@event4u/agent-config 14.15.0 → 14.16.0

package/dist/cli-delegate/cmd_conformance.js

@@ -807,20 +807,22 @@ var PHRASES = [
   // "never auto-merge" each returned ["pr-merge"] — a prompt saying DO NOT
   // MERGE authorized a merge. The noun-sense lookahead was never a negator.
   //
-  // The lookBEHIND is line-scoped by `[^.!?\n]` on purpose, the same scoping
-  // `turn_end_gate_hook.ts` uses for its own negation exclusion (`:330`) and
-  // its negated-claim window (`:490-493`). A sentence boundary ends a
-  // negation's reach: "Do not push. Merge PR #12." is two instructions, and a
-  // guard that let the first suppress the second would silently stop
-  // authorizing merges the user DID order — the failure mode that is worse
-  // than the defect, because nothing happens and nothing says why.
-  //
-  // Reusing that vocabulary rather than inventing a third is deliberate: two
+  // The inline negative lookBEHIND that used to live in this pattern was
+  // REMOVED on 2026-09-03, and its own comment is why. It warned that "two
   // negation vocabularies in one tree drift, and the drift is invisible until
-  // a prompt lands in the gap between them.
+  // a prompt lands in the gap between them" — and by then they had drifted:
+  // `negatedBefore` became clause-scanned in both directions while this
+  // lookbehind stayed a blind 30-character window with no forward half. The
+  // prompt that landed in the gap is `"nicht pushen, aber mergen"`, which the
+  // lookbehind refused (13 characters, inside its window, across a contrast
+  // cue it could not see) while the clause scan correctly authorizes it.
+  //
+  // Every phrase match already passes through `negatedBefore` at the call
+  // site, so the guard is not weakened by the removal — it is applied once,
+  // by the one vocabulary this file's comment asked for.
   {
     op: "pr-merge",
-    re: /(?<!\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b[^.!?\n]{0,30})\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i
+    re: /\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i
   },
   // A tag is an ACTION here — bare "Tag" is the German word for day, and
   // "Version" is an ordinary noun. Both authorized a BLOCK op before this.
@@ -942,13 +944,16 @@ function isInterrogative(prose) {
   if (!t) {
     return false;
   }
-  const hasImperative = /\b(mach|mache|bitte|leg|lege|erstell|erstelle|f(ü|ue)hr|f(ü|ue)hre|setz|setze|starte|los|jetzt|go ahead|do it|ja[,.]?\s|ok[,.]?\s)\b/i.test(
+  if (/\?\s*$/.test(t)) {
+    return true;
+  }
+  const hasImperative = /\b(mach|mache|bitte|leg|lege|erstell|erstelle|f(ü|ue)hr|f(ü|ue)hre|setz|setze|starte|los|jetzt|now|asap|go ahead|do it|ja[,.]?\s|ok[,.]?\s)\b/i.test(
     t
   );
   if (hasImperative) {
     return false;
   }
-  return /\?\s*$/.test(t) || /^(was|wie|warum|wieso|weshalb|wann|wer|welche[rs]?|wo|ist|sind|kann|kannst|k(ö|oe)nnen|soll|sollen|darf|d(ü|ue)rfen|why|what|how|when|which|who|is|are|can|could|should|does|do)\b/i.test(
+  return /^(was|wie|warum|wieso|weshalb|wann|wer|welche[rs]?|wo|ist|sind|kann|kannst|k(ö|oe)nnen|soll|sollen|darf|d(ü|ue)rfen|why|what|how|when|which|who|is|are|can|could|should|does|do)\b/i.test(
     t
   );
 }
@@ -995,13 +1000,18 @@ function splitFences(prompt) {
 function _commandLines(fence) {
   return fence.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).filter((l) => !/^(remote:|error:|hint:|fatal:|warning:|To |!\s|\s*\^)/i.test(l)).map((l) => l.replace(/^[$>#]\s*/, "")).filter((l) => /^(git|gh|npm|pnpm|yarn|task)\b/.test(l));
 }
+function _errText(err) {
+  const t = err instanceof Error ? err.message : String(err);
+  return t.replace(/\s+/g, " ").trim().slice(0, 200);
+}
+var PR_NUMBER_MAX = 2147483647;
 function extractMergeTargets(prompt) {
   const out = /* @__PURE__ */ new Set();
-  const re = /(?:#|\bpr[- ]?|\bpull[- ]request\s+#?)(\d{1,7})\b/giu;
+  const re = /(?:#|\bpr[- ]?|\bpull[- ]request\s+#?)(\d{1,10})\b/giu;
   let m;
   while ((m = re.exec(prompt)) !== null) {
     const n = Number.parseInt(m[1], 10);
-    if (Number.isSafeInteger(n) && n > 0) {
+    if (Number.isSafeInteger(n) && n > 0 && n <= PR_NUMBER_MAX) {
       out.add(n);
     }
   }
@@ -1045,27 +1055,109 @@ function foldGrants(prior, prompt, authorized, session_id, now) {
   ];
 }
 var NEGATION_WORD = /\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b/i;
-function negatedBefore(text, index, matched = "") {
+var CONTRAST_CUE = /\b(aber|sondern|jedoch|but|however|instead)\b/gi;
+var ABBREVIATION_BEFORE_DOT = /(?:^|[\s("'\u2018\u201c])(?:[a-z]|z\.b|bzw|ca|usw|d\.h|u\.a|evtl|ggf|inkl|max|min|nr|abb|e\.g|i\.e|etc|vs|approx|fig|no|st|dr|prof)\.$/i;
