@nidvue/teamwork 1.1.1 → 1.4.2

package/skills/teamwork/scripts/privacy_scan.py

@@ -48,11 +48,13 @@ Design notes
 * Stdlib only, no network, no third-party import.
 * The scanner is itself published, so it must not become the leak it detects.
   Private domains are therefore not stored as plain text (they are reconstructed
-  from code points at runtime) and matched values are **masked by default** so a
-  failing CI log cannot republish the secret. Unmasked values are **never**
-  printed: ``--reveal`` prints a stable fingerprint (SHA-256 prefix) instead and
-  ``--reveal-to PATH`` exports the raw values to a ``0600`` file for local
-  remediation only.
+  from code points at runtime) and a matched value never reaches a log in any
+  form: the report names the rule (``<redacted-rule>``) and no more, so a failing
+  CI log cannot republish the secret, not even a prefix of it. The raw value is
+  held outside the report record (see ``Finding``), so no reporting sink can
+  serialise it by accident. ``--reveal`` prints a stable fingerprint (SHA-256
+  prefix) instead and ``--reveal-to PATH`` exports the raw values to a ``0600``
+  file for local remediation only.
 * The allowlist file (``--allow``) holds one regular expression per line with an
   optional ``# reason`` suffix. A finding is exempt when its matched text matches
   any allowlist expression. Keep it minimal and justify each entry.
@@ -63,6 +65,11 @@ Unmasked values are **never** written to stdout or stderr. A log line is a
 broadcast sink - CI logs are public, terminals are recorded, and ``tee``ed
 output outlives the session - so the scanner has no flag that prints a secret.
 
+* The report line for a finding is
+  ``<location>: [<severity>/<rule>] <redacted-<rule>>``: it says which rule fired
+  where, and deliberately no character of the value - a partly masked preview
+  still publishes the first and last characters of a credential to every reader
+  of the log, which is the disclosure this scanner exists to prevent.
 * ``--reveal`` adds ``(sha256:<12 hex>)`` to each finding line. The fingerprint
   is a stable, unsalted SHA-256 prefix: it identifies which finding is which and
   lets an operator confirm a rotated value, but it cannot be used as the
@@ -91,7 +98,7 @@ import sys
 from collections import Counter
 from pathlib import Path
 
-SCANNER_VERSION = "1.3.0"
+SCANNER_VERSION = "1.4.0"
 
 # --------------------------------------------------------------------------- #
 # Neutral identity / allowlisted email domains
@@ -259,6 +266,31 @@ _CODE_KEYWORDS = {
 
 _RE_DOTTED_IDENT = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$")
 
+# A bare Python name: letters, digits and underscores only, no punctuation.
+_RE_PY_IDENT = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+
+# Words that mark a name as a credential in its own right even when it is shaped
+# like a code name (``my_super_secret_password``).
+_SECRET_WORDS = ("secret", "password", "passwd", "passphrase", "credential")
+
+
+def _is_code_name(value: str) -> bool:
+    """True for a bare identifier used as a value: code, not a credential.
+
+    ``token = _current_github_token()`` assigns the *result of a call*, and the
+    scanner only sees the name because the call's parentheses are outside the
+    credential charset. A name-shaped value is code when it is written the way
+    code is written: underscored, digit-free and not itself naming a secret.
+    A value that carries digits (a cloud access key, a hex blob) or that names a
+    secret stays a credential, so the rule is not weakened.
+    """
+    if not _RE_PY_IDENT.match(value):
+        return False
+    if "_" not in value or any(c.isdigit() for c in value):
+        return False
+    lowered = value.lower()
+    return not any(word in lowered for word in _SECRET_WORDS)
+
 
 def _looks_like_secret_value(value: str) -> bool:
     if value.startswith(("re.", "os.", "self.", "match.", "str(", "Path(")):
@@ -465,6 +497,76 @@ def _shannon_entropy(value: str) -> float:
     return -sum((n / length) * math.log2(n / length) for n in counts.values())
 
