@spinabot/brigade 0.1.2 → 1.0.1

package/dist/cli/commands/pairing.js

@@ -0,0 +1,155 @@
+/**
+ * `brigade pairing …` — approve/revoke pending pairing codes.
+ *
+ * When `channels.<id>.dmPolicy` is `pairing` (the default), a stranger DMing
+ * the bot gets an 8-char code in the reply and asks the operator to approve
+ * it. The operator runs `brigade pairing approve <CODE>` here, which moves
+ * the sender from "pending" to the channel's allow-from list — subsequent DMs
+ * from that sender reach the agent.
+ *
+ * Channel resolution mirrors `brigade channels …` (auto-pick when only one
+ * channel is available).
+ */
+import { BUNDLED_MODULES, loadModules } from "../../agents/extensions/index.js";
+import { approvePairingCode, readPendingPairings, revokePairingCode } from "../../agents/channels/access-control/index.js";
+import { DEFAULT_AGENT_ID, resolveAgentWorkspaceDir } from "../../config/paths.js";
+import { loadConfig } from "../../core/config.js";
+/**
+ * Test injection hook — overrides the channel registry so unit tests can
+ * drive `pairing approve` against a fake adapter (with a spy `notifyApproval`)
+ * without depending on bundled modules. Production callers leave this
+ * `undefined`; tests set it in `beforeEach` and clear it in `afterEach`.
+ */
+let testChannelOverride;
+/** @internal — tests only. */
+export function __setPairingChannelsForTests(channels) {
+    testChannelOverride = channels;
+}
+/**
+ * Resolve the channel id; either auto-picked (single channel) or named.
+ * Also returns the adapter so callers that need to invoke per-channel
+ * pairing hooks (`notifyApproval`) don't have to re-load the module
+ * registry a second time.
+ */
+async function resolveChannel(wanted) {
+    let adapters;
+    if (testChannelOverride) {
+        adapters = testChannelOverride;
+    }
+    else {
+        const config = loadConfig();
+        const workspaceDir = resolveAgentWorkspaceDir(DEFAULT_AGENT_ID);
+        const registry = await loadModules({
+            modules: BUNDLED_MODULES,
+            meta: { agentId: DEFAULT_AGENT_ID, workspaceDir, cwd: workspaceDir, config: config },
+        });
+        adapters = registry.channels;
+    }
+    if (adapters.length === 0) {
+        process.stderr.write("No channels are bundled or installed.\n");
+        return { error: 2 };
+    }
+    if (wanted) {
+        const found = adapters.find((c) => c.id === wanted);
+        if (!found) {
+            process.stderr.write(`Unknown channel "${wanted}" (have: ${adapters.map((c) => c.id).join(", ")}).\n`);
+            return { error: 2 };
+        }
+        return { id: found.id, adapter: found };
+    }
+    if (adapters.length === 1) {
+        const sole = adapters[0];
+        return { id: sole.id, adapter: sole };
+    }
+    process.stderr.write(`More than one channel is available — pick one with --channel <id> (have: ${adapters.map((c) => c.id).join(", ")}).\n`);
+    return { error: 2 };
+}
+/** Back-compat helper for existing call sites that only need the id. */
+async function resolveChannelId(wanted) {
+    const r = await resolveChannel(wanted);
+    if ("error" in r)
+        return { error: r.error };
+    return { id: r.id };
+}
+/* ─────────────────────────── pairing list ─────────────────────────── */
+export async function runPairingList(args, opts = {}) {
+    const resolved = await resolveChannelId(args.channel);
+    if ("error" in resolved)
+        return resolved.error;
+    const pending = readPendingPairings(resolved.id);
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ channel: resolved.id, pending }, null, 2)}\n`);
+        return 0;
+    }
+    if (pending.length === 0) {
+        process.stdout.write(`No pending pairing codes for ${resolved.id}.\n`);
+        return 0;
+    }
+    const header = `${"CODE".padEnd(10)} ${"SENDER".padEnd(28)} ${"NAME".padEnd(20)} CREATED`;
+    process.stdout.write(`${header}\n`);
+    for (const r of pending) {
+        const line = `${r.code.padEnd(10)} ${r.senderId.padEnd(28)} ${(r.senderName ?? "—").padEnd(20)} ${r.createdAt}`;
+        process.stdout.write(`${line}\n`);
+    }
+    return 0;
+}
+/* ─────────────────────────── pairing approve ─────────────────────────── */
+export async function runPairingApprove(args, opts = {}) {
+    const resolved = await resolveChannel(args.channel);
+    if ("error" in resolved)
+        return resolved.error;
+    const approved = approvePairingCode(resolved.id, args.code);
+    if (!approved) {
+        const msg = `Unknown or expired pairing code for ${resolved.id}.`;
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify({ ok: false, reason: msg })}\n`);
+        else
+            process.stderr.write(`${msg}\n`);
+        return 1;
+    }
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, channel: resolved.id, sender: approved.senderId }, null, 2)}\n`);
+    }
+    else {
+        const who = approved.senderName ? `${approved.senderName} (${approved.senderId})` : approved.senderId;
+        process.stdout.write(`Approved ${who} on ${resolved.id}. They can now DM the agent.\n`);
+    }
+    // Best-effort in-channel confirmation — when the channel adapter declares
+    // a `pairing.notifyApproval` hook, fire it so the requester sees a
+    // "you're approved" reply in-channel. Failures here are non-fatal: the
+    // approval already landed in the on-disk allow-list, the operator
+    // already saw the CLI confirmation. WhatsApp currently omits this
+    // hook (no slot wired); Slack/Discord channels will fill it in.
+    const notify = resolved.adapter.pairing?.notifyApproval;
+    if (notify) {
+        try {
+            await notify({ senderId: approved.senderId, senderName: approved.senderName });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`Warning: failed to notify approved sender in-channel (${msg}).\n`);
+        }
+    }
+    return 0;
+}
+/* ─────────────────────────── pairing revoke ─────────────────────────── */
+export async function runPairingRevoke(args, opts = {}) {
+    const resolved = await resolveChannelId(args.channel);
+    if ("error" in resolved)
+        return resolved.error;
+    const dropped = revokePairingCode(resolved.id, args.code);
+    if (!dropped) {
+        const msg = `No matching pending code on ${resolved.id}.`;
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify({ ok: false, reason: msg })}\n`);
+        else
+            process.stderr.write(`${msg}\n`);
+        return 1;
+    }
+    if (opts.json)
+        process.stdout.write(`${JSON.stringify({ ok: true, channel: resolved.id })}\n`);
+    else
+        process.stdout.write(`Pending code revoked on ${resolved.id}.\n`);
+    return 0;
+}
+//# sourceMappingURL=pairing.js.map

