@spinabot/brigade 0.1.2 → 1.0.1

package/dist/core/agent-runtime-persist.js

@@ -0,0 +1,114 @@
+/**
+ * Pure helpers for the persistence shape the `set-thinking`, `set-model`,
+ * and hot-reload `seedAgentsFromConfig` paths in `server.ts` emit. The
+ * server still owns the live RPC plumbing (it must mutate
+ * `perAgentRuntime`, push into the in-flight Pi session, and broadcast a
+ * snapshot); these helpers capture only the on-disk side of the work so
+ * unit tests can pin the exact `cfg.agents.<id>` shape that each handler
+ * writes without having to boot the whole gateway.
+ *
+ * Every helper takes the prior `cfg` snapshot and returns the next one,
+ * matching the read-modify-write contract `mutateConfigAtomic` expects.
+ * No I/O, no closure state.
+ */
+/**
+ * H4 — `set-thinking` persistence shape.
+ *
+ * Writes `cfg.agents.<id>.thinking = <level>` so a daemon restart honours
+ * the operator's selection instead of resetting to the model-derived
+ * default. The boot/seed path reads it back via
+ * `readPersistedThinkingLevel` from `model-caps.ts`.
+ */
+export function applySetThinkingMutation(cfg, agentId, level) {
+    const next = { ...cfg };
+    const agentsMap = {
+        ...(next.agents ?? {}),
+    };
+    const prevEntry = agentsMap[agentId] && typeof agentsMap[agentId] === "object"
+        ? agentsMap[agentId]
+        : {};
+    agentsMap[agentId] = { ...prevEntry, thinking: level };
+    next.agents = agentsMap;
+    return next;
+}
+/**
+ * H5 — `set-model` per-agent persistence shape with fallback inheritance.
+ *
+ * When the per-agent entry has no `model.fallbacks` of its own, this
+ * inherits the array from `cfg.agents.defaults.model.fallbacks` so a
+ * `set-model` doesn't silently drop the resilient-turn fallback chain
+ * the operator configured at onboarding time. If the per-agent entry
+ * already declares fallbacks, those are preserved verbatim.
+ */
+export function applySetModelMutationForAgent(cfg, agentId, provider, modelId) {
+    const next = { ...cfg };
+    const agentsMap = {
+        ...(next.agents ?? {}),
+    };
+    const prevEntry = agentsMap[agentId] ?? {};
+    const prevModel = prevEntry.model ?? {};
+    let inheritedFallbacks;
+    if (!Array.isArray(prevModel.fallbacks) || prevModel.fallbacks.length === 0) {
+        const defaults = agentsMap.defaults;
+        if (Array.isArray(defaults?.model?.fallbacks)) {
+            inheritedFallbacks = (defaults?.model?.fallbacks).filter((f) => typeof f === "string" && f.length > 0);
+        }
+    }
+    const nextModel = {
+        ...prevModel,
+        primary: modelId,
+    };
+    if (inheritedFallbacks && inheritedFallbacks.length > 0) {
+        nextModel.fallbacks = inheritedFallbacks;
+    }
+    else if (Array.isArray(prevModel.fallbacks) && prevModel.fallbacks.length > 0) {
+        nextModel.fallbacks = prevModel.fallbacks;
+    }
+    agentsMap[agentId] = {
+        ...(typeof agentsMap[agentId] === "object" && agentsMap[agentId]
+            ? agentsMap[agentId]
+            : {}),
+        provider,
+        model: nextModel,
+    };
+    next.agents = agentsMap;
+    return next;
+}
+/**
+ * H1 — hot-reload "diff" helper used by the brigade.json watcher.
+ *
+ * Given the previously-seeded agent-id set and the freshly loaded
+ * `cfg.agents` map, returns the ids that should be ADDED to
+ * `perAgentRuntime` (new named entries that don't already have a
+ * runtime) and the ids that should be REMOVED (previously-seeded
+ * entries that vanished from the config). The boot agent is always
+ * preserved so the snapshot default never disappears.
+ *
+ * The actual `Map<string, AgentRuntime>` mutation lives in `server.ts`
+ * (it needs the resolved `Model` instances + `AuthStorage`); this
+ * helper covers the pure "what changed" calculation that's easy to
+ * unit-test.
+ */
+export function computeSeedDiff(previouslySeeded, bootAgentId, cfgAgents) {
+    const map = cfgAgents ?? {};
+    const seenIds = new Set([bootAgentId]);
+    const addedCandidates = [];
+    for (const [id, entry] of Object.entries(map)) {
+        if (id === "defaults" || !entry || typeof entry !== "object")
+            continue;
+        seenIds.add(id);
+        if (previouslySeeded.has(id))
+            continue;
+        addedCandidates.push(id);
+    }
+    const removed = [];
+    for (const existingId of previouslySeeded) {
+        if (existingId === bootAgentId)
+            continue;
+        if (seenIds.has(existingId))
+            continue;
+        removed.push(existingId);
+    }
+    return { addedCandidates, removed };
+}
+//# sourceMappingURL=agent-runtime-persist.js.map

