span className="text-sm font-medium w-28 truncate">{name}</span>
+              <label className="text-[10px] text-muted-foreground">rank</label>
+              <Input type="number" className={`${inputCls} w-20`} value={Number.isFinite(r.rank) ? r.rank : ''} onChange={(e) => setRole(name, { rank: e.target.value === '' ? NaN : Number(e.target.value) })} />
+              <label className="text-[10px] text-muted-foreground">profile</label>
+              <select className={selectCls} value={r.profile} onChange={(e) => setRole(name, { profile: e.target.value })}>
+                {!profileNames.includes(r.profile) && <option value={r.profile}>{r.profile} (missing)</option>}
+                {profileNames.map((p) => <option key={p} value={p}>{p}</option>)}
+              </select>
+              <div className="flex-1" />
+              {name !== 'owner' && (
+                <button className={`${iconBtn} hover:text-destructive`} title="Remove role" onClick={() => setDraft((d) => ({ ...d, roles: without(d.roles, name) }))}>
+                  <Trash2 className="w-3.5 h-3.5" />
+                </button>
+              )}
+            </div>
+          ))}
+        </div>
+        <div className="flex items-center gap-2">
+          <Input className={`${inputCls} w-40`} placeholder="new role name" value={newRole} onChange={(e) => setNewRole(e.target.value.trim())} />
+          <Button size="sm" variant="outline" className="h-7 text-xs" disabled={!newRole || newRole in draft.roles}
+            onClick={() => { setDraft((d) => ({ ...d, roles: { ...d.roles, [newRole]: { rank: 10, profile: profileNames.includes('none') ? 'none' : profileNames[0] } } })); setNewRole(''); }}>
+            <Plus className="w-3 h-3 mr-1" /> Add role
+          </Button>
+          <div className="flex-1" />
+          <label className="text-[10px] text-muted-foreground">default role</label>
+          <select className={selectCls} value={draft.default} onChange={(e) => setDraft((d) => ({ ...d, default: e.target.value }))}>
+            {Object.keys(draft.roles).filter((n) => n !== 'owner').map((n) => <option key={n} value={n}>{n}</option>)}
+          </select>
+        </div>
+      </section>
+
+      <section className="space-y-2">
+        <h3 className="text-xs font-medium text-muted-foreground uppercase tracking-wide">Profiles</h3>
+        {Object.entries(draft.profiles).map(([name, p]) => (
+          <div key={name} className="border rounded-lg p-3 space-y-2">
+            <div className="flex items-center gap-2">
+              <span className="text-sm font-medium">{name}</span>
+              <div className="flex-1" />
+              <button className={`${iconBtn} hover:text-destructive`} title="Remove profile" onClick={() => setDraft((d) => ({ ...d, profiles: without(d.profiles, name) }))}>
+                <Trash2 className="w-3.5 h-3.5" />
+              </button>
+            </div>
+            <div className="grid grid-cols-[4.5rem_1fr] gap-x-2 gap-y-1.5 items-center">
+              {(['tools', 'mcps', 'env'] as const).map((f) => (
+                <FieldRow key={f} label={f}><CsvInput value={p[f]} onChange={(v) => setProfile(name, { [f]: v })} placeholder='comma-separated, "*" = all' /></FieldRow>
+              ))}
+              <FieldRow label="rate"><Input className={`${inputCls} w-28`} value={p.rate} placeholder="120/h" onChange={(e) => setProfile(name, { rate: e.target.value.trim() })} /></FieldRow>
+              <FieldRow label="readScope">
+                <select className={`${selectCls} w-28`} value={p.readScope} onChange={(e) => setProfile(name, { readScope: e.target.value as Profile['readScope'] })}>
+                  {['all', 'own', 'none'].map((s) => <option key={s} value={s}>{s}</option>)}
+                </select>
+              </FieldRow>
+              <FieldRow label="outbound">
+                <input type="checkbox" className="h-4 w-4 justify-self-start" checked={p.outbound} onChange={(e) => setProfile(name, { outbound: e.target.checked })} />
+              </FieldRow>
+            </div>
+          </div>
+        ))}
+        <div className="flex items-center gap-2">
+          <Input className={`${inputCls} w-40`} placeholder="new profile name" value={newProfile} onChange={(e) => setNewProfile(e.target.value.trim())} />
+          <Button size="sm" variant="outline" className="h-7 text-xs" disabled={!newProfile || newProfile in draft.profiles}
+            onClick={() => { setDraft((d) => ({ ...d, profiles: { ...d.profiles, [newProfile]: { tools: [], mcps: [], env: [], outbound: false, readScope: 'none', rate: '0' } } })); setNewProfile(''); }}>
+            <Plus className="w-3 h-3 mr-1" /> Add profile
+          </Button>
+        </div>
+      </section>
+      {saveBar}
+    </div>
+  );
+}
+
+function FieldRow({ label, children }: { label: string; children: React.ReactNode }) {
+  return (<><label className="text-[11px] text-muted-foreground">{label}</label>{children}</>);
+}

