oh-my-copilot 5.6.2 → 5.8.0

package/dist/team/sdk-policy.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Permission and tool policy for headless SDK team workers (`--transport sdk`).
+ *
+ * Pane workers run with `--allow-all-*`. An SDK worker gets no allow-all: its
+ * host answers every `onPermissionRequest` with {@link decideSdkPermission},
+ * and removes tools up front with {@link buildSdkExcludedTools}.
+ */
+/** The subset of the SDK PermissionRequest the policy reads (SDK 1.0.16). */
+export interface SdkPermissionRequest {
+    kind?: string;
+    fullCommandText?: string;
+    path?: unknown;
+    fileName?: unknown;
+    resolvedPath?: unknown;
+    serverName?: unknown;
+    toolName?: unknown;
+    url?: unknown;
+    [key: string]: unknown;
+}
+export interface SdkPolicyContext {
+    /** The worker's working directory (its worktree, or the leader cwd without worktrees). */
+    cwd: string;
+    /** The leader's team state root: inbox, status, heartbeat, shutdown ack, verdicts. */
+    stateRoot: string;
+    /** The oh-my-copilot plugin root (skills, agents, hook scripts are read from here). */
+    pluginRoot: string;
+    /** Extra read-only roots (the per-worker COPILOT_HOME). */
+    readRoots?: string[];
+    /** The plugin MCP server name (`t`). */
+    mcpServer: string;
+    /** `permissions.workerDenyTools`. */
+    denyTools?: string[];
+    /** `permissions.workerDenyUrls`. */
+    denyUrls?: string[];
+    platform?: NodeJS.Platform;
+}
+export interface SdkPermissionDecision {
+    approve: boolean;
+    reason: string;
+}
+/**
+ * Shell commands a worker must never run, whatever the config says:
+ * - team control other than `team api` (nested teams, shutdown of its own team);
+ * - `omg smoke` (would spend credits from inside a worker);
+ * - the multiplexers (the pane transport's control plane);
+ * - `git push` (workers commit in their worktree; the leader integrates).
+ *
+ * This is a denylist over the command text, not a sandbox: it stops the
+ * direct and quoted spellings a model actually writes, but a worker that
+ * builds the command indirectly (an alias, a script file, `Invoke-Expression`,
+ * an encoded command) is not stopped by it. The real boundaries are the
+ * write-path check, the credit cap and the per-worker COPILOT_HOME.
+ * Patterns run on {@link normalizeShellCommand}'s output.
+ */
+export declare const SDK_SHELL_DENY_PATTERNS: ReadonlyArray<{
+    re: RegExp;
+    reason: string;
+}>;
+/** Strip quotes around single tokens (`"omg" 'team'` -> `omg team`) so quoting cannot dodge a pattern. */
+export declare function normalizeShellCommand(command: string): string;
+/** True when `p` is `root` or lies below it (realpath, case-folded on win32). */
+export declare function isUnderRoot(p: string, root: string, platform?: NodeJS.Platform): boolean;
+/** `shell(<prefix>)` entries of `workerDenyTools`, as command prefixes. */
+export declare function shellDenyPrefixes(denyTools?: readonly string[]): string[];
+export declare function decideSdkPermission(req: SdkPermissionRequest, ctx: SdkPolicyContext): SdkPermissionDecision;
+/**
+ * Built-in tools that start or drive other agents. A worker is one agent on
+ * one credit cap; these would fan out work (and spend) outside the team's
+ * task and claim protocol.
+ */
+export declare const SDK_AGENT_FANOUT_TOOLS: readonly string[];
+/**
+ * `excludedTools` for an SDK worker session: the recursion fence (the
+ * `<server>-host_smoke` tool and {@link SDK_AGENT_FANOUT_TOOLS}) plus each bare
+ * `workerDenyTools` name; `<server>(<tool>)` becomes `<server>-<tool>`, the
+ * SDK's MCP tool name. `shell(<prefix>)` entries stay with the handler.
