claudecode-omc 4.3.4

package/dist/team/__tests__/worker-restart.test.js

@@ -0,0 +1,122 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, rmSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { shouldRestart, recordRestart, readRestartState, clearRestartState, synthesizeBridgeConfig, } from '../worker-restart.js';
+describe('worker-restart', () => {
+    let testDir;
+    const teamName = 'test-team';
+    const workerName = 'worker1';
+    beforeEach(() => {
+        testDir = mkdtempSync(join(tmpdir(), 'worker-restart-test-'));
+    });
+    afterEach(() => {
+        rmSync(testDir, { recursive: true, force: true });
+    });
+    describe('shouldRestart', () => {
+        it('returns base backoff for first restart', () => {
+            const delay = shouldRestart(testDir, teamName, workerName);
+            expect(delay).toBe(5000); // default base
+        });
+        it('returns exponential backoff values', () => {
+            recordRestart(testDir, teamName, workerName);
+            const delay = shouldRestart(testDir, teamName, workerName);
+            expect(delay).toBe(10000); // 5000 * 2^1
+        });
+        it('caps backoff at backoffMaxMs', () => {
+            const policy = { maxRestarts: 10, backoffBaseMs: 5000, backoffMaxMs: 15000, backoffMultiplier: 2 };
+            recordRestart(testDir, teamName, workerName, policy);
+            recordRestart(testDir, teamName, workerName, policy);
+            recordRestart(testDir, teamName, workerName, policy); // count=3, would be 5000*2^3=40000
+            const delay = shouldRestart(testDir, teamName, workerName, policy);
+            expect(delay).toBe(15000); // capped
+        });
+        it('returns null after max restarts', () => {
+            const policy = { maxRestarts: 2, backoffBaseMs: 1000, backoffMaxMs: 60000, backoffMultiplier: 2 };
+            recordRestart(testDir, teamName, workerName, policy);
+            recordRestart(testDir, teamName, workerName, policy);
+            const delay = shouldRestart(testDir, teamName, workerName, policy);
+            expect(delay).toBeNull();
+        });
+        it('uses custom policy', () => {
+            const policy = { maxRestarts: 5, backoffBaseMs: 1000, backoffMaxMs: 30000, backoffMultiplier: 3 };
+            const delay = shouldRestart(testDir, teamName, workerName, policy);
+            expect(delay).toBe(1000); // base
+        });
+    });
+    describe('recordRestart', () => {
+        it('creates restart state on first call', () => {
+            recordRestart(testDir, teamName, workerName);
+            const state = readRestartState(testDir, teamName, workerName);
+            expect(state).not.toBeNull();
+            expect(state.restartCount).toBe(1);
+            expect(state.workerName).toBe(workerName);
+        });
+        it('increments restart count', () => {
+            recordRestart(testDir, teamName, workerName);
+            recordRestart(testDir, teamName, workerName);
+            const state = readRestartState(testDir, teamName, workerName);
+            expect(state.restartCount).toBe(2);
+        });
+        it('updates lastRestartAt timestamp', () => {
+            recordRestart(testDir, teamName, workerName);
+            const state1 = readRestartState(testDir, teamName, workerName);
+            // Small delay to ensure different timestamp
+            recordRestart(testDir, teamName, workerName);
+            const state2 = readRestartState(testDir, teamName, workerName);
+            expect(state2.lastRestartAt).not.toBe('');
+        });
+    });
+    describe('clearRestartState', () => {
+        it('removes restart state', () => {
+            recordRestart(testDir, teamName, workerName);
+            expect(readRestartState(testDir, teamName, workerName)).not.toBeNull();
+            clearRestartState(testDir, teamName, workerName);
+            expect(readRestartState(testDir, teamName, workerName)).toBeNull();
+        });
+        it('does not throw for non-existent state', () => {
+            expect(() => clearRestartState(testDir, teamName, 'nonexistent')).not.toThrow();
+        });
+    });
+    describe('synthesizeBridgeConfig', () => {
+        it('creates config from worker member', () => {
+            const worker = {
+                agentId: 'agent-1',
+                name: 'codex-worker',
+                agentType: 'mcp-codex',
+                model: 'gpt-5.3-codex',
+                joinedAt: Date.now(),
+                tmuxPaneId: 'omc-team-test-codex-worker',
+                cwd: '/home/user/project',
+                backendType: 'tmux',
+                subscriptions: [],
+            };
+            const config = synthesizeBridgeConfig(worker, 'my-team');
+            expect(config.workerName).toBe('codex-worker');
+            expect(config.teamName).toBe('my-team');
+            expect(config.workingDirectory).toBe('/home/user/project');
+            expect(config.provider).toBe('codex');
+            expect(config.model).toBe('gpt-5.3-codex');
+            expect(config.pollIntervalMs).toBe(3000);
+            expect(config.taskTimeoutMs).toBe(600000);
+            expect(config.maxConsecutiveErrors).toBe(3);
+        });
+        it('handles gemini worker', () => {
+            const worker = {
+                agentId: 'agent-2',
+                name: 'gemini-worker',
+                agentType: 'mcp-gemini',
+                model: 'gemini-3-pro-preview',
+                joinedAt: Date.now(),
+                tmuxPaneId: 'omc-team-test-gemini-worker',
+                cwd: '/home/user/project',
+                backendType: 'tmux',
+                subscriptions: [],
+            };
+            const config = synthesizeBridgeConfig(worker, 'my-team');
+            expect(config.provider).toBe('gemini');
+            expect(config.model).toBe('gemini-3-pro-preview');
+        });
+    });
+});
+//# sourceMappingURL=worker-restart.test.js.map

