@spinabot/brigade 0.1.2 → 1.0.1

package/dist/agents/model-fallback.js

@@ -0,0 +1,226 @@
+// Multi-model fallback orchestrator.
+//
+// Wraps an inner attempt fn with a candidate chain: if the primary model
+// fails with a transient or model-specific error, the next candidate is
+// tried automatically. Same-model retries are handled inside `runWithRetry`;
+// this layer rotates *across* models when same-model retry is exhausted or
+// when the failure category demands a new candidate (model_not_found,
+// auth_permanent for the only profile on a provider).
+//
+// Per-(provider, reason) cooldown slots prevent a thundering rate-limit
+// storm from cycling all candidates within the same second. Each (provider,
+// reason) pair can absorb at most one transient probe per fallback run; once
+// a probe spends the slot, the candidate goes on cooldown for the rest of
+// this run regardless of subsequent retries.
+//
+// Allowlist enforcement: only candidates whose `provider/model` key appears
+// in `agents.defaults.models` (when configured) are eligible as fallbacks.
+// The explicit primary always runs even if not in the allowlist — the user
+// asked for it.
+import { classifyErrorReason, isBrigadeRetryError, summariseError, } from "./error-classifier.js";
+import { getRetryPolicy, runWithRetry } from "./retry-policy.js";
+import { createSubsystemLogger } from "../logging/subsystem-logger.js";
+const log = createSubsystemLogger("loop/fallback");
+export class FallbackExhaustedError extends Error {
+    attempts;
+    soonestRetryHintMs;
+    constructor(attempts, soonestRetryHintMs) {
+        const summary = attempts
+            .map((a) => `${a.provider}/${a.model}: ${a.reason} (${a.errorSummary})`)
+            .join(" | ");
+        super(`All ${attempts.length} candidate model(s) failed: ${summary}`);
+        this.name = "FallbackExhaustedError";
+        this.attempts = attempts;
+        this.soonestRetryHintMs = soonestRetryHintMs;
+    }
+}
+/**
+ * Cap on `LiveSessionModelSwitchError` retries within a single fallback run.
+ * Without this, a hook that throws a fresh switch error on every attempt
+ * would loop forever (each new candidate rejecting with another switch
+ * request). 5 is more than any reasonable user-driven /model swap cascade
+ * — beyond that something is wrong and we'd rather fail loud.
+ */
+const MAX_LIVE_SWITCH_RETRIES = 5;
+export async function runWithModelFallback(args) {
+    const candidates = [args.primary, ...args.fallbacks];
+    const attempts = [];
+    // (provider, reason) → exhausted? Once a (provider, reason) pair has
+    // absorbed a probe in this run, further candidates on the same provider
+    // skip ahead rather than re-probing.
+    const exhaustedSlots = new Set();
+    // Counter for the live-switch guard above. Resets per call to
+    // runWithModelFallback (each user prompt gets its own budget).
+    let liveSwitchRetries = 0;
+    for (let i = 0; i < candidates.length; i++) {
+        const candidate = candidates[i];
+        if (!candidate)
+            continue;
+        if (args.signal?.aborted) {
+            throw args.signal.reason ?? new Error("Aborted");
+        }
+        log.info("attempting candidate", {
+            candidate: `${candidate.provider}/${candidate.model}`,
+            isPrimary: candidate.isPrimary,
+            attemptIndex: i,
+        });
+        try {
+            const result = await args.attempt(candidate, args.signal);
+            log.info("candidate succeeded", {
+                candidate: `${candidate.provider}/${candidate.model}`,
+                attemptIndex: i,
+            });
+            return { result, candidate, attempts };
+        }
+        catch (err) {
+            // Bare aborts surface immediately — never roll past a user cancel.
+            if (isAbortError(err))
+                throw err;
+            // Live model switch — caller signalled mid-attempt that the active
+            // turn should rotate to a different (provider, modelId). Splice the
+            // requested candidate to the head of the remaining queue and re-enter
+            // the loop without consuming a probe slot or recording the request
+            // as a "failure". The previous attempt's actual outcome (whatever it
+            // was) is discarded — the user asked for a different model, they
+            // get the result of the new model.
+            //
+            // Max-retries guard caps live-switch chaining. A buggy hook could
+            // otherwise chain switches forever (each new model immediately
+            // throws another LiveSessionModelSwitchError) — surface as a hard
+            // error after MAX_LIVE_SWITCH_RETRIES.
