agentirc-cli 9.13.1__tar.gz → 9.14.0__tar.gz

{agentirc_cli-9.13.1 → agentirc_cli-9.14.0}/CHANGELOG.md

@@ -4,6 +4,74 @@ All notable changes to this project will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [9.14.0] - 2026-11-01
+
+### Added
+
+- Agent accounts (culture#506): a reserved nick, a secret (only its sha256 is
+  stored), a role (`resident`, `operator`, `guest`), channel grants (`read`,
+  `speak`) and a state (`active`, `suspended`, `revoked`), read from
+  `<data_dir>/accounts.json` (written by culture). The file reloads within
+  about 1 s of a change and on SIGHUP; a malformed file never crashes the
+  server — it is rejected whole, the last good table is kept, and the nicks it
+  names stay reserved (fail closed). See docs/accounts.md.
+- SASL PLAIN (IRCv3 `sasl` capability, numerics 900/903-908). An account nick
+  never gets `001` unless the connection authenticated as exactly that
+  account, on every registration path. SASL is accepted only from loopback
+  (`accounts.trust_loopback`, default true) or `accounts.trusted_cidrs`; other
+  peers are refused before they are asked for the secret. A correct login
+  reclaims the nick from any other local holder.
+- Channel grants and roles are enforced on JOIN, PRIVMSG/NOTICE, HISTORY,
+  BACKFILL, EVENTSUB, EVENTPUB, THREAD, TOPIC and the room verbs; operator-only
+  room verbs need the `operator` role; guests may only hold grants on channels
+  under `accounts.guest_channel_prefixes`. Clients without an account are not
+  gated.
+- Live revoke: a session whose account is revoked, suspended, removed or
+  re-keyed is closed within 5 s; a nick squatted before its account existed
+  is evicted too.
+- Failed-authentication logging (nick, peer, reason code; never secret
+  material), a per (address, account) rate limit (`accounts.auth_failure_limit`,
+  default 10 per `accounts.auth_failure_window` 60 s) and the
+  `culture.auth.failures` counter (attribute `reason`).
+
+### Changed
+
+- Registration now waits for IRCv3 capability negotiation to finish: a client
+  that opens negotiation with `CAP LS` gets no `001` welcome and no `SNICK`
+  relay to linked peers until it sends `CAP END` (even if `NICK` and `USER`
+  already arrived). `CAP END` completes the held registration. A client that
+  never sends `CAP` registers exactly as before, and a bare `CAP REQ` without a
+  preceding `CAP LS` does not hold registration (legacy-client compatibility).
+  A client that sends `CAP LS` and never `CAP END` stays unregistered. This is
+  the groundwork for SASL authentication of reserved nicks (culture#506).
+- Before registration only CAP, NICK, USER, PASS, PING, PONG, AUTHENTICATE
+  and QUIT are accepted (plus the EVENT*/BACKFILL verbs, which keep their
+  `EVENTERR :not-registered` reply); anything else gets `451
+  ERR_NOTREGISTERED`, and a pre-registration QUIT emits no event. Applies to
+  all clients.
+- Local nicks must be printable ASCII, and a nick that matches an account nick
+  under an ASCII case fold without being equal to it is refused (432).
+- Accounts that are not operators are no longer auto-opped as a channel's
+  first joiner.
+- EVENTSUB scopes channel-less events for non-operator account sessions: a
+  payload `channel` / `target` / `room_id` the session cannot read drops the
+  event, and a `channels` list (e.g. `user.quit`) is filtered to readable
+  channels (dropped when none remain). Clients without an account are
+  unchanged.
+- Channel-less `EVENTPUB <type> *` is refused (`permission-denied`) for
+  `guest` accounts and for sessions whose account is suspended, revoked or
+  gone; `operator` and `resident` accounts and clients without an account
+  are unchanged.
+- `ROOMINVITE` needs read access on the channel for an account session;
+  without it the reply is the same `403` as for a nonexistent channel.
+- The failed-authentication limiter is a bounded LRU (4096 keys, O(1)
+  amortised per failure) instead of growing without bound under churning
+  `authcid`s (agentirc#65).
+- Account lookups no longer `stat()` the accounts file: they read the cached
+  table, refreshed by the 1 s watcher, SIGHUP, and at most three file checks
+  per connection on the registration/SASL path. Grant and role changes reach
+  connected sessions within about 1 s instead of on the next lookup.
+
 ## [9.13.1] - 2026-10-30
 
