teamshare-bridge 0.26.15 → 0.26.17

package/dist/lib/scope-guard.js

@@ -0,0 +1,246 @@
+"use strict";
+/**
+ * Scope guard (2026-10-25).
+ *
+ * A QA run lost its tools at the 63-minute mark and spent the next hour
+ * operating the PLATFORM instead of reporting a blocker: it listed processes,
+ * read `~/.teamshare/config.json` and `~/.config/opencode/opencode.jsonc`,
+ * printed a live `ts_...` key into the transcript and called the TeamShare API
+ * with it. Nothing in the runtime noticed, because the harness had a shell and
+ * no rule said what it may touch.
+ *
+ * Removing the shell fixes the QA lane. This module is the second layer that
+ * works for EVERY harness (codex/gemini/cursor have no permission model): it
+ * classifies the tool input a harness is about to run and lets the caller abort
+ * the session on a platform-level action.
+ *
+ * The classifier is PURE and deliberately conservative: it only sees tool
+ * inputs (a shell command, a path, a URL), never assistant prose, so a report
+ * that merely mentions `.teamshare` cannot trip it. Every rule is a literal
+ * pattern with a stable id, and the tests pin both the hits and the
+ * false-positives a real repository path produces (`teamshare-bridge/`,
+ * `../.teamshare-worktrees/`, `teamshare/research/`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyScopeViolation = classifyScopeViolation;
+exports.scopeTextsFromLine = scopeTextsFromLine;
+exports.inspectLineForScope = inspectLineForScope;
+/** Keys whose string values are the actual tool INPUT (never prose). */
+const TOOL_INPUT_KEYS = new Set([
+    'command',
+    'cmd',
+    'code',
+    'script',
+    'filePath',
+    'file_path',
+    'path',
+    'pattern',
+    'url',
+]);
+const MAX_TEXTS = 40;
+const MAX_DEPTH = 6;
+const MAX_TEXT_LENGTH = 8_000;
+/**
+ * Path of the machine-local bridge state (`~/.teamshare`). Written so that it
+ * matches `~/.teamshare/config.json`, `%USERPROFILE%\.teamshare\...` and
+ * `C:\...\.teamshare\...` but NOT `.teamshare-worktrees` (a mirror path) or
+ * `<cwd>/teamshare/` (the research scratch folder).
+ */
+const PRIVATE_STATE = /(?:^|[\\/\s"'`=(])\.teamshare(?:[\\/]|$|[\s"'`),])/;
+/**
+ * The ONE agent-writable part of the state folder: a task run's run report
+ * (`~/.teamshare/reports/<taskId>.md`, uploaded by the bridge). It holds no
+ * credential and every brief instructs the agent to write it, so flagging it
+ * would abort honest work.
+ */
+const REPORT_PATH = /(?:^|[\\/\s"'`=(])\.teamshare[\\/]reports(?:[\\/]|$|[\s"'`),])/;
+/** Private state that is NOT the run-report folder. */
+function hasPrivateStatePath(text) {
+    if (!PRIVATE_STATE.test(text))
+        return false;
+    return PRIVATE_STATE.test(text.replace(new RegExp(REPORT_PATH.source, 'g'), ' '));
+}
+/** `opencode.json` / `.config/opencode` - the harness's own MCP identity. */
+const MCP_CONFIG = /(?:^|[\\/\s"'`=(])\.config[\\/]opencode(?:[\\/]|$)/i;
+const OPENCODE_JSON = /(?:^|[\\/\s"'`=(])opencode\.jsonc?(?:$|[\s"'`])/i;
+/** The relay endpoints themselves. */
+const RELAY_PROBE = /\bmcp-relay\b|\bmcp-token\b|\b(?:127\.0\.0\.1|localhost):\d{2,5}[\\/]mcp(?:-relay)?\b/i;
+/**
+ * A platform CLI invoked as a COMMAND.
+ *
+ * The position matters: `cd teamshare-bridge`, `--prefix teamshare-bridge` and
+ * `"teamshare-bridge/src/x.ts"` are ordinary work on this repository, while
+ * `teamshare-agent doctor` and `sh -c "teamshare-bridge status"` are the agent
+ * operating the platform. A separator (or a shell `-c`) is required, and the
+ * token may not be followed by a path separator or word character.