package/dist/team/__tests__/worker-restart.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-restart.test.js","sourceRoot":"","sources":["../../../src/team/__tests__/worker-restart.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAG9B,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,OAAe,CAAC;IACpB,MAAM,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,UAAU,GAAG,SAAS,CAAC;IAE7B,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACnG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACrD,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACrD,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,mCAAmC;YACzF,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YAClG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACrD,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YAClG,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,CAAC,KAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC/D,4CAA4C;YAC5C,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,MAAM,GAAoB;gBAC9B,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,WAAW;gBACtB,KAAK,EAAE,eAAe;gBACtB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,UAAU,EAAE,4BAA4B;gBACxC,GAAG,EAAE,oBAAoB;gBACzB,WAAW,EAAE,MAAM;gBACnB,aAAa,EAAE,EAAE;aAClB,CAAC;YAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,MAAM,GAAoB;gBAC9B,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,YAAY;gBACvB,KAAK,EAAE,sBAAsB;gBAC7B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,UAAU,EAAE,6BAA6B;gBACzC,GAAG,EAAE,oBAAoB;gBACzB,WAAW,EAAE,MAAM;gBACnB,aAAa,EAAE,EAAE;aAClB,CAAC;YAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/team/activity-log.d.ts

@@ -0,0 +1,23 @@
+export interface ActivityEntry {
+    timestamp: string;
+    actor: string;
+    action: string;
+    target?: string;
+    details?: string;
+    category: 'task' | 'file' | 'message' | 'lifecycle' | 'error';
+}
+/**
+ * Get structured activity log from audit events.
+ * Enriches audit events with human-readable descriptions.
+ */
+export declare function getActivityLog(workingDirectory: string, teamName: string, options?: {
+    since?: string;
+    limit?: number;
+    category?: ActivityEntry['category'];
+    actor?: string;
+}): ActivityEntry[];
+/**
+ * Generate a human-readable activity timeline.
+ */
+export declare function formatActivityTimeline(activities: ActivityEntry[]): string;
+//# sourceMappingURL=activity-log.d.ts.map

package/dist/team/activity-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-log.d.ts","sourceRoot":"","sources":["../../src/team/activity-log.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;CAC/D;AAmDD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,aAAa,EAAE,CA6BjB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAY1E"}

