@spinabot/brigade 0.1.1 → 1.0.0

package/dist/security/injection-patterns.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Injection / exfiltration / C2 threat-pattern scanner — the CONTENT-safety layer
+ * for untrusted text that reaches the model (stored memory, recalled facts,
+ * project-context files). Orthogonal to the memory write-gate's PROVENANCE layer:
+ * the gate stops an untrusted SOURCE from authoring the self-model; this catches
+ * an attack PAYLOAD riding a permitted (knowledge) write OR owner-pasted text the
+ * gate can't see by provenance alone. Both layers run; neither replaces the other.
+ *
+ * Three widening scopes — all ⊆ context ⊆ strict:
+ *   all     — classic prompt injection + obvious exfil (scan everywhere).
+ *   context — + role-play/identity hijack + C2/promptware (project-context files).
+ *   strict  — + send-to-URL exfil + persistence + secrets (stored MEMORY uses this).
+ *
+ * Patterns anchor on attack-SPECIFIC vocabulary (override phrases, C2 verbs, exfil
+ * targets) — NOT generic "bossy English" — and tolerate filler words between key
+ * tokens (`(?:\w+\s+)*`) so "ignore all PRIOR instructions" can't slip past a
+ * naive "ignore instructions" match. Deterministic + pure (no I/O, no clock).
+ */
+export type ThreatScope = "all" | "context" | "strict";
+/** All matched threat-pattern ids in `content` at `scope` (+ invisible-unicode). Empty = clean. */
+export declare function scanForThreats(content: string, scope?: ThreatScope): string[];
+/** Human-readable block reason for the FIRST threat hit, or undefined if clean. */
+export declare function firstThreatMessage(content: string, scope?: ThreatScope): string | undefined;
+/** Thrown when a memory WRITE carries an injection/exfil/C2 payload — a CONTENT
+ *  block (distinct from the provenance WriteGateError). Callers that want a clean
+ *  rejection (the write_memory tool) catch it; best-effort writers (extraction,
+ *  reviewers) let it no-op the write (the poisoned text never persists). */
+export declare class MemoryThreatError extends Error {
+    readonly code: "memory:threat";
+    readonly threats: string[];
+    constructor(threats: string[]);
+}
+//# sourceMappingURL=injection-patterns.d.ts.map

package/dist/security/injection-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-patterns.d.ts","sourceRoot":"","sources":["../../src/security/injection-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;AAwDvD,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,WAAsB,GAAG,MAAM,EAAE,CAQvF;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,WAAsB,GAAG,MAAM,GAAG,SAAS,CAGrG;AAED;;;4EAG4E;AAC5E,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACf,OAAO,EAAE,MAAM,EAAE;CAK7B"}

