@spinabot/brigade 1.11.2 → 1.13.0

package/README.md

@@ -119,6 +119,7 @@ backend — all under one `~/.brigade/` directory you fully own.
 | 📅 **Always-on** | Run as a headless WebSocket gateway with a crash supervisor, cron jobs, and OS service install. |
 | 💬 **Channels** | Talk to your crew from WhatsApp and Telegram today; the adapter contract is built for more. |
 | 🔗 **1,000+ connectors** | Gmail, Slack, GitHub, Notion, Calendar, Linear… via the built-in Composio tool. |
+| 📄 **Reads & writes documents** | Send a PDF, Office doc, image, audio, or video and your crew *understands* it — then have it **create or edit** Word, Excel, PowerPoint, and PDF files and hand them back. |
 | 🧩 **MCP** | Expose your long-term memory to any MCP client (`brigade mcp`), or connect MCP servers in. |
 | 🗄️ **Your storage** | Default filesystem mode, or an optional **fully self-hosted Convex** backend with at-rest encryption. |
 | 🔐 **Yours** | Everything lives under `~/.brigade/`. Keys are stored locally at mode `0600`. `rm -rf ~/.brigade` wipes it clean. |
@@ -283,6 +284,17 @@ to **PLATFORM**, open **Settings → API Keys**, and copy the `ak_…` key. Hand
 Brigade once (*"set my Composio key to `ak_…`"*) and it's verified and stored encrypted.
 Full guide: **[docs/composio.md](docs/composio.md)**.
 
+### 📄 Documents & media
+Send your crew a file and it actually **reads** it: the `analyze_media` tool
+understands PDFs (text or scanned), Word / Excel / PowerPoint (including the images
+embedded inside them), plain images, audio, and video — auto-selecting the right
+provider and caching the result. The write side, `make_document` and
+`edit_document`, **creates and edits** Word / Excel / PowerPoint / PDF in place:
+fill templates and form fields, set cells and formulas, add charts, and
+merge / split / stamp / watermark PDFs — all with pure-JS libraries, no sandbox.
+Drop a document into a channel and Brigade sees it; ask for a report and it hands
+one back with `send_media`.
+
 ### 🧩 MCP
 Run `brigade mcp` to expose your long-term memory to any MCP client (Claude Desktop,
 editors, etc.) as add/search/context tools over stdio, owner-bound.
@@ -294,6 +306,14 @@ by a per-agent approval allowlist (`brigade exec`). Secrets in config use `${VAR
 references that resolve at read time and are never persisted resolved. Optional
 **AES-256-GCM at-rest encryption** in Convex mode (`brigade encrypt`).
 
+**Optional gateway tokens.** The gateway is unauthenticated and localhost-only by
+default — ideal for a single machine. Want more? Add one or more access tokens
+(`brigade gateway token new`) and every connection must then present a valid one
+(`Authorization: Bearer`, `x-brigade-token`, or `?token=`). **Multiple tokens** are
+supported, so you can hand a distinct token to each device and revoke one without
+disturbing the rest, and the same tokens secure `brigade expose`. Entirely opt-in:
+with no tokens configured, nothing changes.
+
 ### 🔀 Carrow — cross-model continuity
 Switch models mid-conversation **without losing context**. Carrow carries the full
 transcript onto the new model (it's the same session), **re-anchors your thinking
@@ -342,6 +362,7 @@ principle is the same: *independent verification, never the agent judging itself
 | `brigade status` | Snapshot config, sessions, and gateway state (`--json`) |
 | `brigade doctor` | Health-check Node, config, providers, prompts, logs, gateway (`--json`, `--strict`, `--gateway <url>`) |
 | `brigade logs` | Tail today's gateway log (`--follow`) |
+| `brigade update` · `upgrade` | Update Brigade to the latest code and restart the gateway (`--check`, `--no-restart`) |
 
 ### Gateway
 
@@ -351,6 +372,8 @@ principle is the same: *independent verification, never the agent judging itself
 | `brigade gateway status` · `stop` · `restart` | Inspect / stop / restart the running gateway |
 | `brigade gateway install` · `uninstall` | Install/remove as a system service (launchd / systemd / Task Scheduler) |
 | `brigade gateway supervise` | Out-of-process crash watchdog (respawns a wedged gateway) |
+| `brigade expose` · `expose stop` | Publish the gateway to the public internet via a secure, token-gated tunnel (alias: `bloody benchmark`) |
+| `brigade gateway token new` · `list` · `add` · `revoke` | Manage **optional** access tokens (multiple supported). No tokens → the gateway stays unauthenticated + localhost-only |
 
