Merge branch 'main' into feat/approval-button-styles

src/cli/dispatch.test.ts

@@ -185,6 +185,16 @@ register({
   handler: async (args) => ({ id: (args as Record<string, unknown>).id, agent_group_id: 'g1' }),
 });
 
+// Echoes args back — used to assert dash-joined positional id resolution.
+register({
+  name: 'groups-get',
+  description: 'test command (groups get)',
+  resource: 'groups',
+  access: 'open',
+  parseArgs: (raw) => raw,
+  handler: async (args) => ({ echo: args }),
+});
+
 import { dispatch } from './dispatch.js';
 import type { CallerContext } from './frame.js';
 
@@ -584,3 +594,19 @@ describe('CLI scope enforcement', () => {
     }
   });
 });
+
+// --- Dash-joined positional id resolution (generated ids contain dashes) ---
+
+describe('dash-joined positional id resolution', () => {
+  it('resolves `groups-get-<uuid-with-dashes>` to (groups get, id=<uuid>)', async () => {
+    const uuid = '550e8400-e29b-41d4-a716-446655440000';
+
+    const resp = await dispatch({ id: '1', command: `groups-get-${uuid}`, args: {} }, { caller: 'host' });
+
+    expect(resp.ok).toBe(true);
+    if (resp.ok) {
+      const data = resp.data as { echo: Record<string, unknown> };
+      expect(data.echo.id).toBe(uuid);
+    }
+  });
+});

src/cli/dispatch.ts

@@ -26,19 +26,24 @@ export async function dispatch(
 ): Promise<ResponseFrame> {
   let cmd = lookup(req.command);
 
-  // Fallback: if the full command isn't registered, trim the last
-  // dash-segment and treat it as the target ID. This lets clients join
-  // all positional args with dashes (e.g. `ncl groups get abc123`
-  // → command "groups-get-abc123" → trim → "groups-get" + id "abc123").
+  // Fallback: if the full command isn't registered, split the dash-joined
+  // command and treat the longest registered prefix as the command, with the
+  // re-joined remainder as the target ID. Clients join all positional args
+  // with dashes (e.g. `ncl groups get abc123` → command "groups-get-abc123"),
+  // and generated ids (UUIDs, `sess-…`, `appr-…`) themselves contain dashes,
+  // so trimming a single trailing segment isn't enough — walk prefixes from
+  // longest to shortest so `groups-get-<uuid-with-dashes>` still resolves to
+  // "groups-get" + id "<uuid-with-dashes>".
   if (!cmd) {
-    const idx = req.command.lastIndexOf('-');
-    if (idx > 0) {
-      const shortened = req.command.slice(0, idx);
-      const tail = req.command.slice(idx + 1);
+    const parts = req.command.split('-');
+    for (let i = parts.length - 1; i > 0; i--) {
+      const shortened = parts.slice(0, i).join('-');
       const fallback = lookup(shortened);
       if (fallback) {
+        const tail = parts.slice(i).join('-');
         cmd = fallback;
         req = { ...req, command: shortened, args: { ...req.args, id: req.args.id ?? tail } };
+        break;
       }
     }
   }