package/dist/security/injection-patterns.js

@@ -0,0 +1,97 @@
+/**
+ * Injection / exfiltration / C2 threat-pattern scanner — the CONTENT-safety layer
+ * for untrusted text that reaches the model (stored memory, recalled facts,
+ * project-context files). Orthogonal to the memory write-gate's PROVENANCE layer:
+ * the gate stops an untrusted SOURCE from authoring the self-model; this catches
+ * an attack PAYLOAD riding a permitted (knowledge) write OR owner-pasted text the
+ * gate can't see by provenance alone. Both layers run; neither replaces the other.
+ *
+ * Three widening scopes — all ⊆ context ⊆ strict:
+ *   all     — classic prompt injection + obvious exfil (scan everywhere).
+ *   context — + role-play/identity hijack + C2/promptware (project-context files).
+ *   strict  — + send-to-URL exfil + persistence + secrets (stored MEMORY uses this).
+ *
+ * Patterns anchor on attack-SPECIFIC vocabulary (override phrases, C2 verbs, exfil
+ * targets) — NOT generic "bossy English" — and tolerate filler words between key
+ * tokens (`(?:\w+\s+)*`) so "ignore all PRIOR instructions" can't slip past a
+ * naive "ignore instructions" match. Deterministic + pure (no I/O, no clock).
+ */
+const PATTERNS = [
+    // ── classic prompt injection (scope: all) ──
+    { re: /ignore\s+(?:\w+\s+)*(?:previous|all|above|prior)\s+(?:\w+\s+)*instructions/i, id: "ignore_instructions", scope: "all" },
+    { re: /system\s+prompt\s+override/i, id: "system_prompt_override", scope: "all" },
+    { re: /disregard\s+(?:\w+\s+)*(?:instructions|rules|guidelines|safety)/i, id: "disregard_rules", scope: "all" },
+    { re: /act\s+as\s+if\s+(?:\w+\s+)*no\s+(?:restrictions|rules|limits)/i, id: "no_restrictions", scope: "all" },
+    { re: /<!--[^>]*(?:ignore|override|system\s+prompt|secret|hidden\s+instruction)[^>]*-->/i, id: "html_comment_injection", scope: "all" },
+    { re: /translate\s+(?:\w+\s+)*and\s+(?:execute|run|eval)/i, id: "translate_and_execute", scope: "all" },
+    { re: /do\s+not\s+(?:tell|inform|mention\s+to)\s+the\s+user/i, id: "do_not_tell_user", scope: "all" },
+    // ── role-play / identity hijack (scope: context) ──
+    { re: /you\s+are\s+(?:\w+\s+)*now\s+(?:a|an|the)\b/i, id: "you_are_now", scope: "context" },
+    { re: /pretend\s+(?:you\s+are|to\s+be)/i, id: "pretend", scope: "context" },
+    { re: /(?:output|reveal|print|repeat)\s+(?:\w+\s+)*(?:system|initial|original)\s+prompt/i, id: "reveal_system_prompt", scope: "context" },
+    { re: /(?:respond|answer|reply)\s+without\s+(?:\w+\s+)*(?:restrictions|filters|safety)/i, id: "respond_without_safety", scope: "context" },
+    { re: /you\s+have\s+been\s+(?:updated|upgraded|patched|reprogrammed)\s+to/i, id: "you_have_been_updated", scope: "context" },
+    // ── C2 / promptware (scope: context) ──
+    { re: /register\s+as\s+a\s+node/i, id: "c2_register_node", scope: "context" },
+    { re: /(?:heartbeat|beacon|check-?in)\s+(?:to|with)\b/i, id: "c2_beacon", scope: "context" },
+    { re: /\bpull\s+(?:\w+\s+)*task(?:ing|s)?\b/i, id: "c2_pull_tasks", scope: "context" },
+    { re: /you\s+must\s+(?:\w+\s+)*(?:register|connect|report|beacon)\b/i, id: "c2_must_connect", scope: "context" },
+    { re: /\b(?:cobalt\s+strike|sliver|havoc|mythic|metasploit)\b/i, id: "c2_framework", scope: "context" },
+    { re: /\bcommand\s+and\s+control\b|\bc2\s+(?:server|channel|node)\b/i, id: "command_and_control", scope: "context" },
+    { re: /\bunset\s+(?:\w+\s+)*(?:BRIGADE|CLAUDE|ANTHROPIC|OPENAI|AGENT)[A-Z_]*/, id: "anti_forensic_unset", scope: "context" },
+    { re: /\bname\s+yourself\s+\w+/i, id: "identity_override", scope: "context" },
+    { re: /never\s+(?:\w+\s+)*(?:create|write)\s+(?:\w+\s+)*(?:script|file)\s+(?:\w+\s+)*disk/i, id: "anti_forensic_disk", scope: "context" },
+    { re: /only\s+use\s+one[\s-]?liners?\b/i, id: "anti_forensic_oneliner", scope: "context" },
+    { re: /connect\s+to\s+the\s+network\b/i, id: "c2_network_connect", scope: "context" },
+    // ── exfiltration ──
+    { re: /(?:curl|wget)\b[^\n]*\$?[A-Za-z_]*(?:KEY|TOKEN|SECRET|PASSWORD)/i, id: "exfil_curl_secret", scope: "all" },
+    { re: /\bcat\b[^\n]*(?:\.env\b|credentials\b|\.netrc\b|\.pgpass\b|\.npmrc\b|\.pypirc\b)/i, id: "exfil_cat_secrets", scope: "all" },
+    { re: /(?:send|post|upload|transmit|exfiltrate)\s+(?:\w+\s+)*to\s+https?:\/\//i, id: "exfil_send_url", scope: "strict" },
+    { re: /(?:include|output|print|share|leak|send|reveal|forward)\s+(?:\w+\s+)*(?:the\s+)?(?:conversation|chat\s+history|full\s+context)/i, id: "exfil_history", scope: "strict" },
+    // ── persistence (scope: strict) ──
+    { re: /authorized_keys|~?\/?\.ssh\b|\.brigade\/\.env/i, id: "persistence_ssh", scope: "strict" },
+    { re: /(?:update|modify|append\s+to|overwrite|write\s+to|edit|change|add\s+to)\s+(?:\w+\s+)*(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerules|SOUL\.md)/i, id: "persistence_context_file", scope: "strict" },
+    // ── hardcoded secret (scope: strict) ──
+    { re: /(?:api[_-]?key|access[_-]?token|secret|password)\s*[:=]\s*["'](?:[^"']{20,}["']|[^"'\s]{20,})/i, id: "hardcoded_secret", scope: "strict" },
+];
+/** Zero-width / BOM / bidi codepoints (a hidden-payload vector). */
+const INVISIBLE_CODEPOINTS = /[​-‍⁠⁢-⁤‪-‮⁦-⁩]/;
+function patternsForScope(scope) {
+    if (scope === "all")
+        return PATTERNS.filter((p) => p.scope === "all");
+    if (scope === "context")
+        return PATTERNS.filter((p) => p.scope !== "strict");
+    return PATTERNS; // strict ⊇ context ⊇ all
+}
+/** All matched threat-pattern ids in `content` at `scope` (+ invisible-unicode). Empty = clean. */
+export function scanForThreats(content, scope = "strict") {
+    if (!content)
+        return [];
+    const out = [];
+    for (const p of patternsForScope(scope)) {
+        if (p.re.test(content))
+            out.push(p.id);
+    }
+    if (INVISIBLE_CODEPOINTS.test(content))
+        out.push("invisible_unicode");
+    return out;
+}
+/** Human-readable block reason for the FIRST threat hit, or undefined if clean. */
+export function firstThreatMessage(content, scope = "strict") {
+    const ids = scanForThreats(content, scope);
+    return ids.length > 0 ? `matched threat pattern(s): ${ids.join(", ")}` : undefined;
+}
+/** Thrown when a memory WRITE carries an injection/exfil/C2 payload — a CONTENT
+ *  block (distinct from the provenance WriteGateError). Callers that want a clean
+ *  rejection (the write_memory tool) catch it; best-effort writers (extraction,
+ *  reviewers) let it no-op the write (the poisoned text never persists). */
+export class MemoryThreatError extends Error {
+    code = "memory:threat";
+    threats;
+    constructor(threats) {
+        super(`memory content matched threat pattern(s): ${threats.join(", ")}`);
+        this.name = "MemoryThreatError";
+        this.threats = threats;
+    }
+}
+//# sourceMappingURL=injection-patterns.js.map

