@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/agents-sync.js

@@ -1,502 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/agents-sync.js — reconcile .claude/agents/*.md into
-// agents_definitions at deploy (task 1002490, goal 1000038 Phase 1, T6).
-//
-// WHY. The registry is what the spawn path fires from, so it — not the tree — is
-// the operative list. Files-are-source means a committed definition must reach
-// that table on deploy without anyone running anything by hand, and without a
-// deploy ever silently undoing an operator's decision.
-//
-// FOUR RULES, each of which is a way this could go wrong:
-//
-//  1. A `source=db` row is NEVER touched. An instance-authored agent is not in
-//     any file, so a file-driven reconcile that "cleaned up" rows with no
-//     matching file would delete exactly the agents nobody can restore from git.
-//     This script only ever writes rows it owns.
-//
-//  2. `author_rank` is NEVER read from the file, and never taken from git where
-//     it could grant anything. A committed file cannot carry authority (ADR
-//     0016) — writing `author_rank: archon` into frontmatter must buy nothing.
-//     The obvious implementation, "resolve the committer and stamp their live
-//     rank", has the same hole one level down: `git log --format=%ae` reports
-//     the commit AUTHOR, which the committer sets freely with `git config` or
-//     `--author`, so it is attacker-controlled too. Rather than pretend that
-//     value can be trusted, it is denied any power — see stampableAuthorRank:
-//     a definition reaching a PROTECTED module is stamped NULL regardless of
-//     git, which the wall treats as insufficient, so it imports disabled and
-//     arming it becomes an operator act with a real session behind it.
-//
-//  3. The scope wall is RE-RUN here, server-side. The same check runs when a
-//     definition is authored, but that check ran against the author's rank at
-//     authoring time on a machine outside the trust boundary. A definition
-//     scoped onto protected surfaces imports DISABLED and FLAGGED — present in
-//     the registry so it can be seen and fixed, never armed.
-//
-//  4. The sync NEVER ARMS ANYTHING. `enabled` is an operator decision, not a
-//     file one — by exactly the reasoning in rule 2. A new row inserts disabled;
-//     an existing row keeps whatever `enabled` an operator set, unless it is
-//     flagged, in which case it is forced off. So `git push` can add an agent to
-//     the registry and can never switch one on.
-//
-// FAIL-CLOSED IN THE DIRECTION THAT MATTERS. An unresolvable author yields a
-// NULL rank, which the validator treats as insufficient for any protected scope,
-// and which the schema's agents_definitions_armed_needs_author_chk independently
-// refuses to arm. Three layers have to agree before an agent fires; this script
-// is only one of them.
-//
-// Run:  node scripts/gds/agents-sync.js [--dry-run] [--json] [--dir <path>]
-
+// scripts/gds/agents-sync.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/agents-sync.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const DEFAULT_DIR = path.join(REPO_ROOT, '.claude', 'agents');
-
-// The module owns the definition grammar; this script is its deploy-time
-// carrier. Requiring the module's own pure validator from the module's own
-// script is the same shape as context-pack.js reading task-classifier.
-const validate = require(path.join(REPO_ROOT, 'modules/agents/lib/validate.js'));
-
-// Validator error codes that mean "the SCOPE is refused", as opposed to "this is
-// not a definition". The distinction is the whole of rule 3: a scope refusal is
-// imported as a flagged row so somebody can SEE it, while a shape error has no
-// row to import — there is no definition there to put in the registry.
-const SCOPE_CODES = Object.freeze([
-  'scope_protected_rank',
-  'scope_out_of_bounds',
-  // task 1002492. The definition is well-formed; what failed is that its paths
-  // could not be checked. That is importable-but-flagged (visible, disabled),
-  // never a silent skip — "nobody checked" must surface as loudly as "refused".
-  'scope_paths_uncheckable',
-]);
-
-// Does this definition reach a PROTECTED surface — by module OR by path? If so,
-// the git-derived author identity is not consulted at all (see below), which is
-// what makes rule 2 hold against a value the author controls.
-//
-// The path half arrived with task 1002492. Before it, this asked about modules
-// only, which left the withholding rule with the same asymmetry the scope wall
-// itself had: naming `modules/government/` as a PATH reached neither check, so a
-// spoofed identity could still have stamped a rank onto a definition pointed at
-// the authority surface. Both halves, or neither is a wall.
