@te-river/opencode-team-mode 1.5.0 → 1.5.1

package/dist/envprotect.js

@@ -0,0 +1,467 @@
+/**
+ * R6 — code-level environment-variable read protection for Team mode.
+ *
+ * HUMAN-approved feature: in Team mode, EVERY path the model can use to
+ * read environment variables / env files is intercepted in code, before
+ * the tool runs, independent of prompt compliance. This hook throws inside
+ * `tool.execute.before`, which opencode (verified live on 1.18.29) turns
+ * into a failed tool call whose error text is returned to the model — so
+ * the block is hard, not advisory.
+ *
+ * Surfaces covered (bash + PowerShell dialects, matched against the bash
+ * tool's `args.command`, and against path-class args of the read / grep /
+ * glob / list tools):
+ *   1. explicit env commands: `env` — a dump whenever no outside command
+ *      word follows: flags/assignments only (`env -0`, `env -u HOME`,
+ *      `env FOO=bar`) or a command word that is itself `env`/`printenv`
+ *      (`env printenv`); a real launcher (`env node app.js`, `env -i node
+ *      app.js`) passes — `printenv`, bare `set` (sh context only —
+ *      PowerShell `Set-*` cmdlets are never matched), `declare -p` and
+ *      its dump synonyms `typeset -p` / `export -p` / `local -p` (flags
+ *      may be split: `declare -x -p FOO`), and the PowerShell `env:`
+ *      drive via Get-ChildItem / gci / dir / ls / Get-Item / gi /
+ *      Get-Content / gc / cat / type (flags and optional quotes allowed
+ *      between cmdlet and drive: `Get-Content 'env:HOME'`).  The same
+ *      statement heads are caught behind statement noise: subshells and
+ *      groups (`(env)`, `{ env; }`), escaped commands (`\env`), the `time`
+ *      keyword prefix, and command substitution (`$(printenv)`, backticks).
+ *   2. `$env:` / `${env:...}` expansion (PowerShell);
+ *   3. strict mode only: `${VAR}` and `$ALLCAPS_VAR` expansion;
+ *   4. env-file paths: `.env`, `.env.*`, `*.env`, `.bashrc`,
+ *      `.bash_profile`, `.profile`, `.zshrc`, `.zprofile`, `.zshenv`
+ *      (checked-in template copies like `.env.example` are exempt, and
+ *      code identifiers like `process.env` are not files).
+ *
+ * TeamMode's own tm_* tools (tm_read / tm_grep / tm_bash) are aliased onto
+ * read/grep/bash in `inspectToolCall`, so this interception covers them
+ * identically — the plugin tools can never serve as an R6 bypass.
+ *
+ * Known limitation (accepted, documented): interpreter execution paths —
+ * `bash -c "env"`, `node -e 'process.env'`, `python -c "import os; ..."` —
+ * are NOT intercepted; the pattern surface stops at the command line
+ * itself.  One decode pass covers URL-encoded names (`/%2Eenv`); a double
+ * encoding (`/%252Eenv`) and a quoted dump head behind `env`
+ * (`env 'printenv'`) stay ahead of the matcher by design.
+ *
+ * Configuration (read by the PLUGIN at startup — this is program-level
+ * configuration of the tool itself, the same category as the ttlDays
+ * option below; it is NOT what R6 defends against, which is the MODEL
+ * reading environment variables through tool calls at runtime):
+ *   - `TM_ENV_PROTECT`       = "strict" (default) | "standard" | "off";
+ *     unknown values fail closed into strict.
+ *   - `TM_ENV_PROTECT_EXTRA_DENY` = semicolon-separated user regexes,
+ *     applied to every scanned string in any non-off mode.
+ *
+ * Audit red line (HUMAN privacy constraint): every interception is logged
+ * via `client.app.log()` (level "warn", service "team-mode-env-protect")
+ * recording ONLY the tool name and the pattern category. Command text,
+ * paths, variable names and values are NEVER logged — the audit trail must
+ * answer "what class of read was blocked", and must not become a place
+ * where secrets accumulate.
+ */
+/** Audit log service identifier (also the query key for "what was blocked"). */
+export const ENV_PROTECT_SERVICE = "team-mode-env-protect";
+/**
+ * Fixed structured message returned to the model on every block.  The
+ * category is appended as a machine-readable suffix; tests pin both.
+ */
+export const ENV_PROTECT_MESSAGE = "TeamMode R6 env protection: 环境变量读取已被拦截。需要变量值请向 HUMAN 申请。";
+/** Pattern categories surfaced in the block message and the audit log. */
+export const CATEGORY_BASH_ENV_COMMAND = "bash-env-command";
+export const CATEGORY_BASH_ENV_EXPANSION = "bash-env-expansion";
+export const CATEGORY_ENV_FILE_PATH = "env-file-path";
+export const CATEGORY_EXTRA_DENY = "extra-deny";
+/**
+ * Resolve the protection mode.  Only exact "standard" / "off" switch those
+ * modes on; everything else (unset, typos, wrong case) fails CLOSED into
+ * strict — a mistyped opt-out must never disable the red line.
