@spinabot/brigade 0.1.0 → 0.1.2

package/dist/cli/gateway-cmd.js

@@ -25,8 +25,11 @@
  *                        nohup / tmux when you want JSONL only.
  */
 import process from "node:process";
+import chalk from "chalk";
 import { createConsoleStream } from "../core/console-stream.js";
+import { EXIT_CONFIG_ERROR, EXIT_FAILURE } from "../protocol.js";
 import { startServer } from "../core/server.js";
+import { restoreTerminal } from "../ui/terminal-cleanup.js";
 /**
  * Boot the gateway. Resolves once the port is bound. Wires SIGINT/SIGTERM
  * to a clean shutdown so the listening socket is released even on Ctrl+C.
@@ -61,20 +64,72 @@ export async function runGatewayCommand(opts = {}) {
         // instead of dumping a Node stack trace.
         const msg = err instanceof Error ? err.message : String(err);
         const port = opts.port ?? (Number(process.env.BRIGADE_PORT) || 7777);
+        // "no saved config" is a config error — exit with sysexits 78 so
+        // supervisors (systemd, launchd) STOP restarting. Restarting will
+        // produce the exact same error until the operator runs onboarding.
+        //
+        // Interactive enhancement (TTY only): rather than dead-ending the
+        // developer in their terminal with "go run another command", offer
+        // to launch chat (which handles onboarding inline) right now. Non-
+        // interactive supervisors get the message + exit 78 as before, so
+        // systemd doesn't sit waiting for stdin that will never come.
+        if (/no saved config|model .+ not in registry/i.test(msg)) {
+            process.stderr.write(chalk.yellow(`brigade-gateway: this gateway hasn't been set up yet.\n`) +
+                chalk.dim(`  Run ${chalk.bold("brigade chat")} to pick a provider + model, then re-launch.\n`));
+            if (process.stdin.isTTY && process.stdout.isTTY) {
+                const readline = await import("node:readline");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+                const answer = await new Promise((resolve) => {
+                    rl.question(`\nLaunch ${chalk.bold("brigade chat")} now to onboard? [Y/n] `, (a) => {
+                        rl.close();
+                        resolve(a.trim().toLowerCase());
+                    });
+                });
+                if (answer === "" || answer === "y" || answer === "yes") {
+                    // Hand off to chat. It boots the TUI, runs onboarding, then
+                    // stays in chat — the user can `/exit` and re-run gateway
+                    // when they're ready. Don't auto-restart the gateway: chat
+                    // may have done other work (model switch, /provider add)
+                    // the operator wants to control.
+                    const { runChatCommand } = await import("./chat-cmd.js");
+                    await runChatCommand({});
+                    // Chat owns its own exit. The gateway never started, so
+                    // there's no teardown to run — return a no-op so the
+                    // caller's contract holds.
+                    return async () => { };
+                }
+            }
+            process.exit(EXIT_CONFIG_ERROR);
+        }
         if (/EADDRINUSE/.test(msg)) {
             process.stderr.write(`brigade-gateway: port ${port} is already in use.\n` +
                 `  - find the process: PowerShell> Get-NetTCPConnection -LocalPort ${port}\n` +
                 `  - or pick a different port: brigade gateway --port ${port + 1}\n`);
-            process.exit(1);
+            process.exit(EXIT_FAILURE);
         }
         if (/EACCES/.test(msg)) {
+            // Privileged-port permission is a config issue (won't fix on retry).
             process.stderr.write(`brigade-gateway: permission denied binding port ${port} (privileged ports require admin).\n` +
                 `  - pick an unprivileged port: brigade gateway --port 7777\n`);
-            process.exit(1);
+            process.exit(EXIT_CONFIG_ERROR);
+        }
+        if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg)) {
+            // Bad --host config (won't fix on retry).
