agent-nuvira 1.14.0

package/dist/sandbox/types.js

@@ -0,0 +1,107 @@
+/**
+ * Sandbox types — Configuration types for Docker-based sandbox isolation.
+ *
+ * The sandbox system provides process-level isolation for running generated
+ * code and tests inside Docker containers with configurable resource limits.
+ *
+ * Basic usage:
+ * ```ts
+ * const manager = new SandboxManager({ memoryLimit: '512m', cpuLimit: 1 });
+ * const id = await manager.createContainer();
+ * await manager.copyProject(id, '/path/to/project');
+ * const result = await manager.runCommand(id, 'npm test');
+ * await manager.destroyContainer(id);
+ * ```
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+// ─── Defaults ───────────────────────────────────────────────────────────────
+export const DEFAULT_RESOURCE_LIMITS = {
+    memoryLimit: '1g',
+    cpuLimit: 1,
+    diskLimit: '2g',
+    pidsLimit: 100,
+    networkAccess: false,
+    timeoutMs: 600_000,
+};
+export const DEFAULT_SANDBOX_CONFIG = {
+    enabled: false,
+    limits: { ...DEFAULT_RESOURCE_LIMITS },
+    image: {
+        image: 'node:20-slim',
+        label: 'Node.js 20 (slim)',
+        runtimes: ['node'],
+        installCommand: 'npm install',
+        testCommand: 'npm test',
+        shell: '/bin/bash',
+    },
+    workDir: '/workspace',
+    containerUser: 'node',
+    stopTimeoutMs: 10_000,
+};
+// ─── Sandbox Configuration Manager ──────────────────────────────────────────
+let SANDBOX_CONFIG_PATH = '/tmp/buff-sandbox-config.json';
+let cachedConfig = null;
+/**
+ * Get the current sandbox configuration.
+ * Reads from ~/.buff/sandbox-config.json (if exists), falls back to defaults.
+ */
+export function getSandboxConfig() {
+    if (cachedConfig)
+        return { ...cachedConfig };
+    try {
+        // Lazy init path to avoid module-level side effects
+        if (SANDBOX_CONFIG_PATH === '/tmp/buff-sandbox-config.json' && process.env.HOME) {
+            SANDBOX_CONFIG_PATH = join(process.env.HOME, '.buff', 'sandbox-config.json');
+        }
+        if (existsSync(SANDBOX_CONFIG_PATH)) {
+            const raw = readFileSync(SANDBOX_CONFIG_PATH, 'utf-8');
+            const parsed = JSON.parse(raw);
+            cachedConfig = {
+                ...DEFAULT_SANDBOX_CONFIG,
+                ...parsed,
+                limits: { ...DEFAULT_RESOURCE_LIMITS, ...(parsed.limits || {}) },
+                image: { ...DEFAULT_SANDBOX_CONFIG.image, ...(parsed.image || {}) },
+            };
+            return { ...cachedConfig };
+        }
+    }
+    catch {
+        // Fall through to default
+    }
+    return { ...DEFAULT_SANDBOX_CONFIG };
+}
+/**
+ * Update the sandbox configuration and persist to disk.
+ */
+/**
+ * Reset the sandbox config cache. Useful for testing.
+ */
+export function resetSandboxConfigCache() {
+    cachedConfig = null;
+}
+/**
+ * Update the sandbox configuration and persist to disk.