 ### Added

{agentirc_cli-9.13.1 → agentirc_cli-9.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentirc-cli
-Version: 9.13.1
+Version: 9.14.0
 Summary: Agent-friendly IRCd: server core for AI agent meshes
 Project-URL: Homepage, https://github.com/agentculture/agentirc
 Project-URL: Issues, https://github.com/agentculture/agentirc/issues

{agentirc_cli-9.13.1 → agentirc_cli-9.14.0}/agentirc/_internal/event_subscriptions.py

@@ -207,15 +207,29 @@ class SubscriptionRegistry:
         # ``add`` or ``remove`` and mutate the dicts. The ``list()`` snapshots
         # avoid ``RuntimeError: dictionary changed size during iteration``.
         for client, per_client in list(self._subs.items()):  # NOSONAR python:S7504: defensive snapshot vs. concurrent mutation
-            for sub in list(per_client.values()):  # NOSONAR python:S7504: defensive snapshot vs. concurrent mutation
-                if sub.dropped:
-                    continue
-                if not sub.matches(event):
-                    continue
-                try:
-                    sub.queue.put_nowait(event)
-                except asyncio.QueueFull:
-                    await self._handle_overflow(client, sub)
+            # Read grants (culture#506 h1): an account session only receives
+            # events it could read through any other path. Checked per event,
+            # live, so a grant change applies to the very next event.
+            # Channel-less events are scoped to the channels the session can
+            # read (agentirc#66 review): ``visible_event`` may return a copy
+            # with a filtered channel list, or ``None`` to drop the event.
+            visible_event = getattr(client, "visible_event", None)
+            delivered = event if visible_event is None else visible_event(event)
+            if delivered is None:
+                continue
+            await self._deliver_to_client(client, per_client, delivered)
+
+    async def _deliver_to_client(
+        self, client: Client, per_client: dict[str, Subscription], delivered: Event
+    ) -> None:
+        """Enqueue *delivered* on each live, matching subscription of *client*."""
+        for sub in list(per_client.values()):  # NOSONAR python:S7504: defensive snapshot vs. concurrent mutation
+            if sub.dropped or not sub.matches(delivered):
+                continue
+            try:
+                sub.queue.put_nowait(delivered)
+            except asyncio.QueueFull:
+                await self._handle_overflow(client, sub)
 
     async def _handle_overflow(self, client: Client, sub: Subscription) -> None:
         sub.dropped = True

{agentirc_cli-9.13.1 → agentirc_cli-9.14.0}/agentirc/_internal/protocol/replies.py

@@ -43,13 +43,24 @@ ERR_ERRONEUSNICKNAME = "432"
 ERR_NICKNAMEINUSE = "433"
 ERR_USERNOTINCHANNEL = "441"
 ERR_NOTONCHANNEL = "442"
+ERR_NOTREGISTERED = "451"
 ERR_NEEDMOREPARAMS = "461"
 ERR_ALREADYREGISTRED = "462"
 ERR_CHANOPRIVSNEEDED = "482"
 ERR_USERSDONTMATCH = "502"
 
+# SASL (IRCv3 sasl-3.1)
+RPL_LOGGEDIN = "900"
+RPL_SASLSUCCESS = "903"
+ERR_SASLFAIL = "904"
+ERR_SASLTOOLONG = "905"
+ERR_SASLABORTED = "906"
+ERR_SASLALREADY = "907"
+RPL_SASLMECHS = "908"
+
 # Error/reply message texts
 MSG_NEEDMOREPARAMS = "Not enough parameters"
+MSG_NOTREGISTERED = "You have not registered"
 MSG_NOSUCHCHANNEL = "No such channel"
 MSG_NOSUCHNICK = "No such nick"
 MSG_NOTONCHANNEL = "You're not on that channel"

{agentirc_cli-9.13.1 → agentirc_cli-9.14.0}/agentirc/_internal/telemetry/metrics.py

@@ -66,6 +66,8 @@ class MetricsRegistry:
     # Bots (Plan 7)
     bot_invocations: Counter
     bot_webhook_duration: Histogram
+    # Agent accounts (culture#506 t10)
+    auth_failures: Counter
 
 
 def reset_for_tests() -> None:
@@ -181,6 +183,11 @@ def _build_registry(meter: Meter) -> MetricsRegistry:
             unit="s",
             description="Webhook request handler duration by bot and status_class=2xx|3xx|4xx|5xx",
         ),
+        # Agent accounts (culture#506 t10)
+        auth_failures=meter.create_counter(
+            "culture.auth.failures",
+            description="Failed authentications by reason (bad_secret, unknown_account, ...)",
+        ),
     )