@astrosheep/keiyaku 2.9.13 → 4.0.0

package/build/cli/skills-install.js

@@ -1,348 +0,0 @@
-import * as crypto from "node:crypto";
-import * as fs from "node:fs/promises";
-import * as os from "node:os";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
-import { FlowError, asMessage } from "../flow-error.js";
-import { VERSION } from "../generated/version.js";
-const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
-const PACKAGE_ROOT = path.resolve(MODULE_DIR, "../..");
-const OFFICIAL_SKILLS = ["keiyaku", "keiyaku-akuma", "keiyaku-workflow", "keiyaku-task"];
-const SKILL_ROOT = path.join(PACKAGE_ROOT, "skills");
-const INSTALL_MARKER = ".keiyaku-skill-owned.json";
-function skillSource(skill) {
-    return path.join(SKILL_ROOT, skill);
-}
-function targetPaths(skill) {
-    return [
-        path.join(os.homedir(), ".claude", "skills", skill),
-        path.join(os.homedir(), ".agents", "skills", skill),
-    ];
-}
-function errorCode(error) {
-    return error.code;
-}
-function isMissing(error) {
-    return errorCode(error) === "ENOENT";
-}
-async function validateSource(skill) {
-    const source = skillSource(skill);
-    let sourceStat;
-    let skillStat;
-    try {
-        sourceStat = await fs.stat(source);
-        skillStat = await fs.stat(path.join(source, "SKILL.md"));
-    }
-    catch (error) {
-        if (isMissing(error))
-            throw new FlowError("EMPTY_PARAM", `Keiyaku skill source is incomplete: ${source}`);
-        throw error;
-    }
-    if (!sourceStat.isDirectory() || !skillStat.isFile()) {
-        throw new FlowError("EMPTY_PARAM", `Keiyaku skill source must be a directory containing a regular SKILL.md: ${source}`);
-    }
-    return await fs.realpath(source);
-}
-function objectKind(stat) {
-    if (stat.isSymbolicLink())
-        return "symlink";
-    if (stat.isFile())
-        return "file";
-    if (stat.isDirectory())
-        return "directory";
-    return "other";
-}
-function updateHashField(hash, value) {
-    const bytes = typeof value === "string" ? Buffer.from(value, "utf8") : value;
-    const length = Buffer.allocUnsafe(4);
-    length.writeUInt32BE(bytes.length);
-    hash.update(length);
-    hash.update(bytes);
-}
-async function contentHash(root) {
-    const hash = crypto.createHash("sha256");
-    const walk = async (directory, relativeDirectory) => {
-        const entries = await fs.readdir(directory, { withFileTypes: true });
-        entries.sort((left, right) => Buffer.compare(Buffer.from(left.name, "utf8"), Buffer.from(right.name, "utf8")));
-        for (const entry of entries) {
-            const relative = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
-            if (relative === INSTALL_MARKER)
-                continue;
-            const absolute = path.join(directory, entry.name);
-            const stat = await fs.lstat(absolute);
-            const kind = stat.isDirectory() ? "directory"
-                : stat.isFile() ? "file"
-                    : stat.isSymbolicLink() ? "symlink"
-                        : "other";
-            updateHashField(hash, kind);
-            updateHashField(hash, relative);
-            if (kind === "file")
-                updateHashField(hash, await fs.readFile(absolute));
-            if (kind === "symlink")
-                updateHashField(hash, await fs.readlink(absolute));
-            if (kind === "other")
-                updateHashField(hash, `${stat.mode}:${stat.rdev}`);
-            if (kind === "directory")
-                await walk(absolute, relative);
-        }
-    };
-    await walk(root, "");
-    return hash.digest("hex");
-}
-function validMarker(value, skill) {
-    if (!value || typeof value !== "object")
-        return false;
-    const marker = value;
-    return marker.kind === "official-skill-copy"
-        && marker.skill === skill
-        && typeof marker.sourceVersion === "string"
-        && typeof marker.contentHash === "string"
-        && /^[0-9a-f]{64}$/.test(marker.contentHash);
-}
-async function readInstallMarker(target, skill) {
-    try {
-        const markerPath = path.join(target, INSTALL_MARKER);
