@spinabot/brigade 0.1.2 → 1.0.0

package/dist/agents/exec-gate.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Exec gate — refuses problematic shell-tool calls BEFORE they execute.
+ *
+ * Wired into Pi's `session.agent.beforeToolCall` hook AFTER the
+ * unknown-tool guard. Composed in `agent-loop.ts`:
+ *
+ *   const nameGuard = makeUnknownToolGuard(enabledToolNames);
+ *   const gate      = makeExecGate({ ctxRef, displayCwd });
+ *   session.agent.beforeToolCall = async (ctx, signal) => {
+ *     const named = await nameGuard(ctx, signal);
+ *     if (named?.block) return named;
+ *     return gate(ctx, signal);
+ *   };
+ *
+ * Scope is shell-only. Path-mutating tools (`write`, `edit`) are NOT
+ * gated here — Pi resolves their relative paths against the session
+ * cwd (the agent's workspace dir), and absolute paths are passed
+ * through. The agent's "home" is its persona directory; project files
+ * are reached via absolute paths the operator gives it. This matches the
+ * `tools.fs.workspaceOnly = false` default and `createAgentSession({cwd:
+ * resolvedWorkspace})` wiring.
+ *
+ * What this gate enforces:
+ *
+ *   1. Tool name match — case-insensitive lookup against
+ *      `EXEC_GATED_TOOLS` (bash, exec, shell, sh). Catches the
+ *      `Bash`/`SHELL`/`Exec` casing that some providers emit.
+ *
+ *   2. Non-string command argument — refused with a typed message
+ *      identifying the actual shape (array / number / object / etc.)
+ *      so the model knows exactly what to fix.
+ *
+ *   3. workdir / cwd argument override — refused outright (any value
+ *      or type). An operator who approved `ls -la` did NOT approve
+ *      running it from `/etc`. v1 trust model: commands run from the
+ *      agent's session cwd, no directory shopping. Phase 2 may relax
+ *      this to "must be inside session cwd" once the analyzer surface
+ *      lands.
+ *
+ *   4. env argument override — refused. An operator who allowlisted
+ *      `git status` did NOT also allowlist running it with arbitrary
+ *      environment variables (e.g. `GIT_SSH_COMMAND=/tmp/evil`
+ *      hijacks ssh; `LD_PRELOAD=…` hijacks dynamic linking).
+ *
+ *   5. `decideApproval(command)` — the heart of the gate. Returns
+ *      "allow" / "deny" / "prompt"; "allow" passes the call through,
+ *      "deny" refuses with a hard-deny reason (and is never persistable),
+ *      "prompt" refuses with the exact `brigade exec allow ...` CLI
+ *      the operator needs to run.
+ *
+ *   6. `BrigadeApprovalFileVersionError` passthrough — if the
+ *      `~/.brigade/exec-approvals.json` file declares a future schema
+ *      version, refuse the tool call with the typed error's remediation
+ *      message instead of letting the throw escape into Pi.
+ *
+ * Every refusal also emits a `tool-blocked` event via the agent event
+ * bus. The TUI / gateway WebSocket / future audit consumers can
+ * subscribe and render the refusal as a log line.
+ */
+import type { ChannelApprovalRoute } from "./channels/approval-router.js";
+import { type BrigadeBeforeToolCallHook } from "./tool-guard.js";
+/**
+ * Optional context the gate threads into bus events. The agent-loop
+ * sets `ctxRef.value = {runId, agentId}` at turn start and clears it
+ * in the finally; the gate reads `.value` live each call so events
+ * carry accurate correlation IDs across turn boundaries.
+ *
+ * Both fields are optional: when omitted (unit tests pass no ctxRef)
+ * the gate still emits the event with empty-string ids.
+ */
+export interface ExecGateContext {
+    runId?: string;
+    agentId?: string;
+    /** Wave I — session key the gated tool call ran under. Threaded into the
+     *  `tool-blocked` bus event so the WS subscription filter can route the
+     *  refusal log to the operator watching THIS session only. */
+    sessionKey?: string;
+    /** When this turn IS running inside a sub-agent, these surface so the
+     *  operator's approval prompt can show "Sub-agent '<label>' wants to run
+     *  …" instead of the default attribution. Top-level turns leave them
+     *  unset (the prompt falls back to "Brigade wants to run …"). */
+    subagentLabel?: string;
+    subagentDepth?: number;
+    parentRunId?: string;
+    /** Channel routing — when set, the approval prompt is delivered into
+     *  the originating chat (via the per-channel approval-router) instead
+     *  of only the gateway WS. Channel-routed inbounds populate this; TUI /
+     *  sub-agent / cron turns leave it undefined and the bridge falls back
+     *  to the WS-only path. */
+    channelRoute?: ChannelApprovalRoute;
+}
+export interface MakeExecGateOptions {
+    /** Live context bag for bus events. Default: empty (test-friendly). */
+    ctxRef?: {
+        value: ExecGateContext;
+    };
+    /**
+     * Cwd label for the workdir-refusal reason text. NOT used for any
+     * resolution logic — purely diagnostic so the model sees the actual
+     * cwd Pi will use when retrying without a workdir override. Defaults
+     * to `process.cwd()` for backwards compatibility with callers that
+     * don't supply it.
+     */
+    displayCwd?: string;
+}
+/**
+ * Build a `beforeToolCall` hook that enforces the shell-policy above.
+ * Returns `undefined` (pass through) for non-shell tools and for
+ * allowlisted shell commands; returns `{block: true, reason}` for
+ * refusals.
+ */
+export declare function makeExecGate(opts?: MakeExecGateOptions): BrigadeBeforeToolCallHook;
+//# sourceMappingURL=exec-gate.d.ts.map

