@spinabot/brigade 0.1.2 → 1.0.1

package/dist/cli/commands/encrypt-cmd.js

@@ -0,0 +1,119 @@
+// src/cli/commands/encrypt-cmd.ts
+//
+// `brigade encrypt` — operator-facing surface for at-rest encryption.
+//
+//   brigade encrypt status     — check whether a key is configured + round-trip
+//   brigade encrypt init       — generate a fresh 32-byte hex key (just prints)
+//   brigade encrypt test       — encrypt+decrypt a sample string
+import chalk from "chalk";
+import { encryptionStatus, generateMasterKeyHex, openToString, sealString, isEncryptionEnabled, } from "../../storage/encryption.js";
+export async function runEncryptStatus(opts = {}) {
+    const status = encryptionStatus();
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: !status.error, status }, null, 2)}\n`);
+        return status.error ? 1 : 0;
+    }
+    if (!status.enabled) {
+        process.stdout.write(`${chalk.dim("Brigade at-rest encryption:")} ${chalk.bold("OFF")}\n`);
+        process.stdout.write(chalk.dim(`  No key in the environment and no key file on this computer.\n` +
+            `  Onboarding in convex mode creates one automatically, or generate one\n` +
+            `  yourself with: ${chalk.bold("brigade encrypt init")}\n`));
+        return 0;
+    }
+    if (status.error) {
+        process.stdout.write(`${chalk.red("✗")} encryption configured but ${status.error}\n`);
+        return 1;
+    }
+    process.stdout.write(`${chalk.green("✓")} Brigade at-rest encryption: ${chalk.bold("ON")}\n`);
+    process.stdout.write(chalk.dim(`  Algorithm:    ${status.algorithm}\n`));
+    process.stdout.write(chalk.dim(`  Fingerprint:  ${status.primaryKeyFingerprint}\n`));
+    process.stdout.write(chalk.dim(`  Key source:   ${status.source === "env" ? "environment variable" : "key file on this computer"}\n`));
+    if (status.hasOldKey) {
+        process.stdout.write(chalk.dim(`  Old key:      present (key rotation in progress)\n`));
+    }
+    return 0;
+}
+export async function runEncryptInit(opts = {}) {
+    const hex = generateMasterKeyHex();
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, key: hex }, null, 2)}\n`);
+        return 0;
+    }
+    process.stdout.write(`${chalk.green("✓")} Generated a fresh master encryption key.\n\n`);
+    process.stdout.write(`  ${chalk.bold(hex)}\n\n`);
+    process.stdout.write(chalk.dim(`Activate it by setting BRIGADE_ENCRYPTION_KEY in your environment:\n\n`));
+    if (process.platform === "win32") {
+        process.stdout.write(`  ${chalk.bold(`$env:BRIGADE_ENCRYPTION_KEY = "${hex}"`)}   (PowerShell)\n`);
+    }
+    else {
+        process.stdout.write(`  ${chalk.bold(`export BRIGADE_ENCRYPTION_KEY=${hex}`)}\n`);
+    }
+    process.stdout.write(chalk.dim(`\nKeep this key safe. Without it you can't decrypt your existing Convex data.\n` +
+        `We do NOT save it to disk. Add it to your password manager / 1Password / Vault.\n` +
+        `Rotate later with: BRIGADE_ENCRYPTION_KEY_OLD=<current> BRIGADE_ENCRYPTION_KEY=<new>\n`));
+    return 0;
+}
+export async function runEncryptTest(opts = {}) {
+    const sample = `brigade-encrypt-test-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    try {
+        const sealed = sealString(sample);
+        const opened = openToString(sealed);
+        const ok = opened === sample;
+        const result = {
+            ok,
+            encryptionEnabled: isEncryptionEnabled(),
+            sampleBytes: sealed.byteLength,
+            roundTrip: ok,
+        };
+        if (opts.json) {
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+            return ok ? 0 : 1;
+        }
+        if (ok) {
+            process.stdout.write(`${chalk.green("✓")} encryption round-trip succeeded\n`);
+            process.stdout.write(chalk.dim(`  Mode:         ${result.encryptionEnabled ? "encrypted" : "passthrough (no key set)"}\n` +
+                `  Sample bytes: ${result.sampleBytes}\n`));
+        }
+        else {
+            process.stdout.write(`${chalk.red("✗")} round-trip MISMATCH — your data may be corrupt\n`);
+        }
+        return ok ? 0 : 1;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (opts.json) {
+            process.stdout.write(`${JSON.stringify({ ok: false, error: msg }, null, 2)}\n`);
