fix(security): co-pod-member rule + no ghost-users on POST /room; rate-limit POST /pods (#617)

* fix(security): enforce co-pod-member rule + stop ghost-user creation on POST /room; rate-limit POST /pods

From the agent-runtime security audit.

- **Co-pod-member bypass (CRITICAL)**: the agent path of POST
  /api/agents/runtime/room created an agent↔agent DM room with NO
  sharePod check — any runtime token could DM any agent, defeating the
  §3.7 isolation the /agent-dm route already enforces. Added the same
  DMService.sharePod gate (403 rule:'sharePod' when no shared pod).
- **Ghost bot-user creation (HIGH)**: the target agent was resolved with
  getOrCreateAgentUser (upsert), so a made-up agentName from a leaked
  token materialized an orphan User row (unbounded table pollution). Now
  resolved with a non-upsert User.findOne — unknown agent → 404.
- **POST /pods had no rate limit (HIGH)**: a runtime token could spray
  unlimited pod creation. Added phase4RateLimit (matches /room,
  /agent-dm, /messages).

Regression lock: agentsRuntime.room.test.js gains a non-existent-agent
404 case and a no-shared-pod 403 case; existing same-pod cases still
pass (alice+bob share a pod).

* fix(#617): sanitize agent identity in /room to clear CodeQL js/sql-injection

The new non-upsert User.findOne({username}) fed a req.body-derived
username → CodeQL js/sql-injection. Applied the strip-then-use sanitizer
CodeQL recognises (same pattern as routes/registry/install.ts): agentName/
instanceId/username are stripped to [a-z0-9-] before the query. No
behavior change for valid inputs (usernames are already that charset).

* fix(#617): put phase4RateLimit before auth on POST /pods for CodeQL recognition

CodeQL's js/missing-rate-limiting only credits a limiter that PRECEDES
the other route middleware (documented in install.ts/uploads.ts). The
limiter was present but second (after agentRuntimeAuth) so the query
still flagged the DB access. Reordered to first — the key generator reads
the auth header directly, so it works pre-auth.

Author: lilyshen0722

backend/__tests__/service/agentsRuntime.room.test.js

@@ -202,5 +202,42 @@ describe('POST /api/agents/runtime/room — dual-auth (ADR-010 Phase 1)', () =>
         .send({});
       expect(res.status).toBe(400);
     });
+
+    // Security hardening (audit): the agent path must enforce the §3.7
+    // co-pod-member rule (it previously did not) and must not materialise a
+    // ghost bot User for an unknown agentName.
+    it('returns 404 for a non-existent target agent (no ghost-user creation)', async () => {
+      const res = await request(app)
+        .post('/api/agents/runtime/room')
+        .set('Authorization', `Bearer ${aliceToken}`)
+        .send({ agentName: 'ghostface-nonexistent' });
+      expect(res.status).toBe(404);
+      // No User row was materialised for the made-up name.
+      const ghost = await User.findOne({ username: 'ghostface-nonexistent', isBot: true });
+      expect(ghost).toBeNull();
+    });
+
+    it('returns 403 when the two agents share no pod (co-pod-member rule)', async () => {
+      // charlie is registered + installed into a SEPARATE pod — alice and
+      // charlie never share a pod, so alice must not be able to DM charlie.
+      await registerAgent('charlie', 'Charlie');
+      const otherPod = await Pod.create({
+        name: 'Charlie-only pod',
+        type: 'chat',
+        createdBy: humanUser._id,
+        members: [humanUser._id],
+      });
+      await request(app)
+        .post('/api/registry/install')
+        .set('Authorization', `Bearer ${humanToken}`)
+        .send({ agentName: 'charlie', podId: otherPod._id.toString(), scopes: ['context:read'] });
+
+      const res = await request(app)
+        .post('/api/agents/runtime/room')
+        .set('Authorization', `Bearer ${aliceToken}`)
+        .send({ agentName: 'charlie' });
+      expect(res.status).toBe(403);
+      expect(res.body.rule).toBe('sharePod');
+    });
   });
 });