 ### Agents
 
@@ -428,6 +451,10 @@ brigade gateway stop
 brigade gateway restart
 brigade gateway install      # install as a system service (launchd / systemd / Task Scheduler)
 brigade gateway supervise    # out-of-process crash watchdog
+
+brigade gateway token new        # generate + store an access token (printed once)
+brigade gateway token list       # show configured tokens (masked) + whether auth is on
+brigade gateway token revoke 1   # remove a token by its number (or its exact value)
 ```
 
 | Flag | Default | Notes |
@@ -438,6 +465,13 @@ brigade gateway supervise    # out-of-process crash watchdog
 | `--quiet` | off | Suppress the live console stream |
 | `--log-level X` | `info` | `debug` / `info` / `warn` / `error` |
 
+**Optional authentication.** By default the gateway is unauthenticated and refuses to
+bind anywhere but loopback. To require a token, run `brigade gateway token new` (repeat
+for multiple tokens) and restart the gateway. On the same machine, clients read the
+token from config automatically; elsewhere pass `--token <t>` or set
+`BRIGADE_GATEWAY_TOKEN`. `BRIGADE_GATEWAY_TOKENS` (comma-separated) adds tokens via the
+environment. Remove every token to return to open, localhost-only mode.
+
 ### `brigade connect`
 
 Attaches a TUI to a running gateway. Same chat experience as `brigade`, but the
@@ -485,6 +519,27 @@ brigade doctor --json            # machine-readable
 brigade doctor --strict          # exit 1 on warnings (CI mode)
 ```
 
+### `brigade update`
+
+Bring Brigade up to date and reload the gateway. It auto-detects how Brigade is
+installed and does the right thing:
+
+- **npm global** — `npm i -g @spinabot/brigade@latest`, then restart.
+- **source checkout** — `git pull` (fast-forward, only when your tree is clean and
+  behind upstream — a dirty tree is left untouched and rebuilt as-is), then
+  `npm install`, `npm run build`, then restart.
+
+```bash
+brigade update            # update + restart the gateway
+brigade upgrade           # alias of update
+brigade update --check    # report whether newer code is available; change nothing
+brigade update --no-restart
+```
+
+If Brigade is installed as a background service (`brigade gateway install`) the
+restart is automatic; if you run the gateway in the foreground, restart it yourself
+to load the new code. Same behavior on macOS, Linux, and Windows.
+
 ### `brigade config`
 
 Read and write the local config without opening the TUI.
@@ -605,6 +660,7 @@ Every agent gets a curated toolset. Mutating/privileged tools are owner-gated
 - **Web:** `web_search`, `fetch_url`, `browser` (when a provider is configured)
 - **Connectors:** `composio` (1,000+ apps), `oauth_authorize`
 - **Generation:** `generate_image`
+- **Documents & media:** `analyze_media` (read/understand PDF · Office · image · audio · video), `make_document` · `edit_document` (create & edit Word/Excel/PowerPoint/PDF)
 - **Channels:** `send_message`, `send_media` (when a channel is linked)
 
 ---

package/dist/agents/tools/edge-tts.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Microsoft Edge "Read Aloud" text-to-speech over WebSocket — FREE, no API key.
+ *
+ * This is the same free endpoint the `node-edge-tts` package uses (the Bing /
+ * "Read Aloud" TTS WebSocket). Auth is an embedded TrustedClientToken plus a
+ * computed `Sec-MS-GEC` token (a SHA-256 of the current Windows file-time ticks,
+ * floored to 5 minutes, concatenated with the token). The socket sends a
+ * `speech.config` frame then an `ssml` frame; audio arrives as binary WS frames
+ * (after a `Path:audio` header) and the turn ends on a `Path:turn.end` text
+ * frame. Returns MP3 bytes.
+ *
+ * Re-implemented self-contained (no new dependency) over the `ws` package that
+ * Brigade already ships for the gateway/TUI.
+ */
+/** Minimal WebSocket surface edge-tts uses — lets tests inject a fake socket. */
+export interface EdgeWebSocketLike {
+    on(event: "open" | "message" | "error" | "close", cb: (...args: unknown[]) => void): void;
+    send(data: string): void;
+    close(): void;
+}
+export interface EdgeTtsOptions {
+    text: string;
+    voice: string;
+    outputFormat?: string;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    /** Test seam: inject a WebSocket factory instead of opening a real socket. */
+    wsFactory?: (url: string, headers: Record<string, string>) => EdgeWebSocketLike;
+}
+/** Synthesize speech via the free Edge endpoint. Resolves with MP3 bytes. */
+export declare function synthesizeEdge(opts: EdgeTtsOptions): Promise<Buffer>;
+/**
+ * The `Sec-MS-GEC` auth token: uppercase SHA-256 hex of `${ticks}${TrustedClientToken}`,
+ * where `ticks` = Windows file time (100-ns intervals since 1601-01-01) floored to
+ * the nearest 5 minutes. BigInt math — the tick count exceeds Number.MAX_SAFE_INTEGER.
+ */
+export declare function secMsGec(nowMs?: number): string;
+/** The opening `speech.config` frame carrying the requested output format. */
+export declare function configFrame(outputFormat: string): string;
+/** The `ssml` frame carrying the voice + escaped text. */
+export declare function ssmlFrame(text: string, voice: string): string;
+/** Minimal XML escaping for SSML text content. */
+export declare function escapeXml(s: string): string;
+//# sourceMappingURL=edge-tts.d.ts.map