+ */
+export function resolveEnvProtectMode(raw) {
+    if (raw === "standard")
+        return "standard";
+    if (raw === "off")
+        return "off";
+    return "strict";
+}
+/**
+ * Parse `TM_ENV_PROTECT_EXTRA_DENY` (semicolon-separated regex bodies).
+ * Invalid regexes are skipped rather than crashing plugin startup; the
+ * remaining rules still apply.  Empty/absent input yields no extra rules.
+ */
+export function parseExtraDeny(raw) {
+    if (typeof raw !== "string")
+        return [];
+    const rules = [];
+    for (const part of raw.split(";")) {
+        const body = part.trim();
+        if (!body)
+            continue;
+        try {
+            rules.push(new RegExp(body));
+        }
+        catch {
+            /* user regex failed to compile — skip it, keep the rest */
+        }
+    }
+    return rules;
+}
+/** The block error handed back to the model (fixed text + category tag). */
+export function envProtectError(category) {
+    return new Error(`${ENV_PROTECT_MESSAGE} [category=${category}]`);
+}
+// ---------- env-file path matching ----------
+/** Shell/rc basenames whose content is effectively an env dump. */
+const ENV_FILE_BASENAMES = new Set([
+    ".bashrc",
+    ".bash_profile",
+    ".profile",
+    ".zshrc",
+    ".zprofile",
+    ".zshenv",
+]);
+/** Checked-in template suffixes — documentation copies, not real secrets. */
+const ENV_TEMPLATE_SUFFIX = /\.(?:example|sample|template|dist)$/;
+/**
+ * Code identifiers that merely end in ".env" and name an object, not a
+ * file (`process.env`, `import.meta.env`, ...).  The escaped form is
+ * listed too because a grep pattern like `process\.env` survives
+ * tokenization with its backslash.
+ */
+const ENV_IDENTIFIER = /^(?:process|deno|bun|os|import\.meta)\.env$/i;
+/**
+ * True when the value points at an env file.  Matches on the BASENAME with
+ * both separators handled; URL query/fragment tails are cut first so
+ * `https://x/.env?raw=1` matches the same basename as a plain path, and
+ * asterisks are stripped so glob patterns like "*.env" or a recursive deep
+ * form of ".env.local" are caught by the same matcher as real paths.
+ * (Note: glob spellings are written without backticks here — a double-star
+ * + slash inside JSDoc would close the comment block early.)
+ */
+export function isEnvFilePath(raw) {
+    const value = String(raw ?? "")
+        // one percent-decode pass FIRST, so URL-encoded names like
+        // `https://x/%2Eenv` land on the same basename as the plain path
+        // (single pass only: `%252E` decodes to `%2E` and stays encoded)
+        .replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+        .replace(/[?#].*$/, "")
+        .replace(/\*/g, "")
+        .trim();
+    if (!value)
+        return false;
+    // A code identifier like `process.env` is not a file path, however it is
+    // segmented.  The unescaped form matters because a grep pattern spelled
+    // `process\.env` would otherwise split at the backslash into path +
+    // basename `.env` and slip past the identifier check below.
+    if (ENV_IDENTIFIER.test(value) || ENV_IDENTIFIER.test(value.replace(/\\/g, ""))) {
+        return false;
+    }
+    const segments = value.split(/[\\/]/);
+    const base = (segments[segments.length - 1] || "").toLowerCase();
+    if (!base)
+        return false;
+    if (base === ".env")
+        return true;
+    if (base.startsWith(".env.")) {
+        // `.env.example` and friends are safe checked-in documentation
+        if (ENV_TEMPLATE_SUFFIX.test(base))
+            return false;
+        return true;
+    }
+    if (base.endsWith(".env")) {
+        if (ENV_IDENTIFIER.test(base) || ENV_IDENTIFIER.test(base.replace(/\\/g, ""))) {
+            return false;
+        }
+        return true;
+    }
+    return ENV_FILE_BASENAMES.has(base);
+}
+// ---------- bash command classification ----------
+/**
+ * Split a command into shell segments so compound statements like
+ * `cd /x && printenv` are checked at every statement boundary.
+ */
+function splitSegments(command) {
+    return command.split(/&&|\|\||[;\n|&]/);
+}
+/**
+ * First token + remainder of one segment.  Statement noise is peeled off
+ * until stable so the real statement head surfaces: subshell/group
+ * openers and closers (`(env)`, `{ env; }`), escaped commands (`\env`),
+ * and the `time` keyword prefix (`time (env)` needs two passes).  Leading
+ * `VAR=value` assignment prefixes are skipped so `FOO=1 env` is still
+ * recognized as an env dump.
