@spinabot/brigade 0.1.2 → 1.0.0

package/package.json

@@ -1,91 +1,196 @@
 {
   "name": "@spinabot/brigade",
-  "version": "0.1.2",
-  "type": "module",
-  "description": "Brigade — your personal AI crew. Polished terminal CLI for Anthropic, OpenAI, Gemini, Groq, xAI, DeepSeek, Mistral, OpenRouter, Cerebras, Ollama and any OpenAI-compatible endpoint. Built on the Pi SDK.",
+  "version": "1.0.0",
+  "description": "Brigade — your personal AI crew",
+  "homepage": "https://brigade-agent.ai",
+  "author": "Spinabot",
   "license": "MIT",
-  "author": "Bhasvanth Dev",
-  "homepage": "https://github.com/Bhasvanth-Dev9380/brigade#readme",
-  "bugs": {
-    "url": "https://github.com/Bhasvanth-Dev9380/brigade/issues"
-  },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Bhasvanth-Dev9380/brigade.git"
+    "url": "git+https://github.com/spinabot/brigade.git"
   },
-  "engines": {
-    "node": ">=20.0.0"
+  "bugs": {
+    "url": "https://github.com/spinabot/brigade/issues"
   },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
   "bin": {
-    "brigade": "brigade.mjs"
+    "brigade": "./brigade.mjs"
+  },
+  "main": "dist/entry.js",
+  "exports": {
+    ".": "./brigade.mjs",
+    "./extension-sdk": {
+      "types": "./dist/extension-sdk.d.ts",
+      "import": "./dist/extension-sdk.js"
+    },
+    "./package.json": "./package.json"
   },
-  "main": "./dist/index.js",
   "files": [
     "brigade.mjs",
-    "dist",
-    "!dist/**/*.map",
+    "scripts/run-brigade.mjs",
+    "scripts/build-done.mjs",
+    "dist/**/*",
+    "templates/**/*",
+    "skills/**/*",
     "README.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "SECURITY.md",
-    "assets/brigade-wordmark.png"
+    "LICENSE"
   ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "postbuild": "node scripts/build-done.mjs",
+    "build:watch": "tsc -p tsconfig.build.json --watch",
+    "clean": "node -e \"import('node:fs').then(fs => fs.rmSync('dist', { recursive: true, force: true }))\"",
+    "prepack": "npm run build",
+    "test": "node scripts/run-tests.mjs",
+    "bench": "npx tsx --test src/agents/memory/eval/comparison.test.ts src/agents/memory/eval/gold-hard.test.ts src/agents/memory/eval/gold-parity.test.ts src/agents/memory/eval/asr-bench.test.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "brigade": "node brigade.mjs",
+    "start": "node scripts/run-brigade.mjs",
+    "dev": "node scripts/run-brigade.mjs",
+    "dev:tsx": "tsx src/entry.ts",
+    "watch": "tsx --watch src/entry.ts",
+    "onboard": "node scripts/run-brigade.mjs onboard",
+    "onboard:bin": "node brigade.mjs onboard",
+    "onboard:watch": "tsx --watch src/entry.ts onboard",
+    "agent": "node scripts/run-brigade.mjs agent",
+    "agent:bin": "node brigade.mjs agent",
+    "agent:watch": "tsx --watch src/entry.ts agent",
+    "agents": "node scripts/run-brigade.mjs agents",
+    "agents:bin": "node brigade.mjs agents",
+    "agents:list": "node scripts/run-brigade.mjs agents list",
+    "agents:bindings": "node scripts/run-brigade.mjs agents bindings",
+    "agents:bind": "node scripts/run-brigade.mjs agents bind",
+    "agents:unbind": "node scripts/run-brigade.mjs agents unbind",
+    "agents:add": "node scripts/run-brigade.mjs agents add",
+    "agents:set-identity": "node scripts/run-brigade.mjs agents set-identity",
+    "agents:delete": "node scripts/run-brigade.mjs agents delete",
+    "tui": "node scripts/run-brigade.mjs tui",
+    "tui:bin": "node brigade.mjs tui",
+    "tui:watch": "tsx --watch src/entry.ts tui",
+    "gateway": "node scripts/run-brigade.mjs gateway",
+    "gateway:bin": "node brigade.mjs gateway",
+    "gateway:watch": "tsx --watch src/entry.ts gateway",
+    "gateway:status": "node scripts/run-brigade.mjs gateway status",
+    "gateway:stop": "node scripts/run-brigade.mjs gateway stop",
+    "connect": "node scripts/run-brigade.mjs connect",
