feat(daemon): team resource sharing + copy red-line guard

Shares design systems, plugins, and skills to the team through the resource hub
via a kind-parametrized share service and per-kind routes
(/api/workspace/{design-systems,plugins,skills}/{team,:id/share}), and enforces
the team-resource copy red-line (a frozen team resource can't be copied to
personal) at the plugin-duplicate and skill-edit escape routes. Wires all the
collab + sharing routes together in the server. Verified against a local
resource-hub fixture: owner shares -> member pulls byte-identical, per kind.

Author: lefarcen

apps/daemon/src/collab/team-resource-share.ts

@@ -0,0 +1,87 @@
+// Team resource sharing. A member with publish rights promotes a personal
+// resource — a design system, plugin, or skill — into the team scope: the
+// resource's directory is packed and pushed to the resource hub under its kind,
+// so teammates can pull it into their own workspace. This reuses the same
+// content-addressed publish machinery as project sync — only the resource kind
+// and id namespace differ — and degrades to a no-op when there is no team
+// identity or the hub is not configured (the same identity gate as the rest of
+// the collab surface).
+
+import {
+  createResourceHubClient,
+  readResourceHubConfig,
+  type ResourceHubClient,
+  type ResourceHubPrincipal,
+} from '../integrations/resource-hub.js';
+import { createResourceHubPublishAdapter } from './resource-hub-publish-adapter.js';
+
+export interface TeamResourceShareService {
+  /** Share a resource to the team. Returns the published version, or null off-team. */
+  share(resourceId: string): Promise<{ version: number } | null>;
+  /** Ids of resources shared to the team in this session. */
+  sharedIds(): string[];
+  /** True once a resource has been shared to the team. */
+  isShared(resourceId: string): boolean;
+  /** Whether the hub is reachable (share is a no-op otherwise). */
+  readonly configured: boolean;
+}
+
+export interface CreateTeamResourceShareOptions {
+  /** Resource hub kind, e.g. `design_system` | `plugin` | `skill`. */
+  kind: string;
+  /** Colon-free id-namespace prefix distinguishing this kind on the shared hub. */
+  idPrefix: string;
+  /** Resolve a resource's source directory (what gets packed and pushed). */
+  resolveDir: (resourceId: string) => string;
+  /** Resolve the current principal (null = no team identity → share no-ops). */
+  getPrincipal: () => ResourceHubPrincipal | null | Promise<ResourceHubPrincipal | null>;
+  /** Injectable client for tests; built from env when omitted. */
+  client?: ResourceHubClient;
+  env?: NodeJS.ProcessEnv;
+}
+
+export function createTeamResourceShareService(
+  options: CreateTeamResourceShareOptions,
+): TeamResourceShareService {
+  const env = options.env ?? process.env;
+  const client =
+    options.client ??
+    (env.OD_RESOURCE_HUB_URL?.trim()
+      ? createResourceHubClient({ config: readResourceHubConfig(env) })
+      : null);
+  // Ids shared this session. The published resources are the durable record on
+  // the hub; this is the fast local view the team collection reads until a hub
+  // listing query lands.
+  const shared = new Set<string>();
+
+  if (!client) {
+    return {
+      share: async () => null,
+      sharedIds: () => [],
+      isShared: () => false,
+      configured: false,
+    };
+  }
+
+  const adapter = createResourceHubPublishAdapter({
+    client,
+    getPrincipal: options.getPrincipal,
+    resolveProjectDir: options.resolveDir,
+    // Distinct, colon-free id namespace on the shared hub. The caller's id (e.g.
+    // `user:palette-x`) is sanitized to path-safe chars — the hub routes the
+    // resource id as a path param, so a colon would 404.
+    resourceIdFor: (id) => `${options.idPrefix}-${id.replace(/[^a-zA-Z0-9_-]/g, '-')}`,
+    kind: options.kind,
+  });
+
+  return {
+    async share(resourceId) {
+      const result = await adapter.publish({ projectId: resourceId, reason: 'share' });
+      if (result) shared.add(resourceId);
+      return result;
+    },
+    sharedIds: () => [...shared],
+    isShared: (resourceId) => shared.has(resourceId),
+    configured: true,
+  };
+}

