@spinabot/brigade 1.13.0 → 1.14.0

package/dist/core/config-ops.js

@@ -0,0 +1,241 @@
+/**
+ * Config path operations — the pure logic behind `brigade config <get|set|
+ * unset|list|schema|validate>` AND the `config.*` gateway RPCs.
+ *
+ * Extracted from `cli/commands/config-cmd.ts` so the CLI and the gateway speak
+ * to ONE implementation: a remote client (web console) doing `config.set` and
+ * an operator doing `brigade config set` parse paths, redact secrets, and
+ * mutate brigade.json identically.
+ *
+ * The path helpers are pure (no I/O). The `handle*` functions are the gateway
+ * handlers: they read/write through the mode-aware `loadConfig`/`saveConfig`
+ * (filesystem OR Convex), so `config.*` works in both storage modes.
+ *
+ * Secret handling mirrors the CLI: any segment matching SENSITIVE_SEGMENT
+ * renders as `__BRIGADE_REDACTED__` in get/list output. Writes are NOT
+ * redacted (you can set a key you can't read back in plaintext), and the
+ * on-disk `${VAR}` restoration in `saveConfig` keeps resolved secrets off disk.
+ */
+import JSON5 from "json5";
+import { BrigadeConfigSchema, collectBrigadeConfigErrors } from "./brigade-config.js";
+import { loadConfig, saveConfig } from "./config.js";
+export const REDACTED_SENTINEL = "__BRIGADE_REDACTED__";
+const SENSITIVE_SEGMENT = /^(key|apikey|token|secret|password|refreshtoken|accesstoken)$/i;
+/* ───────────────────────── path helpers ───────────────────────── */
+/**
+ * Parse a config path into segments. Supports dot-notation
+ * (`agents.defaults.provider`), escaped dots (`keys.foo\.bar`), bracket array
+ * indices (`a.b[0]`), and bracket literal keys (`a["my.key"]`).
+ */
+export function parsePath(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        throw new Error("config path is empty");
+    }
+    const segments = [];
+    let buf = "";
+    for (let i = 0; i < trimmed.length; i++) {
+        const ch = trimmed[i];
+        if (ch === "\\" && trimmed[i + 1] === ".") {
+            buf += ".";
+            i++;
+            continue;
+        }
+        if (ch === ".") {
+            if (buf.length === 0) {
+                throw new Error(`empty segment in config path "${raw}"`);
+            }
+            segments.push(buf);
+            buf = "";
+            continue;
+        }
+        if (ch === "[") {
+            if (buf.length > 0) {
+                segments.push(buf);
+                buf = "";
+            }
+            const close = trimmed.indexOf("]", i);
+            if (close === -1) {
+                throw new Error(`unclosed "[" in config path "${raw}"`);
+            }
+            let inside = trimmed.slice(i + 1, close).trim();
+            if ((inside.startsWith('"') && inside.endsWith('"')) ||
+                (inside.startsWith("'") && inside.endsWith("'"))) {
+                inside = inside.slice(1, -1);
+            }
+            if (inside.length === 0) {
+                throw new Error(`empty bracket segment in config path "${raw}"`);
+            }
+            segments.push(inside);
+            i = close;
+            continue;
+        }
+        buf += ch;
+    }
+    if (buf.length > 0)
+        segments.push(buf);
+    if (segments.length === 0) {
+        throw new Error(`unable to parse config path "${raw}"`);
+    }
+    return segments;
+}
+/** True iff the segment looks like a non-negative integer (array index). */
+function isIndexSegment(seg) {
+    return /^[0-9]+$/.test(seg);
+}
+export function getNested(root, segments) {
+    let cur = root;
+    for (const seg of segments) {
+        if (cur === null || cur === undefined)
+            return undefined;
+        if (Array.isArray(cur) && isIndexSegment(seg)) {
+            cur = cur[Number(seg)];
+            continue;
+        }
+        if (typeof cur !== "object")
+            return undefined;
+        cur = cur[seg];
+    }
+    return cur;
+}
+export function setNested(root, segments, value) {
+    // biome-ignore lint/suspicious/noExplicitAny: walking an untyped config tree.
+    let cur = root;
+    for (let i = 0; i < segments.length - 1; i++) {
+        const seg = segments[i] ?? "";
+        const nextSeg = segments[i + 1] ?? "";
+        const wantArray = isIndexSegment(nextSeg);
+        const existing = Array.isArray(cur) && isIndexSegment(seg) ? cur[Number(seg)] : cur[seg];
+        if (existing === undefined || existing === null || typeof existing !== "object") {