+    "connect:bin": "node brigade.mjs connect",
+    "connect:watch": "tsx --watch src/entry.ts connect",
+    "status": "node scripts/run-brigade.mjs status",
+    "status:bin": "node brigade.mjs status",
+    "status:json": "node scripts/run-brigade.mjs status --json",
+    "doctor": "node scripts/run-brigade.mjs doctor",
+    "doctor:bin": "node brigade.mjs doctor",
+    "doctor:json": "node scripts/run-brigade.mjs doctor --json",
+    "doctor:strict": "node scripts/run-brigade.mjs doctor --strict",
+    "config:list": "node scripts/run-brigade.mjs config list",
+    "config:file": "node scripts/run-brigade.mjs config file",
+    "config:schema": "node scripts/run-brigade.mjs config schema",
+    "config:validate": "node scripts/run-brigade.mjs config validate",
+    "channels": "node scripts/run-brigade.mjs channels",
+    "channels:list": "node scripts/run-brigade.mjs channels list",
+    "channels:status": "node scripts/run-brigade.mjs channels status --channel whatsapp",
+    "channels:link": "node scripts/run-brigade.mjs channels link --channel whatsapp",
+    "channels:unlink": "node scripts/run-brigade.mjs channels unlink --channel whatsapp",
+    "channels:enable": "node scripts/run-brigade.mjs channels enable --channel whatsapp",
+    "channels:disable": "node scripts/run-brigade.mjs channels disable --channel whatsapp",
+    "channels:allow": "node scripts/run-brigade.mjs channels allow list --channel whatsapp",
+    "channels:allow:add": "node scripts/run-brigade.mjs channels allow add --channel whatsapp",
+    "channels:allow:remove": "node scripts/run-brigade.mjs channels allow remove --channel whatsapp",
+    "channels:add": "node scripts/run-brigade.mjs channels add",
+    "wa": "node scripts/run-brigade.mjs channels status --channel whatsapp",
+    "wa:link": "node scripts/run-brigade.mjs channels link --channel whatsapp",
+    "wa:unlink": "node scripts/run-brigade.mjs channels unlink --channel whatsapp",
+    "wa:status": "node scripts/run-brigade.mjs channels status --channel whatsapp",
+    "wa:allow": "node scripts/run-brigade.mjs channels allow list --channel whatsapp",
+    "pairing": "node scripts/run-brigade.mjs pairing list --channel whatsapp",
+    "pairing:list": "node scripts/run-brigade.mjs pairing list --channel whatsapp",
+    "pairing:approve": "node scripts/run-brigade.mjs pairing approve --channel whatsapp",
+    "pairing:revoke": "node scripts/run-brigade.mjs pairing revoke --channel whatsapp",
+    "backup": "node scripts/run-brigade.mjs backup create",
+    "backup:create": "node scripts/run-brigade.mjs backup create",
+    "backup:verify": "node scripts/run-brigade.mjs backup verify",
+    "backup:restore": "node scripts/run-brigade.mjs backup restore",
+    "gateway:install": "node scripts/run-brigade.mjs gateway install",
+    "gateway:uninstall": "node scripts/run-brigade.mjs gateway uninstall",
+    "gateway:restart": "node scripts/run-brigade.mjs gateway restart",
+    "sessions": "node scripts/run-brigade.mjs sessions list",
+    "sessions:list": "node scripts/run-brigade.mjs sessions list",
+    "sessions:cleanup": "node scripts/run-brigade.mjs sessions cleanup",
+    "skills": "node scripts/run-brigade.mjs skills list",
+    "skills:list": "node scripts/run-brigade.mjs skills list",
+    "skills:info": "node scripts/run-brigade.mjs skills info",
+    "logs": "node scripts/run-brigade.mjs logs",
+    "logs:follow": "node scripts/run-brigade.mjs logs --follow",
+    "secrets:audit": "node scripts/run-brigade.mjs secrets audit",
+    "exec:list": "node scripts/run-brigade.mjs exec list",
+    "store:mode": "node scripts/run-brigade.mjs store mode show",
+    "store:mode:show": "node scripts/run-brigade.mjs store mode show",
+    "store:mode:set": "node scripts/run-brigade.mjs store mode set",
+    "convex:install": "node scripts/install-convex.mjs",