+ */
+const PLATFORM_CLI = /(?:^|[;&|(]\s*|\(\s*|\b(?:sudo|doas)\s+|\b(?:bash|sh|zsh|cmd|powershell|pwsh)\b[^\n]{0,40}?)(?:"|')?(?:teamshare-agent|teamshare-bridge|opencode)(?:\.(?:exe|cmd|ps1))?(?:"|')?(?![\w\\/.-])/i;
+/** Credentials: a literal key, or a header that carries one. */
+const CREDENTIAL_LITERAL = /\bts_(?:ba_)?[A-Za-z0-9_-]{16,}\b/;
+const CREDENTIAL_HEADER = /\bx-api-key\b|\bx-teamshare-(?:session-token|machine-id)\b/i;
+/** A network call to the hub, from a shell or from Code Mode. */
+const API_CALL = /https?:\/\/(?:api\.)?teamshare\.name\.ng|\b(curl|wget|Invoke-WebRequest|Invoke-RestMethod|iwr|irm|https?\.request|fetch)\b[\s\S]{0,240}(?:api\.teamshare|teamshare\.name\.ng)/i;
+/** Process inspection is normal for a code run; recorded, never fatal. */
+const PROCESS_INSPECT = /\b(Get-Process|tasklist|ps\s+(?:aux|-ef)|pgrep)\b/i;
+/**
+ * Redact the credential shapes a violating command may contain BEFORE the
+ * detail is logged, posted or sent as a diagnostic. The guard's whole purpose
+ * includes not repeating a key it just caught.
+ */
+function redactSensitive(text) {
+    return text
+        .replace(/\bts_(?:ba_)?[A-Za-z0-9_-]{6,}\b/g, '[REDACTED_KEY]')
+        .replace(/\bsk-[A-Za-z0-9_-]{6,}\b/g, '[REDACTED_KEY]')
+        .replace(/(Bearer\s+)[A-Za-z0-9._-]{8,}/gi, '$1[REDACTED]')
+        .replace(/((?:x-api-key|x-teamshare-session-token|x-teamshare-machine-id)["']?\s*[:=]\s*["']?)[^"'\s,}]+/gi, '$1[REDACTED]');
+}
+function detailOf(text) {
+    const oneLine = redactSensitive(text)
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, 240);
+    return oneLine;
+}
+/**
+ * Classify ONE tool input. Returns `null` when the input is ordinary work.
+ * Order is deliberate: the first match is the most specific reason a human
+ * will read in the run console.
+ */
+function classifyScopeViolation(input) {
+    const text = typeof input === 'string' ? input : '';
+    if (!text.trim())
+        return null;
+    const detail = detailOf(text);
+    if (CREDENTIAL_LITERAL.test(text)) {
+        return {
+            rule: 'credential_literal',
+            severity: 'abort',
+            reason: 'a literal TeamShare API key was used in a tool call; agents never handle keys',
+            detail,
+        };
+    }
+    if (CREDENTIAL_HEADER.test(text)) {
+        return {
+            rule: 'credential_header',
+            severity: 'abort',
+            reason: 'a TeamShare credential header was set by hand; the harness already authenticates itself',
+            detail,
+        };
+    }
+    if (hasPrivateStatePath(text)) {
+        return {
+            rule: 'private_state',
+            severity: 'abort',
+            reason: 'the bridge state folder (~/.teamshare) is off limits - it holds credentials and other agents’ sessions',
+            detail,
+        };
+    }
+    if (MCP_CONFIG.test(text) || OPENCODE_JSON.test(text)) {
+        return {
+            rule: 'mcp_config',
+            severity: 'abort',
+            reason: 'the harness MCP config is off limits - it carries the run’s identity',
+            detail,
+        };
+    }
+    if (RELAY_PROBE.test(text)) {
+        return {
+            rule: 'relay_probe',
+            severity: 'abort',
+            reason: 'the MCP relay endpoint is not a target for a run',
+            detail,
+        };
+    }
+    if (PLATFORM_CLI.test(text)) {
+        return {
+            rule: 'platform_cli',
+            severity: 'abort',
+            reason: 'a run never drives the TeamShare bridge/CLI - infrastructure failures are reported, not repaired',
+            detail,
+        };
+    }
+    if (API_CALL.test(text)) {
+        return {
+            rule: 'api_call',
+            severity: 'abort',
+            reason: 'a run must use its TeamShare MCP tools, never call the API by hand',
+            detail,
+        };
+    }
+    if (PROCESS_INSPECT.test(text)) {
+        return {
+            rule: 'process_inspect',
+            severity: 'warn',
+            reason: 'process inspection is outside the task’s scope',
+            detail,
+        };
+    }
+    return null;
+}
+function collect(value, out, depth) {
+    if (out.length >= MAX_TEXTS || depth > MAX_DEPTH)
+        return;
+    if (typeof value === 'string')
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collect(item, out, depth + 1);
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (out.length >= MAX_TEXTS)
+            return;
+        if (typeof child === 'string' && TOOL_INPUT_KEYS.has(key)) {
+            if (child.length > MAX_TEXT_LENGTH) {
+                out.push(child.slice(0, MAX_TEXT_LENGTH));
+            }
+            else {
+                out.push(child);
+            }
+            continue;
+        }
+        if (typeof child === 'object')
+            collect(child, out, depth + 1);
+    }
+}
+/**
+ * The tool INPUTS carried by one streamed harness line.
