@nidvue/teamwork 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -9,7 +9,63 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased](https://github.com/Nidvue/Teamwork/compare/v1.0.2...HEAD)
+## [Unreleased](https://github.com/Nidvue/Teamwork/compare/v1.1.2...HEAD)
+
+## [1.1.2](https://github.com/Nidvue/Teamwork/compare/v1.1.1...v1.1.2) - 2026-10-20
+
+### Fixed
+
+- **The skill now declares its interpreter.** `SKILL.md` carried no
+  `compatibility` field, so a host without python3 loaded the skill and only found
+  out at the first `teamwork.py` call. It now states
+  `compatibility: python3 3.9 or newer on PATH - the engine is stdlib-only, so
+  there is no pip install and no venv; git is required for every branch, commit
+  and PR operation`, and
+  `tests/unit/test_skill_contracts.py::test_the_skill_declares_the_agent_skills_contract`
+  fails when the field is missing or advertises an interpreter `pyproject.toml`
+  does not support.
+- **A self-contradictory review rule.** The re-submission bullet read "there is no
+  round limit, but at fail, fix, re-check, re-submit, re-review until it passes" -
+  a truncated sentence that contradicted the 3-failure dispute rule stated 300
+  lines above it. It now says failures are counted and at 3 the Reviewer opens a
+  dispute, which is what the tribunal paragraph, `AGENTS.md` and
+  `references/Dissent.md` all say.
+- **Nine tests were unreachable on NixOS and Guix.**
+  `tests/unit/test_skill_refresh.py` ran every `git` call with a hard-coded
+  `PATH=/usr/bin:/bin:/usr/local/bin`, where git does not exist on those
+  distributions, so the nine fixtures errored instead of testing the refresh path.
+  The ambient `PATH` is now prepended and the standard directories are kept as a
+  floor. On this machine: 9 errors -> 0.
+
+## [1.1.1](https://github.com/Nidvue/Teamwork/compare/v1.1.0...v1.1.1) - 2026-10-20
+
+### Fixed
+
+- **npm package republished as 1.1.1**: the first `npm publish` of
+  `@nidvue/teamwork@1.1.0` exited 0 but only *staged* the version on the registry
+  (`dist-tags.latest` stayed at the `0.0.0-stage` placeholder, the packument never
+  appeared, and `npm stage list` returned no stage-id to reject). A second publish
+  of that version is refused with `E409 Cannot publish over previously staged
+  version`. This is the phantom-staged-publish registry bug tracked as
+  [npm/cli#9889](https://github.com/npm/cli/issues/9889); the version number cannot
+  be reused, so the package ships as 1.1.1. No code, skill or protocol change -
+  the only differences from the 1.1.0 build are the `version` field and this entry.
+
+### Security
+
+- **The privacy scanner publishes no character of a matched value**: a finding
+  line now names the rule - `<location>: [<severity>/<rule>] <redacted-<rule>>` -
+  instead of a partly masked preview (`ghp********************************QQQ`
+  used to hand the first and last three characters of a credential to every reader
+  of a CI log, which is the disclosure the scanner exists to prevent). The raw
+  value is no longer an item of the finding record at all: it is held on the
+  `Finding` object as `.raw`, so no reporting sink - the text line, `--json`, the
+  archive mask - can serialise it by accident. `--reveal` (stable fingerprint) and
+  `--reveal-to` (`0600` file) are unchanged, and the `--json` evidence is
+  rule-named too. This closes the two open `py/clear-text-logging-sensitive-data`
+  code-scanning alerts on `scripts/privacy_scan.py` by removing the dataflow
+  rather than by a dismissal or a query exclusion, and `SCANNER_VERSION` moves to
+  `1.4.0`. Dead code that took a raw value (`_clip`) is gone.
 
 ## [1.1.0](https://github.com/Nidvue/Teamwork/releases/tag/v1.1.0) - 2026-10-20
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nidvue/teamwork",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Nidvue Teamwork - an autonomous, self-governing agent company for pi: CEO-led decomposition, parallel lanes, two-stage review, hash-chained audit ledger and layered role-owned tests. Python 3.9+, stdlib only.",
   "keywords": [
     "pi-package",

package/skills/teamwork/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: teamwork
 description: "Nidvue Teamwork - run a user prompt to completion with an autonomous multi-agent company: CEO, CTO, COO, CFO, Architect, Product Manager, Project Manager, Designer, Release Engineer, Technical Writer, Data Engineer, Developer(s), Tester(s), Reviewer and Security Auditor. Use when the user invokes /teamwork, asks for a team of sub-agents with roles, wants an org chart of agents that plans, builds, tests and iterates until the goal is met, or wants long-running parallel work with per-agent memory. The user talks only to the CEO; every other agent communicates internally."
+compatibility: "python3 3.9 or newer on PATH - the engine is stdlib-only, so there is no pip install and no venv; git is required for every branch, commit and PR operation."
 ---
 
