@event4u/agent-config 14.10.0 → 14.12.0

package/dist/cli-delegate/{chunk-77GR3VD4.js → chunk-FF7WAFMR.js}

@@ -150,6 +150,61 @@ function hardenedSpawnEnv(overrides = {}) {
   return out;
 }
 
+// src/scripts/ai_council/cli_agency_bounds.ts
+var AGENCY_BOUNDS = [
+  {
+    member: "anthropic",
+    binary: "claude",
+    bound: ["--tools", ""],
+    // Omission IS the control here, and it is verified rather than assumed:
+    // the control arm created the sentinel on 2026-08-23, so the default
+    // genuinely grants the write capability.
+    control: [],
+    probed_version: "2.1.241 (Claude Code)",
+    probed_on: "2026-08-23",
+    rationale: '`claude` grants its full built-in tool set by default; `""` is the documented "disable all tools" value. Predates this module \u2014 added after a live context-window overflow rather than a security pass, which is why the canary exists at all.'
+  },
+  {
+    member: "openai",
+    binary: "codex",
+    bound: ["--sandbox", "read-only"],
+    control: ["--sandbox", "workspace-write"],
+    probed_version: "codex-cli 0.148.0",
+    probed_on: "2026-08-23",
+    rationale: "`codex exec --help` documents `-s, --sandbox <SANDBOX_MODE>` with `read-only`, `workspace-write`, `danger-full-access`. It sits BESIDE `--skip-git-repo-check`, never instead of it: the trust gate is what makes a worktree usable at all, the sandbox bounds what the session may then do, and before this the argv carried the guard REMOVAL with no counterpart. Control is `workspace-write`, the smallest documented step up \u2014 never `danger-full-access`."
+  },
+  {
+    member: "gemini",
+    binary: "gemini",
+    bound: ["--approval-mode", "plan"],
+    control: ["--approval-mode", "auto_edit"],
+    probed_version: "0.50.0",
+    probed_on: "2026-08-23",
+    rationale: "`gemini --help` lists `plan (read-only mode)`. NOT `--allowed-tools`, which the same help marks `DEPRECATED: Use Policy Engine instead` \u2014 pinning to it would bind the council to a surface the vendor is retiring. The siblings move the wrong way: `-y/--yolo` auto-accepts every action, `auto_edit` auto-approves edit tools, which is exactly why `auto_edit` is the control and not the bound."
+  },
+  {
+    member: "xai",
+    binary: "grok",
+    bound: [],
+    control: [],
+    probed_version: null,
+    probed_on: null,
+    rationale: "not-probed \u2014 binary absent on the probing machine. No flag is guessed: a member whose bound was never determined must not be rendered as bounded."
+  },
+  {
+    member: "perplexity",
+    binary: "perplexity",
+    bound: [],
+    control: [],
+    probed_version: null,
+    probed_on: null,
+    rationale: "not-probed \u2014 binary absent on the probing machine. Same refusal to guess as `xai`."
+  }
+];
+function boundFor(member) {
+  return AGENCY_BOUNDS.find((b) => b.member === member)?.bound ?? [];
+}
+
 // src/scripts/_lib/session_role.ts
 var SESSION_ROLE_ENV = "AGENT_CONFIG_SESSION_ROLE";
 var KNOWN_ROLES = /* @__PURE__ */ new Set(["orchestrator", "worker", "reviewer"]);
@@ -432,7 +487,7 @@ function isEnvKillSwitchActive(name) {
 var SOLO_FLOOR_MIN_PRESENT = 2;
 
 // src/scripts/ai_council/events_log.ts
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 5;
 var _VALID_ACTIONS = /* @__PURE__ */ new Set([
   "proceed",
   "skip_necessity",
@@ -1807,7 +1862,7 @@ var OpenAICliClient = class extends CliClient {
     void user_prompt;
     void max_tokens;
     const modelArgs = this.model === OPENAI_CLI_VENDOR_DEFAULT ? [] : ["--model", this.model];
-    return [this.binary, "exec", "--json", "--skip-git-repo-check", ...modelArgs, "-"];
+    return [this.binary, "exec", "--json", "--skip-git-repo-check", ...boundFor("openai"), ...modelArgs, "-"];
   }
   /**
    * Refuse a pin this estate has measured the transport rejecting.
@@ -1976,7 +2031,7 @@ var GeminiCliClient = class extends CliClient {
     void system_prompt;
     void user_prompt;
     void max_tokens;
-    return [this.binary, "--output-format", "json", "--model", this.model];
+    return [this.binary, "--output-format", "json", ...boundFor("gemini"), "--model", this.model];
   }
   /**
    * One payload on stdin, same shape and same reason as the codex adapter:

package/dist/cli-delegate/{chunk-YM4GZDJG.js → chunk-JCW7ZLHK.js}

@@ -4535,6 +4535,11 @@ var settingsSchema = external_exports.object({
         "PreToolUse anti-slop nudge (road-to-anti-slop-detector Phase 3). Default off. When on, runs the lint_design_slop registry against about-to-be-written UI content and WARNS (never blocks) on P0/P1 aesthetic tells (side-stripe, gradient-text, magic z-index, \u2026). Flags are rebuttable via DESIGN.md / design-slop-disable. Anti-loop: a file::rule signature surfaced 3x goes silent. Host-limited convenience layer; the universal gate is the lint_design_slop linter/CI."
       )
     }).default({}),
+    design_pass: external_exports.object({
+      enabled: external_exports.boolean().default(false).describe(
+        "PostToolUse + stop design pass (road-to-frontend-power E1.1/E1.2/E1.3). Default off. One concern on two slots: on post_tool_use a write to a UI surface delivers the design findings as context and never blocks; on stop the same pass runs over every UI file touched this session, deduped against what the post pass surfaced, and a P0 objective floor (contrast, font size, heading skip, focus) blocks with a continuation. P1-P3 never block. post_tool_use rather than pre_tool_use for two measured reasons: pre_tool_use is declared by three hosts and honoured by one while post_tool_use is declared by six, and _lib/ui_surface.ts is a path predicate, so a pre-write gate cannot fire on the first write of a new surface. A pass that could not fully run reports verification: degraded with a reason rather than passing silently. Does not replace design_slop: two design keys is the honest state until the tiering experiment has a number."
+      )
+    }).default({}),
     ui_route_nudge: external_exports.object({
       enabled: external_exports.boolean().default(false).describe(
         "PreToolUse UI-route nudge (road-to-frontend-skill-application Phase 4). Default off. When on, a Write/Edit to a UI surface with no design consultation latched this session WARNS (never blocks) naming the route \u2014 run existing-ui-audit, then the fe-design loop. A read or search touching fe-design / existing-ui-audit / design-review / design-intelligence latches consultation and silences it for the session. Anti-loop: at most 2 nudges per session. It does not read the rules: the UI-surface decision comes from _lib/ui_surface.ts and no code parses rule frontmatter, so this runs parallel to the two UI rules rather than consuming their triggers, and a test keeps the sets from drifting. It is a nudge, so their enforced_by: none stays accurate."
@@ -4544,6 +4549,11 @@ var settingsSchema = external_exports.object({
       enabled: external_exports.boolean().default(false).describe(
         "PreToolUse code-graph nudge (ADR-124 Phase 4). Default off. When on AND a native code-graph cache or a consumer-shipped graph.json/SCIP index is present, warns once per session (never blocks) as the agent is about to Grep/Glob or Read a source file \u2014 query the graph first for who-calls/where-used/impact questions (or rebuild if stale, build if absent). Source G\u2019s strict block-first-read mode is deliberately un-ported."
       )
+    }).default({}),
+    suggestion_capture: external_exports.object({
+      enabled: external_exports.boolean().default(false).describe(
+        'Suggestion-block capture (road-to-suggestion-block-capture Phase 2). Default off. Two slots: `stop` reads `last_assistant_message` \u2014 a payload field, so no transcript file is read \u2014 and latches that the assistant turn carried a numbered-options block; `user_prompt_submit` CONSUMES that latch and classifies the answering turn as option_n / as_is / other / stale_block. Consume-once is the correctness guard: the latch is deleted on read, so a bare "1" three turns later meets no latch and classifies `other`, and a latch past its TTL or unparseable is `stale_block` rather than a guess. Writes COUNTS ONLY to agents/runtime/state/audit/suggestion-capture.jsonl \u2014 the record type has no field able to hold a prompt, an option label or a command name, and a test asserts the written key set against src/config/suggestion-capture.json. Off by default because this is an INSTRUMENT rather than a feature: it exists so a capture rate can be measured on a maintainer workspace over a fixed soak window, and there is nothing in it for a consumer to gain.'
+      )
     }).default({})
     // `turn_end_gate` is deliberately ABSENT. The stop-slot turn-end gate is
     // always armed (2026-08-12) and has no settings surface: whether it