package/dist/team/activity-log.js

@@ -0,0 +1,102 @@
+// src/team/activity-log.ts
+/**
+ * Human-readable activity log built on top of audit events.
+ *
+ * Transforms structured audit events into categorized activity entries
+ * with human-readable descriptions suitable for reports and timelines.
+ */
+import { readAuditLog } from './audit-log.js';
+/** Map audit event types to activity categories */
+const CATEGORY_MAP = {
+    bridge_start: 'lifecycle',
+    bridge_shutdown: 'lifecycle',
+    worker_ready: 'lifecycle',
+    task_claimed: 'task',
+    task_started: 'task',
+    task_completed: 'task',
+    task_failed: 'error',
+    task_permanently_failed: 'error',
+    worker_quarantined: 'error',
+    worker_idle: 'lifecycle',
+    inbox_rotated: 'lifecycle',
+    outbox_rotated: 'lifecycle',
+    cli_spawned: 'task',
+    cli_timeout: 'error',
+    cli_error: 'error',
+    shutdown_received: 'lifecycle',
+    shutdown_ack: 'lifecycle',
+    permission_violation: 'error',
+    permission_audit: 'task',
+};
+/** Map audit event types to human-readable action descriptions */
+function describeEvent(event) {
+    switch (event.eventType) {
+        case 'bridge_start': return 'Started bridge daemon';
+        case 'bridge_shutdown': return 'Shut down bridge daemon';
+        case 'worker_ready': return 'Worker ready and accepting tasks';
+        case 'task_claimed': return `Claimed task ${event.taskId || '(unknown)'}`;
+        case 'task_started': return `Started working on task ${event.taskId || '(unknown)'}`;
+        case 'task_completed': return `Completed task ${event.taskId || '(unknown)'}`;
+        case 'task_failed': return `Task ${event.taskId || '(unknown)'} failed`;
+        case 'task_permanently_failed': return `Task ${event.taskId || '(unknown)'} permanently failed`;
+        case 'worker_quarantined': return 'Self-quarantined due to errors';
+        case 'worker_idle': return 'Standing by (idle)';
+        case 'inbox_rotated': return 'Rotated inbox log';
+        case 'outbox_rotated': return 'Rotated outbox log';
+        case 'cli_spawned': return `Spawned CLI process`;
+        case 'cli_timeout': return `CLI process timed out`;
+        case 'cli_error': return `CLI process error`;
+        case 'shutdown_received': return 'Received shutdown signal';
+        case 'shutdown_ack': return 'Acknowledged shutdown';
+        case 'permission_violation': return `Permission violation on task ${event.taskId || '(unknown)'}`;
+        case 'permission_audit': return `Permission audit warning on task ${event.taskId || '(unknown)'}`;
+        default: return event.eventType;
+    }
+}
+/**
+ * Get structured activity log from audit events.
+ * Enriches audit events with human-readable descriptions.
+ */
+export function getActivityLog(workingDirectory, teamName, options) {
+    // Read raw audit events
+    const auditFilter = {};
+    if (options?.since)
+        auditFilter.since = options.since;
+    if (options?.actor)
+        auditFilter.workerName = options.actor;
+    const events = readAuditLog(workingDirectory, teamName, auditFilter);
+    // Transform to activity entries
+    let activities = events.map(event => ({
+        timestamp: event.timestamp,
+        actor: event.workerName,
+        action: describeEvent(event),
+        target: event.taskId,
+        details: event.details ? JSON.stringify(event.details) : undefined,
+        category: CATEGORY_MAP[event.eventType] || 'lifecycle',
+    }));
+    // Apply category filter
+    if (options?.category) {
+        activities = activities.filter(a => a.category === options.category);
+    }
+    // Apply limit
+    if (options?.limit && options.limit > 0) {
+        activities = activities.slice(-options.limit);
+    }
+    return activities;
+}
+/**
+ * Generate a human-readable activity timeline.
+ */
+export function formatActivityTimeline(activities) {
+    if (activities.length === 0)
+        return '(no activity recorded)';
+    const lines = [];
+    for (const a of activities) {
+        // Include full YYYY-MM-DD HH:MM timestamp for clarity across multi-day timelines
+        const time = a.timestamp.slice(0, 16).replace('T', ' '); // YYYY-MM-DD HH:MM
+        const target = a.target ? ` [${a.target}]` : '';
+        lines.push(`[${time}] ${a.actor}: ${a.action}${target}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=activity-log.js.map