package/dist/agents/exec-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-gate.d.ts","sourceRoot":"","sources":["../../src/agents/exec-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAYH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,KAAK,yBAAyB,EAAqB,MAAM,iBAAiB,CAAC;AAUpF;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;kEAE8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;qEAGiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;+BAI2B;IAC3B,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IACnC,uEAAuE;IACvE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,eAAe,CAAA;KAAE,CAAC;IACpC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,yBAAyB,CAiQtF"}

package/dist/agents/exec-gate.js

@@ -0,0 +1,335 @@
+/**
+ * Exec gate — refuses problematic shell-tool calls BEFORE they execute.
+ *
+ * Wired into Pi's `session.agent.beforeToolCall` hook AFTER the
+ * unknown-tool guard. Composed in `agent-loop.ts`:
+ *
+ *   const nameGuard = makeUnknownToolGuard(enabledToolNames);
+ *   const gate      = makeExecGate({ ctxRef, displayCwd });
+ *   session.agent.beforeToolCall = async (ctx, signal) => {
+ *     const named = await nameGuard(ctx, signal);
+ *     if (named?.block) return named;
+ *     return gate(ctx, signal);
+ *   };
+ *
+ * Scope is shell-only. Path-mutating tools (`write`, `edit`) are NOT
+ * gated here — Pi resolves their relative paths against the session
+ * cwd (the agent's workspace dir), and absolute paths are passed
+ * through. The agent's "home" is its persona directory; project files
+ * are reached via absolute paths the operator gives it. This matches the
+ * `tools.fs.workspaceOnly = false` default and `createAgentSession({cwd:
+ * resolvedWorkspace})` wiring.
+ *
+ * What this gate enforces:
+ *
+ *   1. Tool name match — case-insensitive lookup against
+ *      `EXEC_GATED_TOOLS` (bash, exec, shell, sh). Catches the
+ *      `Bash`/`SHELL`/`Exec` casing that some providers emit.
+ *
+ *   2. Non-string command argument — refused with a typed message
+ *      identifying the actual shape (array / number / object / etc.)
+ *      so the model knows exactly what to fix.
+ *
+ *   3. workdir / cwd argument override — refused outright (any value
+ *      or type). An operator who approved `ls -la` did NOT approve
+ *      running it from `/etc`. v1 trust model: commands run from the
+ *      agent's session cwd, no directory shopping. Phase 2 may relax
+ *      this to "must be inside session cwd" once the analyzer surface
+ *      lands.
+ *
+ *   4. env argument override — refused. An operator who allowlisted
+ *      `git status` did NOT also allowlist running it with arbitrary
+ *      environment variables (e.g. `GIT_SSH_COMMAND=/tmp/evil`
+ *      hijacks ssh; `LD_PRELOAD=…` hijacks dynamic linking).
+ *
+ *   5. `decideApproval(command)` — the heart of the gate. Returns
+ *      "allow" / "deny" / "prompt"; "allow" passes the call through,
+ *      "deny" refuses with a hard-deny reason (and is never persistable),
+ *      "prompt" refuses with the exact `brigade exec allow ...` CLI
+ *      the operator needs to run.
+ *
+ *   6. `BrigadeApprovalFileVersionError` passthrough — if the
+ *      `~/.brigade/exec-approvals.json` file declares a future schema
+ *      version, refuse the tool call with the typed error's remediation
+ *      message instead of letting the throw escape into Pi.
+ *
+ * Every refusal also emits a `tool-blocked` event via the agent event
+ * bus. The TUI / gateway WebSocket / future audit consumers can
+ * subscribe and render the refusal as a log line.
+ */
+import { BrigadeApprovalFileVersionError, decideApproval } from "../core/exec-approvals.js";
+import { emitAgentEvent } from "./agent-event-bus.js";
+import { isExecAllowAll, setExecAllowAll } from "./exec-session-allow.js";
+import { applyApprovalDecision, getActiveApprovalBridge, } from "./approval-bridge.js";
+import { normalizeToolName } from "./tool-guard.js";
+/**
+ * Shell-shaped tool names gated by this hook. Includes the canonical
+ * `bash` plus the aliases providers occasionally emit (`exec`, `shell`,
+ * `sh`). Match is case-insensitive at call time — adding a new alias
+ * here is the only wiring needed.
+ */
+const EXEC_GATED_TOOLS = new Set(["bash", "exec", "shell", "sh"]);
+/**
+ * Build a `beforeToolCall` hook that enforces the shell-policy above.
+ * Returns `undefined` (pass through) for non-shell tools and for
+ * allowlisted shell commands; returns `{block: true, reason}` for
+ * refusals.
+ */
+export function makeExecGate(opts = {}) {
+    const ctxRef = opts.ctxRef ?? { value: {} };
+    const displayCwd = opts.displayCwd ?? process.cwd();
+    const emitBlocked = (toolName, reason) => {
+        const c = ctxRef.value;
+        emitAgentEvent({
