claudecode-omc 4.3.4

package/dist/team/permissions.js

@@ -0,0 +1,219 @@
+// src/team/permissions.ts
+/**
+ * RBAC-compatible advisory permission scoping for workers.
+ *
+ * NOTE: This is an advisory layer only. MCP workers run in full-auto mode
+ * and cannot be mechanically restricted. Permissions are injected into
+ * prompts as instructions for the LLM to follow.
+ */
+import { relative, resolve } from 'node:path';
+/**
+ * Simple glob matching for path patterns.
+ * Supports: * (any non-/ chars), ** (any depth including /), ? (single non-/ char), exact match.
+ *
+ * Uses iterative character-by-character matching to avoid ReDoS risk from regex.
+ */
+function matchGlob(pattern, path) {
+    let pi = 0; // pattern index
+    let si = 0; // string (path) index
+    let starPi = -1; // pattern index after last '*' fallback point
+    let starSi = -1; // string index at last '*' fallback point
+    while (si < path.length) {
+        // Check for '**' (matches anything including '/')
+        if (pi < pattern.length - 1 && pattern[pi] === '*' && pattern[pi + 1] === '*') {
+            // Consume the '**'
+            pi += 2;
+            // Skip trailing '/' after '**' if present
+            if (pi < pattern.length && pattern[pi] === '/')
+                pi++;
+            starPi = pi;
+            starSi = si;
+            continue;
+        }
+        // Check for single '*' (matches any non-/ chars)
+        if (pi < pattern.length && pattern[pi] === '*') {
+            pi++;
+            starPi = pi;
+            starSi = si;
+            continue;
+        }
+        // Check for '?' (matches single non-/ char)
+        if (pi < pattern.length && pattern[pi] === '?' && path[si] !== '/') {
+            pi++;
+            si++;
+            continue;
+        }
+        // Exact character match
+        if (pi < pattern.length && pattern[pi] === path[si]) {
+            pi++;
+            si++;
+            continue;
+        }
+        // Mismatch: backtrack to last star if possible
+        if (starPi !== -1) {
+            pi = starPi;
+            starSi++;
+            si = starSi;
+            // For single '*', don't match across '/'
+            // We detect this by checking if the star was a '**' or '*'
+            // If we got here from '**', slashes are OK; from '*', skip if slash
+            // Re-check: was the star a '**'?
+            const wasSingleStar = starPi >= 2 && pattern[starPi - 2] === '*' && pattern[starPi - 1] === '*' ? false :
+                starPi >= 1 && pattern[starPi - 1] === '*' ? true : false;
+            if (wasSingleStar && si > 0 && path[si - 1] === '/') {
+                return false;
+            }
+            continue;
+        }
+        return false;
+    }
+    // Consume remaining pattern characters (trailing '*' or '**')
+    while (pi < pattern.length) {
+        if (pattern[pi] === '*') {
+            pi++;
+        }
+        else if (pattern[pi] === '/') {
+            // Allow trailing slash in pattern after '**'
+            pi++;
+        }
+        else {
+            break;
+        }
+    }
+    return pi === pattern.length;
+}
+/**
+ * Check if a worker is allowed to modify a given path.
+ * Denied paths override allowed paths.
+ */
+export function isPathAllowed(permissions, filePath, workingDirectory) {
+    // Normalize to relative path
+    const absPath = resolve(workingDirectory, filePath);
+    const relPath = relative(workingDirectory, absPath);
+    // If path escapes working directory, always deny
+    if (relPath.startsWith('..'))
+        return false;
+    // Check denied paths first (they override)
+    for (const pattern of permissions.deniedPaths) {
+        if (matchGlob(pattern, relPath))
+            return false;
+    }
+    // If no allowed paths specified, allow all within workingDirectory
+    if (permissions.allowedPaths.length === 0)
+        return true;
+    // Check allowed paths
+    for (const pattern of permissions.allowedPaths) {
+        if (matchGlob(pattern, relPath))
+            return true;
+    }
+    return false;
+}
+/**
+ * Check if a worker is allowed to run a given command.
+ * Empty allowedCommands means all commands are allowed.
+ */
+export function isCommandAllowed(permissions, command) {
+    if (permissions.allowedCommands.length === 0)
+        return true;
+    const trimmed = command.trim();
+    return permissions.allowedCommands.some(prefix => trimmed.startsWith(prefix));
+}
+/**
+ * Generate permission instructions for inclusion in worker prompt.