+            if (isLiveSessionModelSwitchError(err)) {
+                if (liveSwitchRetries >= MAX_LIVE_SWITCH_RETRIES) {
+                    log.error("live model switch retries exhausted", {
+                        from: `${candidate.provider}/${candidate.model}`,
+                        to: `${err.nextProvider}/${err.nextModel}`,
+                        retries: liveSwitchRetries,
+                        cap: MAX_LIVE_SWITCH_RETRIES,
+                    });
+                    throw new Error(`Exceeded maximum live model switch retries (${MAX_LIVE_SWITCH_RETRIES})`, { cause: err });
+                }
+                liveSwitchRetries++;
+                log.info("live model switch requested mid-attempt", {
+                    from: `${candidate.provider}/${candidate.model}`,
+                    to: `${err.nextProvider}/${err.nextModel}`,
+                    retry: liveSwitchRetries,
+                });
+                const switched = {
+                    provider: err.nextProvider,
+                    model: err.nextModel,
+                    isPrimary: false,
+                };
+                // Insert as the next-to-try without disturbing the rest of the
+                // chain. `i` stays put; the for-loop's i++ will land on this.
+                candidates.splice(i + 1, 0, switched);
+                continue;
+            }
+            const reason = classifyErrorReason(err);
+            const status = isBrigadeRetryError(err) ? err.status : undefined;
+            const errorSummary = summariseError(err);
+            const info = {
+                provider: candidate.provider,
+                model: candidate.model,
+                reason,
+                errorSummary,
+                status,
+            };
+            attempts.push(info);
+            args.onCandidateAttempted?.(info);
+            const policy = getRetryPolicy(reason);
+            log.warn("candidate failed", {
+                candidate: `${candidate.provider}/${candidate.model}`,
+                reason,
+                status,
+                willRotate: i + 1 < candidates.length,
+                rotateAuthProfile: policy.rotateAuthProfile,
+                rotateModel: policy.rotateModel,
+                consumesProbeSlot: policy.consumesProbeSlot,
+            });
+            // Probe-slot accounting — track per (provider, reason) so a chained
+            // rate-limit storm doesn't burn through every candidate.
+            if (policy.consumesProbeSlot) {
+                exhaustedSlots.add(`${candidate.provider}::${reason}`);
+            }
+            // Categories that should fail immediately rather than rotate. These
+            // mean retrying with any candidate would surface the same hard error.
+            if (reason === "auth_permanent" || reason === "session_expired") {
+                // For auth_permanent on the primary, give fallbacks a chance — a
+                // different provider key may work. For session_expired, the upstream
+                // session is gone; rotating providers won't fix that.
+                if (reason === "session_expired")
+                    throw err;
+            }
+            if (reason === "format") {
+                // The same body re-fails on every candidate. Surface the original.
+                throw err;
+            }
+            // Skip the next candidate if it's on a slot that's already exhausted
+            // for this run.
+            while (i + 1 < candidates.length) {
+                const next = candidates[i + 1];
+                if (!next)
+                    break;
+                if (exhaustedSlots.has(`${next.provider}::${reason}`)) {
+                    log.debug("skipping candidate on exhausted slot", {
+                        candidate: `${next.provider}/${next.model}`,
+                        reason,
+                    });
+                    i++;
+                    continue;
+                }
+                break;
+            }
+        }
+    }
+    throw new FallbackExhaustedError(attempts);
+}
+// Live-session model switch error.
+//
+// Thrown from inside an `attempt` callback when a different (provider,
+// modelId) should serve the in-flight turn. The resilient runner catches
+// this in `runWithModelFallback` / `runResilient` and rotates to the
+// requested candidate before retrying — no FallbackExhaustedError is
+// raised, no probe-slot is consumed.
+//
+// Today's CLI can't throw this mid-stream because Pi 0.70.x's
+// `session.prompt` doesn't accept an AbortSignal — a `/model X` command
+// at the CLI persists to sessions.json and takes effect on the NEXT
+// turn (see cli/commands/agent.ts). Future channel adapters (gateway
+// WebSocket, IDE bridge, etc.) that DO have a side channel into the
+// agent loop can throw this from a hook to drive a true live switch.
