@spinabot/brigade 0.1.0 → 0.1.2

package/dist/core/cli-error.js

@@ -0,0 +1,94 @@
+/**
+ * Translate Node-style error codes (ECONNREFUSED, ENOTFOUND, EACCES, …) into
+ * single-line plain-English descriptions suitable for surface in CLI error
+ * output. Without this, raw `getaddrinfo ENOTFOUND foo.local` strings reach
+ * paying users — same B2B-jargon class as Pi's `/login` leak that triggered
+ * this audit pass.
+ *
+ * Pure function. Returns `null` for unrecognised errors so the caller can
+ * fall through to its own fallback (often `cleanProviderError` for the
+ * Pi/provider error envelope).
+ */
+const NODE_ERRNO_MESSAGES = {
+    ECONNREFUSED: "couldn't connect — nothing is listening at that address",
+    ETIMEDOUT: "connection timed out — the host took too long to answer",
+    ENOTFOUND: "couldn't resolve that host — check the address and your DNS",
+    EHOSTUNREACH: "couldn't reach that host — check your network",
+    ENETUNREACH: "no network route to that host",
+    EAI_AGAIN: "DNS lookup failed temporarily — try again in a moment",
+    ECONNRESET: "connection dropped mid-request",
+    EPIPE: "the connection was closed before we could finish writing",
+    EACCES: "permission denied",
+    EPERM: "permission denied",
+    ENOENT: "file or directory not found",
+    EEXIST: "already exists",
+    EISDIR: "expected a file but got a directory",
+    ENOTDIR: "expected a directory but got a file",
+    ENOSPC: "no space left on this device",
+    EMFILE: "too many open files — close some apps and retry",
+    EBUSY: "file is locked by another process — close it and retry",
+    EROFS: "read-only filesystem",
+    ENOMEM: "out of memory",
+};
+/**
+ * Detect a Node errno in the input and replace with the plain-English line.
+ * Strategy:
+ *   1. Walk the well-known errno tokens; if one appears at the start (`^X:`)
+ *      or as the bare token (`getaddrinfo ENOTFOUND foo`), return the mapped
+ *      message with the offending host/path appended when we can extract it.
+ *   2. Strip absolute paths from the appended detail (no `C:\Users\...` leaks).
+ */
+export function translateNodeErrno(raw) {
+    if (!raw)
+        return null;
+    for (const [code, plain] of Object.entries(NODE_ERRNO_MESSAGES)) {
+        // Match the token surrounded by start/end/whitespace/colon/quote — so
+        // "ECONNREFUSED 127.0.0.1:7777" matches but "RECONNECTING" doesn't.
+        const re = new RegExp(`(?:^|[\\s:"'])${code}(?:$|[\\s:"',])`);
+        if (!re.test(raw))
+            continue;
+        const detail = extractDetailAfter(raw, code);
+        return detail ? `${plain} (${detail})` : plain;
+    }
+    return null;
+}
+/**
+ * Universal CLI-error helper: try Node errno first, then fall through to a
+ * caller-supplied fallback. Mirrors the `friendlyError` shape used in the
+ * TUI surface.
+ */
+export function friendlyCliError(raw, fallback = (s) => s) {
+    const errno = translateNodeErrno(raw);
+    if (errno)
+        return errno;
+    return fallback(raw);
+}
+/**
+ * Pull a useful detail off a Node errno string, stripping absolute paths so
+ * we don't leak `C:\Users\Bob\.brigade\…` to a B2B user.
+ *
+ * Examples:
+ *   `getaddrinfo ENOTFOUND foo.local`   → "foo.local"
+ *   `EACCES: permission denied, open 'C:\\Users\\Bob\\.brigade\\auth.json'`
+ *                                       → "auth.json"
+ *   `connect ECONNREFUSED 127.0.0.1:7777` → "127.0.0.1:7777"
+ */
+function extractDetailAfter(raw, code) {
+    const idx = raw.indexOf(code);
+    if (idx < 0)
+        return "";
+    const tail = raw.slice(idx + code.length).trim();
+    if (!tail)
+        return "";
+    // Quoted path: keep only the basename to drop directory leakage.
+    const pathMatch = tail.match(/['"]([^'"]+)['"]/);
+    if (pathMatch?.[1]) {
+        const segments = pathMatch[1].split(/[/\\]/);
+        const last = segments[segments.length - 1] ?? "";
+        return last;
+    }
+    // Bare host:port or hostname after the code.