+            const fresh = wantArray ? [] : {};
+            if (Array.isArray(cur) && isIndexSegment(seg)) {
+                cur[Number(seg)] = fresh;
+            }
+            else {
+                cur[seg] = fresh;
+            }
+            cur = fresh;
+        }
+        else {
+            cur = Array.isArray(cur) && isIndexSegment(seg) ? cur[Number(seg)] : cur[seg];
+        }
+    }
+    const tail = segments[segments.length - 1] ?? "";
+    if (Array.isArray(cur) && isIndexSegment(tail)) {
+        cur[Number(tail)] = value;
+    }
+    else {
+        cur[tail] = value;
+    }
+}
+export function deleteNested(root, segments) {
+    // biome-ignore lint/suspicious/noExplicitAny: walking an untyped config tree.
+    let cur = root;
+    for (let i = 0; i < segments.length - 1; i++) {
+        const seg = segments[i] ?? "";
+        const next = Array.isArray(cur) && isIndexSegment(seg) ? cur[Number(seg)] : cur?.[seg];
+        if (next === undefined || next === null || typeof next !== "object")
+            return false;
+        cur = next;
+    }
+    const tail = segments[segments.length - 1] ?? "";
+    if (Array.isArray(cur) && isIndexSegment(tail)) {
+        const idx = Number(tail);
+        if (idx < cur.length) {
+            cur.splice(idx, 1);
+            return true;
+        }
+        return false;
+    }
+    if (cur && typeof cur === "object" && tail in cur) {
+        delete cur[tail];
+        return true;
+    }
+    return false;
+}
+/** JSON5-parse a CLI string value, falling back to the raw string. */
+export function parseConfigValue(raw, opts = {}) {
+    if (opts.strictJson) {
+        return JSON.parse(raw);
+    }
+    try {
+        return JSON5.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+/** Deep-redact any string value whose key looks secret. */
+export function redactDeep(value) {
+    if (value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => redactDeep(v));
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (SENSITIVE_SEGMENT.test(k) && typeof v === "string" && v.length > 0) {
+            out[k] = REDACTED_SENTINEL;
+        }
+        else {
+            out[k] = redactDeep(v);
+        }
+    }
+    return out;
+}
+/* ───────────────────── structured operations ──────────────────── */
+/** Read a redacted value at `rawPath`. `found:false` when the key is absent. */
+export function configGetValue(cfg, rawPath) {
+    const value = getNested(cfg, parsePath(rawPath));
+    if (value === undefined)
+        return { found: false };
+    return { found: true, value: redactDeep(value) };
+}
+/** Mutate `cfg` in place: set `rawPath` to `value`. */
+export function configSetValue(cfg, rawPath, value) {
+    setNested(cfg, parsePath(rawPath), value);
+}
+/** Mutate `cfg` in place: remove `rawPath`. Returns whether anything was removed. */
+export function configUnsetValue(cfg, rawPath) {
+    return deleteNested(cfg, parsePath(rawPath));
+}
+export function handleConfigGet(params) {
+    const p = (params ?? {});
+    const rawPath = (p.path ?? "").trim();
+    if (!rawPath)
+        throw new Error("config.get: missing 'path'");
+    return configGetValue(loadConfig(), rawPath);
+}
+export function handleConfigSet(params) {
+    const p = (params ?? {});
+    const rawPath = (p.path ?? "").trim();
+    if (!rawPath)
+        throw new Error("config.set: missing 'path'");
+    const cfg = loadConfig();
+    configSetValue(cfg, rawPath, p.value);
+    saveConfig(cfg);
+    return { ok: true, path: rawPath, value: redactDeep(p.value) };
+}
+export function handleConfigUnset(params) {
+    const p = (params ?? {});
+    const rawPath = (p.path ?? "").trim();
+    if (!rawPath)
+        throw new Error("config.unset: missing 'path'");
+    const cfg = loadConfig();
+    const removed = configUnsetValue(cfg, rawPath);
+    if (removed)
+        saveConfig(cfg);
+    return { ok: removed, path: rawPath, removed };
+}
+export function handleConfigList(params) {
+    const p = (params ?? {});
+    const cfg = loadConfig();
+    return { config: p.redact === false ? cfg : redactDeep(cfg) };
+}
+export function handleConfigSchema(_params) {
+    return { schema: BrigadeConfigSchema };
+}
+export function handleConfigValidate(_params) {
+    const issues = collectBrigadeConfigErrors(loadConfig());
+    return { valid: issues.length === 0, issues };
+}
+//# sourceMappingURL=config-ops.js.map