+    "convex:dev": "node scripts/install-convex.mjs && node scripts/convex-dev.mjs",
+    "convex:codegen": "convex codegen --admin-key \"$(node -e \"process.stdout.write(require('node:fs').readFileSync('.convex-data/admin-key.txt', 'utf8').trim())\")\" --url http://127.0.0.1:3210",
+    "smoke:strict-zero": "tsx scripts/strict-zero-smoke.mjs",
+    "convex:push": "node scripts/convex-push.mjs",
+    "store": "node scripts/run-brigade.mjs store",
+    "store:reset": "node scripts/run-brigade.mjs store reset",
+    "store:reset:purge": "node scripts/run-brigade.mjs store reset --purge-local",
+    "store:migrate": "node scripts/run-brigade.mjs store migrate"
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "dependencies": {
+    "@composio/core": "^0.10.0",
+    "@mariozechner/pi-coding-agent": "0.73.1",
+    "@mariozechner/pi-tui": "0.73.1",
+    "@mozilla/readability": "^0.6.0",
+    "@whiskeysockets/baileys": "7.0.0-rc.9",
+    "cfonts": "^3.3.1",
+    "chalk": "^5.3.0",
+    "cli-highlight": "^2.1.11",
+    "commander": "^12.1.0",
+    "convex": "^1.40.0",
+    "croner": "^10.0.1",
+    "json5": "^2.2.3",
+    "linkedom": "^0.18.12",
+    "minimatch": "^10.2.5",
+    "playwright-core": "^1.59.0",
+    "prompts": "^2.4.2",
+    "proper-lockfile": "^4.1.2",
+    "qrcode-terminal": "^0.12.0",
+    "tar": "^7.5.15",
+    "undici": "^7.25.0",
+    "ws": "^8.20.0",
+    "yaml": "^2.9.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "@types/prompts": "^2.4.9",
+    "@types/proper-lockfile": "^4.1.4",
+    "@types/qrcode-terminal": "^0.12.2",
+    "@types/tar": "^6.1.13",
+    "@types/ws": "^8.18.1",
+    "tsx": "^4.20.0",
+    "typescript": "^5.6.3"
+  },
   "keywords": [
     "ai",
+    "agent",
+    "agents",
+    "ai-agent",
     "cli",
     "tui",
     "llm",
-    "chat",
-    "agent",
-    "anthropic",
     "claude",
     "openai",
-    "gpt",
     "gemini",
     "ollama",
-    "openrouter",
-    "groq",
-    "xai",
-    "deepseek",
-    "mistral",
-    "cerebras",
-    "pi-sdk"
-  ],
-  "scripts": {
-    "dev": "tsx src/cli.ts",
-    "chat": "tsx src/cli.ts chat",
-    "gateway": "tsx src/cli.ts gateway",
-    "connect": "tsx src/cli.ts connect",
-    "doctor": "tsx src/cli.ts doctor",
-    "onboard": "tsx src/cli.ts onboard",
-    "build": "tsc -p tsconfig.json",
-    "start": "node dist/cli.js",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "format": "biome format --write .",
-    "gen:wordmark": "node scripts/gen-wordmark-svg.mjs",
-    "prepublishOnly": "npm run build",
-    "prepack": "node scripts/prepack.mjs"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "@mariozechner/pi-agent-core": "0.70.6",
-    "@mariozechner/pi-ai": "0.70.6",
-    "@mariozechner/pi-coding-agent": "0.70.6",
-    "@mariozechner/pi-tui": "0.70.6",
-    "@types/ws": "^8.18.1",
-    "cfonts": "^3.3.1",
-    "chalk": "^5.3.0",
-    "ws": "^8.20.0"
-  },
-  "devDependencies": {
-    "@biomejs/biome": "^1.9.4",
-    "@types/node": "^22.7.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0",
-    "vitest": "^2.1.0"
-  }
+    "whatsapp",
+    "gateway",
+    "brigade"
+  ]
 }

package/scripts/build-done.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+/**
+ * Postbuild step. Two jobs, both after a successful `tsc` (which prints
+ * nothing on success), wired via the `postbuild` npm lifecycle hook:
+ *
+ *   1. Write a BUILD STAMP — `dist/buildstamp.json = { builtAt, head }` (git
+ *      commit + timestamp). The runtime reads it (see `src/version.ts`) so
+ *      `brigade --version` and the gateway boot banner report the EXACT build
+ *      that's running. Brigade uses a non-dot filename
+ *      (`dist/buildstamp.json`) so it's reliably included by the
+ *      `files: ["dist/**\/*"]` package glob.
+ *   2. Print a gold "Build complete" banner pointing at what to run next.