+ */
+function commandToken(segment) {
+    let s = segment.trim();
+    for (;;) {
+        for (;;) {
+            const next = s
+                .replace(/^[({\\]+/, "")
+                .replace(/[)}]+$/, "")
+                .replace(/^time\s+/, "")
+                .trim();
+            if (next === s)
+                break;
+            s = next;
+        }
+        const sp = s.search(/\s/);
+        const token = sp === -1 ? s : s.slice(0, sp);
+        const isAssignment = /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);
+        if (!isAssignment)
+            return { token, rest: sp === -1 ? "" : s.slice(sp).trim() };
+        s = sp === -1 ? "" : s.slice(sp).trim();
+        if (!s)
+            return { token: "", rest: "" };
+    }
+}
+/**
+ * env options whose value is a SEPARATE token (GNU env: `-u NAME`,
+ * `-S STRING`, `-C DIR`, long spellings included) — without this table the
+ * value token would be mistaken for the launched command word and a dump
+ * like `env -u HOME` would pass as a launcher.
+ */
+const ENV_VALUE_OPTS = new Set(["u", "s", "c", "--unset", "--split-string", "--chdir"]);
+/**
+ * Classify the argument tail of an `env` invocation.  True (dump) when no
+ * outside command word remains: a bare `env`, flags/assignments only
+ * (`env -0`, `env -i`, `env -u HOME`, `env FOO=bar`), or when the command
+ * word is itself `env`/`printenv` (`env printenv`, `env -i env`) — the
+ * single-token bypass of the bare-dump rule.  A real launcher — the first
+ * non-flag, non-assignment token names any other program (`env node
+ * app.js`, `env -i node app.js`) — returns false and stays allowed.
+ */
+function envRestIsDump(rest) {
+    const tokens = rest.split(/\s+/).filter(Boolean);
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
+            continue;
+        if (token.startsWith("-")) {
+            const shortTakesValue = /^-[a-z0-9]+$/i.test(token) &&
+                [...token.slice(1)].some((ch) => ENV_VALUE_OPTS.has(ch.toLowerCase()));
+            if ((shortTakesValue || ENV_VALUE_OPTS.has(token.toLowerCase())) && i + 1 < tokens.length) {
+                i++;
+            }
+            continue;
+        }
+        const cmd = token.toLowerCase();
+        return cmd === "env" || cmd === "printenv";
+    }
+    return true;
+}
+/**
+ * Statement-head env dumps.  Case matters for `set`: the exact lowercase
+ * bare `set` (no arguments) is the sh builtin that prints every variable,
+ * while PowerShell `Set-*` cmdlets and `set -euo pipefail` style flags are
+ * never variable dumps and must pass.  `env`/`printenv` are matched
+ * case-insensitively.  A pathed `/usr/bin/env` is a program launcher, not
+ * a dump, and stays allowed.  `env` dumps when no outside command word
+ * follows (see envRestIsDump); `env <command>` is a launcher and passes.
+ * `declare -p` prints variable definitions in reusable form, and so do its
+ * synonyms `typeset -p` / `export -p` / `local -p` — with the flag allowed
+ * to be split from `-p` by one other option (`declare -x -p FOO`).
+ */
+function isEnvDumpStatement(token, rest) {
+    if (!token)
+        return false;
+    const lower = token.toLowerCase();
+    if (lower === "env" && !token.includes("/")) {
+        return envRestIsDump(rest);
+    }
+    if (lower === "printenv")
+        return true;
+    if (lower === "declare" || lower === "typeset" || lower === "export" || lower === "local") {
+        return /^\s*(?:-[a-z]+\s+)?-[a-z]*p[a-z]*\b/.test(` ${rest}`);
+    }
+    if (token === "set")
+        return rest === "";
+    return false;
+}
+/** PowerShell `env:` drive access without the `$` prefix.  Optional
+ *  parameter flags and optional quotes between the cmdlet and the drive
+ *  (`Get-Content -Path env:HOME`, `Get-Content 'env:HOME'`, `ls env:`) are
+ *  part of the same read. */
+const PS_ENV_DRIVE = /(?:^|[\s;&|("'`])(?:get-childitem|gci|dir|ls|get-item|gi|get-content|gc|cat|type)\s+(?:-[A-Za-z]+\s+)*['"]?env:/i;
+/** `$env:` / `${env:...}` expansion (PowerShell), case-insensitive like
+ *  the drive itself. */
+const PS_ENV_EXPANSION = /\$\{?env:/i;
+/**
+ * Command substitutions that run a command line of their own.  Captured
+ * content excludes parens, so there is no nesting and the recursive
+ * classification in classifyBashCommand cannot loop.
+ */
+const COMMAND_SUBSTITUTION = /\$\(([^()]*)\)|`([^`]*)`/g;
+/** strict-mode brace expansion, e.g. `${HOME}`. */
+const BRACE_EXPANSION = /\$\{[^}]*\}/;
+/** strict-mode bare all-caps variable, e.g. `$API_KEY` (also `$F`, `$_`).