 
+#: A token that may continue past the match: the high-entropy rule matches 32+
+#: base64-ish characters, and a path segment may continue with a file name, a
+#: second extension or another segment.
+_TOKEN_CHARS = re.compile(r"[A-Za-z0-9._/+=-]+")
+#: One path segment of a repository path: a name, optionally with an extension.
+_PATH_SEGMENT = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]*")
+#: The words of a name: a CamelCase run splits into its parts, a trailing digit
+#: group is its own part.
+_NAME_WORDS = re.compile(r"[A-Z]+(?![a-z])|[A-Z][a-z]*|[a-z]+|[0-9]+")
+#: A lower-case letter followed by an upper-case one: the CamelCase mark that
+#: separates a name like ``ProductManager`` from a random mix of letters.
+_CAMEL_CASE = re.compile(r"[a-z][A-Z]")
+#: How many words a path segment may have before it stops reading as a name.
+_MAX_NAME_WORDS = 3
+#: A one-letter alphabetic part means a random mix, not a name.
+_MIN_NAME_WORD = 2
+
+
+def _token_around(line: str, index: int, length: int) -> str:
+    """The whole token the match at ``index`` sits in, or ``""``."""
+    for match in _TOKEN_CHARS.finditer(line):
+        if match.start() <= index and index + length <= match.end():
+            return match.group(0)
+    return ""
+
+
+def _is_path_name(token: str) -> bool:
+    """Does this token read as a repository path rather than as a random string?
+
+    Every segment must be a name: a word (or a few words in CamelCase) with an
+    optional extension. A random base64 run splits into many short fragments,
+    which is what tells the two apart.
+    """
+    if "/" not in token:
+        return False
+    segments = [segment for segment in token.split("/") if segment]
+    if not segments:
+        return False
+    for segment in segments:
+        if not _PATH_SEGMENT.fullmatch(segment):
+            return False
+        words = _NAME_WORDS.findall(segment.split(".")[0])
+        if not words or len(words) > _MAX_NAME_WORDS:
+            return False
+        if any(len(word) < _MIN_NAME_WORD and word.isalpha() for word in words):
+            return False
+    return True
+
+
+def _is_path_fragment(line: str, index: int, length: int) -> bool:
+    """Is the match a piece of a path, rather than a value in its own right?
+
+    The high-entropy rule matches 32+ base64-ish characters, so it also matches
+    the first 33 characters of a longer path: ``ProductManager/Artifacts/Harness2``
+    is the head of ``ProductManager/Artifacts/Harness2-Brief.md``. A credential
+    is a whole token, so two signals together are decisive - the token must read
+    as a path, and it must be a NAME (CamelCase, or cut out of a longer path).
+    A random base64 run reads as neither: it has too many fragments to be a
+    name, and it is a whole token.
+    """
+    whole = _token_around(line, index, length)
+    if not _is_path_name(whole):
+        return False
+    if len(whole) > length:
+        following = whole[length]
+        if following.isalnum() or following in "-_":
+            return True
+    return any(_CAMEL_CASE.search(part) for part in whole.split("/") if part)
+
+
 def _looks_like_secret(value: str, line: str = "", index: int = 0) -> bool:
     """Filter out hashes, identifiers, URL paths and natural words."""
     if len(value) < 32:
@@ -478,6 +580,11 @@ def _looks_like_secret(value: str, line: str = "", index: int = 0) -> bool:
         between = line[scheme + 3 : index]
         if not re.search(r"[\s\"']", between):
             return False
+    # A relative path is a path, not a secret. The rule matches the first 32+
+    # characters of a longer path, so the match has to be checked against the
+    # whole token it was cut from.
+    if _is_path_fragment(line, index, len(value)):
+        return False
     has_digit = any(c.isdigit() for c in value)
     has_upper = any(c.isupper() for c in value)
     has_lower = any(c.islower() for c in value)
@@ -511,14 +618,6 @@ def _email_allowed(value: str) -> bool:
     return any(domain.endswith(suffix) for suffix in _ALLOWED_EMAIL_SUFFIXES)
 
 
-def _mask(value: str) -> str:
-    if len(value) <= 4:
-        return "*" * len(value)
-    if len(value) <= 10:
-        return value[0] + "*" * (len(value) - 2) + value[-1]
-    return value[:3] + "*" * (len(value) - 6) + value[-3:]
-
-
 def _fingerprint(value: str, length: int = 12) -> str:
     """A stable, non-usable identifier for a matched value.
 