-function declaresProtectedScope(candidate, protectedModules = [], isProtectedPath = null) {
-  const modules = Array.isArray(candidate?.scope_modules) ? candidate.scope_modules : [];
-  if (modules.some((m) => protectedModules.includes(m))) return true;
-  const paths = Array.isArray(candidate?.scope_paths) ? candidate.scope_paths : [];
-  if (paths.length === 0) return false;
-  // No matcher and declared paths: unanswerable, so treated as protected — the
-  // same fail-closed reading the validator applies (scope_paths_uncheckable).
-  if (typeof isProtectedPath !== 'function') return true;
-  return paths.some((p) => {
-    try { return isProtectedPath(p) !== false; } catch { return true; }
-  });
-}
-
-// THE RANK THAT ACTUALLY GETS STAMPED, and the answer to the spoofable-identity
-// problem in lastCommitterLogin above.
-//
-// The naive design — resolve the committer, read their live rank, stamp it — is
-// an escalation path: the committer email is attacker-controlled, so anyone who
-// can land a commit can claim to be an Archon and arm an agent scoped onto the
-// authority surface. Verifying the identity properly would mean a trustworthy
-// server-side record of who authored each file, which this script does not have.
-//
-// So instead of trying to make the input trustworthy, the input is denied any
-// power: WHERE THE RANK COULD GRANT SOMETHING, IT IS NOT TAKEN FROM GIT.
-//
-//   - definition reaches a protected module → rank is NULL, full stop. The wall
-//     then flags it (an unresolved rank is insufficient, never exempt) and it
-//     imports disabled. Arming it is an operator act with a real session behind
-//     it, which is where the authority decision belongs.
-//   - definition reaches nothing protected → the rank gates nothing, so the
-//     hint is recorded as the provenance it is.
-//
-// The result is that spoofing the git identity buys exactly nothing: on the only
-// path where rank matters, no git-derived value is read.
-function stampableAuthorRank(candidate, { gitRank = null, protectedModules = [], isProtectedPath = null } = {}) {
-  if (declaresProtectedScope(candidate, protectedModules, isProtectedPath)) return null;
-  return gitRank;
-}
-
-// ---- pure core -------------------------------------------------------------
-
-// Split `---\n<yaml>\n---\n<body>` into frontmatter text and body.
-// Deliberately NOT a YAML parser: the definition grammar is a flat map of
-// scalars and simple lists, and pulling a YAML dependency into a deploy script
-// to read four keys would be a supply-chain decision, not a convenience. The
-// validator is the thing that decides whether the result is a definition — this
-// only has to hand it a plain object faithfully.
-function splitFrontmatter(text) {
-  const s = String(text || '');
-  // Tolerates a BOM and CRLF, both of which a Windows-authored file will carry.
-  //
-  // The BOM is stripped BY CODE POINT rather than matched inside the regex. Two
-  // earlier spellings both failed review for the same reason: a literal U+FEFF
-  // in the pattern is invisible, so `/^<BOM>?---/` reads as `/^?---/` — an
-  // apparent no-op quantifier on a zero-width assertion — and an escape can be
-  // re-interpreted back into that literal by tooling on the way to disk. This
-  // form is unambiguous ASCII, and the file now contains no invisible
-  // characters at all. Behaviour that is correct but unreadable is still a
-  // defect; it cost two review rounds here.
-  const withoutBom = s.charCodeAt(0) === 0xFEFF ? s.slice(1) : s;
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(withoutBom);
-  if (!m) return { frontmatter: null, body: s };
-  return { frontmatter: m[1], body: m[2] };
-}
-
-// `key: value` / `key: [a, b]` / `key:\n  - a\n  - b`. Unknown keys are kept —
-// the validator refuses what it does not recognise, and silently dropping a key
-// here would turn a typo into a default instead of an error.