+ *
+ * Cosmetic/best-effort — wrapped so it can NEVER fail the build, and
+ * colour-aware (chalk auto-disables on non-TTY / NO_COLOR).
+ */
+
+import { spawnSync } from "node:child_process";
+import {
+	copyFileSync,
+	existsSync,
+	mkdirSync,
+	readdirSync,
+	writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+
+import chalk from "chalk";
+
+const GOLD = "#fbbf24"; // Brigade amber — matches src/ui/theme.ts
+
+/** Current git commit, or null outside a repo / when git is unavailable. */
+function gitHead() {
+	try {
+		const r = spawnSync("git", ["rev-parse", "HEAD"], {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "ignore"],
+		});
+		if (r.status !== 0) return null;
+		return (r.stdout ?? "").trim() || null;
+	} catch {
+		return null;
+	}
+}
+
+/** Count compiled .js files in dist/ as a light "what got built" signal. */
+function countJs(dir) {
+	let n = 0;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return 0;
+	}
+	for (const e of entries) {
+		if (e.isDirectory()) n += countJs(join(dir, e.name));
+		else if (e.name.endsWith(".js")) n++;
+	}
+	return n;
+}
+
+/**
+ * Recursively copy a directory tree (best-effort, returns file count).
+ * Used for non-TS assets — tsc compiles .ts → .js but ignores .png, .svg,
+ * .woff, etc. that live alongside source modules.
+ */
+function copyTree(src, dst) {
+	if (!existsSync(src)) return 0;
+	let n = 0;
+	mkdirSync(dst, { recursive: true });
+	for (const e of readdirSync(src, { withFileTypes: true })) {
+		const s = join(src, e.name);
+		const d = join(dst, e.name);
+		if (e.isDirectory()) {
+			n += copyTree(s, d);
+		} else if (e.isFile()) {
+			copyFileSync(s, d);
+			n++;
+		}
+	}
+	return n;
+}
+
+// 1. Build stamp — best-effort.
+let head = null;
+try {
+	head = gitHead();
+	mkdirSync("dist", { recursive: true });
+	writeFileSync("dist/buildstamp.json", `${JSON.stringify({ builtAt: Date.now(), head })}\n`, "utf8");
+} catch {
+	// Stamp is optional — a build without it just reports the bare version.
+}
+
+// 2. Asset copy — mirror non-TS files under src/**/assets/ into dist/.
+// tsc only emits .js for .ts inputs; binary assets (PNG mascots,
+// brand SVGs, fonts) need a separate copy step to end up in the
+// shipped package. The `files: ["dist/**\/*"]` package glob then
+// picks them up automatically.
+try {
+	const ASSET_TREES = [
+		// Pride org-chart mascot PNGs + any other org-chart static assets.
+		["src/agents/org/assets", "dist/agents/org/assets"],
+		// Brand assets: the Brigade favicon shown on the OAuth callback page
+		// (and reusable by any future surface).
+		["src/assets", "dist/assets"],
+	];
+	for (const [src, dst] of ASSET_TREES) copyTree(src, dst);
+} catch {
+	// Asset copy is best-effort; missing assets just produce a chart
+	// without the mascot (text fallback still works).
+}
+
+// 3. Banner — best-effort, never fails the build.
+try {
+	const gold = chalk.hex(GOLD);
+	const files = countJs("dist");
+	const sha = head ? ` ${chalk.dim(`· ${head.slice(0, 7)}`)}` : "";
+	const count = files > 0 ? ` (${files} files)` : "";
+	process.stdout.write(
+		`\n${gold.bold("🦁 Build complete")}${chalk.dim(` — dist/ ready${count}.`)}${sha}\n` +
+			`${chalk.dim("  Run:")} ${gold("brigade")}${chalk.dim(" chat · ")}${gold("brigade gateway")}${chalk.dim(" daemon · ")}${gold("brigade onboard")}${chalk.dim(" setup")}\n\n`,
+	);
+} catch {
+	// Cosmetic only.
+}

package/scripts/run-brigade.mjs

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+/**
+ * Brigade dev runner — auto-rebuilds `dist/` when source has drifted, then
+ * dispatches to `brigade.mjs` (the bin shim) with the user's args.
+ *
+ * Used by:
+ *   npm run dev                 — bare invocation (defaults to TUI)
+ *   npm run dev -- onboard      — run any subcommand against current source
+ *   npm run dev:gateway         — gateway-only dev run
+ *
+ * End-users running `npm install -g brigade` never touch this — they go
+ * through `brigade.mjs` directly. This is a developer ergonomic only.