package/dist/security/injection-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-patterns.js","sourceRoot":"","sources":["../../src/security/injection-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAUH,MAAM,QAAQ,GAA6B;IAC1C,8CAA8C;IAC9C,EAAE,EAAE,EAAE,6EAA6E,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE;IAC9H,EAAE,EAAE,EAAE,6BAA6B,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,KAAK,EAAE;IACjF,EAAE,EAAE,EAAE,kEAAkE,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE;IAC/G,EAAE,EAAE,EAAE,gEAAgE,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE;IAC7G,EAAE,EAAE,EAAE,mFAAmF,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,KAAK,EAAE;IACvI,EAAE,EAAE,EAAE,oDAAoD,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,KAAK,EAAE;IACvG,EAAE,EAAE,EAAE,uDAAuD,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE;IACrG,qDAAqD;IACrD,EAAE,EAAE,EAAE,8CAA8C,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE;IAC3F,EAAE,EAAE,EAAE,kCAAkC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;IAC3E,EAAE,EAAE,EAAE,mFAAmF,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE;IACzI,EAAE,EAAE,EAAE,kFAAkF,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC1I,EAAE,EAAE,EAAE,qEAAqE,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC5H,yCAAyC;IACzC,EAAE,EAAE,EAAE,2BAA2B,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC7E,EAAE,EAAE,EAAE,iDAAiD,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE;IAC5F,EAAE,EAAE,EAAE,uCAAuC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE;IACtF,EAAE,EAAE,EAAE,+DAA+D,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE;IAChH,EAAE,EAAE,EAAE,yDAAyD,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE;IACvG,EAAE,EAAE,EAAE,+DAA+D,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IACpH,EAAE,EAAE,EAAE,uEAAuE,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC5H,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC7E,EAAE,EAAE,EAAE,qFAAqF,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE;IACzI,EAAE,EAAE,EAAE,kCAAkC,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC1F,EAAE,EAAE,EAAE,iCAAiC,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE;IACrF,qBAAqB;IACrB,EAAE,EAAE,EAAE,kEAAkE,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE;IACjH,EAAE,EAAE,EAAE,mFAAmF,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE;IAClI,EAAE,EAAE,EAAE,yEAAyE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACxH,EAAE,EAAE,EAAE,iIAAiI,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC/K,oCAAoC;IACpC,EAAE,EAAE,EAAE,gDAAgD,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAChG,EAAE,EAAE,EAAE,qJAAqJ,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9M,yCAAyC;IACzC,EAAE,EAAE,EAAE,gGAAgG,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;CACjJ,CAAC;AAEF,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD,SAAS,gBAAgB,CAAC,KAAkB;IAC3C,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC,CAAC,yBAAyB;AAC3C,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,QAAqB,QAAQ;IAC5E,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,QAAqB,QAAQ;IAChF,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;4EAG4E;AAC5E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAClC,IAAI,GAAG,eAAwB,CAAC;IAChC,OAAO,CAAW;IAC3B,YAAY,OAAiB;QAC5B,KAAK,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD"}