package/dist/core/agent-runtime-persist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-runtime-persist.js","sourceRoot":"","sources":["../../src/core/agent-runtime-persist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACvC,GAAkB,EAClB,OAAe,EACf,KAAa;IAEb,MAAM,IAAI,GAAkB,EAAE,GAAG,GAAG,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG;QACjB,GAAG,CAAE,IAAI,CAAC,MAA8C,IAAI,EAAE,CAAC;KACpC,CAAC;IAC7B,MAAM,SAAS,GACd,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC3D,CAAC,CAAE,SAAS,CAAC,OAAO,CAA6B;QACjD,CAAC,CAAC,EAAE,CAAC;IACP,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtD,IAAgC,CAAC,MAAM,GAAG,SAAS,CAAC;IACrD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC5C,GAAkB,EAClB,OAAe,EACf,QAAgB,EAChB,OAAe;IAEf,MAAM,IAAI,GAAkB,EAAE,GAAG,GAAG,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG;QACjB,GAAG,CAAE,IAAI,CAAC,MAA8C,IAAI,EAAE,CAAC;KACpC,CAAC;IAC7B,MAAM,SAAS,GACb,SAAS,CAAC,OAAO,CAAsD,IAAI,EAAE,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;IAExC,IAAI,kBAAwC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,QAEf,CAAC;QACb,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/C,kBAAkB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAuB,CAAA,CAAC,MAAM,CACpE,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CACzD,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAA8C;QAC5D,GAAG,SAAS;QACZ,OAAO,EAAE,OAAO;KAChB,CAAC;IACF,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,SAAS,CAAC,SAAS,GAAG,kBAAkB,CAAC;IAC1C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjF,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,GAAG;QACpB,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC;YAC/D,CAAC,CAAE,SAAS,CAAC,OAAO,CAA6B;YACjD,CAAC,CAAC,EAAE,CAAC;QACN,QAAQ;QACR,KAAK,EAAE,SAAS;KAChB,CAAC;IACD,IAAgC,CAAC,MAAM,GAAG,SAAS,CAAC;IACrD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAC9B,gBAAqC,EACrC,WAAmB,EACnB,SAA8C;IAE9C,MAAM,GAAG,GAAG,SAAS,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,EAAE,KAAK,UAAU,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACvC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC3C,IAAI,UAAU,KAAK,WAAW;YAAE,SAAS;QACzC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QACtC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC"}

package/dist/core/auth-bridge.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Build a Pi `AuthStorage` populated from Brigade's auth-profiles.json. Returns
+ * an empty storage when the file is missing or unparseable so callers can
+ * decide whether to surface "no key" themselves (chat re-onboards; gateway
+ * throws a clean config error).
+ */
+export declare function loadBrigadeAuthStorage(agentId?: string): unknown;
+//# sourceMappingURL=auth-bridge.d.ts.map

package/dist/core/auth-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bridge.d.ts","sourceRoot":"","sources":["../../src/core/auth-bridge.ts"],"names":[],"mappings":"AAoCA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,MAAyB,GAAG,OAAO,CAoBlF"}