+ */
+export function setSandboxConfig(config) {
+    const current = getSandboxConfig();
+    const updated = {
+        ...current,
+        ...config,
+        limits: { ...current.limits, ...(config.limits || {}) },
+        image: { ...current.image, ...(config.image || {}) },
+    };
+    try {
+        const dir = dirname(SANDBOX_CONFIG_PATH);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        writeFileSync(SANDBOX_CONFIG_PATH, JSON.stringify(updated, null, 2), 'utf-8');
+    }
+    catch {
+        // Non-critical: config stays in memory
+    }
+    cachedConfig = updated;
+    return { ...updated };
+}
+//# sourceMappingURL=types.js.map

package/dist/sandbox/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiG1C,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAC/D,WAAW,EAAE,IAAI;IACjB,QAAQ,EAAE,CAAC;IACX,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,GAAG;IACd,aAAa,EAAE,KAAK;IACpB,SAAS,EAAE,OAAO;CACnB,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,EAAE,GAAG,uBAAuB,EAAE;IACtC,KAAK,EAAE;QACL,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,UAAU;QACvB,KAAK,EAAE,WAAW;KACnB;IACD,OAAO,EAAE,YAAY;IACrB,aAAa,EAAE,MAAM;IACrB,aAAa,EAAE,MAAM;CACtB,CAAC;AAEF,+EAA+E;AAE/E,IAAI,mBAAmB,GAAG,+BAA+B,CAAC;AAE1D,IAAI,YAAY,GAAyB,IAAI,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,YAAY;QAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;IAE7C,IAAI,CAAC;QACH,oDAAoD;QACpD,IAAI,mBAAmB,KAAK,+BAA+B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAChF,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;YACzD,YAAY,GAAG;gBACb,GAAG,sBAAsB;gBACzB,GAAG,MAAM;gBACT,MAAM,EAAE,EAAE,GAAG,uBAAuB,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;gBAChE,KAAK,EAAE,EAAE,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;aACpE,CAAC;YACF,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IAED,OAAO,EAAE,GAAG,sBAAsB,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA8B;IAC7D,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAkB;QAC7B,GAAG,OAAO;QACV,GAAG,MAAM;QACT,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;QACvD,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;KACrD,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,aAAa,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,YAAY,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;AACxB,CAAC"}

package/dist/security/scanner.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Security Scanner — Reusable utilities for detecting security issues.
+ *
+ * Capabilities:
+ * - PII detection (emails, API keys, tokens, SSNs, etc.)
+ * - Prompt injection pattern detection
+ * - Dangerous code pattern detection (eval, exec, shell injection, etc.)
+ * - File permission checks
+ *
+ * Used by SecurityAgent and can be imported directly for custom use.
+ */
+export interface SecurityFinding {
+    type: 'pii' | 'injection' | 'dangerous-code';
+    severity: 'info' | 'low' | 'medium' | 'high' | 'critical';
+    category: string;
+    match: string;
+    context?: string;
+    line?: number;
+    recommendation?: string;
+}
+export interface ScanResult {
+    passed: boolean;
+    findings: SecurityFinding[];
+    summary: string;
+}
+/**
+ * Scan text for PII (personally identifiable information).
+ */
+export declare function scanForPII(text: string): SecurityFinding[];
+/**
+ * Scan text for prompt injection attempts.
+ */
+export declare function scanForInjections(text: string): SecurityFinding[];
+/**
+ * Scan code for dangerous patterns.
+ */
+export declare function scanForDangerousCode(code: string, contextInfo?: {
+    isGenerated?: boolean;
+    filename?: string;
+}): SecurityFinding[];
+/**
+ * Run all security scans on a given text.
+ * Convenience function that combines PII, injection, and code scans.
+ */
+export declare function runAllScans(text: string, options?: {
+    isGenerated?: boolean;
+    filename?: string;
+}): ScanResult;
+/**
+ * Format findings as a readable report string.
+ */
+export declare function formatScanReport(result: ScanResult): string;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/security/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/security/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuGH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,GAAG,WAAW,GAAG,gBAAgB,CAAC;IAC7C,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,EAAE,CA4E1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,EAAE,CAiBjE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,eAAe,EAAE,CAqCnB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD,UAAU,CA0BZ;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAkB3D"}

package/dist/security/scanner.js

@@ -0,0 +1,271 @@
+/**
+ * Security Scanner — Reusable utilities for detecting security issues.