 # Nidvue Teamwork - `teamwork` skill
@@ -696,8 +697,9 @@ Mechanical enforcement:
 - a `review --result pass` appends the accepted result to
   `docs/Team/Archive.md` (what, who, verified how, which revision) - the team's
   evidence ledger. Read it with `teamwork.py archive [--agent X]`.
-- a re-submitted fix is reviewed from scratch; there is no round limit, but at
-  fail, fix, re-check, re-submit, re-review until it passes.
+- a re-submitted fix is reviewed from scratch - fail, fix, self-check, re-submit,
+  re-review until it passes - and the failures are counted, so at 3 the Reviewer
+  opens a dispute and the tribunal rules instead of the loop spinning.
 - if a finding turns into a design disagreement, use the dispute protocol.
 
 This applies to code, unit tests, integration/E2E tests, documentation, design

package/skills/teamwork/references/Remotes.md

@@ -118,7 +118,10 @@ Security), an open `error`/`critical`/`high` alert on the default branch is a
 known defect **in the shipped revision**: the code is already public, so the
 alert is a release blocker, not a backlog item. Two measured examples on this
 repository's own remote, both `py/clear-text-logging-sensitive-data` on
-`scripts/privacy_scan.py`, both `error`, both on `main` with no task and no owner.
+`scripts/privacy_scan.py`, both `error`, both on `main` with no task and no owner -
+and both only closed when the value stopped reaching the sink at all: the raw
+value left the finding record, and the report named the rule instead of printing a
+partly masked preview.
 
 The Release Engineer owns the gate:
 

package/skills/teamwork/scripts/privacy_scan.py

@@ -48,11 +48,13 @@ Design notes
 * Stdlib only, no network, no third-party import.
 * The scanner is itself published, so it must not become the leak it detects.
   Private domains are therefore not stored as plain text (they are reconstructed
-  from code points at runtime) and matched values are **masked by default** so a
-  failing CI log cannot republish the secret. Unmasked values are **never**
-  printed: ``--reveal`` prints a stable fingerprint (SHA-256 prefix) instead and
-  ``--reveal-to PATH`` exports the raw values to a ``0600`` file for local
-  remediation only.
+  from code points at runtime) and a matched value never reaches a log in any
+  form: the report names the rule (``<redacted-rule>``) and no more, so a failing
+  CI log cannot republish the secret, not even a prefix of it. The raw value is
+  held outside the report record (see ``Finding``), so no reporting sink can
+  serialise it by accident. ``--reveal`` prints a stable fingerprint (SHA-256
+  prefix) instead and ``--reveal-to PATH`` exports the raw values to a ``0600``
+  file for local remediation only.
 * The allowlist file (``--allow``) holds one regular expression per line with an
   optional ``# reason`` suffix. A finding is exempt when its matched text matches
   any allowlist expression. Keep it minimal and justify each entry.
@@ -63,6 +65,11 @@ Unmasked values are **never** written to stdout or stderr. A log line is a
 broadcast sink - CI logs are public, terminals are recorded, and ``tee``ed
 output outlives the session - so the scanner has no flag that prints a secret.
 
+* The report line for a finding is
+  ``<location>: [<severity>/<rule>] <redacted-<rule>>``: it says which rule fired
+  where, and deliberately no character of the value - a partly masked preview
+  still publishes the first and last characters of a credential to every reader
+  of the log, which is the disclosure this scanner exists to prevent.
 * ``--reveal`` adds ``(sha256:<12 hex>)`` to each finding line. The fingerprint
   is a stable, unsalted SHA-256 prefix: it identifies which finding is which and
   lets an operator confirm a rotated value, but it cannot be used as the
@@ -91,7 +98,7 @@ import sys
 from collections import Counter
 from pathlib import Path
 
-SCANNER_VERSION = "1.3.0"
+SCANNER_VERSION = "1.4.0"
 
 # --------------------------------------------------------------------------- #
 # Neutral identity / allowlisted email domains
@@ -511,14 +518,6 @@ def _email_allowed(value: str) -> bool:
     return any(domain.endswith(suffix) for suffix in _ALLOWED_EMAIL_SUFFIXES)
 
 
-def _mask(value: str) -> str:
-    if len(value) <= 4:
-        return "*" * len(value)
-    if len(value) <= 10:
-        return value[0] + "*" * (len(value) - 2) + value[-1]
-    return value[:3] + "*" * (len(value) - 6) + value[-3:]
-
-
 def _fingerprint(value: str, length: int = 12) -> str:
     """A stable, non-usable identifier for a matched value.
 
