@teamvibe/poller 0.8.3 → 0.8.4-rc.2

package/README.md

@@ -74,11 +74,24 @@ All configuration is via environment variables (or `~/.teamvibe/.env`):
 |----------|----------|---------|-------------|
 | `TEAMVIBE_POLLER_TOKEN` | Yes | — | Your poller authentication token |
 | `CLAUDE_CODE_OAUTH_TOKEN` | No | — | Claude Code OAuth token (from `claude setup-token`) |
+| `EXPOSE_CLAUDE_TOKEN_TO_AGENT` | No | `false` | Opt in per poller to exposing the session token to agent subprocesses; accepts `1`/`true`/`yes`/`on` (case-insensitive) |
+| `TEAMVIBE_CLAUDE_OAUTH_TOKEN` | Injected | Unset | In the poller-injected env: with opt-in, the selected pool account's token, otherwise the poller's non-empty `CLAUDE_CODE_OAUTH_TOKEN`; inherited aliases are cleared. Claude settings can override this |
+| `TEAMVIBE_POOL_ACCOUNT_ID` | Injected | Unset | In the poller-injected env: with opt-in and a selected pool account, its account ID (no secret); absent without a pool account. Claude settings can override this |
 | `TEAMVIBE_API_URL` | No | `https://poller.api.teamvibe.ai` | API endpoint |
 | `MAX_CONCURRENT_SESSIONS` | No | `5` | Max parallel Claude sessions |
 | `CLAUDE_CLI_PATH` | No | `claude` | Path to Claude Code CLI |
 | `TEAMVIBE_DATA_DIR` | No | `~/.teamvibe` | Data directory for brains and state |
 
+Set `EXPOSE_CLAUDE_TOKEN_TO_AGENT=true` in the poller's environment to let agents run nested Claude sessions on the current session's account. Claude CLI strips `CLAUDE_CODE_OAUTH_TOKEN` from Bash subprocess environments by name, so agents can restore it from the alias:
+
+```bash
+CLAUDE_CODE_OAUTH_TOKEN="$TEAMVIBE_CLAUDE_OAUTH_TOKEN" claude -p "…"
+```
+
+In the environment the poller injects, the alias and account ID follow the selected account on resume and failover; without opt-in, the poller leaves both variables unset. **This guarantee applies only to the injected process environment.** Claude CLI subsequently applies settings-file `env` entries: a brain's `CLAUDE_CONFIG_DIR/settings.json` can restore either variable when the flag is off or override it with a stale value when the flag is on. Project `.claude/settings.json` and `.claude/settings.local.json` can also override them. `settings.local.json` is a project source, not a user file next to `CLAUDE_CONFIG_DIR/settings.json`; recent CLI versions also read project-local settings from the main checkout for worktree sessions ([Claude settings sources](https://code.claude.com/docs/en/settings)). Before each spawn, the poller emits one warning listing the keys and files defining either variable in these settings sources, never their values. It never edits brain settings. Remove conflicting entries yourself to preserve the injected values in the agent's environment.
+
+**Security trade-off:** with opt-in, the agent and its subprocesses can read and use the token, bypassing Claude CLI's credential filtering. Enable this only for agents you trust with that credential. With no settings override, nested sessions use the selected session account; this option adds no nested-session usage accounting. Poller-side Claude output logs, returned output/errors, typing status and fallback Slack replies redact the actual injected Claude token and alias values, plus assignments to either token variable name, whether or not opt-in is enabled. This does not prevent agents from using credentials or sending them directly through their own tools.
+
 ## How It Works
 
 The poller authenticates with the TeamVibe API using your token, then continuously polls an SQS queue for incoming messages from Slack. When a message arrives, it spawns a Claude Code session with the appropriate brain (knowledge base) and streams the response back to Slack.