package/dist/core/auth-bridge.js

@@ -0,0 +1,102 @@
+/**
+ * Auth bridge — reads Brigade's `auth-profiles.json` (the file `brigade onboard`
+ * actually writes) and produces a Pi `AuthStorage` that the lifted CLI surfaces
+ * (`brigade chat`, `brigade gateway`) can hand to `ModelRegistry`.
+ *
+ * Without this, those commands would default to `AuthStorage.create(<dir>/auth.json)` —
+ * Pi's vanilla on-disk store — and never see the keys onboarding wrote into
+ * `~/.brigade/agents/main/agent/auth-profiles.json`. Mutually invisible.
+ *
+ * This is a deliberately small subset of `agents/agent-loop.ts`'s
+ * `readAuthProfilesAsCredentialMap` + `buildAuthStorage` (cooldown filtering
+ * skipped — only Primitive #1's run loop needs that). Duplicating the small
+ * surface here keeps the agent-loop module untouched per the lift-scope rule.
+ */
+import { AuthStorage } from "@mariozechner/pi-coding-agent";
+import { DEFAULT_AGENT_ID } from "../config/paths.js";
+import { PROVIDERS } from "../providers/catalog.js";
+import { readProfiles } from "../auth/profiles.js";
+/**
+ * Build a Pi `AuthStorage` populated from Brigade's auth-profiles.json. Returns
+ * an empty storage when the file is missing or unparseable so callers can
+ * decide whether to surface "no key" themselves (chat re-onboards; gateway
+ * throws a clean config error).
+ */
+export function loadBrigadeAuthStorage(agentId = DEFAULT_AGENT_ID) {
+    const credentials = readBrigadeCredentials(agentId);
+    const Storage = AuthStorage;
+    if (typeof Storage.inMemory === "function") {
+        return Storage.inMemory(credentials);
+    }
+    if (typeof Storage.fromStorage === "function") {
+        return Storage.fromStorage({
+            withLock(update) {
+                const { result } = update(JSON.stringify(credentials, null, 2));
+                return result;
+            },
+        });
+    }
+    throw new Error("Pi AuthStorage exposes neither inMemory nor fromStorage; pin to 0.70.x or update brigade.");
+}
+function readBrigadeCredentials(agentId) {
+    const out = {};
+    // Route through the mode-aware `readProfiles` choke point: filesystem mode
+    // reads auth-profiles.json, convex mode reads the in-process cache primed
+    // at boot from the sealed authProfiles table. Either way the bridge sees
+    // the same profiles the agent kernel does.
+    let parsed = {};
+    try {
+        parsed = readProfiles(agentId);
+    }
+    catch {
+        // Fall through to env-backed bootstrap.
+    }
+    for (const profile of Object.values(parsed.profiles ?? {})) {
+        if (!profile?.provider || profile.type !== "api_key")
+            continue;
+        const resolvedKey = resolveProfileKey(profile);
+        if (!resolvedKey)
+            continue;
+        // First-wins per provider — matches Primitive #1's no-cooldown path.
+        if (out[profile.provider] === undefined) {
+            out[profile.provider] = { type: "api_key", key: resolvedKey };
+        }
+    }
+    // Env-backed bootstrap. If a user has ANTHROPIC_API_KEY (etc) exported
+    // in their shell but never ran `brigade onboard`, Pi's registry would
+    // hide the provider unless we surface that key here. Profile-stored keys
+    // take precedence — env is only consulted when a provider has no profile
+    // entry.
+    for (const provider of PROVIDERS) {
+        if (!provider.envVar || provider.noAuth)
+            continue;
+        if (out[provider.id] !== undefined)
+            continue;
+        const apiKey = process.env[provider.envVar];
+        if (!apiKey)
+            continue;
+        out[provider.id] = { type: "api_key", key: apiKey };
+    }
+    return out;
+}
+function resolveProfileKey(profile) {
+    if (profile.key && profile.key.length > 0)
+        return profile.key;
+    const ref = profile.keyRef;
+    if (!ref)
+        return "";
+    // String form (legacy): `${ENV_VAR}` literal. Matches the regex agent-loop
+    // uses for the same shape.
+    if (typeof ref === "string") {
+        const m = /^\$\{([A-Z_][A-Z0-9_]*)\}$/.exec(ref);
+        if (m && m[1])
+            return process.env[m[1]] ?? "";
+        return ref;
+    }
+    // BrigadeSecretRef object form: only env-source is resolvable synchronously.
+    if (ref.source === "env" && ref.id) {
+        return process.env[ref.id] ?? "";
+    }
+    return "";
+}
+//# sourceMappingURL=auth-bridge.js.map