package/dist/team/activity-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-log.js","sourceRoot":"","sources":["../../src/team/activity-log.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAE3B;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAY9C,mDAAmD;AACnD,MAAM,YAAY,GAAsD;IACtE,YAAY,EAAE,WAAW;IACzB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,MAAM;IACpB,YAAY,EAAE,MAAM;IACpB,cAAc,EAAE,MAAM;IACtB,WAAW,EAAE,OAAO;IACpB,uBAAuB,EAAE,OAAO;IAChC,kBAAkB,EAAE,OAAO;IAC3B,WAAW,EAAE,WAAW;IACxB,aAAa,EAAE,WAAW;IAC1B,cAAc,EAAE,WAAW;IAC3B,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,OAAO;IACpB,SAAS,EAAE,OAAO;IAClB,iBAAiB,EAAE,WAAW;IAC9B,YAAY,EAAE,WAAW;IACzB,oBAAoB,EAAE,OAAO;IAC7B,gBAAgB,EAAE,MAAM;CACzB,CAAC;AAEF,kEAAkE;AAClE,SAAS,aAAa,CAAC,KAAiB;IACtC,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;QACxB,KAAK,cAAc,CAAC,CAAC,OAAO,uBAAuB,CAAC;QACpD,KAAK,iBAAiB,CAAC,CAAC,OAAO,yBAAyB,CAAC;QACzD,KAAK,cAAc,CAAC,CAAC,OAAO,kCAAkC,CAAC;QAC/D,KAAK,cAAc,CAAC,CAAC,OAAO,gBAAgB,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QAC1E,KAAK,cAAc,CAAC,CAAC,OAAO,2BAA2B,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QACrF,KAAK,gBAAgB,CAAC,CAAC,OAAO,kBAAkB,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QAC9E,KAAK,aAAa,CAAC,CAAC,OAAO,QAAQ,KAAK,CAAC,MAAM,IAAI,WAAW,SAAS,CAAC;QACxE,KAAK,yBAAyB,CAAC,CAAC,OAAO,QAAQ,KAAK,CAAC,MAAM,IAAI,WAAW,qBAAqB,CAAC;QAChG,KAAK,oBAAoB,CAAC,CAAC,OAAO,gCAAgC,CAAC;QACnE,KAAK,aAAa,CAAC,CAAC,OAAO,oBAAoB,CAAC;QAChD,KAAK,eAAe,CAAC,CAAC,OAAO,mBAAmB,CAAC;QACjD,KAAK,gBAAgB,CAAC,CAAC,OAAO,oBAAoB,CAAC;QACnD,KAAK,aAAa,CAAC,CAAC,OAAO,qBAAqB,CAAC;QACjD,KAAK,aAAa,CAAC,CAAC,OAAO,uBAAuB,CAAC;QACnD,KAAK,WAAW,CAAC,CAAC,OAAO,mBAAmB,CAAC;QAC7C,KAAK,mBAAmB,CAAC,CAAC,OAAO,0BAA0B,CAAC;QAC5D,KAAK,cAAc,CAAC,CAAC,OAAO,uBAAuB,CAAC;QACpD,KAAK,sBAAsB,CAAC,CAAC,OAAO,gCAAgC,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QAClG,KAAK,kBAAkB,CAAC,CAAC,OAAO,oCAAoC,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QAClG,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,SAAS,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,gBAAwB,EACxB,QAAgB,EAChB,OAKC;IAED,wBAAwB;IACxB,MAAM,WAAW,GAA4C,EAAE,CAAC;IAChE,IAAI,OAAO,EAAE,KAAK;QAAE,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACtD,IAAI,OAAO,EAAE,KAAK;QAAE,WAAW,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;IAE3D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAErE,gCAAgC;IAChC,IAAI,UAAU,GAAoB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,UAAU;QACvB,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAClE,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,WAAW;KACvD,CAAC,CAAC,CAAC;IAEJ,wBAAwB;IACxB,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED,cAAc;IACd,IAAI,OAAO,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACxC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA2B;IAChE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IAE7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,iFAAiF;QACjF,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,mBAAmB;QAC5E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/team/audit-log.d.ts