+    const hostMatch = tail.match(/^[:,\s]*([a-zA-Z0-9._:-]+(?::\d+)?)/);
+    return hostMatch?.[1] ?? "";
+}
+//# sourceMappingURL=cli-error.js.map

package/dist/core/config.js

@@ -12,15 +12,35 @@ import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 /**
- * `~/.brigade` — Pi's agentDir for our app. Env override `BRIGADE_DIR` takes
- * precedence so tests, dotfile-managers, and CI runners can redirect Brigade's
+ * `~/.brigade` — Pi's agentDir for our app. Two env-var overrides supported,
+ * priority order:
+ *   1. `BRIGADE_STATE_DIR` — preferred name, matches `XDG_STATE_HOME` style
+ *   2. `BRIGADE_DIR` — original Brigade name; kept as a backwards-compat alias
+ *
+ * Either lets tests, dotfile-managers, and CI runners redirect Brigade's
  * state to a sandbox dir without symlinking the home directory.
  */
-export const BRIGADE_DIR = process.env.BRIGADE_DIR && process.env.BRIGADE_DIR.trim().length > 0
-    ? path.resolve(process.env.BRIGADE_DIR)
-    : path.join(os.homedir(), ".brigade");
+export const BRIGADE_DIR = (() => {
+    const stateDir = process.env.BRIGADE_STATE_DIR;
+    if (stateDir && stateDir.trim().length > 0)
+        return path.resolve(stateDir);
+    const legacy = process.env.BRIGADE_DIR;
+    if (legacy && legacy.trim().length > 0)
+        return path.resolve(legacy);
+    return path.join(os.homedir(), ".brigade");
+})();
 /** ~/.brigade/config.json — our user preferences. */
 const CONFIG_FILE = path.join(BRIGADE_DIR, "config.json");
+/**
+ * `~/.brigade/workspace/` — the canonical home for the persona layer files
+ * (SOUL.md, IDENTITY.md, AGENTS.md, TOOLS.md, USER.md, BOOTSTRAP.md,
+ * HEARTBEAT.md). Files live at the workspace root with UPPERCASE names so the
+ * same conventions apply whether they're read by the system-prompt assembler
+ * or cloned to another machine alongside the rest of the workspace.
+ */
+export function getBrigadeWorkspaceDir() {
+    return path.join(BRIGADE_DIR, "workspace");
+}
 /**
  * Compute the session directory for a given working directory, rooted at
  * Brigade's own agentDir.
@@ -44,6 +64,21 @@ export function getBrigadeSessionDir(cwd, agentDir = BRIGADE_DIR) {
  * Read user preferences from disk. Returns `{}` if missing or unparseable
  * (a corrupt config should never block boot — the user just sees onboarding).
  *
+ * Two-tier read for backwards compatibility with the v0.1 split-file layout:
+ *   1. Legacy `config.json` first (still authoritative if it exists — the
+ *      migration tool only renames it AFTER copying values into brigade.json,
+ *      so a present `config.json` means "no migration has happened yet").
+ *   2. Fall back to the unified `brigade.json` (post-migration home for these
+ *      values). Reads them from the v2 reference-aligned blocks:
+ *        - default provider+model  → agents.defaults.model.primary
+ *        - fallback provider+model → agents.defaults.model.fallbacks[0]
+ *        - installedAt             → meta.installedAt
+ *        - thinkingLevel/compaction → settings.* (Brigade-private namespace)
+ *      Plus an in-flight upgrade fallback to the v1 settings.defaultProvider/
+ *      defaultModelId/fallbackProvider/fallbackModelId/installedAt fields, in
+ *      case a write landed during a partially-completed migration. Drop in v3
+ *      once everyone's been on v2 for a release.
+ *
  * `configPath` overrides the default location — used by tests to redirect
  * to a tempdir without mutating $HOME.
  */
@@ -53,7 +88,54 @@ export async function loadConfig(configPath = CONFIG_FILE) {
         return JSON.parse(data);
     }
     catch {
-        return {};
+        // Legacy file missing. Only fall back to the unified brigade.json when
+        // we're reading the DEFAULT config path — a custom configPath (test
+        // tempdir, integration probes) wants strict isolation: empty means
+        // empty, no leakage from the user's real `~/.brigade/brigade.json`.
