@codedrifters/configulator 0.0.361 → 0.0.362

package/lib/index.js

@@ -451,6 +451,7 @@ __export(index_exports, {
   renderSkillEvalsRuleContent: () => renderSkillEvalsRuleContent,
   renderSkillEvalsRunnerScript: () => renderSkillEvalsRunnerScript,
   renderSourceTierExamples: () => renderSourceTierExamples,
+  renderStripToolArtifactTagsProcedure: () => renderStripToolArtifactTagsProcedure,
   renderTemporalFramingCheckerScript: () => renderTemporalFramingCheckerScript,
   renderTemporalFramingRuleContent: () => renderTemporalFramingRuleContent,
   renderUnblockDependentsScript: () => renderUnblockDependentsScript,
@@ -487,6 +488,7 @@ __export(index_exports, {
   slackBundle: () => slackBundle,
   softwareProfileBundle: () => softwareProfileBundle,
   standardsResearchBundle: () => standardsResearchBundle,
+  stripToolArtifactTagsProcedure: () => stripToolArtifactTagsProcedure,
   tsdocRecordToFindings: () => tsdocRecordToFindings,
   turborepoBundle: () => turborepoBundle,
   typescriptBundle: () => typescriptBundle,
@@ -4264,7 +4266,7 @@ function buildBaseBundle(paths = DEFAULT_AGENT_PATHS) {
           "- **After modifying Projen configuration**, run the three-step regen sequence: `pnpm i`, then `pnpm exec projen`, then `pnpm i` again. The leading `pnpm i` syncs `node_modules` with the lockfile so synth runs against the right configulator/projen/plugin versions; the trailing `pnpm i` refreshes the lockfile to match anything projen rewrote in `package.json`.",
           "- **Configure dependencies through Projen** \u2014 never use `npm install`, `pnpm add`, or `yarn add`. Add them to `deps` or `devDeps` in Projen config.",
           "- **Export from index.ts** to maintain clean public APIs",
-          '- **`defaultMode: "dontAsk"` is configulator\'s hardcoded default** for the rendered Claude Code `settings.json`. Scheduled-task workers (issue-worker, orchestrator, pr-reviewer, and the analyst/writer family) run autonomously and would deadlock on confirmation prompts, so the synthesised default suppresses them. Override only after revisiting the autonomous-worker contract end-to-end; the override path is `claudeSettings.defaultMode` on `AgentConfigOptions`.',
+          '- **`defaultMode` is opt-in** for the rendered Claude Code `settings.json`. configulator does not set it by default, so the synthesised `settings.json` omits the key unless the consumer opts in. Consumers that run autonomous scheduled-task workers (issue-worker, orchestrator, pr-reviewer, and the analyst/writer family) \u2014 which would deadlock on confirmation prompts \u2014 opt in by setting `claudeSettings.defaultMode: "dontAsk"` on `AgentConfigOptions`.',
           "",
           "## Repository Layout",
           "",
@@ -9845,6 +9847,108 @@ var checkLinksProcedure = {
   description: "Link integrity checker that wraps `astro check` (internal links) and `lychee` (external URLs) and normalizes their output into a single JSON-array stream of { url, docPath, line, kind, reason } records. Detection is data: the helper exits 0 when a tool ran successfully regardless of how many broken links it reported. Non-zero exits are reserved for tool-level failures.",
   content: renderCheckLinksProcedure()
 };
+function renderStripToolArtifactTagsProcedure() {
+  return [
+    "#!/usr/bin/env bash",
+    "# strip-tool-artifact-tags.sh \u2014 remove leaked tool-call wrapper",
+    "# closing tags from the end of an authored markdown file.",
+    "#",
+    "# Usage:",
+    "#   .claude/procedures/strip-tool-artifact-tags.sh <file-path>",
+    "#",
+    "# Authoring agents occasionally leak tool-call wrapper *closing*",
+    "# tags (</content>, </invoke>, </parameter>) as trailing whole",