package/dist/brain-directory.d.ts

@@ -0,0 +1,14 @@
+import type { TeamVibeQueueMessage } from './types.js';
+/** Selected from platform routing; never inferred from files or replay payloads. */
+export type BrainDirectory = {
+    path: string;
+    workspaceId: string;
+    brainId: string;
+} | {
+    path: string;
+    workspaceId?: never;
+    brainId?: never;
+};
+/** Bare paths are fallback directories and carry no brain identity. */
+export declare function executionDirectory(directory: BrainDirectory | string, brainsPath?: string): BrainDirectory;
+export declare function selectBrainDirectory(message: TeamVibeQueueMessage): Promise<BrainDirectory>;

package/dist/brain-directory.js

@@ -0,0 +1,16 @@
+import { resolveBrainDir } from './brain-path.js';
+import { getBrainPath } from './brain-manager.js';
+/** Bare paths are fallback directories and carry no brain identity. */
+export function executionDirectory(directory, brainsPath) {
+    if (typeof directory === 'string')
+        return { path: directory };
+    if (directory.workspaceId !== undefined || directory.brainId !== undefined) {
+        return { ...directory, path: resolveBrainDir(directory.workspaceId, directory.brainId, brainsPath) };
+    }
+    return directory;
+}
+export async function selectBrainDirectory(message) {
+    const { brain, workspaceId } = message.teamvibe;
+    const path = await getBrainPath(brain, message.response_context.slack?.channel, workspaceId);
+    return brain?.gitRepoUrl ? { path, workspaceId, brainId: brain.brainId } : { path };
+}

package/dist/brain-manager.d.ts

@@ -1,4 +1,4 @@
-export declare function withBrainLock<T>(brainId: string, fn: () => Promise<T>): Promise<T>;
+export declare function withBrainLock<T>(key: string, fn: () => Promise<T>): Promise<T>;
 interface BrainConfig {
     brainId: string;
     gitRepoUrl: string;
@@ -31,7 +31,7 @@ export declare function getBrainPath(brain?: BrainConfig, channelId?: string, wo
  * Update a brain repo (respects cooldown). Exported for testing — production
  * call sites should go through `getBrainPath` / `ensureBaseBrain`.
  */
-export declare function updateBrain(brainDir: string, brainId: string, branch: string): Promise<void>;
+export declare function updateBrain(brainDir: string, brainId: string, branch: string, workspaceId?: string): Promise<void>;
 /**
  * Ensure base brain repo is cloned and up to date.
  * Uses same cooldown pattern as channel brains.