+ *
+ * Staleness check (small Brigade surface = lighter check than full
+ * build-stamp + git-head models):
+ *   1. dist/entry.js missing            → build
+ *   2. tsconfig.build.json newer        → build
+ *   3. Any src/**\/*.ts mtime newer than dist/entry.js → build
+ *   4. BRIGADE_FORCE_BUILD=1            → build
+ *
+ * Otherwise skip the build and dispatch immediately.
+ */
+
+import { spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const SIGNAL_EXIT_CODES = { SIGINT: 130, SIGTERM: 143 };
+
+function statMtime(filePath) {
+  try {
+    return fs.statSync(filePath).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+function findLatestSrcMtime(srcRoot) {
+  let latest = null;
+  const queue = [srcRoot];
+  while (queue.length > 0) {
+    const current = queue.pop();
+    let entries;
+    try {
+      entries = fs.readdirSync(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        queue.push(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      // Skip test files — they don't ship in dist and shouldn't trigger rebuilds.
+      if (entry.name.endsWith(".test.ts") || entry.name.endsWith(".test.tsx")) continue;
+      if (!/\.[cm]?[jt]sx?$/.test(entry.name)) continue;
+      const m = statMtime(full);
+      if (m != null && (latest == null || m > latest)) latest = m;
+    }
+  }
+  return latest;
+}
+
+function resolveBuildRequirement({ repoRoot, distEntry, srcRoot, configFiles, env }) {
+  if (env.BRIGADE_FORCE_BUILD === "1") {
+    return { shouldBuild: true, reason: "force_build" };
+  }
+  const distMtime = statMtime(distEntry);
+  if (distMtime == null) {
+    return { shouldBuild: true, reason: "missing_dist_entry" };
+  }
+  for (const config of configFiles) {
+    const m = statMtime(path.join(repoRoot, config));
+    if (m != null && m > distMtime) {
+      return { shouldBuild: true, reason: `${config}_newer` };
+    }
+  }
+  const srcMtime = findLatestSrcMtime(srcRoot);
+  if (srcMtime != null && srcMtime > distMtime) {
+    return { shouldBuild: true, reason: "src_mtime_newer" };
+  }
+  return { shouldBuild: false, reason: "clean" };
+}
+
+const REASON_LABELS = {
+  force_build: "BRIGADE_FORCE_BUILD=1",
+  missing_dist_entry: "dist/entry.js is missing",
+  src_mtime_newer: "src/ has newer files than dist/entry.js",
+  clean: "clean",
+};
+
+function logRunner(message) {
+  if (process.env.BRIGADE_RUNNER_LOG === "0") return;
+  process.stderr.write(`[brigade] ${message}\n`);
+}
+
+function isSignalKey(signal) {
+  return Object.hasOwn(SIGNAL_EXIT_CODES, signal);
+}
+
+function getSignalExitCode(signal) {
+  return isSignalKey(signal) ? SIGNAL_EXIT_CODES[signal] : 1;
+}
+
+async function waitForSpawnedProcess(child) {
+  let forwardedSignal = null;
+  const onSigInt = () => {
+    if (!forwardedSignal) {
+      forwardedSignal = "SIGINT";
+      try {
+        child.kill?.("SIGINT");
+      } catch {
+        // best effort — exit handling still happens on `exit`.
+      }
+    }
+  };
+  const onSigTerm = () => {
+    if (!forwardedSignal) {
+      forwardedSignal = "SIGTERM";
+      try {
+        child.kill?.("SIGTERM");
+      } catch {
+        // best effort.
+      }
+    }
+  };
+  process.on("SIGINT", onSigInt);
+  process.on("SIGTERM", onSigTerm);
+  try {
+    return await new Promise((resolve) => {
+      child.on("exit", (exitCode, exitSignal) => {
+        resolve({ exitCode, exitSignal, forwardedSignal });
+      });
+    });
+  } finally {
+    process.off("SIGINT", onSigInt);
+    process.off("SIGTERM", onSigTerm);
+  }
+}
+
+function getInterruptedExitCode(res) {
+  if (res.exitSignal) return getSignalExitCode(res.exitSignal);
+  if (res.forwardedSignal) return getSignalExitCode(res.forwardedSignal);
+  return null;
+}
+
+async function runChildProcess(cmd, args, opts) {
+  const child = spawn(cmd, args, opts);
+  const res = await waitForSpawnedProcess(child);
+  const interrupted = getInterruptedExitCode(res);
+  if (interrupted !== null) return interrupted;
+  return res.exitCode ?? 1;
+}
+
+async function runBuild({ repoRoot }) {
+  // Invoke the typescript package's `bin/tsc` JS entry directly via node.
