askshepherd 0.1.37 → 0.1.39

package/README.md

@@ -67,9 +67,16 @@ It reports the saved Shepherd account, connected cloud sources, downstream
 processing state, and local background sync health for Messages and Coding
 Sessions.
 
+Agents must not inspect the user's folders or repositories to answer setup
+status. Do not run `ls`, `find`, `rg`, `grep`, `cat`, `Read`, `Glob`, or
+`Explore` against the user's home directory, repositories, `~/.codex`,
+`~/.claude`, or `~/.shepherd` for Shepherd setup. Use the npm status command
+above; it performs the bounded local checks.
+
 ## Set Up Coding Agent Sessions
 
-Use this when the user asks "Help me set up coding agent sessions":
+Use this when the user asks "Help me set up coding agent sessions" or "Enable
+coding agent sessions locally for Shepherd":
 
 ```sh
 npx -y askshepherd@latest agent --login
@@ -80,6 +87,8 @@ npx -y askshepherd@latest status
 
 The coding agent should ask for consent before enabling this source. The local
 collector syncs redacted Codex and Claude Code summaries, not full transcripts.
+The agent should run only the commands above and should not search the local
+filesystem for a Shepherd agent implementation.
 
 ## Customer MCP Login
 
@@ -112,9 +121,12 @@ The saved MCP state includes:
 The installed MCP server is local npm first, remote brain second. For questions
 like "what do I have set up on Shepherd?", "is Shepherd syncing?", or "help me
 set up coding agent sessions", the MCP exposes local tools such as
-`shepherd_status` and `shepherd_setup_coding_sessions` that route agents to the
-local `askshepherd status` / add-source flow. Production memory and wiki tools
-remain remote Railway-backed tools for source recall and company-memory answers.
+`shepherd_status`, `shepherd_setup_coding_sessions`, and
+`shepherd_enable_coding_sessions` that route agents to the local
+`askshepherd status` / add-source flow. Production memory and wiki tools remain
+remote Railway-backed tools for source recall and company-memory answers.
+Those local MCP tools are also the permission boundary: an MCP client should not
+use shell or file tools to inspect the user's folders or repositories for setup.
 
 Use `--json` when an agent or setup script needs machine-readable endpoint and
 header details.

package/bin/shepherd-onboard.js

@@ -803,21 +803,28 @@ function localMcpTools() {
   return [
     {
       name: "shepherd_status",
-      description: "LOCAL Shepherd setup and sync status. Use this first when the user asks what they have enabled, what is connected, whether Shepherd is syncing, or why local Messages/Coding Sessions are not running. This is backed by the local askshepherd npm CLI; do not use production memory/wiki tools for local setup status.",
+      description: "LOCAL Shepherd setup and sync status. Use this first when the user asks what they have enabled, what is connected, whether Shepherd is syncing, or why local Messages/Coding Sessions are not running. This is backed by the local askshepherd npm CLI; do not use production memory/wiki tools or shell/file exploration for local setup status.",
       inputSchema: emptyInputSchema,
       annotations: readOnlyAnnotations,
       _meta: { provider: "local_npm", command: `${agentCommand()} status` },
     },
     {
       name: "shepherd_local_status",
-      description: "Explicit local alias for shepherd_status. Returns the authoritative local askshepherd npm status path and current local setup/sync state.",
+      description: "Explicit local alias for shepherd_status. Returns the authoritative local askshepherd npm status path and current local setup/sync state. Do not inspect user folders or repositories yourself.",
       inputSchema: emptyInputSchema,
       annotations: readOnlyAnnotations,
       _meta: { provider: "local_npm", command: `${agentCommand()} status` },
     },
     {
       name: "shepherd_setup_coding_sessions",
-      description: "LOCAL setup guide for Codex and Claude Code coding-session sync. Use when the user asks to set up coding agent sessions. Ask for consent, then guide the local askshepherd npm login/add-sources/continue/status commands.",
+      description: "LOCAL setup guide for Codex and Claude Code coding-session sync. Use when the user asks to set up coding agent sessions. Ask for consent, then guide the local askshepherd npm login/add-sources/continue/status commands. Do not search, list, or read the user's folders or repos to discover setup.",
+      inputSchema: emptyInputSchema,
+      annotations: readOnlyAnnotations,
+      _meta: { provider: "local_npm", command: `${agentCommand()} agent --add-sources coding-sessions` },