package/src/client/components/owner/shared.tsx

@@ -0,0 +1,84 @@
+import { useEffect, useState } from 'react';
+import { Input } from '@/components/ui/input';
+import type { OwnerCall } from '@/hooks/useOwner';
+
+export type { OwnerCall };
+export interface Profile { tools: string[]; mcps: string[]; env: string[]; outbound: boolean; readScope: 'all' | 'own' | 'none'; rate: string }
+export interface Match { kind?: string; id?: string; emailIn?: string[]; domain?: string; verified?: boolean; [k: string]: unknown }
+export interface Policy {
+  roles: Record<string, { rank: number; profile: string }>;
+  profiles: Record<string, Profile>;
+  bindings: { match: Match; role: string }[];
+  default: string;
+  blocklist: { match: Match; until: number | null; reason?: string }[];
+  tokensValidAfter: Record<string, number>;
+}
+export interface PolicyDoc { policy: Policy; version: string; valid: boolean; ownerIds?: string[] }
+/** PUT the whole policy, guarded by the version the edit started from. */
+export type SavePolicy = (policy: Policy, version: string) => Promise<void>;
+
+export const KINDS = ['user', 'email', 'slack', 'apikey', 'internal', 'anonymous'];
+export const selectCls = 'h-7 rounded-md border border-input bg-background px-2 text-xs';
+export const inputCls = 'h-7 text-xs';
+export const thCls = 'text-left font-medium text-muted-foreground px-2 py-1 whitespace-nowrap';
+export const tdCls = 'px-2 py-1 align-top';
+export const iconBtn = 'text-muted-foreground hover:text-foreground disabled:opacity-40 transition-colors';
+
+export const fmtTs = (v: string | number) => new Date(v).toLocaleString(undefined, { month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit' });
+export const matchLabel = (m: Match) => Object.entries(m).map(([k, v]) => `${k}=${Array.isArray(v) ? v.join('|') : String(v)}`).join(' ');
+
+/** One action at a time, with its error kept visible (useOwner's call already logged it). */
+export function useAction() {
+  const [busy, setBusy] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const run = async (key: string, fn: () => Promise<void>) => {
+    if (busy) return;
+    setBusy(key);
+    setError(null);
+    try { await fn(); } catch (e: any) { setError(e?.message ?? String(e)); } finally { setBusy(null); }
+  };
+  return { busy, error, run };
+}
+
+/** Server error; a policy validation error ("Invalid policy: a; b") renders as a list. */
+export function ErrorBox({ error }: { error: string | null }) {
+  if (!error) return null;
+  const m = /^Invalid policy: (.*)$/s.exec(error);
+  return (
+    <div className="text-xs text-destructive border border-destructive/40 rounded-md p-2">
+      {m ? (<><p className="font-medium">Invalid policy — not saved:</p><ul className="list-disc pl-4">{m[1].split('; ').map((e, i) => <li key={i}>{e}</li>)}</ul></>) : error}
+    </div>
+  );
+}
+
+/** Comma-separated list input; commits on blur so typing "a, " isn't normalized away mid-edit. */
+export function CsvInput({ value, onChange, placeholder }: { value: string[] | undefined; onChange: (v: string[]) => void; placeholder?: string }) {
+  const joined = (value ?? []).join(', ');
+  const [text, setText] = useState(joined);
+  useEffect(() => setText(joined), [joined]);
+  return (
+    <Input className={inputCls} value={text} placeholder={placeholder} onChange={(e) => setText(e.target.value)}
+      onBlur={() => onChange(text.split(',').map((s) => s.trim()).filter(Boolean))} />
+  );
+}
+
+/** Row actions shared by Principals and Audit. Only `user:`/`internal:` principals carry revocable tokens. Both actions
+ *  change the policy document, so `onPolicyChange` refreshes its version (else the next Save would 409). */
+export function principalActions(call: OwnerCall, onPolicyChange: () => Promise<void>, ownerIds: string[] = []) {
+  return {
+    canRevoke: (id: string) => /^(user|internal):/.test(id) && id !== 'internal:agent-internal',
+    /** UI hint only (ownerIds from GET /policy) — the server refuses a block that matches an owner. */
+    canBlock: (id: string) => !ownerIds.includes(id),
+    revoke: async (id: string) => {
+      if (!confirm(`Revoke every token issued to ${id}? They must sign in again.`)) return;
+      await call('/tokens/revoke', 'POST', { principalId: id });
+      await onPolicyChange();
+    },
+    block: async (id: string) => {
+      const reason = prompt(`Block ${id}? Reason (optional):`);
+      if (reason === null) return;
+      await call('/blocks', 'POST', { match: { id }, until: null, reason });
+      await onPolicyChange();
+    },
+  };
+}

