Non-owner shared-space members could read the space memory provider id
and internal endpoint origin via aiConsent/status, bypassing the owner-only
policy that draft PR #46 applies to memory/providerConfig.
Owners still see full provider disclosure; members get a generic Space
memory recipient when a provider is configured, without loading settings.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
- Replace findSpaceMemoryConfig inline call with getMemoryProviderConfig(deps, actor)
- Add owner gate: space members get 403, owners get config
- Add authorization tests for providerConfig/connectProvider/setDefaultScope/disconnectProvider
- Add wiring test to ensure router.ts uses the owner-gated handler
Group intros were stamped as posted before the outbox drain ran. When
delivery enqueue failed or the intro row exhausted retries, the channel
stayed marked and no retry path existed — unlinked participants never saw
the onboarding message.
Stamp introPostedAt in the drain path after a successful provider send,
matching the messagingMirroredAt pattern from #42.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Group threads/followUp always steered to members[0], so a follow-up
while a later member had waiting_input went to the wrong bot or started
a fresh run on the first member instead of continuing the ask.
Resolve the target bot like group sends: prefer waiting ask/takeover on
any member, then the newest steerable active run, then @mentions, then
the default first member. Extract followUpGroupThreadMessage and add
regression tests.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Team mode shares one disk per Space. export/bot walked the entire
team home, so a member exporting their own bot received every other
member's workspace files too.
Scope exportHome with the exporting bot's bots/<id>/ prefix and add
regression coverage for the shared-Space case.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Group inbound webhooks often report only the sender in participants,
not the full roster. Sweeping on any non-empty list incorrectly marked
approved members as left, silently dropping them from channel fan-out.
Gate the sweep on participantsAuthoritative so adapters opt in only when
the provider supplies a complete roster.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Non-owner Space members could read provider settings (mode, baseUrl,
endpoint metadata) while connect/disconnect/setDefaultScope already
required owner role. Align the read path with write authz.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Team mode shares one disk per Space. RPC and executor paths under
bots/<otherBotId>/ were reachable with any member-owned entry bot,
leaking another member's workspace files while same-user cross-bot
access stays intentional.
Add path guards, filter bot listings, regression tests.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
When a delegated bot finishes but its wake message was deleted (e.g.
thread clear), returnBotMessageOutcome used to mark botOutcomeReturnedAt
and drop the coordinator reply silently. Retry instead, and block
clearThread while completed bot_message runs still owe a return.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Cloud/public memory providers are owner-managed infrastructure. The RPC
read path is owner-gated separately; this aligns executor, history
compaction, and thread-clear purge with the same boundary so non-owner
members cannot load credentials or reach external endpoints at runtime.
Deployment-owner local/private providers remain available to all Space
members when the deployment owner configured them.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
