teamclaws 2.0.6 → 2.0.7

package/README.md

@@ -5,6 +5,9 @@ with a TeamClaws workspace and stores the resulting Clawgate credential on that
 computer. The command-line client and its agent skills ship together in this
 package.
 
+Pairing connects this computer to the workspace. It does not add a person as a
+workspace user; user membership is a separate privilege.
+
 ## Requirements
 
 - Node.js 22 or newer
@@ -14,6 +17,12 @@ package.
 
 ## Installation
 
+Check `node --version` first. If it is below 22, upgrade Node.js to version 22
+or newer before installing. npm normally treats the package engine requirement
+as a warning; `npm install -g teamclaws@latest --engine-strict` rejects an
+unsupported Node.js version during installation. The CLI also refuses to run on
+Node.js below 22.
+
 Install the published CLI:
 
 ```text

package/dist/constants.js

@@ -1,5 +1,5 @@
 export const PACKAGE_NAME = "teamclaws";
-export const PACKAGE_VERSION = "2.0.6";
+export const PACKAGE_VERSION = "2.0.7";
 export const CLIENT_NAME = "teamclaws-cli";
 export const CONTRACT_VERSION = 1;
 export const OUTPUT_SCHEMA_VERSION = 1;

package/dist/machine-key.js

@@ -73,7 +73,9 @@ export class OsMachineKeyProvider {
             await assertPrivateDirectory(directory);
             return directory;
         }
-        catch {
+        catch (error) {
+            if (error instanceof TeamClawsError)
+                throw error;
             throw keyUnavailable();
         }
     }
@@ -158,7 +160,9 @@ export class OsMachineKeyProvider {
                 dsaEncoding: "ieee-p1363",
             }).toString("base64url");
         }
-        catch {
+        catch (error) {
+            if (error instanceof TeamClawsError)
+                throw error;
             throw keyUnavailable();
         }
     }
@@ -167,9 +171,11 @@ async function assertPrivateDirectory(path) {
     const info = await lstat(path);
     if (!info.isDirectory() ||
         info.isSymbolicLink() ||
-        info.uid !== process.getuid?.() ||
-        (info.mode & 0o777) !== 0o700)
+        info.uid !== process.getuid?.())
         throw keyUnavailable();
+    const mode = info.mode & 0o777;
+    if (mode !== 0o700)
+        throw new TeamClawsError("machine_key_unavailable", `The machine-key directory ${JSON.stringify(path)} has mode ${mode.toString(8).padStart(4, "0")}; mode 0700 is required. Run chmod 700 '${path.replaceAll("'", "'\\''")}' and retry.`, { exitCode: 9 });
 }
 async function assertPrivateFile(path) {
     const info = await lstat(path);

package/dist/startup.js

@@ -1,6 +1,13 @@
 import { parseArguments, run } from "./app.js";
 import { checkRelease, releaseNotice } from "./update.js";
+import { TeamClawsError } from "./errors.js";
+import { Output } from "./output.js";
 export async function runCli(args, dependencies = {}, signal, check = checkRelease) {
+    if (Number(process.versions.node.split(".")[0]) < 22) {
+        const error = new TeamClawsError("unsupported_runtime", `TeamClaws requires Node.js 22 or newer; this runtime is ${process.versions.node}. Upgrade Node.js, then run npm install -g teamclaws@latest.`, { exitCode: 9 });
+        new Output(args.includes("--json"), dependencies.io?.stdout, dependencies.io?.stderr).error(error);
+        return error.exitCode;
+    }
     // No persistent cache: every executable invocation checks before dispatch.
     let releaseCheck;
     try {

package/dist/storage.js

@@ -118,6 +118,13 @@ export class CredentialStore {
             dirname(directory),
             directory,
         ]) {
+            const info = await lstat(path);
+            if (this.platform !== "win32" &&
+                info.isDirectory() &&
+                !info.isSymbolicLink() &&
+                info.uid === process.getuid?.() &&
+                (info.mode & 0o077) !== 0)
+                throw conversationStorageError(`Directory ${JSON.stringify(path)} has mode ${(info.mode & 0o777).toString(8).padStart(4, "0")}; mode 0700 is required. Run chmod 700 '${path.replaceAll("'", "'\\''")}' and retry. `);
             await this.assertPrivateDirectory(path);
         }
     }
@@ -150,7 +157,10 @@ export class CredentialStore {
             }
             return records.sort((a, b) => b.updated_at.localeCompare(a.updated_at));
         }
-        catch {
+        catch (error) {
+            if (error instanceof TeamClawsError &&
+                error.code === "chat_reference_storage_failed")
+                throw error;
             throw conversationStorageError();
         }
     }
@@ -460,6 +470,6 @@ function parseConversationReference(value, credential) {
         updated_at: value.updated_at,
     };
 }
-function conversationStorageError() {
-    return new TeamClawsError("chat_reference_storage_failed", "The local conversation references could not be read or saved safely. Retain any returned session/request identifiers; do not resend the message automatically.", { exitCode: 9 });
+function conversationStorageError(detail = "") {
+    return new TeamClawsError("chat_reference_storage_failed", `${detail}The local conversation references could not be read or saved safely. Retain any returned session/request identifiers; do not resend the message automatically.`, { exitCode: 9 });
 }

package/dist/update.js

@@ -143,7 +143,9 @@ export async function npmRunner(nodeExecutable = process.execPath, platform = pr
             return async (args, timeout, signal) => {
                 const env = { ...process.env };
                 for (const key of Object.keys(env)) {
-                    if (/^npm_config_/i.test(key) ||
+                    if ((/^npm_config_/i.test(key) &&
+                        !(args[0] === "prefix" &&
+                            /^npm_config_(prefix|userconfig|globalconfig)$/i.test(key))) ||
                         /^(NODE_OPTIONS|NODE_PATH)$/i.test(key))
                         delete env[key];
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaws",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "Official TeamClaws command-line client and agent skills",
   "license": "PolyForm-Shield-1.0.0",
   "homepage": "https://teamclaws.com",

package/skills/teamclaws-login/SKILL.md

@@ -16,6 +16,9 @@ pairing approval come next when they are connecting a workspace. If onboarding
 already explained the process, use a short transition into this step. Give the
 approval link with that context, never as an unexplained authorization request.
 
+Pairing connects this computer to the workspace. It does not add a person as a
+workspace user; user membership is a separate privilege.
+
 Use the official executable:
 