package/src/client/hooks/useOwner.ts

@@ -0,0 +1,20 @@
+import { useCallback } from 'react';
+import { api } from '@/lib/api';
+import { useIsOwner } from './useIsOwner';
+
+/** `/api/owner/*` caller: throws the server's `error` (validation text included), logged before it reaches the UI. */
+export type OwnerCall = <T = any>(path: string, method?: string, body?: unknown) => Promise<T>;
+
+/** Owner Console access: `isOwner` (UI hint — the server enforces) + an authenticated caller for `/api/owner/*`. */
+export function useOwner(getToken: () => Promise<string | null>) {
+  const isOwner = useIsOwner(getToken);
+  const call = useCallback<OwnerCall>(async (path, method = 'GET', body) => {
+    try {
+      return await api(`/api/owner${path}`, getToken, { method, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
+    } catch (e: any) {
+      console.warn(`[owner] ${method} ${path} failed: ${e?.message ?? e}`);
+      throw e;
+    }
+  }, [getToken]);
+  return { isOwner, call };
+}

package/src/client/lib/api.ts

@@ -1,6 +1,6 @@
 import { reportApiFailure, reportApiResponse } from '@/lib/backendHealth';
 
-/** Minimal authenticated JSON fetch helper. Throws `Error("<status> <statusText>")` or the server's `error` field. */
+/** Minimal authenticated JSON fetch helper. Throws `Error("<status> <statusText>")` or the server's `error` field, with `status` set. */
 export async function api<T>(
   path: string,
   getToken: () => Promise<string | null>,
@@ -23,7 +23,7 @@ export async function api<T>(
   reportApiResponse(path, res, init?.expect);
   if (!res.ok) {
     const body = await res.json().catch(() => ({}));
-    throw new Error(body.error || `${res.status} ${res.statusText}`);
+    throw Object.assign(new Error(body.error || `${res.status} ${res.statusText}`), { status: res.status });
   }
   return res.json();
 }