src/command-gate.test.ts

@@ -0,0 +1,83 @@
+/**
+ * Tests for the host-side command gate — filtered commands are dropped
+ * before reaching the container, and admin commands are gated against
+ * the user_roles table.
+ */
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { gateCommand } from './command-gate.js';
+import { closeDb, createAgentGroup, initTestDb, runMigrations } from './db/index.js';
+import { createUser } from './modules/permissions/db/users.js';
+import { grantRole } from './modules/permissions/db/user-roles.js';
+
+function now(): string {
+  return new Date().toISOString();
+}
+
+function seedAgentGroup(id: string): void {
+  createAgentGroup({ id, name: id.toUpperCase(), folder: id, agent_provider: null, created_at: now() });
+}
+
+function seedUser(id: string): void {
+  createUser({ id, kind: 'telegram', display_name: null, created_at: now() });
+}
+
+beforeEach(() => {
+  const db = initTestDb();
+  runMigrations(db);
+  seedAgentGroup('ag-1');
+  seedAgentGroup('ag-2');
+});
+
+afterEach(() => {
+  closeDb();
+});
+
+describe('filtered commands', () => {
+  it('drops /start before it reaches the container', () => {
+    expect(gateCommand('/start', 'telegram:1', 'ag-1')).toEqual({ action: 'filter' });
+  });
+
+  it('drops /start regardless of sender', () => {
+    expect(gateCommand('/start', null, 'ag-1')).toEqual({ action: 'filter' });
+  });
+});
+
+describe('admin gating goes through roles', () => {
+  it('denies an admin command from a non-admin user', () => {
+    expect(gateCommand('/clear', 'telegram:nobody', 'ag-1')).toEqual({ action: 'deny', command: '/clear' });
+  });
+
+  it('denies an admin command with no sender', () => {
+    expect(gateCommand('/clear', null, 'ag-1')).toEqual({ action: 'deny', command: '/clear' });
+  });
+
+  it('allows an admin command from an owner', () => {
+    seedUser('telegram:owner');
+    grantRole({ user_id: 'telegram:owner', role: 'owner', agent_group_id: null, granted_by: null, granted_at: now() });
+    expect(gateCommand('/clear', 'telegram:owner', 'ag-1')).toEqual({ action: 'pass' });
+  });
+
+  it('allows an admin command from a scoped admin of the group', () => {
+    seedUser('telegram:admin');
+    grantRole({
+      user_id: 'telegram:admin',
+      role: 'admin',
+      agent_group_id: 'ag-1',
+      granted_by: null,
+      granted_at: now(),
+    });
+    expect(gateCommand('/clear', 'telegram:admin', 'ag-1')).toEqual({ action: 'pass' });
+    expect(gateCommand('/clear', 'telegram:admin', 'ag-2')).toEqual({ action: 'deny', command: '/clear' });
+  });
+});
+
+describe('normal messages pass through', () => {
+  it('passes a plain message', () => {
+    expect(gateCommand('hello there', 'telegram:1', 'ag-1')).toEqual({ action: 'pass' });
+  });
+
+  it('passes an unknown slash command', () => {
+    expect(gateCommand('/whatever', 'telegram:1', 'ag-1')).toEqual({ action: 'pass' });
+  });
+});

src/command-gate.ts

@@ -7,11 +7,11 @@
  *   "Permission denied" response written directly to messages_out
  * - Normal messages: pass through unchanged
  */
-import { getDb, hasTable } from './db/connection.js';
+import { hasAdminPrivilege } from './modules/permissions/db/user-roles.js';
 
 export type GateResult = { action: 'pass' } | { action: 'filter' } | { action: 'deny'; command: string };
 
-const FILTERED_COMMANDS = new Set(['/help', '/login', '/logout', '/doctor', '/config', '/remote-control']);
+const FILTERED_COMMANDS = new Set(['/start', '/help', '/login', '/logout', '/doctor', '/config', '/remote-control']);
 const ADMIN_COMMANDS = new Set(['/clear', '/compact', '/context', '/cost', '/files', '/upload-trace']);
 
 /**
@@ -48,16 +48,5 @@ export function gateCommand(content: string, userId: string | null, agentGroupId
 
 function isAdmin(userId: string | null, agentGroupId: string): boolean {
   if (!userId) return false;
-  if (!hasTable(getDb(), 'user_roles')) return true; // no permissions module = allow all
-  const db = getDb();
-  const row = db
-    .prepare(
-      `SELECT 1 FROM user_roles
-       WHERE user_id = ?
-         AND (role = 'owner' OR role = 'admin')
-         AND (agent_group_id IS NULL OR agent_group_id = ?)
-       LIMIT 1`,
-    )
-    .get(userId, agentGroupId);
-  return row != null;
+  return hasAdminPrivilege(userId, agentGroupId);
 }

src/container-runner.ts

@@ -320,12 +320,6 @@ export function buildMounts(
     mounts.push({ hostPath: fragmentsDir, containerPath: '/workspace/agent/.claude-fragments', readonly: true });
   }
 