-        if (!(await fs.lstat(markerPath)).isFile())
-            return undefined;
-        const marker = JSON.parse(await fs.readFile(markerPath, "utf8"));
-        return validMarker(marker, skill) ? marker : undefined;
-    }
-    catch (error) {
-        if (isMissing(error) || error instanceof SyntaxError)
-            return undefined;
-        throw error;
-    }
-}
-async function writeInstallMarker(target, skill, hash) {
-    const marker = {
-        kind: "official-skill-copy",
-        skill,
-        sourceVersion: VERSION,
-        contentHash: hash,
-    };
-    await fs.writeFile(path.join(target, INSTALL_MARKER), `${JSON.stringify(marker, null, 2)}\n`, "utf8");
-}
-async function classifyTarget(skill, target, canonicalSource) {
-    let stat;
-    try {
-        stat = await fs.lstat(target);
-    }
-    catch (error) {
-        if (isMissing(error))
-            return { skill, path: target, source: canonicalSource, kind: "absent" };
-        throw error;
-    }
-    const kind = objectKind(stat);
-    if (stat.isDirectory()) {
-        const marker = await readInstallMarker(target, skill);
-        if (marker) {
-            const installedHash = await contentHash(target);
-            if (installedHash === marker.contentHash) {
-                const sourceHash = await contentHash(canonicalSource);
-                return {
-                    skill,
-                    path: target,
-                    source: canonicalSource,
-                    kind: "owned",
-                    needsUpgrade: marker.sourceVersion !== VERSION || marker.contentHash !== sourceHash,
-                };
-            }
-            return {
-                skill,
-                path: target,
-                source: canonicalSource,
-                kind: "foreign",
-                collisionReason: "modified",
-                foreignIdentity: { kind, dev: stat.dev, ino: stat.ino },
-            };
-        }
-    }
-    const link = stat.isSymbolicLink() ? await fs.readlink(target) : undefined;
-    return {
-        skill,
-        path: target,
-        source: canonicalSource,
-        kind: "foreign",
-        collisionReason: "foreign",
-        foreignIdentity: { kind, dev: stat.dev, ino: stat.ino, link },
-    };
-}
-async function ensureParent(parent, createdDirectories) {
-    const absentBeforeMutation = [];
-    let cursor = parent;
-    while (true) {
-        try {
-            const stat = await fs.stat(cursor);
-            if (!stat.isDirectory())
-                throw new Error(`Skill target parent is not a directory: ${cursor}`);
-            break;
-        }
-        catch (error) {
-            if (!isMissing(error))
-                throw error;
-            absentBeforeMutation.push(cursor);
-            const next = path.dirname(cursor);
-            if (next === cursor)
-                throw error;
-            cursor = next;
-        }
-    }
-    for (const directory of absentBeforeMutation.reverse()) {
-        await fs.mkdir(directory);
-        createdDirectories.unshift(directory);
-    }
-}
-function siblingArtifact(target, label) {
-    return path.join(path.dirname(target), `.${path.basename(target)}.keiyaku-${label}-${process.pid}-${crypto.randomUUID()}`);
-}
-async function removeIfPresent(target) {
-    try {
-        await fs.rm(target, { recursive: true, force: true });
-    }
-    catch (error) {
-        if (!isMissing(error))
-            throw error;
-    }
-}
-async function verifyMissing(target, label, failures) {
-    try {
-        await fs.lstat(target);
-        failures.push(`${label} still exists at ${target}`);
-    }
-    catch (error) {
-        if (!isMissing(error))
-            failures.push(`${label} verification failed at ${target}: ${asMessage(error)}`);
-    }
-}
-async function rollbackAndVerify(originalError, states, createdDirectories) {
-    const failures = [];
-    const attempt = async (action, affectedPath, operation) => {
-        try {
-            await operation();
-        }
-        catch (error) {