+    "# lines in the markdown they write. astro check and CI link checks",
+    "# do not catch them. This helper strips those EOF artifact lines",
+    "# (plus any now-trailing blank lines) and rewrites the file with a",
+    "# single final newline.",
+    "#",
+    "# Guards (mirrors check-links.sh):",
+    "#   - Operates only on an existing file whose path is under",
+    "#     docs/src/content/docs/. Any other path, or a missing file,",
+    "#     is a silent no-op.",
+    "#   - Only WHOLE-LINE EOF tags are removed; inline `<...>` prose or",
+    "#     fenced code is never touched.",
+    "#   - Idempotent: a re-run on a clean file changes nothing.",
+    "#   - Never fails the tool call \u2014 always exits 0. Diagnostics go to",
+    "#     stderr only; the file is rewritten only when it changes.",
+    "",
+    "set -uo pipefail",
+    "",
+    "err() {",
+    '  printf "strip-tool-artifact-tags.sh: %s\\n" "$*" >&2',
+    "}",
+    "",
+    "# No file argument: nothing to do.",
+    'if [ "$#" -lt 1 ]; then',
+    "  exit 0",
+    "fi",
+    "",
+    'file="$1"',
+    "",
+    "# No-op unless the file actually exists and is a regular file.",
+    'if [ ! -f "$file" ]; then',
+    "  exit 0",
+    "fi",
+    "",
+    "# Path guard: only touch markdown under the Starlight content tree.",
+    "# Match the canonical content-root segment anywhere in the path so",
+    "# the guard works for both absolute and repo-relative paths.",
+    'case "$file" in',
+    "  *docs/src/content/docs/*) ;;",
+    "  *) exit 0 ;;",
+    "esac",
+    "",
+    "# Rewrite the file with trailing artifact tags and trailing blank",
+    "# lines removed. awk buffers every line, then walks back from EOF",
+    "# dropping lines that are blank or exactly one of the leaked",
+    "# closing tags (trailing whitespace tolerated). Whatever survives",
+    "# is re-emitted with a single final newline. Only whole lines are",
+    "# considered, so inline `<...>` content is never altered.",
+    'tmp_out="$(mktemp -t strip-tool-artifact-tags-XXXXXX)" || exit 0',
+    "# shellcheck disable=SC2064",
+    `trap "rm -f '$tmp_out'" EXIT`,
+    "",
+    "awk '",
+    "  { lines[NR] = $0 }",
+    "  END {",
+    "    last = NR",
+    "    while (last > 0) {",
+    "      line = lines[last]",
+    "      # Strip trailing whitespace (spaces, tabs, CR) for the match.",
+    "      stripped = line",
+    '      sub(/[ \\t\\r]+$/, "", stripped)',
+    '      if (stripped == "" \\',
+    '          || stripped == "</content>" \\',
+    '          || stripped == "</invoke>" \\',
+    '          || stripped == "</parameter>") {',
+    "        last--",
+    "        continue",
+    "      }",
+    "      break",
+    "    }",
+    "    for (i = 1; i <= last; i++) {",
+    "      print lines[i]",
+    "    }",
+    "  }",
+    `' "$file" > "$tmp_out" || exit 0`,
+    "",
+    "# Only write back when the content actually changed \u2014 keeps the",
+    "# helper a true no-op on clean files (idempotent re-runs included).",
+    'if ! cmp -s "$tmp_out" "$file"; then',
+    '  if ! cat "$tmp_out" > "$file"; then',
+    '    err "failed to rewrite $file"',
+    "  fi",
+    "fi",
+    "",
+    "exit 0"
+  ].join("\n");
+}
+var stripToolArtifactTagsProcedure = {
+  name: "strip-tool-artifact-tags.sh",
+  description: "Strips leaked tool-call wrapper closing tags (</content>, </invoke>, </parameter>) that authoring agents occasionally emit as trailing whole lines in markdown, plus any now-trailing blank lines, leaving a single final newline. Operates only on an existing file under docs/src/content/docs/; idempotent, a no-op on clean or missing files, and always exits 0 so it can never fail a PostToolUse hook.",