@@ -562,43 +561,49 @@ def write_reveal_file(path, pairs):
     return written
 
 
-def _clip(line: str, value: str, width: int = 160) -> str:
-    """A short, single-line context snippet around the match."""
-    index = line.find(value)
-    if index < 0:
-        return line[:width]
-    start = max(0, index - 40)
-    end = min(len(line), index + len(value) + 40)
-    snippet = line[start:end].strip()
-    if start > 0:
-        snippet = "..." + snippet
-    if end < len(line):
-        snippet = snippet + "..."
-    return snippet[:width]
-
-
 # --------------------------------------------------------------------------- #
 # Findings
 # --------------------------------------------------------------------------- #
 
 
+class Finding(dict):
+    """One report row, with the raw matched value held outside the mapping.
+
+    Every reporting sink serialises *items*: ``json.dumps(report)`` walks the
+    dict, the text report reads ``evidence``, and both end up in a CI log. A
+    value kept as an attribute therefore cannot be published by any of them, so
+    "the log never carries a secret" is a property of the shape rather than a
+    promise held by one ``pop`` before one ``print``. Everything that needs the
+    value itself - ``--reveal``, ``--reveal-to`` and the archive mask - reads
+    ``.raw`` explicitly, which is greppable and reviewable in one place each.
+    """
+
+    __slots__ = ("raw",)
+
+    def __init__(self, items, raw=""):
+        super().__init__(items)
+        self.raw = raw
+
+
 def make_finding(rule_id, severity, path, line_no, value, line, source, commit=None):
-    masked = _mask(value)
-    # Never ship the surrounding line: a second credential in the same window
-    # would be republished in plaintext (the scanner is published too).
-    context = ""
-    return {
-        "rule": rule_id,
-        "severity": severity,
-        "path": path,
-        "line": line_no,
-        "source": source,
-        "commit": commit,
-        "location": location(path, line_no, commit),
-        "evidence": masked,
-        "match": value,
-        "context": context,
-    }
+    # Not one character of the value, and never the surrounding line: the report
+    # names the rule the way the archive mask does, because a partly masked
+    # preview still hands the first and last characters of a credential to
+    # everyone who can read the log.
+    return Finding(
+        {
+            "rule": rule_id,
+            "severity": severity,
+            "path": path,
+            "line": line_no,
+            "source": source,
+            "commit": commit,
+            "location": location(path, line_no, commit),
+            "evidence": f"<redacted-{rule_id}>",
+            "context": "",
+        },
+        value,
+    )
 
 
 def location(path, line_no, commit=None):
@@ -861,18 +866,21 @@ def config_path_finding(rel, source, allow=(), commit=None):
     if any(pattern.search(rel) for pattern in allow):
         return None
     local_state = reason.startswith("local state")
-    return {
-        "rule": "local-state" if local_state else "local-config",
-        "severity": "high" if local_state else "critical",
-        "path": rel,
-        "line": 0,
-        "source": source,
-        "commit": commit,
-        "location": rel,
-        "evidence": rel,
-        "match": rel,
-        "context": reason,
-    }
+    return Finding(
+        {
+            "rule": "local-state" if local_state else "local-config",
+            "severity": "high" if local_state else "critical",
+            "path": rel,
+            "line": 0,
+            "source": source,
+            "commit": commit,
+            "location": rel,
+            # A path is the finding, not a credential: naming it is the report.
+            "evidence": rel,
+            "context": reason,
+        },
+        rel,
+    )
 
 
 def scan_tree(root, allow, stats=None):
@@ -888,18 +896,20 @@ def scan_tree(root, allow, stats=None):
             data = full.read_bytes()
         except OSError as exc:
             findings.append(
-                {
-                    "rule": "unreadable-tracked-file",
-                    "severity": "medium",
-                    "path": rel,
-                    "line": 0,
-                    "source": "tree",
-                    "commit": None,
-                    "location": rel,
-                    "evidence": rel,
-                    "match": rel,
-                    "context": f"tracked file could not be read: {exc}",
-                }
+                Finding(
+                    {
+                        "rule": "unreadable-tracked-file",
+                        "severity": "medium",
+                        "path": rel,
+                        "line": 0,
+                        "source": "tree",
+                        "commit": None,
+                        "location": rel,
+                        "evidence": rel,
+                        "context": f"tracked file could not be read: {exc}",
+                    },
+                    rel,
+                )
             )
             continue
         findings.extend(_scan_bytes(data, rel, "tree", allow))
@@ -1016,7 +1026,7 @@ def dedupe(findings):
     seen = set()
     unique = []
     for finding in findings:
-        key = (finding["rule"], finding["location"], finding["match"], finding.get("commit") or "")
+        key = (finding["rule"], finding["location"], finding.raw, finding.get("commit") or "")
         if key in seen:
             continue
         seen.add(key)
@@ -1103,13 +1113,12 @@ def main(argv=None):
     reveal_path = args.reveal_to
     reveal_values = []
     for finding in findings:
-        match = finding.pop("match", None)
-        if match is None:
+        if not finding.raw:
             continue
         if args.reveal:
-            finding["fingerprint"] = _fingerprint(match)
+            finding["fingerprint"] = _fingerprint(finding.raw)
         if reveal_path:
-            reveal_values.append((finding, match))
+            reveal_values.append((finding, finding.raw))
 