-            failures.push(`${action} failed at ${affectedPath}: ${asMessage(error)}`);
-        }
-    };
-    for (const state of [...states].reverse()) {
-        if (state.installed)
-            await attempt("rollback target removal", state.path, () => removeIfPresent(state.path));
-        if (state.backup)
-            await attempt("rollback foreign restore", state.path, () => fs.rename(state.backup, state.path));
-        if (state.temp)
-            await attempt("rollback temporary removal", state.temp, () => removeIfPresent(state.temp));
-    }
-    for (const directory of createdDirectories) {
-        await attempt("rollback parent removal", directory, async () => {
-            try {
-                await fs.rmdir(directory);
-            }
-            catch (error) {
-                if (errorCode(error) !== "ENOENT")
-                    throw error;
-            }
-        });
-    }
-    for (const state of states) {
-        if (state.kind === "absent") {
-            await verifyMissing(state.path, "originally absent target", failures);
-        }
-        else if (state.kind === "owned") {
-            try {
-                const marker = await readInstallMarker(state.path, state.skill);
-                if (!marker || await contentHash(state.path) !== marker.contentHash) {
-                    failures.push(`owned target changed at ${state.path}`);
-                }
-            }
-            catch (error) {
-                failures.push(`owned target verification failed at ${state.path}: ${asMessage(error)}`);
-            }
-        }
-        else {
-            try {
-                const stat = await fs.lstat(state.path);
-                const identity = state.foreignIdentity;
-                const kind = objectKind(stat);
-                const link = kind === "symlink" ? await fs.readlink(state.path) : undefined;
-                if (!identity || kind !== identity.kind || stat.dev !== identity.dev || stat.ino !== identity.ino || link !== identity.link) {
-                    failures.push(`foreign target identity changed at ${state.path}`);
-                }
-            }
-            catch (error) {
-                failures.push(`foreign target verification failed at ${state.path}: ${asMessage(error)}`);
-            }
-        }
-        if (state.temp)
-            await verifyMissing(state.temp, "temporary artifact", failures);
-        if (state.backup)
-            await verifyMissing(state.backup, "backup artifact", failures);
-    }
-    for (const directory of createdDirectories) {
-        await verifyMissing(directory, "created parent", failures);
-    }
-    if (failures.length > 0) {
-        throw new FlowError("INTERNAL_STATE", [`Skill installation failed: ${asMessage(originalError)}`, "Rollback or verification was incomplete:", ...failures.map((failure) => `- ${failure}`)].join("\n"), { cause: originalError });
-    }
-    throw originalError;
-}
-export async function installOfficialSkills(force = false) {
-    const sources = new Map();
-    for (const skill of OFFICIAL_SKILLS) {
-        sources.set(skill, await validateSource(skill));
-    }
-    const states = [];
-    for (const skill of OFFICIAL_SKILLS) {
-        const source = sources.get(skill);
-        for (const target of targetPaths(skill)) {
-            states.push(await classifyTarget(skill, target, source));
-        }
-    }
-    const collisions = states.filter((state) => state.kind === "foreign");
-    if (collisions.length > 0 && !force) {
-        const details = collisions.map((state) => state.collisionReason === "modified"
-            ? `${state.path} (owned fact exists but copied content was modified)`
-            : `${state.path} (foreign target or missing ownership fact)`);
-        throw new FlowError("EMPTY_PARAM", `Skill target collision at ${details.join(", ")}. Re-run with -f or --force to replace it.`);
-    }
-    const createdDirectories = [];
-    try {
-        for (const state of states) {
-            if (state.kind === "owned" && !state.needsUpgrade)
-                continue;
-            await ensureParent(path.dirname(state.path), createdDirectories);