+export class LiveSessionModelSwitchError extends Error {
+    nextProvider;
+    nextModel;
+    authProfileId;
+    constructor(args) {
+        super(`Live session model switch requested: ${args.provider}/${args.model}`);
+        this.name = "LiveSessionModelSwitchError";
+        this.nextProvider = args.provider;
+        this.nextModel = args.model;
+        this.authProfileId = args.authProfileId;
+    }
+}
+export function isLiveSessionModelSwitchError(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        value.name === "LiveSessionModelSwitchError");
+}
+export async function runResilient(args) {
+    return runWithModelFallback({
+        primary: args.primary,
+        fallbacks: args.fallbacks,
+        signal: args.signal,
+        attempt: (candidate, signal) => runWithRetry({
+            ctx: { provider: candidate.provider, model: candidate.model },
+            signal,
+            attempt: (_attemptIndex, innerSignal) => args.invoke(candidate, innerSignal),
+        }),
+    });
+}
+function isAbortError(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return v.name === "AbortError" || v.code === "ABORT_ERR" || v.code === 20;
+}
+//# sourceMappingURL=model-fallback.js.map

package/dist/agents/model-fallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-fallback.js","sourceRoot":"","sources":["../../src/agents/model-fallback.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,sEAAsE;AACtE,sDAAsD;AACtD,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,6CAA6C;AAC7C,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAEhB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,GAEf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,MAAM,GAAG,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;AAkBnD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,QAAQ,CAAoB;IAC5B,kBAAkB,CAAU;IAErC,YAAY,QAA2B,EAAE,kBAA2B;QAClE,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC;aACvE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,CAAC,OAAO,QAAQ,CAAC,MAAM,+BAA+B,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;CACF;AAsBD;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAiC;IAEjC,MAAM,UAAU,GAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,qEAAqE;IACrE,wEAAwE;IACxE,qCAAqC;IACrC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,8DAA8D;IAC9D,+DAA+D;IAC/D,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAC/B,SAAS,EAAE,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE;YACrD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC9B,SAAS,EAAE,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE;gBACrD,YAAY,EAAE,CAAC;aAChB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,IAAI,YAAY,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAEjC,mEAAmE;YACnE,oEAAoE;YACpE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,iEAAiE;YACjE,mCAAmC;YACnC,EAAE;YACF,kEAAkE;YAClE,+DAA+D;YAC/D,kEAAkE;YAClE,uCAAuC;YACvC,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,IAAI,iBAAiB,IAAI,uBAAuB,EAAE,CAAC;oBACjD,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE;wBAC/C,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE;wBAChD,EAAE,EAAE,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,SAAS,EAAE;wBAC1C,OAAO,EAAE,iBAAiB;wBAC1B,GAAG,EAAE,uBAAuB;qBAC7B,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CACb,+CAA+C,uBAAuB,GAAG,EACzE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;gBACJ,CAAC;gBACD,iBAAiB,EAAE,CAAC;gBACpB,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBAClD,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE;oBAChD,EAAE,EAAE,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,SAAS,EAAE;oBAC1C,KAAK,EAAE,iBAAiB;iBACzB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAmB;oBAC/B,QAAQ,EAAE,GAAG,CAAC,YAAY;oBAC1B,KAAK,EAAE,GAAG,CAAC,SAAS;oBACpB,SAAS,EAAE,KAAK;iBACjB,CAAC;gBACF,+DAA+D;gBAC/D,8DAA8D;gBAC9D,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,IAAI,GAAoB;gBAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,MAAM;gBACN,YAAY;gBACZ,MAAM;aACP,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,CAAC;YAElC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC3B,SAAS,EAAE,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE;gBACrD,MAAM;gBACN,MAAM;gBACN,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM;gBACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC5C,CAAC,CAAC;YAEH,oEAAoE;YACpE,yDAAyD;YACzD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,cAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;YAED,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;gBAChE,iEAAiE;gBACjE,qEAAqE;gBACrE,sDAAsD;gBACtD,IAAI,MAAM,KAAK,iBAAiB;oBAAE,MAAM,GAAG,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,mEAAmE;gBACnE,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,qEAAqE;YACrE,gBAAgB;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/B,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACjB,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,KAAK,CAAC,sCAAsC,EAAE;wBAChD,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE;wBAC3C,MAAM;qBACP,CAAC,CAAC;oBACH,CAAC,EAAE,CAAC;oBACJ,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,mCAAmC;AACnC,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,qEAAqE;AACrE,qCAAqC;AACrC,EAAE;AACF,8DAA8D;AAC9D,wEAAwE;AACxE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,YAAY,CAAS;IACrB,SAAS,CAAS;IAClB,aAAa,CAAU;IAEhC,YAAY,IAAiE;QAC3E,KAAK,CAAC,wCAAwC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,CACL,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACxB,KAA4B,CAAC,IAAI,KAAK,6BAA6B,CACrE,CAAC;AACJ,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAI,IAAyB;IAC7D,OAAO,oBAAoB,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAC7B,YAAY,CAAC;YACX,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;YAC7D,MAAM;YACN,OAAO,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;SAC7E,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAA2C,CAAC;IACtD,OAAO,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;AAC5E,CAAC"}

package/dist/agents/model-resolution.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Never-miss model resolution — a layered resolution net (static registry
+ * find → discovery → dynamic resolve → configured fallback). The
+ * invariant: a `ModelRegistry.find` returning `undefined` is NEVER
+ * terminal while we can still discover or synthesize a usable Model.