package/dist/cli/commands/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../../src/cli/commands/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AAC3H,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD;;;;;GAKG;AACH,IAAI,mBAAiD,CAAC;AAEtD,8BAA8B;AAC9B,MAAM,UAAU,4BAA4B,CAAC,QAAsC;IAClF,mBAAmB,GAAG,QAAQ,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC5B,MAA0B;IAE1B,IAAI,QAA0B,CAAC;IAC/B,IAAI,mBAAmB,EAAE,CAAC;QACzB,QAAQ,GAAG,mBAAmB,CAAC;IAChC,CAAC;SAAM,CAAC;QACP,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;YAClC,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAe,EAAE;SAC7F,CAAC,CAAC;QACH,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,YAAY,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAmB,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,4EAA4E,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CACtH,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,gBAAgB,CAAC,MAA0B;IACzD,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5C,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;AACrB,CAAC;AAED,0EAA0E;AAE1E,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,IAA0B,EAC1B,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC;IACV,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC;IAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,6EAA6E;AAE7E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAwC,EACxC,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,uCAAuC,QAAQ,CAAC,EAAE,GAAG,CAAC;QAClE,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;;YAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACrH,CAAC;SAAM,CAAC;QACP,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,OAAO,QAAQ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACzF,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC;IACxD,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,GAAG,MAAM,CAAC,CAAC;QAC1F,CAAC;IACF,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,IAAwC,EACxC,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,+BAA+B,QAAQ,CAAC,EAAE,GAAG,CAAC;QAC1D,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;;YAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC;AACV,CAAC"}

package/dist/cli/commands/secrets-audit.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `brigade secrets audit` — find leaked-key risk under ~/.brigade.
+ *
+ * Walks the state dir, applies plain-text regex patterns for the API-key shapes
+ * Brigade depends on, and reports any matches. Exits non-zero on findings so
+ * CI / cron / preflight scripts can gate.
+ *
+ * Pure best-effort: false positives are expected (an API key in an example
+ * comment will match too). The point is to give operators a "did I leak a key"
+ * answer in one command, not a perfect scanner.
+ */
+export declare function runSecretsAudit(args: {
+    strict?: boolean;
+}, opts?: {
+    json?: boolean;
+}): Promise<number>;
+//# sourceMappingURL=secrets-audit.d.ts.map