+ */
+export function formatPermissionInstructions(permissions) {
+    const lines = [];
+    lines.push('PERMISSION CONSTRAINTS:');
+    if (permissions.allowedPaths.length > 0) {
+        lines.push(`- You may ONLY modify files matching: ${permissions.allowedPaths.join(', ')}`);
+    }
+    if (permissions.deniedPaths.length > 0) {
+        lines.push(`- You must NOT modify files matching: ${permissions.deniedPaths.join(', ')}`);
+    }
+    if (permissions.allowedCommands.length > 0) {
+        lines.push(`- You may ONLY run commands starting with: ${permissions.allowedCommands.join(', ')}`);
+    }
+    if (Number.isFinite(permissions.maxFileSize)) {
+        lines.push(`- Maximum file size: ${Math.round(permissions.maxFileSize / 1024)}KB per file`);
+    }
+    if (lines.length === 1) {
+        lines.push('- No restrictions (full access within working directory)');
+    }
+    return lines.join('\n');
+}
+/**
+ * Default permissions (allow all within working directory).
+ */
+export function getDefaultPermissions(workerName) {
+    return {
+        workerName,
+        allowedPaths: [], // empty = allow all
+        deniedPaths: [],
+        allowedCommands: [], // empty = allow all
+        maxFileSize: Infinity,
+    };
+}
+/**
+ * Secure deny-defaults that are always enforced regardless of caller config.
+ * These protect sensitive files from being modified by any worker.
+ */
+const SECURE_DENY_DEFAULTS = [
+    '.git/**',
+    '.env*',
+    '**/.env*',
+    '**/secrets/**',
+    '**/.ssh/**',
+    '**/node_modules/.cache/**',
+];
+/**
+ * Merge caller-provided permissions with secure deny-defaults.
+ * The deny-defaults are always prepended to deniedPaths so they cannot be overridden.
+ */
+export function getEffectivePermissions(base) {
+    const perms = base
+        ? { ...getDefaultPermissions(base.workerName), ...base }
+        : getDefaultPermissions('default');
+    // Prepend secure defaults (deduplicating against existing deniedPaths)
+    const existingSet = new Set(perms.deniedPaths);
+    const merged = [
+        ...SECURE_DENY_DEFAULTS.filter(p => !existingSet.has(p)),
+        ...perms.deniedPaths,
+    ];
+    perms.deniedPaths = merged;
+    return perms;
+}
+/**
+ * Check a list of changed file paths against permissions.
+ * Returns an array of violations (empty = all paths allowed).
+ *
+ * @param changedPaths - relative or absolute paths of files that were modified
+ * @param permissions - effective permissions to check against
+ * @param cwd - working directory for resolving relative paths
+ */
+export function findPermissionViolations(changedPaths, permissions, cwd) {
+    const violations = [];
+    for (const filePath of changedPaths) {
+        if (!isPathAllowed(permissions, filePath, cwd)) {
+            // Determine which deny pattern matched for the reason
+            const absPath = resolve(cwd, filePath);
+            const relPath = relative(cwd, absPath);
+            let reason;
+            if (relPath.startsWith('..')) {
+                reason = `Path escapes working directory: ${relPath}`;
+            }
+            else {
+                // Find which deny pattern matched
+                const matchedDeny = permissions.deniedPaths.find(p => matchGlob(p, relPath));
+                if (matchedDeny) {
+                    reason = `Matches denied pattern: ${matchedDeny}`;
+                }
+                else {
+                    reason = `Not in allowed paths: ${permissions.allowedPaths.join(', ') || '(none configured)'}`;
+                }
+            }
+            violations.push({ path: relPath, reason });
+        }
+    }
+    return violations;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/team/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/team/permissions.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAU9C;;;;;GAKG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,IAAY;IAC9C,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB;IAC5B,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,sBAAsB;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8CAA8C;IAC/D,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0CAA0C;IAE3D,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,kDAAkD;QAClD,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC9E,mBAAmB;YACnB,EAAE,IAAI,CAAC,CAAC;YACR,0CAA0C;YAC1C,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,GAAG;gBAAE,EAAE,EAAE,CAAC;YACrD,MAAM,GAAG,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,iDAAiD;QACjD,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/C,EAAE,EAAE,CAAC;YACL,MAAM,GAAG,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,4CAA4C;QAC5C,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