+ *
+ * Resolution order (each step only runs if earlier ones miss):
+ *   1. Static registry find — Pi built-in catalog + models.json.
+ *   2. Local discovery — Ollama re-queries /api/tags + refresh (the model was
+ *      `ollama pull`ed after onboarding).
+ *   3. Live cloud discovery — hit the provider's models endpoint (OpenRouter
+ *      /api/v1/models, OpenAI-compatible /v1/models) for accurate metadata.
+ *   4. Synthesize-from-template — clone a catalogued model for the SAME
+ *      provider (inherits the correct api/baseUrl/auth routing), swap the id,
+ *      and apply discovered-or-default capabilities. This is what lets an
+ *      uncatalogued-but-valid cloud model resolve; the real API call then
+ *      validates the id (a typo surfaces as the provider's own error).
+ *   5. Synthesize-from-config — for a `custom` provider configured in
+ *      models.json (baseUrl/api), build a Model from that config.
+ *
+ * Returns the resolved/synthesized Model, or `undefined` if even synthesis is
+ * impossible (no template + no provider config) — the only legitimate miss.
+ */
+export interface ResolveModelArgs {
+    modelRegistry: unknown;
+    provider: string;
+    modelId: string;
+    /** Path to models.json (for Ollama re-discovery writes). */
+    modelsFile: string;
+    /** Auth storage to read the provider key for authenticated /models calls. */
+    authStorage?: unknown;
+}
+/**
+ * Resolve `provider/modelId` to a usable Model, discovering or synthesizing
+ * one on a static miss. See module header for the ordered net.
+ */
+export declare function resolveModelNeverMiss(args: ResolveModelArgs): Promise<unknown | undefined>;
+//# sourceMappingURL=model-resolution.d.ts.map

package/dist/agents/model-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-resolution.d.ts","sourceRoot":"","sources":["../../src/agents/model-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgCH,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAmDhG"}

package/dist/agents/model-resolution.js

@@ -0,0 +1,155 @@
+/**
+ * Never-miss model resolution — a layered resolution net (static registry
+ * find → discovery → dynamic resolve → configured fallback). The
+ * invariant: a `ModelRegistry.find` returning `undefined` is NEVER
+ * terminal while we can still discover or synthesize a usable Model.
+ *
+ * Resolution order (each step only runs if earlier ones miss):
+ *   1. Static registry find — Pi built-in catalog + models.json.
+ *   2. Local discovery — Ollama re-queries /api/tags + refresh (the model was
+ *      `ollama pull`ed after onboarding).
+ *   3. Live cloud discovery — hit the provider's models endpoint (OpenRouter
+ *      /api/v1/models, OpenAI-compatible /v1/models) for accurate metadata.
+ *   4. Synthesize-from-template — clone a catalogued model for the SAME
+ *      provider (inherits the correct api/baseUrl/auth routing), swap the id,
+ *      and apply discovered-or-default capabilities. This is what lets an
+ *      uncatalogued-but-valid cloud model resolve; the real API call then
+ *      validates the id (a typo surfaces as the provider's own error).
+ *   5. Synthesize-from-config — for a `custom` provider configured in
+ *      models.json (baseUrl/api), build a Model from that config.
+ *
+ * Returns the resolved/synthesized Model, or `undefined` if even synthesis is
+ * impossible (no template + no provider config) — the only legitimate miss.