@@ -0,0 +1,29 @@
+export type AuditEventType = 'bridge_start' | 'bridge_shutdown' | 'worker_ready' | 'task_claimed' | 'task_started' | 'task_completed' | 'task_failed' | 'task_permanently_failed' | 'worker_quarantined' | 'worker_idle' | 'inbox_rotated' | 'outbox_rotated' | 'cli_spawned' | 'cli_timeout' | 'cli_error' | 'shutdown_received' | 'shutdown_ack' | 'permission_violation' | 'permission_audit';
+export interface AuditEvent {
+    timestamp: string;
+    eventType: AuditEventType;
+    teamName: string;
+    workerName: string;
+    taskId?: string;
+    details?: Record<string, unknown>;
+}
+/**
+ * Append an audit event to the team's audit log.
+ * Append-only JSONL format with 0o600 permissions.
+ */
+export declare function logAuditEvent(workingDirectory: string, event: AuditEvent): void;
+/**
+ * Read audit events with optional filtering.
+ */
+export declare function readAuditLog(workingDirectory: string, teamName: string, filter?: {
+    eventType?: AuditEventType;
+    workerName?: string;
+    since?: string;
+    limit?: number;
+}): AuditEvent[];
+/**
+ * Rotate audit log if it exceeds maxSizeBytes.
+ * Keeps the most recent half of entries.
+ */
+export declare function rotateAuditLog(workingDirectory: string, teamName: string, maxSizeBytes?: number): void;
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/team/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/team/audit-log.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,cAAc,GACtB,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,yBAAyB,GACzB,oBAAoB,GACpB,aAAa,GACb,eAAe,GACf,gBAAgB,GAChB,aAAa,GACb,aAAa,GACb,WAAW,GACX,mBAAmB,GACnB,cAAc,GACd,sBAAsB,GACtB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAQD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,UAAU,GAChB,IAAI,CAON;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE;IACP,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,UAAU,EAAE,CA8Bd;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,MAA6B,GAC1C,IAAI,CA6BN"}

package/dist/team/audit-log.js

@@ -0,0 +1,92 @@
+// src/team/audit-log.ts
+/**
+ * Structured audit logging for MCP Team Bridge.
+ *
+ * All events are logged to append-only JSONL files with 0o600 permissions.
+ * Automatic rotation when log exceeds size threshold.
+ */
+import { join } from 'node:path';
+import { existsSync, readFileSync, statSync, renameSync, writeFileSync, lstatSync, unlinkSync } from 'node:fs';
+import { appendFileWithMode, ensureDirWithMode, validateResolvedPath } from './fs-utils.js';
+const DEFAULT_MAX_LOG_SIZE = 5 * 1024 * 1024; // 5MB
+function getLogPath(workingDirectory, teamName) {
+    return join(workingDirectory, '.omc', 'logs', `team-bridge-${teamName}.jsonl`);
+}
+/**
+ * Append an audit event to the team's audit log.
+ * Append-only JSONL format with 0o600 permissions.
+ */
+export function logAuditEvent(workingDirectory, event) {
+    const logPath = getLogPath(workingDirectory, event.teamName);
+    const dir = join(workingDirectory, '.omc', 'logs');
+    validateResolvedPath(logPath, workingDirectory);
+    ensureDirWithMode(dir);
+    const line = JSON.stringify(event) + '\n';
+    appendFileWithMode(logPath, line);
+}
+/**
+ * Read audit events with optional filtering.
+ */
+export function readAuditLog(workingDirectory, teamName, filter) {
+    const logPath = getLogPath(workingDirectory, teamName);
+    if (!existsSync(logPath))
+        return [];
+    const content = readFileSync(logPath, 'utf-8');
+    const lines = content.split('\n').filter(l => l.trim());
+    const maxResults = filter?.limit;
+    const events = [];
+    for (const line of lines) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            continue; /* skip malformed */
+        }
+        // Apply filters inline for early-exit optimization
+        if (filter) {
+            if (filter.eventType && event.eventType !== filter.eventType)
+                continue;
+            if (filter.workerName && event.workerName !== filter.workerName)
+                continue;
+            if (filter.since && event.timestamp < filter.since)
+                continue;
+        }
+        events.push(event);
+        // Early exit when limit is reached
+        if (maxResults !== undefined && events.length >= maxResults)
+            break;
+    }
+    return events;
+}
+/**
+ * Rotate audit log if it exceeds maxSizeBytes.
+ * Keeps the most recent half of entries.
+ */
+export function rotateAuditLog(workingDirectory, teamName, maxSizeBytes = DEFAULT_MAX_LOG_SIZE) {
+    const logPath = getLogPath(workingDirectory, teamName);
+    if (!existsSync(logPath))
+        return;
+    const stat = statSync(logPath);
+    if (stat.size <= maxSizeBytes)
+        return;
+    const content = readFileSync(logPath, 'utf-8');
+    const lines = content.split('\n').filter(l => l.trim());
+    // Keep the most recent half
+    const keepFrom = Math.floor(lines.length / 2);
+    const rotated = lines.slice(keepFrom).join('\n') + '\n';
+    // Atomic write: write to temp, then rename
+    const tmpPath = logPath + '.tmp';
+    const logsDir = join(workingDirectory, '.omc', 'logs');
+    validateResolvedPath(tmpPath, logsDir);
+    // Prevent symlink attacks: if tmp path exists as symlink, remove it
+    if (existsSync(tmpPath)) {
+        const tmpStat = lstatSync(tmpPath);
+        if (tmpStat.isSymbolicLink()) {
+            unlinkSync(tmpPath);
+        }
+    }
+    writeFileSync(tmpPath, rotated, { encoding: 'utf-8', mode: 0o600 });
+    renameSync(tmpPath, logPath);
+}
+//# sourceMappingURL=audit-log.js.map