package/dist/brain-manager.js

@@ -2,10 +2,11 @@ import { exec } from 'child_process';
 import { promisify } from 'util';
 import { existsSync, mkdirSync } from 'fs';
 import { readdir, stat, unlink, mkdir, writeFile } from 'fs/promises';
-import { join, basename } from 'path';
+import { join, basename, dirname } from 'path';
 import { config } from './config.js';
 import { logger } from './logger.js';
 import { emitError } from './event-queue.js';
+import { brainLockKey, resolveBrainDir, fallbackBrainPath, legacyBrainPath } from './brain-path.js';
 import { startupFailureDetail } from './startup-auth.js';
 const execAsync = promisify(exec);
 // Clean env for git commands:
@@ -30,7 +31,8 @@ function gitExec(command, options) {
 const GIT_SCAN_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
 // Cooldown tracker per brain
 const lastUpdateTimes = new Map();
-// Per-brainId mutex serializing updateBrain/pushBrainChanges for a given
+const loggedLegacyDirectories = new Set();
+// Per-workspace:brainId mutex serializing updateBrain/pushBrainChanges for a given
 // brain. Two threads of the SAME brain running concurrently in this process
 // share one brainDir (tv#76/tv#277 review) — without this, cleanupStaleLocks()
 // can unlink a git lock file that a still-in-flight sibling call's own git
@@ -40,10 +42,10 @@ const lastUpdateTimes = new Map();
 // in-process mutex fully closes the race; no DynamoDB-level lock is needed.
 const brainLocks = new Map();
 // Exported for testing — production call sites go through updateBrain / pushBrainChanges above.
-export function withBrainLock(brainId, fn) {
-    const prior = brainLocks.get(brainId) ?? Promise.resolve();
+export function withBrainLock(key, fn) {
+    const prior = brainLocks.get(key) ?? Promise.resolve();
     const run = prior.then(fn, fn);
-    brainLocks.set(brainId, run.then(() => undefined, () => undefined));
+    brainLocks.set(key, run.then(() => undefined, () => undefined));
     return run;
 }
 /**
@@ -173,7 +175,7 @@ export async function ensureGitAttributes(brainDir) {
 export async function getBrainPath(brain, channelId, workspaceId) {
     if (!brain?.gitRepoUrl) {
         if (channelId) {
-            const channelDir = join(config.BRAINS_PATH, `channel_${channelId}`);
+            const channelDir = fallbackBrainPath(channelId);
             if (!existsSync(channelDir)) {
                 mkdirSync(channelDir, { recursive: true });
             }
@@ -181,7 +183,17 @@ export async function getBrainPath(brain, channelId, workspaceId) {
         }
         return config.DEFAULT_BRAIN_PATH;
     }
-    const brainDir = join(config.BRAINS_PATH, brain.brainId);
+    const brainDir = resolveBrainDir(workspaceId, brain.brainId);
+    return withBrainLock(brainLockKey(brainDir, brain.brainId, workspaceId), () => getWorkspaceBrainPath(brain, workspaceId));
+}
+async function getWorkspaceBrainPath(brain, workspaceId) {
+    const brainDir = resolveBrainDir(workspaceId, brain.brainId);
+    const legacyDir = legacyBrainPath(brain.brainId);
+    if (existsSync(legacyDir) && !loggedLegacyDirectories.has(legacyDir)) {
+        loggedLegacyDirectories.add(legacyDir);
+        logger.info(`Legacy brain directory ${legacyDir} left untouched; it can be deleted once its unpushed changes are checked. A fresh workspace-scoped clone will be used.`);
+    }
+    mkdirSync(dirname(brainDir), { recursive: true });
     if (!existsSync(brainDir)) {
         logger.info(`Cloning brain ${brain.brainId} from ${brain.gitRepoUrl} (branch: ${brain.branch})...`);
         await gitExec(`git clone --recurse-submodules ${brain.gitRepoUrl} ${brainDir}`);
@@ -202,7 +214,7 @@ export async function getBrainPath(brain, channelId, workspaceId) {
             reportBrainSync(brain.brainId, workspaceId, 'pulled');
     }
     else if (config.BRAIN_AUTO_UPDATE) {
-        await updateBrain(brainDir, brain.brainId, brain.branch);
+        await updateBrainLocked(brainDir, brain.brainId, brain.branch, `${workspaceId}:${brain.brainId}`);
         if (workspaceId)
             reportBrainSync(brain.brainId, workspaceId, 'pulled');
     }
@@ -215,12 +227,13 @@ export async function getBrainPath(brain, channelId, workspaceId) {
  * Update a brain repo (respects cooldown). Exported for testing — production
  * call sites should go through `getBrainPath` / `ensureBaseBrain`.
  */
-export async function updateBrain(brainDir, brainId, branch) {