+        if (configPath !== CONFIG_FILE)
+            return {};
+        try {
+            const { loadBrigadeConfig, parseModelRef } = await import("./brigade-config.js");
+            const cfg = await loadBrigadeConfig(BRIGADE_DIR);
+            // In-flight upgrade fallback: if v2 lift hasn't happened yet, the
+            // legacy v1 `settings.defaultProvider`/etc. may still be present in
+            // memory (loadBrigadeConfig only validates the current schema, but
+            // the backup-recovery path could legitimately hand back stale data
+            // during a partial migration). Read those as a last resort.
+            const legacySettings = cfg.settings;
+            const primaryRef = cfg.agents?.defaults?.model?.primary;
+            const primary = parseModelRef(primaryRef);
+            const fallbackRef = cfg.agents?.defaults?.model?.fallbacks?.[0];
+            const fallback = parseModelRef(fallbackRef);
+            // Emit only fields that are actually present so callers can keep
+            // using `Object.keys(cfg).length === 0` as their "is this an empty
+            // config" check (the `brigade config list` "(empty)" message
+            // depends on this — listing a config that's all-undefined would
+            // show as not-empty otherwise).
+            const out = {};
+            const defaultProvider = primary?.provider ?? legacySettings?.defaultProvider;
+            const defaultModelId = primary?.modelId ?? legacySettings?.defaultModelId;
+            const thinkingLevel = legacySettings?.thinkingLevel;
+            const fallbackProvider = fallback?.provider ?? legacySettings?.fallbackProvider;
+            const fallbackModelId = fallback?.modelId ?? legacySettings?.fallbackModelId;
+            const installedAt = cfg.meta?.installedAt ?? legacySettings?.installedAt;
+            if (defaultProvider !== undefined)
+                out.defaultProvider = defaultProvider;
+            if (defaultModelId !== undefined)
+                out.defaultModelId = defaultModelId;
+            if (thinkingLevel !== undefined)
+                out.thinkingLevel = thinkingLevel;
+            if (fallbackProvider !== undefined)
+                out.fallbackProvider = fallbackProvider;
+            if (fallbackModelId !== undefined)
+                out.fallbackModelId = fallbackModelId;
+            if (installedAt !== undefined)
+                out.installedAt = installedAt;
+            return out;
+        }
+        catch {
+            return {};
+        }
     }
 }
 /**
@@ -75,6 +157,99 @@ export async function saveConfig(partial, configPath = CONFIG_FILE) {
         ...partial,
         installedAt: existing.installedAt ?? partial.installedAt ?? new Date().toISOString(),
     };
-    await fs.writeFile(configPath, JSON.stringify(merged, null, 2), "utf8");
+    // Two-tier write: prefer brigade.json (the unified config) when no legacy
+    // config.json is present at the tested path. This keeps tests with custom
+    // configPath working (they'll create config.json in their tempdir) AND
+    // makes prod writes flow into brigade.json after migration. We never WRITE
+    // to a legacy config.json once migration has happened — that would
+    // re-create the split-file layout we just consolidated.
+    let legacyExists = false;
+    try {
+        await fs.stat(configPath);
+        legacyExists = true;
+    }
+    catch {
+        /* missing — fall through */
+    }
+    if (legacyExists || configPath !== CONFIG_FILE) {
+        await fs.writeFile(configPath, JSON.stringify(merged, null, 2), "utf8");
+        return;
+    }
+    // Default path + no legacy file → write into brigade.json under the v2
+    // reference-aligned blocks. Mapping:
+    //   defaultProvider + defaultModelId   → agents.defaults.model.primary (when BOTH set)
+    //   defaultProvider OR defaultModelId  → settings.defaultProvider/Id (transient,
+    //                                        in-flight scratch until both halves arrive)
+    //   fallbackProvider + fallbackModelId → agents.defaults.model.fallbacks[0]
+    //   installedAt                        → meta.installedAt
+    //   thinkingLevel/compaction           → settings.* (Brigade-private)
+    const { loadBrigadeConfig, writeBrigadeConfig, composeModelRefExternal } = await import("./brigade-config.js");
+    const brigadeCfg = await loadBrigadeConfig(BRIGADE_DIR);
+    // Resolve the effective provider+modelId pair from the merged values PLUS
+    // any in-flight scratch already in settings. This is what makes the
+    // two-step CLI ritual (`set defaultProvider X` then `set defaultModelId Y`)
+    // land both halves into agents.defaults.model.primary on the second call,
+    // instead of leaving the scratch in settings indefinitely.