+ */
+export declare function buildSdkExcludedTools(mcpServer: string, denyTools?: readonly string[]): string[];
+//# sourceMappingURL=sdk-policy.d.ts.map

package/dist/team/sdk-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-policy.d.ts","sourceRoot":"","sources":["../../src/team/sdk-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUjF,CAAC;AAEF,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7D;AASD,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,OAAO,CAK1G;AAYD,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,EAAE,CAO7E;AAcD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,gBAAgB,GAAG,qBAAqB,CA8C3G;AAQD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAQnD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,EAAE,CAcpG"}

package/dist/team/sdk-policy.js

@@ -0,0 +1,186 @@
+/**
+ * Permission and tool policy for headless SDK team workers (`--transport sdk`).
+ *
+ * Pane workers run with `--allow-all-*`. An SDK worker gets no allow-all: its
+ * host answers every `onPermissionRequest` with {@link decideSdkPermission},
+ * and removes tools up front with {@link buildSdkExcludedTools}.
+ */
+import { realpathSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+/**
+ * Shell commands a worker must never run, whatever the config says:
+ * - team control other than `team api` (nested teams, shutdown of its own team);
+ * - `omg smoke` (would spend credits from inside a worker);
+ * - the multiplexers (the pane transport's control plane);
+ * - `git push` (workers commit in their worktree; the leader integrates).
+ *
+ * This is a denylist over the command text, not a sandbox: it stops the
+ * direct and quoted spellings a model actually writes, but a worker that
+ * builds the command indirectly (an alias, a script file, `Invoke-Expression`,
+ * an encoded command) is not stopped by it. The real boundaries are the
+ * write-path check, the credit cap and the per-worker COPILOT_HOME.
+ * Patterns run on {@link normalizeShellCommand}'s output.
+ */
+export const SDK_SHELL_DENY_PATTERNS = [
+    // `\s+(?!\s|api\b)`: doubled whitespace must not let `team  api` backtrack into a deny.
+    { re: /\b(?:omg|omc|oh-my-copilot|oh-my-claudecode)(?:\.cmd|\.ps1)?\s+team\s+(?!\s|api\b)/i, reason: 'team control outside `team api`' },
+    { re: /\bcli\.cjs["']?\s+team\s+(?!\s|api\b)/i, reason: 'team control outside `team api`' },
+    { re: /\b(?:omg|omc|oh-my-copilot)(?:\.cmd|\.ps1)?\s+smoke\b/i, reason: '`omg smoke` from a worker' },
+    { re: /(?:^|[\s;&|("'])(?:tmux|psmux)(?:\.exe)?\b/i, reason: 'multiplexer control' },
+    // `push` as git's subcommand: only global options (`-C <dir>`, `-c <k=v>`, `--flag[=v]`) may sit between.
+    { re: /(?:^|[\s;&|("'/\\])git(?:\.exe)?(?:\s+(?:-C\s+\S+|-c\s+\S+|--?[A-Za-z][\w-]*(?:=\S+)?))*\s+push\b/i, reason: '`git push` from a worker' },
+    // `$g="git"; & $g push` / `g=git; $g push`: git named, then pushed through a variable.