package/dist/cli/commands/secrets-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-audit.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/secrets-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA4EH,wBAAsB,eAAe,CACpC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC1B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,MAAM,CAAC,CA0BjB"}

package/dist/cli/commands/secrets-audit.js

@@ -0,0 +1,109 @@
+/**
+ * `brigade secrets audit` — find leaked-key risk under ~/.brigade.
+ *
+ * Walks the state dir, applies plain-text regex patterns for the API-key shapes
+ * Brigade depends on, and reports any matches. Exits non-zero on findings so
+ * CI / cron / preflight scripts can gate.
+ *
+ * Pure best-effort: false positives are expected (an API key in an example
+ * comment will match too). The point is to give operators a "did I leak a key"
+ * answer in one command, not a perfect scanner.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import path from "node:path";
+import { resolveStateDir } from "../../config/paths.js";
+const PATTERNS = [
+    { name: "anthropic-key", re: /sk-ant-[a-z0-9-_]{30,}/i },
+    { name: "openai-key", re: /sk-(?:proj-)?[A-Za-z0-9]{32,}/ },
+    { name: "google-key", re: /AIza[0-9A-Za-z\-_]{30,}/ },
+    { name: "aws-access-key", re: /AKIA[0-9A-Z]{16}/ },
+    { name: "bearer-token-long", re: /Bearer\s+[A-Za-z0-9._-]{30,}/i },
+    { name: "generic-secret-line", re: /\b(?:secret|api[_-]?key|token|password)\s*[:=]\s*['"]?[A-Za-z0-9._\-+/=]{24,}/i },
+];
+// Don't scan these — they're huge + redundant.
+const SKIP_DIRS = new Set(["cache", "logs"]);
+const SKIP_FILE_RE = /\.bak(\.\d+)?$|\.clobbered\.\d+$|\.lock$/;
+const MAX_FILE_BYTES = 2 * 1024 * 1024; // skip giant files (likely binary)
+function* walk(root) {
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let names;
+        try {
+            names = readdirSync(dir);
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            if (SKIP_DIRS.has(name))
+                continue;
+            if (SKIP_FILE_RE.test(name))
+                continue;
+            const full = path.join(dir, name);
+            let st;
+            try {
+                st = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory())
+                stack.push(full);
+            else if (st.isFile() && st.size <= MAX_FILE_BYTES)
+                yield full;
+        }
+    }
+}
+function scanFile(file) {
+    let text;
+    try {
+        text = readFileSync(file, "utf8");
+    }
+    catch {
+        return [];
+    }
+    // Cheap binary-file sniff: a NUL byte in the first 1KB → skip.
+    if (text.slice(0, 1024).includes("\0"))
+        return [];
+    const out = [];
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] ?? "";
+        for (const { name, re } of PATTERNS) {
+            if (re.test(line)) {
+                out.push({ file, line: i + 1, pattern: name, excerpt: line.trim().slice(0, 160) });
+            }
+        }
+    }
+    return out;
+}
+export async function runSecretsAudit(args, opts = {}) {
+    const root = resolveStateDir();
+    if (!existsSync(root)) {
+        process.stdout.write(`Nothing to scan — ${root} doesn't exist.\n`);
+        return 0;
+    }
+    const matches = [];
+    for (const file of walk(root)) {
+        for (const m of scanFile(file))
+            matches.push(m);
+    }
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ root, matches }, null, 2)}\n`);
+    }
+    else if (matches.length === 0) {
+        process.stdout.write(`No suspected secrets found under ${root}.\n`);
+    }
+    else {
+        process.stdout.write(`Found ${matches.length} suspected secret(s) under ${root}:\n`);
+        for (const m of matches) {
+            process.stdout.write(`  ${m.file}:${m.line} [${m.pattern}]  ${m.excerpt}\n`);
+        }
+        process.stdout.write("\nNot every match is a real leak (regex-based) — review each and either rotate the key or ignore.\n");
+    }
+    // `--strict` makes findings a non-zero exit (CI gate). Default behavior
+    // remains 0 so an audit doesn't break the shell pipeline by surprise.
+    return matches.length > 0 && args.strict ? 1 : 0;
+}
+//# sourceMappingURL=secrets-audit.js.map