-function parseFrontmatter(fmText) {
-  const out = {};
-  if (typeof fmText !== 'string') return out;
-  const lines = fmText.split(/\r?\n/);
-  let listKey = null;
-  for (const raw of lines) {
-    if (!raw.trim() || /^\s*#/.test(raw)) continue;
-    const item = /^\s*-\s+(.*)$/.exec(raw);
-    if (item && listKey) { out[listKey].push(scalar(item[1])); continue; }
-    const kv = /^([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.*)$/.exec(raw);
-    if (!kv) { listKey = null; continue; }
-    const [, key, rest] = kv;
-    if (rest === '') { listKey = key; out[key] = []; continue; }
-    listKey = null;
-    const inline = /^\[(.*)\]$/.exec(rest.trim());
-    out[key] = inline
-      ? inline[1].split(',').map((p) => scalar(p)).filter((p) => p !== '')
-      : scalar(rest);
-  }
-  return out;
-}
-
-function scalar(raw) {
-  let v = String(raw).trim();
-  // Strip a trailing comment only when the value is not quoted — a persona-ish
-  // string legitimately contains '#'.
-  const quoted = /^(['"])([\s\S]*)\1$/.exec(v);
-  if (quoted) return quoted[2];
-  v = v.replace(/\s+#.*$/, '').trim();
-  if (v === 'true') return true;
-  if (v === 'false') return false;
-  return v;
-}
-
-// One file → the candidate object the validator takes. The BODY is the persona:
-// a persona is prose, and prose does not belong in frontmatter.
-function parseAgentFile(text, { name } = {}) {
-  const { frontmatter, body } = splitFrontmatter(text);
-  const fm = parseFrontmatter(frontmatter);
-  const candidate = { ...fm };
-  // The filename is the identity when frontmatter does not override it, so
-  // historian.md is the `historian` agent without having to say so twice.
-  if (!candidate.name && name) candidate.name = name;
-  const persona = String(body || '').trim();
-  if (persona) candidate.persona = persona;
-  // `trigger: event` + `event: task.shipped` is the readable file spelling of
-  // the column pair the schema stores. Mapped here rather than in the validator
-  // so the validator keeps taking exactly the row shape the DB holds.
-  if (candidate.trigger && !candidate.trigger_type) {
-    candidate.trigger_type = candidate.trigger;
-    delete candidate.trigger;
-  }
-  // Every trigger PARAMETER, not just `event` (task 1004007). The frontmatter
-  // is flat on purpose (no YAML parser in a deploy script), so the file spells
-  // trigger_spec's keys at the top level and they are folded in here. Only
-  // `event` used to be, so a file's `touches:` filter reached the validator as
-  // a stray top-level key and was dropped, and every file-authored event agent
-  // fired on EVERY ship whatever its author wrote. `touches_globs` is the
-  // router's second spelling of the same filter. Values are moved VERBATIM: a
-  // malformed one is the validator's to refuse, not this parser's to coerce.
-  const SPEC_KEYS = ['event', 'touches', 'touches_globs', 'sink', 'cadence'];
-  const present = SPEC_KEYS.filter((k) => Object.prototype.hasOwnProperty.call(candidate, k));
-  if (present.length > 0 && candidate.trigger_spec === undefined) {
-    candidate.trigger_spec = {};
-    for (const k of present) { candidate.trigger_spec[k] = candidate[k]; delete candidate[k]; }
-  }
-  return candidate;
-}
-
-/**
- * Decide what to do with ONE parsed candidate. Pure: no disk, no database, no
- * git. Returns a plan the caller applies (or prints, under --dry-run).
- *
- * Outcomes:
- *   skip    — not a definition. No row; the reason is reported.
- *   flagged — a real definition whose SCOPE is refused. Imported disabled, with
- *             scope_violation set, so it is visible and fixable.
- *   upsert  — clean. Imported; `enabled` is left to the operator (rule 4).
- *   protected — a `source=db` row owns this name. Never touched (rule 1).
- */
-function planOne(candidate, {
-  authorRank: gitRank = null,
-  allowedModules = [],
-  protectedModules = [],
-  isProtectedPath = null,
-  existing = null,
-} = {}) {
-  const name = typeof candidate?.name === 'string' ? candidate.name : null;
-  // The caller passes the GIT-DERIVED rank; what gets stamped is whatever
-  // survives stampableAuthorRank, which withholds it entirely on any definition
-  // that reaches a protected module. Everything below uses `authorRank`, so the
-  // spoofable value cannot reach the wall by a path that forgets to launder it.