+ */
+import * as fs from "node:fs";
+import { isLikelyReasoningModelId } from "../core/model-caps.js";
+import { rediscoverOllamaModel } from "../integrations/ollama.js";
+import { discoverCloudModelMeta } from "../integrations/provider-discovery.js";
+const DEFAULT_CONTEXT_WINDOW = 200_000;
+const DEFAULT_MAX_TOKENS = 8192;
+const ZERO_COST = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+/**
+ * Resolve `provider/modelId` to a usable Model, discovering or synthesizing
+ * one on a static miss. See module header for the ordered net.
+ */
+export async function resolveModelNeverMiss(args) {
+    const { provider, modelId, modelsFile } = args;
+    const registry = args.modelRegistry;
+    if (typeof registry.find !== "function")
+        return undefined;
+    // 1. Static.
+    const direct = registry.find(provider, modelId);
+    if (direct)
+        return direct;
+    // 2. Local Ollama discovery (writes models.json + refresh, then re-find).
+    if (provider === "ollama") {
+        const found = await rediscoverOllamaModel(modelsFile, modelId).catch(() => false);
+        if (found) {
+            registry.refresh?.();
+            const reFound = registry.find(provider, modelId);
+            if (reFound)
+                return reFound;
+        }
+        // Ollama daemon unreachable / model not pulled → no synth (a local model
+        // the daemon doesn't have can't be served). Surface the normal error.
+        return undefined;
+    }
+    // Find a catalogued template for this provider — it carries the correct
+    // transport (api/baseUrl) + auth routing, which we inherit for the synth.
+    const template = findProviderTemplate(registry, provider);
+    // 3. Live cloud discovery for accurate metadata (best-effort).
+    const apiKey = await readApiKey(args.authStorage, provider);
+    const discovery = await discoverCloudModelMeta(provider, modelId, {
+        baseUrl: typeof template?.baseUrl === "string" ? template.baseUrl : undefined,
+        apiKey,
+    });
+    // 4. Synthesize from the provider template (clone routing, override the
+    // per-model fields). We synthesize even when discovery couldn't confirm
+    // existence — a catch-all dynamic resolver pattern. The live API call
+    // validates the id and surfaces a precise provider error for a genuine
+    // typo, which is strictly better than an opaque "not registered".
+    if (template) {
+        return synthFromTemplate(template, modelId, discovery.meta);
+    }
+    // 5. Synthesize from a configured `custom`/OpenAI-compatible provider in
+    // models.json (no built-in template exists for it).
+    const configured = readProviderConfigFromModelsJson(modelsFile, provider);
+    if (configured?.baseUrl && configured?.api) {
+        return synthFromConfig(provider, modelId, configured, discovery.meta);
+    }
+    // No template, no config — the only legitimate miss.
+    return undefined;
+}
+function findProviderTemplate(registry, provider) {
+    if (typeof registry.getAvailable !== "function")
+        return undefined;
+    let list;
+    try {
+        list = registry.getAvailable() ?? [];
+    }
+    catch {
+        return undefined;
+    }
+    return list.find((m) => {
+        return !!m && typeof m === "object" && m.provider === provider;
+    });
+}
+function synthFromTemplate(template, modelId, meta) {
+    const reasoning = meta.reasoning ?? isLikelyReasoningModelId(modelId);
+    const input = meta.vision
+        ? ["text", "image"]
+        : Array.isArray(template.input)
+            ? template.input
+            : ["text"];
+    return {
+        // Inherit transport-critical fields (provider, api, baseUrl, headers) from
+        // the template so routing + auth resolve exactly as for a real model.
+        ...template,
+        id: modelId,
+        name: modelId,
+        reasoning,
+        input,
+        // Cost is per-model and unknown for a synthesized id — report zero rather
+        // than the template model's (wrong) pricing. Display-only.