+        }
+        else {
+            process.stdout.write(`${chalk.red("✗")} ${msg}\n`);
+        }
+        return 1;
+    }
+}
+export function registerEncryptCommand(program) {
+    const enc = program
+        .command("encrypt")
+        .description("Manage Brigade's at-rest encryption key (AES-256-GCM)");
+    enc
+        .command("status")
+        .description("Report whether the encryption key is configured + run a self-check")
+        .option("--json", "emit JSON instead of human text", false)
+        .action(async (opts) => {
+        process.exit(await runEncryptStatus(opts));
+    });
+    enc
+        .command("init")
+        .description("Generate a fresh 32-byte master key (prints to stdout; YOU save it securely)")
+        .option("--json", "emit JSON instead of human text", false)
+        .action(async (opts) => {
+        process.exit(await runEncryptInit(opts));
+    });
+    enc
+        .command("test")
+        .description("Round-trip a sample string through seal/open to confirm the key is good")
+        .option("--json", "emit JSON instead of human text", false)
+        .action(async (opts) => {
+        process.exit(await runEncryptTest(opts));
+    });
+}
+//# sourceMappingURL=encrypt-cmd.js.map

package/dist/cli/commands/encrypt-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt-cmd.js","sourceRoot":"","sources":["../../../src/cli/commands/encrypt-cmd.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,iEAAiE;AAEjE,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EACN,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,mBAAmB,GACnB,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA2B,EAAE;IACnE,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,KAAK,CAAC,GAAG,CACR,iEAAiE;YAChE,0EAA0E;YAC1E,oBAAoB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAC3D,CACD,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,qBAAqB,IAAI,CAAC,CAAC,CAAC;IACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,KAAK,CAAC,GAAG,CACR,mBAAmB,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,2BAA2B,IAAI,CACrG,CACD,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA2B,EAAE;IACjE,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IACzF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,kCAAkC,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpG,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAC7B,iFAAiF;QAChF,mFAAmF;QACnF,wFAAwF,CACzF,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,wBAAwB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,KAAK,MAAM,CAAC;QAC7B,MAAM,MAAM,GAAG;YACd,EAAE;YACF,iBAAiB,EAAE,mBAAmB,EAAE;YACxC,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,SAAS,EAAE,EAAE;SACb,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,KAAK,CAAC,GAAG,CACR,mBAAmB,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,0BAA0B,IAAI;gBACzF,mBAAmB,MAAM,CAAC,WAAW,IAAI,CAC1C,CACD,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC;IACV,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACtD,MAAM,GAAG,GAAG,OAAO;SACjB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,uDAAuD,CAAC,CAAC;IAEvE,GAAG;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,oEAAoE,CAAC;SACjF,MAAM,CAAC,QAAQ,EAAE,iCAAiC,EAAE,KAAK,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,GAAG;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8EAA8E,CAAC;SAC3F,MAAM,CAAC,QAAQ,EAAE,iCAAiC,EAAE,KAAK,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEJ,GAAG;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,QAAQ,EAAE,iCAAiC,EAAE,KAAK,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/exec-cmd.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `brigade exec <list|allow|allow-pattern|remove|deny-test|file>` — CRUD over
+ * a per-agent exec-approvals allowlist that gates `bash` tool calls. The
+ * allowlist file lives at `<agentDir>/exec-approvals.json` and is consulted
+ * at every tool-call boundary by `src/agents/exec-gate.ts`.
+ *
+ * Pass `--agent <id>` to target a non-default agent's allowlist; without the
+ * flag the canonical default agent ("main") is used.
+ *
+ * v1 shape (per-agent, file-backed):
+ *   - exact-command approvals: the literal command string must match (after
+ *     trim) for the gate to allow.