+  content: renderStripToolArtifactTagsProcedure()
+};
 function renderCheckDocSamplesProcedure() {
   const nodeScript = [
     "(async () => {",
@@ -10017,7 +10121,8 @@ function buildDocsSyncBundle(paths = DEFAULT_AGENT_PATHS) {
     procedures: [
       extractApiProcedure,
       checkLinksProcedure,
-      checkDocSamplesProcedure
+      checkDocSamplesProcedure,
+      stripToolArtifactTagsProcedure
     ],
     labels: [
       {
@@ -12643,6 +12748,36 @@ function buildMeetingAnalystSubAgent(tier) {
       "**Goal:** Create GitHub issues for follow-up work, cross-reference the",
       "meeting into existing documentation, and complete bi-directional traceability.",
       "",
+      "### Idempotent dedup gate (open AND closed)",
+      "",
+      "Phase 3 (`meeting:draft`) already files one downstream issue per",
+      "drafted artifact \u2014 a `req:write` per requirement draft, plus",
+      "`docs:write` / `bcm:*` / `research:scope` where applicable. Phase 4",
+      "must **not** re-file what Phase 3 already filed. Before creating",
+      "**any** downstream issue (`req:write`, `docs:write`, `bcm:*`,",
+      "`research:scope`) for a drafted artifact, dedup against existing",
+      "issues:",
+      "",
+      "1. **Search open AND closed issues** for one already covering the",
+      "   same artifact, matching on the draft's title / basename \u2014 e.g.",
+      "   `gh issue list --search '<draft title or basename>' --state all --json number,title,state`.",
+      "   Searching **all states** is load-bearing: the original may have",
+      "   already been worked and **merged (closed)**, and an open-only",
+      "   search misses it \u2014 re-filing then collides with the shipped",
+      "   document and produces an ID-collision PR.",
+      "2. **If a match exists (open or closed), SKIP creation.** Link to",
+      "   the existing issue from the `## Downstream Artifacts` section",
+      "   instead of filing a new one.",
+      "3. **Only create issues for follow-up work that has no Phase 3",
+      "   draft.** A drafted artifact already has its downstream issue;",
+      "   file new issues only for items the draft phase did not cover.",
+      "4. **Be idempotent.** Re-running the same `meeting:link` issue must",
+      "   file nothing new \u2014 a second run finds the first run's issues",
+      "   (now open or closed) via the same search and skips them.",
+      "",
+      "Apply this gate to **both** Step 2 (requirement issues) and Step 4",
+      "(action-item routing) below.",
+      "",
       "### Steps",
       "",
       "1. Read the drafts from Phase 3 (if they exist) and the extraction",
@@ -12652,6 +12787,11 @@ function buildMeetingAnalystSubAgent(tier) {
       "   are in scope for direct edits on this meeting. Apply the rules in",
       "   the **Areas filtering** section above.",
       "2. Create requirement issues using `gh issue create` with appropriate labels.",
+      "   **First apply the Idempotent dedup gate above:** search open AND",
+      "   closed issues for one already covering the drafted requirement",
+      "   (match on its title / basename) and **skip creation when a match",
+      "   exists** \u2014 Phase 3 already filed a `req:write` issue per requirement",
+      "   draft, so file here only for requirements with no Phase 3 draft.",
       "   Include a `## Traceability` section in each issue body linking back to",
       "   the source meeting and extraction file. Issue creation is **not**",
       "   gated by areas.",
@@ -12666,9 +12806,13 @@ function buildMeetingAnalystSubAgent(tier) {