+    { re: /\bgit\b[\s\S]*\$\{?\w+\}?\s+push\b/i, reason: '`git push` from a worker' },
+];
+/** Strip quotes around single tokens (`"omg" 'team'` -> `omg team`) so quoting cannot dodge a pattern. */
+export function normalizeShellCommand(command) {
+    return command.replace(/(["'])([^"'\s]+)\1/g, '$2');
+}
+function canon(p, platform) {
+    let out = resolve(p);
+    try {
+        out = realpathSync.native(out);
+    }
+    catch { /* missing: keep the resolved form */ }
+    out = out.replace(/\\/g, '/').replace(/\/+$/, '');
+    return platform === 'win32' ? out.toLowerCase() : out;
+}
+/** True when `p` is `root` or lies below it (realpath, case-folded on win32). */
+export function isUnderRoot(p, root, platform = process.platform) {
+    if (!p || !root)
+        return false;
+    const child = canon(p, platform);
+    const parent = canon(root, platform);
+    return child === parent || child.startsWith(`${parent}/`);
+}
+function requestPath(req, cwd) {
+    for (const key of ['resolvedPath', 'path', 'fileName']) {
+        const value = req[key];
+        if (typeof value === 'string' && value.trim()) {
+            return isAbsolute(value) ? value : resolve(cwd, value);
+        }
+    }
+    return null;
+}
+/** `shell(<prefix>)` entries of `workerDenyTools`, as command prefixes. */
+export function shellDenyPrefixes(denyTools = []) {
+    const out = [];
+    for (const raw of denyTools) {
+        const m = /^shell\((.+)\)$/i.exec(raw.trim());
+        if (m && m[1].trim())
+            out.push(m[1].trim().replace(/:\*$/, ''));
+    }
+    return out;
+}
+function matchesDenyUrl(url, patterns) {
+    const lower = url.toLowerCase();
+    let host = '';
+    try {
+        host = new URL(url).hostname.toLowerCase();
+    }
+    catch { /* not a URL: substring match only */ }
+    return patterns.some((p) => {
+        const pattern = p.trim().toLowerCase();
+        if (!pattern)
+            return false;
+        if (host && (host === pattern || host.endsWith(`.${pattern}`)))
+            return true;
+        return lower.includes(pattern);
+    });
+}
+export function decideSdkPermission(req, ctx) {
+    const platform = ctx.platform ?? process.platform;
+    switch (req.kind) {
+        case 'read': {
+            const path = requestPath(req, ctx.cwd);
+            if (!path)
+                return { approve: true, reason: 'read without a path' };
+            const roots = [ctx.cwd, ctx.stateRoot, ctx.pluginRoot, ...(ctx.readRoots ?? [])];
+            return roots.some((root) => isUnderRoot(path, root, platform))
+                ? { approve: true, reason: 'read inside worker roots' }
+                : { approve: false, reason: `read outside worker roots: ${path}` };
+        }
+        case 'write': {
+            const path = requestPath(req, ctx.cwd);
+            if (!path)
+                return { approve: false, reason: 'write without a path' };
+            return isUnderRoot(path, ctx.cwd, platform) || isUnderRoot(path, ctx.stateRoot, platform)
+                ? { approve: true, reason: 'write inside worktree or team state' }
+                : { approve: false, reason: `write outside worktree and team state: ${path}` };
+        }
+        case 'shell': {
+            const command = String(req.fullCommandText ?? '');
+            if (!command.trim())
+                return { approve: false, reason: 'shell without command text' };
+            const normalized = normalizeShellCommand(command);
+            for (const { re, reason } of SDK_SHELL_DENY_PATTERNS) {
+                if (re.test(normalized))
+                    return { approve: false, reason };
+            }
+            const spellings = [command.trim(), normalized.trim()];
+            for (const prefix of shellDenyPrefixes(ctx.denyTools)) {
+                if (spellings.some((s) => s === prefix || s.startsWith(`${prefix} `))) {
+                    return { approve: false, reason: `permissions.workerDenyTools shell(${prefix})` };
+                }
+            }
+            return { approve: true, reason: 'shell' };
+        }
+        case 'url': {
+            const url = String(req.url ?? '');
+            return matchesDenyUrl(url, ctx.denyUrls ?? [])
+                ? { approve: false, reason: `permissions.workerDenyUrls: ${url}` }
+                : { approve: true, reason: 'url' };
+        }
+        case 'mcp':
+            return req.serverName === ctx.mcpServer
+                ? { approve: true, reason: `mcp server ${ctx.mcpServer}` }
+                : { approve: false, reason: `mcp server ${String(req.serverName)} is not the plugin server` };
+        default:
+            return { approve: false, reason: `permission kind ${String(req.kind)} is not granted to sdk workers` };
+    }
+}
+/** Built-in tool names a bare `workerDenyTools` kind expands to. */
+const KIND_TOOLS = {
+    shell: ['shell', 'powershell', 'bash'],
+    write: ['create', 'edit'],
+};
+/**
+ * Built-in tools that start or drive other agents. A worker is one agent on
+ * one credit cap; these would fan out work (and spend) outside the team's
+ * task and claim protocol.
