sessionmap

type ByNative struct {
	BrigadeSessionID string    `json:"brigade_session_id"`
	TeamRef          string    `json:"team_ref"`
	SessionName      string    `json:"session_name"`
	UpdatedAt        time.Time `json:"updated_at,omitzero"`
}

type ByPID struct {
	// ClaudePID is the Claude Code process id; it is also the file name.
	ClaudePID int `json:"claude_pid"`
	// ClaudeSessionID is the native session id from the hook's stdin; it
	// is never sent to any backend (T10).
	ClaudeSessionID string `json:"claude_session_id"`
	// BrigadeSessionID is the adapter-assigned session id (4.4.3).
	BrigadeSessionID string `json:"brigade_session_id"`
	// TeamRef and TeamName are the profile's team binding at registration.
	TeamRef  string `json:"team_ref"`
	TeamName string `json:"team_name"`
	// SessionName is the display name registered (6.5).
	SessionName string `json:"session_name"`
	// WorkspaceLabel is the label registered with the session (P11-5):
	// the repository name the hook derived, or the user's own; "" when
	// sharing is off. The watcher carries it on a re-open, because a
	// resume that omits it clears it at the backend.
	WorkspaceLabel string `json:"workspace_label,omitempty"`
	// LabelOption is the `label` option as the hook resolved it (card 24,
	// part C): config.LabelAccount, config.LabelNone, or a literal the
	// member gave. The OPTION rides here, never a label — the account
	// email is read at the point of use by the watcher, exactly as
	// StartFacts does it, so this file never carries a member's email.
	// The watcher sends the resolved label on every registration, so a
	// membership whose label is empty is filled at the next session start
	// and at every watcher replacement.
	LabelOption string `json:"label_option,omitzero"`
	// DoingMode is the RESOLVED doing mode of card 25 (plan 5.2): one of
	// doing.ModeUnsupported, ModeOff, ModeUnasked, ModeAllowed and
	// ModeQuiet, frozen here by the SessionStart hook from the adapter's
	// capabilities, the `share_doing` option and the permission rules in
	// the settings it can read. `brigade doing` reads it to decide whether
	// to publish (the Bash-tool verb never sees CLAUDE_PLUGIN_OPTION_*);
	// the prompt hook reads it to decide whether a line may be printed. It
	// is safe on disk because it is one of five fixed words — never a
	// sentence, never a rule, never a byte of a settings file. Absent
	// (omitzero) in a map written before the mode existed; a reader treats
	// absent as "publish, print nothing" until the prompt hook resolves it
	// once.
	DoingMode string `json:"doing_mode,omitzero"`
	// PermissionMode is recorded for diagnostics only; the inbound policy
	// never depends on it (D18).
	PermissionMode string `json:"permission_mode"`
	// NonInteractive is true for a `claude -p` session (CLAUDE_CODE_ENTRYPOINT
	// sdk-cli, 6.5); diagnostics only.
	NonInteractive bool `json:"non_interactive"`
	// Inbound is the EFFECTIVE policy the hook chose: accept, hold or
	// refuse (6.8).
	Inbound string `json:"inbound"`
	// FrameLevel is the instruction paragraph the frame carries: open,
	// guarded, strict, or custom for a user-supplied clause (P5-12). The
	// hook resolves it ONCE at SessionStart and freezes it here, so the
	// watcher never re-reads a user file minutes or hours later.
	FrameLevel string `json:"frame_level"`
	// FrameText is the resolved custom clause, EMPTY unless FrameLevel is
	// custom: a named level's text is a Go constant and is never carried
	// here, so a rewritten map cannot smuggle a different paragraph in
	// under a level's name.
	FrameText string `json:"frame_text"`
	// SocketPath is CLAUDE_CODE_MESSAGING_SOCKET as the hook saw it, or ""
	// on a host without an inbox socket. The token is NOT here.
	SocketPath string `json:"socket_path"`
	// TranscriptPath is the native transcript path from the hook's stdin,
	// read by the watcher for the model and context facts; it is never
	// sent to any backend (T10). "" when the hook document carried none
	// (or a relative one); omitted from the file then, so a map from
	// before it existed still reads.
	TranscriptPath string `json:"transcript_path,omitzero"`
	// Profile is the resolved profile name.
	TeamKey string `json:"team_key"`
	// ConfigDir is the resolved absolute Brigade config directory.
	ConfigDir string `json:"config_dir"`
	// AdapterCommand is the resolved argv prefix prepended verbatim to
	// every adapter invocation; [] means the bundled adapter, which the
	// adapterclient resolves through os.Executable() at spawn time and
	// which is deliberately never pinned to a path here.
	AdapterCommand []string `json:"adapter_command"`
	// PluginBin is the bootstrap's resolved realpath when the hook knows
	// it (the shadowing check of 6.2), else "".
	PluginBin string `json:"plugin_bin"`
	// SyncAdapter, SyncFolders and SyncRoot are file sync as the hook
	// resolved it at SessionStart (folder-sync plan §4.3) and froze it for
	// the watcher, which drives the adapter, and for `brigade sync
	// status`: the NAME of the sync adapter the team file's `sync` member
	// gives (never a path — foldersync resolves it), the folders it lists
	// exactly as written (relative to the checkout), and the canonical
	// repository toplevel they are relative to. All three are set together
	// — a usable member with at least one folder and the `sync` option on —
	// or none is, and then this session syncs nothing. Absent (omitzero)
	// in a map from before file sync existed, which reads as "off".
	SyncAdapter string   `json:"sync_adapter,omitzero"`
	SyncFolders []string `json:"sync_folders,omitzero"`
	SyncRoot    string   `json:"sync_root,omitzero"`
	// SyncScope is the repository's name as the hook derived it
	// (teamfile.RepoName), frozen beside the three above: the part of a
	// folder's id that keeps two repositories of one team apart (card
	// 42). It is never the `workspace_label` option, which a member may
	// set to anything: an id must be the same on every checkout. Absent
	// (omitzero) with sync off, in a map from before it existed, and for
	// a checkout with no name to derive — then the folders keep the ids
	// of 0.11.0 to 0.15.0 (foldersync.LegacyFolderID).
	SyncScope string `json:"sync_scope,omitzero"`
	// MessageSound is the `message_sound` option as the hook resolved it
	// (card 35): true when this session's watcher plays one quiet sound
	// as a message arrives. The watcher re-reads it on every liveness
	// tick, so a SessionStart that flips the option takes effect without
	// a respawn. Absent (omitzero) when off, so a map from before the
	// option existed reads as off.
	MessageSound bool `json:"message_sound,omitzero"`
	// MessageNotification is the `message_notification` option the same
	// way (card 36): a desktop notification as a message arrives.
	MessageNotification bool `json:"message_notification,omitzero"`
	// MessageIntervalSeconds is the `message_interval` option as the hook
	// resolved it (card 38): the seconds between two sounds, or two
	// notifications, within notify's bounds. Absent (omitzero) in a map
	// from before the option existed, which Interval reads as the default.
	MessageIntervalSeconds int `json:"message_interval_seconds,omitzero"`
	// HarnessVersion is the Claude Code version from the registry's
	// `version` member when present, else "unknown".
	HarnessVersion string `json:"harness_version"`
	// RegisteredAt is when the Brigade session was registered; UpdatedAt
	// when this file was last rewritten. Both are the hook's clock.
	RegisteredAt time.Time `json:"registered_at,omitzero"`
	UpdatedAt    time.Time `json:"updated_at,omitzero"`
}