;YACnE,EAAE,EAAE,CAAC;YACL,EAAE,EAAE,CAAC;YACL,SAAS;QACX,CAAC;QAED,wBAAwB;QACxB,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACpD,EAAE,EAAE,CAAC;YACL,EAAE,EAAE,CAAC;YACL,SAAS;QACX,CAAC;QAED,+CAA+C;QAC/C,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,EAAE,GAAG,MAAM,CAAC;YACZ,MAAM,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,CAAC;YAEZ,yCAAyC;YACzC,2DAA2D;YAC3D,oEAAoE;YACpE,iCAAiC;YACjC,MAAM,aAAa,GACjB,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACnF,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YAE5D,IAAI,aAAa,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,SAAS;QACX,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8DAA8D;IAC9D,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;YACxB,EAAE,EAAE,CAAC;QACP,CAAC;aAAM,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/B,6CAA6C;YAC7C,EAAE,EAAE,CAAC;QACP,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,WAA8B,EAC9B,QAAgB,EAChB,gBAAwB;IAExB,6BAA6B;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAEpD,iDAAiD;IACjD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,2CAA2C;IAC3C,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IAChD,CAAC;IAED,mEAAmE;IACnE,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sBAAsB;IACtB,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAA8B,EAC9B,OAAe;IAEf,IAAI,WAAW,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,OAAO,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAC/C,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAA8B;IAE9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAEtC,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,yCAAyC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,yCAAyC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,WAAW,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,8CAA8C,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,OAAO;QACL,UAAU;QACV,YAAY,EAAE,EAAE,EAAM,oBAAoB;QAC1C,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,EAAE,EAAG,oBAAoB;QAC1C,WAAW,EAAE,QAAQ;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAa;IACrC,SAAS;IACT,OAAO;IACP,UAAU;IACV,eAAe;IACf,YAAY;IACZ,2BAA2B;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA0D;IAChG,MAAM,KAAK,GAAG,IAAI;QAChB,CAAC,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE;QACxD,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAErC,uEAAuE;IACvE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG;QACb,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,GAAG,KAAK,CAAC,WAAW;KACrB,CAAC;IACF,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC;IAE3B,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAsB,EACtB,WAA8B,EAC9B,GAAW;IAEX,MAAM,UAAU,GAA0B,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/C,sDAAsD;YACtD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAEvC,IAAI,MAAc,CAAC;YACnB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,GAAG,mCAAmC,OAAO,EAAE,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,kCAAkC;gBAClC,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC7E,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,GAAG,2BAA2B,WAAW,EAAE,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,yBAAyB,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC;gBACjG,CAAC;YACH,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/team/summary-report.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generate a markdown summary report for a team session.
+ */
+export declare function generateTeamReport(workingDirectory: string, teamName: string): string;
+/**
+ * Write the report to disk.
+ * Path: .omc/reports/team-{teamName}-{timestamp}.md
+ * Returns the file path.
+ */
+export declare function saveTeamReport(workingDirectory: string, teamName: string): string;
+//# sourceMappingURL=summary-report.d.ts.map

package/dist/team/summary-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary-report.d.ts","sourceRoot":"","sources":["../../src/team/summary-report.ts"],"names":[],"mappings":"AAiBA;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,MAAM,CA+ER;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,MAAM,CASR"}

package/dist/team/summary-report.js

@@ -0,0 +1,101 @@
+// src/team/summary-report.ts
+/**
+ * Team summary report generator.
+ *
+ * Generates comprehensive markdown reports combining:
+ * - Activity log
+ * - Usage statistics
+ * - Audit event history
+ */
+import { join } from 'node:path';
+import { writeFileWithMode, ensureDirWithMode, validateResolvedPath } from './fs-utils.js';
+import { getActivityLog, formatActivityTimeline } from './activity-log.js';
+import { generateUsageReport } from './usage-tracker.js';
+import { readAuditLog } from './audit-log.js';
+/**
+ * Generate a markdown summary report for a team session.