     reveal_written = 0
     if reveal_path:
@@ -1151,16 +1160,18 @@ def main(argv=None):
     else:
         if not args.quiet:
             for finding in findings:
-                # The unmasked value is never printed: stdout is a broadcast
-                # sink. --reveal only adds a non-usable fingerprint.
+                # The value is never printed in any form: stdout is a broadcast
+                # sink, so the report names the rule instead. --reveal only adds
+                # a non-usable fingerprint.
                 shown = finding["evidence"]
                 fingerprint = finding.get("fingerprint")
                 if fingerprint:
                     shown = f"{shown} ({fingerprint})"
-                print(
-                    f"{finding['location']}: [{finding['severity']}/"
-                    f"{finding['rule']}] {shown}  {finding.get('detail', '')}"
-                )
+                line = f"{finding['location']}: [{finding['severity']}/{finding['rule']}] {shown}"
+                detail = finding.get("detail", "")
+                if detail:
+                    line = f"{line}  {detail}"
+                print(line)
         state = "FAIL" if findings else "PASS"
         print(f"privacy_scan: {state} - {len(findings)} finding(s) in {', '.join(modes)}")
     return 1 if findings else 0

package/skills/teamwork/src/teamwork/engine.py

@@ -3214,6 +3214,30 @@ def default_audit_range(project: Path) -> str:
     return "HEAD"
 
 
+def rewrite_safe_range(project: Path, rev_range: str) -> str:
+    """Narrow ``A..B`` to ``B`` when ``A`` no longer exists, and say so.
+
+    A push event hands CI the revision the branch had before the push. When that
+    push *rewrote* history - the sanctioned repair for a commit carrying a
+    personal mailbox - the old revision is gone, ``git log A..B`` exits 128 with
+    "Invalid revision range", and the identity audit dies over a range that can no
+    longer be measured. The new tip can still be audited, so audit it, name the
+    rewrite, and never pretend the unmeasurable span was clean.
+    """
+    if ".." not in rev_range:
+        return rev_range
+    base = rev_range.split("..", 1)[0].strip()
+    if not base or base.startswith("-"):
+        return rev_range
+    if run_git(project, "cat-file", "-e", f"{base}^{{commit}}").returncode == 0:
+        return rev_range
+    print(
+        f"# {base[:12]} is not an ancestor of this clone (history rewrite): "
+        f"auditing the tip only, the span before it is unmeasurable"
+    )
+    return rev_range.split("..", 1)[1].strip() or "HEAD"
+
+
 def audit_commit_identities(project: Path, rev_range: str, strict_authors: bool = False) -> int:
     """Fail when a commit is not authored and committed by the acting role.
 
@@ -3228,6 +3252,7 @@ def audit_commit_identities(project: Path, rev_range: str, strict_authors: bool
     if rev_range.startswith("-"):
         print(f"teamwork: invalid revision range {rev_range!r}")
         return 2
+    rev_range = rewrite_safe_range(project, rev_range)
     proc = run_git(
         project, "log", "--format=%H%x1f%an%x1f%ae%x1f%cn%x1f%ce%x1f%P%x1f%B%x1e", rev_range
     )
@@ -6608,7 +6633,9 @@ def mask_secret_shapes(text: str) -> str:
     # placeholder, code-shape and allow filters, so a placeholder the gate accepts
     # (``${API_KEY}``, ``replace_me``) was rewritten in the immutable record.
     for finding in scanner.scan_lines(text, "", "archive", rules, ()):
-        value = finding.get("match") or ""
+        # The raw value is a Finding attribute, never a report item, so the
+        # scanner cannot publish it and this mask reads it explicitly.
+        value = finding.raw or ""
         if not value:
             continue
         rule = finding["rule"]

package/skills/teamwork/src/teamwork/version.py

@@ -6,7 +6,7 @@ that importing ``teamwork`` stays cheap.
 
 from __future__ import annotations
 
-__version__ = "1.1.0"
+__version__ = "1.1.2"
 
 #: Distribution name on PyPI. The name ``teamwork`` is already taken there, so
 #: the project ships as ``teamwork-agents`` while importing as ``teamwork``.