+            process.stderr.write(`brigade-gateway: couldn't resolve host "${opts.host ?? "default"}". Check the --host value and your DNS.\n`);
+            process.exit(EXIT_CONFIG_ERROR);
+        }
+        if (/EHOSTUNREACH|ENETUNREACH/i.test(msg)) {
+            // Transient network — supervisor may retry.
+            process.stderr.write(`brigade-gateway: no network route to ${opts.host ?? "default"}. Check your network / firewall / VPN.\n`);
+            process.exit(EXIT_FAILURE);
         }
-        // Unrecognized failure — surface the message but skip the stack.
-        process.stderr.write(`brigade-gateway: failed to start: ${msg}\n`);
-        process.exit(1);
+        // Unrecognized failure — short message line; raw `msg` only when the
+        // operator opts into BRIGADE_DEBUG=1.
+        process.stderr.write(`brigade-gateway: failed to start the server.\n`);
+        if (process.env.BRIGADE_DEBUG === "1") {
+            process.stderr.write(`  (debug: ${msg})\n`);
+        }
+        process.exit(EXIT_FAILURE);
     }
     // Banner already printed by startServer (verbose path uses consoleStream;
     // quiet path writes the two plain lines). No additional banner needed here.
@@ -83,7 +138,15 @@ export async function runGatewayCommand(opts = {}) {
     // here because the gateway runs without the TUI and never reaches that path.
     const onSignal = (sig) => {
         process.stderr.write(`brigade-gateway: ${sig} received, shutting down\n`);
-        void handle.stop().then(() => process.exit(0));
+        void handle.stop().then(() => {
+            // Gateway is headless and never enables raw mode itself, but the
+            // readline prompt above (the no-config Y/N) momentarily borrows the
+            // TTY. restoreTerminal() is idempotent and always safe — call it
+            // before exit so the next shell prompt is clean even if we ever
+            // add a richer interactive path here.
+            restoreTerminal();
+            process.exit(0);
+        });
     };
     process.once("SIGTERM", () => onSignal("SIGTERM"));
     process.once("SIGINT", () => onSignal("SIGINT"));

package/dist/cli.js

@@ -29,8 +29,12 @@ import { runConfigCommand } from "./cli/config-cmd.js";
 import { runConnectCommand } from "./cli/connect-cmd.js";
 import { runDoctorCommand } from "./cli/doctor-cmd.js";
 import { runGatewayCommand } from "./cli/gateway-cmd.js";
+import { installTerminalCleanupHandler, restoreTerminal } from "./ui/terminal-cleanup.js";
+import { loadBrigadeConfig, loadEnvIntoProcess, migrateBrigadeConfigV1toV2, migrateLegacyConfig, } from "./core/brigade-config.js";
+import { BRIGADE_DIR } from "./core/config.js";
 import { DEFAULT_PORT } from "./protocol.js";
-const VERSION = "0.1.0";
+import { BRIGADE_CLI_VERSION } from "./core/version.js";
+const VERSION = BRIGADE_CLI_VERSION;
 const HELP = `${chalk.bold("brigade")} — your personal AI crew
 
 ${chalk.dim("usage:")}
@@ -48,6 +52,9 @@ ${chalk.dim("flags (all subcommands respect):")}
   --help            show help (per-subcommand if applicable)
   --version         print version
 
+${chalk.dim("flags (chat / onboard):")}
+  --no-env-detect   ignore API keys exported in the shell env (typed-key only)
+
 ${chalk.dim("flags (gateway):")}
   --port <n>        listen port (default: ${DEFAULT_PORT}; env: BRIGADE_PORT)
   --host <addr>     bind address (default: 127.0.0.1)
@@ -80,6 +87,7 @@ export const BOOLEAN_FLAGS = new Set([
     "verbose",
     "quiet",
     "force",
+    "no-env-detect",
 ]);
 export function parseArgs(argv) {
     const positional = [];
@@ -133,8 +141,9 @@ export function parseArgs(argv) {
  *   3. Mention it in HELP above
  */
 const SUBCOMMANDS = {
-    chat: async () => {
-        await runChatCommand();
+    chat: async ({ flags }) => {
+        const noEnvDetect = flags["no-env-detect"] === true;
+        await runChatCommand({ noEnvDetect });
     },
     gateway: async ({ flags }) => {
         const port = typeof flags.port === "string"
@@ -180,7 +189,7 @@ const SUBCOMMANDS = {
         // Same as gateway — the TUI's stdin handler keeps the process alive.