+        cost: { ...ZERO_COST },
+        contextWindow: meta.contextWindow ?? template.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: DEFAULT_MAX_TOKENS,
+    };
+}
+function synthFromConfig(provider, modelId, cfg, meta) {
+    return {
+        provider,
+        id: modelId,
+        name: modelId,
+        api: cfg.api,
+        baseUrl: cfg.baseUrl,
+        reasoning: meta.reasoning ?? isLikelyReasoningModelId(modelId),
+        input: meta.vision ? ["text", "image"] : ["text"],
+        cost: { ...ZERO_COST },
+        contextWindow: meta.contextWindow ?? DEFAULT_CONTEXT_WINDOW,
+        maxTokens: DEFAULT_MAX_TOKENS,
+    };
+}
+function readProviderConfigFromModelsJson(modelsFile, provider) {
+    try {
+        const raw = fs.readFileSync(modelsFile, "utf8");
+        const parsed = JSON.parse(raw);
+        return parsed.providers?.[provider];
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readApiKey(authStorage, provider) {
+    const store = authStorage;
+    if (!store || typeof store.getApiKey !== "function")
+        return undefined;
+    try {
+        const key = await store.getApiKey(provider);
+        return typeof key === "string" && key.length > 0 ? key : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=model-resolution.js.map

package/dist/agents/model-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-resolution.js","sourceRoot":"","sources":["../../src/agents/model-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAA4B,MAAM,uCAAuC,CAAC;AAEzG,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAW,CAAC;AAgChF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAsB;IACjE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAA8B,CAAC;IACrD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAE1D,aAAa;IACb,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,0EAA0E;IAC1E,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC7B,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE1D,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE;QACjE,OAAO,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAC7E,MAAM;KACN,CAAC,CAAC;IAEH,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,UAAU,GAAG,gCAAgC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,UAAU,EAAE,OAAO,IAAI,UAAU,EAAE,GAAG,EAAE,CAAC;QAC5C,OAAO,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,qDAAqD;IACrD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuB,EAAE,QAAgB;IACtE,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,IAAe,CAAC;IACpB,IAAI,CAAC;QACJ,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAmB,EAAE;QACvC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAChF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAoB,EAAE,OAAe,EAAE,IAAyB;IAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,KAAK,GAAyB,IAAI,CAAC,MAAM;QAC9C,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAE,QAAQ,CAAC,KAA8B;YAC1C,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACb,OAAO;QACN,2EAA2E;QAC3E,sEAAsE;QACtE,GAAG,QAAQ;QACX,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,OAAO;QACb,SAAS;QACT,KAAK;QACL,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE;QACtB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,IAAI,sBAAsB;QACrF,SAAS,EAAE,kBAAkB;KAC7B,CAAC;AACH,CAAC;AAQD,SAAS,eAAe,CACvB,QAAgB,EAChB,OAAe,EACf,GAAuB,EACvB,IAAyB;IAEzB,OAAO;QACN,QAAQ;QACR,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC,OAAO,CAAC;QAC9D,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjD,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE;QACtB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,sBAAsB;QAC3D,SAAS,EAAE,kBAAkB;KAC7B,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,UAAkB,EAAE,QAAgB;IAC7E,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuD,CAAC;QACrF,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,WAAoB,EAAE,QAAgB;IAC/D,MAAM,KAAK,GAAG,WAA2C,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC"}

package/dist/agents/org/a2a-adapter.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Brigade virtual-office layer — A2A policy adapter (Stage C).
+ *
+ * `orgGraphAsA2APolicy(graph)` returns an `AgentToAgentPolicy`
+ * implementation that uses the derived org `graph.canSend(from, to)`
+ * reasoning instead of the legacy flat `allow` array.
+ *
+ * STAGE-C CONTRACT
+ * ----------------
+ *   - Only called when `cfg.org` is present AND `cfg.org.a2a.mode ===
+ *     "derived"` (or `"open"`). When `cfg.org` is absent, the legacy
+ *     `createAgentToAgentPolicy({enabled, allow})` from
+ *     `tools/sessions/shared.ts` runs unchanged.
+ *   - The returned object satisfies the SAME shape as the legacy
+ *     policy: `enabled / matchesAllow / isAllowed`. We keep
+ *     `enabled === true` and `matchesAllow` always-true so callers
+ *     that have not been taught about the org layer (e.g. tests
+ *     stubbing the shape) still behave as if A2A is enabled — the
+ *     real reasoning happens in `isAllowed`, which is the only entry
+ *     point existing call sites consult for actual cross-agent
+ *     decisions.
+ *   - Self-targets are always allowed (mirrors the legacy policy's
+ *     `requesterAgentId === targetAgentId` short-circuit).
+ *
+ * No external agent-codebase
+ * identifiers are referenced from this file.