+ *  The lookahead pins the END of the identifier so mixed-case names like
+ *  `$Path` never match on their capitalized prefix alone. */
+const ALLCAPS_EXPANSION = /\$[A-Z_][A-Z0-9_]*(?![A-Za-z0-9_])/;
+/**
+ * Tokenize a bash command and report whether any token names an env file —
+ * catches `cat .env`, `head -50 .env.local`, `curl https://x/.env`,
+ * `X=.env ./run` (the token survives because `=`, `.`, `/`, `:` stay inside
+ * tokens).  Quote/glob leftovers are stripped per token.
+ */
+function bashEnvFileHit(command) {
+    const tokens = command.split(/[\s'"`|;&<>()]+/);
+    for (const rawToken of tokens) {
+        const token = rawToken.replace(/^[*'"`]+|[*'"`]+$/g, "");
+        if (token && isEnvFilePath(token))
+            return true;
+    }
+    return false;
+}
+/**
+ * Classify a bash/PowerShell command string.  Returns the pattern category
+ * when the command must be blocked, null when it may pass.  `off` is
+ * handled by the caller; user extra-deny rules take precedence.
+ */
+export function classifyBashCommand(command, mode, extra = []) {
+    const text = String(command ?? "");
+    if (!text)
+        return null;
+    for (const rule of extra) {
+        if (rule.test(text))
+            return CATEGORY_EXTRA_DENY;
+    }
+    for (const segment of splitSegments(text)) {
+        const { token, rest } = commandToken(segment);
+        if (isEnvDumpStatement(token, rest))
+            return CATEGORY_BASH_ENV_COMMAND;
+    }
+    // command substitution runs its own command line: classify the inner
+    // text recursively (`$(printenv) PATH`, backtick `cat .env`)
+    for (const match of text.matchAll(COMMAND_SUBSTITUTION)) {
+        const inner = match[1] ?? match[2];
+        if (!inner)
+            continue;
+        const innerCategory = classifyBashCommand(inner, mode, extra);
+        if (innerCategory)
+            return innerCategory;
+    }
+    if (PS_ENV_DRIVE.test(text))
+        return CATEGORY_BASH_ENV_COMMAND;
+    if (PS_ENV_EXPANSION.test(text))
+        return CATEGORY_BASH_ENV_EXPANSION;
+    if (mode === "strict") {
+        if (BRACE_EXPANSION.test(text))
+            return CATEGORY_BASH_ENV_EXPANSION;
+        if (ALLCAPS_EXPANSION.test(text))
+            return CATEGORY_BASH_ENV_EXPANSION;
+    }
+    if (bashEnvFileHit(text))
+        return CATEGORY_ENV_FILE_PATH;
+    return null;
+}
+// ---------- file-tool path classification ----------
+/**
+ * Path-class argument keys scanned defensively across read / grep / glob /
+ * list (read uses `filePath`; the others historically use `path`, and
+ * `pattern` / `include` select files for glob / grep).  Keys outside this
+ * set (descriptions, notes) are never scanned.
+ */
+const PATH_LIKE_KEYS = /^(filepath|path|file|dir|directory|pattern|include)$/i;
+/**
+ * Classify the path-class arguments of a file tool.  Returns the pattern
+ * category when the call must be blocked, null when it may pass.
+ */
+export function classifyPathFields(args, mode, extra = []) {
+    if (!args || typeof args !== "object")
+        return null;
+    for (const [key, value] of Object.entries(args)) {
+        if (typeof value !== "string" || !value)
+            continue;
+        if (!PATH_LIKE_KEYS.test(key))
+            continue;
+        for (const rule of extra) {
+            if (rule.test(value))
+                return CATEGORY_EXTRA_DENY;
+        }
+        if (isEnvFilePath(value))
+            return CATEGORY_ENV_FILE_PATH;
+    }
+    return null;
+}
+// ---------- tool-call level routing ----------
+/** File tools whose path-class arguments are scanned for env files. */
+const PATH_SCAN_TOOLS = new Set(["read", "grep", "glob", "list"]);
+/**
+ * TeamMode's own tm_* tools alias onto the built-in surface so the SAME
+ * interception applies to them (anti-backdoor: tm_read/tm_grep/tm_bash must
+ * never become an R6 bypass by virtue of a different tool name).  The tools
+ * ALSO re-check with the same matchers inside their own pipelines — this
+ * hook-level alias is the outer defense layer.
+ */
+const TM_TOOL_ALIASES = {
+    tm_read: "read",
+    tm_grep: "grep",
+    tm_bash: "bash",
+};
+/**
+ * Top routing: tool name + tool args -> category to block, or null to pass.
+ * `off` always passes (the hook stays installed but is a no-op).