         await new Promise(() => { });
     },
-    onboard: async () => {
+    onboard: async ({ flags }) => {
         // Onboarding lives inside chat-cmd's boot path today (it runs when no
         // saved config is present). For an explicit `brigade onboard`, force
         // the wizard by deleting the saved default before booting chat — the
@@ -202,7 +211,8 @@ const SUBCOMMANDS = {
         catch {
             /* missing config is fine — wizard will run regardless */
         }
-        await runChatCommand();
+        const noEnvDetect = flags["no-env-detect"] === true;
+        await runChatCommand({ noEnvDetect });
     },
     doctor: async ({ flags }) => {
         const gatewayUrl = typeof flags.gateway === "string" ? flags.gateway : undefined;
@@ -220,6 +230,12 @@ const SUBCOMMANDS = {
  * a subprocess.
  */
 export async function runCli(argv) {
+    // Install the process-wide terminal-cleanup safety net the moment runCli
+    // is called. Idempotent — repeated invocations (tests, embedded callers)
+    // register the listener at most once. Covers ALL exit paths (normal
+    // return, throw, signal, process.exit) so kitty keyboard escape sequences
+    // can never leak into the user's shell after Brigade exits.
+    installTerminalCleanupHandler();
     const parsed = parseArgs(argv);
     // Top-level flags first.
     if (parsed.flags.version === true || parsed.flags.v === true) {
@@ -230,6 +246,28 @@ export async function runCli(argv) {
         process.stdout.write(HELP);
         return 0;
     }
+    // Boot init — runs once per process before any subcommand. Four stages:
+    //   1. Auto-migrate legacy 3-file config (auth.json + config.json + settings.json)
+    //      to the unified brigade.json super-config. Idempotent.
+    //   2. Auto-migrate brigade.json from v1 → v2 super-config schema. Idempotent.
+    //      Order matters: stage 1 may produce a v2 file directly (so this is a
+    //      no-op for fresh installs), but a v1 file from an earlier Brigade
+    //      build needs lifting BEFORE we read it in stage 3.
+    //   3. Load brigade.json + overlay its `env` block into process.env so Pi's
+    //      auth resolution finds Brigade-managed keys. Existing shell env vars
+    //      take priority — we never overwrite a key the user explicitly exported.
+    //   4. Errors here are non-fatal. The agent must always boot so the user can
+    //      run `brigade doctor` and diagnose.
+    try {
+        await migrateLegacyConfig(BRIGADE_DIR);
+        await migrateBrigadeConfigV1toV2(BRIGADE_DIR);
+        const cfg = await loadBrigadeConfig(BRIGADE_DIR);
+        loadEnvIntoProcess(cfg);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(chalk.dim(`brigade: config init warning — ${msg}\n`));
+    }
     // Default subcommand: chat
     const sub = parsed.positional[0] ?? "chat";
     // Help on a specific subcommand: `brigade <sub> --help` falls through to
@@ -254,7 +292,10 @@ export async function runCli(argv) {
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         process.stderr.write(chalk.red(`brigade ${sub}: ${msg}\n`));
-        if (err instanceof Error && err.stack) {
+        // Stack traces leak `node_modules/.../` paths into user-facing output
+        // — same B2B-jargon class as Pi's `/login` leak. Suppress by default;
+        // surface only when the operator explicitly opts in via env.