+ *
+ * Capabilities:
+ * - PII detection (emails, API keys, tokens, SSNs, etc.)
+ * - Prompt injection pattern detection
+ * - Dangerous code pattern detection (eval, exec, shell injection, etc.)
+ * - File permission checks
+ *
+ * Used by SecurityAgent and can be imported directly for custom use.
+ */
+// ─── PII Patterns ───────────────────────────────────────────────────────────
+const EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+const API_KEY_PATTERNS = [
+    /sk-[a-zA-Z0-9]{20,}/g, // OpenAI-style keys
+    /gsk_[a-zA-Z0-9]{20,}/g, // Groq-style keys
+    /ghp_[a-zA-Z0-9]{36,}/g, // GitHub PAT
+    /gho_[a-zA-Z0-9]{36,}/g, // GitHub OAuth
+    /ghu_[a-zA-Z0-9]{36,}/g, // GitHub user token
+    /xox[bpras]-[a-zA-Z0-9-]{24,}/g, // Slack tokens
+    /AKIA[0-9A-Z]{16}/g, // AWS access keys
+    /-----BEGIN (RSA |EC )?PRIVATE KEY-----/g, // Private keys
+    /eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g, // JWT tokens
+];
+const SSN_PATTERN = /\b\d{3}-\d{2}-\d{4}\b/g;
+const CREDIT_CARD_PATTERN = /\b(?:\d{4}[ -]?){3}\d{4}\b/g;
+const PHONE_PATTERN = /\b(?:\+1)?[\s.-]?\(?\d{3}\)?[\s.-]?\d{3}[\s.-]?\d{4}\b/g;
+// ─── Injection Patterns ─────────────────────────────────────────────────────
+const INJECTION_PATTERNS = [
+    // Ignore/Cancel system instructions
+    /\bignore\s+(all\s+)?(previous|above|prior)\s+(instructions|directions|prompts?)\b/i,
+    /\bdisregard\s+(all\s+)?(previous|above)\s+(instructions|directions)\b/i,
+    /\bforget\s+(all\s+)?(previous|prior)\s+(instructions|context)\b/i,
+    // Role-play jailbreaks
+    /\byou\s+are\s+(now|free|released|DAN|jailbroken)\b/i,
+    /\bpretend\s+(to\s+)?(be|you\s+are)\s+(a|an|the)\b/i,
+    /\bDAN\b/i, // "Do Anything Now"
+    // Prompt leaking
+    /\boutput\s+(the\s+)?(initial|original|first|above)\s+(prompt|instruction|system)\b/i,
+    /\breveal\s+(the\s+)?(prompt|instructions|system\s+message)\b/i,
+    /\bshow\s+(me\s+)?(the\s+)?(prompt|instructions)\b/i,
+    /\bprint\s+(the\s+)?(prompt|instructions|system\s+prompt)\b/i,
+    // Token smuggling
+    /\bbase64\s+(\d+\s+times|repeat)/i,
+    /\bleetspeak/i,
+    /\broT13/i,
+];
+// ─── Dangerous Code Patterns ────────────────────────────────────────────────
+const DANGEROUS_EXEC_PATTERNS = [
+    /\beval\s*\(/g,
+    /\bFunction\s*\(/g,
+    /\bsetTimeout\s*\(\s*["'`]/g,
+    /\bsetInterval\s*\(\s*["'`]/g,
+    /\bnew\s+Function\s*\(/g,
+];
+const DANGEROUS_SHELL_PATTERNS = [
+    /\bexec(?:Sync)?\s*\(/g, // exec/execSync calls
+    /\bspawn(?:Sync)?\s*\(/g,
+    /\bfork\s*\(/g,
+    /\bexecFile(?:Sync)?\s*\(/g,
+    /`[^`]*\$\{[^}]*`/g, // Template literals with shell interpolation
+];
+const DANGEROUS_FS_PATTERNS = [
+    /\b(?:un)?linkSync?\s*\(/g,
+    /\brm\s+-rf/g,
+    /\bchmod\s*(?:\s+-R)?\s*777/g,
+    /\bchown\b/g,
+];
+const DANGEROUS_NETWORK_PATTERNS = [
+    /\bfetch\s*\(/g,
+    /\b(?:https?|axios|got|request)\s*\./gi,
+    /\bWebSocket\s*\(/g,
+    /\bnet\s*\.\s*connect\b/g,
+];
+const DANGEROUS_SQL_PATTERNS = [
+    /\bDROP\s+TABLE\b/gi,
+    /\bDROP\s+DATABASE\b/gi,
+    /\bTRUNCATE\s+TABLE\b/gi,
+    /\bALTER\s+TABLE\b.*\bDROP\b/gi,
+    /'.*OR\s+1\s*=\s*1.*--/gi,
+];