package/src/index.ts

@@ -25,8 +25,10 @@ import type { AgentEngine, EngineModel, EngineStreamOpts } from './server/engine
 import type { ExtRegisterFn, ExtensionContext } from './server/extensions.ts';
 import type { WebhookOptions } from './server/events/webhook.ts';
 import type { ShragaEvent, ShragaEventMap, PayloadOf } from './server/events/types.ts';
+import type { PolicyOptions, PolicyFile } from './server/security/policy.ts';
 
 export type {
+  PolicyFile,
   ServerHandle,
   ServerFeature,
   FeatureContext,
@@ -67,6 +69,12 @@ export class ShragaOptions {
   runtimeRegistration?: boolean = false;
   /** Arbitrary extra environment to apply before boot (e.g. ANTHROPIC_API_KEY, SHRAGA_FEAT_*). */
   env?: Record<string, string>;
+  /** Security policy seams. `migrate` seeds `data/security/policy.json` ONCE, when it's first generated (no file, no
+   *  `.migrated` marker): it receives the default draft (legacy whitelist already bound as operator) and returns the
+   *  final draft. The result is validated and saved like any policy; an invalid draft or a throw fails closed (owners
+   *  only). Never runs on a PASSIVE standby (it runs on promotion if the file is still missing). Later edits go through
+   *  the Owner Console, not this hook. */
+  security?: { migrate?: PolicyOptions['migrate'] };
 }
 
 export interface ShragaInstance {
@@ -94,7 +102,7 @@ export interface ShragaInstance {
 
 class Shraga implements ShragaInstance {
   public options: ShragaOptions;
-  private reg: Required<BootRegistrations> = { features: [], engines: [], extensions: [], eventSubs: [] };
+  private reg: Required<Omit<BootRegistrations, 'security'>> ={ features: [], engines: [], extensions: [], eventSubs: [] };
   private handle: ServerHandle | null = null;
   private starting: Promise<ServerHandle> | null = null;
 
@@ -150,7 +158,7 @@ class Shraga implements ShragaInstance {
     if (this.starting) return this.starting;
     this.starting = (async () => {
       const { bootServer } = await import('./server/boot.ts');
-      this.handle = await bootServer(this.reg);
+      this.handle = await bootServer({ ...this.reg, security: this.options.security });
       return this.handle;
     })();
     return this.starting;

package/src/server/agent-config.ts

@@ -0,0 +1,34 @@
+// Agent config READ path (shared across users), as its own leaf module.
+//
+// Why it isn't in claude.ts: the security runtime reads a flag from it (`allowUntrustedReplies`, see
+// `mayReplyTo`), and claude.ts imports the runtime — plus the whole engine/skills/sessions graph. A leaf
+// that only touches fs + paths keeps that dependency one-way and cheap. The WRITE path stays in claude.ts
+// (it also has to tell data-sync, which pulls the Agent SDK).
+import { existsSync, readFileSync } from 'node:fs';
+import { dataPath } from './paths.ts';
+import type { AgentSettings as AgentConfig } from './shraga-config.ts';
+
+export const CONFIG_PATH = dataPath('agent-config.json');
+
+export const DEFAULT_CONFIG: AgentConfig = {
+  /** ToolSearch loads deferred MCP tools; without it, permission prompts / tool graph can block Meta Ads tools. */
+  allowedTools: ['Read', 'Edit', 'Bash', 'WebSearch', 'Glob', 'LS', 'ToolSearch'],
+  permissionMode: 'acceptEdits',
+  maxTurns: 15,
+  // Defaults are what a fresh self-hosted install runs before anyone touches the UI, so they favour
+  // cost/latency over ceiling. Both are overridable per-deployment via agent-config.json and per-send
+  // via directives — an operator who wants a bigger model sets it once; every operator pays for a default.
+  model: 'claude-sonnet-5',
+  effort: 'low',
+  // `allowUntrustedReplies` is deliberately absent: undefined = off, so a fresh install never auto-replies
+  // to an unverified sender, and an owner has to turn it on explicitly.
+};
+
+export function getAgentConfig(): AgentConfig {
+  // agent-config.json (UI-writable, git-tracked) is the single source of truth for agent settings.
+  let config = { ...DEFAULT_CONFIG };
+  if (existsSync(CONFIG_PATH)) {
+    try { Object.assign(config, JSON.parse(readFileSync(CONFIG_PATH, 'utf-8'))); } catch (e) { console.warn('[claude] failed to parse agent-config.json:', e); }
+  }
+  return config;
+}