-            state.temp = siblingArtifact(state.path, "tmp");
-            await fs.cp(state.source, state.temp, { recursive: true, errorOnExist: true, force: false });
-            await writeInstallMarker(state.temp, state.skill, await contentHash(state.temp));
-            if (state.kind === "foreign" || state.kind === "owned") {
-                state.backup = siblingArtifact(state.path, "backup");
-                await fs.rename(state.path, state.backup);
-            }
-            await fs.rename(state.temp, state.path);
-            state.temp = undefined;
-            state.installed = true;
-        }
-    }
-    catch (error) {
-        return await rollbackAndVerify(error, states, createdDirectories);
-    }
-    const warnings = [];
-    for (const state of states) {
-        if (!state.backup)
-            continue;
-        try {
-            await removeIfPresent(state.backup);
-        }
-        catch (error) {
-            warnings.push(`Could not remove retained skill backup ${state.backup}: ${asMessage(error)}`);
-        }
-    }
-    return {
-        targets: states.map((state) => ({
-            skill: state.skill,
-            path: state.path,
-            source: state.source,
-            status: state.installed ? "installed" : "owned",
-        })),
-        warnings,
-    };
-}

package/build/cli/subagent-guard.js

@@ -1,25 +0,0 @@
-const SUBAGENT_SAFE_COMMANDS = new Set(["status", "history", "log", "guide", "dump-env", "wait"]);
-const SUBAGENT_SAFE_FLAGS = new Set(["--help", "-h", "--version"]);
-function isSubagentSafeCommand(args) {
-    if (args.length === 0)
-        return true;
-    if (args[0]?.startsWith("@")) {
-        return isSubagentSafeCommand(args.slice(1));
-    }
-    const [head] = args;
-    if (head === "akuma") {
-        const subcommand = args[1];
-        return subcommand === "list" || subcommand === "show" || SUBAGENT_SAFE_FLAGS.has(subcommand ?? "");
-    }
-    if (head === "task") {
-        return args[1] === "log" || SUBAGENT_SAFE_FLAGS.has(args[1] ?? "");
-    }
-    return ((head !== undefined && SUBAGENT_SAFE_COMMANDS.has(head)) ||
-        (args.length === 1 && head !== undefined && SUBAGENT_SAFE_FLAGS.has(head)));
-}
-export function assertSubagentCliCommandAllowed(options) {
-    if (!options.disableSpawn || isSubagentSafeCommand(options.args)) {
-        return;
-    }
-    throw new Error(`Keiyaku CLI command blocked by ${options.envKey}=1. Only read-only Keiyaku CLI commands are allowed in an Akuma process.`);
-}

package/build/cli/types.js

@@ -1,2 +0,0 @@
-export const TASK_SUBCOMMANDS = ["add", "compose", "show", "ls", "log", "start", "stop", "hold", "resume", "done", "note", "drop", "update", "doctor"];
-export const AKUMA_SUBCOMMANDS = ["list", "ls", "show"];

package/build/config/akuma-loader.js

@@ -1,240 +0,0 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import { z } from "zod";
-import { parseToAST } from "../core/markdown/parser.js";
-import { observeGitRepository } from "../git/branches.js";
-import { BUILTIN_AGENT_PROFILES } from "../keiyaku.js";
-import { getKeiyakuHome } from "./env.js";
-import { agentNameSchema, providerInstanceNameSchema } from "./settings/schema.js";
-import { canonicalizeAkumaName } from "../core/projection/akuma-name.js";
-const nonblankString = z.string().refine((value) => value.trim().length > 0, { message: "must not be blank" });
-const effortOptionsSchema = z.array(nonblankString).superRefine((values, ctx) => {
-    if (new Set(values).size !== values.length) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not contain duplicate values" });
-    }
-});
-const profileSchema = z
-    .object({
-    provider: providerInstanceNameSchema,
-    description: nonblankString.optional(),
-    model: nonblankString.optional(),
-    effort: nonblankString.optional(),
-    effortOptions: effortOptionsSchema.optional(),
-    access: z.enum(["read", "write", "auto"]).optional(),
-    network: z.enum(["disabled", "enabled"]).optional(),
-    webSearch: z.enum(["disabled", "cached", "live"]).optional(),
-})
-    .strict();