+/** Categories of dangerous code for grouping in results */
+const DANGEROUS_PATTERN_CATEGORIES = [
+    { name: 'eval-dynamic-exec', severity: 'high', patterns: DANGEROUS_EXEC_PATTERNS, description: 'Dynamic code execution' },
+    { name: 'shell-commands', severity: 'critical', patterns: DANGEROUS_SHELL_PATTERNS, description: 'Shell command execution' },
+    { name: 'dangerous-fs', severity: 'medium', patterns: DANGEROUS_FS_PATTERNS, description: 'Dangerous filesystem operations' },
+    { name: 'network-calls', severity: 'low', patterns: DANGEROUS_NETWORK_PATTERNS, description: 'Network calls in generated code' },
+    { name: 'sql-injection', severity: 'critical', patterns: DANGEROUS_SQL_PATTERNS, description: 'SQL injection patterns' },
+];
+// ─── Scanner Functions ──────────────────────────────────────────────────────
+/**
+ * Scan text for PII (personally identifiable information).
+ */
+export function scanForPII(text) {
+    const findings = [];
+    // Emails
+    const emails = text.match(EMAIL_PATTERN);
+    if (emails) {
+        for (const email of emails) {
+            findings.push({
+                type: 'pii',
+                severity: 'medium',
+                category: 'email',
+                match: email,
+                recommendation: 'Remove or obfuscate email address before sharing',
+            });
+        }
+    }
+    // API keys & secrets
+    for (const pattern of API_KEY_PATTERNS) {
+        const matches = text.match(pattern);
+        if (matches) {
+            for (const key of matches) {
+                findings.push({
+                    type: 'pii',
+                    severity: 'critical',
+                    category: 'api-key',
+                    match: key.slice(0, 12) + '...',
+                    recommendation: 'Revoke this key immediately and generate a new one',
+                });
+            }
+        }
+    }
+    // SSNs
+    const ssns = text.match(SSN_PATTERN);
+    if (ssns) {
+        for (const ssn of ssns) {
+            findings.push({
+                type: 'pii',
+                severity: 'critical',
+                category: 'ssn',
+                match: ssn.replace(/\d{4}$/, 'XXXX'),
+                recommendation: 'Remove SSN — this is sensitive PII',
+            });
+        }
+    }
+    // Credit cards
+    const cards = text.match(CREDIT_CARD_PATTERN);
+    if (cards) {
+        for (const card of cards) {
+            findings.push({
+                type: 'pii',
+                severity: 'critical',
+                category: 'credit-card',
+                match: card.replace(/\d{4}$/, 'XXXX'),
+                recommendation: 'Remove credit card number — PCI violation',
+            });
+        }
+    }
+    // Phone numbers
+    const phones = text.match(PHONE_PATTERN);
+    if (phones) {
+        for (const phone of phones) {
+            findings.push({
+                type: 'pii',
+                severity: 'low',
+                category: 'phone',
+                match: phone,
+                recommendation: 'Consider obfuscating phone number',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Scan text for prompt injection attempts.