       "     \u2014 a `req:write` issue for a requirement, a `docs:write` issue",
       "     for a docs page, `bcm:*` for a capability model, a",
       "     `research:scope` issue for a research note, or a roadmap /",
-      "     product-doc follow-up. Use the matching template from the",
-      "     issue-templates page; include a `## Traceability` section.",
-      "     Issue creation is not gated by areas.",
+      "     product-doc follow-up. **First apply the Idempotent dedup gate",
+      "     above:** search open AND closed issues for one already covering",
+      "     this artifact and **skip creation when a match exists** (link",
+      "     to it instead) \u2014 file only for action items that have no Phase",
+      "     3 draft. Use the matching template from the issue-templates",
+      "     page; include a `## Traceability` section. Issue creation is",
+      "     not gated by areas.",
       "   - **Human-owned** (send/schedule/install/decide/communicate/",
       "     get-access/build-elsewhere): record it **only** in the notes",
       "     `## Action Items` table (step 8 already carries the table",
@@ -14044,7 +14188,7 @@ var DEFAULT_BUNDLE_OVERRIDES = {
     acceptanceCriteria: { smallMax: 3, mediumMax: 14 }
   },
   "regulatory:research": {
-    acceptanceCriteria: { smallMax: 3, mediumMax: 10 }
+    acceptanceCriteria: { smallMax: 3, mediumMax: 12 }
   },
   "standards:research": {
     acceptanceCriteria: { smallMax: 3, mediumMax: 10 }
@@ -14060,6 +14204,32 @@ var DEFAULT_BUNDLE_OVERRIDES = {
   "software:matrix": {
     acceptanceCriteria: { smallMax: 3, mediumMax: 12 },
     sources: { smallMax: 2, mediumMax: 15 }
+  },
+  "people:research": {
+    acceptanceCriteria: { smallMax: 3, mediumMax: 12 }
+  },
+  "company:research": {
+    acceptanceCriteria: { smallMax: 3, mediumMax: 12 }
+  },
+  "people:draft": {
+    acceptanceCriteria: { smallMax: 3, mediumMax: 12 }
+  },
+  "company:draft": {
+    acceptanceCriteria: { smallMax: 3, mediumMax: 12 }
+  },
+  "req:draft-trace": {
+    acceptanceCriteria: { smallMax: 3, mediumMax: 20 }
+  },
+  "meeting:notes": {
+    acceptanceCriteria: { smallMax: 3, mediumMax: 9 }
+  },
+  "meeting:draft": {
+    acceptanceCriteria: { smallMax: 3, mediumMax: 15 },
+    sources: { smallMax: 2, mediumMax: 10 }
+  },
+  "meeting:link": {
+    acceptanceCriteria: { smallMax: 3, mediumMax: 15 },
+    sources: { smallMax: 2, mediumMax: 10 }
   }
 };
 var DEFAULT_DECOMPOSITION_TEMPLATE = [
@@ -14323,17 +14493,30 @@ function renderScopeGateShellHelpers(gate) {
     "  body=$(cat)",
     "  local ac_count sources_count",
     `  ac_count=$(printf '%s\\n' "$body" | awk '`,
-    "    BEGIN { in_ac=0; count=0 }",
+    "    # Count only TOP-LEVEL checkboxes \u2014 those at the shallowest",
+    "    # indentation in each Acceptance-Criteria section. A checkbox",
+    "    # with nested/indented sub-checkboxes (e.g. a `file N action-",
+    "    # item issues` criterion) counts once, mirroring the TS",
+    "    # countTopLevelCheckboxes() helper.",
+    "    function flush() {",
+    "      if (n > 0) { for (i = 0; i < n; i++) if (indents[i] == mini) total++ }",
+    "      n = 0; mini = -1",
+    "    }",
+    "    BEGIN { in_ac=0; total=0; n=0; mini=-1 }",
     "    # Fully case-insensitive heading match mirrors the TypeScript",
     "    # classifier (/^## acceptance criteria\\s*$/i); POSIX awk has",
     "    # no /i flag, so we compare via tolower() instead of a",
     "    # per-letter character class like [Aa]cceptance [Cc]riteria",
     "    # which would drift for headings like `## ACCEPTANCE CRITERIA`.",
     "    { lower = tolower($0) }",
-    "    lower ~ /^## acceptance criteria[[:space:]]*$/ { in_ac=1; next }",