+ *   - pattern approvals: operator-supplied regex; gate skips malformed
+ *     regexes rather than crashing.
+ *   - hard-deny patterns (rm -rf /, dd to raw disk, fork bomb, etc.) are
+ *     coded into `exec-approvals.ts` and CANNOT be allowlisted. Operators
+ *     can verify a command's classification via `brigade exec deny-test`.
+ */
+export interface ExecListOptions {
+    json?: boolean;
+    /** Agent id whose allowlist to inspect — defaults to the canonical agent. */
+    agentId?: string;
+}
+export interface ExecAllowOptions {
+    json?: boolean;
+    /** Agent id whose allowlist to mutate — defaults to the canonical agent. */
+    agentId?: string;
+}
+export interface ExecAllowPatternOptions {
+    json?: boolean;
+    /** Agent id whose allowlist to mutate — defaults to the canonical agent. */
+    agentId?: string;
+}
+export interface ExecRemoveOptions {
+    json?: boolean;
+    /** Agent id whose allowlist to mutate — defaults to the canonical agent. */
+    agentId?: string;
+}
+export interface ExecDenyTestOptions {
+    json?: boolean;
+    /** Agent id whose allowlist to consult — defaults to the canonical agent. */
+    agentId?: string;
+}
+export interface ExecFileOptions {
+    json?: boolean;
+    /** Agent id whose allowlist path to print — defaults to the canonical agent. */
+    agentId?: string;
+}
+export declare function runExecList(opts?: ExecListOptions): Promise<number>;
+export declare function runExecAllow(rawCommand: string, opts?: ExecAllowOptions): Promise<number>;
+export declare function runExecAllowPattern(rawPattern: string, opts?: ExecAllowPatternOptions): Promise<number>;
+export declare function runExecRemove(rawValue: string, opts?: ExecRemoveOptions): Promise<number>;
+export declare function runExecDenyTest(rawCommand: string, opts?: ExecDenyTestOptions): Promise<number>;
+export declare function runExecFile(opts?: ExecFileOptions): Promise<number>;
+//# sourceMappingURL=exec-cmd.d.ts.map

package/dist/cli/commands/exec-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-cmd.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/exec-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAcH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,uBAAuB;IACvC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,iBAAiB;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,mBAAmB;IACnC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AA0CD,wBAAsB,WAAW,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C7E;AAID,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCnG;AAID,wBAAsB,mBAAmB,CACxC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,uBAA4B,GAChC,OAAO,CAAC,MAAM,CAAC,CAwCjB;AAID,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCnG;AAID,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzG;AAID,wBAAsB,WAAW,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAS7E"}

package/dist/cli/commands/exec-cmd.js

@@ -0,0 +1,253 @@
+/**
+ * `brigade exec <list|allow|allow-pattern|remove|deny-test|file>` — CRUD over
+ * a per-agent exec-approvals allowlist that gates `bash` tool calls. The
+ * allowlist file lives at `<agentDir>/exec-approvals.json` and is consulted
+ * at every tool-call boundary by `src/agents/exec-gate.ts`.
+ *
+ * Pass `--agent <id>` to target a non-default agent's allowlist; without the
+ * flag the canonical default agent ("main") is used.
+ *
+ * v1 shape (per-agent, file-backed):
+ *   - exact-command approvals: the literal command string must match (after
+ *     trim) for the gate to allow.
+ *   - pattern approvals: operator-supplied regex; gate skips malformed
+ *     regexes rather than crashing.
+ *   - hard-deny patterns (rm -rf /, dd to raw disk, fork bomb, etc.) are
+ *     coded into `exec-approvals.ts` and CANNOT be allowlisted. Operators
+ *     can verify a command's classification via `brigade exec deny-test`.