apps/daemon/src/design-systems/index.ts

@@ -2390,7 +2390,7 @@ window.Composer = Composer;
 `;
 }
 
-function stripPrefixAndValidateId(id: string, prefix = ''): string | null {
+export function stripPrefixAndValidateId(id: string, prefix = ''): string | null {
   if (typeof id !== 'string') return null;
   if (prefix && !id.startsWith(prefix)) return null;
   const dirId = prefix ? id.slice(prefix.length) : id;

apps/daemon/src/routes/plugins/index.ts

@@ -6,10 +6,15 @@ import type {
   Project,
   ProjectMetadata,
 } from '@open-design/contracts';
+import { TeamResourceCopyForbiddenError } from '@open-design/contracts';
 import {
   duplicatePluginExampleIntoProject,
   PluginDuplicateProjectError,
 } from '../../plugins/duplicate-project.js';
+import {
+  enforceTeamResourceCopyAllowed,
+  type TeamResourceStateProvider,
+} from '../../collab/team-resource-state.js';
 import type { PluginShareAction } from '../../services/plugin-share-tasks.js';
 
 export interface RegisterPluginEventRoutesDeps {
@@ -105,6 +110,9 @@ interface PluginRouteHelpers {
 
 export interface RegisterPluginRoutesDeps {
   db: SqliteDbLike;
+  /** Team-resource copy red-line (D3). When present, a frozen team plugin cannot
+   *  be duplicated into a personal project. Omit to skip the guard (no-op). */
+  teamResources?: TeamResourceStateProvider;
   paths: { PROJECTS_DIR: string; PLUGIN_REGISTRY_ROOTS: string[]; PLUGIN_LOCKFILE_PATH: string };
   ids: { randomId(): string };
   projectStore: {
@@ -169,7 +177,7 @@ export function registerPluginEventRoutes(app: Express, deps: RegisterPluginEven
 }
 
 export function registerPluginRoutes(app: Express, deps: RegisterPluginRoutesDeps): void {
-  const { db, paths, ids, projectStore, conversations, plugins, helpers } = deps;
+  const { db, paths, ids, projectStore, conversations, plugins, helpers, teamResources } = deps;
   app.get('/api/plugins', async (_req, res) => { try { res.json({ plugins: helpers.applyBakedPreviews(plugins.listInstalledPlugins(db), helpers.PLUGIN_PREVIEWS_DIR) }); } catch (err) { res.status(500).json({ error: String(err) }); } });
   app.get('/api/plugins/:id', async (req, res) => { try { const plugin = plugins.getInstalledPlugin(db, req.params.id); if (!plugin) return res.status(404).json({ error: 'plugin not found' }); res.json(plugin); } catch (err) { res.status(500).json({ error: String(err) }); } });
   app.post('/api/plugins/upload-zip', (req, res) => helpers.pluginUpload.single('file')(req, res, async (err: unknown) => { if (err) return helpers.sendMulterError(res, err); try { const file = req.file; if (!file?.buffer) return res.status(400).json({ error: 'file is required' }); const result = await helpers.pluginInstallation.stageUploadedPluginZip(file.buffer, `upload:zip:${helpers.decodeMultipartFilename(file.originalname || 'plugin.zip')}`); res.status((result as { ok?: boolean }).ok ? 200 : 400).json(result); } catch (uploadErr: unknown) { res.status(400).json({ ok: false, warnings: [], message: uploadErr instanceof Error ? uploadErr.message : String(uploadErr), log: [] }); } }));
@@ -188,6 +196,13 @@ export function registerPluginRoutes(app: Express, deps: RegisterPluginRoutesDep
       if (typeof plugin.id !== 'string' || typeof plugin.fsPath !== 'string') {
         return res.status(422).json({ error: { code: 'plugin-not-duplicable', message: 'plugin record is missing a filesystem source' } });
       }
+      // AC-9 copy red-line (D3): a frozen team plugin cannot be duplicated into a
+      // personal project. Runs before any project is created (nothing to clean up
+      // if it throws). No-op until the resource-hub reports this plugin as a
+      // frozen team resource.
+      if (teamResources) {
+        await enforceTeamResourceCopyAllowed(teamResources, { kind: 'plugin', resourceId: plugin.id });
+      }
       const body = req.body && typeof req.body === 'object'
         ? req.body as PluginDuplicateProjectRequest
         : {};
@@ -258,6 +273,9 @@ export function registerPluginRoutes(app: Express, deps: RegisterPluginRoutesDep
         if (insertedProject) projectStore.dbDeleteProject(db, cleanupProjectId);
         await projectStore.removeProjectDir(paths.PROJECTS_DIR, cleanupProjectId).catch(() => {});
       }
+      if (err instanceof TeamResourceCopyForbiddenError) {
+        return res.status(403).json({ error: { code: err.code, message: err.message } });
+      }
       if (err instanceof PluginDuplicateProjectError) {
         return res.status(err.status).json({ error: { code: err.code, message: err.message } });
       }