+    },
+    {
+      name: "shepherd_enable_coding_sessions",
+      description: "Alias for shepherd_setup_coding_sessions. Use when the user asks to enable coding agent sessions locally for Shepherd. Return the local askshepherd npm setup commands; do not search, list, or read the user's folders or repos.",
       inputSchema: emptyInputSchema,
       annotations: readOnlyAnnotations,
       _meta: { provider: "local_npm", command: `${agentCommand()} agent --add-sources coding-sessions` },
@@ -828,7 +835,8 @@ function localMcpTools() {
 function localMcpInstructions(remoteInstructions, remoteConnectError) {
   return [
     "This MCP server is the local askshepherd npm wrapper plus production Shepherd memory/wiki tools.",
-    `For local setup/sync questions like "what do I have set up on Shepherd", "what have I enabled", "is Shepherd syncing", "help me set up coding agent sessions", or "enable coding sessions", use shepherd_status or shepherd_setup_coding_sessions first. These local tools route to the local askshepherd npm status/setup flow and can inspect ~/.shepherd, LaunchAgents, and local Codex/Claude paths.`,
+    `For local setup/sync questions like "what do I have set up on Shepherd", "what have I enabled", "is Shepherd syncing", "help me set up coding agent sessions", "enable coding sessions", or "enable coding agent sessions locally for Shepherd", use shepherd_status, shepherd_setup_coding_sessions, or shepherd_enable_coding_sessions first. These local tools route to the local askshepherd npm status/setup flow. The askshepherd CLI is the only component that may perform bounded local checks of Shepherd state, LaunchAgents, and known Codex/Claude session locations.`,
+    "Hard boundary: do not use shell or filesystem tools such as ls, find, rg, grep, cat, Read, Glob, or Explore to inspect the user's home directory, repositories, ~/.codex, ~/.claude, or ~/.shepherd for Shepherd setup. If local status is needed, call shepherd_status or run the exact askshepherd status command.",
     `If the user asks for raw local status outside MCP, tell them to run ${agentCommand()} status. For setup of coding agent sessions, ask consent, then use ${agentCommand()} agent --login if needed, ${agentCommand()} agent --add-sources coding-sessions --name "<full_name>" --org "<organization>", ${agentCommand()} agent --continue, then ${agentCommand()} status.`,
     "Use production memory/wiki tools only for company-memory questions, source recall, wiki lookup, messages/meetings retrieval, or coding-session work history that has already synced to Shepherd.",
     "Important override: any production instruction saying not to use local shell commands applies only to production memory/wiki answers. It does not apply to local Shepherd setup, source enablement, or sync health.",
@@ -843,11 +851,12 @@ async function callLocalMcpTool(name) {
     return localMcpTextResult([
       `Authoritative local status path: ${agentCommand()} status`,
       "Use this result for setup/source/sync-health questions. Do not use production memory/wiki tools to answer what is enabled locally.",
+      "Do not inspect the user's folders or repositories yourself. Do not run ls/find/rg/grep/cat/Read/Glob/Explore against the user's home directory, repos, ~/.codex, ~/.claude, or ~/.shepherd for Shepherd setup.",
       renderShepherdStatus(status),
     ].join("\n\n"));
   }
 
-  if (name === "shepherd_setup_coding_sessions") {
+  if (name === "shepherd_setup_coding_sessions" || name === "shepherd_enable_coding_sessions") {
     const status = await collectShepherdStatus();
     return localMcpTextResult(renderCodingSessionsSetupMcpResult(status));
   }
@@ -862,6 +871,7 @@ function renderCodingSessionsSetupMcpResult(status) {
     "Local Shepherd coding-session setup",
     "",
     "Use this when the user asks to set up coding agent sessions. Ask for explicit consent before enabling this source: Shepherd will read local Codex and Claude Code session logs, redact sensitive strings locally, and sync bounded summaries plus repo/command/file metadata, not full raw transcripts.",
+    "Do not inspect the user's folders or repositories to set this up. Do not run ls/find/rg/grep/cat/Read/Glob/Explore against the user's home directory, repos, ~/.codex, ~/.claude, or ~/.shepherd. Use only the Shepherd npm commands below and the status result they print.",
     "",
     alreadyConfigured
       ? "Current state: Coding Sessions already has a local config. Check whether the LaunchAgent is running and whether the last sync is healthy below."