package/dist/cli/commands/secrets-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-audit.js","sourceRoot":"","sources":["../../../src/cli/commands/secrets-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AASxD,MAAM,QAAQ,GAAmC;IAChD,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,yBAAyB,EAAE;IACxD,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,+BAA+B,EAAE;IAC3D,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,yBAAyB,EAAE;IACrD,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,kBAAkB,EAAE;IAClD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,+BAA+B,EAAE;IAClE,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,EAAE,gFAAgF,EAAE;CACrH,CAAC;AAEF,+CAA+C;AAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7C,MAAM,YAAY,GAAG,0CAA0C,CAAC;AAChE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,mCAAmC;AAE3E,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAY;IAC1B,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QAClC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACJ,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,EAA+B,CAAC;YACpC,IAAI,CAAC;gBACJ,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACR,SAAS;YACV,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBAClC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,cAAc;gBAAE,MAAM,IAAI,CAAC;QAC/D,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IACD,+DAA+D;IAC/D,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;YACrC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAA0B,EAC1B,OAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,mBAAmB,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC;IACV,CAAC;IACD,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,IAAI,KAAK,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,8BAA8B,IAAI,KAAK,CAAC,CAAC;QACrF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,qGAAqG,CACrG,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/cli/commands/sessions.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `brigade sessions list / cleanup` — daemon-grade transcript hygiene.
+ *
+ * Sessions live at `~/.brigade/agents/<agentId>/sessions/<sessionId>.jsonl` and
+ * are tracked in `sessions.json`. Over time idle sessions accumulate — this
+ * command lists them with size + mtime, and `cleanup --older-than <duration>`
+ * deletes the transcripts. The session-store entry isn't touched (the gateway
+ * regenerates it on next access).
+ */
+export declare function runSessionsList(args: {
+    agent?: string;
+}, opts?: {
+    json?: boolean;
+}): Promise<number>;
+export declare function runSessionsCleanup(args: {
+    agent?: string;
+    olderThan: string;
+    dryRun?: boolean;
+}, opts?: {
+    json?: boolean;
+}): Promise<number>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/cli/commands/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgDH,wBAAsB,eAAe,CACpC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACxB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED,wBAAsB,kBAAkB,CACvC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7D,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,MAAM,CAAC,CA2BjB"}