+ */
+export function inspectToolCall(tool, args, mode, extra = []) {
+    if (mode === "off")
+        return null;
+    const rawName = String(tool ?? "").trim().toLowerCase();
+    const name = TM_TOOL_ALIASES[rawName] ?? rawName;
+    if (name === "bash") {
+        const command = args?.command;
+        return classifyBashCommand(String(command ?? ""), mode, extra);
+    }
+    if (PATH_SCAN_TOOLS.has(name)) {
+        return classifyPathFields(args, mode, extra);
+    }
+    return null;
+}
+/**
+ * Best-effort audit of one interception.  Records ONLY the tool name and
+ * the pattern category (privacy red line: never command text, paths,
+ * variable names or values); the message embeds the service id itself so
+ * file-backed log sinks that drop the `service` field stay greppable.  A
+ * failing audit endpoint must never turn a block into a pass-through, so
+ * every failure is swallowed after the call attempt.
+ */
+async function auditInterception(client, tool, category) {
+    try {
+        // Call the method THROUGH the app object.  Destructuring `app.log`
+        // first would drop the SDK's `this` binding, so every real call died
+        // inside the SDK and was silently swallowed here — zero audit entries.
+        const app = client?.app;
+        if (!app || typeof app.log !== "function")
+            return;
+        await app.log({
+            body: {
+                level: "warn",
+                service: ENV_PROTECT_SERVICE,
+                message: `${ENV_PROTECT_SERVICE} :: ${tool} :: ${category}`,
+            },
+        });
+    }
+    catch {
+        /* audit is best-effort; the block below still takes effect */
+    }
+}
+/**
+ * Build the `tool.execute.before` hook.  The hook is installed in every
+ * mode; with mode "off" it returns immediately and everything passes.
+ * When a block triggers, the audit entry is written first, then the fixed
+ * structured error is thrown so opencode surfaces it to the model as the
+ * failed tool result.
+ */
+export function createEnvProtectHook(client, mode, extra = []) {
+    return async (input, output) => {
+        if (mode === "off")
+            return;
+        const tool = String(input?.tool ?? "");
+        const args = output?.args;
+        const category = inspectToolCall(tool, args, mode, extra);
+        if (!category)
+            return;
+        await auditInterception(client, tool, category);
+        throw envProtectError(category);
+    };
+}
+//# sourceMappingURL=envprotect.js.map

package/dist/envprotect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envprotect.js","sourceRoot":"","sources":["../src/envprotect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA;AAE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,0DAA0D,CAAA;AAE5D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAA;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAA;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AACrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAI/C;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,UAAU,CAAA;IACzC,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC/B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACxB,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,IAAI,KAAK,CAAC,GAAG,mBAAmB,cAAc,QAAQ,GAAG,CAAC,CAAA;AACnE,CAAC;AAED,+CAA+C;AAE/C,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,SAAS;IACT,eAAe;IACf,UAAU;IACV,QAAQ;IACR,WAAW;IACX,SAAS;CACV,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,qCAAqC,CAAA;AAEjE;;;;;GAKG;AACH,MAAM,cAAc,GAAG,8CAA8C,CAAA;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;SAChE,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACjF,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,IAAI,EAAE,CAAA;IACT,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,+DAA+D;QAC/D,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACrC,CAAC;AAED,oDAAoD;AAEpD;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IACtB,SAAS,CAAC;QACR,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,CAAC;iBACX,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;iBACvB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;iBACrB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;iBACvB,IAAI,EAAE,CAAA;YACT,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAK;YACrB,CAAC,GAAG,IAAI,CAAA;QACV,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACzB,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC5C,MAAM,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3D,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;QAC9E,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACvC,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;IACxC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvF;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QACpD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,eAAe,GACnB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC3B,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;YACxE,IAAI,CAAC,eAAe,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC1F,CAAC,EAAE,CAAA;YACL,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QAC/B,OAAO,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,UAAU,CAAA;IAC5C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IACjC,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC1F,OAAO,qCAAqC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,KAAK,EAAE,CAAA;IACvC,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;6BAG6B;AAC7B,MAAM,YAAY,GAChB,kHAAkH,CAAA;AAEpH;wBACwB;AACxB,MAAM,gBAAgB,GAAG,YAAY,CAAA;AAErC;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,2BAA2B,CAAA;AAExD,mDAAmD;AACnD,MAAM,eAAe,GAAG,aAAa,CAAA;AAErC;;6DAE6D;AAC7D,MAAM,iBAAiB,GAAG,oCAAoC,CAAA;AAE9D;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC/C,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IAChD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,IAAoB,EACpB,QAAkB,EAAE;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,mBAAmB,CAAA;IACjD,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO,yBAAyB,CAAA;IACvE,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAC7D,IAAI,aAAa;YAAE,OAAO,aAAa,CAAA;IACzC,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,yBAAyB,CAAA;IAC7D,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,2BAA2B,CAAA;IAEnE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,2BAA2B,CAAA;QAClE,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,2BAA2B,CAAA;IACtE,CAAC;IAED,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAA;IACvD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,sDAAsD;AAEtD;;;;;GAKG;AACH,MAAM,cAAc,GAAG,uDAAuD,CAAA;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAyC,EACzC,IAAoB,EACpB,QAAkB,EAAE;IAEpB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,SAAQ;QACjD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAQ;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,mBAAmB,CAAA;QAClD,CAAC;QACD,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,sBAAsB,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gDAAgD;AAEhD,uEAAuE;AACvE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEjE;;;;;;GAMG;AACH,MAAM,eAAe,GAA2B;IAC9C,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;CAChB,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,IAAyC,EACzC,IAAoB,EACpB,QAAkB,EAAE;IAEpB,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAA;IAChD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAI,IAA0C,EAAE,OAAO,CAAA;QACpE,OAAO,mBAAmB,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAWD;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAC9B,MAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,IAAI,CAAC;QACH,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,GAAG,GAAI,MAAyC,EAAE,GAAG,CAAA;QAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU;YAAE,OAAM;QACjD,MAAM,GAAG,CAAC,GAAG,CAAC;YACZ,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,GAAG,mBAAmB,OAAO,IAAI,OAAO,QAAQ,EAAE;aAC5D;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,IAAoB,EACpB,QAAkB,EAAE;IAEpB,OAAO,KAAK,EAAE,KAAc,EAAE,MAAe,EAAiB,EAAE;QAC9D,IAAI,IAAI,KAAK,KAAK;YAAE,OAAM;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAE,KAAmC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACrE,MAAM,IAAI,GAAI,MAAoD,EAAE,IAAI,CAAA;QACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ;YAAE,OAAM;QACrB,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC/C,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -6,7 +6,11 @@
  *
  *   export default {
  *     id: "team-mode",                     → Desktop plugin display name
- *     server: async (input, options) => ({ config(cfg) { ...inject... } })
+ *     server: async (input, options) => ({
+ *       config(cfg) { ...inject agents/commands... },
+ *       "tool.execute.before"(...) { ...R6 env protection... },
+ *       tool: { tm_read, tm_grep, tm_bash, tm_fetch },   → JIT layer-2 tools
+ *     })
  *   }
  *
  * `server()` is the ONLY function the loader calls; a `setup` property is

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,YAAY,CAAA;AA6BhE,QAAA,MAAM,MAAM,EAAE,cAyCb,CAAA;AAED,eAAe,MAAM,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,YAAY,CAAA;AAmChE,QAAA,MAAM,MAAM,EAAE,cAuEb,CAAA;AAED,eAAe,MAAM,CAAA"}

package/dist/index.js

@@ -6,7 +6,11 @@
  *
  *   export default {
  *     id: "team-mode",                     → Desktop plugin display name
- *     server: async (input, options) => ({ config(cfg) { ...inject... } })
+ *     server: async (input, options) => ({
+ *       config(cfg) { ...inject agents/commands... },
+ *       "tool.execute.before"(...) { ...R6 env protection... },
+ *       tool: { tm_read, tm_grep, tm_bash, tm_fetch },   → JIT layer-2 tools
+ *     })
  *   }
  *
  * `server()` is the ONLY function the loader calls; a `setup` property is
@@ -27,6 +31,8 @@
 import { agents } from "./agents.js";
 import { commands } from "./commands.js";
 import { startBlackboardMaintenance, resolveTtlMs, DEFAULT_TTL_DAYS, } from "./blackboard.js";
+import { createEnvProtectHook, parseExtraDeny, resolveEnvProtectMode, } from "./envprotect.js";
+import { createTmTools } from "./tm/index.js";
 /** Runtime addendum to the team prompt: concrete board + TTL (hybrid mode). */
 function blackboardNote(root, ttlDays) {
     return [
@@ -57,6 +63,24 @@ const plugin = {
         const ttlDays = Math.round(ttlMs / (24 * 60 * 60 * 1000)) || DEFAULT_TTL_DAYS;
         const boardRoot = startBlackboardMaintenance(directory, ttlMs);
         const note = blackboardNote(boardRoot, ttlDays);
+        // ---------- R6 env protection (code-level interception) ----------
+        // Reading TM_ENV_PROTECT / TM_ENV_PROTECT_EXTRA_DENY here is the PLUGIN
+        // configuring ITSELF at startup — program-level configuration, the same
+        // category as the ttlDays option.  R6 exists to stop the MODEL reading
+        // environment variables through tool calls; these two reads are not
+        // that and are out of scope of the protection.