type StartFacts struct {
	// ClaudePID is the Claude Code process id; it is also the file name.
	ClaudePID int `json:"claude_pid"`
	// ClaudeSessionID is the native session id from the hook's stdin.
	ClaudeSessionID string `json:"claude_session_id"`
	// ConfigDir is the resolved absolute Brigade config directory.
	ConfigDir string `json:"config_dir"`
	// PluginBin is the bootstrap's resolved realpath when the hook knows
	// it, else "".
	PluginBin string `json:"plugin_bin"`
	// LabelOption is the `label` option as the hook resolved it (card 24,
	// part B): "account", "none", or the member's own sanitised text.
	// Plugin options never reach the Bash tool, so this is the only way an
	// in-session `team create` or `team join` can learn it — exactly the
	// reason ConfigDir is here. It is the OPTION, not a label: the account
	// email is read from Claude Code's own config at the point of use, so
	// no member's email is ever written to this file. Omitted when the
	// option is absent, so a map written before it existed still reads.
	LabelOption string `json:"label_option,omitzero"`
	// WrittenAt is the hook's clock at the write.
	WrittenAt time.Time `json:"written_at"`
}

type Store struct {
	// StateDir is ${BRIGADE_STATE_DIR} as resolved by the caller.
	StateDir string
	// Stat, when non-nil, replaces the fstat of the opened file in the
	// privacy check. It exists for tests: a foreign-uid file cannot be
	// created without privileges, so the foreign-owner refusal is
	// exercised through a FileInfo whose Sys reports another uid. Leave
	// it nil everywhere else — the fstat on the open descriptor is what
	// makes the check free of a check-then-open race.
	Stat func(path string) (fs.FileInfo, error)
}