+ */
+import chalk from "chalk";
+import { BrigadeApprovalRefusedError, decideApproval, getApprovalsFilePath, recordApproval, removeApproval, } from "../../core/exec-approvals.js";
+import { DEFAULT_AGENT_ID } from "../../config/paths.js";
+import * as fs from "node:fs";
+function resolveAgentId(agentId) {
+    const trimmed = (agentId ?? "").trim();
+    return trimmed.length > 0 ? trimmed : DEFAULT_AGENT_ID;
+}
+/**
+ * Read the raw file shape for the `list` view. UNLIKE `loadApprovals` in
+ * exec-approvals.ts, this does NOT enforce schema v1 — `list` is the
+ * operator's inspection tool, so we show whatever's on disk so they can
+ * diagnose a future-version file or a corrupted entry. Returns null if
+ * the file can't be read or parsed at all.
+ */
+function readApprovalsRaw(agentId) {
+    const filePath = getApprovalsFilePath(agentId);
+    try {
+        const raw = fs.readFileSync(filePath, "utf8");
+        if (raw.trim().length === 0)
+            return { version: 1, commands: [], patterns: [] };
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return { version: 1, commands: [], patterns: [] };
+        }
+        const obj = parsed;
+        return {
+            version: typeof obj.version === "number" ? obj.version : 1,
+            commands: Array.isArray(obj.commands) ? obj.commands.filter((s) => typeof s === "string") : [],
+            patterns: Array.isArray(obj.patterns) ? obj.patterns.filter((s) => typeof s === "string") : [],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/* ───────────────────────── list ───────────────────────── */
+export async function runExecList(opts = {}) {
+    const agentId = resolveAgentId(opts.agentId);
+    const approvals = readApprovalsRaw(agentId) ?? { version: 1, commands: [], patterns: [] };
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ agentId, ...approvals }, null, 2)}\n`);
+        return 0;
+    }
+    process.stdout.write(`${chalk.bold("exec-approvals")} ${chalk.dim(`(agent: ${agentId})`)} (${getApprovalsFilePath(agentId)})\n`);
+    // Surface a future-version file inline — operator sees the data they have
+    // AND the warning that the gate refuses to operate on it.
+    if (approvals.version !== 1) {
+        process.stdout.write(`${chalk.yellow("⚠ schema version:")} file declares v${approvals.version}; this Brigade build only understands v1.\n`);
+        process.stdout.write(`${chalk.dim("  the gate REFUSES to operate on a future-version file. Move it aside and re-approve:")}\n`);
+        process.stdout.write(`${chalk.dim(`  mv "${getApprovalsFilePath(agentId)}" "${getApprovalsFilePath(agentId)}.from-v${approvals.version}.bak"`)}\n`);
+    }
+    if (approvals.commands.length === 0 && approvals.patterns.length === 0) {
+        process.stdout.write(`${chalk.dim("  (empty — every bash command will be refused until you approve one)")}\n`);
+        process.stdout.write(`${chalk.dim("  add an exact command:   brigade exec allow \"ls -la\"")}\n`);
+        process.stdout.write(`${chalk.dim("  add a regex pattern:    brigade exec allow-pattern \"^git (status|diff)( |$)\"")}\n`);
+        return 0;
+    }
+    if (approvals.commands.length > 0) {
+        process.stdout.write(`${chalk.green("commands:")} (${approvals.commands.length})\n`);
+        for (const c of approvals.commands)
+            process.stdout.write(`  ${c}\n`);
+    }
+    if (approvals.patterns.length > 0) {
+        process.stdout.write(`${chalk.green("patterns:")} (${approvals.patterns.length})\n`);
+        for (const p of approvals.patterns)
+            process.stdout.write(`  /${p}/\n`);
+    }
+    return 0;
+}
+/* ───────────────────────── allow ───────────────────────── */
+export async function runExecAllow(rawCommand, opts = {}) {
+    const agentId = resolveAgentId(opts.agentId);
+    const cmd = rawCommand.trim();
+    if (!cmd) {
+        writeError(opts.json, "brigade exec: command is empty", { code: "empty" });
+        return 1;
+    }
+    // Surface hard-deny patterns BEFORE writing.