package/dist/security/media-path-guard.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Outbound media-path guard — refuse to ATTACH a local file that is a secret or
+ * a system file. A channel `sendMedia` takes a local path and uploads its bytes
+ * to the conversation; without this guard a prompt-injected "send the file at
+ * ~/.ssh/id_rsa" (or Brigade's own `~/.brigade/brigade.json` / sealed auth) would
+ * exfiltrate credentials to whoever the agent is talking to. This is the
+ * CONTENT-exfil sibling of the SSRF fetch guard (which protects inbound URLs).
+ *
+ * Posture = denylist, always-on, low false-positive: remote URLs and data URIs
+ * pass (they aren't local-file reads; outbound fetch SSRF is handled elsewhere);
+ * legitimate generated media under temp/cache/workspace passes; only known
+ * secret/system targets are refused. Symlinks are resolved first so an
+ * innocent-looking name can't smuggle a denied target.
+ */
+export interface MediaPathVerdict {
+    ok: boolean;
+    /** Non-sensitive reason (safe to surface to the agent / log — no full path leak). */
+    reason?: string;
+}
+/**
+ * Decide whether `rawPath` is safe to upload as an outbound attachment.
+ * Never throws — returns a verdict the caller surfaces/throws.
+ */
+export declare function validateOutboundMediaPath(rawPath: string): MediaPathVerdict;
+//# sourceMappingURL=media-path-guard.d.ts.map

package/dist/security/media-path-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-path-guard.d.ts","sourceRoot":"","sources":["../../src/security/media-path-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAoCD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAyC3E"}

package/dist/security/media-path-guard.js

@@ -0,0 +1,98 @@
+/**
+ * Outbound media-path guard — refuse to ATTACH a local file that is a secret or
+ * a system file. A channel `sendMedia` takes a local path and uploads its bytes
+ * to the conversation; without this guard a prompt-injected "send the file at
+ * ~/.ssh/id_rsa" (or Brigade's own `~/.brigade/brigade.json` / sealed auth) would
+ * exfiltrate credentials to whoever the agent is talking to. This is the
+ * CONTENT-exfil sibling of the SSRF fetch guard (which protects inbound URLs).
+ *
+ * Posture = denylist, always-on, low false-positive: remote URLs and data URIs
+ * pass (they aren't local-file reads; outbound fetch SSRF is handled elsewhere);
+ * legitimate generated media under temp/cache/workspace passes; only known
+ * secret/system targets are refused. Symlinks are resolved first so an
+ * innocent-looking name can't smuggle a denied target.
+ */
+import fs from "node:fs";
+import path from "node:path";
+/** Basenames that are never legitimate as an outbound attachment (matched case-insensitively). */
+const SENSITIVE_BASENAMES = new Set([
+    ".env",
+    ".netrc",
+    ".pgpass",
+    ".npmrc",
+    ".git-credentials",
+    "credentials",
+    "id_rsa",
+    "id_ed25519",
+    "id_ecdsa",
+    "id_dsa",
+    // Brigade's own secret/config store
+    "brigade.json",
+    "auth.json",
+    "auth-profiles.json",
+    "models.json",
+    "exec-approvals.json",
+]);
+/** Path fragments that mark a credentials directory (platform-normalized separators). */
+const SENSITIVE_DIR_NAMES = [".ssh", ".aws", ".gnupg", ".kube", ".docker", "gcloud"];
+/** Resolved-prefix roots that are off-limits regardless of filename. */
+function systemRoots() {
+    if (process.platform === "win32") {
+        const roots = [];
+        if (process.env.SystemRoot)
+            roots.push(process.env.SystemRoot);
+        else
+            roots.push("C:\\Windows");
+        return roots;
+    }
+    return ["/etc", "/proc", "/sys", "/dev", "/boot", "/root"];
+}
+/**
+ * Decide whether `rawPath` is safe to upload as an outbound attachment.
+ * Never throws — returns a verdict the caller surfaces/throws.
+ */
+export function validateOutboundMediaPath(rawPath) {
+    if (!rawPath || typeof rawPath !== "string")
+        return { ok: false, reason: "empty media path" };
+    // Remote URLs / data URIs are not local-file reads — allow (SSRF on the fetch
+    // is a separate concern of the fetch guard); this guard targets local exfil.
+    if (/^(https?:|data:)/i.test(rawPath))
+        return { ok: true };
+    // Resolve to an absolute, symlink-free path so a symlink named photo.jpg that
+    // points at /etc/shadow can't slip through. If the file doesn't exist yet,
+    // check the intended absolute path (the upload would fail anyway, but we still
+    // refuse a sensitive target).
+    let resolved;
+    try {
+        resolved = fs.realpathSync(path.resolve(rawPath));
+    }
+    catch {
+        resolved = path.resolve(rawPath);
+    }
+    const lower = resolved.toLowerCase();
+    const base = path.basename(resolved).toLowerCase();
+    // Match the dotenv family by prefix (.env, .env.local, .env.production, …)
+    // rather than enumerating every suffix — those suffixed files are the standard
+    // secret stores and are not legitimate media attachments.
+    if (base === ".env" || base.startsWith(".env.") || SENSITIVE_BASENAMES.has(base)) {
+        return { ok: false, reason: `refusing to attach a sensitive file (${base})` };
+    }
+    const segments = lower.split(/[\\/]+/);
+    for (const dir of SENSITIVE_DIR_NAMES) {
+        if (segments.includes(dir))
+            return { ok: false, reason: "refusing to attach from a credentials directory" };
+    }
+    for (const root of systemRoots()) {
+        const r = root.toLowerCase();
+        if (lower === r || lower.startsWith(r + path.sep)) {
+            return { ok: false, reason: "refusing to attach a system file" };
+        }
+    }
+    // Brigade's sealed per-agent auth subtree (…/agents/<id>/agent/…) and any
+    // auth* file under a .brigade dir — denied regardless of basename.
+    if (/[\\/]agents[\\/][^\\/]+[\\/]agent[\\/]/.test(resolved) || /[\\/]\.brigade[\\/].*auth/i.test(resolved)) {
+        return { ok: false, reason: "refusing to attach from the credential store" };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=media-path-guard.js.map