package/dist/cli/commands/sessions.js

@@ -0,0 +1,99 @@
+/**
+ * `brigade sessions list / cleanup` — daemon-grade transcript hygiene.
+ *
+ * Sessions live at `~/.brigade/agents/<agentId>/sessions/<sessionId>.jsonl` and
+ * are tracked in `sessions.json`. Over time idle sessions accumulate — this
+ * command lists them with size + mtime, and `cleanup --older-than <duration>`
+ * deletes the transcripts. The session-store entry isn't touched (the gateway
+ * regenerates it on next access).
+ */
+import { existsSync, readdirSync, rmSync, statSync } from "node:fs";
+import path from "node:path";
+import { DEFAULT_AGENT_ID, resolveSessionsDir } from "../../config/paths.js";
+function listSessions(agentId) {
+    const dir = resolveSessionsDir(agentId);
+    if (!existsSync(dir))
+        return [];
+    const now = Date.now();
+    const rows = [];
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith(".jsonl"))
+            continue;
+        const full = path.join(dir, name);
+        try {
+            const st = statSync(full);
+            rows.push({
+                sessionId: name.replace(/\.jsonl$/, ""),
+                bytes: st.size,
+                mtimeIso: new Date(st.mtimeMs).toISOString(),
+                ageDays: Math.floor((now - st.mtimeMs) / (1000 * 60 * 60 * 24)),
+            });
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    rows.sort((a, b) => Date.parse(b.mtimeIso) - Date.parse(a.mtimeIso));
+    return rows;
+}
+/** Parse a duration like "30d" / "12h" / "2w" into milliseconds. */
+function parseDuration(s) {
+    const m = s.match(/^(\d+)\s*(s|m|h|d|w)$/i);
+    if (!m)
+        return null;
+    const n = Number(m[1]);
+    const u = m[2]?.toLowerCase() ?? "d";
+    const mul = { s: 1_000, m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000 }[u] ?? 0;
+    return n * mul;
+}
+export async function runSessionsList(args, opts = {}) {
+    const agentId = args.agent ?? DEFAULT_AGENT_ID;
+    const rows = listSessions(agentId);
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ agent: agentId, sessions: rows }, null, 2)}\n`);
+        return 0;
+    }
+    if (rows.length === 0) {
+        process.stdout.write(`No sessions for agent "${agentId}".\n`);
+        return 0;
+    }
+    process.stdout.write(`${"SESSION".padEnd(38)} ${"AGE".padEnd(8)} ${"BYTES".padStart(10)}  MTIME\n`);
+    for (const r of rows) {
+        process.stdout.write(`${r.sessionId.padEnd(38)} ${`${r.ageDays}d`.padEnd(8)} ${String(r.bytes).padStart(10)}  ${r.mtimeIso}\n`);
+    }
+    return 0;
+}
+export async function runSessionsCleanup(args, opts = {}) {
+    const agentId = args.agent ?? DEFAULT_AGENT_ID;
+    const ms = parseDuration(args.olderThan);
+    if (ms == null) {
+        process.stderr.write(`--older-than must look like "30d" / "12h" / "2w" (got ${JSON.stringify(args.olderThan)}).\n`);
+        return 2;
+    }
+    const cutoff = Date.now() - ms;
+    const rows = listSessions(agentId).filter((r) => Date.parse(r.mtimeIso) < cutoff);
+    if (args.dryRun) {
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify({ wouldDelete: rows }, null, 2)}\n`);
+        else
+            process.stdout.write(`Would delete ${rows.length} session(s) older than ${args.olderThan}.\n`);
+        return 0;
+    }
+    let deleted = 0;
+    for (const r of rows) {
+        const full = path.join(resolveSessionsDir(agentId), `${r.sessionId}.jsonl`);
+        try {
+            rmSync(full, { force: true });
+            deleted++;
+        }
+        catch {
+            /* ignore individual delete failures */
+        }
+    }
+    if (opts.json)
+        process.stdout.write(`${JSON.stringify({ ok: true, deleted, candidates: rows.length })}\n`);
+    else
+        process.stdout.write(`Deleted ${deleted}/${rows.length} session transcript(s).\n`);
+    return 0;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/cli/commands/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/cli/commands/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAS7E,SAAS,YAAY,CAAC,OAAe;IACpC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;gBACvC,KAAK,EAAE,EAAE,CAAC,IAAI;gBACd,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;gBAC5C,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;aAC/D,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACR,YAAY;QACb,CAAC;IACF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC;IACrC,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAQ,CAAC,IAAI,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,GAAG,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAwB,EACxB,OAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC;IAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,OAAO,MAAM,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,CACzG,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,IAA6D,EAC7D,OAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC;IAC/C,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpH,OAAO,CAAC,CAAC;IACV,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;;YACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,MAAM,0BAA0B,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC;QAC5E,IAAI,CAAC;YACJ,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACR,uCAAuC;QACxC,CAAC;IACF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;;QACtG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,OAAO,IAAI,IAAI,CAAC,MAAM,2BAA2B,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC;AACV,CAAC"}

package/dist/cli/commands/skills.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `brigade skills list / info` — operator CLI introspection over Primitive #5.
+ *
+ * Brigade discovers skills from two roots (per `resolveBundledSkillsDir()` and
+ * `resolveSkillsDir(agentId)`): the bundled set ships with the npm package, the
+ * workspace set lives under `~/.brigade/workspace/skills/`. We walk both and
+ * emit the name + first-line description; `info <name>` prints the body.
+ */
+export declare function runSkillsList(opts?: {
+    json?: boolean;
+}): Promise<number>;
+export declare function runSkillsInfo(args: {
+    name: string;
+}, opts?: {
+    json?: boolean;
+}): Promise<number>;
+//# sourceMappingURL=skills.d.ts.map

package/dist/cli/commands/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0DH,wBAAsB,aAAa,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAelF;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB1G"}