-  // Global memory directory — always read-only.
-  const globalDir = path.join(GROUPS_DIR, 'global');
-  if (fs.existsSync(globalDir)) {
-    mounts.push({ hostPath: globalDir, containerPath: '/workspace/global', readonly: true });
-  }
-
   // Shared CLAUDE.md — read-only, imported by the composed entry point via
   // the `.claude-shared.md` symlink inside the group dir.
   const sharedClaudeMd = path.join(process.cwd(), 'container', 'CLAUDE.md');

src/modules/approvals/onecli-approvals.ts

@@ -254,16 +254,46 @@ async function sweepStaleApprovals(): Promise<void> {
   }
 }
 
+/** The hosted gateway's structured request summary — not yet in the SDK's
+ *  ApprovalRequest type (observed on api.onecli.sh, 2026-07): the action being
+ *  performed plus labeled fields (To / Subject / Body for email sends). */
+interface ApprovalSummary {
+  action?: string;
+  details?: { label: string; value: string }[];
+}
+
+const SUMMARY_VALUE_EXCERPT_CHARS = 900;
+
 function buildQuestion(request: ApprovalRequest, agentName: string): string {
-  const lines = [
-    'Credential access request',
-    `Agent: ${agentName}`,
-    '```',
-    `${request.method} ${request.host}${request.path}`,
-    '```',
-  ];
-  if (request.bodyPreview) {
-    lines.push('Body:', '```', request.bodyPreview, '```');
+  const lines = [`*Agent:* ${agentName}`];
+
+  const summary = (request as ApprovalRequest & { summary?: ApprovalSummary }).summary;
+  if (summary?.details?.length) {
+    if (summary.action) lines.push(`*Action:* ${summary.action}`);
+    // A render bug here must never decide the request: handleRequest's catch
+    // returns 'deny', so stay defensive — coerce non-string values instead of
+    // assuming the gateway's shape, and keep the card under Slack's 3000-char
+    // section limit or delivery itself fails.
+    let budget = 2600;
+    for (const { label, value } of summary.details) {
+      const raw = typeof value === 'string' ? value : (JSON.stringify(value) ?? String(value));
+      const cap = Math.min(SUMMARY_VALUE_EXCERPT_CHARS, Math.max(0, budget));
+      if (cap === 0) {
+        lines.push(`_…${summary.details.length} field(s) omitted for length — see the audit payload._`);
+        break;
+      }
+      const v = raw.length > cap ? `${raw.slice(0, cap)}…` : raw;
+      budget -= v.length + String(label).length + 8;
+      // Multi-line values (message bodies) read better fenced; short labeled
+      // fields (To, Subject) inline.
+      if (v.includes('\n')) lines.push(`*${label}:*`, '```', v, '```');
+      else lines.push(`*${label}:* ${v}`);
+    }
+  } else if (request.bodyPreview) {
+    lines.push('```', request.bodyPreview.slice(0, SUMMARY_VALUE_EXCERPT_CHARS * 2), '```');
+    lines.push(`_${request.method} ${request.host}${request.path}_`);
+  } else {
+    lines.push(`_${request.method} ${request.host}${request.path}_`);
   }
   return lines.join('\n');
 }

src/providers/index.ts

@@ -1,6 +1,6 @@
 // Host-side provider container-config barrel.
 // Providers that need host-side container setup (extra mounts, env passthrough,
 // per-session directories) self-register on import. Providers with no host
-// needs (claude, mock) don't appear here.
+// needs (claude) don't appear here.
 //
 // Skills add a new provider by appending one import line below.

src/providers/provider-container-registry.ts

@@ -7,7 +7,7 @@
  * the registered config fn, and merges the returned mounts/env into the spawn
  * args.
  *
- * Providers without host-side needs (e.g. `claude`, `mock`) don't appear in
+ * Providers without host-side needs (e.g. `claude`) don't appear in
  * this registry at all — the lookup returns `undefined` and the spawn path
  * proceeds with only the default mounts and env.
  *