security: inter-agent mesh messages bypass policy evaluation after decryption

[imran-siddique]

Summary

Mesh messages decrypted by the plugin are processed without policy evaluation. A trusted peer could send task requests that should be blocked by policy.

Details

File: cli/src/plugin.ts, lines 156-305 (onMessage handler)

Once E2E-decrypted, task_request messages are delegated directly to the native agent. No check whether:

• The requested action is allowed by policy
• The sender's trust score warrants this level of access
• The request type (tool call, file access, spawn) is permitted from a peer

Proposed Fix

// Before delegateToNativeAgent:
const decision = await agtPolicy.evaluate({
    action: "handle_mesh_request",
    message_type: msg.message_type,
    from_agent: msg.from_agent,
    trust_score: trustStore.get(msg.from_agent)?.score
});
if (decision !== "allow") {
    console.log(`Blocked mesh request from ${msg.from_agent}: ${decision}`);
    return;
}

AGT's inter-agent trust protocol (IATP) provides exactly this pattern.

References

• plugin.ts lines 156-305
• AGT: trust-protocol IATP handshake verification

[pallakatos]

Resolved in main (merge commit 8f90e58)

Incoming mesh messages are gated by two checks: KNOCK trust evaluation and per-message policy evaluation.

KNOCK gate (plugin.ts lines 783–829):

// Trust score from registry (0.0-1.0 → 0-1000) + spawner affinity (+200)
const effectiveScore = normalizedScore + affinityBonus;
if (effectiveScore < AGT_TRUST_THRESHOLD) {
    return { accept: false, reason: "trust_score_below_threshold" };
}
// Policy evaluation on KNOCK intent
if (agtPolicy && intent !== "*") {
    const decision = agtPolicy.evaluate({ action: intent });
    if (decision && !decision.allowed) return { accept: false, reason: "policy_denied" };
}

Per-message policy gate (plugin.ts lines 910–970):

• Looks up sender trust score from sidecar
• Evaluates mesh:receive action with sender context
• Sends E2E encrypted rejection via relay if denied

Verified on AKS: mesh:receive events logged in agent-alice audit chain with decision=allow.

Key commit: dd6b948 (Wire mesh policy gate #10)