+  // Skipping `node_modules/.bin/tsc.cmd` avoids the Windows-shell hop and
+  // the `spawn shell:true` deprecation warning. The bin script has a
+  // node shebang and is plain JS, so node runs it cleanly cross-platform.
+  const tscEntry = path.join(repoRoot, "node_modules", "typescript", "bin", "tsc");
+  return await runChildProcess(process.execPath, [tscEntry, "-p", "tsconfig.build.json"], {
+    cwd: repoRoot,
+    env: process.env,
+    stdio: "inherit",
+  });
+}
+
+async function runBrigadeBin({ repoRoot, args }) {
+  const binPath = path.join(repoRoot, "brigade.mjs");
+  return await runChildProcess(process.execPath, [binPath, ...args], {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: "inherit",
+  });
+}
+
+export async function runDevMain(params = {}) {
+  const repoRoot = params.repoRoot ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+  const args = params.args ?? process.argv.slice(2);
+  const env = params.env ?? process.env;
+  const distEntry = path.join(repoRoot, "dist", "entry.js");
+  const srcRoot = path.join(repoRoot, "src");
+  const configFiles = ["tsconfig.json", "tsconfig.build.json", "package.json"];
+
+  const requirement = resolveBuildRequirement({ repoRoot, distEntry, srcRoot, configFiles, env });
+  if (requirement.shouldBuild) {
+    logRunner(`building (${REASON_LABELS[requirement.reason] ?? requirement.reason}).`);
+    const buildExit = await runBuild({ repoRoot });
+    if (buildExit !== 0) {
+      logRunner(`build failed (exit ${buildExit}).`);
+      return buildExit;
+    }
+  }
+  return await runBrigadeBin({ repoRoot, args });
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  runDevMain()
+    .then((code) => process.exit(code))
+    .catch((err) => {
+      console.error(err);
+      process.exit(1);
+    });
+}

package/skills/1password/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: 1password
+description: Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
+homepage: https://developer.1password.com/docs/cli/get-started/
+metadata:
+  {
+    "brigade":
+      {
+        "emoji": "🔐",
+        "requires": { "bins": ["op"] },
+        "install":
+          [
+            {
+              "id": "brew",
+              "kind": "brew",
+              "formula": "1password-cli",
+              "bins": ["op"],
+              "label": "Install 1Password CLI (brew)",
+            },
+          ],
+      },
+  }
+---
+
+# 1Password CLI
+
+Follow the official CLI get-started steps. Don't guess install commands.
+
+## References
+
+- `references/get-started.md` (install + app integration + sign-in flow)
+- `references/cli-examples.md` (real `op` examples)
+
+## Workflow
+
+1. Check OS + shell.
+2. Verify CLI present: `op --version`.
+3. Confirm desktop app integration is enabled (per get-started) and the app is unlocked.
+4. REQUIRED: create a fresh tmux session for all `op` commands (no direct `op` calls outside tmux).
+5. Sign in / authorize inside tmux: `op signin` (expect app prompt).
+6. Verify access inside tmux: `op whoami` (must succeed before any secret read).
+7. If multiple accounts: use `--account` or `OP_ACCOUNT`.
+
+## REQUIRED tmux session (T-Max)
+
+The shell tool uses a fresh TTY per command. To avoid re-prompts and failures, always run `op` inside a dedicated tmux session with a fresh socket/session name.
+
+Example (see `tmux` skill for socket conventions, do not reuse old session names):
+
+```bash
+SOCKET_DIR="${BRIGADE_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/brigade-tmux-sockets}"
+mkdir -p "$SOCKET_DIR"
+SOCKET="$SOCKET_DIR/brigade-op.sock"
+SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"
+
+tmux -S "$SOCKET" new -d -s "$SESSION" -n shell
+tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op signin --account my.1password.com" Enter
+tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter
+tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op vault list" Enter
+tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200
+tmux -S "$SOCKET" kill-session -t "$SESSION"
+```
+
+## Guardrails
+
+- Never paste secrets into logs, chat, or code.
+- Prefer `op run` / `op inject` over writing secrets to disk.
+- If sign-in without app integration is needed, use `op account add`.
+- If a command returns "account is not signed in", re-run `op signin` inside tmux and authorize in the app.
+- Do not run `op` outside tmux; stop and ask if tmux is unavailable.