package/dist/core/auth-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bridge.js","sourceRoot":"","sources":["../../src/core/auth-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAkBnD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,gBAAgB;IACvE,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,WAGf,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,WAAW,CAAC;YACzB,QAAQ,CAAI,MAAyD;gBACnE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,OAAO,MAAM,CAAC;YAChB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,2CAA2C;IAC3C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,OAAO,CAAgC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QAC/D,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,qEAAqE;QACrE,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,SAAS;IACT,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;YAAE,SAAS;QAClD,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,SAAS;YAAE,SAAS;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoB;IAC7C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,2EAA2E;IAC3E,2BAA2B;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;IACD,6EAA6E;IAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/core/auth-error.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Brigade-native translator for the "No API key found for X" error that
+ * surfaces from Pi's auth-resolution path.
+ *
+ * Pi's own message hardcodes `/login` (a Pi slash command Brigade doesn't
+ * have) and dumps raw `node_modules/@mariozechner/pi-coding-agent/docs/`
+ * paths into the user's chat. Both are direct violations of Brigade's
+ * B2B-grade copy rules — paying customers see the agent gesture at a
+ * non-existent command and at internal package paths.
+ *
+ * The replacement is a SINGLE SHORT LINE with a clear next step. Not a
+ * multi-line guidance block — when the user already knows what's wrong
+ * (their key isn't set), more text is more friction. Same pattern used by
+ * mature production agent platforms.
+ *
+ * Pure function. No I/O.
+ */
+/**
+ * Detect Pi's auth-failure error and return a Brigade-native single-line
+ * replacement. Returns `null` for any other error — caller falls through
+ * to the normal cleanProviderError path.
+ *
+ * Three known patterns from Pi (each a different code path; each leaks
+ * `/login` and may include raw `node_modules/.../docs/...` paths):
+ *   - "No API key found for X." (auth-guidance.js — no key in storage / env)
+ *   - "Authentication failed for X. Credentials may have expired …
+ *      Run '/login X' to re-authenticate." (agent-session.js — startup)
+ *   - "OAuth token refresh failed for X: …" (oauth refresh path — mid-session)
+ */
+export declare function translateAuthError(raw: string): string | null;
+/**
+ * Single-line response when a user types `/login` (a Pi command Brigade
+ * doesn't have). Same shape as the auth-error translator above.
+ */
+export declare function buildLoginGuidanceMessage(): string;
+/**
+ * Universal error-prep used by every catch site that may render a Pi error
+ * to the user. Pipeline:
+ *   1. Try the auth-error translator (handles `No API key`, OAuth expired,
+ *      `No models available`).
+ *   2. Fall back to `cleanProviderError` to peel JSON wrappers from generic
+ *      provider errors (rate limits, content policy, etc).
+ *
+ * Single helper everywhere = no chance of one catch site forgetting to
+ * translate auth errors. Whenever a NEW Pi error pattern needs handling,
+ * extend `translateAuthError` once and every catch path benefits.
+ */
+export declare function friendlyError(raw: string, cleanProviderError: (s: string) => string): string;
+//# sourceMappingURL=auth-error.d.ts.map

package/dist/core/auth-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-error.d.ts","sourceRoot":"","sources":["../../src/core/auth-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgC7D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,CAI5F"}

package/dist/core/auth-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-error.js","sourceRoot":"","sources":["../../src/core/auth-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oEAAoE;AACpE,MAAM,kBAAkB,GAAG,iDAAiD,CAAC;AAC7E;4DAC4D;AAC5D,MAAM,qBAAqB,GAAG,qDAAqD,CAAC;AACpF;;2EAE2E;AAC3E,MAAM,qBAAqB,GAAG,8DAA8D,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,yBAAyB,QAAQ,2EAA2E,CAAC;IACrH,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,KAAK,QAAQ,8GAA8G,CAAC;IACpI,CAAC;IAED,6EAA6E;IAC7E,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,KAAK,QAAQ,sIAAsI,CAAC;IAC5J,CAAC;IAED,IAAI,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,0FAA0F,CAAC;IACnG,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACxC,OAAO,4GAA4G,CAAC;AACrH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,kBAAyC;IACnF,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,cAAc,GAAqC;IACxD,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,eAAe;IACvB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;CACP,CAAC;AAEX,SAAS,oBAAoB,CAAC,EAAU;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,uBAAuB,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,IAAI,EAAE,CAAC;AACrB,CAAC"}