+            type: "tool-blocked",
+            runId: c.runId ?? "",
+            agentId: c.agentId ?? "",
+            toolName,
+            reason,
+            // Wave I — forward the session key so the gateway's per-client
+            // subscription filter routes the refusal log to the operator
+            // watching THIS session only.
+            ...(c.sessionKey !== undefined ? { sessionKey: c.sessionKey } : {}),
+        });
+    };
+    return async (ctx) => {
+        const rawName = ctx?.toolCall?.name
+            ?? ctx?.name
+            ?? "";
+        // Shared normaliser — lowercase + trim — so the gate behaves
+        // identically to the unknown-tool guard and the loop detector
+        // when a provider emits `Bash` / `BASH` / `  bash  `.
+        const name = normalizeToolName(rawName);
+        if (!name)
+            return undefined;
+        if (!EXEC_GATED_TOOLS.has(name))
+            return undefined;
+        const args = ctx
+            ?.toolCall?.arguments
+            ?? ctx?.args
+            ?? ctx?.arguments
+            ?? {};
+        // Pull the command out of the tool args. Pi's `bash` tool accepts
+        // `command` (the Anthropic convention); some providers emit `cmd`
+        // or `script` instead — fall back through them.
+        const cmdRaw = (args && typeof args === "object"
+            ? (args.command
+                ?? args.cmd
+                ?? args.script)
+            : undefined);
+        // Non-string command argument: refuse with shape info so the model
+        // can correct itself. Without this branch a `command: ["ls", "-la"]`
+        // would silently coerce to empty-string and surface as
+        // "(empty command) is not on the allowlist" — misleading.
+        if (cmdRaw !== undefined && typeof cmdRaw !== "string") {
+            const shape = Array.isArray(cmdRaw)
+                ? "array"
+                : typeof cmdRaw === "object" && cmdRaw !== null
+                    ? "object"
+                    : typeof cmdRaw;
+            const article = /^[aeiou]/i.test(shape) ? "an" : "a";
+            const reason = `Tool "${name}" was blocked: its \`command\` argument was ${article} ${shape}, ` +
+                `not a string. Brigade's bash gate expects a single shell command string ` +
+                `(e.g. \`{command: "ls -la"}\`). Re-emit the tool call with the command as ` +
+                `one string and retry.`;
+            emitBlocked(name, reason);
+            return { block: true, reason };
+        }
+        const cmd = typeof cmdRaw === "string" ? cmdRaw : "";
+        // workdir / cwd refusal. Pi's bash schema accepts a `workdir` (alias:
+        // `cwd`) override; v1 refuses any such override regardless of value
+        // or type. An operator who allowlisted `ls -la` did NOT approve
+        // running it from `/etc` — the directory matters. Refused BEFORE
+        // the decideApproval check so a workdir attack on an allowlisted
+        // command is still caught.
+        if (args && typeof args === "object") {
+            const hasWorkdir = Object.prototype.hasOwnProperty.call(args, "workdir");
+            const hasCwd = Object.prototype.hasOwnProperty.call(args, "cwd");
+            const workdirRaw = hasWorkdir
+                ? args.workdir
+                : hasCwd
+                    ? args.cwd
+                    : undefined;
+            const workdirKey = hasWorkdir ? "workdir" : hasCwd ? "cwd" : null;
+            if (workdirKey !== null && workdirRaw !== undefined && workdirRaw !== null) {
+                const isEmptyString = typeof workdirRaw === "string" && workdirRaw.trim().length === 0;
+                if (!isEmptyString) {
+                    const displayValue = typeof workdirRaw === "string"
+                        ? `"${workdirRaw}"`
+                        : `(${Array.isArray(workdirRaw) ? "array" : typeof workdirRaw})`;
+                    const reason = `Tool "${name}" was blocked: \`${workdirKey}\` override ${displayValue} is not ` +
+                        `allowed. v1 refuses any \`workdir\` / \`cwd\` argument on shell tools — ` +
+                        `the command runs from the agent's session cwd ("${displayCwd}"). If you need ` +
+                        `to act on files inside a subdirectory, prefer absolute paths in the ` +
+                        `command itself (e.g. \`ls -la /full/path\`).`;
+                    emitBlocked(name, reason);
+                    return { block: true, reason };
+                }
+            }
+            // env refusal. Pi's bash schema accepts an `env` override.
+            // Allowlisting `git status` does NOT also allowlist running it
+            // with arbitrary env vars (e.g. `GIT_SSH_COMMAND=/tmp/evil`