+    if (decideApproval(cmd, agentId) === "deny") {
+        writeError(opts.json, `brigade exec: "${cmd}" matches a hard-deny pattern and cannot be allowlisted`, {
+            code: "hard-denied",
+            command: cmd,
+        });
+        process.stderr.write(`${chalk.dim("  hard-deny patterns are coded into Brigade for safety (rm -rf /, dd to raw disk, fork bomb, etc.).")}\n`);
+        return 1;
+    }
+    try {
+        recordApproval(cmd, "exact", agentId);
+    }
+    catch (err) {
+        if (err instanceof BrigadeApprovalRefusedError) {
+            writeError(opts.json, `brigade exec: ${err.message}`, { code: "refused", command: cmd });
+            return 1;
+        }
+        throw err;
+    }
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, kind: "exact", command: cmd, agentId }, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${chalk.green("allowed")} (exact, agent ${agentId}): ${cmd}\n`);
+    }
+    return 0;
+}
+/* ───────────────────────── allow-pattern ───────────────────────── */
+export async function runExecAllowPattern(rawPattern, opts = {}) {
+    const agentId = resolveAgentId(opts.agentId);
+    const pat = rawPattern.trim();
+    if (!pat) {
+        writeError(opts.json, "brigade exec: pattern is empty", { code: "empty" });
+        return 1;
+    }
+    try {
+        // eslint-disable-next-line no-new
+        new RegExp(pat);
+    }
+    catch (err) {
+        writeError(opts.json, `brigade exec: invalid regex pattern: ${err.message}`, {
+            code: "invalid-regex",
+            pattern: pat,
+        });
+        return 1;
+    }
+    try {
+        recordApproval(pat, "pattern", agentId);
+    }
+    catch (err) {
+        if (err instanceof BrigadeApprovalRefusedError) {
+            writeError(opts.json, `brigade exec: ${err.message}`, { code: "refused", pattern: pat });
+            return 1;
+        }
+        throw err;
+    }
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, kind: "pattern", pattern: pat, agentId }, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${chalk.green("allowed")} (pattern, agent ${agentId}): /${pat}/\n`);
+        if (!pat.startsWith("^")) {
+            process.stdout.write(`${chalk.dim("  note: pattern does not start with `^` — it matches anywhere in the command line.")}\n`);
+            process.stdout.write(`${chalk.dim(`        if you meant "the command line starts with this", use ${JSON.stringify(`^${pat}`)} instead.`)}\n`);
+        }
+    }
+    return 0;
+}
+/* ───────────────────────── remove ───────────────────────── */
+export async function runExecRemove(rawValue, opts = {}) {
+    const agentId = resolveAgentId(opts.agentId);
+    const value = rawValue.trim();
+    if (!value) {
+        writeError(opts.json, "brigade exec: command/pattern is empty", { code: "empty" });
+        return 1;
+    }
+    let result;
+    try {
+        result = removeApproval(value, agentId);
+    }
+    catch (err) {
+        if (err instanceof BrigadeApprovalRefusedError) {
+            writeError(opts.json, `brigade exec: ${err.message}`, { code: "refused", value });
+            return 1;
+        }
+        throw err;
+    }
+    const { removedCommands, removedPatterns } = result;
+    if (removedCommands === 0 && removedPatterns === 0) {
+        writeError(opts.json, `brigade exec: "${value}" not found in commands or patterns`, {
+            code: "not-found",
+            value,
+        });
+        return 1;
+    }
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, removedCommands, removedPatterns, agentId }, null, 2)}\n`);
+    }
+    else {
+        const parts = [];
+        if (removedCommands > 0)
+            parts.push(`${removedCommands} command(s)`);
+        if (removedPatterns > 0)
+            parts.push(`${removedPatterns} pattern(s)`);
+        process.stdout.write(`${chalk.yellow("removed")} (agent ${agentId}): ${parts.join(", ")} matching "${value}"\n`);
+    }
+    return 0;
+}
+/* ───────────────────────── deny-test ───────────────────────── */
+export async function runExecDenyTest(rawCommand, opts = {}) {
+    const agentId = resolveAgentId(opts.agentId);
+    const cmd = rawCommand.trim();
+    if (!cmd) {
+        writeError(opts.json, "brigade exec: command is empty", { code: "empty" });
+        return 1;
+    }
+    const decision = decideApproval(cmd, agentId);
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ command: cmd, decision, agentId }, null, 2)}\n`);
+        return 0;
+    }
+    const colored = decision === "allow"
+        ? chalk.green("allow")
+        : decision === "deny"
+            ? chalk.red("deny")
+            : chalk.yellow("prompt");
+    process.stdout.write(`${cmd} → ${colored} ${chalk.dim(`(agent ${agentId})`)}\n`);
+    if (decision === "prompt") {
+        process.stdout.write(`${chalk.dim("  approve with:  brigade exec allow ")}${JSON.stringify(cmd)}\n`);
+    }
+    if (decision === "deny") {
+        process.stdout.write(`${chalk.dim("  this command matches a hard-deny pattern and CANNOT be allowlisted.")}\n`);
+    }
+    return 0;
+}
+/* ───────────────────────── file ───────────────────────── */
+export async function runExecFile(opts = {}) {
+    const agentId = resolveAgentId(opts.agentId);
+    const filePath = getApprovalsFilePath(agentId);
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ path: filePath, agentId }, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${filePath}\n`);
+    }
+    return 0;
+}