package/dist/core/brigade-config.d.ts

@@ -0,0 +1,205 @@
+/**
+ * Brigade super-config.
+ *
+ * Single source of truth at `<BRIGADE_DIR>/brigade.json`. Replaces the legacy
+ * three-file layout (`auth.json`, `config.json`, `settings.json`) with a
+ * versioned, schema-validated document plus rotating backups and atomic
+ * writes. Boot must never fail on a corrupt file — recovery walks the
+ * backup chain and ultimately falls through to a fresh empty config.
+ *
+ * v2 schema (current). The block names mirror the reference super-config
+ * shape so future Phase-2/3 features (auth profiles for non-key providers,
+ * multi-agent rosters, plugins, skills, channels, gateway control UI) just
+ * add nested fields rather than reshaping the document. The migration from
+ * v1 → v2 reorganises three things:
+ *
+ *   1. settings.defaultProvider + settings.defaultModelId
+ *        → agents.defaults.model.primary (composed as "<provider>/<modelId>")
+ *   2. settings.fallbackProvider + settings.fallbackModelId
+ *        → agents.defaults.model.fallbacks[0]
+ *   3. settings.installedAt
+ *        → meta.installedAt
+ *
+ * settings.compaction and settings.thinkingLevel stay under `settings` —
+ * Brigade-private namespace until later primitives give them a real home.
+ */
+import { type Static, Type } from "typebox";
+export declare const BRIGADE_CONFIG_SCHEMA_VERSION: 2;
+export declare const BRIGADE_CONFIG_FILENAME = "brigade.json";
+export declare const BACKUP_DEPTH = 4;
+export declare const BrigadeConfigSchema: Type.TObject<{
+    $schema: Type.TOptional<Type.TString>;
+    version: Type.TLiteral<2>;
+    meta: Type.TOptional<Type.TObject<{
+        lastTouchedVersion: Type.TOptional<Type.TString>;
+        lastTouchedAt: Type.TOptional<Type.TString>;
+        installedAt: Type.TOptional<Type.TString>;
+    }>>;
+    wizard: Type.TOptional<Type.TObject<{
+        lastRunAt: Type.TOptional<Type.TString>;
+        lastRunVersion: Type.TOptional<Type.TString>;
+    }>>;
+    env: Type.TOptional<Type.TRecord<"^.*$", Type.TString>>;
+    auth: Type.TOptional<Type.TObject<{
+        profiles: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+            provider: Type.TString;
+            mode: Type.TUnion<[Type.TLiteral<"api_key">, Type.TLiteral<"oauth">, Type.TLiteral<"token">]>;
+            email: Type.TOptional<Type.TString>;
+            displayName: Type.TOptional<Type.TString>;
+        }>>>;
+    }>>;
+    agents: Type.TOptional<Type.TObject<{
+        defaults: Type.TOptional<Type.TObject<{
+            model: Type.TOptional<Type.TObject<{
+                primary: Type.TOptional<Type.TString>;
+                fallbacks: Type.TOptional<Type.TArray<Type.TString>>;
+            }>>;
+            subagents: Type.TOptional<Type.TObject<{
+                allowAgents: Type.TOptional<Type.TArray<Type.TString>>;
+            }>>;
+        }>>;
+        list: Type.TOptional<Type.TArray<Type.TObject<{
+            id: Type.TString;
+            name: Type.TOptional<Type.TString>;
+            identity: Type.TOptional<Type.TObject<{
+                name: Type.TOptional<Type.TString>;
+                emoji: Type.TOptional<Type.TString>;
+            }>>;
+            workspace: Type.TOptional<Type.TString>;
+            agentDir: Type.TOptional<Type.TString>;
+            tools: Type.TOptional<Type.TObject<{
+                alsoAllow: Type.TOptional<Type.TArray<Type.TString>>;
+                deny: Type.TOptional<Type.TArray<Type.TString>>;
+            }>>;
+            model: Type.TOptional<Type.TObject<{
+                primary: Type.TOptional<Type.TString>;
+                fallbacks: Type.TOptional<Type.TArray<Type.TString>>;
+            }>>;
+        }>>>;
+    }>>;
+    plugins: Type.TOptional<Type.TObject<{
+        enabled: Type.TOptional<Type.TBoolean>;
+        allow: Type.TOptional<Type.TArray<Type.TString>>;
+        deny: Type.TOptional<Type.TArray<Type.TString>>;
+        entries: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+            enabled: Type.TOptional<Type.TBoolean>;
+            config: Type.TOptional<Type.TRecord<"^.*$", Type.TUnknown>>;
+        }>>>;
+    }>>;
+    skills: Type.TOptional<Type.TObject<{
+        enabled: Type.TOptional<Type.TBoolean>;
+        paths: Type.TOptional<Type.TArray<Type.TString>>;
+        entries: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+            enabled: Type.TOptional<Type.TBoolean>;
+            config: Type.TOptional<Type.TRecord<"^.*$", Type.TUnknown>>;
+        }>>>;
+    }>>;
+    channels: Type.TOptional<Type.TRecord<"^.*$", Type.TIntersect<[Type.TObject<{
+        enabled: Type.TOptional<Type.TBoolean>;
+        dmPolicy: Type.TOptional<Type.TUnion<[Type.TLiteral<"pairing">, Type.TLiteral<"allowlist">, Type.TLiteral<"open">, Type.TLiteral<"disabled">]>>;
+    }>, Type.TRecord<"^.*$", Type.TUnknown>]>>>;
+    extensions: Type.TOptional<Type.TObject<{