+ */
+export function scanForInjections(text) {
+    const findings = [];
+    for (const pattern of INJECTION_PATTERNS) {
+        const match = text.match(pattern);
+        if (match) {
+            findings.push({
+                type: 'injection',
+                severity: 'high',
+                category: 'prompt-injection',
+                match: match[0].slice(0, 80),
+                recommendation: 'Review the prompt for jailbreak or injection attempts',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Scan code for dangerous patterns.
+ */
+export function scanForDangerousCode(code, contextInfo) {
+    const findings = [];
+    for (const category of DANGEROUS_PATTERN_CATEGORIES) {
+        for (const pattern of category.patterns) {
+            const matches = code.matchAll(pattern);
+            for (const match of matches) {
+                // Find the line number
+                const beforeMatch = code.slice(0, match.index);
+                const line = (beforeMatch.match(/\n/g) || []).length + 1;
+                // Get surrounding context (20 chars before and after)
+                const start = Math.max(0, (match.index || 0) - 20);
+                const end = Math.min(code.length, (match.index || 0) + match[0].length + 20);
+                const context = code.slice(start, end).replace(/\n/g, ' ');
+                // For generated code, lower the severity of network calls and dynamic exec
+                let severity = category.severity;
+                if (contextInfo?.isGenerated) {
+                    if (category.name === 'network-calls')
+                        severity = 'low';
+                    if (category.name === 'eval-dynamic-exec')
+                        severity = 'medium';
+                }
+                findings.push({
+                    type: 'dangerous-code',
+                    severity,
+                    category: category.name,
+                    match: match[0].slice(0, 60),
+                    context,
+                    line,
+                    recommendation: `Dangerous ${category.description} pattern detected. Review carefully.`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * Run all security scans on a given text.
+ * Convenience function that combines PII, injection, and code scans.
+ */
+export function runAllScans(text, options) {
+    const findings = [
+        ...scanForPII(text),
+        ...scanForInjections(text),
+        ...scanForDangerousCode(text, { isGenerated: options?.isGenerated }),
+    ];
+    const criticalCount = findings.filter((f) => f.severity === 'critical').length;
+    const highCount = findings.filter((f) => f.severity === 'high').length;
+    const mediumCount = findings.filter((f) => f.severity === 'medium').length;
+    const lowCount = findings.filter((f) => f.severity === 'low' || f.severity === 'info').length;
+    // Fail on critical or high severity findings
+    const passed = criticalCount === 0 && highCount === 0;
+    const summaryParts = [];
+    if (criticalCount > 0)
+        summaryParts.push(`${criticalCount} critical`);
+    if (highCount > 0)
+        summaryParts.push(`${highCount} high`);
+    if (mediumCount > 0)
+        summaryParts.push(`${mediumCount} medium`);
+    if (lowCount > 0)
+        summaryParts.push(`${lowCount} low`);
+    const summary = findings.length === 0
+        ? 'Security scan passed — no issues found'
+        : `Security scan found ${findings.length} issue(s): ${summaryParts.join(', ')} severity`;
+    return { passed, findings, summary };
+}
+/**
+ * Format findings as a readable report string.