+            // hijacks ssh; `LD_PRELOAD=…` hijacks dynamic linking).
+            // Empty-object env (`{env: {}}`) is harmless — passes through.
+            const envRaw = args.env;
+            if (envRaw !== undefined && envRaw !== null) {
+                if (typeof envRaw !== "object" ||
+                    Array.isArray(envRaw) ||
+                    Object.keys(envRaw).length > 0) {
+                    const reason = `Tool "${name}" was blocked: \`env\` override is not allowed. v1 refuses ` +
+                        `any \`env\` argument on shell tools — environment variables can hijack ` +
+                        `allowlisted commands (e.g. GIT_SSH_COMMAND to replace ssh, LD_PRELOAD to ` +
+                        `hijack dynamic linking). If you need a specific env, prefix the command ` +
+                        `itself (e.g. \`FOO=bar npm test\`) AND approve THAT exact string.`;
+                    emitBlocked(name, reason);
+                    return { block: true, reason };
+                }
+            }
+        }
+        // decideApproval may throw `BrigadeApprovalFileVersionError` if the
+        // on-disk allowlist file declares a future schema version. Refuse
+        // the tool call with the typed error's message rather than letting
+        // the throw escape into Pi (which would surface a generic stream
+        // error far from the actual cause).
+        //
+        // agentId scopes the allowlist per-agent — top-level + sub-agent turns
+        // both flow through here and ctxRef.value.agentId carries the active
+        // agent id from runSingleTurn. Falls back to the default agent when
+        // no ctxRef is supplied (unit tests).
+        const gateAgentId = ctxRef.value.agentId;
+        let decision;
+        try {
+            decision = decideApproval(cmd, gateAgentId);
+        }
+        catch (err) {
+            if (err instanceof BrigadeApprovalFileVersionError) {
+                const reason = `Tool "${name}" was blocked: the exec-approvals file declares a schema ` +
+                    `version this Brigade build doesn't understand. ${err.message}`;
+                emitBlocked(name, reason);
+                return { block: true, reason };
+            }
+            throw err;
+        }
+        if (decision === "allow")
+            return undefined;
+        if (decision === "deny") {
+            const reason = `Tool "${name}" was blocked: command "${cmd.slice(0, 120)}" ` +
+                `matches a hard-deny pattern (e.g. rm -rf /, dd to raw disk, ` +
+                `fork bomb). This pattern is permanently refused and cannot be ` +
+                `allowlisted — pick a safer command.`;
+            emitBlocked(name, reason);
+            return { block: true, reason };
+        }
+        // Session allow-all (operator-armed via `/allow-all on`). Only a
+        // "prompt" decision can reach here — "allow" returned at the allowlist
+        // check above, "deny" returned in the hard-deny block, and the
+        // non-string / workdir / env refusals returned earlier. The
+        // config-write + path-write guards also ran BEFORE this gate in
+        // composeBrigadeBeforeToolCall. So allow-all ONLY ever waives the
+        // interactive prompt — it can never bypass a protective block. It's
+        // in-memory + per-session (clears on restart) and does NOT cascade to
+        // sub-agents (their gate checks distinct child session keys).
+        if (isExecAllowAll(ctxRef.value.sessionKey))
+            return undefined;
+        // "prompt" — operator hasn't allowlisted this command yet. If a
+        // gateway client is online (the WS bridge is registered), surface
+        // an inline approval prompt and route the operator's choice
+        // through `applyApprovalDecision` — which persists "allow-always"
+        // or "allow-pattern" decisions to `~/.brigade/exec-approvals.json`
+        // before letting the call proceed.
+        const bridge = getActiveApprovalBridge();
+        if (bridge) {
+            const preview = previewCommand(cmd);
+            const decisions = [
+                "allow-once",
+                "allow-always",
+                "allow-pattern",
+                "allow-session",
+                "deny",
+            ];
+            try {
+                const c = ctxRef.value;
+                const decision = await bridge.requestApproval({
+                    command: cmd,
+                    toolName: name,
+                    cwd: displayCwd,
+                    timeoutMs: 5 * 60 * 1000,
+                    decisions,
+                    ...(c.subagentLabel !== undefined ? { subagentLabel: c.subagentLabel } : {}),
+                    ...(c.subagentDepth !== undefined ? { subagentDepth: c.subagentDepth } : {}),
