@spinabot/brigade 1.19.0 → 1.19.2

package/dist/security/media-path-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-path-guard.d.ts","sourceRoot":"","sources":["../../src/security/media-path-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAoCD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAyC3E"}
+{"version":3,"file":"media-path-guard.d.ts","sourceRoot":"","sources":["../../src/security/media-path-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAwCD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CA+C3E"}

package/dist/security/media-path-guard.js

@@ -32,9 +32,13 @@ const SENSITIVE_BASENAMES = new Set([
     "auth-profiles.json",
     "models.json",
     "exec-approvals.json",
+    // Brigade encryption key (stored outside ~/.brigade by design)
+    "encryption.key",
+    // Convex local backend admin key
+    "admin-key.txt",
 ]);
 /** Path fragments that mark a credentials directory (platform-normalized separators). */
-const SENSITIVE_DIR_NAMES = [".ssh", ".aws", ".gnupg", ".kube", ".docker", "gcloud"];
+const SENSITIVE_DIR_NAMES = [".ssh", ".aws", ".gnupg", ".kube", ".docker", "gcloud", ".convex-data"];
 /** Resolved-prefix roots that are off-limits regardless of filename. */
 function systemRoots() {
     if (process.platform === "win32") {
@@ -89,8 +93,12 @@ export function validateOutboundMediaPath(rawPath) {
         }
     }
     // Brigade's sealed per-agent auth subtree (…/agents/<id>/agent/…) and any
-    // auth* file under a .brigade dir — denied regardless of basename.
-    if (/[\\/]agents[\\/][^\\/]+[\\/]agent[\\/]/.test(resolved) || /[\\/]\.brigade[\\/].*auth/i.test(resolved)) {
+    // `auth` path component under a .brigade dir — denied regardless of basename.
+    // Walk the already-split segments (linear, no regex backtracking).
+    const sealedPerAgent = segments.some((seg, i) => seg === "agents" && i + 2 < segments.length && segments[i + 2] === "agent" && Boolean(segments[i + 1]));
+    const brigadeIdx = segments.indexOf(".brigade");
+    const authUnderBrigade = brigadeIdx >= 0 && segments.slice(brigadeIdx + 1).some((seg) => seg.includes("auth"));
+    if (sealedPerAgent || authUnderBrigade) {
         return { ok: false, reason: "refusing to attach from the credential store" };
     }
     return { ok: true };

package/dist/security/media-path-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-path-guard.js","sourceRoot":"","sources":["../../src/security/media-path-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,oCAAoC;IACpC,cAAc;IACd,WAAW;IACX,oBAAoB;IACpB,aAAa;IACb,qBAAqB;CACrB,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAErF,wEAAwE;AACxE,SAAS,WAAW;IACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;;YAC1D,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACxD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC9F,8EAA8E;IAC9E,6EAA6E;IAC7E,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE3D,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,8BAA8B;IAC9B,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,2EAA2E;IAC3E,+EAA+E;IAC/E,0DAA0D;IAC1D,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,GAAG,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAClE,CAAC;IACF,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,wCAAwC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"media-path-guard.js","sourceRoot":"","sources":["../../src/security/media-path-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,oCAAoC;IACpC,cAAc;IACd,WAAW;IACX,oBAAoB;IACpB,aAAa;IACb,qBAAqB;IACrB,+DAA+D;IAC/D,gBAAgB;IAChB,iCAAiC;IACjC,eAAe;CACf,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAErG,wEAAwE;AACxE,SAAS,WAAW;IACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;;YAC1D,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACxD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC9F,8EAA8E;IAC9E,6EAA6E;IAC7E,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE3D,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,8BAA8B;IAC9B,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,2EAA2E;IAC3E,+EAA+E;IAC/E,0DAA0D;IAC1D,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,GAAG,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAClE,CAAC;IACF,CAAC;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CACnC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAClH,CAAC;IACF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,gBAAgB,GAAG,UAAU,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/G,IAAI,cAAc,IAAI,gBAAgB,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spinabot/brigade",
-  "version": "1.19.0",
+  "version": "1.19.2",
   "description": "Brigade — your personal AI crew",
   "homepage": "https://brigade.spinabot.com",
   "author": "Spinabot <hello@brigade-agent.ai>",

package/scripts/convex-dev.mjs

@@ -19,7 +19,7 @@ import { mkdirSync, existsSync, writeFileSync, readFileSync, unlinkSync } from "
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { readFile, stat } from "node:fs/promises";
-import { extname, join, dirname, resolve } from "node:path";
+import { extname, join, dirname, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -235,12 +235,26 @@ const MIME = {
   ".woff2": "font/woff2",
 };
 
+// Confine a request-derived file path under DASHBOARD_DIR. `req.url` is
+// attacker-controllable (any local process can hit 127.0.0.1:6791), so a
+// decoded `..` segment must never let `join` escape the served root. Resolve
+// to an absolute path and reject anything outside DASHBOARD_DIR.
+const DASHBOARD_ROOT = resolve(DASHBOARD_DIR);
+function confineToDashboard(candidate) {
+  const resolved = resolve(candidate);
+  if (resolved === DASHBOARD_ROOT || resolved.startsWith(DASHBOARD_ROOT + sep)) {
+    return resolved;
+  }
+  return null;
+}
+
 const dashboardServer = createServer(async (req, res) => {
   try {
     let urlPath = decodeURIComponent((req.url ?? "/").split("?")[0]);
     if (urlPath === "/") urlPath = "/index.html";
 
-    let filePath = join(DASHBOARD_DIR, urlPath);
+    let filePath = confineToDashboard(join(DASHBOARD_DIR, urlPath));
+    if (!filePath) { res.writeHead(404); res.end("Not Found"); return; }
 
     // SPA fallback — if the requested path has no extension and doesn't exist,
     // try $path.html, then fall back to index.html.
@@ -248,11 +262,12 @@ const dashboardServer = createServer(async (req, res) => {
     try { st = await stat(filePath); } catch {}
     if (!st || st.isDirectory()) {
       const candidates = [
-        filePath + ".html",
-        join(filePath, "index.html"),
-        join(DASHBOARD_DIR, "index.html"),
+        confineToDashboard(filePath + ".html"),
+        confineToDashboard(join(filePath, "index.html")),
+        join(DASHBOARD_ROOT, "index.html"),
       ];
       for (const c of candidates) {
+        if (!c) continue;
         try {
           const s = await stat(c);
           if (s.isFile()) { filePath = c; st = s; break; }
@@ -294,8 +309,11 @@ const dashboardServer = createServer(async (req, res) => {
     }
     res.end(await readFile(filePath));
   } catch (err) {
+    // Log the detail locally; never echo the raw error (path/stack) to the
+    // HTTP response.
+    console.error(`\x1b[31m▌ dashboard request failed: ${String(err)}\x1b[0m`);
     res.writeHead(500);
-    res.end(String(err));
+    res.end("Internal Server Error");
   }
 });
 

package/skills/coding-agent/SKILL.md

@@ -208,7 +208,7 @@ bash pty:true workdir:~/project command:"opencode run 'Your task'"
 ## Pi Coding Agent
 
 ```bash
-# Install: npm install -g @mariozechner/pi-coding-agent
+# Install: npm install -g @earendil-works/pi-coding-agent
 bash pty:true workdir:~/project command:"pi 'Your task'"
 
 # Non-interactive mode (PTY still recommended)