@@ -562,43 +661,49 @@ def write_reveal_file(path, pairs):
     return written
 
 
-def _clip(line: str, value: str, width: int = 160) -> str:
-    """A short, single-line context snippet around the match."""
-    index = line.find(value)
-    if index < 0:
-        return line[:width]
-    start = max(0, index - 40)
-    end = min(len(line), index + len(value) + 40)
-    snippet = line[start:end].strip()
-    if start > 0:
-        snippet = "..." + snippet
-    if end < len(line):
-        snippet = snippet + "..."
-    return snippet[:width]
-
-
 # --------------------------------------------------------------------------- #
 # Findings
 # --------------------------------------------------------------------------- #
 
 
+class Finding(dict):
+    """One report row, with the raw matched value held outside the mapping.
+
+    Every reporting sink serialises *items*: ``json.dumps(report)`` walks the
+    dict, the text report reads ``evidence``, and both end up in a CI log. A
+    value kept as an attribute therefore cannot be published by any of them, so
+    "the log never carries a secret" is a property of the shape rather than a
+    promise held by one ``pop`` before one ``print``. Everything that needs the
+    value itself - ``--reveal``, ``--reveal-to`` and the archive mask - reads
+    ``.raw`` explicitly, which is greppable and reviewable in one place each.
+    """
+
+    __slots__ = ("raw",)
+
+    def __init__(self, items, raw=""):
+        super().__init__(items)
+        self.raw = raw
+
+
 def make_finding(rule_id, severity, path, line_no, value, line, source, commit=None):
-    masked = _mask(value)
-    # Never ship the surrounding line: a second credential in the same window
-    # would be republished in plaintext (the scanner is published too).
-    context = ""
-    return {
-        "rule": rule_id,
-        "severity": severity,
-        "path": path,
-        "line": line_no,
-        "source": source,
-        "commit": commit,
-        "location": location(path, line_no, commit),
-        "evidence": masked,
-        "match": value,
-        "context": context,
-    }
+    # Not one character of the value, and never the surrounding line: the report
+    # names the rule the way the archive mask does, because a partly masked
+    # preview still hands the first and last characters of a credential to
+    # everyone who can read the log.
+    return Finding(
+        {
+            "rule": rule_id,
+            "severity": severity,
+            "path": path,
+            "line": line_no,
+            "source": source,
+            "commit": commit,
+            "location": location(path, line_no, commit),
+            "evidence": f"<redacted-{rule_id}>",
+            "context": "",
+        },
+        value,
+    )
 
 
 def location(path, line_no, commit=None):
@@ -664,7 +769,8 @@ def scan_lines(text, path, source, rules, allow, commit=None):
                         # A quoted passphrase may legitimately contain spaces.
                         if not re.search(r"\s", secret) and not _looks_like_secret_value(secret):
                             continue
-                    elif not _looks_like_secret_value(secret):
+                    elif _is_code_name(secret) or not _looks_like_secret_value(secret):
+                        # An unquoted name is a reference to a value, not the value.
                         continue
                     value = secret
                 if rule["id"] == "high-entropy-secret":
@@ -698,7 +804,9 @@ def scan_lines(text, path, source, rules, allow, commit=None):
                 if match:
                     candidate = match.group(1) or match.group(2)
                     if not _PLACEHOLDERS.match(candidate) and (
-                        match.group(1) is not None or _looks_like_secret_value(candidate)
+                        match.group(1) is not None
+                        or not _is_code_name(candidate)
+                        and _looks_like_secret_value(candidate)
                     ):
                         credential = candidate
             if credential and not any(p.search(credential) for p in allow):
@@ -861,18 +969,21 @@ def config_path_finding(rel, source, allow=(), commit=None):
     if any(pattern.search(rel) for pattern in allow):
         return None
     local_state = reason.startswith("local state")
-    return {
-        "rule": "local-state" if local_state else "local-config",
-        "severity": "high" if local_state else "critical",
-        "path": rel,
-        "line": 0,
-        "source": source,
-        "commit": commit,
-        "location": rel,
-        "evidence": rel,
-        "match": rel,
-        "context": reason,
-    }
+    return Finding(
+        {
+            "rule": "local-state" if local_state else "local-config",
+            "severity": "high" if local_state else "critical",
+            "path": rel,
+            "line": 0,
+            "source": source,
+            "commit": commit,
+            "location": rel,
+            # A path is the finding, not a credential: naming it is the report.
+            "evidence": rel,
+            "context": reason,
+        },
+        rel,
+    )
 