package/dist/agents/tools/edge-tts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-tts.d.ts","sourceRoot":"","sources":["../../../src/agents/tools/edge-tts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IACjC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1F,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,iBAAiB,CAAC;CAChF;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsE1E;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,GAAE,MAAmB,GAAG,MAAM,CAK3D;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAYxD;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,kDAAkD;AAClD,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO3C"}

package/dist/agents/tools/edge-tts.js

@@ -0,0 +1,142 @@
+/**
+ * Microsoft Edge "Read Aloud" text-to-speech over WebSocket — FREE, no API key.
+ *
+ * This is the same free endpoint the `node-edge-tts` package uses (the Bing /
+ * "Read Aloud" TTS WebSocket). Auth is an embedded TrustedClientToken plus a
+ * computed `Sec-MS-GEC` token (a SHA-256 of the current Windows file-time ticks,
+ * floored to 5 minutes, concatenated with the token). The socket sends a
+ * `speech.config` frame then an `ssml` frame; audio arrives as binary WS frames
+ * (after a `Path:audio` header) and the turn ends on a `Path:turn.end` text
+ * frame. Returns MP3 bytes.
+ *
+ * Re-implemented self-contained (no new dependency) over the `ws` package that
+ * Brigade already ships for the gateway/TUI.
+ */
+import crypto from "node:crypto";
+import { WebSocket } from "ws";
+const TRUSTED_TOKEN = "6A5AA1D4EAFF4E9FB37E23D68491D6F4";
+const GEC_VERSION = "1-131.0.2903.86";
+const WSS_BASE = "wss://speech.platform.bing.com/consumer/speech/synthesize/readaloud/edge/v1";
+const CHROME_UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0";
+/** Synthesize speech via the free Edge endpoint. Resolves with MP3 bytes. */
+export async function synthesizeEdge(opts) {
+    const outputFormat = opts.outputFormat ?? "audio-24khz-48kbitrate-mono-mp3";
+    const url = `${WSS_BASE}?TrustedClientToken=${TRUSTED_TOKEN}&Sec-MS-GEC=${secMsGec()}&Sec-MS-GEC-Version=${GEC_VERSION}`;
+    const headers = {
+        "User-Agent": CHROME_UA,
+        Origin: "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold",
+        "Accept-Language": "en-US,en;q=0.9",
+    };
+    const ws = opts.wsFactory
+        ? opts.wsFactory(url, headers)
+        : new WebSocket(url, { headers });
+    return await new Promise((resolve, reject) => {
+        const chunks = [];
+        let settled = false;
+        const timer = setTimeout(() => fail(new Error("Edge TTS timed out")), opts.timeoutMs ?? 30_000);
+        const onAbort = () => fail(new Error("aborted"));
+        opts.signal?.addEventListener("abort", onAbort, { once: true });
+        const cleanup = () => {
+            clearTimeout(timer);
+            opts.signal?.removeEventListener("abort", onAbort);
+            try {
+                ws.close();
+            }
+            catch {
+                /* ignore */
+            }
+        };
+        function fail(err) {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(err);
+        }
+        function done() {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            if (chunks.length === 0)
+                reject(new Error("Edge TTS produced no audio"));
+            else
+                resolve(Buffer.concat(chunks));
+        }
+        ws.on("open", () => {
+            ws.send(configFrame(outputFormat));
+            ws.send(ssmlFrame(opts.text, opts.voice));
+        });
+        ws.on("message", (...args) => {
+            const data = args[0];
+            const isBinary = args[1] === true;
+            const buf = Buffer.isBuffer(data)
+                ? data
+                : data instanceof ArrayBuffer
+                    ? Buffer.from(data)
+                    : Buffer.from(String(data), "utf8");
+            if (isBinary) {
+                // Binary frame: first 2 bytes = big-endian header length; audio follows.
+                if (buf.length < 2)
+                    return;
+                const headerLen = buf.readUInt16BE(0);
+                const header = buf.subarray(2, 2 + headerLen).toString("utf8");
+                if (header.includes("Path:audio"))
+                    chunks.push(buf.subarray(2 + headerLen));
+            }
+            else if (buf.toString("utf8").includes("Path:turn.end")) {
+                done();
+            }
+        });
+        ws.on("error", (...args) => {
+            const e = args[0];
+            fail(e instanceof Error ? e : new Error(String(e)));
+        });
+        ws.on("close", () => {
+            if (!settled)
+                done();
+        });
+    });
+}
+/**
+ * The `Sec-MS-GEC` auth token: uppercase SHA-256 hex of `${ticks}${TrustedClientToken}`,
+ * where `ticks` = Windows file time (100-ns intervals since 1601-01-01) floored to
+ * the nearest 5 minutes. BigInt math — the tick count exceeds Number.MAX_SAFE_INTEGER.
+ */
+export function secMsGec(nowMs = Date.now()) {
+    const secondsSince1601 = BigInt(Math.floor(nowMs / 1000) + 11_644_473_600);
+    const roundedSeconds = (secondsSince1601 / 300n) * 300n;
+    const ticks = roundedSeconds * 10000000n;
+    return crypto.createHash("sha256").update(`${ticks}${TRUSTED_TOKEN}`).digest("hex").toUpperCase();
+}
+/** The opening `speech.config` frame carrying the requested output format. */
+export function configFrame(outputFormat) {
+    const cfg = {
+        context: {
+            synthesis: {
+                audio: {
+                    metadataoptions: { sentenceBoundaryEnabled: false, wordBoundaryEnabled: false },
+                    outputFormat,
+                },
+            },
+        },
+    };
+    return `X-Timestamp:${new Date().toString()}\r\nContent-Type:application/json; charset=utf-8\r\nPath:speech.config\r\n\r\n${JSON.stringify(cfg)}`;
+}
+/** The `ssml` frame carrying the voice + escaped text. */
+export function ssmlFrame(text, voice) {
+    const id = crypto.randomUUID().replace(/-/g, "");
+    const ssml = `<speak version='1.0' xmlns='http://www.w3.org/2001/10/synthesis' xml:lang='en-US'>` +
+        `<voice name='${voice}'><prosody pitch='+0Hz' rate='+0%' volume='+0%'>${escapeXml(text)}</prosody></voice></speak>`;
+    return `X-RequestId:${id}\r\nContent-Type:application/ssml+xml\r\nX-Timestamp:${new Date().toString()}Z\r\nPath:ssml\r\n\r\n${ssml}`;
+}
+/** Minimal XML escaping for SSML text content. */
+export function escapeXml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/'/g, "&apos;")
+        .replace(/"/g, "&quot;");
+}
+//# sourceMappingURL=edge-tts.js.map