package/dist/security/media-path-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-path-guard.js","sourceRoot":"","sources":["../../src/security/media-path-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,oCAAoC;IACpC,cAAc;IACd,WAAW;IACX,oBAAoB;IACpB,aAAa;IACb,qBAAqB;CACrB,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAErF,wEAAwE;AACxE,SAAS,WAAW;IACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;;YAC1D,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACxD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC9F,8EAA8E;IAC9E,6EAA6E;IAC7E,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE3D,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,8BAA8B;IAC9B,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,2EAA2E;IAC3E,+EAA+E;IAC/E,0DAA0D;IAC1D,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,IAAI,GAAG,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAClE,CAAC;IACF,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,wCAAwC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC"}

package/dist/security/terminal-input-sanitizer.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Terminal input sanitizer — scrub hostile/garbled control bytes from user input
+ * BEFORE it reaches the transcript, the model payload, or the terminal echo.
+ *
+ * Two threats this closes:
+ *  - TERMINAL-ESCAPE INJECTION: pasted text (or text the agent is told to copy
+ *    from a malicious page) can carry ANSI escape sequences — cursor moves, OSC
+ *    title/clipboard sets, screen clears — that corrupt the operator's terminal
+ *    when echoed, and pollute the transcript/model payload. ESC (0x1B) never
+ *    legitimately appears in typed prose, so stripping all escape sequences is
+ *    safe and high-value.
+ *  - LEAKED BRACKETED-PASTE markers: when a terminal's bracketed-paste parse
+ *    tears (SSH glitch, sleep/wake, multiplexer tab switch), the ESC[200~ /
+ *    ESC[201~ wrappers — and degraded ^[[200~ / [200~ fragments — leak as
+ *    literal text into the buffer. And lone UTF-16 surrogates (from rich-text
+ *    clipboard paste) crash JSON serialization in some provider SDKs.
+ *
+ * Pure + deterministic. Outbound message surrogate-sanitization already exists
+ * (`sanitize-surrogates.ts`); this is the INPUT-side complement the TUI lacked.
+ */
+/**
+ * Strip terminal control bytes + leaked paste markers + lone surrogates from a
+ * line of user input. Returns the cleaned text (idempotent). Leaves all ordinary
+ * printable text — including newlines, tabs, emoji, and CJK — untouched.
+ */
+export declare function sanitizeTerminalInput(text: string): string;
+/** True if `text` carries anything `sanitizeTerminalInput` would strip — lets a
+ *  caller log/flag a hostile paste without recomputing. */
+export declare function hasTerminalControlBytes(text: string): boolean;
+//# sourceMappingURL=terminal-input-sanitizer.d.ts.map

package/dist/security/terminal-input-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-input-sanitizer.d.ts","sourceRoot":"","sources":["../../src/security/terminal-input-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA8BH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW1D;AAED;2DAC2D;AAC3D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/security/terminal-input-sanitizer.js

