fix(local-agent): derive deterministic local_agent_id + harden install path

[jeff-r2026]

Problem

The HTTP local-agent generated local_agent_id via crypto.randomBytes(8), which is non-deterministic:

• env-only path (loadLocalAgentConfig with only TEAMAI_HTTP_ENDPOINT set): a fresh random id was minted on every hook fire and never persisted — so session_start / prompt_submit / each tool-use reported a different id.
• init --http path: random once then persisted, but a new random id on every reinstall (config removed) or on a different machine.

Either way the backend saw a churn of unrelated random agents instead of one stable agent per machine/tool. This regressed the design contract already documented in src/machine-id.ts: local_agent_id = sha1(agent_type + machine_id + path_hash)[:16], stable for the same machine + install dir + agent_type.

Fix

Reuse the existing deterministic deriveLocalAgentId(agentType, machineId, installPath):

• New resolveLocalAgentId(context) derives the id at runtime. The tool is auto-detected from the hook's --tool flag (context.tool), so claude / codebuddy / workbuddy each get a stable, distinct id.
• localAgentId is no longer stored in config.json (field kept optional for backward-compatible loads of old config files).
• TEAMAI_LOCAL_AGENT_ID still overrides for explicit pinning.

Security hardening (install/sync command path)

Backend sync commands are untrusted input; three issues flagged by an automated security review, all pre-existing in the HTTP local-agent module, fixed here since they live in the same file:

• Path traversal — validateSlug() in commandSlug() rejects slugs containing /, \, .., or absolute paths before they reach path.join.
• SSRF / arbitrary local file read — downloadResource() drops the file:// and absolute-local-path copy branches, allows only http(s) schemes, and follows redirects manually so each hop's scheme is re-validated. (Kept http allowed so internal/self-hosted endpoints keep working; no private-IP block by design.)
• Insecure credential perms — writeTokenFile() writes the token with owner-only 0o600 and chmods an already-existing token file to tighten it.

Test Plan

• npx tsc --noEmit
• npx vitest run src/__tests__/local-agent.test.ts src/__tests__/machine-id.test.ts — 16 passed (incl. 4 new security tests)
• npm run build
• E2E (id-fix): real CLI hook-dispatch with --tool claude|codebuddy|workbuddy against a mock server — same tool → same id across calls; different tools → different ids; report & sync ids match; TEAMAI_LOCAL_AGENT_ID override honoured.
• E2E (security): real CLI hook-dispatch where the mock server returns malicious commands — slug ../../evil → ack failed: Invalid resource slug, no file escapes the repo; file:///etc/passwd download_url → ack failed: Unsupported download URL scheme: file:.

🤖 Generated with Claude Code