+        if (process.env.BRIGADE_DEBUG === "1" && err instanceof Error && err.stack) {
             process.stderr.write(chalk.dim(`${err.stack}\n`));
         }
         return 1;
@@ -270,17 +311,17 @@ if (import.meta.url === entry) {
         .then((code) => {
         // Most subcommands keep the loop alive (gateway, connect, chat).
         // Only short-lived ones (config, doctor, --help) reach this point.
+        restoreTerminal();
         if (typeof code === "number")
             process.exit(code);
     })
         .catch((err) => {
-        try {
-            process.stdout.write("\x1b[?25h\x1b[?1049l");
-        }
-        catch {
-            /* terminal already gone */
+        restoreTerminal();
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(chalk.red(`Brigade crashed: ${msg}`));
+        if (process.env.BRIGADE_DEBUG === "1" && err instanceof Error && err.stack) {
+            console.error(chalk.dim(err.stack));
         }
-        console.error(chalk.red(`Brigade crashed: ${err instanceof Error ? err.stack ?? err.message : String(err)}`));
         process.exit(1);
     });
 }

package/dist/core/agent.js

@@ -22,7 +22,7 @@ import { decodeXaiToolCallArgs, downgradeOpenAIResponsesReasoningPairs, dropAnth
 import { smartCompactToolResults } from "./smart-compaction.js";
 import { refreshSessionSystemPrompt, seedDefaultPrompts } from "./system-prompt.js";
 export async function buildAgent(opts) {
-    // Seed default prompt files into ~/.brigade/prompts/ on first boot.
+    // Seed default prompt files into ~/.brigade/workspace/ on first boot.
     // Idempotent: existing files are never overwritten (users own their edits).
     // Failure is non-fatal — the assembler falls back to embedded defaults
     // when files are missing or unreadable.
@@ -47,7 +47,7 @@ export async function buildAgent(opts) {
         // tools: omitted → Pi enables read/bash/edit/write by default; grep is available too
     });
     // Inject Brigade's system prompt — assembled from the layered .md files
-    // at ~/.brigade/prompts/ (with per-cwd override). The assembler embeds
+    // at ~/.brigade/workspace/ (with per-cwd override). The assembler embeds
     // the BRIGADE_CACHE_BOUNDARY marker between static prefix and dynamic
     // suffix; the payload mutator (wrapStreamFnWithPayloadMutations below)
     // splits at the marker and applies Anthropic cache_control.
@@ -214,7 +214,7 @@ export async function buildAgent(opts) {
     //   - Cost: ~5KB of file I/O per turn (a few ms — negligible vs the
     //     500-5000ms LLM call). Re-read happens BEFORE the first LLM call
     //     of the turn, so the new prompt is in effect when Pi reads it.
-    //   - Hot reload: edits to ~/.brigade/prompts/<layer>.md take effect on
+    //   - Hot reload: edits to ~/.brigade/workspace/<layer>.md take effect on
     //     the next user turn, no restart needed.
     //   - Per-model guidance refresh: a /model swap changes which family
     //     guidance fires (OpenAI vs Google vs none for Anthropic). The

package/dist/core/auth-error.js

@@ -0,0 +1,111 @@
+/**
+ * Brigade-native translator for the "No API key found for X" error that
+ * surfaces from Pi's auth-resolution path.
+ *
+ * Pi's own message hardcodes `/login` (a Pi slash command Brigade doesn't
+ * have) and dumps raw `node_modules/@mariozechner/pi-coding-agent/docs/`
+ * paths into the user's chat. Both are direct violations of Brigade's
+ * B2B-grade copy rules — paying customers see the agent gesture at a
+ * non-existent command and at internal package paths.
+ *
+ * The replacement is a SINGLE SHORT LINE with a clear next step. Not a
+ * multi-line guidance block — when the user already knows what's wrong
+ * (their key isn't set), more text is more friction. Same pattern used by
+ * mature production agent platforms.
+ *
+ * Pure function. No I/O.