package/dist/core/config-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-ops.js","sourceRoot":"","sources":["../../src/core/config-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACxD,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F,sEAAsE;AAEtE;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3C,GAAG,IAAI,GAAG,CAAC;YACX,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,GAAG,CAAC,CAAC;YAC1D,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,GAAG,EAAE,CAAC;YACT,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,GAAG,EAAE,CAAC;YACV,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IACC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC/C,CAAC;gBACF,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,GAAG,CAAC,CAAC;YAClE,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC,GAAG,KAAK,CAAC;YACV,SAAS;QACV,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;IACX,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,GAAW;IAClC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,QAAkB;IAC1D,IAAI,GAAG,GAAY,IAAI,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACV,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAA6B,EAAE,QAAkB,EAAE,KAAc;IAC1F,8EAA8E;IAC9E,IAAI,GAAG,GAAQ,IAAI,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,GAAG,GAAG,KAAK,CAAC;QACb,CAAC;aAAM,CAAC;YACP,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;SAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAA6B,EAAE,QAAkB;IAC7E,8EAA8E;IAC9E,IAAI,GAAG,GAAQ,IAAI,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAClF,GAAG,GAAG,IAAI,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,OAAiC,EAAE;IAChF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC;IACZ,CAAC;AACF,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;QAC5B,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,sEAAsE;AAEtE,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,OAAe;IAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,GAA4B,EAAE,OAAe,EAAE,KAAc;IAC3F,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,GAA4B,EAAE,OAAe;IAC7E,OAAO,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAmCD,MAAM,UAAU,eAAe,CAAC,MAAe;IAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAsB,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC,UAAU,EAA6B,EAAE,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAuC,CAAC;IAC/D,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,UAAU,EAA6B,CAAC;IACpD,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACtC,UAAU,CAAC,GAAY,CAAC,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAChD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAsB,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,UAAU,EAA6B,CAAC;IACpD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO;QAAE,UAAU,CAAC,GAAY,CAAC,CAAC;IACtC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC/C,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAyB,CAAC;IACjD,MAAM,GAAG,GAAG,UAAU,EAA6B,CAAC;IACpD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAiB;IACnD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAiB;IACrD,MAAM,MAAM,GAAG,0BAA0B,CAAC,UAAU,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC"}

package/dist/core/exec-ops.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Exec-approval operations behind the `exec.*` gateway RPCs — the
+ * `brigade exec <list|allow|allow-pattern|remove|deny-test>` surface, reachable
+ * from a remote client.
+ *
+ * OPERATOR-SCOPED, per-agent: manages an agent's bash approval allowlist. NOT
+ * session-targeted — the operator manages exec trust for their OWN agents, the
+ * same posture as the already-allowlisted `exec-grant-skill` / `exec-allow-all`
+ * RPCs. No per-session access guard is needed (and the guard-sweep allowlists
+ * these by name for that reason).
+ *
+ * All structured returns (no console I/O) so the gateway can hand them straight
+ * back to a WS client. The underlying primitives in `exec-approvals.ts` are the
+ * SAME ones the CLI calls, so `brigade exec allow` and `exec.allow` over the
+ * wire behave identically — including the hard-deny safety net.
+ */
+import { type ApprovalDecision } from "./exec-approvals.js";
+export interface ExecListResult {
+    agentId: string;
+    filePath: string;
+    commands: string[];
+    patterns: string[];
+}
+export declare function handleExecList(params: unknown): ExecListResult;
+export interface ExecMutateResult {
+    ok: boolean;
+    agentId: string;
+    kind?: "exact" | "pattern";
+    value?: string;
+    reason?: string;
+}
+export declare function handleExecAllow(params: unknown): ExecMutateResult;
+export declare function handleExecAllowPattern(params: unknown): ExecMutateResult;
+export interface ExecRemoveResult {
+    ok: boolean;
+    agentId: string;
+    removedCommands: number;
+    removedPatterns: number;
+    reason?: string;
+}
+export declare function handleExecRemove(params: unknown): ExecRemoveResult;
+export interface ExecDenyTestResult {
+    agentId: string;
+    command: string;
+    decision: ApprovalDecision;
+}
+export declare function handleExecDenyTest(params: unknown): ExecDenyTestResult;
+//# sourceMappingURL=exec-ops.d.ts.map