-    "    /^## / { in_ac=0 }",
-    "    in_ac && /^[[:space:]]*-[[:space:]]*\\[[ xX]\\]/ { count++ }",
-    "    END { print count }",
+    "    lower ~ /^## acceptance criteria[[:space:]]*$/ { flush(); in_ac=1; next }",
+    "    /^## / { if (in_ac) { flush(); in_ac=0 } }",
+    "    in_ac && /^[[:space:]]*-[[:space:]]*\\[[ xX]\\]/ {",
+    "      match($0, /^[[:space:]]*/); ind = RLENGTH;",
+    "      indents[n++] = ind;",
+    "      if (mini < 0 || ind < mini) mini = ind;",
+    "    }",
+    "    END { flush(); print total }",
     "  ')",
     `  sources_count=$(printf '%s\\n' "$body" | awk '`,
     "    BEGIN { in_src=0; count=0 }",
@@ -14342,7 +14525,16 @@ function renderScopeGateShellHelpers(gate) {
     "    { lower = tolower($0) }",
     "    lower ~ /^## (inputs|references|sources)[[:space:]]*$/ { in_src=1; next }",
     "    /^## / { in_src=0 }",
-    "    in_src && /^[[:space:]]*[-*][[:space:]]+/ { count++ }",
+    "    # Exclude `Key: value` metadata bullets (e.g. `- Basename: \u2026`)",
+    "    # \u2014 a bullet whose text is a `Word:` key/value pair is",
+    "    # metadata, not a source. Mirrors the TS countSourceBullets()",
+    "    # METADATA_KEY_VALUE_REGEX exclusion.",
+    "    in_src && /^[[:space:]]*[-*][[:space:]]+/ {",
+    "      rest = $0;",
+    '      sub(/^[[:space:]]*[-*][[:space:]]+/, "", rest);',
+    "      if (rest ~ /^[A-Za-z][A-Za-z0-9-]*:[[:space:]]+[^[:space:]]/) next;",
+    "      count++;",
+    "    }",
     "    END { print count }",
     "  ')",
     `  printf 'ac=%s sources=%s\\n' "$ac_count" "$sources_count" >&2`,
@@ -14497,37 +14689,80 @@ function resolveScopeClass(acCount, sourcesCount, thresholds) {
   }
   return "large";
 }
+var AC_CHECKBOX_REGEX = /^(\s*)-\s*\[[ xX]\]/;
+var SOURCES_BULLET_REGEX = /^\s*[-*]\s+(.*)$/;
+var METADATA_KEY_VALUE_REGEX = /^[A-Za-z][A-Za-z0-9-]*:\s+\S/;
 function countAcceptanceCriteria(body) {
   return countSectionMatches(
     body,
     /^## acceptance criteria\s*$/i,
-    /^\s*-\s*\[[ xX]\]/
+    countTopLevelCheckboxes
   );
 }
 function countSources(body) {
   return countSectionMatches(
     body,
     /^## (?:inputs|references|sources)\s*$/i,
-    /^\s*[-*]\s+/
+    countSourceBullets
   );
 }
-function countSectionMatches(body, headingRegex, lineRegex) {
+function countTopLevelCheckboxes(sectionLines) {
+  let minIndent = Infinity;
+  const indents = [];
+  for (const line of sectionLines) {
+    const match = AC_CHECKBOX_REGEX.exec(line);
+    if (match === null) {
+      continue;
+    }
+    const indent = match[1].length;
+    indents.push(indent);
+    if (indent < minIndent) {
+      minIndent = indent;
+    }
+  }
+  return indents.filter((indent) => indent === minIndent).length;
+}
+function countSourceBullets(sectionLines) {
+  let count = 0;
+  for (const line of sectionLines) {
+    const match = SOURCES_BULLET_REGEX.exec(line);
+    if (match === null) {
+      continue;
+    }
+    if (METADATA_KEY_VALUE_REGEX.test(match[1])) {
+      continue;
+    }
+    count += 1;
+  }
+  return count;
+}
+function countSectionMatches(body, headingRegex, lineCounter) {
   const lines = body.split(/\r?\n/);
   let count = 0;
   let inSection = false;
+  let sectionLines = [];
+  const flush = () => {
+    if (sectionLines.length > 0) {
+      count += lineCounter(sectionLines);
+      sectionLines = [];
+    }
+  };
   for (const line of lines) {
     if (headingRegex.test(line)) {
+      flush();
       inSection = true;
       continue;
     }
     if (inSection && /^## /.test(line)) {
+      flush();
       inSection = false;
       continue;
     }
-    if (inSection && lineRegex.test(line)) {
-      count += 1;
+    if (inSection) {