package/dist/team/audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/team/audit-log.ts"],"names":[],"mappings":"AAAA,wBAAwB;AAExB;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAgC5F,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM;AAEpD,SAAS,UAAU,CAAC,gBAAwB,EAAE,QAAgB;IAC5D,OAAO,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,QAAQ,QAAQ,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,gBAAwB,EACxB,KAAiB;IAEjB,MAAM,OAAO,GAAG,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAChD,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC1C,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,gBAAwB,EACxB,QAAgB,EAChB,MAKC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,KAAK,CAAC;IACjC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS,CAAC,oBAAoB;QAAC,CAAC;QAE1C,mDAAmD;QACnD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;gBAAE,SAAS;YACvE,IAAI,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,SAAS;YAC1E,IAAI,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK;gBAAE,SAAS;QAC/D,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEnB,mCAAmC;QACnC,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM;IACrE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,gBAAwB,EACxB,QAAgB,EAChB,eAAuB,oBAAoB;IAE3C,MAAM,OAAO,GAAG,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO;IAEjC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,IAAI,YAAY;QAAE,OAAO;IAEtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,2CAA2C;IAC3C,MAAM,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEvC,oEAAoE;IACpE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7B,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/team/bridge-entry.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Validate that a config path is under the user's home directory
+ * and contains a trusted subpath (Claude config dir or ~/.omc/).
+ * Resolves the path first to defeat traversal attacks like ~/foo/.claude/../../evil.json.
+ */
+export declare function validateConfigPath(configPath: string, homeDir: string, claudeConfigDir: string): boolean;
+//# sourceMappingURL=bridge-entry.d.ts.map

package/dist/team/bridge-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-entry.d.ts","sourceRoot":"","sources":["../../src/team/bridge-entry.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CA6BxG"}