package/dist/core/exec-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-ops.d.ts","sourceRoot":"","sources":["../../src/core/exec-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACN,KAAK,gBAAgB,EAOrB,MAAM,qBAAqB,CAAC;AAO7B,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AACD,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc,CAK9D;AAED,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AACD,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAejE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAiBxE;AAED,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AACD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAsBlE;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;CAC3B;AACD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAKtE"}

package/dist/core/exec-ops.js

@@ -0,0 +1,101 @@
+/**
+ * Exec-approval operations behind the `exec.*` gateway RPCs — the
+ * `brigade exec <list|allow|allow-pattern|remove|deny-test>` surface, reachable
+ * from a remote client.
+ *
+ * OPERATOR-SCOPED, per-agent: manages an agent's bash approval allowlist. NOT
+ * session-targeted — the operator manages exec trust for their OWN agents, the
+ * same posture as the already-allowlisted `exec-grant-skill` / `exec-allow-all`
+ * RPCs. No per-session access guard is needed (and the guard-sweep allowlists
+ * these by name for that reason).
+ *
+ * All structured returns (no console I/O) so the gateway can hand them straight
+ * back to a WS client. The underlying primitives in `exec-approvals.ts` are the
+ * SAME ones the CLI calls, so `brigade exec allow` and `exec.allow` over the
+ * wire behave identically — including the hard-deny safety net.
+ */
+import { DEFAULT_AGENT_ID } from "../config/paths.js";
+import { BrigadeApprovalRefusedError, decideApproval, getApprovalsFilePath, listApprovals, recordApproval, removeApproval, } from "./exec-approvals.js";
+function resolveAgentId(agentId) {
+    const t = (agentId ?? "").trim();
+    return t.length > 0 ? t : DEFAULT_AGENT_ID;
+}
+export function handleExecList(params) {
+    const p = (params ?? {});
+    const agentId = resolveAgentId(p.agentId);
+    const { commands, patterns } = listApprovals(agentId);
+    return { agentId, filePath: getApprovalsFilePath(agentId), commands, patterns };
+}
+export function handleExecAllow(params) {
+    const p = (params ?? {});
+    const agentId = resolveAgentId(p.agentId);
+    const cmd = (p.command ?? "").trim();
+    if (!cmd)
+        return { ok: false, agentId, reason: "command is empty" };
+    if (decideApproval(cmd, agentId) === "deny") {
+        return { ok: false, agentId, value: cmd, reason: "matches a hard-deny pattern and cannot be allowlisted" };
+    }
+    try {
+        recordApproval(cmd, "exact", agentId);
+    }
+    catch (err) {
+        if (err instanceof BrigadeApprovalRefusedError)
+            return { ok: false, agentId, value: cmd, reason: err.message };
+        throw err;
+    }
+    return { ok: true, agentId, kind: "exact", value: cmd };
+}
+export function handleExecAllowPattern(params) {
+    const p = (params ?? {});
+    const agentId = resolveAgentId(p.agentId);
+    const pat = (p.pattern ?? "").trim();
+    if (!pat)
+        return { ok: false, agentId, reason: "pattern is empty" };
+    try {
+        new RegExp(pat);
+    }
+    catch (err) {
+        return { ok: false, agentId, value: pat, reason: `invalid regex: ${err.message}` };
+    }
+    try {
+        recordApproval(pat, "pattern", agentId);
+    }
+    catch (err) {
+        if (err instanceof BrigadeApprovalRefusedError)
+            return { ok: false, agentId, value: pat, reason: err.message };
+        throw err;
+    }
+    return { ok: true, agentId, kind: "pattern", value: pat };
+}
+export function handleExecRemove(params) {
+    const p = (params ?? {});
+    const agentId = resolveAgentId(p.agentId);
+    const value = (p.value ?? "").trim();
+    if (!value)
+        return { ok: false, agentId, removedCommands: 0, removedPatterns: 0, reason: "value is empty" };
+    let res;
+    try {
+        res = removeApproval(value, agentId);
+    }
+    catch (err) {
+        if (err instanceof BrigadeApprovalRefusedError) {
+            return { ok: false, agentId, removedCommands: 0, removedPatterns: 0, reason: err.message };
+        }
+        throw err;
+    }
+    const ok = res.removedCommands > 0 || res.removedPatterns > 0;
+    return {
+        ok,
+        agentId,
+        removedCommands: res.removedCommands,
+        removedPatterns: res.removedPatterns,
+        ...(ok ? {} : { reason: `"${value}" not found in commands or patterns` }),
+    };
+}
+export function handleExecDenyTest(params) {
+    const p = (params ?? {});
+    const agentId = resolveAgentId(p.agentId);
+    const cmd = (p.command ?? "").trim();
+    return { agentId, command: cmd, decision: cmd ? decideApproval(cmd, agentId) : "deny" };
+}
+//# sourceMappingURL=exec-ops.js.map