+/* ───────────────────────── helpers ───────────────────────── */
+function writeError(json, message, details) {
+    if (json) {
+        process.stderr.write(`${JSON.stringify({ ok: false, error: message, ...details }, null, 2)}\n`);
+    }
+    else {
+        process.stderr.write(`${chalk.red(message)}\n`);
+    }
+}
+//# sourceMappingURL=exec-cmd.js.map

package/dist/cli/commands/exec-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-cmd.js","sourceRoot":"","sources":["../../../src/cli/commands/exec-cmd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACN,2BAA2B,EAC3B,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,cAAc,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAuC9B,SAAS,cAAc,CAAC,OAA2B;IAClD,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,MAAqC,CAAC;QAClD,OAAO;YACN,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1D,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YAC9F,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,8DAA8D;AAE9D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB,EAAE;IAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1F,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,OAAO,GAAG,CAAC,KAAK,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAC1G,CAAC;IACF,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,SAAS,CAAC,OAAO,6CAA6C,CACrH,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,uFAAuF,CAAC,IAAI,CACzG,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,oBAAoB,CAAC,OAAO,CAAC,MAAM,oBAAoB,CAAC,OAAO,CAAC,UAAU,SAAS,CAAC,OAAO,OAAO,CAAC,IAAI,CAC7H,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,sEAAsE,CAAC,IAAI,CACxF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,IAAI,CAC3E,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,kFAAkF,CAAC,IAAI,CACpG,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QACrF,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QACrF,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,+DAA+D;AAE/D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,OAAyB,EAAE;IACjF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gCAAgC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACV,CAAC;IACD,6CAA6C;IAC7C,IAAI,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,yDAAyD,EAAE;YACrG,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,qGAAqG,CAAC,IAAI,CACvH,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QACJ,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACzF,OAAO,CAAC,CAAC;QACV,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1G,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,kBAAkB,OAAO,MAAM,GAAG,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,uEAAuE;AAEvE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,UAAkB,EAClB,OAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gCAAgC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QACJ,kCAAkC;QAClC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,wCAAyC,GAAa,CAAC,OAAO,EAAE,EAAE;YACvF,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QACJ,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACzF,OAAO,CAAC,CAAC;QACV,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,OAAO,OAAO,GAAG,KAAK,CAAC,CAAC;QAC1F,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,oFAAoF,CAAC,IAAI,CACtG,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,iEAAiE,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CACvH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,gEAAgE;AAEhE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,OAA0B,EAAE;IACjF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,wCAAwC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,MAA4D,CAAC;IACjE,IAAI,CAAC;QACJ,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,CAAC;QACV,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IACD,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IACpD,IAAI,eAAe,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QACpD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,KAAK,qCAAqC,EAAE;YACnF,IAAI,EAAE,WAAW;YACjB,KAAK;SACL,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACvF,CAAC;IACH,CAAC;SAAM,CAAC;QACP,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,eAAe,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,aAAa,CAAC,CAAC;QACrE,IAAI,eAAe,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,aAAa,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,mEAAmE;AAEnE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB,EAAE,OAA4B,EAAE;IACvF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gCAAgC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACV,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,OAAO,CAAC,CAAC;IACV,CAAC;IACD,MAAM,OAAO,GACZ,QAAQ,KAAK,OAAO;QACnB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QACtB,CAAC,CAAC,QAAQ,KAAK,MAAM;YACpB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YACnB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAC9E,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,IAAI,CACzF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,8DAA8D;AAE9D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB,EAAE;IAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,iEAAiE;AAEjE,SAAS,UAAU,CAClB,IAAyB,EACzB,OAAe,EACf,OAAgC;IAEhC,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjG,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;AACF,CAAC"}

package/dist/cli/commands/gateway-install.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `brigade gateway install / uninstall / restart` — register Brigade as an OS
+ * service so the gateway survives reboots and crashes.