+ */
+export function generateTeamReport(workingDirectory, teamName) {
+    // Gather data
+    const activities = getActivityLog(workingDirectory, teamName);
+    const usage = generateUsageReport(workingDirectory, teamName);
+    const auditEvents = readAuditLog(workingDirectory, teamName);
+    // Compute stats
+    const taskCompleted = auditEvents.filter(e => e.eventType === 'task_completed').length;
+    const taskFailed = auditEvents.filter(e => e.eventType === 'task_permanently_failed').length;
+    const taskTotal = taskCompleted + taskFailed;
+    const workerCount = new Set(auditEvents.map(e => e.workerName)).size;
+    // Duration
+    const startEvents = auditEvents.filter(e => e.eventType === 'bridge_start');
+    const endEvents = auditEvents.filter(e => e.eventType === 'bridge_shutdown');
+    let durationStr = 'unknown';
+    if (startEvents.length > 0) {
+        const startTime = new Date(startEvents[0].timestamp).getTime();
+        const endTime = endEvents.length > 0
+            ? new Date(endEvents[endEvents.length - 1].timestamp).getTime()
+            : Date.now();
+        const durationMin = Math.round((endTime - startTime) / 60000);
+        durationStr = `${durationMin} minutes`;
+    }
+    // Build report
+    const lines = [];
+    lines.push(`# Team Report: ${teamName}`);
+    lines.push('');
+    lines.push('## Summary');
+    lines.push(`- Duration: ${durationStr}`);
+    lines.push(`- Workers: ${workerCount}`);
+    lines.push(`- Tasks: ${taskCompleted} completed, ${taskFailed} failed, ${taskTotal} total`);
+    lines.push('');
+    // Task results table
+    const taskEvents = auditEvents.filter(e => e.eventType === 'task_completed' || e.eventType === 'task_permanently_failed');
+    if (taskEvents.length > 0) {
+        lines.push('## Task Results');
+        lines.push('| Task | Worker | Status |');
+        lines.push('|------|--------|--------|');
+        for (const event of taskEvents) {
+            const status = event.eventType === 'task_completed' ? 'Completed' : 'Failed';
+            lines.push(`| ${event.taskId || 'N/A'} | ${event.workerName} | ${status} |`);
+        }
+        lines.push('');
+    }
+    // Worker performance table
+    if (usage.workers.length > 0) {
+        lines.push('## Worker Performance');
+        lines.push('| Worker | Tasks | Wall-Clock Time | Prompt Chars | Response Chars |');
+        lines.push('|--------|-------|-----------------|--------------|----------------|');
+        for (const w of usage.workers) {
+            const timeStr = `${Math.round(w.totalWallClockMs / 1000)}s`;
+            lines.push(`| ${w.workerName} | ${w.taskCount} | ${timeStr} | ${w.totalPromptChars.toLocaleString()} | ${w.totalResponseChars.toLocaleString()} |`);
+        }
+        lines.push('');
+    }
+    // Activity timeline
+    lines.push('## Activity Timeline');
+    const timeline = formatActivityTimeline(activities.slice(-50)); // Last 50 entries
+    lines.push(timeline);
+    lines.push('');
+    // Usage totals
+    lines.push('## Usage Totals');
+    lines.push(`- Total wall-clock time: ${Math.round(usage.totalWallClockMs / 1000)}s`);
+    lines.push(`- Total tasks: ${usage.taskCount}`);
+    lines.push('');
+    lines.push('---');
+    lines.push(`*Generated at ${new Date().toISOString()}*`);
+    return lines.join('\n');
+}
+/**
+ * Write the report to disk.
+ * Path: .omc/reports/team-{teamName}-{timestamp}.md
+ * Returns the file path.
+ */
+export function saveTeamReport(workingDirectory, teamName) {
+    const report = generateTeamReport(workingDirectory, teamName);
+    const dir = join(workingDirectory, '.omc', 'reports');
+    ensureDirWithMode(dir);
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const filePath = join(dir, `team-${teamName}-${timestamp}.md`);
+    validateResolvedPath(filePath, workingDirectory);
+    writeFileWithMode(filePath, report);
+    return filePath;
+}
+//# sourceMappingURL=summary-report.js.map

package/dist/team/summary-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary-report.js","sourceRoot":"","sources":["../../src/team/summary-report.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAE7B;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,gBAAwB,EACxB,QAAgB;IAEhB,cAAc;IACd,MAAM,UAAU,GAAG,cAAc,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,YAAY,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAE7D,gBAAgB;IAChB,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC,MAAM,CAAC;IACvF,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,yBAAyB,CAAC,CAAC,MAAM,CAAC;IAC7F,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAErE,WAAW;IACX,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,iBAAiB,CAAC,CAAC;IAC7E,IAAI,WAAW,GAAG,SAAS,CAAC;IAC5B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;YAC/D,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC;QAC9D,WAAW,GAAG,GAAG,WAAW,UAAU,CAAC;IACzC,CAAC;IAED,eAAe;IACf,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,cAAc,WAAW,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,YAAY,aAAa,eAAe,UAAU,YAAY,SAAS,QAAQ,CAAC,CAAC;IAC5F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,qBAAqB;IACrB,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACxC,CAAC,CAAC,SAAS,KAAK,gBAAgB,IAAI,CAAC,CAAC,SAAS,KAAK,yBAAyB,CAC9E,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,MAAM,KAAK,CAAC,UAAU,MAAM,MAAM,IAAI,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,2BAA2B;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACnF,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,SAAS,MAAM,OAAO,MAAM,CAAC,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACtJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,oBAAoB;IACpB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;IAClF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,eAAe;IACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAEzD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,gBAAwB,EACxB,QAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,QAAQ,IAAI,SAAS,KAAK,CAAC,CAAC;IAC/D,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACjD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/team/task-file-ops.d.ts

@@ -0,0 +1,76 @@
+import type { TaskFile, TaskFileUpdate, TaskFailureSidecar } from './types.js';
+/** Handle returned by acquireTaskLock; pass to releaseTaskLock. */
+export interface LockHandle {
+    fd: number;
+    path: string;
+}
+/**
+ * Try to acquire an exclusive lock file for a task.