+    const settingsAsRecord = (brigadeCfg.settings ?? {});
+    const effectiveProvider = merged.defaultProvider ??
+        settingsAsRecord.defaultProvider;
+    const effectiveModelId = merged.defaultModelId ??
+        settingsAsRecord.defaultModelId;
+    const primaryRef = composeModelRefExternal(effectiveProvider, effectiveModelId);
+    const fallbackRef = composeModelRefExternal(merged.fallbackProvider, merged.fallbackModelId);
+    const existingAgents = brigadeCfg.agents ?? {};
+    const existingDefaults = existingAgents.defaults ?? {};
+    const existingModel = existingDefaults.model ?? {};
+    brigadeCfg.agents = {
+        ...existingAgents,
+        defaults: {
+            ...existingDefaults,
+            model: {
+                ...existingModel,
+                primary: primaryRef ?? existingModel.primary,
+                fallbacks: fallbackRef ? [fallbackRef] : existingModel.fallbacks,
+            },
+        },
+        // Preserve any user-populated `agents.list` verbatim. Do NOT seed a
+        // stub entry when the list is empty/absent — the runtime synthesizes
+        // a virtual default agent keyed by "main" in that case (see
+        // brigade-config.ts migrations for the same rationale). Seeding a
+        // `{ id: "main", name: "<product>" }` stub would leak the product
+        // brand into the persona slot; the `name` field is reserved for the
+        // user's choice via BOOTSTRAP / identity command.
+        ...(existingAgents.list && existingAgents.list.length > 0
+            ? { list: existingAgents.list }
+            : {}),
+    };
+    if (merged.installedAt) {
+        brigadeCfg.meta = {
+            ...(brigadeCfg.meta ?? {}),
+            installedAt: brigadeCfg.meta?.installedAt ?? merged.installedAt,
+        };
+    }
+    const newSettings = { ...(brigadeCfg.settings ?? {}) };
+    if (merged.thinkingLevel !== undefined) {
+        newSettings.thinkingLevel = merged.thinkingLevel;
+    }
+    // Partial defaults: when only ONE half of provider+modelId is known,
+    // stash it in settings as in-flight scratch so the next `set` call can
+    // combine the two into a complete agents.defaults.model.primary ref.
+    // Once primaryRef is composed, clear the scratch — it'd otherwise lie
+    // stale on disk and shadow the canonical agents.defaults.model.primary
+    // on the next read.
+    if (primaryRef) {
+        delete newSettings.defaultProvider;
+        delete newSettings.defaultModelId;
+    }
+    else {
+        if (effectiveProvider !== undefined)
+            newSettings.defaultProvider = effectiveProvider;
+        if (effectiveModelId !== undefined)
+            newSettings.defaultModelId = effectiveModelId;
+    }
+    // compaction is set by other code paths directly through writeBrigadeConfig
+    // and is preserved by the spread above.
+    brigadeCfg.settings = newSettings;
+    await writeBrigadeConfig(BRIGADE_DIR, brigadeCfg);
 }
 //# sourceMappingURL=config.js.map

package/dist/core/exec-approvals.js

@@ -0,0 +1,337 @@
+/**
+ * Persistent tool-approval allowlist — storage + decision contract.
+ *
+ * Lives at `<brigadeDir>/exec-approvals.json`. The actual approval flow (TUI
+ * prompt with "approve once / always / never" choices) is wired separately;
+ * this module is the storage layer + the pure-function decider that the flow
+ * calls when a tool is about to run.
+ *
+ * Why "tool-approval" and not "command-approval": Brigade's risk surface is
+ * the set of registered tools (Bash, Edit, Write, …) plus arbitrary `args`
+ * strings. A `tool` scope blanket-approves every invocation of a single tool;
+ * a `tool+pattern` scope adds an args-substring guard so an operator can say
+ * "always allow `Bash` when its args contain `npm test`" without unlocking
+ * `Bash rm -rf /`. Substring (not regex) is intentional — regex in security-
+ * relevant code is a footgun (catastrophic backtracking, accidental over-
+ * matching from `.` in untrusted input). Regex matching is a v2 feature when
+ * we have a hardened pattern surface (anchors, no backrefs, length cap).