@@ -0,0 +1,70 @@
+/**
+ * Terminal input sanitizer — scrub hostile/garbled control bytes from user input
+ * BEFORE it reaches the transcript, the model payload, or the terminal echo.
+ *
+ * Two threats this closes:
+ *  - TERMINAL-ESCAPE INJECTION: pasted text (or text the agent is told to copy
+ *    from a malicious page) can carry ANSI escape sequences — cursor moves, OSC
+ *    title/clipboard sets, screen clears — that corrupt the operator's terminal
+ *    when echoed, and pollute the transcript/model payload. ESC (0x1B) never
+ *    legitimately appears in typed prose, so stripping all escape sequences is
+ *    safe and high-value.
+ *  - LEAKED BRACKETED-PASTE markers: when a terminal's bracketed-paste parse
+ *    tears (SSH glitch, sleep/wake, multiplexer tab switch), the ESC[200~ /
+ *    ESC[201~ wrappers — and degraded ^[[200~ / [200~ fragments — leak as
+ *    literal text into the buffer. And lone UTF-16 surrogates (from rich-text
+ *    clipboard paste) crash JSON serialization in some provider SDKs.
+ *
+ * Pure + deterministic. Outbound message surrogate-sanitization already exists
+ * (`sanitize-surrogates.ts`); this is the INPUT-side complement the TUI lacked.
+ */
+// CSI sequences: ESC [ <params> <intermediates> <final 0x40-0x7E>. Covers
+// cursor-position reports (DSR/CPR ESC[…R), SGR mouse reports (ESC[<…M/m),
+// device attributes, screen clears, AND the bracketed-paste markers ESC[200~ /
+// ESC[201~ (~ is a valid final byte).
+const CSI_SEQUENCE = /\x1b\[[0-9;?<>=!"']*[ -\/]*[@-~]/g;
+// OSC sequences: ESC ] … (BEL | ST). These set window title / clipboard (OSC 52!)
+// and must never ride in from pasted text.
+const OSC_SEQUENCE = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
+// Degraded bracketed-paste markers that arrive as LITERAL text (ESC already lost).
+// Boundary-anchored so we don't eat prose/code that merely embeds the digits —
+// e.g. "200~300", "x[200~210]", "list[201~]end" stay intact. The OPEN marker
+// ([200~ / ^[[200~) is stripped only at start-of-string or after whitespace/
+// bracket/quote; the CLOSE marker ([201~ / ^[[201~) only at end-of-string or
+// before whitespace. The canonical ESC-wrapped form stays owned by CSI_SEQUENCE.
+const LEAKED_PASTE_OPEN = /(^|[\s\[\]"'`(){}])\^?\[\[?200~/g;
+const LEAKED_PASTE_CLOSE = /\^?\[\[?201~(?=$|\s)/g;
+// Caret-notation forms of the cursor/mouse reports CSI_SEQUENCE catches, for the
+// SAME defense-in-depth reason the leaked-paste caret form is stripped: a torn
+// terminal can surface CPR/DSR (^[[<row>;<col>R) and SGR mouse (^[[<…M/m) as
+// literal caret text. Numeric-anchored so ordinary prose like "^[[0m" is left be.
+const CARET_CPR = /\^\[\[\d+;\d+R/g;
+const CARET_SGR_MOUSE = /\^\[\[<\d+;\d+;\d+[Mm]/g;
+/** Replace a lone UTF-16 surrogate (not part of a valid pair) with U+FFFD. */
+function replaceLoneSurrogates(text) {
+    return text.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "�");
+}
+/**
+ * Strip terminal control bytes + leaked paste markers + lone surrogates from a
+ * line of user input. Returns the cleaned text (idempotent). Leaves all ordinary
+ * printable text — including newlines, tabs, emoji, and CJK — untouched.
+ */
+export function sanitizeTerminalInput(text) {
+    if (!text)
+        return text;
+    let out = text.replace(CSI_SEQUENCE, "").replace(OSC_SEQUENCE, "");
+    out = out.replace(LEAKED_PASTE_OPEN, "$1").replace(LEAKED_PASTE_CLOSE, "");
+    // Caret-notation leaks (CPR/DSR + SGR mouse) — consistency with the leaked
+    // paste caret handling above; applied before the lone-ESC strip below.
+    out = out.replace(CARET_CPR, "").replace(CARET_SGR_MOUSE, "");
+    // Any malformed/standalone ESC bytes left after sequence removal.
+    out = out.replace(/\x1b/g, "");
+    out = replaceLoneSurrogates(out);
+    return out;
+}
+/** True if `text` carries anything `sanitizeTerminalInput` would strip — lets a
+ *  caller log/flag a hostile paste without recomputing. */
+export function hasTerminalControlBytes(text) {
+    return text !== sanitizeTerminalInput(text);
+}
+//# sourceMappingURL=terminal-input-sanitizer.js.map