package/dist/team/bridge-entry.js

@@ -0,0 +1,189 @@
+// src/team/bridge-entry.ts
+//
+// Entry point for the bridge daemon, invoked from tmux:
+//   node dist/team/bridge-entry.js --config /path/to/config.json
+//
+// Config via temp file, not inline JSON argument.
+import { readFileSync, statSync, realpathSync } from 'fs';
+import { resolve } from 'path';
+import { homedir } from 'os';
+import { runBridge } from './mcp-team-bridge.js';
+import { deleteHeartbeat } from './heartbeat.js';
+import { unregisterMcpWorker } from './team-registration.js';
+import { getWorktreeRoot } from '../lib/worktree-paths.js';
+import { getClaudeConfigDir } from '../utils/paths.js';
+import { sanitizeName } from './tmux-session.js';
+/**
+ * Validate that a config path is under the user's home directory
+ * and contains a trusted subpath (Claude config dir or ~/.omc/).
+ * Resolves the path first to defeat traversal attacks like ~/foo/.claude/../../evil.json.
+ */
+export function validateConfigPath(configPath, homeDir, claudeConfigDir) {
+    // Resolve to canonical absolute path to defeat ".." traversal
+    const resolved = resolve(configPath);
+    const isUnderHome = resolved.startsWith(homeDir + '/') || resolved === homeDir;
+    const normalizedConfigDir = resolve(claudeConfigDir);
+    const normalizedOmcDir = resolve(homeDir, '.omc');
+    const hasOmcComponent = resolved.includes('/.omc/') || resolved.endsWith('/.omc');
+    const isTrustedSubpath = resolved === normalizedConfigDir ||
+        resolved.startsWith(normalizedConfigDir + '/') ||
+        resolved === normalizedOmcDir ||
+        resolved.startsWith(normalizedOmcDir + '/') ||
+        hasOmcComponent;
+    if (!isUnderHome || !isTrustedSubpath)
+        return false;
+    // Additionally verify via realpathSync on the parent directory (if it exists)
+    // to defeat symlink attacks where the parent is a symlink outside home
+    try {
+        const parentDir = resolve(resolved, '..');
+        const realParent = realpathSync(parentDir);
+        if (!realParent.startsWith(homeDir + '/') && realParent !== homeDir) {
+            return false;
+        }
+    }
+    catch {
+        // Parent directory doesn't exist yet — allow (file may be about to be created)
+    }
+    return true;
+}
+/**
+ * Validate the bridge working directory is safe:
+ * - Must exist and be a directory
+ * - Must resolve (via realpathSync) to a path under the user's home directory
+ * - Must be inside a git worktree
+ */
+function validateBridgeWorkingDirectory(workingDirectory) {
+    // Check exists and is directory
+    let stat;
+    try {
+        stat = statSync(workingDirectory);
+    }
+    catch {
+        throw new Error(`workingDirectory does not exist: ${workingDirectory}`);
+    }
+    if (!stat.isDirectory()) {
+        throw new Error(`workingDirectory is not a directory: ${workingDirectory}`);
+    }
+    // Resolve symlinks and verify under homedir
+    const resolved = realpathSync(workingDirectory);
+    const home = homedir();
+    if (!resolved.startsWith(home + '/') && resolved !== home) {
+        throw new Error(`workingDirectory is outside home directory: ${resolved}`);
+    }
+    // Must be inside a git worktree
+    const root = getWorktreeRoot(workingDirectory);
+    if (!root) {
+        throw new Error(`workingDirectory is not inside a git worktree: ${workingDirectory}`);
+    }
+}
+function main() {
+    // Parse --config flag
+    const configIdx = process.argv.indexOf('--config');
+    if (configIdx === -1 || !process.argv[configIdx + 1]) {
+        console.error('Usage: node bridge-entry.js --config <path-to-config.json>');
+        process.exit(1);
+    }
+    const configPath = resolve(process.argv[configIdx + 1]);
+    // Validate config path is from a trusted location
+    const home = homedir();
+    const claudeConfigDir = getClaudeConfigDir();
+    if (!validateConfigPath(configPath, home, claudeConfigDir)) {
+        console.error(`Config path must be under ~/ with ${claudeConfigDir} or ~/.omc/ subpath: ${configPath}`);
+        process.exit(1);
+    }
+    let config;
+    try {
+        const raw = readFileSync(configPath, 'utf-8');
+        config = JSON.parse(raw);
+    }
+    catch (err) {
+        console.error(`Failed to read config from ${configPath}: ${err.message}`);
+        process.exit(1);
+    }
+    // Validate required fields
+    const required = ['teamName', 'workerName', 'provider', 'workingDirectory'];
+    for (const field of required) {
+        if (!config[field]) {
+            console.error(`Missing required config field: ${field}`);
+            process.exit(1);
+        }
+    }
+    // Sanitize team and worker names (prevent tmux injection)
+    config.teamName = sanitizeName(config.teamName);
+    config.workerName = sanitizeName(config.workerName);
+    // Validate provider
+    if (config.provider !== 'codex' && config.provider !== 'gemini') {
+        console.error(`Invalid provider: ${config.provider}. Must be 'codex' or 'gemini'.`);
+        process.exit(1);
+    }
+    // Validate working directory before use
+    try {
+        validateBridgeWorkingDirectory(config.workingDirectory);
+    }
+    catch (err) {
+        console.error(`[bridge] Invalid workingDirectory: ${err.message}`);
+        process.exit(1);
+    }
+    // Validate permission enforcement config
+    if (config.permissionEnforcement) {
+        const validModes = ['off', 'audit', 'enforce'];
+        if (!validModes.includes(config.permissionEnforcement)) {
+            console.error(`Invalid permissionEnforcement: ${config.permissionEnforcement}. Must be 'off', 'audit', or 'enforce'.`);
+            process.exit(1);
+        }
+        // Validate permissions shape when enforcement is active
+        if (config.permissionEnforcement !== 'off' && config.permissions) {
+            const p = config.permissions;
+            if (p.allowedPaths && !Array.isArray(p.allowedPaths)) {
+                console.error('permissions.allowedPaths must be an array of strings');
+                process.exit(1);
+            }
+            if (p.deniedPaths && !Array.isArray(p.deniedPaths)) {
+                console.error('permissions.deniedPaths must be an array of strings');
+                process.exit(1);
+            }
+            if (p.allowedCommands && !Array.isArray(p.allowedCommands)) {
+                console.error('permissions.allowedCommands must be an array of strings');
+                process.exit(1);
+            }
+            // Reject dangerous patterns that could defeat the deny-defaults
+            const dangerousPatterns = ['**', '*', '!.git/**', '!.env*', '!**/.env*'];
+            for (const pattern of (p.allowedPaths || [])) {
+                if (dangerousPatterns.includes(pattern)) {
+                    console.error(`Dangerous allowedPaths pattern rejected: "${pattern}"`);
+                    process.exit(1);
+                }
+            }
+        }
+    }
+    // Apply defaults
+    config.pollIntervalMs = config.pollIntervalMs || 3000;
+    config.taskTimeoutMs = config.taskTimeoutMs || 600_000;
+    config.maxConsecutiveErrors = config.maxConsecutiveErrors || 3;
+    config.outboxMaxLines = config.outboxMaxLines || 500;
+    config.maxRetries = config.maxRetries || 5;
+    config.permissionEnforcement = config.permissionEnforcement || 'off';
+    // Signal handlers for graceful cleanup on external termination
+    for (const sig of ['SIGINT', 'SIGTERM']) {
+        process.on(sig, () => {
+            console.error(`[bridge] Received ${sig}, shutting down...`);
+            try {
+                deleteHeartbeat(config.workingDirectory, config.teamName, config.workerName);
+                unregisterMcpWorker(config.teamName, config.workerName, config.workingDirectory);
+            }
+            catch { /* best-effort cleanup */ }
+            process.exit(0);
+        });
+    }
+    // Run bridge (never returns unless shutdown)
+    runBridge(config).catch(err => {
+        console.error(`[bridge] Fatal error: ${err.message}`);
+        process.exit(1);
+    });
+}
+// Only run main if this file is the entry point (not imported for testing).
+// Note: require.main === module is correct here - this file is bundled to CJS by esbuild.
+if (require.main === module) {
+    main();
+}
+//# sourceMappingURL=bridge-entry.js.map