package/dist/agents/tools/edge-tts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-tts.js","sourceRoot":"","sources":["../../../src/agents/tools/edge-tts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,QAAQ,GAAG,6EAA6E,CAAC;AAC/F,MAAM,SAAS,GACd,+HAA+H,CAAC;AAmBjI,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAoB;IACxD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,iCAAiC,CAAC;IAC5E,MAAM,GAAG,GAAG,GAAG,QAAQ,uBAAuB,aAAa,eAAe,QAAQ,EAAE,uBAAuB,WAAW,EAAE,CAAC;IACzH,MAAM,OAAO,GAA2B;QACvC,YAAY,EAAE,SAAS;QACvB,MAAM,EAAE,qDAAqD;QAC7D,iBAAiB,EAAE,gBAAgB;KACnC,CAAC;IACF,MAAM,EAAE,GAAsB,IAAI,CAAC,SAAS;QAC3C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC;QAC9B,CAAC,CAAE,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAkC,CAAC;IAErE,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC;gBACJ,EAAE,CAAC,KAAK,EAAE,CAAC;YACZ,CAAC;YAAC,MAAM,CAAC;gBACR,YAAY;YACb,CAAC;QACF,CAAC,CAAC;QACF,SAAS,IAAI,CAAC,GAAU;YACvB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;QACD,SAAS,IAAI;YACZ,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;;gBACpE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAClB,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,YAAY,WAAW;oBAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBACnB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,QAAQ,EAAE,CAAC;gBACd,yEAAyE;gBACzE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBAC3B,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC3D,IAAI,EAAE,CAAC;YACR,CAAC;QACF,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,OAAO;gBAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,cAAc,GAAG,SAAW,CAAC;IAC3C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AACnG,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC/C,MAAM,GAAG,GAAG;QACX,OAAO,EAAE;YACR,SAAS,EAAE;gBACV,KAAK,EAAE;oBACN,eAAe,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE;oBAC/E,YAAY;iBACZ;aACD;SACD;KACD,CAAC;IACF,OAAO,eAAe,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,iFAAiF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AACnJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GACT,oFAAoF;QACpF,gBAAgB,KAAK,mDAAmD,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACrH,OAAO,eAAe,EAAE,wDAAwD,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,yBAAyB,IAAI,EAAE,CAAC;AACtI,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,SAAS,CAAC,CAAS;IAClC,OAAO,CAAC;SACN,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3B,CAAC"}