+ */
+export function formatScanReport(result) {
+    if (result.findings.length === 0) {
+        return '  ✅ Security scan: Clean';
+    }
+    const lines = [
+        `  ${result.passed ? '⚠️' : '❌'} Security scan: ${result.summary}`,
+    ];
+    for (const finding of result.findings) {
+        const icon = finding.severity === 'critical' ? '🔴' :
+            finding.severity === 'high' ? '🟠' :
+                finding.severity === 'medium' ? '🟡' : '🔵';
+        const lineStr = finding.line ? ` (line ${finding.line})` : '';
+        lines.push(`    ${icon} [${finding.severity}] ${finding.category}${lineStr}: ${finding.match.slice(0, 60)}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=scanner.js.map

package/dist/security/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/security/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,+EAA+E;AAE/E,MAAM,aAAa,GAAG,iDAAiD,CAAC;AAExE,MAAM,gBAAgB,GAAG;IACvB,sBAAsB,EAAe,oBAAoB;IACzD,uBAAuB,EAAc,kBAAkB;IACvD,uBAAuB,EAAc,aAAa;IAClD,uBAAuB,EAAc,eAAe;IACpD,uBAAuB,EAAc,oBAAoB;IACzD,+BAA+B,EAAK,eAAe;IACnD,mBAAmB,EAAmB,kBAAkB;IACxD,yCAAyC,EAAG,eAAe;IAC3D,gEAAgE,EAAG,aAAa;CACjF,CAAC;AAEF,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAC1D,MAAM,aAAa,GAAG,yDAAyD,CAAC;AAEhF,+EAA+E;AAE/E,MAAM,kBAAkB,GAAG;IACzB,oCAAoC;IACpC,oFAAoF;IACpF,wEAAwE;IACxE,kEAAkE;IAElE,uBAAuB;IACvB,qDAAqD;IACrD,oDAAoD;IACpD,UAAU,EAAG,oBAAoB;IAEjC,iBAAiB;IACjB,qFAAqF;IACrF,+DAA+D;IAC/D,oDAAoD;IACpD,6DAA6D;IAE7D,kBAAkB;IAClB,kCAAkC;IAClC,cAAc;IACd,UAAU;CACX,CAAC;AAEF,+EAA+E;AAE/E,MAAM,uBAAuB,GAAG;IAC9B,cAAc;IACd,kBAAkB;IAClB,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;CACzB,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC/B,uBAAuB,EAAE,sBAAsB;IAC/C,wBAAwB;IACxB,cAAc;IACd,2BAA2B;IAC3B,mBAAmB,EAAM,6CAA6C;CACvE,CAAC;AAEF,MAAM,qBAAqB,GAAG;IAC5B,0BAA0B;IAC1B,aAAa;IACb,6BAA6B;IAC7B,YAAY;CACb,CAAC;AAEF,MAAM,0BAA0B,GAAG;IACjC,eAAe;IACf,uCAAuC;IACvC,mBAAmB;IACnB,yBAAyB;CAC1B,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,oBAAoB;IACpB,uBAAuB;IACvB,wBAAwB;IACxB,+BAA+B;IAC/B,yBAAyB;CAC1B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,4BAA4B,GAK7B;IACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE,WAAW,EAAE,wBAAwB,EAAE;IACzH,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,wBAAwB,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC5H,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,WAAW,EAAE,iCAAiC,EAAE;IAC7H,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,0BAA0B,EAAE,WAAW,EAAE,iCAAiC,EAAE;IAChI,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,sBAAsB,EAAE,WAAW,EAAE,wBAAwB,EAAE;CACzH,CAAC;AAoBF,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,SAAS;IACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,kDAAkD;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,UAAU;oBACpB,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBAC/B,cAAc,EAAE,oDAAoD;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;IACP,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACpC,cAAc,EAAE,oCAAoC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,eAAe;IACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,aAAa;gBACvB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACrC,cAAc,EAAE,2CAA2C;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,mCAAmC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,kBAAkB;gBAC5B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC5B,cAAc,EAAE,uDAAuD;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,WAA0D;IAE1D,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,QAAQ,IAAI,4BAA4B,EAAE,CAAC;QACpD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,uBAAuB;gBACvB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAEzD,sDAAsD;gBACtD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;gBAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAE3D,2EAA2E;gBAC3E,IAAI,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBACjC,IAAI,WAAW,EAAE,WAAW,EAAE,CAAC;oBAC7B,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe;wBAAE,QAAQ,GAAG,KAAK,CAAC;oBACxD,IAAI,QAAQ,CAAC,IAAI,KAAK,mBAAmB;wBAAE,QAAQ,GAAG,QAAQ,CAAC;gBACjE,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC5B,OAAO;oBACP,IAAI;oBACJ,cAAc,EAAE,aAAa,QAAQ,CAAC,WAAW,sCAAsC;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,OAAsD;IAEtD,MAAM,QAAQ,GAAsB;QAClC,GAAG,UAAU,CAAC,IAAI,CAAC;QACnB,GAAG,iBAAiB,CAAC,IAAI,CAAC;QAC1B,GAAG,oBAAoB,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;KACrE,CAAC;IAEF,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAE9F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,CAAC;IAEtD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,aAAa,GAAG,CAAC;QAAE,YAAY,CAAC,IAAI,CAAC,GAAG,aAAa,WAAW,CAAC,CAAC;IACtE,IAAI,SAAS,GAAG,CAAC;QAAE,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC;QAAE,YAAY,CAAC,IAAI,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,CAAC;QAAE,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnC,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,uBAAuB,QAAQ,CAAC,MAAM,cAAc,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;IAE3F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,mBAAmB,MAAM,CAAC,OAAO,EAAE;KACnE,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/team/config.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Team Config — Project-level configuration with config priority chain.