+ *
+ * Platform mapping:
+ *   - macOS  → launchd LaunchAgent
+ *   - Linux  → systemd user unit
+ *   - Windows→ Task Scheduler (XML-defined, restart-on-failure)
+ *
+ * The supervisor IS the restart loop; Brigade doesn't try to babysit itself.
+ */
+export declare function runGatewayInstall(opts?: {
+    json?: boolean;
+}): Promise<number>;
+export declare function runGatewayUninstall(opts?: {
+    json?: boolean;
+}): Promise<number>;
+export declare function runGatewayRestart(opts?: {
+    json?: boolean;
+}): Promise<number>;
+//# sourceMappingURL=gateway-install.d.ts.map

package/dist/cli/commands/gateway-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-install.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/gateway-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CActF;AAED,wBAAsB,mBAAmB,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAaxF;AAED,wBAAsB,iBAAiB,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAatF"}

package/dist/cli/commands/gateway-install.js

@@ -0,0 +1,71 @@
+/**
+ * `brigade gateway install / uninstall / restart` — register Brigade as an OS
+ * service so the gateway survives reboots and crashes.
+ *
+ * Platform mapping:
+ *   - macOS  → launchd LaunchAgent
+ *   - Linux  → systemd user unit
+ *   - Windows→ Task Scheduler (XML-defined, restart-on-failure)
+ *
+ * The supervisor IS the restart loop; Brigade doesn't try to babysit itself.
+ */
+import { buildServiceContext, resolveServiceAdapter } from "../../core/daemon/service.js";
+export async function runGatewayInstall(opts = {}) {
+    try {
+        const adapter = await resolveServiceAdapter();
+        const ctx = buildServiceContext();
+        const result = await adapter.install(ctx);
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+        else
+            process.stdout.write(`${result.message}\n`);
+        return result.ok ? 0 : 1;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify({ ok: false, reason: msg })}\n`);
+        else
+            process.stderr.write(`${msg}\n`);
+        return 1;
+    }
+}
+export async function runGatewayUninstall(opts = {}) {
+    try {
+        const adapter = await resolveServiceAdapter();
+        const result = await adapter.uninstall();
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+        else
+            process.stdout.write(`${result.message}\n`);
+        return result.ok ? 0 : 1;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify({ ok: false, reason: msg })}\n`);
+        else
+            process.stderr.write(`${msg}\n`);
+        return 1;
+    }
+}
+export async function runGatewayRestart(opts = {}) {
+    try {
+        const adapter = await resolveServiceAdapter();
+        const result = await adapter.restart();
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+        else
+            process.stdout.write(`${result.message}\n`);
+        return result.ok ? 0 : 1;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify({ ok: false, reason: msg })}\n`);
+        else
+            process.stderr.write(`${msg}\n`);
+        return 1;
+    }
+}
+//# sourceMappingURL=gateway-install.js.map

package/dist/cli/commands/gateway-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-install.js","sourceRoot":"","sources":["../../../src/cli/commands/gateway-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA2B,EAAE;IACpE,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;;YACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;;YAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACV,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA2B,EAAE;IACtE,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;;YACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;;YAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACV,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA2B,EAAE;IACpE,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;;YACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;;YAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACV,CAAC;AACF,CAAC"}