+                    ...(c.parentRunId !== undefined ? { parentRunId: c.parentRunId } : {}),
+                    ...(c.channelRoute !== undefined ? { channelRoute: c.channelRoute } : {}),
+                    // Wave K (R3) — forward the per-turn agentId + sessionKey-as-sessionId
+                    // so the gateway's WS subscription filter routes the approval
+                    // prompt to the operator watching THIS agent's session only. Without
+                    // these the broadcaster's filter sees an un-tagged frame and falls
+                    // back to fan-out-to-everyone, so a TUI bound to a different agent
+                    // would see (and could answer) someone else's approval.
+                    ...(c.agentId !== undefined ? { agentId: c.agentId } : {}),
+                    ...(c.sessionKey !== undefined ? { sessionId: c.sessionKey } : {}),
+                });
+                if (decision.timedOut) {
+                    const reason = `Bash refused: approval timed out (no operator reply within 5 minutes). Command was "${preview}". ` +
+                        `Tell the user what you wanted to run and ask again when they're back.`;
+                    emitBlocked(name, reason);
+                    return { block: true, reason };
+                }
+                // "allow-session" — operator chose "allow all this session" from the
+                // prompt. Arm the per-session bypass (so subsequent commands skip
+                // the prompt) AND allow THIS call. Same bounded surface as
+                // `/allow-all`: only the prompt is waived; hard-deny / workdir / env
+                // refusals + the config/path-write guards still apply.
+                if (decision.kind === "allow-session") {
+                    setExecAllowAll(ctxRef.value.sessionKey, true);
+                    return undefined;
+                }
+                const outcome = applyApprovalDecision({ command: cmd, decision, agentId: gateAgentId });
+                if (outcome === "allow")
+                    return undefined;
+                // Deny → refuse with a short, agent-friendly reason.
+                const reason = `Bash refused by operator: "${preview}" was explicitly denied. Don't retry the same command — ask the user what they want instead.`;
+                emitBlocked(name, reason);
+                return { block: true, reason };
+            }
+            catch (err) {
+                // recordApproval can throw on hard-deny / symlink violation.
+                // Surface a clear refusal so the agent doesn't loop on the
+                // same command thinking the operator hasn't seen it yet.
+                const detail = err instanceof Error ? err.message : String(err);
+                const reason = `Bash refused: couldn't persist the operator's approval — ${detail}. ` +
+                    `The command was "${preview}". Tell the user the file at ~/.brigade/exec-approvals.json may need attention.`;
+                emitBlocked(name, reason);
+                return { block: true, reason };
+            }
+        }
+        // No bridge attached (CLI `brigade agent`, unit tests). Refuse with
+        // the legacy message so the model knows to ask the operator out-of-band.
+        const preview = previewCommand(cmd);
+        const reason = `Bash refused: command starting "${preview}" is not pre-approved.\n` +
+            `Do NOT retry with shell variants (powershell / python -c / different quoting / heredoc) — ` +
+            `they all hit the same gate. Tell the user what you wanted to run and ask them to approve, ` +
+            `OR use one of these tools that don't need approval:\n` +
+            `  • read / grep / find / ls — file ops are always open.\n` +
+            `  • fetch_url / web_search / web_extract — for web content.\n` +
+            `  • browser — for JS-driven pages or screenshots.\n` +
+            `  • write / edit — for file writes inside the workspace.`;
+        emitBlocked(name, reason);
+        return { block: true, reason };
+    };
+}
+/**
+ * Build a short, single-line preview of the offending command for the
+ * blocked-tool error message. Strips newlines + control chars (so a
+ * multi-line heredoc doesn't blow up the rendering), collapses runs of
+ * whitespace, and truncates at 80 chars with an ellipsis. Output is
+ * SAFE to embed in an arbitrary error string — no shell escaping needed.
+ */
+function previewCommand(cmd) {
+    if (!cmd)
+        return "(empty command)";
+    const flat = cmd.replace(/[\r\n]+/g, " ").replace(/[\x00-\x1f\x7f]/g, " ").replace(/\s+/g, " ").trim();
+    if (flat.length <= 80)
+        return flat;
+    return `${flat.slice(0, 77)}…`;
+}
+//# sourceMappingURL=exec-gate.js.map