-function formatIssues(error) {
-    return error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
-}
-function stripFrontMatterQuote(rawValue) {
-    const value = rawValue.trim();
-    if (value.length < 2)
-        return value;
-    const quote = value[0];
-    return (quote === "'" || quote === '"') && value.at(-1) === quote ? value.slice(1, -1) : value;
-}
-function splitFrontMatter(content) {
-    const ast = parseToAST(content, { allowSections: false });
-    if (ast.frontmatter === undefined) {
-        throw new Error("missing leading YAML frontmatter");
-    }
-    const lines = content.split(/\r?\n/);
-    let closingIndex = -1;
-    for (let index = 1; index < lines.length; index += 1) {
-        if ((lines[index] ?? "").trim() === "---") {
-            closingIndex = index;
-            break;
-        }
-    }
-    if (closingIndex === -1)
-        throw new Error("frontmatter is not closed");
-    const entries = [];
-    for (let index = 1; index < closingIndex; index += 1) {
-        const line = lines[index] ?? "";
-        const match = line.trim().match(/^([A-Za-z0-9_.-]+)\s*:\s*(.*)$/);
-        if (!match)
-            continue;
-        const key = match[1] ?? "";
-        const value = match[2] ?? "";
-        if (key === "effortOptions" && value.trim() === "") {
-            const options = [];
-            while (index + 1 < closingIndex) {
-                const item = lines[index + 1] ?? "";
-                if (item.trim().match(/^([A-Za-z0-9_.-]+)\s*:/))
-                    break;
-                const itemMatch = item.match(/^\s*-\s*(.*)$/);
-                if (!itemMatch)
-                    break;
-                options.push(stripFrontMatterQuote(itemMatch[1] ?? ""));
-                index += 1;
-            }
-            entries.push([key, options]);
-            continue;
-        }
-        entries.push([key, stripFrontMatterQuote(value)]);
-    }
-    return { entries, body: lines.slice(closingIndex + 1).join("\n") };
-}
-function freezeProfile(profile) {
-    if (profile.effortOptions === undefined)
-        return Object.freeze({ ...profile });
-    return Object.freeze({
-        ...profile,
-        effortOptions: Object.freeze([...profile.effortOptions]),
-    });
-}
-function freezeCandidate(candidate) {
-    if ("reason" in candidate && candidate.reason !== undefined) {
-        return Object.freeze({ ...candidate });
-    }
-    return Object.freeze({
-        ...candidate,
-        profile: freezeProfile(candidate.profile),
-    });
-}
-function decodeProfile(entries) {
-    const raw = {};
-    for (const [key, value] of entries) {
-        if (key === "effortOptions") {
-            raw[key] = value;
-            continue;
-        }
-        if (typeof value !== "string")
-            throw new Error(`${key} must be a scalar value`);
-        raw[key] = value;
-    }
-    const parsed = profileSchema.safeParse(raw);
-    if (!parsed.success)
-        throw new Error(formatIssues(parsed.error));
-    if (parsed.data.effort !== undefined && parsed.data.effortOptions !== undefined && !parsed.data.effortOptions.includes(parsed.data.effort)) {
-        throw new Error("effort must be an exact member of effortOptions");
-    }
-    return freezeProfile(parsed.data);
-}
-async function readLayer(directory, source) {
-    let entries;
-    try {
-        entries = await fs.readdir(directory, { withFileTypes: true });
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return { candidates: [] };
-        return {
-            candidates: [],
-            directoryFailure: {
-                path: directory,
-                reason: `unable to read akuma directory (${error instanceof Error ? error.message : String(error)})`,
-            },
-        };
-    }
-    const candidates = [];
-    const canonicalFiles = new Map();
-    for (const entry of entries.filter((candidate) => candidate.isFile() && candidate.name.endsWith(".md"))) {
-        const rawName = path.basename(entry.name, ".md");
-        const canonicalName = canonicalizeAkumaName(rawName);
-        const files = canonicalFiles.get(canonicalName) ?? [];
