mirror of
https://github.com/garrytan/gbrain.git
synced 2026-08-14 00:48:18 +00:00
Garry TanandClaude Fable 5
a948dfd6e2
* fix(auth): honor permissions.takes_holders for legacy bearer tokens over serve --http (#2529) The OAuth provider's legacy access_tokens branch parsed permissions.source_id but never read permissions.takes_holders, so the /mcp dispatch site's fail-closed default pinned every remote caller to world-only takes visibility — set-takes-holders was a silent no-op over serve --http, in both directions (grants above world never applied; restrictions below world didn't either). - src/core/legacy-token-scope.ts: new parseTakesHoldersAllowList shared by BOTH transports (the drift between the legacy HTTP transport's correct inline parse and the OAuth provider is how this bug shipped). [] preserved as explicit deny-all; non-array → undefined → consumer defaults ['world']. - src/core/operations.ts: AuthInfo.takesHoldersAllowList typed field (same ride-along as sourceId/allowedSources). - src/core/oauth-provider.ts: legacy branch threads the stored grant. OAuth-client tokens unchanged (no per-client storage — TODO filed). - src/mcp/http-transport.ts: converged on the shared helper (behavior no-op). - src/commands/serve-http.ts: sidecar cast replaced by the typed field. - src/core/facts/meta-hook.ts: hashAllowList gives [] its own cache key (cache identity only — payload filtering stays visibility-based). Tests: 7 verifyAccessToken cases (grant/absent/garbage/deny-all/mixed/ oauth-client/column-default), pure-helper describe, meta-hook cache-key pin, and a Postgres e2e (test/e2e/serve-http-takes-holders.test.ts) pinning the issue repro end-to-end over POST /mcp — the seam that had no coverage. Reported by @Derek95king. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(agent-voice): default-deny CORS + origin gate + loopback bind in reference server (#2477) The recipe reference server reflected any Origin into Access-Control-Allow-Origin on every route, including the unauthenticated side-effectful POSTs. Recipe is install_kind: copy-into-host-repo, so the reference is the source of truth for every future install. - Default-deny CORS: headers emitted only for exact matches against the new AGENT_VOICE_CORS_ORIGIN allowlist (comma-separated), with Vary: Origin; Allow-Credentials never set. Same-origin /call needs no configuration. - Origin gate on /session and /tool: CORS headers gate response reads, not request sends — a no-preflight "simple" cross-origin POST still executes. Disallowed Origins now 403 before any body read / upstream fetch / tool dispatch. No-Origin callers (curl, Twilio, native) and same-origin pages (Origin host == Host, tunnels included) pass. DNS rebinding stays a documented production-checklist item (TODO filed). - Loopback-default bind: HOST env, default 127.0.0.1 (mirrors gbrain serve --http --bind default); HOST=0.0.0.0 for containers/LAN. - Startup log prints the bind + CORS posture; recipe md + install manifest bumped to 0.1.1 with the production checklist rewritten to match. Tests: test/agent-voice-cors.serial.test.ts spawns the real server twice and pins default-deny, allowlist echo + trimming, preflight behavior, and the gate's ordering (evil-origin 403 vs no-origin reaching the handler). Reported by @sebastiondev. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: agent-voice origin gate fails closed on malformed Origin (#2477) Coverage-audit follow-up: a cross-origin POST with an unparseable Origin header must 403 (new URL() throws → originAllowed returns false), never fall through to the handler. A bypass here would defeat the gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: pin loopback-bind default + wire-level fail-closed takes default (#2529 #2477) Pre-landing review (testing specialist) flagged two revert-catching gaps: - #2477 HOST default (127.0.0.1) had no assertion — a regression to all-interfaces would pass every test. Capture the server's startup log and assert the loopback bind; add a HOST=0.0.0.0 override case. - #2529 serve-http `?? ['world']` default branch was only unit-covered. Add a 4th e2e case: a legacy token with no takes_holders key sees world-held takes but NOT brain-held ones over POST /mcp, pinning the fail-closed default end-to-end. Also assert the deny-all case returns a successful (non-error) tool result so the negatives can't pass vacuously. Verified: agent-voice 4/4, serve-http-takes-holders e2e 4/4 (real Postgres). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): shared permissions decode + collision-free hot-memory cache key (#2529) Adversarial-review hardening on the #2529 fix: - The two transports shared parseTakesHoldersAllowList but still decoded the permissions column differently: the OAuth provider JSON.parse'd a string-typed value, the legacy HTTP transport didn't. On a double-encoded jsonb string scalar (#2339 class) a deny-all token would fail open to ['world'] on the HTTP transport while the provider honored it. Extract coerceLegacyPermissions into the shared module and route both through it, so "the two transports cannot drift" is literally true (shared decode + shared parse). Arrays/scalars/malformed strings → undefined (no grant). - hashAllowList used bare sentinels ('_' for undefined, '(empty)' for []), which collided with real holder values ['_'] and ['(empty)']. Encode collision-free (undefined → 'none', else JSON.stringify(sorted)) so the []-vs-undefined cache separation the #2529 change relies on holds for every holder value. Tests: coerceLegacyPermissions unit cases (object/JSON-string/malformed/ array/scalar), all existing takes-holders + meta-hook + e2e suites green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * v0.42.74.0 fix(security): honor takes_holders over serve --http + agent-voice default-deny CORS (#2529 #2477) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: document agent-voice HOST + AGENT_VOICE_CORS_ORIGIN env vars in install hint (v0.42.74.0) The post-install hint's env-var quick-start predated the #2477 hardening and listed neither the loopback-default HOST bind nor the default-deny AGENT_VOICE_CORS_ORIGIN allowlist. Add both as optional entries (safe by default) and refresh the stale startup-log line to match the server's actual loopback-bind output. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: correct CHANGELOG command guidance + TODOS filing version (#2529 #2477) Ship-stage document-release caught two wrong CLI invocations in the v0.42.74.0 CHANGELOG "To take advantage" block: `gbrain auth permissions <token>` has no read-only view form (that shape errors + exits 1 — set the scope directly with `set-takes-holders <values>`), and `integrations install agent-voice --refresh` requires `--target <host-repo>`. Also correct the follow-ups TODO header from the plan's stale v0.42.56.0 guess to the actual ship version v0.42.74.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(deps): bump js-yaml to 3.15.1 — osv GHSA-5p4m-2wfm-xmqj (#2529 #2477) osv-scan flagged js-yaml@3.15.0 (High, CVSS 7.5), fixed in 3.15.1. The transitive copy (gray-matter → js-yaml) was pinned to ^3.15.0 by the package.json `overrides` block; bump both the direct dependency and the override to ^3.15.1 so the vulnerable version is gone from bun.lock entirely (gray-matter/js-yaml now resolves to 3.15.1). Patch bump, in-range, frontmatter parsing verified (markdown + frontmatter + import + oauth suites green). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(deps): bump admin nanoid to 3.3.18 — osv GHSA-2v37-7h3g-55p8 (#2529 #2477) osv-scan flagged nanoid@3.3.16 (High, CVSS 8.2) in admin/bun.lock, fixed in 3.3.17. nanoid is transitive (postcss → nanoid), so pin it in the admin overrides block; refresh resolves to 3.3.18 (latest patched 3.x). Admin SPA build verified green; both root and admin lockfiles now scan clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
4.3 KiB
4.3 KiB
Post-install hint
When gbrain integrations install agent-voice --target <repo> completes, print this to stdout (or to the install agent's conversation surface) so the operator knows what to do next.
✓ Voice agent reference installed to <target-repo>/services/voice-agent/.