apps/daemon/src/routes/static-resource.ts

@@ -3,6 +3,11 @@ import type Database from 'better-sqlite3';
 import path from 'node:path';
 import fs from 'node:fs';
 import type { DesignSystemTokenContractRebuildJobResponse } from '@open-design/contracts';
+import { TeamResourceCopyForbiddenError } from '@open-design/contracts';
+import {
+  enforceTeamResourceCopyAllowed,
+  type TeamResourceStateProvider,
+} from '../collab/team-resource-state.js';
 import { detectAgents, detectAgentsStream } from '../agents.js';
 import {
   SkillImportError,
@@ -40,6 +45,9 @@ export interface RegisterStaticResourceRoutesDeps extends RouteDeps<'http' | 'pa
       designSystemId: string,
     ) => Promise<DesignSystemTokenContractRebuildJobResponse | undefined>;
   };
+  /** Team-resource copy red-line (D3). When present, a frozen team skill cannot
+   *  be edit-shadowed into a personal editable copy. Omit to skip (no-op). */
+  teamResources?: TeamResourceStateProvider;
 }
 
 export function registerAtomRoutes(app: Express, ctx: RegisterAtomRoutesDeps) {
@@ -90,6 +98,7 @@ export function registerStaticResourceRoutes(app: Express, ctx: RegisterStaticRe
     mimeFor,
   } = ctx.resources;
   const { isLocalSameOrigin, resolvedPortRef, sendApiError } = ctx.http;
+  const teamResources = ctx.teamResources;
   const requireLocalOrigin = (req: any, res: any) => {
     if (isLocalSameOrigin(req, resolvedPortRef.current)) return true;
     sendApiError(res, 403, 'FORBIDDEN', 'local origin required');
@@ -263,6 +272,12 @@ export function registerStaticResourceRoutes(app: Express, ctx: RegisterStaticRe
       if (!skill) {
         return sendApiError(res, 404, 'NOT_FOUND', 'skill not found');
       }
+      // AC-9 copy red-line (D3): a frozen team skill cannot be edit-shadowed into
+      // a personal editable copy. No-op until the resource-hub reports this skill
+      // as a frozen team resource.
+      if (teamResources) {
+        await enforceTeamResourceCopyAllowed(teamResources, { kind: 'skill', resourceId: skill.id });
+      }
       const result = await updateUserSkill(USER_SKILLS_DIR, {
         ...(req.body || {}),
         id: skill.id,
@@ -286,6 +301,9 @@ export function registerStaticResourceRoutes(app: Express, ctx: RegisterStaticRe
         },
       });
     } catch (err: any) {
+      if (err instanceof TeamResourceCopyForbiddenError) {
+        return sendApiError(res, 403, err.code, err.message);
+      }
       if (err instanceof SkillImportError) {
         const status = err.code === 'NOT_FOUND' ? 404 : err.code === 'BAD_REQUEST' ? 400 : 500;
         return sendApiError(res, status, err.code, err.message);

apps/daemon/src/routes/team-resource-share.ts

@@ -0,0 +1,42 @@
+import type { Express } from 'express';
+import type { TeamResourceShareService } from '../collab/team-resource-share.js';
+
+export interface RegisterTeamResourceShareRoutesDeps {
+  /** URL segment for this resource kind: `design-systems` | `plugins` | `skills`. */
+  basePath: string;
+  share: TeamResourceShareService;
+}
+
+/**
+ * Team resource sharing routes for one resource kind. A member promotes a
+ * personal resource into the team scope; the share service packs its directory
+ * and pushes it to the resource hub so teammates can pull it. When there is no
+ * team identity (or the hub is not configured), share returns `shared: false`
+ * so the client keeps a local-only view instead of erroring. Mounted once per
+ * kind (design systems, plugins, skills).
+ */
+export function registerTeamResourceShareRoutes(
+  app: Express,
+  deps: RegisterTeamResourceShareRoutesDeps,
+): void {
+  const { basePath, share } = deps;
+  const root = `/api/workspace/${basePath}`;
+
+  // Ids shared to the team — drives the "team" collection for this kind.
+  app.get(`${root}/team`, (_req, res) => {
+    res.json({ ids: share.sharedIds() });
+  });
+
+  // Share a personal resource to the team.
+  app.post(`${root}/:id/share`, async (req, res) => {
+    const id = typeof req.params.id === 'string' ? decodeURIComponent(req.params.id) : '';
+    if (!id) return res.status(400).json({ error: 'invalid resource id' });
+    try {
+      const result = await share.share(id);
+      if (!result) return res.json({ shared: false });
+      res.json({ shared: true, version: result.version });
+    } catch (error) {
+      res.status(500).json({ error: error instanceof Error ? error.message : 'share failed' });
+    }
+  });
+}