-        files.push(entry.name);
-        canonicalFiles.set(canonicalName, files);
-    }
-    for (const entry of entries.filter((candidate) => candidate.isFile() && candidate.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name))) {
-        const file = path.join(directory, entry.name);
-        const rawName = path.basename(entry.name, ".md");
-        const name = canonicalizeAkumaName(rawName);
-        const collisions = canonicalFiles.get(name);
-        if (collisions.length > 1) {
-            candidates.push(freezeCandidate({
-                name,
-                source,
-                path: file,
-                reason: `akuma name collision after Unicode NFC normalization: ${collisions.sort().join(", ")}`,
-            }));
-            continue;
-        }
-        const nameResult = agentNameSchema.safeParse(name);
-        if (!nameResult.success) {
-            candidates.push(freezeCandidate({
-                name,
-                source,
-                path: file,
-                reason: `invalid akuma name: ${formatIssues(nameResult.error)}`,
-            }));
-            continue;
-        }
-        try {
-            const content = await fs.readFile(file, "utf-8");
-            const { entries: frontmatter, body } = splitFrontMatter(content);
-            candidates.push(freezeCandidate({
-                name,
-                source,
-                path: file,
-                body,
-                profile: decodeProfile(frontmatter),
-            }));
-        }
-        catch (error) {
-            candidates.push(freezeCandidate({
-                name,
-                source,
-                path: file,
-                reason: error instanceof Error ? error.message : String(error),
-            }));
-        }
-    }
-    return { candidates };
-}
-function foldLayer(selected, shadows, allCandidates, source, layer) {
-    if (layer.directoryFailure !== undefined) {
-        allCandidates.push(freezeCandidate({
-            name: `${source}-akuma-directory`,
-            source,
-            path: layer.directoryFailure.path,
-            reason: layer.directoryFailure.reason,
-        }));
-    }
-    for (const candidate of layer.candidates) {
-        allCandidates.push(candidate);
-        const prior = selected[candidate.name];
-        if (prior !== undefined) {
-            shadows.push(Object.freeze({
-                name: prior.name,
-                source: prior.source,
-                path: prior.path,
-                shadowedBy: candidate.source,
-            }));
-        }
-        selected[candidate.name] = candidate;
-    }
-}
-export async function loadAkumaCatalog(cwd) {
-    const candidates = [];
-    const selected = {};
-    const shadows = [];
-    for (const [name, profile] of Object.entries(BUILTIN_AGENT_PROFILES)) {
-        const candidate = freezeCandidate({
-            name,
-            source: "builtin",
-            path: null,
-            body: "",
-            profile: freezeProfile({
-                provider: profile.provider,
-                ...(profile.description !== undefined ? { description: profile.description } : {}),
-            }),
-        });
-        candidates.push(candidate);
-        selected[name] = candidate;
-    }
-    foldLayer(selected, shadows, candidates, "user", await readLayer(path.join(getKeiyakuHome(), "akuma"), "user"));
-    const repository = await observeGitRepository(cwd);
-    if (repository.capability === "unknown")
-        throw repository.error;
-    if (repository.capability === "available" && repository.coordinate === "repository") {
-        foldLayer(selected, shadows, candidates, "project", await readLayer(path.join(cwd, ".keiyaku", "akuma"), "project"));
-    }
-    return Object.freeze({
-        candidates: Object.freeze(candidates),
-        selected: Object.freeze(selected),
-        shadows: Object.freeze(shadows),
-    });
-}

package/build/config/env-keys.js

@@ -1,57 +0,0 @@
-function formatEnvValue(value) {
-    if (value.length === 0)
-        return '""';
-    if (/^[A-Za-z0-9_./:-]+$/.test(value))