package/dist/agents/exec-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-gate.js","sourceRoot":"","sources":["../../src/agents/exec-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAIH,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EACN,qBAAqB,EAErB,uBAAuB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAkC,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AA8ClE;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B,EAAE;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,EAAqB,EAAE,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAQ,EAAE;QAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,cAAc,CAAC;YACd,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,QAAQ;YACR,MAAM;YACN,+DAA+D;YAC/D,6DAA6D;YAC7D,8BAA8B;YAC9B,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,OAAO,KAAK,EAAE,GAA0B,EAA6C,EAAE;QACtF,MAAM,OAAO,GAAI,GAAyD,EAAE,QAAQ,EAAE,IAAI;eACrF,GAA0B,EAAE,IAAI;eACjC,EAAE,CAAC;QACP,6DAA6D;QAC7D,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAElD,MAAM,IAAI,GAAI,GAAmF;YAChG,EAAE,QAAQ,EAAE,SAAS;eACjB,GAA0B,EAAE,IAAI;eAChC,GAA+B,EAAE,SAAS;eAC3C,EAAE,CAAC;QAEP,kEAAkE;QAClE,kEAAkE;QAClE,gDAAgD;QAChD,MAAM,MAAM,GACX,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAChC,CAAC,CAAC,CAAE,IAA8B,CAAC,OAAO;mBACrC,IAA0B,CAAC,GAAG;mBAC9B,IAA6B,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,SAAS,CAAC,CAAC;QAEf,mEAAmE;QACnE,qEAAqE;QACrE,uDAAuD;QACvD,0DAA0D;QAC1D,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAClC,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;oBAC9C,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,OAAO,MAAM,CAAC;YAClB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YACrD,MAAM,MAAM,GACX,SAAS,IAAI,+CAA+C,OAAO,IAAI,KAAK,IAAI;gBAChF,0EAA0E;gBAC1E,4EAA4E;gBAC5E,uBAAuB,CAAC;YACzB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAErD,sEAAsE;QACtE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,2BAA2B;QAC3B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,UAAU;gBAC5B,CAAC,CAAE,IAA8B,CAAC,OAAO;gBACzC,CAAC,CAAC,MAAM;oBACP,CAAC,CAAE,IAA0B,CAAC,GAAG;oBACjC,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC5E,MAAM,aAAa,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;gBACvF,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpB,MAAM,YAAY,GAAG,OAAO,UAAU,KAAK,QAAQ;wBAClD,CAAC,CAAC,IAAI,UAAU,GAAG;wBACnB,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,UAAU,GAAG,CAAC;oBAClE,MAAM,MAAM,GACX,SAAS,IAAI,oBAAoB,UAAU,eAAe,YAAY,UAAU;wBAChF,0EAA0E;wBAC1E,mDAAmD,UAAU,kBAAkB;wBAC/E,sEAAsE;wBACtE,8CAA8C,CAAC;oBAChD,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAChC,CAAC;YACF,CAAC;YAED,2DAA2D;YAC3D,+DAA+D;YAC/D,4DAA4D;YAC5D,wDAAwD;YACxD,+DAA+D;YAC/D,MAAM,MAAM,GAAI,IAA0B,CAAC,GAAG,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC7C,IACC,OAAO,MAAM,KAAK,QAAQ;oBAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACrB,MAAM,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,EACvC,CAAC;oBACF,MAAM,MAAM,GACX,SAAS,IAAI,6DAA6D;wBAC1E,yEAAyE;wBACzE,2EAA2E;wBAC3E,0EAA0E;wBAC1E,mEAAmE,CAAC;oBACrE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAChC,CAAC;YACF,CAAC;QACF,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,oCAAoC;QACpC,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,sCAAsC;QACtC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QACzC,IAAI,QAA2C,CAAC;QAChD,IAAI,CAAC;YACJ,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,+BAA+B,EAAE,CAAC;gBACpD,MAAM,MAAM,GACX,SAAS,IAAI,2DAA2D;oBACxE,kDAAkD,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,CAAC;QACX,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QAE3C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,MAAM,GACX,SAAS,IAAI,2BAA2B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI;gBAC7D,8DAA8D;gBAC9D,gEAAgE;gBAChE,qCAAqC,CAAC;YACvC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChC,CAAC;QAED,iEAAiE;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,4DAA4D;QAC5D,gEAAgE;QAChE,kEAAkE;QAClE,oEAAoE;QACpE,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QAE9D,gEAAgE;QAChE,kEAAkE;QAClE,4DAA4D;QAC5D,kEAAkE;QAClE,mEAAmE;QACnE,mCAAmC;QACnC,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,SAAS,GAAwC;gBACtD,YAAY;gBACZ,cAAc;gBACd,eAAe;gBACf,eAAe;gBACf,MAAM;aACN,CAAC;YACF,IAAI,CAAC;gBACJ,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;oBAC7C,OAAO,EAAE,GAAG;oBACZ,QAAQ,EAAE,IAAI;oBACd,GAAG,EAAE,UAAU;oBACf,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;oBACxB,SAAS;oBACT,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,uEAAuE;oBACvE,8DAA8D;oBAC9D,qEAAqE;oBACrE,mEAAmE;oBACnE,mEAAmE;oBACnE,wDAAwD;oBACxD,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClE,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACvB,MAAM,MAAM,GACX,uFAAuF,OAAO,KAAK;wBACnG,uEAAuE,CAAC;oBACzE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAChC,CAAC;gBACD,qEAAqE;gBACrE,kEAAkE;gBAClE,2DAA2D;gBAC3D,qEAAqE;gBACrE,uDAAuD;gBACvD,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACvC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;oBAC/C,OAAO,SAAS,CAAC;gBAClB,CAAC;gBACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxF,IAAI,OAAO,KAAK,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAC1C,qDAAqD;gBACrD,MAAM,MAAM,GAAG,8BAA8B,OAAO,8FAA8F,CAAC;gBACnJ,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,6DAA6D;gBAC7D,2DAA2D;gBAC3D,yDAAyD;gBACzD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChE,MAAM,MAAM,GACX,4DAA4D,MAAM,IAAI;oBACtE,oBAAoB,OAAO,iFAAiF,CAAC;gBAC9G,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAChC,CAAC;QACF,CAAC;QAED,oEAAoE;QACpE,yEAAyE;QACzE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GACX,mCAAmC,OAAO,0BAA0B;YACpE,4FAA4F;YAC5F,4FAA4F;YAC5F,uDAAuD;YACvD,2DAA2D;YAC3D,+DAA+D;YAC/D,qDAAqD;YACrD,0DAA0D,CAAC;QAC5D,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,GAAW;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvG,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAChC,CAAC"}