package/dist/security/terminal-input-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-input-sanitizer.js","sourceRoot":"","sources":["../../src/security/terminal-input-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,sCAAsC;AACtC,MAAM,YAAY,GAAG,mCAAmC,CAAC;AACzD,kFAAkF;AAClF,2CAA2C;AAC3C,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,mFAAmF;AACnF,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAC7D,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,kFAAkF;AAClF,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAElD,8EAA8E;AAC9E,SAAS,qBAAqB,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,yEAAyE,EAAE,GAAG,CAAC,CAAC;AACrG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACnE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC9D,kEAAkE;IAClE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/B,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,uBAAuB,CAAC,IAAY;IACnD,OAAO,IAAI,KAAK,qBAAqB,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC"}

package/dist/sessions/bootstrap-marker.d.ts

@@ -0,0 +1,5 @@
+import type { SessionManager } from "@mariozechner/pi-coding-agent";
+export declare const BRIGADE_BOOTSTRAP_DELIVERED_CUSTOM_TYPE = "brigade:bootstrap-context:delivered";
+export declare function hasDeliveredBootstrapToSession(transcriptPath: string): Promise<boolean>;
+export declare function markBootstrapDeliveredToSession(sessionManager: SessionManager): void;
+//# sourceMappingURL=bootstrap-marker.d.ts.map

package/dist/sessions/bootstrap-marker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-marker.d.ts","sourceRoot":"","sources":["../../src/sessions/bootstrap-marker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAsBpE,eAAO,MAAM,uCAAuC,wCACb,CAAC;AAcxC,wBAAsB,8BAA8B,CAClD,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CA+DlB;AASD,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,cAAc,GAC7B,IAAI,CAaN"}

package/dist/sessions/bootstrap-marker.js

@@ -0,0 +1,120 @@
+import fs from "node:fs/promises";
+// Per-session marker that the bootstrap context (workspace persona files +
+// any first-turn guidance) has been delivered into the model's context.
+//
+// Why this exists in addition to the workspace-level lifecycle marker:
+//
+//   workspace-state.json (`bootstrapSeededAt` / `setupCompletedAt`)
+//     Tracks the workspace's first-run lifecycle: did onboard write
+//     BOOTSTRAP.md, and has the user/agent consumed it. Workspace-scoped.
+//
+//   <session>.jsonl custom event (this file)
+//     Tracks per-session "have we delivered the full bootstrap context
+//     to *this* session yet?" Session-scoped. Lets sub-agents and
+//     post-compaction sessions correctly re-emit the first-turn nudge
+//     when they need it, even though the workspace has long since
+//     completed setup.
+//
+// The reference codebase carries the same two-layer pattern. Brigade
+// adopts it so future sub-agent and compaction layers don't have to
+// re-plumb through the agent kernel.
+export const BRIGADE_BOOTSTRAP_DELIVERED_CUSTOM_TYPE = "brigade:bootstrap-context:delivered";
+// Bound the tail scan so a long-running session's JSONL doesn't force a
+// multi-megabyte read on every turn. 256 KiB / 500 records is more than
+// enough to cover the most-recent bootstrap delivery + any compaction
+// events that would invalidate it.
+const TAIL_SCAN_MAX_BYTES = 256 * 1024;
+const TAIL_SCAN_MAX_RECORDS = 500;
+// Returns true when the bootstrap context has already been delivered to
+// this session and a compaction has not occurred since. A compaction
+// after the delivery is treated as invalidation because the bootstrap
+// content has likely been compacted out of the model's working context;
+// the next turn should re-deliver.
+export async function hasDeliveredBootstrapToSession(transcriptPath) {
+    let stat;
+    try {
+        stat = await fs.lstat(transcriptPath);
+    }
+    catch {
+        return false;
+    }
+    // Refuse to follow symlinks — defending against a workspace-write
+    // path that points outside the agent dir.
+    if (stat.isSymbolicLink())
+        return false;
+    if (!stat.isFile() || stat.size === 0)
+        return false;
+    const handle = await fs.open(transcriptPath, "r");
+    try {
+        const bytesToRead = Math.min(stat.size, TAIL_SCAN_MAX_BYTES);
+        const buffer = Buffer.allocUnsafe(bytesToRead);
+        const offset = stat.size - bytesToRead;
+        const { bytesRead } = await handle.read(buffer, 0, bytesToRead, offset);
+        let text = buffer.toString("utf8", 0, bytesRead);
+        // If we sliced into the middle of a line, drop the partial leading line.
+        if (offset > 0) {
+            const firstNewline = text.indexOf("\n");
+            if (firstNewline < 0)
+                return false;
+            text = text.slice(firstNewline + 1);
+        }
+        const records = text
+            .split(/\r?\n/u)
+            .filter((line) => line.trim().length > 0)
+            .slice(-TAIL_SCAN_MAX_RECORDS);
+        // Walk backwards: a `compaction` record encountered before we find
+        // the marker means the marker (if any) has been compacted away —
+        // treat as not-delivered. Finding the marker first means delivered
+        // and still valid.
+        let compactionAfterDelivery = false;
+        for (let i = records.length - 1; i >= 0; i--) {
+            const line = records[i];
+            if (!line)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (entry?.type === "compaction") {
+                compactionAfterDelivery = true;
+                continue;
+            }
+            if (entry?.type === "custom" &&
+                entry.customType === BRIGADE_BOOTSTRAP_DELIVERED_CUSTOM_TYPE) {
+                return !compactionAfterDelivery;
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        await handle.close();
+    }
+}
+// Emit the marker into the session JSONL via Pi's SessionManager. Called
+// after a successful turn that delivered the full bootstrap context, so
+// the next turn (or sub-agent fork) can short-circuit re-injection.
+//
+// Pi's `appendCustomEntry(customType, data)` writes a `{type:"custom",
+// customType, data, ...}` record to the JSONL. Best-effort: any error is
+// swallowed because the marker is observability, not correctness.
+export function markBootstrapDeliveredToSession(sessionManager) {
+    try {
+        const sm = sessionManager;
+        if (typeof sm.appendCustomEntry !== "function")
+            return;
+        sm.appendCustomEntry(BRIGADE_BOOTSTRAP_DELIVERED_CUSTOM_TYPE, {
+            timestamp: new Date().toISOString(),
+        });
+    }
+    catch {
+        // Marker is observability — never block a successful turn because
+        // the marker write itself errored.
+    }
+}
+//# sourceMappingURL=bootstrap-marker.js.map