+ */
+export const SDK_AGENT_FANOUT_TOOLS = [
+    'task',
+    'run_dynamic_workflow',
+    'dynamic_workflows_manage',
+    'write_agent',
+    'read_agent',
+    'list_agents',
+    'search_code_subagent',
+];
+/**
+ * `excludedTools` for an SDK worker session: the recursion fence (the
+ * `<server>-host_smoke` tool and {@link SDK_AGENT_FANOUT_TOOLS}) plus each bare
+ * `workerDenyTools` name; `<server>(<tool>)` becomes `<server>-<tool>`, the
+ * SDK's MCP tool name. `shell(<prefix>)` entries stay with the handler.
+ */
+export function buildSdkExcludedTools(mcpServer, denyTools = []) {
+    const out = new Set([`${mcpServer}-host_smoke`, ...SDK_AGENT_FANOUT_TOOLS]);
+    for (const raw of denyTools) {
+        const entry = raw.trim();
+        if (!entry)
+            continue;
+        const call = /^([A-Za-z0-9_.-]+)\(([^)]*)\)$/.exec(entry);
+        if (call) {
+            if (call[1].toLowerCase() === 'shell' || call[1].toLowerCase() === 'write')
+                continue;
+            if (call[2])
+                out.add(`${call[1]}-${call[2]}`);
+            continue;
+        }
+        for (const name of KIND_TOOLS[entry.toLowerCase()] ?? [entry])
+            out.add(name);
+    }
+    return [...out];
+}
+//# sourceMappingURL=sdk-policy.js.map

package/dist/team/sdk-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-policy.js","sourceRoot":"","sources":["../../src/team/sdk-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsChD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkD;IACpF,wFAAwF;IACxF,EAAE,EAAE,EAAE,qFAAqF,EAAE,MAAM,EAAE,iCAAiC,EAAE;IACxI,EAAE,EAAE,EAAE,wCAAwC,EAAE,MAAM,EAAE,iCAAiC,EAAE;IAC3F,EAAE,EAAE,EAAE,wDAAwD,EAAE,MAAM,EAAE,2BAA2B,EAAE;IACrG,EAAE,EAAE,EAAE,6CAA6C,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACpF,0GAA0G;IAC1G,EAAE,EAAE,EAAE,oGAAoG,EAAE,MAAM,EAAE,0BAA0B,EAAE;IAChJ,uFAAuF;IACvF,EAAE,EAAE,EAAE,qCAAqC,EAAE,MAAM,EAAE,0BAA0B,EAAE;CAClF,CAAC;AAEF,0GAA0G;AAC1G,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,QAAyB;IACjD,IAAI,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC;QAAC,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACvF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,IAAY,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC/F,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,GAAyB,EAAE,GAAW;IACzD,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,CAAU,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,YAA+B,EAAE;IACjE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,QAA2B;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACnG,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAyB,EAAE,GAAqB;IAClF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAClD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAC5D,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE;gBACvD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,IAAI,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC;gBACvF,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qCAAqC,EAAE;gBAClE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,IAAI,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YACrF,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAClD,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;gBACrD,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7D,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACtD,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,MAAM,GAAG,EAAE,CAAC;gBACpF,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAClC,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC5C,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,GAAG,EAAE,EAAE;gBAClE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACvC,CAAC;QACD,KAAK,KAAK;YACR,OAAO,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,SAAS;gBACrC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,GAAG,CAAC,SAAS,EAAE,EAAE;gBAC1D,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,2BAA2B,EAAE,CAAC;QAClG;YACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,GAA6B;IAC3C,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,MAAM;IACN,sBAAsB;IACtB,0BAA0B;IAC1B,aAAa;IACb,YAAY;IACZ,aAAa;IACb,sBAAsB;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,YAA+B,EAAE;IACxF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,SAAS,aAAa,EAAE,GAAG,sBAAsB,CAAC,CAAC,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,OAAO;gBAAE,SAAS;YACvF,IAAI,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/dist/team/sdk-transport.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Leader side of the headless SDK team transport (`omg team --transport sdk`).