+        enabled: Type.TOptional<Type.TBoolean>;
+        allow: Type.TOptional<Type.TArray<Type.TString>>;
+        disabled: Type.TOptional<Type.TArray<Type.TString>>;
+        slots: Type.TOptional<Type.TObject<{
+            memory: Type.TOptional<Type.TString>;
+            contextEngine: Type.TOptional<Type.TString>;
+            compaction: Type.TOptional<Type.TString>;
+            agentHarness: Type.TOptional<Type.TString>;
+        }>>;
+        entries: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+            enabled: Type.TOptional<Type.TBoolean>;
+            config: Type.TOptional<Type.TRecord<"^.*$", Type.TUnknown>>;
+        }>>>;
+    }>>;
+    gateway: Type.TOptional<Type.TObject<{
+        mode: Type.TOptional<Type.TUnion<[Type.TLiteral<"local">, Type.TLiteral<"remote">]>>;
+        port: Type.TOptional<Type.TNumber>;
+        auth: Type.TOptional<Type.TRecord<"^.*$", Type.TUnknown>>;
+        http: Type.TOptional<Type.TObject<{
+            endpoints: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+                enabled: Type.TOptional<Type.TBoolean>;
+            }>>>;
+        }>>;
+        controlUi: Type.TOptional<Type.TObject<{
+            allowedOrigins: Type.TOptional<Type.TArray<Type.TString>>;
+        }>>;
+        reload: Type.TOptional<Type.TObject<{
+            mode: Type.TOptional<Type.TUnion<[Type.TLiteral<"off">, Type.TLiteral<"hot">, Type.TLiteral<"manual">]>>;
+        }>>;
+    }>>;
+    settings: Type.TOptional<Type.TObject<{
+        compaction: Type.TOptional<Type.TObject<{
+            enabled: Type.TOptional<Type.TBoolean>;
+        }>>;
+        thinkingLevel: Type.TOptional<Type.TString>;
+        defaultProvider: Type.TOptional<Type.TString>;
+        defaultModelId: Type.TOptional<Type.TString>;
+    }>>;
+}>;
+export type BrigadeConfig = Static<typeof BrigadeConfigSchema>;
+export interface BrigadeConfigValidationIssue {
+    path: string;
+    message: string;
+}
+export declare class BrigadeConfigValidationError extends Error {
+    readonly errors: BrigadeConfigValidationIssue[];
+    constructor(message: string, errors: BrigadeConfigValidationIssue[]);
+}
+/**
+ * Validate any value against the BrigadeConfigSchema and return a flat list
+ * of issues (empty array = valid). Public so the `brigade config validate`
+ * subcommand can reuse the same TypeBox machinery.
+ */
+export declare function collectBrigadeConfigErrors(value: unknown): BrigadeConfigValidationIssue[];
+export declare function loadBrigadeConfig(brigadeDir: string): Promise<BrigadeConfig>;
+export declare function writeBrigadeConfig(brigadeDir: string, cfg: BrigadeConfig): Promise<void>;
+export interface V1MigrationResult {
+    migrated: boolean;
+    snapshotPath?: string;
+}
+/**
+ * Migrate a v1 Brigade super-config to the v2 reference-aligned shape.
+ * Idempotent — already-v2 configs short-circuit. Side effect: writes a
+ * `<configPath>.migrated-v1-<ISO-ts>.bak` snapshot before write so the
+ * migration is auditable + reversible.
+ *
+ * Behaviour:
+ *   - missing brigade.json         → no-op (returns {migrated:false})
+ *   - version === 2                → no-op (already migrated)
+ *   - version > 2                  → no-op + stderr warn (don't trash a future config)
+ *   - version === 1 (or absent)    → snapshot + lift + write v2
+ *   - corrupt v1 (schema-fails)    → no-op + stderr warn (don't trash bad data)
+ */
+export declare function migrateBrigadeConfigV1toV2(brigadeDir: string): Promise<V1MigrationResult>;
+export interface MigrationResult {
+    migrated: boolean;
+    movedFiles: string[];
+}
+export declare function migrateLegacyConfig(brigadeDir: string): Promise<MigrationResult>;
+export interface EnvLoadResult {
+    applied: string[];
+    skipped: string[];
+}
+export declare function getAppliedEnvKeys(): ReadonlySet<string>;
+export declare function loadEnvIntoProcess(cfg: BrigadeConfig): EnvLoadResult;
+/**
+ * First-slash-split a "<provider>/<modelId>" model ref into its component
+ * parts. Used by config readers that need to recover provider+modelId from
+ * `agents.defaults.model.primary` (or `.fallbacks[i]`). Documented semantics:
+ * the FIRST `/` is the provider/modelId separator, so multi-slash modelIds
+ * (e.g. `openrouter/openrouter/auto` → provider="openrouter",
+ * modelId="openrouter/auto") survive intact.
+ */
+export declare function parseModelRef(ref: string | undefined): {
+    provider: string;
+    modelId: string;
+} | undefined;
+/**
+ * Inverse of `parseModelRef`. Exposed so callers (config-cmd, onboarding,
+ * server, chat) can compose a model ref consistently and avoid double-
+ * prefixing OpenRouter-style ids that already include the provider segment.
+ */
+export declare function composeModelRefExternal(provider?: string, modelId?: string): string | undefined;
+//# sourceMappingURL=brigade-config.d.ts.map