package/dist/sessions/bootstrap-marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-marker.js","sourceRoot":"","sources":["../../src/sessions/bootstrap-marker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGlC,2EAA2E;AAC3E,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,0EAA0E;AAC1E,EAAE;AACF,6CAA6C;AAC7C,uEAAuE;AACvE,kEAAkE;AAClE,sEAAsE;AACtE,kEAAkE;AAClE,uBAAuB;AACvB,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,qCAAqC;AAErC,MAAM,CAAC,MAAM,uCAAuC,GAClD,qCAAqC,CAAC;AAExC,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,mCAAmC;AACnC,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AACvC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,cAAsB;IAEtB,IAAI,IAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,kEAAkE;IAClE,0CAA0C;IAC1C,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACvC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAEjD,yEAAyE;QACzE,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,YAAY,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI;aACjB,KAAK,CAAC,QAAQ,CAAC;aACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aACxC,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAEjC,mEAAmE;QACnE,iEAAiE;QACjE,mEAAmE;QACnE,mBAAmB;QACnB,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,KAAoD,CAAC;YACzD,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2C,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,KAAK,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IACE,KAAK,EAAE,IAAI,KAAK,QAAQ;gBACxB,KAAK,CAAC,UAAU,KAAK,uCAAuC,EAC5D,CAAC;gBACD,OAAO,CAAC,uBAAuB,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,wEAAwE;AACxE,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,kEAAkE;AAClE,MAAM,UAAU,+BAA+B,CAC7C,cAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,cAEV,CAAC;QACF,IAAI,OAAO,EAAE,CAAC,iBAAiB,KAAK,UAAU;YAAE,OAAO;QACvD,EAAE,CAAC,iBAAiB,CAAC,uCAAuC,EAAE;YAC5D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,mCAAmC;IACrC,CAAC;AACH,CAAC"}

package/dist/sessions/session-file-repair.d.ts

@@ -0,0 +1,12 @@
+export interface RepairReport {
+    repaired: boolean;
+    droppedLines: number;
+    backupPath?: string;
+    reason?: string;
+}
+export interface RepairArgs {
+    sessionFile: string;
+    warn?: (message: string) => void;
+}
+export declare function repairSessionFileIfNeeded(args: RepairArgs): Promise<RepairReport>;
+//# sourceMappingURL=session-file-repair.d.ts.map

package/dist/sessions/session-file-repair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-file-repair.d.ts","sourceRoot":"","sources":["../../src/sessions/session-file-repair.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAID,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CA2HvF"}