-  const authorRank = stampableAuthorRank(candidate, { gitRank, protectedModules, isProtectedPath });
-
-  // Rule 1, checked before anything else: an instance-authored row owns its
-  // name. A file that happens to share it does not get to overwrite it, and
-  // this is reported rather than silent so the collision is visible.
-  if (existing && existing.source === 'db') {
-    return { action: 'protected', name, reason: 'an instance-authored (source=db) row owns this name — the file is ignored' };
-  }
-
-  const verdict = validate.validateAgentDefinition(candidate, {
-    authorRank, allowedModules, protectedModules, isProtectedPath,
-  });
-
-  if (verdict.ok) {
-    return {
-      action: 'upsert',
-      name,
-      value: verdict.value,
-      authorRank,
-      scopeViolation: null,
-      // Rule 4: never arm. Absent an existing row this is a fresh insert, which
-      // the schema defaults to disabled; on update we carry the operator's own
-      // setting forward untouched.
-      enabled: existing ? existing.enabled === true : false,
-    };
-  }
-
-  const codes = verdict.errors.map((e) => e.code);
-  const scopeOnly = codes.length > 0 && codes.every((c) => SCOPE_CODES.includes(c));
-  if (!scopeOnly) {
-    return { action: 'skip', name, reason: verdict.errors.map((e) => e.message).join(' · ') };
-  }
-
-  // Rule 3. The definition is well-formed; only its scope is refused. To import
-  // it we need the NORMALIZED row, which the validator only returns on success —
-  // so it is re-run with the scope checks satisfied purely to obtain that shape.
-  //
-  // This cannot widen anything: the re-run's verdict is discarded except for
-  // `value`, the row is forced enabled:false with scope_violation set, and the
-  // schema's agents_definitions_flagged_not_armed_chk refuses to store a flagged
-  // row as armed even if this code were wrong.
-  const declaredModules = Array.isArray(candidate.scope_modules) ? candidate.scope_modules : [];
-  const shapeOnly = validate.validateAgentDefinition(candidate, {
-    authorRank: validate.RANK_ORDER[validate.RANK_ORDER.length - 1],
-    allowedModules: [...new Set([...allowedModules, ...declaredModules])],
-    protectedModules: [],
-    // The re-run clears the MODULE wall to recover the normalized shape. The
-    // path matcher is deliberately left in place: a matcher that says a path is
-    // protected is a fact about the path, not about the author, so laundering
-    // it here would store a row whose scope no longer matches its flag.
-    isProtectedPath: () => false,
-  });
-  if (!shapeOnly.ok) {
-    // Defensive: the two runs disagreeing means an error that is scope-coded but
-    // not scope-caused. Skipping is the fail-closed answer.
-    return { action: 'skip', name, reason: verdict.errors.map((e) => e.message).join(' · ') };
-  }
-  return {
-    action: 'flagged',
-    name,
-    value: shapeOnly.value,
-    authorRank,
-    scopeViolation: verdict.errors.map((e) => e.message).join(' · '),
-    enabled: false,
-  };
-}
-
-// The whole plan, for a list of { name, candidate } and a lookup of existing
-// rows by name. Pure, so the reconcile's DECISIONS are unit-testable with no
-// database standing up.
-function planSync(files, { existingByName = new Map(), authorRankFor = () => null, allowedModules = [], protectedModules = [], isProtectedPath = null } = {}) {
-  return files.map((f) => ({
-    file: f.file || null,
-    ...planOne(f.candidate, {
-      authorRank: authorRankFor(f.file),
-      allowedModules,
-      protectedModules,
-      isProtectedPath,
-      existing: existingByName.get(f.candidate?.name) || null,
-    }),
-  }));
-}
-
-// ---- disk + git ------------------------------------------------------------
-
-// The repo a definitions dir belongs to, by the `<root>/.claude/agents` layout.
-// Not REPO_ROOT: a split-root instance runs this script from the core package
-// while its definitions live in the instance repo (task 1004139), so paths and
-// git history must be read against the definitions' repo, not the core's.
-function definitionsRoot(dir) {
-  return path.resolve(dir, '..', '..');
-}
-
-// An ABSENT directory is a legitimate state, not an error: `.claude/agents/`
-// does not exist in the core tree at all today, and an instance that ships no
-// agents must deploy cleanly. Zero files, exit 0, nothing written.