+      sectionLines.push(line);
     }
   }
+  flush();
   return count;
 }
 
@@ -32716,7 +32951,7 @@ var DEFAULT_CLAUDE_HOOKS = {
       hooks: [
         {
           type: "command",
-          command: 'case "${CLAUDE_TOOL_INPUT_path:-}" in *docs/src/content/docs/*) if [ -x .claude/procedures/check-links.sh ]; then bash .claude/procedures/check-links.sh "$CLAUDE_TOOL_INPUT_path" 2>&1 | head -20; fi ;; esac'
+          command: 'case "${CLAUDE_TOOL_INPUT_path:-}" in *docs/src/content/docs/*) if [ -x .claude/procedures/strip-tool-artifact-tags.sh ]; then bash .claude/procedures/strip-tool-artifact-tags.sh "$CLAUDE_TOOL_INPUT_path" >/dev/null 2>&1; fi; if [ -x .claude/procedures/check-links.sh ]; then bash .claude/procedures/check-links.sh "$CLAUDE_TOOL_INPUT_path" 2>&1 | head -20; fi ;; esac'
         }
       ]
     }
@@ -32805,8 +33040,10 @@ var AgentConfig = class _AgentConfig extends import_projen8.Component {
    * `Array.from(new Set(...))`; V8 `Set` iteration preserves insertion
    * order, so the final ordering is defaults first, then bundle, then
    * user, with duplicates removed (first-occurrence wins). `defaultMode`
-   * defaults to `"dontAsk"` unless overridden — see the inline comment
-   * on the literal below for the autonomous-worker rationale.
+   * is opt-in (steering decision D7): it is set only from
+   * `userSettings.defaultMode` and left undefined otherwise, so the
+   * renderer omits the key for un-opted-in consumers — see the inline
+   * comment on the literal below.
    *
    * Hooks merge: consumer-supplied entries first, then default entries
    * (Stop, PostToolUse), deduped by `(matcher, JSON-serialized hooks)`.
@@ -32829,15 +33066,16 @@ var AgentConfig = class _AgentConfig extends import_projen8.Component {
     const userDeny = userSettings?.permissions?.deny ?? [];
     return {
       ...userSettings,
-      // `defaultMode: "dontAsk"` is configulator's hardcoded default
-      // because scheduled-task workers (issue-worker, orchestrator,
-      // pr-reviewer, and the analyst/writer family) run autonomously
-      // and would deadlock on confirmation prompts. Any other value
-      // breaks the autonomous-worker contract — override only after
-      // revisiting that contract end-to-end. The override path for
-      // consumers is `claudeSettings.defaultMode` on
-      // `AgentConfigOptions`.
-      defaultMode: userSettings?.defaultMode ?? "dontAsk",
+      // `defaultMode` is opt-in (steering decision D7): the base
+      // output does NOT set it unless the consumer supplies
+      // `claudeSettings.defaultMode`. When it is undefined the renderer
+      // omits the key entirely, so an un-opted-in consumer's rendered
+      // settings carry no `defaultMode`. Consumers that run autonomous
+      // scheduled-task workers (issue-worker, orchestrator, pr-reviewer,
+      // and the analyst/writer family) — which would deadlock on
+      // confirmation prompts — opt in by setting
+      // `claudeSettings.defaultMode: "dontAsk"`.
+      defaultMode: userSettings?.defaultMode,
       permissions: {
         ...userSettings?.permissions,
         allow: Array.from(
@@ -39758,6 +39996,7 @@ export const collections = {
   renderSkillEvalsRuleContent,
   renderSkillEvalsRunnerScript,
   renderSourceTierExamples,
+  renderStripToolArtifactTagsProcedure,
   renderTemporalFramingCheckerScript,
   renderTemporalFramingRuleContent,
   renderUnblockDependentsScript,
@@ -39794,6 +40033,7 @@ export const collections = {
   slackBundle,
   softwareProfileBundle,
   standardsResearchBundle,
+  stripToolArtifactTagsProcedure,
   tsdocRecordToFindings,
   turborepoBundle,
   typescriptBundle,