package/src/server/api-key-routes.ts

@@ -9,6 +9,8 @@ import { security } from './security/runtime.ts';
 export class ApiKeyRoutesOptions {
   base: string = '/api/api-keys';
   gate: RequestHandler[] = [];
+  /** Extra gates for create/delete (after `gate`). */
+  writeGate: RequestHandler[] = [];
   /** Owner console: sees/deletes every key and may set `role`/`expiresAt`. Self: own keys (all when the caller is an
    *  owner, as before) and label only. */
   asOwner: boolean = false;
@@ -23,7 +25,7 @@ function fail(res: Response, e: any): void {
 }
 
 export function apiKeyRouter(options?: Partial<ApiKeyRoutesOptions>): Router {
-  const { base, gate, asOwner } = { ...new ApiKeyRoutesOptions(), ...options };
+  const { base, gate, writeGate, asOwner } = { ...new ApiKeyRoutesOptions(), ...options };
   const router = Router();
   const isOwner = (u: AuthUser) => asOwner || u.isOwner;
 
@@ -33,7 +35,7 @@ export function apiKeyRouter(options?: Partial<ApiKeyRoutesOptions>): Router {
   });
 
   /** Body: { label?, role?, expiresAt? (epoch ms) } — role/expiresAt honored on the owner mount only. Plaintext returned once. */
-  router.post(base, ...gate, (req, res) => {
+  router.post(base, ...gate, ...writeGate, (req, res) => {
     const user = userOf(req);
     // Minting a key is minting a credential AS this identity — only an interactive login may (same rule as OAuth
     // consent). Otherwise a role-capped or expiring key could mint itself an uncapped, non-expiring one.
@@ -50,7 +52,7 @@ export function apiKeyRouter(options?: Partial<ApiKeyRoutesOptions>): Router {
     } catch (e: any) { fail(res, e); }
   });
 
-  router.delete(`${base}/:id`, ...gate, (req: Request<{ id: string }>, res) => {
+  router.delete(`${base}/:id`, ...gate, ...writeGate, (req: Request<{ id: string }>, res) => {
     const user = userOf(req);
     try {
       const r = apiKeyStore().delete(req.params.id, user.uid, isOwner(user), user.principal.id);

package/src/server/boot.ts

@@ -53,6 +53,7 @@ import { dataSync } from './data-sync.ts';
 import { mountMcpServer } from './mcp-server.ts';
 import { fromInternal, type Principal } from './security/principal.ts';
 import { initSecurity, security, admitTurn, requestIp } from './security/runtime.ts';
+import type { PolicyOptions } from './security/policy.ts';
 import { writeDenial } from './security/guard.ts';
 import { requireOwner } from './security/owner-only.ts';
 import { flushEscalations } from './security/escalate.ts';
@@ -89,6 +90,8 @@ export interface BootRegistrations {
   engines?: AgentEngine[];
   extensions?: ExtRegisterFn[];
   eventSubs?: Array<{ source: string; handler: (payload: any, evt: any) => void }>;
+  /** ShragaOptions.security — threaded into the process-wide Policy. */
+  security?: { migrate?: PolicyOptions['migrate'] };
 }
 