@@ -1837,11 +1847,11 @@ function printAgentContract() {
     commonUserRequests: [
       {
         userSays: "Check what I've enabled for Shepherd.",
-        agentShould: `Run ${command} status and summarize connected sources, local background agents, unreadable folders, queued items, and any next command it prints.`,
+        agentShould: `Run ${command} status and summarize connected sources, local background agents, unreadable folders, queued items, and any next command it prints. Do not inspect local folders or repositories yourself.`,
       },
       {
         userSays: "Help me set up coding agent sessions.",
-        agentShould: `Ask for consent to sync Codex and Claude Code summaries, then run ${command} agent --login if there is no saved Shepherd login, ${command} agent --add-sources coding-sessions --name "<full_name>" --org "<organization>", ${command} agent --continue, and finally ${command} status.`,
+        agentShould: `Ask for consent to sync Codex and Claude Code summaries, then run ${command} agent --login if there is no saved Shepherd login, ${command} agent --add-sources coding-sessions --name "<full_name>" --org "<organization>", ${command} agent --continue, and finally ${command} status. Do not search the user's filesystem or repos for an agent implementation.`,
       },
     ],
     askStyle: [
@@ -1907,6 +1917,7 @@ function printAgentContract() {
       "Do not ask the customer to create a Google service account or upload service account JSON for the default Shepherd-managed flow.",
       "Do not use WorkOS Auth, WorkOS Pipes, or per-user Google OAuth for Google Workspace delegation.",
       "Do not fill onboarding fields from local repository context, shell identity, machine paths, or earlier conversations; confirm them directly with the user.",
+      "Do not use shell or file tools to list, search, or read the user's home directory, repositories, ~/.codex, ~/.claude, or ~/.shepherd for Shepherd setup. Only the askshepherd npm commands should perform local setup/status checks.",
     ],
     loginCommand: `${command} agent --login`,
     startCommand: `${command} agent --name "<full_name>" --org "<organization>"`,
@@ -1950,6 +1961,8 @@ Use this as a public checklist for coding-agent onboarding to Shepherd raw sync.
 
 Confirm onboarding choices and fields directly with the user instead of assuming them from the local repo, shell username, machine paths, or earlier conversations.
 
+Do not inspect the user's folders or repositories for Shepherd setup. Do not run ls, find, rg, grep, cat, Read, Glob, or Explore against the user's home directory, repos, ~/.codex, ~/.claude, or ~/.shepherd. Use the askshepherd npm commands below; those commands perform the bounded local checks.
+
 Ask with short interactive prompts, not as one pasted checklist. Do not paste this whole checklist into the chat unless the user explicitly asks to see it.
 
 Common user requests:
@@ -2038,6 +2051,7 @@ After the current modality is complete, run:
 Omit either optional flag if that source is not being connected.
 
 If Coding Sessions was selected, the continue step installs local Codex/Claude Code session summary sync. It probes ~/.codex and ~/.claude, redacts sensitive strings, and uploads bounded summaries and work metadata rather than full transcripts. It usually does not need Full Disk Access unless macOS denies access to those folders.
+The coding agent must not probe those folders directly; only the askshepherd CLI may perform that local check.
 
 Check progress with:
   ${payload.statusCommand}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "askshepherd",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Customer-facing Shepherd production onboarding and MCP CLI",
   "type": "module",
   "bin": {