sessionmap

type ByNative struct {
	BrigadeSessionID string    `json:"brigade_session_id"`
	TeamRef          string    `json:"team_ref"`
	SessionName      string    `json:"session_name"`
	UpdatedAt        time.Time `json:"updated_at,omitzero"`
}

type ByPID struct {
	// ClaudePID is the Claude Code process id; it is also the file name.
	ClaudePID int `json:"claude_pid"`
	// ClaudeSessionID is the native session id from the hook's stdin; it
	// is never sent to any backend (T10).
	ClaudeSessionID string `json:"claude_session_id"`
	// BrigadeSessionID is the adapter-assigned session id (4.4.3).
	BrigadeSessionID string `json:"brigade_session_id"`
	// TeamRef and TeamName are the profile's team binding at registration.
	TeamRef  string `json:"team_ref"`
	TeamName string `json:"team_name"`
	// SessionName is the display name registered (6.5).
	SessionName string `json:"session_name"`
	// PermissionMode is recorded for diagnostics only; the inbound policy
	// never depends on it (D18).
	PermissionMode string `json:"permission_mode"`
	// NonInteractive is true for a `claude -p` session (CLAUDE_CODE_ENTRYPOINT
	// sdk-cli, 6.5); diagnostics only.
	NonInteractive bool `json:"non_interactive"`
	// Inbound is the EFFECTIVE policy the hook chose: accept, hold or
	// refuse (6.8).
	Inbound string `json:"inbound"`
	// FrameLevel is the instruction paragraph the frame carries: open,
	// guarded, strict, or custom for a user-supplied clause (P5-12). The
	// hook resolves it ONCE at SessionStart and freezes it here, so the
	// watcher never re-reads a user file minutes or hours later.
	FrameLevel string `json:"frame_level"`
	// FrameText is the resolved custom clause, EMPTY unless FrameLevel is
	// custom: a named level's text is a Go constant and is never carried
	// here, so a rewritten map cannot smuggle a different paragraph in
	// under a level's name.
	FrameText string `json:"frame_text"`
	// SocketPath is CLAUDE_CODE_MESSAGING_SOCKET as the hook saw it, or ""
	// on a host without an inbox socket. The token is NOT here.
	SocketPath string `json:"socket_path"`
	// Profile is the resolved profile name.
	TeamKey string `json:"team_key"`
	// ConfigDir is the resolved absolute Brigade config directory.
	ConfigDir string `json:"config_dir"`
	// AdapterCommand is the resolved argv prefix prepended verbatim to
	// every adapter invocation; [] means the bundled adapter, which the
	// adapterclient resolves through os.Executable() at spawn time and
	// which is deliberately never pinned to a path here.
	AdapterCommand []string `json:"adapter_command"`
	// PluginBin is the bootstrap's resolved realpath when the hook knows
	// it (the shadowing check of 6.2), else "".
	PluginBin string `json:"plugin_bin"`
	// HarnessVersion is the Claude Code version from the registry's
	// `version` member when present, else "unknown".
	HarnessVersion string `json:"harness_version"`
	// RegisteredAt is when the Brigade session was registered; UpdatedAt
	// when this file was last rewritten. Both are the hook's clock.
	RegisteredAt time.Time `json:"registered_at,omitzero"`
	UpdatedAt    time.Time `json:"updated_at,omitzero"`
}

type Store struct {
	// StateDir is ${BRIGADE_STATE_DIR} as resolved by the caller.
	StateDir string
	// Stat, when non-nil, replaces the fstat of the opened file in the
	// privacy check. It exists for tests: a foreign-uid file cannot be
	// created without privileges, so the foreign-owner refusal is
	// exercised through a FileInfo whose Sys reports another uid. Leave
	// it nil everywhere else — the fstat on the open descriptor is what
	// makes the check free of a check-then-open race.
	Stat func(path string) (fs.FileInfo, error)
}