 export interface ServerHandle {
@@ -135,7 +138,7 @@ function bootDataSync(): void {
 await loadShragaConfig();
 // Process-wide policy + audit (shadow mode: decide + audit, never deny). Audit writes only on the
 // active instance — a PASSIVE standby shares DATA_DIR. `activated` is declared above.
-initSecurity({ isActive: () => !PASSIVE || activated });
+initSecurity({ isActive: () => !PASSIVE || activated, policy: { migrate: __reg.security?.migrate } });
 // Programmatic engines register through the same seam an overlay uses — BEFORE initEngines() so
 // getAvailableEngines() includes them and a directive can resolve to one immediately.
 for (const e of __reg.engines ?? []) registerEngine(e);

package/src/server/claude.ts

@@ -30,33 +30,14 @@ import type { Principal } from './security/principal.ts';
 import { security, resolvePrincipal } from './security/runtime.ts';
 import { resolveAndGetEngine, ModelUnavailableError } from './engine/index.ts';
 
-const CONFIG_PATH = dataPath('agent-config.json');
-
 // ── Agent config (shared across users) ──────────────────────────────────────
+// The READ path lives in agent-config.ts (a leaf the security runtime can import without pulling this
+// module's graph); re-exported here so existing importers keep using claude.ts.
 
 export type { AgentSettings as AgentConfig } from './shraga-config.ts';
 import type { AgentSettings as AgentConfig } from './shraga-config.ts';
-
-const DEFAULT_CONFIG: AgentConfig = {
-  /** ToolSearch loads deferred MCP tools; without it, permission prompts / tool graph can block Meta Ads tools. */
-  allowedTools: ['Read', 'Edit', 'Bash', 'WebSearch', 'Glob', 'LS', 'ToolSearch'],
-  permissionMode: 'acceptEdits',
-  maxTurns: 15,
-  // Defaults are what a fresh self-hosted install runs before anyone touches the UI, so they favour
-  // cost/latency over ceiling. Both are overridable per-deployment via agent-config.json and per-send
-  // via directives — an operator who wants a bigger model sets it once; every operator pays for a default.
-  model: 'claude-sonnet-5',
-  effort: 'low',
-};
-
-export function getAgentConfig(): AgentConfig {
-  // agent-config.json (UI-writable, git-tracked) is the single source of truth for agent settings.
-  let config = { ...DEFAULT_CONFIG };
-  if (existsSync(CONFIG_PATH)) {
-    try { Object.assign(config, JSON.parse(readFileSync(CONFIG_PATH, 'utf-8'))); } catch (e) { console.warn('[claude] failed to parse agent-config.json:', e); }
-  }
-  return config;
-}
+import { CONFIG_PATH, getAgentConfig } from './agent-config.ts';
+export { getAgentConfig };
 
 /**
  * Which credentials the claude-code SDK will resolve — process-global, derived from env at call time

package/src/server/data-sync.ts

@@ -811,6 +811,7 @@ export class DataSync {
     // blocks.json (guard auto-blocks); policy.json + .migrated (the Owner Console writes them; a pulled change trips
     // the policy provenance/tamper check). Blue-green shares one DATA_DIR on one host, so nothing needs to cross hosts.
     'security/',
+    'quarantine/', // untrusted inbound content held for operator review — never synced
   ];
 
   /** Write or refresh .gitignore, appending any canonical entries it's missing (idempotent). */

package/src/server/engine/claude-code.ts

@@ -227,6 +227,10 @@ async function* buildAttachmentPrompt(text: string, attachments: { path: string;
   yield { type: 'user', message: { role: 'user', content }, parent_tool_use_id: null, session_id: sessionId };
 }
 