+ *
+ * Config priority (highest to lowest):
+ *   1. Project-level `.buffconfig.json` in working directory
+ *   2. User-level config at `~/.buff/buffconfig.json`
+ *   3. Built-in defaults
+ *
+ * This enables teams to commit a `.buffconfig.json` to their repo that
+ * defines shared provider defaults, team repository URL, and other
+ * project-wide settings while allowing individual overrides.
+ *
+ * The project-level config is read-only by default — CLI commands write
+ * to the user-level config. The `buff config init` command can generate
+ * a project-level config.
+ */
+import type { BuffConfig, TeamConfig } from '../config/types.js';
+/** Default team config values */
+export declare const DEFAULT_TEAM_CONFIG: TeamConfig;
+/**
+ * Find and load the project-level `.buffconfig.json`.
+ * Searches from the working directory upward for common filenames.
+ *
+ * @param cwd — Working directory to search from (default: process.cwd())
+ * @returns The parsed project config, or null if none found
+ */
+export declare function findProjectConfig(cwd?: string): BuffConfig | null;
+/**
+ * Get the team config from the project-level config.
+ * Falls back to user-level config if project config doesn't have team settings.
+ *
+ * @param cwd — Optional working directory
+ * @returns The resolved team config
+ */
+export declare function getTeamConfig(cwd?: string): TeamConfig;
+/**
+ * Check if a project-level `.buffconfig.json` exists.
+ */
+export declare function hasProjectConfig(cwd?: string): boolean;
+/**
+ * Get the path to the team data directory.
+ * Uses project-level config path, falling back to ~/.buff/team/.
+ *
+ * The team directory is a git repository that contains:
+ *   - trajectories/ — Shared agent execution trajectories
+ *   - patterns/ — Project-level coding patterns
+ *   - templates/ — Team workflow templates
+ */
+export declare function getTeamDataDir(cwd?: string): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/team/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/team/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKjE,iCAAiC;AACjC,eAAO,MAAM,mBAAmB,EAAE,UAIjC,CAAC;AAWF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAkBjE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CAmBtD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAMnD"}

package/dist/team/config.js

@@ -0,0 +1,108 @@
+/**
+ * Team Config — Project-level configuration with config priority chain.
+ *
+ * Config priority (highest to lowest):
+ *   1. Project-level `.buffconfig.json` in working directory
+ *   2. User-level config at `~/.buff/buffconfig.json`
+ *   3. Built-in defaults
+ *
+ * This enables teams to commit a `.buffconfig.json` to their repo that
+ * defines shared provider defaults, team repository URL, and other
+ * project-wide settings while allowing individual overrides.