+ */
+import type { AgentToAgentPolicy } from "../tools/sessions/shared.js";
+import type { OrgGraph } from "./types.js";
+/**
+ * Build an A2A policy from a derived org graph. The returned policy
+ * defers every cross-agent decision to `graph.edges` — `isAllowed(from,
+ * to)` returns true iff there exists a directed edge `from → to` in
+ * the graph (regardless of the edge's `reason`).
+ *
+ * `opts.orchestratorId` — the operator's DEFAULT agent (usually "main").
+ * It is the operator's own voice, not an org member: a derived-mode org
+ * chart used to hard-refuse it on the non-member check below, so the agent
+ * the operator actually talks to couldn't message its own crew ("ask
+ * eng-lead if they're up for work" → forbidden) and the model would offer
+ * to flip the WHOLE org to explicit mode as a workaround. Pairs touching
+ * the orchestrator bypass the chart; member↔member traffic stays
+ * graph-governed. Callers omit it (or pass undefined) to keep the strict
+ * members-only contract — `org.a2a.restrictDefaultAgent: true` does that.
+ */
+export declare function orgGraphAsA2APolicy(graph: OrgGraph, opts?: {
+    orchestratorId?: string;
+}): AgentToAgentPolicy;
+//# sourceMappingURL=a2a-adapter.d.ts.map

package/dist/agents/org/a2a-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-adapter.d.ts","sourceRoot":"","sources":["../../../src/agents/org/a2a-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACrC,kBAAkB,CAsCpB"}

package/dist/agents/org/a2a-adapter.js

@@ -0,0 +1,92 @@
+/**
+ * Brigade virtual-office layer — A2A policy adapter (Stage C).
+ *
+ * `orgGraphAsA2APolicy(graph)` returns an `AgentToAgentPolicy`
+ * implementation that uses the derived org `graph.canSend(from, to)`
+ * reasoning instead of the legacy flat `allow` array.
+ *
+ * STAGE-C CONTRACT
+ * ----------------
+ *   - Only called when `cfg.org` is present AND `cfg.org.a2a.mode ===
+ *     "derived"` (or `"open"`). When `cfg.org` is absent, the legacy
+ *     `createAgentToAgentPolicy({enabled, allow})` from
+ *     `tools/sessions/shared.ts` runs unchanged.
+ *   - The returned object satisfies the SAME shape as the legacy
+ *     policy: `enabled / matchesAllow / isAllowed`. We keep
+ *     `enabled === true` and `matchesAllow` always-true so callers
+ *     that have not been taught about the org layer (e.g. tests
+ *     stubbing the shape) still behave as if A2A is enabled — the
+ *     real reasoning happens in `isAllowed`, which is the only entry
+ *     point existing call sites consult for actual cross-agent
+ *     decisions.
+ *   - Self-targets are always allowed (mirrors the legacy policy's
+ *     `requesterAgentId === targetAgentId` short-circuit).
+ *
+ * No external agent-codebase
+ * identifiers are referenced from this file.
+ */
+/**
+ * Build an A2A policy from a derived org graph. The returned policy
+ * defers every cross-agent decision to `graph.edges` — `isAllowed(from,
+ * to)` returns true iff there exists a directed edge `from → to` in
+ * the graph (regardless of the edge's `reason`).
+ *
+ * `opts.orchestratorId` — the operator's DEFAULT agent (usually "main").
+ * It is the operator's own voice, not an org member: a derived-mode org
+ * chart used to hard-refuse it on the non-member check below, so the agent
+ * the operator actually talks to couldn't message its own crew ("ask
+ * eng-lead if they're up for work" → forbidden) and the model would offer
+ * to flip the WHOLE org to explicit mode as a workaround. Pairs touching
+ * the orchestrator bypass the chart; member↔member traffic stays
+ * graph-governed. Callers omit it (or pass undefined) to keep the strict
+ * members-only contract — `org.a2a.restrictDefaultAgent: true` does that.
+ */
+export function orgGraphAsA2APolicy(graph, opts = {}) {
+    // Precompute a Set<`from|to`> once so every isAllowed call is O(1).
+    // Edges are rebuilt by `deriveOrgGraph` on each cache miss, so the
+    // set is in sync with the graph it was created from.
+    const edgeSet = buildEdgeSet(graph.edges);
+    const orchestratorId = opts.orchestratorId?.trim() || undefined;
+    const matchesAllow = (_agentId) => {
+        // Legacy policies use this to seed catalog-side reachability hints.