+async function* buildTextPrompt(text: string, sessionId: string): AsyncIterable<any> {
+  yield { type: 'user', message: { role: 'user', content: text }, parent_tool_use_id: null, session_id: sessionId };
+}
+
 async function* buildLegacyImagePrompt(text: string, images: string[], sessionId: string): AsyncIterable<any> {
   const content: any[] = images.map((dataUrl) => {
     const match = dataUrl.match(/^data:([^;]+);base64,(.+)$/);
@@ -524,11 +528,22 @@ export class ClaudeCodeEngine implements AgentEngine {
     const sessionKey = opts.sessionId ?? crypto.randomUUID();
     const hasAttachments = opts.attachments && opts.attachments.length > 0;
     const hasLegacyImages = opts.images && opts.images.length > 0;
-    const prompt = hasAttachments
+    const source = hasAttachments
       ? buildAttachmentPrompt(fullPrompt, opts.attachments!, sessionKey)
       : hasLegacyImages
         ? buildLegacyImagePrompt(fullPrompt, opts.images!, sessionKey)
-        : fullPrompt;
+        : buildTextPrompt(fullPrompt, sessionKey);
+    // Streaming input, held open until the turn is over. A string prompt runs the CLI one-shot: it exits after
+    // the first result and kills `run_in_background` jobs ~5s later. Open, the job keeps running and its
+    // task_notification gets the model a follow-up turn, as interactive Claude Code does. The uuid is echoed on
+    // the result that answers THIS prompt (`user_message_uuids`), telling it apart from a resumed session's stale one.
+    const promptUuid = crypto.randomUUID();
+    let closeInput!: () => void;
+    const inputClosed = new Promise<void>((r) => { closeInput = r; });
+    const prompt = (async function* () {
+      for await (const msg of source) yield { ...msg, uuid: promptUuid };
+      await inputClosed;
+    })();
 
     const q = query({ prompt, options: options as any });
     // The CLI writes this prompt to the transcript before any output: from here a cancel can't un-deliver it.
@@ -546,6 +561,9 @@ export class ClaudeCodeEngine implements AgentEngine {
     const iter = q[Symbol.asyncIterator]();
     let pendingNext: Promise<IteratorResult<any>> | null = null;
     let waitingForBg = false;
+    // Has the result answering THIS prompt arrived? Later results are the model's follow-ups on bg-task completions.
+    let answered = false;
+    let turnBreak = false;
     let bgTimer: Promise<'__bgtimeout'> | null = null;
     let bgTimerHandle: ReturnType<typeof setTimeout> | null = null;
     let bgHeartbeat: ReturnType<typeof setInterval> | null = null;
@@ -622,7 +640,8 @@ export class ClaudeCodeEngine implements AgentEngine {
         if (m.type === 'system' && m.subtype === 'task_notification') {
           outstandingTasks.delete(m.task_id);
           console.log(`[claude] Background task ${m.status}: ${m.task_id} (${outstandingTasks.size} pending) (${elapsed()})`);
-          if (outstandingTasks.size === 0) { waitingForBg = false; clearBgTimer(); }
+          // Not the end of the turn: the CLI now runs a follow-up turn on the result, whose own result ends it
+          // (still bounded by the bg timer).
           continue;
         }
 
@@ -632,6 +651,15 @@ export class ClaudeCodeEngine implements AgentEngine {
         if (m.type === 'rate_limit_event') { claudeUsageFor(accountDir).observeRateLimit(m.rate_limit_info); continue; }
 