-function readAgentFiles(dir = DEFAULT_DIR) {
-  let names;
-  try {
-    names = fs.readdirSync(dir).filter((f) => f.endsWith('.md'));
-  } catch (err) {
-    if (err.code === 'ENOENT') return [];
-    throw err;
-  }
-  const root = definitionsRoot(dir);
-  return names.sort().map((f) => {
-    const full = path.join(dir, f);
-    return {
-      file: path.relative(root, full).split(path.sep).join('/'),
-      candidate: parseAgentFile(fs.readFileSync(full, 'utf8'), { name: f.replace(/\.md$/, '') }),
-    };
-  });
-}
-
-// The login that last committed a file — a PROVENANCE HINT, and explicitly NOT
-// an authority input. Read `declaresProtectedScope` below before using it.
-//
-// An earlier version of this comment claimed the GitHub noreply address "cannot
-// be spoofed by setting a local git name". THAT WAS WRONG, and it was the more
-// dangerous half of the mistake: `git log --format=%ae` reports the commit
-// AUTHOR, which any committer sets freely with `git config user.email` or
-// `--author`, noreply-shaped values included. Nothing here verifies the address
-// against GitHub. So this value is attacker-controlled, and a comment asserting
-// otherwise invites the next reviewer to skip the one check that matters.
-//
-// It is kept because provenance is genuinely useful where nothing is riding on
-// it. The wall is that it is never consulted where it could grant anything.
-function lastCommitterLogin(file, { runGit = defaultRunGit, cwd = REPO_ROOT } = {}) {
-  let out;
-  try { out = runGit(['log', '-1', '--format=%ae%n%an', '--', file], cwd); }
-  catch { return null; }
-  const [email = '', authorName = ''] = String(out || '').split(/\r?\n/);
-  const noreply = /^(?:\d+\+)?([A-Za-z0-9-]+)@users\.noreply\.github\.com$/.exec(email.trim());
-  if (noreply) return noreply[1];
-  return authorName.trim() || null;
-}
-
-function defaultRunGit(args, cwd = REPO_ROOT) {
-  return execFileSync('git', args, { cwd, encoding: 'utf8' });
-}
-
-module.exports = {
-  splitFrontmatter,
-  parseFrontmatter,
-  parseAgentFile,
-  declaresProtectedScope,
-  stampableAuthorRank,
-  planOne,
-  planSync,
-  readAgentFiles,
-  lastCommitterLogin,
-  SCOPE_CODES,
-  DEFAULT_DIR,
-};
-
-// ---- facade ----------------------------------------------------------------
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const dryRun = argv.includes('--dry-run');
-  const asJson = argv.includes('--json');
-  const dirIdx = argv.indexOf('--dir');
-  const dir = dirIdx >= 0 ? argv[dirIdx + 1] : DEFAULT_DIR;
-  const root = definitionsRoot(dir);
-
-  const files = readAgentFiles(dir);
-  if (files.length === 0) {
-    if (asJson) console.log(JSON.stringify({ ok: true, scanned: 0, plan: [] }));
-    else console.log(`agents-sync: no definitions under ${path.relative(root, dir) || dir} — nothing to reconcile.`);
-    return 0;
-  }
-
-  const { pool } = require(path.join(REPO_ROOT, 'src/bongos/pool'));
-  const scopeMap = require(path.join(REPO_ROOT, 'src/bongos/module-scope-map.js'));
-  const allowedModules = scopeMap.moduleKeys();
-  const protectedModules = scopeMap.protectedModules();
-  // The protected-surface registry, read the way every other enforcer reads it:
-  // synchronously from the checkout, no DB and no server (ADR 0043). surfaceFor
-  // returns the governing registry entry or null, so this is the boolean the
-  // validator's scope_paths wall asks for.
-  const permissionPaths = require(path.join(REPO_ROOT, 'src/bongos/permission-path-check.js'));
-  const isProtectedPath = (p) => permissionPaths.surfaceFor(p) !== null;
-
-  const { rows: existingRows } = await pool.query(
-    'SELECT name, source, enabled FROM agents_definitions'
-  );
-  const existingByName = new Map(existingRows.map((r) => [r.name, r]));
-
-  // ONE git subprocess per file, memoised — `authorRankFor` is called again from
-  // planSync, and re-shelling out there doubled the blocking spawns for an answer
-  // that cannot have changed mid-run.