package/dist/agents/exec-session-allow.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Session-scoped exec "allow-all" toggle (operator-armed).
+ *
+ * When the operator runs `/allow-all on` for a session, the exec-gate stops
+ * PROMPTING for shell commands in that session and lets them run. It ONLY
+ * waives the interactive approval prompt — every protective layer still
+ * applies, by construction:
+ *
+ *   - hard-deny patterns (rm -rf /, fork bombs, …) → exec-gate returns "deny"
+ *     and never reaches the allow-all check;
+ *   - workdir / cwd / env hijack refusals → returned before decideApproval;
+ *   - the config-write-guard + path-write-guard (which protect brigade.json,
+ *     encryption.key, auth, cron.json, mode.sentinel, protected roots) run
+ *     BEFORE the exec-gate in composeBrigadeBeforeToolCall, so they block
+ *     regardless of allow-all.
+ *
+ * State is in-memory and per session key: it clears on gateway restart, never
+ * persists to disk, and does NOT cascade to sub-agents (they run under their
+ * own derived child session keys, so their gate checks a key that was never
+ * armed). Pinned via global-singleton so hot-reload / dual-build share one set.
+ */
+/** Arm (`on`) or disarm allow-all for a session key. No-op on empty key. */
+export declare function setExecAllowAll(sessionKey: string | undefined, on: boolean): void;
+/** True when allow-all is armed for this session key. */
+export declare function isExecAllowAll(sessionKey: string | undefined): boolean;
+/** Snapshot of armed session keys (sorted) — diagnostics / status. */
+export declare function listExecAllowAllSessions(): string[];
+/** Test-only — clear every armed session. */
+export declare function clearExecAllowAllForTests(): void;
+//# sourceMappingURL=exec-session-allow.d.ts.map