Three follow-up steps before this works end-to-end:
1. Set required env vars in <target-repo>/.env
OPENAI_API_KEY=sk-... # required (OpenAI Realtime API)
DEFAULT_PERSONA=venus # optional (one of: venus, mars)
BRAIN_ROOT=/path/to/your/brain # optional (enables live context)
TIMEZONE=US/Pacific # optional
HOST=0.0.0.0 # optional — binds 127.0.0.1 (loopback) by default; set only to expose beyond localhost
AGENT_VOICE_CORS_ORIGIN=https://your.app # optional — CORS is default-deny; list exact origins (comma-separated) only if a browser on another origin needs access
The two security env vars ship safe by default: the server listens on loopback
only and refuses cross-origin browser requests. The local /call flow below
needs neither. See the recipe's production checklist before exposing publicly.
Optional for inbound Twilio:
TWILIO_ACCOUNT_SID=AC...
TWILIO_AUTH_TOKEN=...
2. Implement your context builder (recommended)
The shipped <target>/services/voice-agent/code/lib/context-builder.example.mjs is a working example assuming a documented brain layout ($BRAIN_ROOT/memory/YYYY-MM-DD.md, $BRAIN_ROOT/SOUL.md, etc.). If your brain has a different layout, edit this file to match — the contract at <target>/services/voice-agent/code/lib/personas/context-builder.contract.md documents the API.
A degraded operator with no context-builder still gets a working voice agent — Mars asks open questions, Venus answers logistics with a "I can't see your calendar from here — what do you need?" fallback.
3. Wire your resolver
This install appended three rows to your <target>/RESOLVER.md (or AGENTS.md):
voice-persona-mars | "talk to mars", "mars,", "demo mode mars", ...
voice-persona-venus | "venus,", "calendar", "tasks", ...
voice-post-call | "after the call", "call ended", "transcript", ...
Review them. If your resolver uses different conventions, edit per your style.
4. Run the host-side tests once
cd <target-repo>/services/voice-agent
bun install # or `npm install` if your repo uses npm
bun run test # all unit suites should pass green
If any prompt-shape test fails, the privacy guard has caught a name you'd want to scrub — see code/lib/personas/private-name-blocklist.json for the contract.
5. Start the server
cd <target-repo>/services/voice-agent
bun run start # or `npm start`
# → listening on http://127.0.0.1:8765 (bind: 127.0.0.1 — set HOST=0.0.0.0 to expose beyond loopback)
Open http://localhost:8765/call in a browser, click Connect, grant mic permission. You should be talking to Venus (or Mars if you set DEFAULT_PERSONA=mars).
6. (Optional) Run the WebRTC roundtrip E2E
export AGENT_VOICE_E2E=1 OPENAI_API_KEY=sk-...
bun run test:e2e
# → ~$0.10/run; spawns server, drives puppeteer with a fake-audio WAV
Or the full openclaw-wrapped flow (requires OPENCLAW_BIN, ANTHROPIC_API_KEY):
export AGENT_VOICE_FULL_E2E=1
gbrain claw-test --scenario voice-agent-install --live --agent openclaw
# → ~$1-2/run; friction-discovery test, NOT a ship gate
7. (Optional) Run the LLM-judge persona evals
cd <target-repo>/services/voice-agent
node tests/evals/mars-eval.mjs # ~$1-3 for the full 3-model judge sweep
node tests/evals/venus-eval.mjs
Synthetic canonical baselines are committed under tests/evals/baseline-runs/canonical/. Live receipts you generate go to tests/evals/baseline-runs/ (gitignored — they may contain residual brain content from your live personas).
8. Update later
When gbrain ships a new agent-voice reference, refresh your local copy:
gbrain integrations install agent-voice --target <target-repo> --refresh
The refresh classifies each file (identical / stale / locally-modified / source-deleted / host-deleted) and lets you decide per-file. See <target>/services/voice-agent/code/install/refresh-algorithm.md (copied from gbrain) for the contract.