         if (m.type === 'result') {
+          // A resumed session first replays a pending task_notification as its own zero-turn result, before
+          // our prompt runs — ending on it drops the user's message. Skip any result that is not ours until
+          // ours arrives (older CLIs don't echo the uuid: then only a zero-turn result counts as stale).
+          const echoed = m.user_message_uuids ?? (m.user_message_uuid ? [m.user_message_uuid] : undefined);
+          if (!answered && !m.is_error && (echoed ? !echoed.includes(promptUuid) : !m.num_turns)) {
+            console.log(`[claude] Skipping result of an earlier turn: turns=${m.num_turns ?? 0} result_index=${m.result_index ?? '?'} (${elapsed()})`);
+            continue;
+          }
+          answered = true;
           lastSessionId = m.session_id || lastSessionId;
           const sdkTurns = m.num_turns ?? 0;
           const raw = m.subtype ?? 'unknown';
@@ -647,6 +675,7 @@ export class ClaudeCodeEngine implements AgentEngine {
               bgHeartbeat = setInterval(() => console.log(`[claude] Still holding for ${outstandingTasks.size} bg task(s): ${[...outstandingTasks].join(',')} (${elapsed()})`), BG_HEARTBEAT_MS);
               bgHeartbeat.unref?.();
             }
+            turnBreak = textDeltaCount > 0;
             continue;
           }
           // The SDK reports `subtype: 'success'` even when the API call failed (e.g. an org spend
@@ -687,6 +716,7 @@ export class ClaudeCodeEngine implements AgentEngine {
           if (event?.type === 'content_block_delta' && event.delta?.type === 'text_delta') {
             textDeltaCount++;
             sawOutput = true;
+            if (turnBreak) { turnBreak = false; yield { type: 'text_delta', text: '\n\n' }; }
             yield { type: 'text_delta', text: event.delta.text };
           }
           if (event?.type === 'content_block_start' && event.content_block?.type === 'tool_use') {
@@ -802,6 +832,7 @@ export class ClaudeCodeEngine implements AgentEngine {
       return;
     } finally {
       clearBgTimer();
+      closeInput();
       // The CLI has read the file by now (it loads MCP config at startup); holding it any longer just
       // widens the window in which the credentials sit on disk.
       mcpConfigFile?.cleanup();

package/src/server/security/audit.ts

@@ -422,15 +422,21 @@ export class Audit {
   }
 
   /**
-   * Newest first, streaming backwards over ALL month files (no month-name pruning: a skewed clock can put any ts in any
-   * file); each record is filtered by its own ts. Cursor is opaque (file + byte offset).
-   * Throws (after logging) if the dir or a month file can't be read — never a silently short page. Planted
-   * (non-regular) entries are skipped, not thrown: they're alerted and verify() reports them, and throwing would let
-   * one planted name (undeletable under +a) blind the audit viewer.
+   * Newest first, streaming backwards over the month files; each record is filtered by its own ts. Two skip rules:
+   * - Month-name floor: with `from`, regular month files named older than the month before `from`'s month are skipped
+   *   whole (never opened). Every record in every remaining regular file (any month from that floor on, including
+   *   future-named ones) is checked, so a back-skewed record never hides earlier in-window ones; a record whose ts
+   *   was written into a file below the floor (clock skewed back by more than a month) is not found.
+   * - Planted (non-regular) month entries are skipped, not thrown: they're alerted and verify() reports them, and
+   *   throwing would let one planted name (undeletable under +a) blind the audit viewer.
+   * Throws (after logging) if the dir or a regular month file can't be read — never a silently short page.
+   * Cursor is opaque (file + byte offset).
    */
   public query(q: AuditQuery): AuditPage {
     const limit = Math.max(1, Math.min(MAX_QUERY, Math.floor(q.limit) || 1));
     const from = q.from !== undefined ? toIso(q.from) : undefined, to = q.to !== undefined ? toIso(q.to) : undefined;
+    const fd = from ? new Date(from) : undefined; // skew slack: nothing older than the start of the month before `from`'s
+    const floor = fd ? new Date(Date.UTC(fd.getUTCFullYear(), fd.getUTCMonth() - 1, 1)).toISOString() : undefined;
     const types = q.type === undefined ? undefined : new Set<string>([q.type].flat());
     let cur: { file: string; offset: number } | undefined;
     if (q.cursor) {
@@ -442,6 +448,7 @@ export class Audit {
     let last: { file: string; start: number } | undefined;
     for (const f of this.files().reverse()) {
       if (cur && f > cur.file) continue;
+      if (floor && f.slice(0, 7) < floor.slice(0, 7)) break; // sorted newest-first: every remaining file is older
       try {
         for (const { line, start } of reverseLines(path.join(this.options.dir, f), cur?.file === f ? cur.offset : undefined)) {
           const r = parse(line);