+ *
+ * The project-level config is read-only by default — CLI commands write
+ * to the user-level config. The `buff config init` command can generate
+ * a project-level config.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { ConfigManager } from '../config/manager.js';
+// ─── Constants ──────────────────────────────────────────────────────────────
+/** Default team config values */
+export const DEFAULT_TEAM_CONFIG = {
+    branch: 'main',
+    autoSyncMinutes: 0,
+    shareTrajectories: true,
+};
+/** Priority config search paths (relative to working directory) */
+const PROJECT_CONFIG_FILENAMES = [
+    '.buffconfig.json',
+    'buffconfig.json',
+    '.buff/config.json',
+];
+// ─── Config Priority Chain ──────────────────────────────────────────────────
+/**
+ * Find and load the project-level `.buffconfig.json`.
+ * Searches from the working directory upward for common filenames.
+ *
+ * @param cwd — Working directory to search from (default: process.cwd())
+ * @returns The parsed project config, or null if none found
+ */
+export function findProjectConfig(cwd) {
+    const dir = resolve(cwd || process.cwd());
+    for (const filename of PROJECT_CONFIG_FILENAMES) {
+        const filePath = join(dir, filename);
+        if (existsSync(filePath)) {
+            try {
+                const raw = readFileSync(filePath, 'utf-8');
+                const config = JSON.parse(raw);
+                return config;
+            }
+            catch {
+                // Try next filename
+                continue;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Get the team config from the project-level config.
+ * Falls back to user-level config if project config doesn't have team settings.
+ *
+ * @param cwd — Optional working directory
+ * @returns The resolved team config
+ */
+export function getTeamConfig(cwd) {
+    // Check project-level config first
+    const projectConfig = findProjectConfig(cwd);
+    if (projectConfig?.team) {
+        return { ...DEFAULT_TEAM_CONFIG, ...projectConfig.team };
+    }
+    // Fall back to user-level config
+    try {
+        const configManager = new ConfigManager();
+        const userConfig = configManager.getAll();
+        if (userConfig.team) {
+            return { ...DEFAULT_TEAM_CONFIG, ...userConfig.team };
+        }
+    }
+    catch {
+        // Fall through to defaults
+    }
+    return { ...DEFAULT_TEAM_CONFIG };
+}
+/**
+ * Check if a project-level `.buffconfig.json` exists.
+ */
+export function hasProjectConfig(cwd) {
+    return findProjectConfig(cwd) !== null;
+}
+/**
+ * Get the path to the team data directory.
+ * Uses project-level config path, falling back to ~/.buff/team/.
+ *
+ * The team directory is a git repository that contains:
+ *   - trajectories/ — Shared agent execution trajectories
+ *   - patterns/ — Project-level coding patterns
+ *   - templates/ — Team workflow templates
+ */
+export function getTeamDataDir(cwd) {
+    const teamConfig = getTeamConfig(cwd);
+    if (teamConfig.localPath)
+        return resolve(teamConfig.localPath);
+    // Default: ~/.buff/team/
+    return join(homedir(), '.buff', 'team');
+}
+//# sourceMappingURL=config.js.map

package/dist/team/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/team/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,+EAA+E;AAE/E,iCAAiC;AACjC,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,MAAM,EAAE,MAAM;IACd,eAAe,EAAE,CAAC;IAClB,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF,mEAAmE;AACnE,MAAM,wBAAwB,GAAG;IAC/B,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;CACpB,CAAC;AAEF,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE1C,KAAK,MAAM,QAAQ,IAAI,wBAAwB,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;gBAC7C,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;gBACpB,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,mCAAmC;IACnC,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,aAAa,EAAE,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,GAAG,mBAAmB,EAAE,GAAG,aAAa,CAAC,IAAI,EAAgB,CAAC;IACzE,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,GAAG,mBAAmB,EAAE,GAAG,UAAU,CAAC,IAAI,EAAgB,CAAC;QACtE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IAED,OAAO,EAAE,GAAG,mBAAmB,EAAgB,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,iBAAiB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAE/D,yBAAyB;IACzB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC"}