+ */
+/** Pi's "No API key found for X" pattern (see auth-guidance.js). */
+const NO_API_KEY_PATTERN = /^No API key found for ["']?([^"'.\s]+)["']?\.?/m;
+/** Pi's stale-OAuth pattern (see agent-session.js) — fires at session
+ *  startup when the saved credential won't authenticate. */
+const OAUTH_EXPIRED_PATTERN = /^Authentication failed for ["']?([^"'.\s]+)["']?\./m;
+/** Pi's OAuth token refresh failure pattern — fires mid-session when a
+ *  stored OAuth token's refresh exchange fails (separate code path from
+ *  the startup auth-failed error above). Both leak `/login` references. */
+const OAUTH_REFRESH_PATTERN = /^OAuth token refresh failed for ["']?([^"'.\s:]+)["']?[:.]?/m;
+/**
+ * Detect Pi's auth-failure error and return a Brigade-native single-line
+ * replacement. Returns `null` for any other error — caller falls through
+ * to the normal cleanProviderError path.
+ *
+ * Three known patterns from Pi (each a different code path; each leaks
+ * `/login` and may include raw `node_modules/.../docs/...` paths):
+ *   - "No API key found for X." (auth-guidance.js — no key in storage / env)
+ *   - "Authentication failed for X. Credentials may have expired …
+ *      Run '/login X' to re-authenticate." (agent-session.js — startup)
+ *   - "OAuth token refresh failed for X: …" (oauth refresh path — mid-session)
+ */
+export function translateAuthError(raw) {
+    if (!raw)
+        return null;
+    const noKey = raw.match(NO_API_KEY_PATTERN);
+    if (noKey) {
+        const provider = friendlyProviderName((noKey[1] ?? "").trim());
+        return `⚠ Missing API key for ${provider}. Use /provider to add one, /model to switch, or run \`brigade onboard\`.`;
+    }
+    // OAuth refresh failure (mid-session) — the kernel "tried to use the
+    // stored credential, attempted refresh, refresh round-trip failed."
+    // Often transient (provider 5xx during refresh) — phrase it as such.
+    const refresh = raw.match(OAUTH_REFRESH_PATTERN);
+    if (refresh) {
+        const provider = friendlyProviderName((refresh[1] ?? "").trim());
+        return `⚠ ${provider} login refresh failed. This is often temporary — try again in a moment, or use /provider to re-authenticate.`;
+    }
+    // Hard auth failure (startup) — credential exists but the server rejected it
+    // (expired, revoked, wrong-scope). Distinct from refresh: this needs a
+    // new credential, not just a retry.
+    const expired = raw.match(OAUTH_EXPIRED_PATTERN);
+    if (expired) {
+        const provider = friendlyProviderName((expired[1] ?? "").trim());
+        return `⚠ ${provider} login was rejected (credential expired or revoked). Use /provider to add a fresh key, /model to switch, or run \`brigade onboard\`.`;
+    }
+    if (/^No models? (available|selected)/i.test(raw)) {
+        return "⚠ No models available yet. Use /provider to add one, or run `brigade onboard` to set up.";
+    }
+    return null;
+}
+/**
+ * Single-line response when a user types `/login` (a Pi command Brigade
+ * doesn't have). Same shape as the auth-error translator above.
+ */
+export function buildLoginGuidanceMessage() {
+    return "⚠ Brigade doesn't use /login. Use /provider to add a provider, /model to switch, or run `brigade onboard`.";
+}
+/**
+ * Universal error-prep used by every catch site that may render a Pi error
+ * to the user. Pipeline:
+ *   1. Try the auth-error translator (handles `No API key`, OAuth expired,
+ *      `No models available`).
+ *   2. Fall back to `cleanProviderError` to peel JSON wrappers from generic
+ *      provider errors (rate limits, content policy, etc).
+ *
+ * Single helper everywhere = no chance of one catch site forgetting to
+ * translate auth errors. Whenever a NEW Pi error pattern needs handling,
+ * extend `translateAuthError` once and every catch path benefits.