+ *
+ * Uses O_CREAT|O_EXCL|O_WRONLY which atomically creates the file only if
+ * it doesn't already exist — the kernel guarantees no two openers succeed.
+ *
+ * If the lock file already exists, checks for staleness (age > staleLockMs
+ * AND owner PID is dead) and reaps if stale, retrying once.
+ *
+ * Returns a LockHandle on success, or null if the lock is held by another live worker.
+ */
+export declare function acquireTaskLock(teamName: string, taskId: string, opts?: {
+    staleLockMs?: number;
+    workerName?: string;
+}): LockHandle | null;
+/**
+ * Release a previously acquired task lock.
+ * Closes the file descriptor and removes the lock file.
+ */
+export declare function releaseTaskLock(handle: LockHandle): void;
+/**
+ * Execute a function while holding an exclusive task lock.
+ * Returns the function's result, or null if the lock could not be acquired.
+ */
+export declare function withTaskLock<T>(teamName: string, taskId: string, fn: () => T | Promise<T>, opts?: {
+    staleLockMs?: number;
+    workerName?: string;
+}): Promise<T | null>;
+/** Read a single task file. Returns null if not found or malformed. */
+export declare function readTask(teamName: string, taskId: string): TaskFile | null;
+/**
+ * Atomic update: reads full task JSON, patches specified fields, writes back.
+ * Preserves unknown fields to avoid data loss.
+ *
+ * When useLock is true (default), wraps the read-modify-write in an O_EXCL
+ * lock to prevent lost updates from concurrent writers. Falls back to
+ * unlocked write if the lock cannot be acquired within a single attempt
+ * (backward-compatible degradation with a console warning).
+ */
+export declare function updateTask(teamName: string, taskId: string, updates: TaskFileUpdate, opts?: {
+    useLock?: boolean;
+}): void;
+/**
+ * Find next executable task for this worker.
+ * Returns first task where:
+ *   - owner === workerName
+ *   - status === 'pending'
+ *   - all blockedBy tasks have status 'completed'
+ * Sorted by ID ascending.
+ *
+ * Uses O_EXCL lock files for atomic claiming — no sleep/jitter needed.
+ * The kernel guarantees only one worker can create the lock file.
+ */
+export declare function findNextTask(teamName: string, workerName: string): Promise<TaskFile | null>;
+/** Check if all blocker task IDs have status 'completed' */
+export declare function areBlockersResolved(teamName: string, blockedBy: string[]): boolean;
+/**
+ * Write failure sidecar for a task.
+ * If sidecar already exists, increments retryCount.
+ */
+export declare function writeTaskFailure(teamName: string, taskId: string, error: string): void;
+/** Read failure sidecar if it exists */
+export declare function readTaskFailure(teamName: string, taskId: string): TaskFailureSidecar | null;
+/** Default maximum retries before a task is permanently failed */
+export declare const DEFAULT_MAX_TASK_RETRIES = 5;
+/** Check if a task has exhausted its retry budget */
+export declare function isTaskRetryExhausted(teamName: string, taskId: string, maxRetries?: number): boolean;
+/** List all task IDs in a team directory, sorted ascending */
+export declare function listTaskIds(teamName: string): string[];
+//# sourceMappingURL=task-file-ops.d.ts.map

package/dist/team/task-file-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-file-ops.d.ts","sourceRoot":"","sources":["../../src/team/task-file-ops.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAM/E,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAqBD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,UAAU,GAAG,IAAI,CA8BnB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAGxD;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAQnB;AAoDD,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAS1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,cAAc,EACvB,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,IAAI,CAyCN;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqDjG;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAOlF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAUtF;AAED,wCAAwC;AACxC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAS3F;AAED,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,qDAAqD;AACrD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,MAAiC,GAC5C,OAAO,CAIT;AAED,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBtD"}