package/dist/core/exec-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-ops.js","sourceRoot":"","sources":["../../src/core/exec-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAEN,2BAA2B,EAC3B,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,cAAc,GACd,MAAM,qBAAqB,CAAC;AAE7B,SAAS,cAAc,CAAC,OAAgB;IACvC,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAC5C,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,MAAe;IAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAyB,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACjF,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,MAAe;IAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA2C,CAAC;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACpE,IAAI,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC;QACJ,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,2BAA2B;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/G,MAAM,GAAG,CAAC;IACX,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACrD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA2C,CAAC;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACpE,IAAI,CAAC;QACJ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC;QACJ,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,2BAA2B;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/G,MAAM,GAAG,CAAC;IACX,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC3D,CAAC;AASD,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC/C,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAyC,CAAC;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5G,IAAI,GAAyD,CAAC;IAC9D,IAAI,CAAC;QACJ,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,eAAe,GAAG,CAAC,IAAI,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC;IAC9D,OAAO;QACN,EAAE;QACF,OAAO;QACP,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,qCAAqC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAC,MAAe;IACjD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA2C,CAAC;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzF,CAAC"}

package/dist/core/integrations-ops.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Integration control behind the `composio` and `oauth` gateway RPCs — the
+ * Composio connector (1,000+ apps) and the DIY OAuth-2 authorize flow, reachable
+ * from a remote client.
+ *
+ * Both reuse the owner-scoped tools (ctx-free execute; owner-gating is a session
+ * wrapper). Operator-scoped (allowlisted in the guard-sweep). Action-based,
+ * mirroring the tools 1:1.
+ *
+ * REMOTE NOTES:
+ *  - `composio` is fully remote-capable: Composio HOSTS the OAuth callback, so
+ *    `connect` returns a click-link the operator opens anywhere and the gateway
+ *    just polls `status` — no gateway loopback involved.
+ *  - `oauth` is the DIY loopback flow: `start` opens a 127.0.0.1 listener ON THE
+ *    GATEWAY HOST with a loopback redirect_uri, so the round-trip only completes
+ *    when the operator's browser can reach the GATEWAY's loopback (local to the
+ *    gateway, or tunneled). A pure-remote browser would hit its OWN loopback.
+ *    `status`/`token` work remotely. For remote app integrations prefer
+ *    `composio`.
+ */
+/** `composio` — Composio connector: set-key/apps/connect/status/search/execute/disconnect/refresh. */
+export declare function handleComposio(params: unknown): Promise<unknown>;
+/** `oauth` — DIY OAuth-2 authorize: start/await/cancel/status/token (see loopback caveat above). */
+export declare function handleOauth(params: unknown): Promise<unknown>;
+//# sourceMappingURL=integrations-ops.d.ts.map

package/dist/core/integrations-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations-ops.d.ts","sourceRoot":"","sources":["../../src/core/integrations-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,sGAAsG;AACtG,wBAAsB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtE;AAED,oGAAoG;AACpG,wBAAsB,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAMnE"}