-    return withBrainLock(brainId, () => updateBrainLocked(brainDir, brainId, branch));
+export async function updateBrain(brainDir, brainId, branch, workspaceId) {
+    const key = brainLockKey(brainDir, brainId, workspaceId);
+    return withBrainLock(key, () => updateBrainLocked(brainDir, brainId, branch, key));
 }
-async function updateBrainLocked(brainDir, brainId, branch) {
+async function updateBrainLocked(brainDir, brainId, branch, key) {
     const now = Date.now();
-    const lastUpdate = lastUpdateTimes.get(brainId) || 0;
+    const lastUpdate = lastUpdateTimes.get(key) || 0;
     if (now - lastUpdate < config.BRAIN_UPDATE_COOLDOWN_MS) {
         logger.debug(`Brain ${brainId} update skipped - cooldown active (${Math.round((config.BRAIN_UPDATE_COOLDOWN_MS - (now - lastUpdate)) / 1000)}s remaining)`);
         return;
@@ -268,7 +281,7 @@ async function updateBrainLocked(brainDir, brainId, branch) {
         await gitExec(`git fetch origin ${branch} && git reset --hard origin/${branch} && git submodule update --init --recursive`, {
             cwd: brainDir,
         });
-        lastUpdateTimes.set(brainId, Date.now());
+        lastUpdateTimes.set(key, Date.now());
         logger.info(`Brain ${brainId} updated successfully`);
     }
     catch (error) {
@@ -286,7 +299,7 @@ export async function ensureBaseBrain() {
     if (!existsSync(brainDir)) {
         logger.info(`Cloning base brain (branch: ${config.BASE_BRAIN_BRANCH})...`);
         await gitExec(`git clone --recurse-submodules --branch ${config.BASE_BRAIN_BRANCH} ${config.BASE_BRAIN_REPO} ${brainDir}`);
-        lastUpdateTimes.set('__base_brain__', Date.now());
+        lastUpdateTimes.set(brainDir, Date.now());
         logger.info('Base brain cloned successfully');
     }
     else if (config.BRAIN_AUTO_UPDATE) {
@@ -308,7 +321,7 @@ async function gitStashList(brainDir) {
     const { stdout } = await gitExec('git stash list', { cwd: brainDir });
     return stdout.trim();
 }
-// Per-brainId rescue-ref name, seeded with a timestamp the first time a given
+// Per-clone rescue-ref name, seeded with a timestamp the first time a given
 // brainId hits an unresolved push-race conflict, then reused (force-pushed
 // to) on every later pushBrainChangesLocked invocation that still can't
 // converge — e.g. the next message's push attempt while the conflict remains
@@ -332,13 +345,13 @@ const rescueRefNames = new Map();
  * pre-rebase local branch) — this function pushes HEAD as-is.
  */
 async function pushRescueRef(brainDir, brainId) {
-    let refName = rescueRefNames.get(brainId);
+    let refName = rescueRefNames.get(brainDir);
     if (!refName) {
         // Unix seconds (not ms) — matches the <timestamp> format documented on
         // the consuming side (poller-brain#443's MAINTENANCE.md `oldestAgeDays`
         // derivation), so both sides agree on how to parse the ref name.
         refName = `conflict/${brainId}-${Math.floor(Date.now() / 1000)}`;
-        rescueRefNames.set(brainId, refName);
+        rescueRefNames.set(brainDir, refName);
     }
     try {
         await gitExec(`git push --force origin HEAD:refs/heads/${refName}`, { cwd: brainDir });
@@ -408,7 +421,7 @@ export async function findOversizedBlobs(brainDir, maxBytes) {
  * process-wide env/module-load-order tricks.
  */
 export async function pushBrainChanges(brainDir, brainId, workspaceId, retryOptions) {
-    return withBrainLock(brainId, () => pushBrainChangesLocked(brainDir, brainId, workspaceId, retryOptions));
+    return withBrainLock(brainLockKey(brainDir, brainId, workspaceId), () => pushBrainChangesLocked(brainDir, brainId, workspaceId, retryOptions));
 }
 async function pushBrainChangesLocked(brainDir, brainId, workspaceId, retryOptions) {
     await cleanupStaleLocks(brainDir);
@@ -476,7 +489,7 @@ async function pushBrainChangesLocked(brainDir, brainId, workspaceId, retryOptio
                 // A successful push means any earlier unresolved conflict for this
                 // brainId (if any) is now resolved — a future conflict is a new,
                 // unrelated incident, so stop reusing that rescue ref name.
-                rescueRefNames.delete(brainId);
+                rescueRefNames.delete(brainDir);
                 if (attempt > 1) {
                     logger.info(`Brain ${brainId} push-race auto-resolved after ${attempt} attempts`);
                     emitError('brain', `Brain ${brainId} push-race auto-resolved after ${attempt} attempts`, {