package/dist/core/brigade-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brigade-config.d.ts","sourceRoot":"","sources":["../../src/core/brigade-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAK5C,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AAExD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AACtD,eAAO,MAAM,YAAY,IAAI,CAAC;AAqN9B,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAyB/D,MAAM,WAAW,4BAA4B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACtD,QAAQ,CAAC,MAAM,EAAE,4BAA4B,EAAE,CAAC;gBAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE;CAKnE;AA2BD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,4BAA4B,EAAE,CASzF;AA8GD,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwDlF;AAkDD,wBAAsB,kBAAkB,CACvC,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,aAAa,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAID,MAAM,WAAW,iBAAiB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAoBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC/C,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAgH5B;AAID,MAAM,WAAW,eAAe;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;CACrB;AAiCD,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgGtF;AAID,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAeD,wBAAgB,iBAAiB,IAAI,WAAW,CAAC,MAAM,CAAC,CAEvD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CAkBpE;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,MAAM,GAAG,SAAS,GACrB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQnD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE/F"}

package/dist/core/brigade-config.js

@@ -101,14 +101,58 @@ const SKILL_ENTRY_SCHEMA = Type.Object({
     config: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
 });
 const SKILLS_SCHEMA = Type.Object({
+    // Global on/off for the skills subsystem (default: on when omitted).
+    enabled: Type.Optional(Type.Boolean()),
+    // Extra skill search roots beyond the bundled + workspace dirs.
+    paths: Type.Optional(Type.Array(Type.String())),
     entries: Type.Optional(Type.Record(Type.String(), SKILL_ENTRY_SCHEMA)),
 });
-const CHANNELS_SCHEMA = Type.Record(Type.String(), Type.Record(Type.String(), Type.Unknown()));
-const GATEWAY_AUTH_SCHEMA = Type.Object({
-    mode: Type.Optional(Type.Union([Type.Literal("none"), Type.Literal("token"), Type.Literal("password")])),
-    token: Type.Optional(Type.String()),
-    password: Type.Optional(Type.String()),
+// Per-channel settings. `dmPolicy` gates inbound DMs:
+//   - `pairing` (default) — strangers get a one-shot code, operator approves
+//   - `allowlist` — only senders in the allow-from list (no auto-challenge)
+//   - `open` — anyone can DM (use with care)
+//   - `disabled` — silently drop every DM
+// The schema is intentionally OPEN so adapters can carry their own settings
+// (account ids, baseUrls, etc.) without per-channel schema changes here.
+const CHANNEL_ENTRY_SCHEMA = Type.Object({
+    enabled: Type.Optional(Type.Boolean()),
+    dmPolicy: Type.Optional(Type.Union([Type.Literal("pairing"), Type.Literal("allowlist"), Type.Literal("open"), Type.Literal("disabled")])),
+});
+const CHANNELS_SCHEMA = Type.Record(Type.String(), Type.Intersect([CHANNEL_ENTRY_SCHEMA, Type.Record(Type.String(), Type.Unknown())]));
+// Extension subsystem (Pi-native tools/hooks/commands + Brigade product