backend/routes/agentsRuntime.ts

@@ -591,27 +591,44 @@ router.post('/room', dualAuth, phase4RateLimit, async (req: any, res: any) => {
         agentName: rawAgentName,
         instanceId: rawInstanceId,
       } = req.body || {};
-      const agentName = String(rawAgentName || '').trim().toLowerCase();
-      const instanceId = String(rawInstanceId || '').trim() || 'default';
+      // Sanitize agent identity from the request body via the strip-then-
+      // compare pattern CodeQL recognises as a SqlSanitizer for js/sql-injection
+      // (same shape as routes/registry/install.ts). Usernames are [a-z0-9-],
+      // instanceIds [a-z0-9-]; anything else is invalid input, not one of our
+      // agents.
+      const agentName = String(rawAgentName || '').trim().toLowerCase().replace(/[^a-z0-9-]/g, '');
+      const instanceId = (String(rawInstanceId || '').trim().toLowerCase().replace(/[^a-z0-9-]/g, '')) || 'default';
       if (!agentName) {
         return res.status(400).json({ message: 'agentName is required' });
       }
 
-      // Resolve target agent's User row. `getOrCreateAgentUser` is upsert,
-      // which means a misspelled `agentName` materialises a ghost bot User
-      // row. ADR-010 Phase 1 accepts this side effect (it mirrors the
-      // existing human-path semantics on the same route, and the blast
-      // radius is bounded — the ghost is just an unattached User). A name-
-      // existence check or rate limit is filed for v1.x if abuse surfaces.
-      const targetAgentUser = await AgentIdentityService.getOrCreateAgentUser(
-        agentName,
-        { instanceId },
-      );
+      // Resolve the target agent WITHOUT upserting — a misspelled or made-up
+      // agentName must 404, not materialise a ghost bot User row (unbounded
+      // User-table pollution from a leaked token). Only real, already-existing
+      // agents are DM-able.
+      const targetUsername = String(AgentIdentityService.buildAgentUsername(agentName, instanceId))
+        .replace(/[^a-z0-9-]/g, '');
+      const targetAgentUser = await User.findOne({ username: targetUsername, isBot: true }).select('_id');
+      if (!targetAgentUser) {
+        return res.status(404).json({ message: 'target agent not found' });
+      }
 
       if (String(targetAgentUser._id) === String(callerAgentUserId)) {
         return res.status(400).json({ message: 'Cannot DM yourself' });
       }
 
+      // §3.7 co-pod-member rule — an agent may only open a DM with another
+      // agent it already shares a pod with. The /agent-dm route enforces this;
+      // the /room agent path previously did not, letting any agent token DM
+      // any agent (cross-tenant collaboration bypass).
+      const shared = await DMService.sharePod(callerAgentUserId, targetAgentUser._id);
+      if (!shared) {
+        return res.status(403).json({
+          message: 'No shared pod with target — refused per co-pod-member rule',
+          rule: 'sharePod',
+        });
+      }
+
       const room = await DMService.getOrCreateAgentRoom(
         targetAgentUser._id,
         callerAgentUserId,
@@ -2287,7 +2304,11 @@ router.get('/pods', agentRuntimeAuth, async (req: any, res: any) => {
  * POST /pods (agent runtime token auth)
  * Create a new pod as the agent's bot user
  */
-router.post('/pods', agentRuntimeAuth, async (req: any, res: any) => {
+// phase4RateLimit FIRST (before auth) so CodeQL's js/missing-rate-limiting
+// query recognises the guard — it only credits a limiter that precedes the
+// other middleware. The key generator reads the auth header directly, so it
+// works pre-auth.
+router.post('/pods', phase4RateLimit, agentRuntimeAuth, async (req: any, res: any) => {
   try {
     const agentUser = req.agentUser;
     if (!agentUser) {