-  const loginByFile = new Map(files.map((f) => [f.file, lastCommitterLogin(f.file, { cwd: root })]));
-  // One query for every distinct committer, not one per file.
-  const logins = [...new Set([...loginByFile.values()].filter(Boolean))];
-  const rankByLogin = new Map();
-  if (logins.length) {
-    const { rows } = await pool.query(
-      'SELECT github_login, rank FROM builders WHERE lower(github_login) = ANY($1)',
-      [logins.map((l) => l.toLowerCase())]
-    );
-    for (const r of rows) rankByLogin.set(String(r.github_login).toLowerCase(), r.rank);
-  }
-  // The git-derived rank. planOne withholds it on any protected-scope definition
-  // (stampableAuthorRank) — this function never decides whether it may be used.
-  const authorRankFor = (file) => {
-    const login = loginByFile.get(file);
-    return login ? (rankByLogin.get(login.toLowerCase()) || null) : null;
-  };
-
-  const plan = planSync(files, { existingByName, authorRankFor, allowedModules, protectedModules, isProtectedPath });
-
-  if (dryRun) {
-    if (asJson) console.log(JSON.stringify({ ok: true, scanned: files.length, plan }, null, 2));
-    else for (const p of plan) console.log(`  ${p.action.padEnd(9)} ${p.name || p.file}${p.reason ? ` — ${p.reason}` : ''}`);
-    return 0;
-  }
-
-  let upserted = 0;
-  let flagged = 0;
-  for (const p of plan) {
-    if (p.action === 'skip' || p.action === 'protected') {
-      console.error(`agents-sync: ${p.action} ${p.name || p.file} — ${p.reason}`);
-      continue;
-    }
-    const v = p.value;
-    // ON CONFLICT targets the name unique constraint, and the WHERE clause is
-    // rule 1 made structural: a row that turned source=db between the read above
-    // and this write is not overwritten by the race either.
-    await pool.query(
-      `INSERT INTO agents_definitions
-         (name, title, persona, trigger_type, trigger_spec, model_tier,
-          scope_modules, scope_paths, scope_violation, source, provenance,
-          author_rank, source_path, last_synced_at, enabled)
-       VALUES ($1,$2,$3,$4,$5::jsonb,$6,$7,$8,$9,'file','built-in',$10,$11,now(),$12)
-       ON CONFLICT (name) DO UPDATE SET
-         title = EXCLUDED.title, persona = EXCLUDED.persona,
-         trigger_type = EXCLUDED.trigger_type, trigger_spec = EXCLUDED.trigger_spec,
-         model_tier = EXCLUDED.model_tier, scope_modules = EXCLUDED.scope_modules,
-         scope_paths = EXCLUDED.scope_paths, scope_violation = EXCLUDED.scope_violation,
-         author_rank = EXCLUDED.author_rank, source_path = EXCLUDED.source_path,
-         last_synced_at = now(), enabled = EXCLUDED.enabled, updated_at = now()
-       WHERE agents_definitions.source = 'file'`,
-      [v.name, v.title, v.persona, v.trigger_type, JSON.stringify(v.trigger_spec), v.model_tier,
-        v.scope_modules, v.scope_paths, p.scopeViolation, p.authorRank, p.file || null, p.enabled]
-    );
-    if (p.action === 'flagged') flagged += 1; else upserted += 1;
-  }
-  console.log(`agents-sync: ${files.length} file(s) — ${upserted} reconciled, ${flagged} flagged (disabled), `
-    + `${plan.filter((p) => p.action === 'skip').length} skipped, ${plan.filter((p) => p.action === 'protected').length} db-owned.`);
-  return 0;
-}
-
-if (require.main === module) {
-  main().then((code) => { process.exitCode = code; }).catch((err) => {
-    console.error(`agents-sync: ${err && err.message ? err.message : err}`);
-    process.exitCode = 1;
-  });
-}
+require('../bongos/forwarder.js').forward(module, 'agents-sync.js');