+ */
+export function friendlyError(raw, cleanProviderError) {
+    const translated = translateAuthError(raw);
+    if (translated)
+        return translated;
+    return cleanProviderError(raw);
+}
+const FRIENDLY_NAMES = {
+    anthropic: "Anthropic",
+    openai: "OpenAI",
+    openrouter: "OpenRouter",
+    google: "Google Gemini",
+    groq: "Groq",
+    cerebras: "Cerebras",
+    xai: "xAI",
+    deepseek: "DeepSeek",
+    mistral: "Mistral",
+    ollama: "Ollama",
+};
+function friendlyProviderName(id) {
+    if (!id)
+        return "the selected provider";
+    const lookup = FRIENDLY_NAMES[id.toLowerCase()];
+    return lookup ?? id;
+}
+//# sourceMappingURL=auth-error.js.map

package/dist/core/auth-label.js

@@ -0,0 +1,147 @@
+/**
+ * Auth-source resolver — answers "where did this provider's credential
+ * actually come from?" so the TUI header, doctor output, and config listing
+ * can show the operator a truthful provenance label.
+ *
+ * Why this matters: Pi consults a chain of sources for each provider — the
+ * brigade.json `env` block (loaded into `process.env` at boot via
+ * `loadEnvIntoProcess`), shell-supplied env vars, and (later) custom-provider
+ * entries in models.json. Without explicit labelling, the operator can't
+ * tell whether `rm -rf ~/.brigade` will wipe their auth (yes if `source:"file"`,
+ * no if `source:"env"` because the shell sets it independently).
+ *
+ * The resolver is a pure function — no I/O, no env mutation. Caller passes in
+ * the brigade.json env block and (optionally) a substitute for process.env so
+ * tests can drive every source/precedence combo without poking real env vars.
+ */
+/* ─────────────────────────── provider env-var registry ─────────────────────────── */
+/**
+ * The env vars Pi consults for each provider, in priority order. OAuth tokens
+ * before plain API keys (Anthropic) — same order Pi itself walks at request
+ * time, so the resolved label matches what the SDK is actually using.
+ *
+ * Authoritative source: Pi's `env-api-keys.js::getApiKeyEnvVars` map. Adding
+ * a candidate Pi DOESN'T read produces false-positive labels (doctor reports
+ * "configured" while every API call 401s); omitting one Pi DOES read produces
+ * false-negative labels (operator can't see why their working key isn't
+ * surfaced). Keep this in sync with `src/providers/catalog.ts` AND with Pi.
+ *
+ * Ollama has an empty list because it requires no auth — caller can treat
+ * `source:"none"` for ollama specially (it's not a misconfiguration).
+ */
+export const PROVIDER_ENV_VAR_REGISTRY = {
+    anthropic: ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
+    openai: ["OPENAI_API_KEY"],
+    openrouter: ["OPENROUTER_API_KEY"],
+    google: ["GEMINI_API_KEY"],
+    groq: ["GROQ_API_KEY"],
+    cerebras: ["CEREBRAS_API_KEY"],
+    xai: ["XAI_API_KEY"],
+    deepseek: ["DEEPSEEK_API_KEY"],
+    mistral: ["MISTRAL_API_KEY"],
+    ollama: [],
+};
+/* ─────────────────────────── resolver ─────────────────────────── */
+/**
+ * Walk the candidate env vars for `provider` and return the highest-priority
+ * one that has a value somewhere. The "file vs env" distinction is decided
+ * by whether the value also appears in `brigadeEnvBlock`:
+ *
+ *   - In brigadeEnvBlock + in processEnv with same value → "file"
+ *     (brigade.json::env loaded the value into the process)
+ *   - In processEnv only (or value differs from the file) → "env"
+ *     (the shell set it; brigade.json doesn't own it)
+ *   - In neither → continue to next candidate
+ *
+ * If no candidate matches, returns `{ source: "none", provider }`.