+ *
+ * Pane workers are processes a multiplexer owns; SDK workers are sessions a
+ * detached `omg team sdk-host` process owns (sdk-host.ts). This module holds
+ * what the leader, the monitor, mailbox delivery and shutdown need:
+ * - the per-worker file layout under the team state root;
+ * - the doorbell (`sdk-doorbell.jsonl`), the only way to reach a session;
+ * - the session file (`sdk-session.json`), read instead of a pane capture;
+ * - host launch (launch attempt + detached spawn + ack/started handshake)
+ *   and host stop (doorbell stop, then a bounded wait, then a tree kill).
+ *
+ * The team target is `sdk:<team>` and each worker's `pane_id` is `sdk:<worker>`:
+ * neither names a multiplexer resource, so pane code paths must skip them
+ * ({@link isSdkTarget}).
+ */
+import { type WorkerLaunchAttempt } from './worker-launch-ack.js';
+export declare const SDK_TARGET_PREFIX = "sdk:";
+/** True for the sdk team target (`sdk:<team>`) and sdk worker ids (`sdk:<worker>`). */
+export declare function isSdkTarget(value: string | null | undefined): boolean;
+export declare function sdkTeamTarget(teamName: string): string;
+export declare function sdkPaneId(workerName: string): string;
+export declare function sdkWorkerFiles(stateRoot: string, workerName: string): {
+    dir: string;
+    spec: string;
+    doorbell: string;
+    session: string;
+    probe: string;
+    events: string;
+    log: string;
+    home: string;
+    bin: string;
+    shutdownAck: string;
+};
+export interface SdkHostSpec {
+    schema_version: 1;
+    leader_cwd: string;
+    team_name: string;
+    worker_name: string;
+    instance_id: string;
+    attempt_id: string;
+    pane_id: string;
+    runtime_cli_path: string;
+    worker_cwd: string;
+    state_root: string;
+    plugin_root: string;
+    /** The installed Copilot exe (or its npm package .js), never a .cmd shim. */
+    copilot_bin: string;
+    model?: string;
+    max_credits: number;
+    worker_env: Record<string, string>;
+    deny_tools: string[];
+    deny_urls: string[];
+    mcp_server: string;
+    /** The leader's `bridge/cli.cjs`; the worker's `omg` shim runs it. */
+    omg_cli_path: string;
+    node_path: string;
+    /** Copilot config dir whose login identity the per-worker home copies. */
+    user_config_dir: string;
+}
+export interface SdkDoorbellEntry {
+    id: string;
+    /** `probe`: zero-model introspection (tools offered, MCP servers) written to `sdk-probe.json`. */
+    kind: 'prompt' | 'abort' | 'stop' | 'shutdown' | 'probe';
+    text?: string;
+    at: string;
+    from?: string;
+}
+export type SdkSessionState = 'starting' | 'idle' | 'busy' | 'capped' | 'closing' | 'closed' | 'failed';
+export interface SdkSessionFile {
+    schema_version: 1;
+    team_name: string;
+    worker_name: string;
+    attempt_id: string;
+    host_pid: number;
+    runtime_pid: number | null;
+    /** Strict start identity of `runtime_pid`; absent in files written before it existed. */
+    runtime_start_identity?: string | null;
+    session_id: string | null;
+    model: string | null;
+    state: SdkSessionState;
+    turns: number;
+    queued: number;
+    /** Doorbell ids sent to the session, in order. */
+    delivered: string[];
+    last_event_type: string | null;
+    last_event_at: string | null;
+    updated_at: string;
+    usage: {
+        credits: number;
+        premium_requests: number;
+        shutdown_premium_requests: number | null;
+        shutdown_credits: number | null;
+    };
+    hooks: {
+        session_end_runs: number;
+        failed: number;
+    };
+    aborts: number;
+    permissions: Array<{