package/dist/core/integrations-ops.js

@@ -0,0 +1,40 @@
+/**
+ * Integration control behind the `composio` and `oauth` gateway RPCs — the
+ * Composio connector (1,000+ apps) and the DIY OAuth-2 authorize flow, reachable
+ * from a remote client.
+ *
+ * Both reuse the owner-scoped tools (ctx-free execute; owner-gating is a session
+ * wrapper). Operator-scoped (allowlisted in the guard-sweep). Action-based,
+ * mirroring the tools 1:1.
+ *
+ * REMOTE NOTES:
+ *  - `composio` is fully remote-capable: Composio HOSTS the OAuth callback, so
+ *    `connect` returns a click-link the operator opens anywhere and the gateway
+ *    just polls `status` — no gateway loopback involved.
+ *  - `oauth` is the DIY loopback flow: `start` opens a 127.0.0.1 listener ON THE
+ *    GATEWAY HOST with a loopback redirect_uri, so the round-trip only completes
+ *    when the operator's browser can reach the GATEWAY's loopback (local to the
+ *    gateway, or tunneled). A pure-remote browser would hit its OWN loopback.
+ *    `status`/`token` work remotely. For remote app integrations prefer
+ *    `composio`.
+ */
+import { DEFAULT_AGENT_ID } from "../agents/routing/session-key.js";
+import { makeComposioTool } from "../agents/tools/composio-tool.js";
+import { makeOAuthAuthorizeTool } from "../agents/tools/oauth-authorize-tool.js";
+/** `composio` — Composio connector: set-key/apps/connect/status/search/execute/disconnect/refresh. */
+export async function handleComposio(params) {
+    const p = (params ?? {});
+    const agentId = (p.agentId ?? "").trim() || DEFAULT_AGENT_ID;
+    const tool = makeComposioTool({ agentId });
+    const res = await tool.execute("gateway", params);
+    return res.details;
+}
+/** `oauth` — DIY OAuth-2 authorize: start/await/cancel/status/token (see loopback caveat above). */
+export async function handleOauth(params) {
+    const p = (params ?? {});
+    const agentId = (p.agentId ?? "").trim() || DEFAULT_AGENT_ID;
+    const tool = makeOAuthAuthorizeTool({ agentId });
+    const res = await tool.execute("gateway", params);
+    return res.details;
+}
+//# sourceMappingURL=integrations-ops.js.map

package/dist/core/integrations-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations-ops.js","sourceRoot":"","sources":["../../src/core/integrations-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAe;IACnD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAyB,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC;IAC7D,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAe,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC;AACpB,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAe;IAChD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAyB,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC;IAC7D,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAe,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC;AACpB,CAAC"}

package/dist/core/memory-ops.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Memory (Tideline) write + governance behind the `memory.*` gateway RPCs — the
+ * write_memory + manage_memory surface, reachable from a remote client.
+ *
+ * Memory lives in `facts.jsonl` (a store, NOT brigade.json), so `config.set`
+ * cannot reach it — these RPCs are the only typed remote path to MUTATE memory.
+ * READ is already covered by the `memory-query` (list/search/inspect/stats) and
+ * `memory-graph` RPCs.
+ *
+ * OPERATOR-SCOPED: operates on the OWNER origin over the agent's workspace,
+ * exactly like the tools (filesystem AND Convex modes). Reuses the SAME
+ * write_memory / manage_memory tool logic — their `execute()` is pure (owner-
+ * gating is a session wrapper, not inside execute), so invoking them with an
+ * owner scope from the gateway is correct and byte-identical to a turn.
+ */
+/** `memory.write` — persist a durable fact. Params mirror the write_memory tool. */
+export declare function handleMemoryWrite(params: unknown): Promise<unknown>;
+/** `memory.manage` — dream/purge/inspect/export/retention/vault/retract/restore/relink. */
+export declare function handleMemoryManage(params: unknown): Promise<unknown>;
+//# sourceMappingURL=memory-ops.d.ts.map

package/dist/core/memory-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-ops.d.ts","sourceRoot":"","sources":["../../src/core/memory-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,oFAAoF;AACpF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAMzE;AAED,2FAA2F;AAC3F,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAM1E"}