+ */
+import { existsSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+/* ─────────────────────────── constants ─────────────────────────── */
+const APPROVALS_FILENAME = "exec-approvals.json";
+/** Hard cap on entry count to keep the file small + decisions O(n) in something tiny. */
+const MAX_ENTRIES = 1_000;
+/* ─────────────────────────── path helpers ─────────────────────────── */
+function approvalsFilePath(brigadeDir) {
+    return path.join(brigadeDir, APPROVALS_FILENAME);
+}
+function tmpFilePath(brigadeDir) {
+    // Same dir as the target so rename() is atomic on the same volume. Cross-
+    // volume renames silently degrade to copy+unlink, defeating the atomicity.
+    return path.join(brigadeDir, `${APPROVALS_FILENAME}.tmp`);
+}
+function clobberedPath(brigadeDir, ts) {
+    return path.join(brigadeDir, `${APPROVALS_FILENAME}.clobbered.${ts}`);
+}
+/* ─────────────────────────── schema validation ─────────────────────────── */
+/**
+ * Hand-rolled validator. We deliberately don't pull in a runtime schema lib
+ * here — this file is on the hot path of every tool dispatch and a 200KB AJV
+ * compiled schema would be overkill for a 4-shape struct. Returns true iff
+ * the value is a structurally-valid ExecApprovalsFile; everything else falls
+ * back to "treat as corrupt, snapshot, start fresh".
+ */
+function isValidFile(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    if (v.version !== 1)
+        return false;
+    if (!Array.isArray(v.entries))
+        return false;
+    for (const e of v.entries) {
+        if (!isValidEntry(e))
+            return false;
+    }
+    return true;
+}
+function isValidEntry(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const e = value;
+    if (typeof e.decidedAt !== "string")
+        return false;
+    if (e.decidedBy !== undefined && typeof e.decidedBy !== "string")
+        return false;
+    if (e.expiresAt !== undefined && typeof e.expiresAt !== "string")
+        return false;
+    return isValidScope(e.scope);
+}
+function isValidScope(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const s = value;
+    if (s.kind === "tool") {
+        return typeof s.tool === "string" && s.tool.length > 0;
+    }
+    if (s.kind === "tool+pattern") {
+        return (typeof s.tool === "string" &&
+            s.tool.length > 0 &&
+            typeof s.argsPattern === "string" &&
+            s.argsPattern.length > 0);
+    }
+    return false;
+}
+/* ─────────────────────────── scope identity ─────────────────────────── */
+/**
+ * Two scopes are "the same" when they would match the same set of (tool, args)
+ * pairs. Used by addApproval/removeApproval for dedup. Pattern matching is
+ * exact-string (case-sensitive) — we don't normalise whitespace so the user's
+ * intent is preserved verbatim.
+ */
+function scopesEqual(a, b) {
+    if (a.kind !== b.kind)
+        return false;
+    if (a.kind === "tool" && b.kind === "tool") {
+        return a.tool === b.tool;
+    }
+    if (a.kind === "tool+pattern" && b.kind === "tool+pattern") {
+        return a.tool === b.tool && a.argsPattern === b.argsPattern;
+    }
+    return false;
+}
+/* ─────────────────────────── expiration ─────────────────────────── */
+function isExpired(entry, now) {
+    if (!entry.expiresAt)
+        return false;
+    const t = Date.parse(entry.expiresAt);
+    if (!Number.isFinite(t))
+        return false; // unparseable expiry → treat as never
+    return t <= now.getTime();
+}
+/* ─────────────────────────── load ─────────────────────────── */
+/**
+ * Read the approvals file. Missing file → fresh empty result. Corrupt /
+ * schema-invalid file → snapshot to `<filename>.clobbered.<ts>`, warn to
+ * stderr, return fresh empty result. We never throw from load — a single
+ * bad approval file should not crash boot.