+        at: string;
+        kind: string;
+        approve: boolean;
+        reason: string;
+        detail: string;
+    }>;
+    last_error: string | null;
+    timeline: Partial<Record<'host_started_at' | 'ack_at' | 'accepted_at' | 'client_started_at' | 'session_created_at' | 'first_send_at' | 'first_message_at' | 'closed_at', string>>;
+}
+/** Append one doorbell entry; returns its id. Appends are line-sized and atomic enough for one writer per call. */
+export declare function ringDoorbell(stateRoot: string, workerName: string, entry: Omit<SdkDoorbellEntry, 'id' | 'at'> & {
+    id?: string;
+}): string;
+export declare function readSdkSession(stateRoot: string, workerName: string): SdkSessionFile | null;
+export interface SdkLaunchInput {
+    leaderCwd: string;
+    teamName: string;
+    workerName: string;
+    instanceId: string;
+    workerCwd: string;
+    stateRoot: string;
+    workerEnv: Record<string, string>;
+    copilotBin: string;
+    pluginRoot: string;
+    userConfigDir: string;
+    model?: string;
+    maxCredits: number;
+    denyTools: string[];
+    denyUrls: string[];
+    mcpServer?: string;
+    /** Test seam for the detached spawn. */
+    spawnHost?: (cliPath: string, specPath: string, logPath: string, cwd: string) => number | undefined;
+    ackTimeoutMs?: number;
+}
+export type SdkLaunchResult = {
+    ok: true;
+    attempt: WorkerLaunchAttempt;
+    hostPid: number | undefined;
+    paneId: string;
+} | {
+    ok: false;
+    attempt: WorkerLaunchAttempt | null;
+    reason: string;
+    hostPid?: number;
+};
+/**
+ * Create the launch attempt, write the host spec and spawn the detached host,
+ * then run the same ack -> accepted -> provider_started handshake a pane
+ * bootstrap runs. A failed handshake tree-kills the host it spawned.
+ */
+export declare function launchSdkHost(input: SdkLaunchInput): Promise<SdkLaunchResult>;
+/** Floor for a shutdown's host stop budget: lets a host already mid-teardown finish. */
+export declare const SDK_HOST_STOP_FLOOR_MS = 5000;
+/**
+ * Ring `stop` (or `shutdown`, which also writes the shutdown ack), wait for the
+ * host to report its provider dead, then tree-kill it as the last resort.
+ * True once the provider is observed dead.
+ */
+export declare function stopSdkHost(attempt: WorkerLaunchAttempt, stateRoot: string, opts?: {
+    timeoutMs?: number;
+    kind?: 'stop' | 'shutdown';
+    pollMs?: number;
+}): Promise<boolean>;
+//# sourceMappingURL=sdk-transport.d.ts.map

package/dist/team/sdk-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-transport.d.ts","sourceRoot":"","sources":["../../src/team/sdk-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;;;;;;;;;;;EAcnE;AAED,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,kGAAkG;IAClG,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExG,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,CAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,EAAE,MAAM,CAAC;QACzB,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;QACzC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,CAAC;IACF,KAAK,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC,MAAM,CACtB,iBAAiB,GAAG,QAAQ,GAAG,aAAa,GAAG,mBAAmB,GAAG,oBAAoB,GACvF,eAAe,GAAG,kBAAkB,GAAG,WAAW,EACpD,MAAM,CACP,CAAC,CAAC;CACJ;AAED,mHAAmH;AACnH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,MAAM,CAOR;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAO3F;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBzF;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAmEnF;AAED,wFAAwF;AACxF,eAAO,MAAM,sBAAsB,OAAQ,CAAC;AAuB5C;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7E,OAAO,CAAC,OAAO,CAAC,CAqClB"}