+        const envProtectMode = resolveEnvProtectMode(process.env.TM_ENV_PROTECT);
+        const envProtectExtra = parseExtraDeny(process.env.TM_ENV_PROTECT_EXTRA_DENY);
+        const envProtectHook = createEnvProtectHook(input?.client, envProtectMode, envProtectExtra);
+        // ---------- JIT layer-2 tools (tm_read / tm_grep / tm_bash / tm_fetch) ----------
+        // T0.4-verified static registration: server() hooks gain a `tool` segment.
+        // The R6 mode/extra resolved above are passed in so the tm_* pipelines
+        // share the SAME interception source as the built-in tools (anti-backdoor:
+        // the global hook ALSO aliases tm_* onto read/grep/bash — see envprotect).
+        const tmRuntime = await createTmTools(input, {
+            mode: envProtectMode,
+            extra: envProtectExtra,
+        });
         return {
             // ---------- v1 config hook: inject agents & commands ----------
             config(cfg) {
@@ -84,6 +108,10 @@ const plugin = {
                     cfg.default_agent = "team";
                 }
             },
+            // ---------- R6: block the model's env-var read paths in code ----------
+            "tool.execute.before": envProtectHook,
+            // ---------- JIT layer-2: tm_read / tm_grep / tm_bash / tm_fetch ----------
+            tool: tmRuntime.tools,
         };
     },
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AAExB,+EAA+E;AAC/E,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,OAAO;QACL,EAAE;QACF,EAAE;QACF,kDAAkD;QAClD,qBAAqB,IAAI,IAAI;QAC7B,oFAAoF;QACpF,4EAA4E;QAC5E,mEAAmE;QACnE,iFAAiF;QACjF,mFAAmF;QACnF,uEAAuE;QACvE,kFAAkF;QAClF,mBAAmB;QACnB,yEAAyE,OAAO,gCAAgC;QAChH,sFAAsF;KACvF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,MAAM,GAAmB;IAC7B,EAAE,EAAE,WAAW;IAEf,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,wEAAwE;QACxE,MAAM,SAAS,GACb,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAChE,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QACnB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,gBAAgB,CAAA;QAC7E,MAAM,SAAS,GAAG,0BAA0B,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAE/C,OAAO;YACL,iEAAiE;YACjE,MAAM,CAAC,GAAmB;gBACxB,IAAI,CAAC,GAAG,CAAC,KAAK;oBAAE,GAAG,CAAC,KAAK,GAAG,EAAE,CAAA;gBAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjD,mEAAmE;oBACnE,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBAC7B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;wBAChB,GAAG,GAAG;wBACN,MAAM,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;qBACjE,CAAA;gBACH,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,OAAO;oBAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnD,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBAC/B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;gBACzB,CAAC;gBAED,uEAAuE;gBACvE,MAAM,OAAO,GAAG,OAAO,EAAE,YAAY,KAAK,KAAK,CAAA;gBAC/C,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,CAAC,EAAE,CAAC;oBACrE,GAAG,CAAC,aAAa,GAAG,MAAM,CAAA;gBAC5B,CAAC;YACH,CAAC;SACF,CAAA;IACH,CAAC;CACF,CAAA;AAED,eAAe,MAAM,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,+EAA+E;AAC/E,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,OAAO;QACL,EAAE;QACF,EAAE;QACF,kDAAkD;QAClD,qBAAqB,IAAI,IAAI;QAC7B,oFAAoF;QACpF,4EAA4E;QAC5E,mEAAmE;QACnE,iFAAiF;QACjF,mFAAmF;QACnF,uEAAuE;QACvE,kFAAkF;QAClF,mBAAmB;QACnB,yEAAyE,OAAO,gCAAgC;QAChH,sFAAsF;KACvF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,MAAM,GAAmB;IAC7B,EAAE,EAAE,WAAW;IAEf,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,wEAAwE;QACxE,MAAM,SAAS,GACb,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAChE,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QACnB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,gBAAgB,CAAA;QAC7E,MAAM,SAAS,GAAG,0BAA0B,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAE/C,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,+CAA+C;QAC/C,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACxE,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;QAC7E,MAAM,cAAc,GAAG,oBAAoB,CACzC,KAAK,EAAE,MAAM,EACb,cAAc,EACd,eAAe,CAChB,CAAA;QAED,mFAAmF;QACnF,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE;YAC3C,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,eAAe;SACvB,CAAC,CAAA;QAEF,OAAO;YACL,iEAAiE;YACjE,MAAM,CAAC,GAAmB;gBACxB,IAAI,CAAC,GAAG,CAAC,KAAK;oBAAE,GAAG,CAAC,KAAK,GAAG,EAAE,CAAA;gBAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjD,mEAAmE;oBACnE,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBAC7B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;wBAChB,GAAG,GAAG;wBACN,MAAM,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;qBACjE,CAAA;gBACH,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,OAAO;oBAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnD,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBAC/B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;gBACzB,CAAC;gBAED,uEAAuE;gBACvE,MAAM,OAAO,GAAG,OAAO,EAAE,YAAY,KAAK,KAAK,CAAA;gBAC/C,IAAI,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,CAAC,EAAE,CAAC;oBACrE,GAAG,CAAC,aAAa,GAAG,MAAM,CAAA;gBAC5B,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,qBAAqB,EAAE,cAAc;YAErC,4EAA4E;YAC5E,IAAI,EAAE,SAAS,CAAC,KAAK;SACtB,CAAA;IACH,CAAC;CACF,CAAA;AAED,eAAe,MAAM,CAAA"}

package/dist/tm/config.d.ts

@@ -0,0 +1,71 @@
+/**
+ * JIT layer-2 tools (T1.2 + T1.3) — configuration surface.