-        return value;
-    return JSON.stringify(value);
-}
-export const DISABLE_SUBAGENT_SPAWN_ENV_KEY = "KEIYAKU_DISABLE_SUBAGENT_SPAWN";
-export const ENV_KEYS = {
-    AGENT_OVERRIDE: "KEIYAKU_AGENT_OVERRIDE",
-    DISABLE_SUBAGENT_SPAWN: DISABLE_SUBAGENT_SPAWN_ENV_KEY,
-    SUBAGENT_EXEC_IDLE_TIMEOUT_MS: "KEIYAKU_SUBAGENT_EXEC_IDLE_TIMEOUT_MS",
-    SUBAGENT_EXEC_MAX_DURATION_MS: "KEIYAKU_SUBAGENT_EXEC_MAX_DURATION_MS",
-    CODEX_EXEC_MAX_CAPTURE_CHARS: "KEIYAKU_CODEX_EXEC_MAX_CAPTURE_CHARS",
-    CLAUDE_EXEC_MAX_CAPTURE_CHARS: "KEIYAKU_CLAUDE_EXEC_MAX_CAPTURE_CHARS",
-    OPENCODE_EXEC_MAX_CAPTURE_CHARS: "KEIYAKU_OPENCODE_EXEC_MAX_CAPTURE_CHARS",
-    DEBUG_LOG_PATH: "KEIYAKU_DEBUG_LOG_PATH",
-    TEST_SILENT: "KEIYAKU_TEST_SILENT",
-    GIT_TIMEOUT_MS: "KEIYAKU_GIT_TIMEOUT_MS",
-    GIT_NO_VERIFY: "KEIYAKU_GIT_NO_VERIFY",
-    GIT_NO_GPG_SIGN: "KEIYAKU_GIT_NO_GPG_SIGN",
-    REVIEW_ENABLED: "KEIYAKU_REVIEW_ENABLED",
-    REVIEW_MIN_LINES: "KEIYAKU_REVIEW_MIN_LINES",
-    REVIEW_RESUME_SESSION: "KEIYAKU_REVIEW_RESUME_SESSION",
-    AMENDMENT_WARNING_THRESHOLD: "KEIYAKU_AMENDMENT_WARNING_THRESHOLD",
-};
-const ENV_KEY_ENTRIES = [
-    { key: ENV_KEYS.AGENT_OVERRIDE, defaultValue: "", description: "Override default agent name", category: "subagent" },
-    { key: ENV_KEYS.DISABLE_SUBAGENT_SPAWN, defaultValue: "0", description: "Disable subprocess subagent spawning when set to 1", category: "subagent" },
-    { key: ENV_KEYS.SUBAGENT_EXEC_IDLE_TIMEOUT_MS, defaultValue: "300000", description: "Subagent provider-ingress idle timeout in milliseconds", category: "subagent" },
-    { key: ENV_KEYS.SUBAGENT_EXEC_MAX_DURATION_MS, defaultValue: "0", description: "Subagent absolute execution policy budget in milliseconds; 0 disables it", category: "subagent" },
-    { key: ENV_KEYS.CODEX_EXEC_MAX_CAPTURE_CHARS, defaultValue: "200000", description: "Codex runtime output/diagnostics capture cap", category: "subagent" },
-    { key: ENV_KEYS.CLAUDE_EXEC_MAX_CAPTURE_CHARS, defaultValue: "200000", description: "Claude runtime output/diagnostics capture cap", category: "subagent" },
-    { key: ENV_KEYS.OPENCODE_EXEC_MAX_CAPTURE_CHARS, defaultValue: "200000", description: "OpenCode runtime output/diagnostics capture cap", category: "subagent" },
-    { key: ENV_KEYS.REVIEW_ENABLED, defaultValue: "1", description: "Run the reviewer gate when set to 1", category: "workflow" },
-    { key: ENV_KEYS.REVIEW_MIN_LINES, defaultValue: "200", description: "Minimum changed lines required before running the reviewer gate", category: "workflow" },
-    { key: ENV_KEYS.REVIEW_RESUME_SESSION, defaultValue: "1", description: "Resume reviewer sessions from the prior persisted response path when set to 1", category: "workflow" },
-    { key: ENV_KEYS.AMENDMENT_WARNING_THRESHOLD, defaultValue: "5", description: "Advisory amendment-count threshold for open contracts", category: "workflow" },
-    { key: ENV_KEYS.DEBUG_LOG_PATH, defaultValue: "", description: "Optional debug log output file path", category: "debug" },
-    { key: ENV_KEYS.TEST_SILENT, defaultValue: "0", description: "Suppress progress logs during tests when set to 1", category: "debug" },
-    { key: ENV_KEYS.GIT_TIMEOUT_MS, defaultValue: "15000", description: "Git command timeout in milliseconds", category: "git" },
-    { key: ENV_KEYS.GIT_NO_VERIFY, defaultValue: "1", description: "Use --no-verify on git commit/merge", category: "git" },
-    { key: ENV_KEYS.GIT_NO_GPG_SIGN, defaultValue: "1", description: "Use --no-gpg-sign on git commit/merge", category: "git" },
-];
-const ENV_DEFAULTS = new Map(ENV_KEY_ENTRIES.map((entry) => [entry.key, entry.defaultValue]));
-export function getEnvDefaultValue(envKey) {
-    const value = ENV_DEFAULTS.get(envKey);
-    if (value === undefined) {
-        throw new Error(`No default value registered for ${envKey}`);
-    }
-    return value;
-}
-export function renderEnvExample() {
-    return ENV_KEY_ENTRIES
-        .map((entry) => `# [${entry.category}] ${entry.description}\n# ${entry.key}=${formatEnvValue(entry.defaultValue)}`)
-        .join("\n\n");
-}