Harden Zyra Shield trusted authorization

[sonoxo]

Summary

• resolve agent scopes from an organization-scoped server-side grant registry
• deny unregistered agents by default
• derive restricted-data egress approval from authenticated owner/admin confirmation
• bind scan evidence hashes to the exact manifest digest

Configuration

Set ZYRA_SHIELD_AGENT_GRANTS to a JSON array of trusted grants:

[{"organizationId":"org-id","agentId":"agent-id","scopes":["repository:read"]}]

Security

Client-provided scope declarations and egress assertions are no longer trusted. Missing or invalid grant configuration fails closed.

Addresses the three review findings raised on merged PR #38.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 451ece04b8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require granted scopes for scoped capabilities

When a registered agent submits requestedScopes: [], which the schema permits, the set-difference check finds no undeclared scopes and a low-risk capability such as repository_read returns allow even when the registry grant has no repository scope. Because the caller still controls which scopes it claims to need and those scopes are not tied to the selected capability, it can bypass the new server-side grants simply by omitting them; derive the required scopes from the capability/action or otherwise require the relevant granted scope.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Deny requests with unspecified registration state

For direct users of the exported evaluateShieldRequest API, omitting agentRegistered still passes this check because only the explicit value false is denied. Existing callers compiled against the optional field therefore continue to receive allow for otherwise valid requests without proving registration, contrary to the stated deny-by-default behavior; require agentRegistered === true instead.

Useful? React with 👍 / 👎.