+ */
+export async function loadApprovals(brigadeDir) {
+    const filePath = approvalsFilePath(brigadeDir);
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, "utf8");
+    }
+    catch {
+        return { version: 1, entries: [] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        await snapshotClobbered(brigadeDir, raw, "json parse");
+        return { version: 1, entries: [] };
+    }
+    if (!isValidFile(parsed)) {
+        await snapshotClobbered(brigadeDir, raw, "schema");
+        return { version: 1, entries: [] };
+    }
+    return parsed;
+}
+async function snapshotClobbered(brigadeDir, raw, reason) {
+    const ts = Date.now();
+    const dest = clobberedPath(brigadeDir, ts);
+    try {
+        await fs.writeFile(dest, raw, "utf8");
+        process.stderr.write(`[brigade] approvals file at ${approvalsFilePath(brigadeDir)} was corrupt (${reason}); snapshot saved to ${dest}\n`);
+    }
+    catch {
+        // Snapshot failed (disk full / permission). Fall back to a stderr-only
+        // warning — losing the snapshot is preferable to crashing the agent.
+        process.stderr.write(`[brigade] approvals file at ${approvalsFilePath(brigadeDir)} was corrupt (${reason}); could not write snapshot\n`);
+    }
+}
+/* ─────────────────────────── save ─────────────────────────── */
+/**
+ * Atomically write the approvals file. Validates the schema before writing —
+ * a programming error elsewhere should not be allowed to corrupt the file on
+ * disk. Mode is 0o600 (POSIX); on Windows the chmod call is a no-op and any
+ * EPERM is swallowed.
+ */
+export async function saveApprovals(brigadeDir, file) {
+    if (!isValidFile(file)) {
+        throw new Error("saveApprovals: refusing to write invalid approvals file");
+    }
+    if (file.entries.length > MAX_ENTRIES) {
+        throw new Error(`saveApprovals: too many entries (${file.entries.length} > ${MAX_ENTRIES})`);
+    }
+    await fs.mkdir(brigadeDir, { recursive: true });
+    const target = approvalsFilePath(brigadeDir);
+    const tmp = tmpFilePath(brigadeDir);
+    const json = `${JSON.stringify(file, null, 2)}\n`;
+    // Write to a sibling .tmp first so a crash mid-write leaves the existing
+    // file intact. fs.writeFile already overwrites the tmp file if a previous
+    // run left one behind.
+    await fs.writeFile(tmp, json, "utf8");
+    try {
+        await fs.chmod(tmp, 0o600);
+    }
+    catch (err) {
+        // Windows / non-POSIX filesystems: chmod is unsupported (EPERM /
+        // ENOSYS). Swallow — the rename below is what makes this atomic; the
+        // permissions matter for security, not correctness.
+        const code = err?.code;
+        if (code !== "EPERM" && code !== "ENOSYS")
+            throw err;
+    }
+    await fs.rename(tmp, target);
+}
+/* ─────────────────────────── add / remove / clear ─────────────────────────── */
+/**
+ * Append (or refresh) an approval. Dedup rule:
+ *   - If an entry with an equivalent scope exists AND has expired, replace it
+ *     (so a fresh approval extends a stale one).
+ *   - If an entry with an equivalent scope exists AND is still valid, refresh
+ *     `decidedAt` (and `expiresAt` if a new ttlMs was passed) without dropping
+ *     the matched scope.
+ *   - Otherwise, append.
+ *
+ * Returns the entry that ended up in the file (the new or refreshed one).
+ */
+export async function addApproval(brigadeDir, scope, opts = {}) {
+    if (!isValidScope(scope)) {
+        throw new Error("addApproval: invalid scope");
+    }
+    const file = await loadApprovals(brigadeDir);
+    const now = new Date();
+    const entry = {
+        scope,
+        decidedAt: now.toISOString(),
+    };
+    if (opts.decidedBy !== undefined)
+        entry.decidedBy = opts.decidedBy;
+    if (typeof opts.ttlMs === "number" && opts.ttlMs > 0) {
+        entry.expiresAt = new Date(now.getTime() + opts.ttlMs).toISOString();
+    }
+    const existingIdx = file.entries.findIndex((e) => scopesEqual(e.scope, scope));
+    if (existingIdx === -1) {
+        file.entries.push(entry);
+    }
+    else {
+        const existing = file.entries[existingIdx];
+        if (isExpired(existing, now)) {
+            // Replace expired stub wholesale — old metadata is no longer valid.
+            file.entries[existingIdx] = entry;
+        }
+        else {
+            // Refresh the live entry. Preserve decidedBy when the caller didn't
+            // override it (we don't want a "ttl bump" call to wipe the original
+            // approver), and preserve the existing expiresAt unless ttlMs was
+            // passed — bumping a permanent approval shouldn't silently demote
+            // it to a TTL'd one.