 
 def scan_tree(root, allow, stats=None):
@@ -888,18 +999,20 @@ def scan_tree(root, allow, stats=None):
             data = full.read_bytes()
         except OSError as exc:
             findings.append(
-                {
-                    "rule": "unreadable-tracked-file",
-                    "severity": "medium",
-                    "path": rel,
-                    "line": 0,
-                    "source": "tree",
-                    "commit": None,
-                    "location": rel,
-                    "evidence": rel,
-                    "match": rel,
-                    "context": f"tracked file could not be read: {exc}",
-                }
+                Finding(
+                    {
+                        "rule": "unreadable-tracked-file",
+                        "severity": "medium",
+                        "path": rel,
+                        "line": 0,
+                        "source": "tree",
+                        "commit": None,
+                        "location": rel,
+                        "evidence": rel,
+                        "context": f"tracked file could not be read: {exc}",
+                    },
+                    rel,
+                )
             )
             continue
         findings.extend(_scan_bytes(data, rel, "tree", allow))
@@ -1016,7 +1129,7 @@ def dedupe(findings):
     seen = set()
     unique = []
     for finding in findings:
-        key = (finding["rule"], finding["location"], finding["match"], finding.get("commit") or "")
+        key = (finding["rule"], finding["location"], finding.raw, finding.get("commit") or "")
         if key in seen:
             continue
         seen.add(key)
@@ -1103,13 +1216,12 @@ def main(argv=None):
     reveal_path = args.reveal_to
     reveal_values = []
     for finding in findings:
-        match = finding.pop("match", None)
-        if match is None:
+        if not finding.raw:
             continue
         if args.reveal:
-            finding["fingerprint"] = _fingerprint(match)
+            finding["fingerprint"] = _fingerprint(finding.raw)
         if reveal_path:
-            reveal_values.append((finding, match))
+            reveal_values.append((finding, finding.raw))
 
     reveal_written = 0
     if reveal_path:
@@ -1151,16 +1263,18 @@ def main(argv=None):
     else:
         if not args.quiet:
             for finding in findings:
-                # The unmasked value is never printed: stdout is a broadcast
-                # sink. --reveal only adds a non-usable fingerprint.
+                # The value is never printed in any form: stdout is a broadcast
+                # sink, so the report names the rule instead. --reveal only adds
+                # a non-usable fingerprint.
                 shown = finding["evidence"]
                 fingerprint = finding.get("fingerprint")
                 if fingerprint:
                     shown = f"{shown} ({fingerprint})"
-                print(
-                    f"{finding['location']}: [{finding['severity']}/"
-                    f"{finding['rule']}] {shown}  {finding.get('detail', '')}"
-                )
+                line = f"{finding['location']}: [{finding['severity']}/{finding['rule']}] {shown}"
+                detail = finding.get("detail", "")
+                if detail:
+                    line = f"{line}  {detail}"
+                print(line)
         state = "FAIL" if findings else "PASS"
         print(f"privacy_scan: {state} - {len(findings)} finding(s) in {', '.join(modes)}")
     return 1 if findings else 0

package/skills/teamwork/src/teamwork/bundle.py

@@ -31,16 +31,9 @@ HOST_DEFAULTS = {
     "agents": Path("~/.agents/skills/teamwork"),
 }
 
-#: Marker that identifies a directory as a skill bundle rather than a random tree.
-MARKERS = ("SKILL.md", "roles", "references", "templates")
-
 _SKIP_SUFFIXES = (".pyc", ".pyo")
 
 
-def looks_like_bundle(path: Path) -> bool:
-    return path.is_dir() and any((path / marker).exists() for marker in MARKERS)
-
-
 def _skip(path: Path) -> bool:
     if "__pycache__" in path.parts or any(p.endswith(".egg-info") for p in path.parts):
         return True

package/skills/teamwork/src/teamwork/config.py

@@ -182,6 +182,30 @@ SLOT_TTL_MINUTES = int(os.environ.get("TEAMWORK_SLOT_TTL_MINUTES", "90"))
 
