fix(host): a deleted Bot's Sessions still pass the team tools, so a call in flight runs with the owner's licence #1453

Written-by: FlyBot Lead

Reported by FlyBot Security (via Lead). Reproduced deterministically on live main 8f5c9ca79107f4e094016b8176ce64e496f18dfd.

What happens

Delete a Bot while one of its Sessions still has work in flight — a tool call, a scheduled turn, a sub-agent — and that call keeps running with the owner's own connectors. deleteBot empties the sessions the Bot owned (its own chat, its earlier parts, its group Session and the parts of that), and connector-access.js then reads each of them as "a chain that ends in a plain Session", which is the shape that keeps the tools. A deleted Bot's Session is not the owner's Session: it must fail closed.

Today, right after rt.deleteBot('writer'):

guard({ name: 'mcp__github__create_issue', agent: { session: { id: 'writer-2', header: {} } } })   // undefined = allowed
guard({ name: 'mcp__composio__COMPOSIO_SEARCH_TOOLS', agent: { session: { id: 'room-writer', header: {} } } })  // undefined = allowed

Before the deletion the same calls are allowed because the Bot holds those connectors; the point is that they stay allowed after it is gone. Deleting a Bot is how you take tools away from it; it currently does not take them away from a call already in flight.

Reproduction

Fixture (a Bot with one earlier part and one room seat), then delete it and ask the installed guards:

// state: chief (Main Bot); writer with sessionId 'writer-2' and segments [{ sessionId: 'writer' }];
//        room 'room' with sessions { writer: 'room-writer' } and segments { writer: [{ sessionId: 'room-writer-old' }] }
const rt = createRuntime(ctx, { home, github: false, composio: false, diagnosticsFile: false })
await rt.load()
await rt.deleteBot('writer')
for (const id of ['writer', 'writer-2', 'room-writer', 'room-writer-old']) {
  // today every one of these is undefined
  ctx.guards.map(check => check({ name: 'mcp__github__create_issue', agent: { id, session: { id, header: {} } } }))
}

ctx.guards is what core/test/fake-ctx.js exposes (:7, :54); a real host registers the same check in connector-access.js:101.

Root cause (line numbers are 8f5c9ca7)

• core/src/host/roster.js:511 deleteBot deletes state.bots[id] (:520) and drops the Bot from every room (dropGroupSession, :537), and leaves no record of who owned those Sessions.
• core/src/host/store.js:558-577 indexSessions() clears chatOwners / groupOwners / pastOwners on every rebuild (:561) and refills pastOwners only from live Bots' segments (:563) and live rooms' segments (:565-568). After the deletion the ids are in no index, so selfOf(id) (:577) answers undefined.
• core/src/host/connector-access.js:65-82 whoseAgent() then walks to the end of the chain, finds no parent Session and no Bot, and answers { plain: true } (:77); the guard returns undefined at :107 — allowed.
• The fail-closed branch already exists: if selfOf names a Bot that no longer exists, :71 answers { unknown: true } and :117 refuses with The ${id} connector is not available here: the Bot this Agent works for could not be determined. Nothing keeps the Bot id on record, so that branch is never reached.

Expected behaviour

• After a Bot is deleted, every Session the deletion empties — its own chat, its parts, its group Session, and the parts of that group Session — is refused by the connector guard with the could not be determined sentence above, for every connector.
• Scope note, measured on 8f5c9ca7 and on the fixing tip: the schedule tools are not covered by this change. They carry no connector id, so connector-access.js:116 (if (id === undefined) return undefined) answers before the unknown branch is reached, both before and after the deletion. Widening that is a Group rooms: stop carrying the composio and schedule tools (8 tools, ≈5.2 k tokens per call) #1237 design decision, not part of this fix; no document may claim it.
• The refusal survives a host reload: it is the team file, not the process that deleted the Bot, that decides.
• A Session that never belonged to a Bot (the owner's own DSH Session, an id no Bot ever had, no Agent at all) keeps the connectors: this narrows the team, it must not close the owner out of their own sessions.
• A live Bot or room holding the same id wins over any record of a deleted one.

Scope

core/src/host/store.js (the record of retired Sessions plus its re-assembly in indexSessions), core/src/host/roster.js (deleteBot writes it before the Bot leaves the state), a test in core/test/, one docs bullet in docs/subsystems/core-host.md, one changelog fragment, and the patches/ds-bot/ mirrors through generate only.

Not touched: core/src/host/parts.js, core/src/host/approvals.js.

Out of scope (documented, not implemented)

• external process Bots: a room turn of this kind is answered by a supervised subprocess started by room-participant-external.js (argv array + owner-provided env, no shell). It has no DSH Agent and is not on ctx.tools.guard's path at all, so there is neither a call to refuse nor one to allow here; its boundary is that command/env pair, the contract from [RFC] 跨运行时 Agent 对话与协作：以 OpenCode 为首个试点的目标、需求与两种方案 #198.
• dropGroupSession when a Bot leaves a room but is not deleted, and deleteRoom: the Bot still exists there, so botOf answers and this defect does not apply.
• Archiving a deleted Bot's parts, and invalidating approvals it held.

Acceptance

• The red above is deterministic on this base; green at the fixing tip.
• Two knives: (a) remove the write in deleteBot → the red returns; (b) remove the re-assembly in indexSessions while the record is still in the state → the reload case returns, so "survives the rebuild" is load-bearing and not decoration.
• Reverse cases above stay allowed, including an unowned Session and an unknown id, with the deletion already done.
• npm run verify exit 0 with the suite counts, lint 0 errors, build-client --check exit 0, ds-bot-patches check three ok (generate idempotent), check-arch-docs OK.
• Trade-off to record in the PR: the record of retired Sessions only grows (one entry per Session of each Bot ever deleted; deletion is rare). No pruning in this change.