package/dist/cli/commands/skills.js

@@ -0,0 +1,100 @@
+/**
+ * `brigade skills list / info` — operator CLI introspection over Primitive #5.
+ *
+ * Brigade discovers skills from two roots (per `resolveBundledSkillsDir()` and
+ * `resolveSkillsDir(agentId)`): the bundled set ships with the npm package, the
+ * workspace set lives under `~/.brigade/workspace/skills/`. We walk both and
+ * emit the name + first-line description; `info <name>` prints the body.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import path from "node:path";
+import { DEFAULT_AGENT_ID, resolveBundledSkillsDir, resolveSkillsDir } from "../../config/paths.js";
+function readSkill(dir, name, source) {
+    const skillFile = ["SKILL.md", "skill.md"]
+        .map((f) => path.join(dir, name, f))
+        .find((p) => existsSync(p));
+    if (!skillFile)
+        return null;
+    let description = "";
+    try {
+        const head = readFileSync(skillFile, "utf8").split(/\r?\n/).slice(0, 40);
+        // Look for `description:` in frontmatter or the first non-empty body line.
+        const desc = head.find((line) => /^description\s*:/i.test(line));
+        description = desc ? desc.split(/:\s*/, 2)[1]?.trim() ?? "" : head.find((l) => l.trim() && !l.startsWith("---")) ?? "";
+        description = description.slice(0, 140);
+    }
+    catch {
+        /* ignore */
+    }
+    return { name, source, path: skillFile, description };
+}
+function scanSkillsDir(dir, source) {
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const name of readdirSync(dir)) {
+        const full = path.join(dir, name);
+        try {
+            if (!statSync(full).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const entry = readSkill(dir, name, source);
+        if (entry)
+            out.push(entry);
+    }
+    return out;
+}
+function discoverSkills(agentId) {
+    const bundled = scanSkillsDir(resolveBundledSkillsDir(), "bundled");
+    const workspace = scanSkillsDir(resolveSkillsDir(agentId), "workspace");
+    // Workspace wins on name collision (operator overrides bundled).
+    const byName = new Map();
+    for (const s of bundled)
+        byName.set(s.name, s);
+    for (const s of workspace)
+        byName.set(s.name, s);
+    return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+export async function runSkillsList(opts = {}) {
+    const skills = discoverSkills(DEFAULT_AGENT_ID);
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ skills }, null, 2)}\n`);
+        return 0;
+    }
+    if (skills.length === 0) {
+        process.stdout.write("No skills found.\n");
+        return 0;
+    }
+    process.stdout.write(`${"NAME".padEnd(28)} ${"SOURCE".padEnd(10)}  DESCRIPTION\n`);
+    for (const s of skills) {
+        process.stdout.write(`${s.name.padEnd(28)} ${s.source.padEnd(10)}  ${s.description}\n`);
+    }
+    return 0;
+}
+export async function runSkillsInfo(args, opts = {}) {
+    const skills = discoverSkills(DEFAULT_AGENT_ID);
+    const skill = skills.find((s) => s.name === args.name);
+    if (!skill) {
+        process.stderr.write(`Skill "${args.name}" not found.\n`);
+        return 1;
+    }
+    let body = "";
+    try {
+        body = readFileSync(skill.path, "utf8");
+    }
+    catch (err) {
+        process.stderr.write(`Failed to read ${skill.path}: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ...skill, body }, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`# ${skill.name} (${skill.source})\n${skill.path}\n\n${body}\n`);
+    }
+    return 0;
+}
+//# sourceMappingURL=skills.js.map

package/dist/cli/commands/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../../src/cli/commands/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AASpG,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,MAA4B;IACzE,MAAM,SAAS,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;SACnC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACvH,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,MAA4B;IAC/D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;IACxE,iEAAiE;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA2B,EAAE;IAChE,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACnF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAsB,EAAE,OAA2B,EAAE;IACxF,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACJ,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC"}

package/dist/cli/commands/status.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `brigade status` — runtime snapshot. Brigade-sized: 5 sections, no
+ * plugin compatibility, no pairing recovery, no security audit (those
+ * Phase-2/3 surfaces don't exist here yet).
+ *
+ * Reports:
+ *   - Configured provider/model + workspace dir
+ *   - Auth: how many provider profiles are present, where the file lives
+ *   - Sessions: count of session files under ~/.brigade/agents/<id>/sessions/
+ *   - Gateway: probe ws://127.0.0.1:7777 (or --host/--port), report state
+ *   - Last log path
+ *
+ * --json emits the same data as a single object; useful for shell scripts.
+ *
+ * Standalone — does NOT require the gateway to be up. The gateway probe is
+ * a best-effort optional check.
+ */
+import type { Command } from "commander";
+export interface StatusCommandOptions {
+    host?: string;
+    port?: number;
+    json?: boolean;
+}
+export declare function runStatusCommand(opts?: StatusCommandOptions): Promise<void>;
+export declare function registerStatusCommand(program: Command): void;
+//# sourceMappingURL=status.d.ts.map

package/dist/cli/commands/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,MAAM,WAAW,oBAAoB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAyCD,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,oBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrF;AA+MD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAU5D"}