 ```text

package/skills/teamclaws-onboard/SKILL.md

@@ -37,6 +37,9 @@ or add another permission question for an already authorized step. Describe the
 separate server environment accurately; inspect an existing workspace before
 promising it is empty or that a particular isolation mechanism is configured.
 
+Pairing connects this computer to the workspace. It does not add a person as a
+workspace user; user membership is a separate privilege.
+
 ## Sign in
 
 Run `teamclaws auth status --json`. If signed in, confirm the returned account

package/skills/teamclaws-onboard/references/workspace-uses.md

@@ -122,6 +122,9 @@ and the selected access behavior before providing a working URL.
 
 ## Share work with other people
 
+Pairing connects this computer to the workspace. It does not add a person as a
+workspace user; user membership is a separate privilege.
+
 Distinguish inviting someone to a workspace from sharing a project's web
 address. Workspace collaboration depends on the supported TeamClaws sharing
 controls and the recipient's assigned access. A public app URL is available

package/skills/teamclaws-pair/SKILL.md

@@ -11,6 +11,9 @@ For the full install-and-connect conversation, follow
 Use the official `teamclaws` executable. Do not implement pairing inside this
 skill.
 
+Pairing connects this computer to the workspace. It does not add a person as a
+workspace user; user membership is a separate privilege.
+
 ## Required boundary
 
 - If workspace discovery was performed through a model context protocol client,

package/skills/teamclaws-project/SKILL.md

@@ -20,6 +20,9 @@ carry that task through instead of restarting a generic onboarding conversation.
 Inspect the destination's instructions, available runtimes, resources, network
 access, and account permissions through the paired shell before choosing a setup.
 
+Pairing connects this computer to the workspace. It does not add a person as a
+workspace user; user membership is a separate privilege.
+
 ## Jobs, services, and external systems
 
 For a complete job, place its code and authorized inputs in a dedicated directory,