+ *
+ * Every knob resolves from the process environment with a typed default;
+ * invalid values never crash plugin startup, they fall back to the default
+ * (same fail-soft philosophy as blackboard.resolveTtlMs and
+ * envprotect.resolveEnvProtectMode).
+ *
+ * Token 口径 (estimate basis): tokens ≈ chars/4, ceil.  This is a rough
+ * ASCII/code calibration; CJK text is under-counted by it (one CJK char is
+ * closer to a full token than to 0.25).  Two design choices keep that honest:
+ * the conservative boundary (estimate == threshold still offloads) and the
+ * hard preview cap — a mis-estimate can only make governance MORE aggressive,
+ * never less.  This口径 is pinned by test-tm-tools.mjs.
+ *
+ * Naming note: TM_BLACKBOARD_DIR (this module, run-payload store under the
+ * project root, default `.blackboard/`) is a DIFFERENT artifact from the
+ * team blackboard in blackboard.ts (`.git/opencode-team/`, plugin options).
+ * They share a philosophy (TTL sweeper is the sole cleanup path), not code.
+ */
+/** Default tm_bash read-only allowlist (P3, command-level). */
+export declare const DEFAULT_BASH_READONLY_ALLOWED: readonly string[];
+export interface TmConfig {
+    /** Offload boundary in estimated tokens (estimate == threshold offloads). */
+    offloadThreshold: number;
+    /** Raw lines a preview builder may scan before summarizing. */
+    previewLines: number;
+    /** Hard preview cap in estimated tokens — preview bloat is an R4 regression. */
+    previewMaxTokens: number;
+    /** Single tm_fetch segment cap in lines. */
+    fetchMaxLines: number;
+    /** Run-payload store dir (relative to project root, or absolute). */
+    blackboardDir: string;
+    /** Trajectory store dir (relative to project root, or absolute). */
+    trajectoryDir: string;
+    /** Handle TTL in days (expire_at + physical sweep of expired run dirs). */
+    blackboardTtlDays: number;
+    /** P3 read-only command allowlist for tm_bash. */
+    bashReadonlyAllowed: string[];
+}
+export declare const TM_CONFIG_DEFAULTS: {
+    readonly offloadThreshold: 2000;
+    readonly previewLines: 20;
+    readonly previewMaxTokens: 80;
+    readonly fetchMaxLines: 2000;
+    readonly blackboardDir: ".blackboard/";
+    readonly trajectoryDir: ".trajectory/";
+    readonly blackboardTtlDays: 7;
+};
+type EnvLike = Record<string, string | undefined>;
+/**
+ * Parse `TM_BASH_READONLY_ALLOWED`.  Unset/absent -> null (caller applies the
+ * default list).  An explicitly EMPTY string parses to [] (deny-all bash) —
+ * an explicit user choice is respected; separator is comma or semicolon.
+ */
+export declare function parseAllowlistEnv(raw: unknown): string[] | null;
+/** Resolve the full tm-tools config from an env-like record (default: process.env). */
+export declare function resolveTmConfig(env?: EnvLike): TmConfig;
+/**
+ * Token estimate — chars/4, ceil (口径 documented above).  Empty input = 0.
+ */
+export declare function estimateTokens(text: string): number;
+/**
+ * Offload decision.  estimate == threshold ALSO offloads — the conservative
+ * boundary (HUMAN-pinned spec: "等于阈值也卸载").
+ */
+export declare function shouldOffload(tokens: number, threshold: number): boolean;
+/** Collapse whitespace and hard-cap a string for messages / clue lines. */
+export declare function shorten(text: unknown, max: number): string;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/tm/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/tm/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAI1D,CAAA;AAED,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAA;IACpB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAA;IACxB,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,CAAA;IACzB,kDAAkD;IAClD,mBAAmB,EAAE,MAAM,EAAE,CAAA;CAC9B;AAED,eAAO,MAAM,kBAAkB;;;;;;;;CAQrB,CAAA;AAEV,KAAK,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAmBjD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAG/D;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,GAAG,GAAE,OAAqB,GAAG,QAAQ,CAYpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,2EAA2E;AAC3E,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D"}