package/dist/agents/tools/generate-music-tool.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `generate_music` tool — text-to-music generation, modeled on the proven
+ * `generate_speech` self-contained pattern.
+ *
+ * Why this tool exists
+ * --------------------
+ * Same reasoning as `generate_speech`/`generate_image`: without a first-class
+ * tool, "make a song" / "compose background music" sends the model to raw
+ * `curl` against a music API — the key flows through a shell, the (binary or
+ * base64) audio response gets mangled by a text-only parser, and a billed
+ * generation is dropped. This tool owns the call in-process: stored auth,
+ * validated params, a parser that understands each provider's audio shape, and
+ * a saved file the model hands to `send_media`.
+ *
+ * Providers (auto-selected by which key is configured, preference order):
+ *   • google     — Lyria via Gemini generateContent (AUDIO modality) → base64
+ *                  audio (mp3). Single POST, no poll.
+ *   • minimax    — Music generation → URL or inline (hex/base64) audio (mp3).
+ *   • elevenlabs — Music endpoint → raw mp3 bytes.
+ * Keys resolve through `resolveMediaProviderKey` (the same credential-store +
+ * env path the media-understanding subsystem uses), so music generation works
+ * for whichever provider the operator already configured — no bespoke auth.
+ *
+ * Flow: generate → bytes saved under `<cache>/audio/` → result text carries a
+ * `MEDIA:<saved-path>` line → the model delivers with `send_media({path})`.
+ */
+import { Type } from "typebox";
+import type { BrigadeTool } from "./types.js";
+type MusicProviderId = "google" | "minimax" | "elevenlabs";
+declare const GenerateMusicParams: Type.TObject<{
+    action: Type.TOptional<Type.TUnion<[Type.TLiteral<"generate">, Type.TLiteral<"list">]>>;
+    prompt: Type.TOptional<Type.TString>;
+    lyrics: Type.TOptional<Type.TString>;
+    instrumental: Type.TOptional<Type.TBoolean>;
+    provider: Type.TOptional<Type.TUnion<[Type.TLiteral<"google">, Type.TLiteral<"minimax">, Type.TLiteral<"elevenlabs">]>>;
+    model: Type.TOptional<Type.TString>;
+    durationSeconds: Type.TOptional<Type.TInteger>;
+    filename: Type.TOptional<Type.TString>;
+}>;
+interface GenerateMusicDetails {
+    action: "generate" | "list";
+    provider?: string;
+    model?: string;
+    path?: string;
+    providers?: string[];
+    ok: boolean;
+    message?: string;
+}
+export interface MakeGenerateMusicToolOptions {
+    /** Caller's agent id — drives which credential store backs the key. */
+    agentId?: string;
+    /** Test seam: replaces global fetch. */
+    fetchFn?: typeof fetch;
+    /** Test seam: output directory override. Default `<cache>/audio`. */
+    outDirOverride?: string;
+    /** Test seam: per-provider API-key resolver override. */
+    resolveKey?: (provider: MusicProviderId) => string;
+}
+export declare function makeGenerateMusicTool(opts?: MakeGenerateMusicToolOptions): BrigadeTool<typeof GenerateMusicParams, GenerateMusicDetails>;
+export {};
+//# sourceMappingURL=generate-music-tool.d.ts.map

package/dist/agents/tools/generate-music-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-music-tool.d.ts","sourceRoot":"","sources":["../../../src/agents/tools/generate-music-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAM/B,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,YAAY,CAAC;AAO/D,KAAK,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC;AAW3D,QAAA,MAAM,mBAAmB;;;;;;;;;EAwBvB,CAAC;AAEH,UAAU,oBAAoB;IAC7B,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC5C,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,MAAM,CAAC;CACnD;AAED,wBAAgB,qBAAqB,CACpC,IAAI,GAAE,4BAAiC,GACrC,WAAW,CAAC,OAAO,mBAAmB,EAAE,oBAAoB,CAAC,CAwG/D"}