apps/daemon/src/routes/team-resources.ts

@@ -0,0 +1,77 @@
+import type { Express } from 'express';
+import {
+  assertTeamResourceCopyAllowed,
+  createApiError,
+  createApiErrorResponse,
+  TeamResourceCopyForbiddenError,
+  type TeamResourceState,
+} from '@open-design/contracts';
+import type {
+  TeamResourceKind,
+  TeamResourceKey,
+  TeamResourceStateProvider,
+} from '../collab/team-resource-state.js';
+
+export interface RegisterTeamResourceRoutesDeps {
+  teamResources: TeamResourceStateProvider;
+}
+
+const KINDS: ReadonlySet<TeamResourceKind> = new Set(['design-system', 'plugin', 'skill']);
+const STATES: ReadonlySet<TeamResourceState> = new Set(['active', 'frozen', 'deleted']);
+
+function readKey(params: { kind?: string; id?: string }): TeamResourceKey | null {
+  const kind = params.kind;
+  const resourceId = typeof params.id === 'string' ? decodeURIComponent(params.id) : '';
+  if (!kind || !KINDS.has(kind as TeamResourceKind) || !resourceId) return null;
+  return { kind: kind as TeamResourceKind, resourceId };
+}
+
+/**
+ * Team-resource routes (D1 state model + D3 enforcement). The copy-check runs
+ * the real copy red-line guard against the resolved resource state, so a frozen
+ * team resource is rejected with a 403 the same way the copy-out routes will be.
+ * The state provider is the E-resource-hub seam (the resource-hub owner).
+ */
+export function registerTeamResourceRoutes(app: Express, deps: RegisterTeamResourceRoutesDeps): void {
+  const { teamResources } = deps;
+
+  app.get('/api/workspace/resources/:kind/:id/state', async (req, res) => {
+    const key = readKey(req.params);
+    if (!key) return res.status(400).json({ error: 'invalid resource key' });
+    res.json(await teamResources.resolve(key));
+  });
+
+  // Enforce the AC-9 copy red-line for a resource about to be copied to personal.
+  app.post('/api/workspace/resources/:kind/:id/copy-check', async (req, res) => {
+    const key = readKey(req.params);
+    if (!key) return res.status(400).json({ error: 'invalid resource key' });
+    const target = await teamResources.resolve(key);
+    try {
+      assertTeamResourceCopyAllowed(target);
+      res.json({ allowed: true });
+    } catch (error) {
+      if (error instanceof TeamResourceCopyForbiddenError) {
+        return res.status(403).json(createApiErrorResponse(createApiError(error.code, error.message)));
+      }
+      throw error;
+    }
+  });
+
+  // Dev/demo seam: mark a resource team-shared with a state (real hub-backed
+  // provider omits `set`, so this 404s in production instead of spoofing state).
+  app.put('/api/workspace/resources/:kind/:id/state', (req, res) => {
+    const key = readKey(req.params);
+    if (!key) return res.status(400).json({ error: 'invalid resource key' });
+    if (!teamResources.set) return res.status(404).json({ error: 'resource state is not settable' });
+    const body = (req.body ?? {}) as { scope?: unknown; state?: unknown };
+    if (body.scope === 'personal') {
+      teamResources.set(key, { scope: 'personal' });
+      return res.json({ scope: 'personal' });
+    }
+    if (body.scope === 'team' && typeof body.state === 'string' && STATES.has(body.state as TeamResourceState)) {
+      teamResources.set(key, { scope: 'team', state: body.state as TeamResourceState });
+      return res.json({ scope: 'team', state: body.state });
+    }
+    res.status(400).json({ error: 'invalid resource state' });
+  });
+}