package/dist/brain-path.d.ts

@@ -0,0 +1,9 @@
+/** One policy for workspace and brain IDs, before any filesystem access. */
+export declare function validateBrainId(id: string): void;
+export declare function resolveBrainDir(workspaceId: string, brainId: string, brainsPath?: string): string;
+/** Validate identity and the supplied clone path before update/push touches Git. */
+export declare function brainLockKey(brainPath: string, brainId: string, workspaceId?: string): string;
+/** Existing fallback locations have no workspace/brain identity. */
+export declare function fallbackBrainPath(channelId?: string): string;
+/** Legacy clones are never adopted; their inbox drops may be recovered. */
+export declare function legacyBrainPath(brainId: string, brainsPath?: string): string;

package/dist/brain-path.js

@@ -0,0 +1,65 @@
+import { dirname, join, resolve, sep } from 'path';
+import { realpathSync } from 'fs';
+import { config } from './config.js';
+import { emitError } from './event-queue.js';
+import { logger } from './logger.js';
+/** One policy for workspace and brain IDs, before any filesystem access. */
+export function validateBrainId(id) {
+    if (typeof id !== 'string' || !/^[A-Za-z0-9._-]+$/.test(id) || id === '.' || id === '..') {
+        rejectBrainDirectory('invalid workspace or brain ID');
+    }
+}
+function rejectBrainDirectory(reason) {
+    const message = `Invalid brain directory: ${reason}`;
+    logger.error(message);
+    emitError('brain', message);
+    throw new Error(message);
+}
+export function resolveBrainDir(workspaceId, brainId, brainsPath = config.BRAINS_PATH) {
+    validateBrainId(workspaceId);
+    validateBrainId(brainId);
+    const workspacePath = resolve(brainsPath, workspaceId);
+    const brainPath = resolve(workspacePath, brainId);
+    // Defense in depth: even if the ID policy changes, a clone must be strictly
+    // inside its workspace, never the workspace itself or a sibling directory.
+    if (!brainPath.startsWith(workspacePath + sep))
+        rejectBrainDirectory('clone escapes its workspace');
+    // Check each existing component, including BRAINS_PATH. Checking only the
+    // leaf misses aliases when a workspace or brain has not been created yet.
+    // This prevents routing mistakes, not races with an adversarial OS peer.
+    const root = resolve(brainsPath);
+    for (let current = brainPath;; current = dirname(current)) {
+        let physical;
+        try {
+            physical = realpathSync(current);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                rejectBrainDirectory('cannot resolve physical clone path');
+        }
+        if (physical !== undefined && physical !== current)
+            rejectBrainDirectory('physical clone path disagrees with workspace and brain IDs');
+        if (current === root)
+            break;
+    }
+    return brainPath;
+}
+/** Validate identity and the supplied clone path before update/push touches Git. */
+export function brainLockKey(brainPath, brainId, workspaceId) {
+    validateBrainId(brainId);
+    if (workspaceId === undefined)
+        return brainPath; // Base brain has no workspace.
+    const expected = resolveBrainDir(workspaceId, brainId);
+    if (resolve(brainPath) !== expected)
+        rejectBrainDirectory('clone path disagrees with workspace and brain IDs');
+    return `${workspaceId}:${brainId}`;
+}
+/** Existing fallback locations have no workspace/brain identity. */
+export function fallbackBrainPath(channelId) {
+    return channelId ? join(config.BRAINS_PATH, `channel_${channelId}`) : config.DEFAULT_BRAIN_PATH;
+}
+/** Legacy clones are never adopted; their inbox drops may be recovered. */
+export function legacyBrainPath(brainId, brainsPath = config.BRAINS_PATH) {
+    validateBrainId(brainId);
+    return join(brainsPath, brainId);
+}

package/dist/claude-spawner.d.ts

@@ -1,6 +1,7 @@
 import { type ChildProcess } from 'child_process';
 import type { TeamVibeQueueMessage, SessionMetrics } from './types.js';
 import { type SessionLogger } from './logger.js';
+import { type BrainDirectory } from './brain-directory.js';
 import { type TypingIndicator } from './slack-client.js';
 import { type ResolvedModelConfig } from './config-client.js';
 import type { KilledByPoller } from './classify-failed-iteration.js';
@@ -241,10 +242,10 @@ export declare function resolveTypingStatus(event: any, assistantText?: string):
 export declare function finalizeSpawnResult(retryResult: SpawnResult, isFirstMessage: boolean, effectiveSessionId: string | undefined): SpawnResult & {
     newSessionId?: string;
 };
-export declare function spawnClaudeCode(msg: TeamVibeQueueMessage, sessionLog: SessionLogger, cwd: string, sessionId?: string, isFirstMessage?: boolean, lastMessageTs?: string, onMessageSent?: () => void, typingIndicator?: TypingIndicator): Promise<SpawnResult & {
+export declare function spawnClaudeCode(msg: TeamVibeQueueMessage, sessionLog: SessionLogger, selectedDirectory: BrainDirectory | string, sessionId?: string, isFirstMessage?: boolean, lastMessageTs?: string, onMessageSent?: () => void, typingIndicator?: TypingIndicator): Promise<SpawnResult & {
     newSessionId?: string;
 }>;
-export declare function spawnPoolClaudeCode(msg: TeamVibeQueueMessage, sessionLog: SessionLogger, cwd: string, sessionId?: string, isFirstMessage?: boolean, lastMessageTs?: string, onMessageSent?: () => void, typingIndicator?: TypingIndicator, poolRuntime?: PoolRuntimeOptions): Promise<SpawnResult & {
+export declare function spawnPoolClaudeCode(msg: TeamVibeQueueMessage, sessionLog: SessionLogger, selectedDirectory: BrainDirectory | string, sessionId?: string, isFirstMessage?: boolean, lastMessageTs?: string, onMessageSent?: () => void, typingIndicator?: TypingIndicator, poolRuntime?: PoolRuntimeOptions): Promise<SpawnResult & {
     newSessionId?: string;
 }>;
 export declare function getActiveProcessCount(): number;