 REVIEW_FAIL_LIMIT = int(os.environ.get("TEAMWORK_REVIEW_FAIL_LIMIT", "3"))
 
+# A review claim is a short work lease, not a provider slot. A lane that dies
+# mid-review must not freeze the deliverable for the 90-minute slot TTL.
+REVIEW_LEASE_MINUTES = int(os.environ.get("TEAMWORK_REVIEW_LEASE_MINUTES", "20"))
+
+# A role's shared memory has ONE revising instance at a time. The role file lock
+# makes a single write atomic; this lease is what holds the pen across several
+# commands, so an instance can finish one coherent memory update (`memory claim`
+# ... several `remember`/`forget` ... `memory release`) before a peer interleaves
+# its own view of the same file. A dead holder must not freeze the role forever,
+# so the lease expires and the next writer takes it over.
+MEMORY_LEASE_MINUTES = int(os.environ.get("TEAMWORK_MEMORY_LEASE_MINUTES", "30"))
+
+# A lease that outlives this long is "slow": the role's other instances may contest
+# it and the arbiter (the CTO) rules. The default is half a lease, so a normal
+# multi-entry update never trips it while a stuck lane is visible well before the
+# lease expires and frees itself.
+MEMORY_STALL_MINUTES = int(os.environ.get("TEAMWORK_MEMORY_STALL_MINUTES", "15"))
+
+# Who rules on a contested memory lease. The CTO owns engineering standards and the
+# build and lock policy, so a stuck writer is an engineering question rather than a
+# dispute between peers. The arbiter folds up the reporting line when the CTO is
+# unstaffed (a slim roster), and a party never rules its own lease.
+MEMORY_ARBITER_ROLE = os.environ.get("TEAMWORK_MEMORY_ARBITER", "cto")
+
 SHORT_CAP = int(os.environ.get("TEAMWORK_SHORT_CAP", "24"))
 
 LONG_CAP = int(os.environ.get("TEAMWORK_LONG_CAP", "64"))
@@ -382,13 +406,40 @@ DEFAULT_ROSTER_TIER = "slim"
 # Roles the gates cannot do without, whichever tier is chosen.
 ROSTER_REQUIRED = ("ceo", "developer", "tester", "reviewer")
 
-# Instances per role for a tier: reviewers get two so one verifies and another merges.
+# Instances per role for a tier: reviewers get two so the review queue fans out
+# and a sampled or high-risk deliverable gets a second independent verdict.
 ROSTER_INSTANCE_COUNT = {"reviewer": 2, "developer": 1, "tester": 1}
 
-SETTINGS_NON_PROVIDER = ("PulseMinutes", "Criteria")
+# Settings keys that are workspace policy, not provider concurrency limits: `slot`
+# reads every other key as a provider cap, so a new non-provider key must be
+# listed here or it becomes a phantom provider.
+SETTINGS_NON_PROVIDER = (
+    "PulseMinutes",
+    "Criteria",
+    "AlwaysOnBudgetKb",
+    "ReviewLeaseMinutes",
+    "MemoryLeaseMinutes",
+)
+
+# The always-on context cap, per instance, in KB: SKILL.md + the managed teamwork
+# block of AGENTS.md + the role charter + the role memory. `harness budget` reads
+# `AlwaysOnBudgetKb` from the team Settings.json and falls back to this.
+DEFAULT_ALWAYS_ON_BUDGET_KB = 120
 
 DEFAULT_BASE = "main"
 
+# The two git hook stages `hooks install` writes. `status`, `uninstall` and the
+# overwrite refusal all key on HOOK_MARKER, so a hook without that line is never
+# touched: it belongs to someone else.
+HOOK_STAGES = ("pre-commit", "pre-push")
+
+HOOK_MARKER = "teamwork-managed hook"
+
+# Git LFS threshold shared by the pre-commit hook and `commit --check-lfs`: one
+# MiB, because "1 MB" in decimal and binary differ by 4.8% and a threshold that
+# moves with the reader is not a rule (D-20261020-Architect-7).
+LFS_MAX_BYTES = 1024 * 1024
+
 REVIEW_STATUSES = ("open", "approved", "changes-requested", "merged", "closed")
 
 PRIORITY_ORDER = {"P0": 0, "P1": 1, "P2": 2, "P3": 3}