+ *
+ * Only JSON lines are read: every supported harness emits one JSON event per
+ * line, and a non-JSON line is console text (assistant prose), which must never
+ * be classified as an action. Returns `[]` for anything it cannot parse.
+ */
+function scopeTextsFromLine(line) {
+    const raw = typeof line === 'string' ? line.trim() : '';
+    if (!raw.startsWith('{') && !raw.startsWith('['))
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    collect(parsed, out, 0);
+    return out;
+}
+/**
+ * The first ABORT violation across a line's tool inputs. Warnings are collected
+ * separately so a code run is not killed for listing its own processes.
+ */
+function inspectLineForScope(line) {
+    const warnings = [];
+    for (const text of scopeTextsFromLine(line)) {
+        const hit = classifyScopeViolation(text);
+        if (!hit)
+            continue;
+        if (hit.severity === 'abort')
+            return { abort: hit, warnings };
+        warnings.push(hit);
+    }
+    return { abort: null, warnings };
+}
+//# sourceMappingURL=scope-guard.js.map

package/dist/lib/scope-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-guard.js","sourceRoot":"","sources":["../../src/lib/scope-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AA6HH,wDA4EC;AA+BD,gDAYC;AAMD,kDAYC;AApQD,wEAAwE;AACxE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,SAAS;IACT,KAAK;IACL,MAAM;IACN,QAAQ;IACR,UAAU;IACV,WAAW;IACX,MAAM;IACN,SAAS;IACT,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,eAAe,GAAG,KAAK,CAAC;AAsB9B;;;;;GAKG;AACH,MAAM,aAAa,GAAG,oDAAoD,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,WAAW,GACf,gEAAgE,CAAC;AAEnE,uDAAuD;AACvD,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,aAAa,CAAC,IAAI,CACvB,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,qDAAqD,CAAC;AACzE,MAAM,aAAa,GAAG,kDAAkD,CAAC;AAEzE,sCAAsC;AACtC,MAAM,WAAW,GACf,wFAAwF,CAAC;AAE3F;;;;;;;;GAQG;AACH,MAAM,YAAY,GAChB,+LAA+L,CAAC;AAElM,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAC/D,MAAM,iBAAiB,GACrB,6DAA6D,CAAC;AAEhE,iEAAiE;AACjE,MAAM,QAAQ,GACZ,gLAAgL,CAAC;AAEnL,0EAA0E;AAC1E,MAAM,eAAe,GAAG,oDAAoD,CAAC;AAE7E;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI;SACR,OAAO,CAAC,mCAAmC,EAAE,gBAAgB,CAAC;SAC9D,OAAO,CAAC,2BAA2B,EAAE,gBAAgB,CAAC;SACtD,OAAO,CAAC,iCAAiC,EAAE,cAAc,CAAC;SAC1D,OAAO,CACN,kGAAkG,EAClG,cAAc,CACf,CAAC;AACN,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC;SAClC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAa;IAClD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,+EAA+E;YACjF,MAAM;SACP,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,yFAAyF;YAC3F,MAAM;SACP,CAAC;IACJ,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,wGAAwG;YAC1G,MAAM;SACP,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,sEAAsE;YACxE,MAAM;SACP,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,kDAAkD;YAC1D,MAAM;SACP,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,kGAAkG;YACpG,MAAM;SACP,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,oEAAoE;YACtE,MAAM;SACP,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,gDAAgD;YACxD,MAAM;SACP,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,GAAa,EAAE,KAAa;IAC3D,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAI9C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamshare-bridge",
-  "version": "0.26.15",
+  "version": "0.26.17",
   "description": "Local bridge for TeamShare agents - CLI session runner, auto-wake WebSocket daemon, and teamshare:// protocol handler.",
   "type": "commonjs",
   "license": "MIT",