+            const refreshed = {
+                scope: existing.scope,
+                decidedAt: now.toISOString(),
+                decidedBy: opts.decidedBy ?? existing.decidedBy,
+                expiresAt: entry.expiresAt ?? existing.expiresAt,
+            };
+            file.entries[existingIdx] = refreshed;
+        }
+    }
+    await saveApprovals(brigadeDir, file);
+    return file.entries[existingIdx === -1 ? file.entries.length - 1 : existingIdx];
+}
+/** Remove a matching scope. Returns true if removed, false if not present. */
+export async function removeApproval(brigadeDir, scope) {
+    if (!isValidScope(scope))
+        return false;
+    const file = await loadApprovals(brigadeDir);
+    const before = file.entries.length;
+    file.entries = file.entries.filter((e) => !scopesEqual(e.scope, scope));
+    if (file.entries.length === before)
+        return false;
+    await saveApprovals(brigadeDir, file);
+    return true;
+}
+/** Drop every entry. Returns the count that was removed. */
+export async function clearApprovals(brigadeDir) {
+    const file = await loadApprovals(brigadeDir);
+    const count = file.entries.length;
+    if (count === 0) {
+        // Still write — keeps the file present + stat-able for tooling that
+        // checks for it (e.g. doctor's "approvals file: yes/no" line).
+        await saveApprovals(brigadeDir, { version: 1, entries: [] });
+        return 0;
+    }
+    await saveApprovals(brigadeDir, { version: 1, entries: [] });
+    return count;
+}
+/* ─────────────────────────── decide (pure) ─────────────────────────── */
+/**
+ * Pure decider — does NOT read or write the file. Caller passes in the loaded
+ * file so this stays trivially testable and free of I/O. Returns the matching
+ * entry on hit; on miss the caller is expected to prompt the user.
+ *
+ * Match order: walk entries in declaration order, return on the first match.
+ * Specificity (`tool+pattern` vs plain `tool`) is NOT preferred — if a user
+ * has both, the older one wins. That's intentional: the prompt UI should
+ * surface duplicates rather than letting them quietly shadow each other.
+ */
+export function decideApproval(file, params) {
+    const now = params.now ?? new Date();
+    for (const entry of file.entries) {
+        if (isExpired(entry, now))
+            continue;
+        if (entry.scope.kind === "tool" && entry.scope.tool === params.tool) {
+            return { allow: true, matched: entry };
+        }
+        if (entry.scope.kind === "tool+pattern" &&
+            entry.scope.tool === params.tool &&
+            params.args.includes(entry.scope.argsPattern)) {
+            return { allow: true, matched: entry };
+        }
+    }
+    return { allow: false, needsPrompt: true };
+}
+/* ─────────────────────────── pruneExpired ─────────────────────────── */
+/**
+ * Remove every expired entry. Returns the count removed. Safe to call on any
+ * schedule — at boot, on each `brigade auth` command, or as a periodic timer.
+ * Writes the file only when something actually changed (avoids needlessly
+ * touching mtime on every boot).
+ */
+export async function pruneExpired(brigadeDir, now = new Date()) {
+    const file = await loadApprovals(brigadeDir);
+    const before = file.entries.length;
+    file.entries = file.entries.filter((e) => !isExpired(e, now));
+    const removed = before - file.entries.length;
+    if (removed > 0)
+        await saveApprovals(brigadeDir, file);
+    return removed;
+}
+/* ─────────────────────────── sync escape hatch ─────────────────────────── */
+/**
+ * Synchronous best-effort cleanup of a stale `.tmp` file. Not exported — used
+ * internally if a future code path needs to recover from a crashed write
+ * without awaiting. Kept here so the recovery story stays in one file.
+ */
+function _syncCleanupTmp(brigadeDir) {
+    const tmp = tmpFilePath(brigadeDir);
+    if (!existsSync(tmp))
+        return;
+    try {
+        unlinkSync(tmp);
+    }
+    catch {
+        /* swallow — best effort */
+    }
+}
+// Touch unused refs so noUnusedLocals (off today, but might flip on) doesn't
+// flag them. These imports remain available for future sync recovery paths.
+void _syncCleanupTmp;
+void renameSync;
+void writeFileSync;
+//# sourceMappingURL=exec-approvals.js.map