package/dist/agents/exec-session-allow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-session-allow.d.ts","sourceRoot":"","sources":["../../src/agents/exec-session-allow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,OAAO,GAAG,IAAI,CAKjF;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAItE;AAED,sEAAsE;AACtE,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED,6CAA6C;AAC7C,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD"}

package/dist/agents/exec-session-allow.js

@@ -0,0 +1,50 @@
+/**
+ * Session-scoped exec "allow-all" toggle (operator-armed).
+ *
+ * When the operator runs `/allow-all on` for a session, the exec-gate stops
+ * PROMPTING for shell commands in that session and lets them run. It ONLY
+ * waives the interactive approval prompt — every protective layer still
+ * applies, by construction:
+ *
+ *   - hard-deny patterns (rm -rf /, fork bombs, …) → exec-gate returns "deny"
+ *     and never reaches the allow-all check;
+ *   - workdir / cwd / env hijack refusals → returned before decideApproval;
+ *   - the config-write-guard + path-write-guard (which protect brigade.json,
+ *     encryption.key, auth, cron.json, mode.sentinel, protected roots) run
+ *     BEFORE the exec-gate in composeBrigadeBeforeToolCall, so they block
+ *     regardless of allow-all.
+ *
+ * State is in-memory and per session key: it clears on gateway restart, never
+ * persists to disk, and does NOT cascade to sub-agents (they run under their
+ * own derived child session keys, so their gate checks a key that was never
+ * armed). Pinned via global-singleton so hot-reload / dual-build share one set.
+ */
+import { resolveGlobalSingleton } from "../shared/global-singleton.js";
+const ALLOW_ALL_KEY = Symbol.for("brigade.execSessionAllowAll");
+const armed = resolveGlobalSingleton(ALLOW_ALL_KEY, () => new Set());
+/** Arm (`on`) or disarm allow-all for a session key. No-op on empty key. */
+export function setExecAllowAll(sessionKey, on) {
+    const key = (sessionKey ?? "").trim();
+    if (!key)
+        return;
+    if (on)
+        armed.add(key);
+    else
+        armed.delete(key);
+}
+/** True when allow-all is armed for this session key. */
+export function isExecAllowAll(sessionKey) {
+    const key = (sessionKey ?? "").trim();
+    if (!key)
+        return false;
+    return armed.has(key);
+}
+/** Snapshot of armed session keys (sorted) — diagnostics / status. */
+export function listExecAllowAllSessions() {
+    return [...armed].sort();
+}
+/** Test-only — clear every armed session. */
+export function clearExecAllowAllForTests() {
+    armed.clear();
+}
+//# sourceMappingURL=exec-session-allow.js.map

package/dist/agents/exec-session-allow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-session-allow.js","sourceRoot":"","sources":["../../src/agents/exec-session-allow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAEhE,MAAM,KAAK,GAAG,sBAAsB,CAAc,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,EAAU,CAAC,CAAC;AAE1F,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,UAA8B,EAAE,EAAW;IAC1E,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAClB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,UAA8B;IAC5D,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,wBAAwB;IACvC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,yBAAyB;IACxC,KAAK,CAAC,KAAK,EAAE,CAAC;AACf,CAAC"}

package/dist/agents/extensions/active-registry.d.ts

@@ -0,0 +1,4 @@
+import type { BrigadeExtensionRegistry } from "./registry.js";
+export declare function setActiveRegistry(registry: BrigadeExtensionRegistry | undefined): void;
+export declare function getActiveRegistry(): BrigadeExtensionRegistry | undefined;
+//# sourceMappingURL=active-registry.d.ts.map

package/dist/agents/extensions/active-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-registry.d.ts","sourceRoot":"","sources":["../../../src/agents/extensions/active-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAc9D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,SAAS,GAAG,IAAI,CAEtF;AAED,wBAAgB,iBAAiB,IAAI,wBAAwB,GAAG,SAAS,CAExE"}

package/dist/agents/extensions/active-registry.js

@@ -0,0 +1,18 @@
+/**
+ * Process-wide handle to the live extension registry, set once at gateway boot (after
+ * `loadModules`) and cleared on shutdown. Mirrors `active-service.ts` (the cron service
+ * singleton): lets a deep, hot-path caller — e.g. the inbound media pipeline reaching a
+ * TranscriptionProvider — fetch the registry WITHOUT threading it through every channel
+ * adapter's args/deps. Single-operator, single-process, so one slot is correct.
+ *
+ * Returns `undefined` when unset (e.g. a non-gateway path, or before boot), so callers
+ * degrade gracefully rather than fault.
+ */
+let active;
+export function setActiveRegistry(registry) {
+    active = registry;
+}
+export function getActiveRegistry() {
+    return active;
+}
+//# sourceMappingURL=active-registry.js.map

package/dist/agents/extensions/active-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-registry.js","sourceRoot":"","sources":["../../../src/agents/extensions/active-registry.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,IAAI,MAA4C,CAAC;AAEjD,MAAM,UAAU,iBAAiB,CAAC,QAA8C;IAC/E,MAAM,GAAG,QAAQ,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,MAAM,CAAC;AACf,CAAC"}