+// channels/voice/media). Mirrors the plugins/skills gating shape: a global
+// on/off, a deny-list, and per-module entries. The extension loader reads
+// this; channels additionally honor their own `channels.<id>` settings.
+const EXTENSION_ENTRY_SCHEMA = Type.Object({
+    enabled: Type.Optional(Type.Boolean()),
+    config: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
 });
+// Slots pick the active capability when multiple plugins register one (memory
+// backend, context engine, compaction, agent harness). The value is the id of
+// the registered capability; unset slots fall through to Brigade's built-in
+// path. The resolver lives on `BrigadeExtensionRegistry.resolveSlot`.
+const EXTENSIONS_SLOTS_SCHEMA = Type.Object({
+    memory: Type.Optional(Type.String()),
+    contextEngine: Type.Optional(Type.String()),
+    compaction: Type.Optional(Type.String()),
+    agentHarness: Type.Optional(Type.String()),
+}, { additionalProperties: false });
+const EXTENSIONS_SCHEMA = Type.Object({
+    enabled: Type.Optional(Type.Boolean()),
+    // When non-empty, ONLY listed module ids load (allowlist).
+    allow: Type.Optional(Type.Array(Type.String())),
+    disabled: Type.Optional(Type.Array(Type.String())),
+    slots: Type.Optional(EXTENSIONS_SLOTS_SCHEMA),
+    entries: Type.Optional(Type.Record(Type.String(), EXTENSION_ENTRY_SCHEMA)),
+});
+// Brigade v1 is single-user / localhost-only — there is no WS auth layer to
+// configure here. The gateway hard-refuses non-localhost binds (see server.ts)
+// so this block is a no-op today; multi-user auth lands with the Phase-2 SaaS
+// shape (HTTP-session / Convex), NOT a static token in this file.
+//
+// We intentionally still accept arbitrary keys here so existing brigade.json
+// files don't fail validation, but no field is read by any runtime.
+const GATEWAY_AUTH_SCHEMA = Type.Record(Type.String(), Type.Unknown());
 const GATEWAY_HTTP_SCHEMA = Type.Object({
     endpoints: Type.Optional(Type.Record(Type.String(), Type.Object({
         enabled: Type.Optional(Type.Boolean()),
@@ -171,6 +215,7 @@ export const BrigadeConfigSchema = Type.Object({
     plugins: Type.Optional(PLUGINS_SCHEMA),
     skills: Type.Optional(SKILLS_SCHEMA),
     channels: Type.Optional(CHANNELS_SCHEMA),
+    extensions: Type.Optional(EXTENSIONS_SCHEMA),
     gateway: Type.Optional(GATEWAY_SCHEMA),
     settings: Type.Optional(SETTINGS_SCHEMA),
 });
@@ -220,7 +265,12 @@ function emptyConfig() {
 function isoTimestampForFilename() {
     return new Date().toISOString().replace(/[:]/g, "-");
 }
-function collectErrors(value) {
+/**
+ * Validate any value against the BrigadeConfigSchema and return a flat list
+ * of issues (empty array = valid). Public so the `brigade config validate`
+ * subcommand can reuse the same TypeBox machinery.
+ */
+export function collectBrigadeConfigErrors(value) {
     const issues = [];
     for (const err of Errors(BrigadeConfigSchema, value)) {
         issues.push({
@@ -230,6 +280,8 @@ function collectErrors(value) {
     }
     return issues;
 }
+// Backwards-compat alias used by writers in this file.
+const collectErrors = collectBrigadeConfigErrors;
 async function tryReadJson(p) {
     const buf = await fs.readFile(p, "utf8");
     return JSON.parse(buf);