+        // With the org graph there's no flat allowlist to consult; the only
+        // meaningful answer is "membership matters in isAllowed", so we
+        // return true here and let isAllowed reject. Anyone who explicitly
+        // calls matchesAllow on an org-mode policy gets a permissive
+        // answer — which is the safer default than a hard false that would
+        // hide every peer from listing UIs.
+        return true;
+    };
+    const isAllowed = (requesterAgentId, targetAgentId) => {
+        if (requesterAgentId === targetAgentId)
+            return true;
+        // Orchestrator bypass — the operator's default agent reaches (and is
+        // reachable by) everyone regardless of chart membership.
+        if (orchestratorId !== undefined &&
+            (requesterAgentId === orchestratorId || targetAgentId === orchestratorId)) {
+            return true;
+        }
+        // If either side isn't an org member, fall back to the safer
+        // answer: false. An ad-hoc agent without a `cfg.agents.<id>.org`
+        // block in a multi-agent org install is intentionally outside the
+        // routing fabric.
+        if (!graph.members[requesterAgentId])
+            return false;
+        if (!graph.members[targetAgentId])
+            return false;
+        return edgeSet.has(`${requesterAgentId}|${targetAgentId}`);
+    };
+    return { enabled: true, matchesAllow, isAllowed };
+}
+/**
+ * Build the `from|to` set used by `isAllowed`. Centralised so a future
+ * Stage-D verb-aware policy (delegate/escalate/review) can swap in a
+ * `Map<key, EdgeReason>` without touching the call sites.
+ */
+function buildEdgeSet(edges) {
+    const out = new Set();
+    for (const e of edges)
+        out.add(`${e.from}|${e.to}`);
+    return out;
+}
+//# sourceMappingURL=a2a-adapter.js.map

package/dist/agents/org/a2a-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-adapter.js","sourceRoot":"","sources":["../../../src/agents/org/a2a-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAe,EACf,OAAoC,EAAE;IAEtC,oEAAoE;IACpE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAEhE,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAW,EAAE;QACjD,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,mEAAmE;QACnE,6DAA6D;QAC7D,mEAAmE;QACnE,oCAAoC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,gBAAwB,EAAE,aAAqB,EAAW,EAAE;QAC7E,IAAI,gBAAgB,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QACpD,qEAAqE;QACrE,yDAAyD;QACzD,IACE,cAAc,KAAK,SAAS;YAC5B,CAAC,gBAAgB,KAAK,cAAc,IAAI,aAAa,KAAK,cAAc,CAAC,EACzE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,6DAA6D;QAC7D,iEAAiE;QACjE,kEAAkE;QAClE,kBAAkB;QAClB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,IAAI,aAAa,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAmB;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/agents/org/assets/mascots/README.md

@@ -0,0 +1,34 @@
+# Pride Mascot Assets
+
+Drop lion mascot PNGs here to enable mascot-mode templates in
+`pride-themes.ts` (themes with `mascot: true`).
+
+## Where this lives
+
+- **Source**: `src/agents/org/assets/mascots/` (this directory)
+- **Built**: `dist/agents/org/assets/mascots/` (copied by `scripts/build-done.mjs`)
+- **NOT** in `~/.brigade/workspace/` — that's user state. Brand assets
+  belong with the code so `npm install brigade` always ships them.
+
+## Filename conventions
+
+The renderer (`pride-html.ts`) looks for the following by default:
+
+| Filename                    | Used by                                  |
+| --------------------------- | ---------------------------------------- |
+| `lion-wave.png`             | Default mascot — waving lion             |
+| `lion-flex.png`             | Alt mascot — flexing lion                |
+| `lion-sit.png`              | Alt mascot — seated lion                 |
+| `lion-roar.png`             | Alt mascot — roaring lion                |
+| `lion-sleep.png`            | Alt mascot — sleeping lion (for taunts)  |
+
+When a theme has `mascot: true`, the renderer picks one of the
+available files (deterministically via the chart's rng seed). If no
+PNGs are present, the theme falls back to the lion emoji 🦁.
+
+## Format
+
+- **PNG** with transparent background (so it sits cleanly on any theme bg)
+- Roughly square aspect ratio (the renderer crops/scales to fit)
+- Recommended size: 512×512 to 1024×1024 (will be downscaled per template)
+- Embedded as base64 data URI in the HTML — no network request at render time