+ *
+ * The `models_json` source is reserved here — this function does not resolve
+ * it (custom-provider wiring lives in the models.json side). Callers that
+ * also need to consider models.json should compose a check before calling
+ * this.
+ */
+export function resolveAuthLabel(params) {
+    const { provider } = params;
+    const candidates = PROVIDER_ENV_VAR_REGISTRY[provider] ?? [];
+    const env = params.processEnv ?? process.env;
+    const block = params.brigadeEnvBlock ?? {};
+    const appliedFromFile = params.appliedFromFile;
+    for (const name of candidates) {
+        const fromBlock = block[name];
+        const fromEnv = env[name];
+        const blockHas = typeof fromBlock === "string" && fromBlock.length > 0;
+        const envHas = typeof fromEnv === "string" && fromEnv.length > 0;
+        // Authoritative "file" path: loadEnvIntoProcess actually wrote this
+        // key into process.env (i.e. shell didn't already have it). Requires
+        // the caller to thread the applied set in. Without that signal we
+        // can't distinguish "file" from "shell happens to match by coincidence."
+        if (appliedFromFile && appliedFromFile.has(name) && envHas) {
+            return { source: "file", provider, storedAs: "env_block" };
+        }
+        // Caller didn't pass appliedFromFile (tests, ad-hoc callers): fall back
+        // to value-equality. Less accurate — a shell value matching the file
+        // looks like "file" — but useful as a structural signal in tests.
+        if (!appliedFromFile && blockHas && envHas && fromBlock === fromEnv) {
+            return { source: "file", provider, storedAs: "env_block" };
+        }
+        if (envHas) {
+            // Either shell-supplied (block doesn't have it) OR shell pre-shadowed
+            // the file value (loadEnvIntoProcess skipped it). Either way, what
+            // the SDK actually sends came from process.env, not from brigade.json
+            // — so `rm -rf ~/.brigade` won't touch it.
+            return { source: "env", provider, envVar: name };
+        }
+        // Neither has it (or only the block has it without overlay yet):
+        // try the next candidate.
+    }
+    return { source: "none", provider };
+}
+/* ─────────────────────────── formatter ─────────────────────────── */
+/**
+ * Stringify a label for display in the TUI header / doctor / config-list.
+ * The strings here are the user-facing contract — UI surfaces depend on them
+ * so changes ripple. Snapshot-test if you change the format.
+ */
+export function formatAuthLabel(label) {
+    switch (label.source) {
+        case "file":
+            return "file (~/.brigade/brigade.json)";
+        case "env":
+            return `env (${label.envVar})`;
+        case "models_json":
+            return "custom (~/.brigade/models.json)";
+        case "none":
+            return "not authenticated";
+    }
+}
+/* ─────────────────────────── enumerate configured providers ─────────────────────────── */
+/**
+ * Walk every known provider, resolve its label, and return only those that
+ * are actually configured (label.source !== "none"). Used by `brigade
+ * doctor`'s "configured providers" section to give the operator a one-glance
+ * inventory of what auth they actually have.
+ *
+ * Order is preserved from PROVIDER_ENV_VAR_REGISTRY so the doctor output is
+ * stable across runs — operators reading the report don't get surprised by
+ * reordered lists between invocations.
+ */
+export function listConfiguredProviders(params) {
+    const out = [];
+    // `params.provider` is unused by the per-provider walk — we iterate the
+    // registry and re-call resolveAuthLabel for each. We pull the brigadeEnvBlock
+    // + processEnv off `params` so callers don't have to repeat themselves.
+    const sharedBlock = params.brigadeEnvBlock;
+    const sharedProcessEnv = params.processEnv;
+    for (const provider of Object.keys(PROVIDER_ENV_VAR_REGISTRY)) {
+        const label = resolveAuthLabel({
+            provider,
+            brigadeEnvBlock: sharedBlock,
+            processEnv: sharedProcessEnv,
+        });
+        if (label.source !== "none") {
+            out.push({ provider, label });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=auth-label.js.map