package/dist/core/memory-ops.js

@@ -0,0 +1,40 @@
+/**
+ * Memory (Tideline) write + governance behind the `memory.*` gateway RPCs — the
+ * write_memory + manage_memory surface, reachable from a remote client.
+ *
+ * Memory lives in `facts.jsonl` (a store, NOT brigade.json), so `config.set`
+ * cannot reach it — these RPCs are the only typed remote path to MUTATE memory.
+ * READ is already covered by the `memory-query` (list/search/inspect/stats) and
+ * `memory-graph` RPCs.
+ *
+ * OPERATOR-SCOPED: operates on the OWNER origin over the agent's workspace,
+ * exactly like the tools (filesystem AND Convex modes). Reuses the SAME
+ * write_memory / manage_memory tool logic — their `execute()` is pure (owner-
+ * gating is a session wrapper, not inside execute), so invoking them with an
+ * owner scope from the gateway is correct and byte-identical to a turn.
+ */
+import { FactStore } from "../agents/memory/records.js";
+import { makeManageMemoryTool } from "../agents/tools/manage-memory-tool.js";
+import { makeWriteMemoryTool } from "../agents/tools/memory-tools.js";
+import { DEFAULT_AGENT_ID, resolveAgentWorkspaceDir } from "../config/paths.js";
+function workspaceFor(agentId) {
+    const id = (agentId ?? "").trim() || DEFAULT_AGENT_ID;
+    return resolveAgentWorkspaceDir(id);
+}
+/** `memory.write` — persist a durable fact. Params mirror the write_memory tool. */
+export async function handleMemoryWrite(params) {
+    const p = (params ?? {});
+    const store = new FactStore(workspaceFor(p.agentId));
+    const tool = makeWriteMemoryTool(store, { senderIsOwner: true });
+    const res = await tool.execute("gateway", params);
+    return res.details;
+}
+/** `memory.manage` — dream/purge/inspect/export/retention/vault/retract/restore/relink. */
+export async function handleMemoryManage(params) {
+    const p = (params ?? {});
+    const agentId = (p.agentId ?? "").trim() || DEFAULT_AGENT_ID;
+    const tool = makeManageMemoryTool(workspaceFor(agentId), { agentId });
+    const res = await tool.execute("gateway", params);
+    return res.details;
+}
+//# sourceMappingURL=memory-ops.js.map

package/dist/core/memory-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-ops.js","sourceRoot":"","sources":["../../src/core/memory-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,SAAS,YAAY,CAAC,OAAgB;IACrC,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC;IACtD,OAAO,wBAAwB,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAe;IACtD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAyB,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAe,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC;AACpB,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAe;IACvD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAyB,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC;IAC7D,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAe,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC;AACpB,CAAC"}

package/dist/core/pairing-ops.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Channel pairing operations behind the `pairing.*` gateway RPCs — the
+ * `brigade pairing <list|approve|revoke>` surface, reachable from a remote
+ * client.
+ *
+ * OPERATOR-SCOPED channel access control (approve/deny strangers who DM the
+ * bot). Per-channel, never a per-session target, so no per-session guard. The
+ * RPCs REQUIRE an explicit `channel` (no CLI-style auto-pick) — a client knows
+ * the channel from `system.capabilities`. Reuses the SAME access-control
+ * primitives the CLI calls, including the owner-bootstrap + in-channel notify
+ * on approve.
+ */
+import { readPendingPairings } from "../agents/channels/access-control/index.js";
+export type PairingListResult = {
+    channel: string;
+    pending: ReturnType<typeof readPendingPairings>;
+};
+export declare function handlePairingList(params: unknown): PairingListResult;
+export interface PairingApproveResult {
+    ok: boolean;
+    channel: string;
+    sender?: string;
+    owner?: boolean;
+    reason?: string;
+}
+export declare function handlePairingApprove(params: unknown): Promise<PairingApproveResult>;
+export interface PairingRevokeResult {
+    ok: boolean;
+    channel: string;
+    reason?: string;
+}
+export declare function handlePairingRevoke(params: unknown): PairingRevokeResult;
+//# sourceMappingURL=pairing-ops.d.ts.map

package/dist/core/pairing-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-ops.d.ts","sourceRoot":"","sources":["../../src/core/pairing-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAGN,mBAAmB,EAGnB,MAAM,4CAA4C,CAAC;AAqBpD,MAAM,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;CAChD,CAAC;AACF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,iBAAiB,CAKpE;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AACD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0BzF;AAED,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AACD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,mBAAmB,CAQxE"}