package/dist/team/bridge-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-entry.js","sourceRoot":"","sources":["../../src/team/bridge-entry.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,wDAAwD;AACxD,iEAAiE;AACjE,EAAE;AACF,kDAAkD;AAElD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,OAAe,EAAE,eAAuB;IAC7F,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAErC,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC;IAC/E,MAAM,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClF,MAAM,gBAAgB,GACpB,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC;QAC9C,QAAQ,KAAK,gBAAgB;QAC7B,QAAQ,CAAC,UAAU,CAAC,gBAAgB,GAAG,GAAG,CAAC;QAC3C,eAAe,CAAC;IAClB,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAEpD,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;IACjF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,8BAA8B,CAAC,gBAAwB;IAC9D,gCAAgC;IAChC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oCAAoC,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,gBAAgB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,gCAAgC;IAChC,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,kDAAkD,gBAAgB,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,sBAAsB;IACtB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;IAExD,kDAAkD;IAClD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,qCAAqC,eAAe,wBAAwB,UAAU,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2BAA2B;IAC3B,MAAM,QAAQ,GAA2B,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACpG,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEpD,oBAAoB;IACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,qBAAqB,MAAM,CAAC,QAAQ,gCAAgC,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC;QACH,8BAA8B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,sCAAuC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,qBAAqB,yCAAyC,CAAC,CAAC;YACvH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,wDAAwD;QACxD,IAAI,MAAM,CAAC,qBAAqB,KAAK,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;YAC7B,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrD,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YACzE,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC7C,IAAI,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxC,OAAO,CAAC,KAAK,CAAC,6CAA6C,OAAO,GAAG,CAAC,CAAC;oBACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IACtD,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC;IACvD,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC;IACrD,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,KAAK,CAAC;IAErE,+DAA+D;IAC/D,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACjD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE;YACnB,OAAO,CAAC,KAAK,CAAC,qBAAqB,GAAG,oBAAoB,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,eAAe,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC7E,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC5B,OAAO,CAAC,KAAK,CAAC,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,0FAA0F;AAC1F,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC;AACT,CAAC"}