+function isSentenceBoundary(text, at) {
+  const mark = text[at];
+  if (mark !== ".") {
+    return true;
+  }
+  if (/\d/.test(text[at - 1] ?? "") && /\d/.test(text[at + 1] ?? "")) {
+    return false;
+  }
+  return !ABBREVIATION_BEFORE_DOT.test(text.slice(0, at + 1));
+}
+function sentenceBounds(text, index) {
   let start = 0;
-  for (const mark of [".", "!", "?", "\n"]) {
-    const at = text.lastIndexOf(mark, index - 1);
-    if (at + 1 > start) {
-      start = at + 1;
+  for (let i = index - 1; i >= 0; i -= 1) {
+    const c = text[i];
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      start = i + 1;
+      break;
     }
   }
-  const before = text.slice(Math.max(start, index - 30), index);
-  return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched);
+  let end = text.length;
+  for (let i = index; i < text.length; i += 1) {
+    const c = text[i];
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      end = i;
+      break;
+    }
+  }
+  return { start, end };
+}
+function _sentences(text) {
+  const out = [];
+  let from = 0;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      out.push(text.slice(from, i + 1));
+      from = i + 1;
+    }
+  }
+  if (from < text.length) {
+    out.push(text.slice(from));
+  }
+  return out.filter((t) => t.trim() !== "");
+}
+function clauseStart(text, from, to) {
+  let start = from;
+  const seg = text.slice(from, to);
+  for (let i = seg.length - 1; i >= 0; i -= 1) {
+    const c = seg[i];
+    if (c === "," || c === ";" || c === ":") {
+      start = from + i + 1;
+      break;
+    }
+  }
+  CONTRAST_CUE.lastIndex = 0;
+  let m;
+  while ((m = CONTRAST_CUE.exec(seg)) !== null) {
+    const after = from + m.index + m[0].length;
+    if (after > start) {
+      start = after;
+    }
+  }
+  return start;
+}
+function clauseEnd(text, from, to) {
+  const seg = text.slice(from, to);
+  let end = to;
+  const punct = seg.search(/[,;:]/);
+  if (punct !== -1) {
+    end = from + punct;
+  }
+  CONTRAST_CUE.lastIndex = 0;
+  const m = CONTRAST_CUE.exec(seg);
+  if (m !== null && from + m.index < end) {
+    end = from + m.index;
+  }
+  return end;
+}
+function negatedBefore(text, index, matched = "") {
+  const { start, end } = sentenceBounds(text, index);
+  const before = text.slice(clauseStart(text, start, index), index);
+  const afterFrom = index + matched.length;
+  const after = afterFrom < end ? text.slice(afterFrom, clauseEnd(text, afterFrom, end)) : "";
+  return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched) || NEGATION_WORD.test(after);
 }
 function classifyAuthorization(prompt) {
   const { prose, fences } = splitFences(prompt);
   const authorized = /* @__PURE__ */ new Set();
   const evidence = {};
   const instruction = prose.split("\n").filter((l) => !OUTPUT_LINE.test(l)).join("\n");
-  for (const { op, re } of isInterrogative(instruction) ? [] : PHRASES) {
-    const m = re.exec(instruction);
-    if (m && !negatedBefore(instruction, m.index, m[0])) {
-      authorized.add(op);
-      evidence[op] = `prose: "${m[0]}"`;
+  for (const { op, re } of PHRASES) {
+    for (const sentence of _sentences(instruction)) {
+      if (isInterrogative(sentence)) {
+        continue;
+      }
+      const m = re.exec(sentence);
+      if (m && !negatedBefore(sentence, m.index, m[0])) {
+        authorized.add(op);
+        evidence[op] = `prose: "${m[0]}"`;
+        break;
+      }
     }
   }
   for (const fence of fences) {
@@ -1143,7 +1235,11 @@ function consumeGrantTarget(consumer_root, session_id, target) {
   if (touched) {
     try {
       atomic_write_json(file, decoded);
-    } catch {
+    } catch (err) {
+      process.stderr.write(
+        `git-authorization: grant-consumption write failed (${_errText(err)}) \u2014 the target stays UNSPENT, so one further merge of a PR the user named will still be authorized. Authorization outcome unchanged.
+`
+      );
     }
   }
 }
@@ -1236,7 +1332,11 @@ function run2(stdin_text, options) {
   };
   try {
     atomic_write_json(path2.join(options.consumer_root, ledgerFileFor(session)), ledger);
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `git-authorization: session-ledger write failed (${_errText(err)}) \u2014 the gate degrades to "no ledger" for this session, which denies the irreversible subset and warns on the rest. Authorization outcome unchanged.
+`
+    );
   }
   return EXIT_ALLOW2;
 }
@@ -1300,6 +1400,24 @@ var DESTRUCTIVE_MARKERS = [
   { label: "a route or endpoint was removed", re: /^-.*\b(Route::(get|post|put|patch|delete)|@(Get|Post|Put|Patch|Delete)Mapping|app\.(get|post|put|patch|delete)\s*\()/m },
   { label: "a whole file was deleted", re: /^deleted file mode /m }
 ];
+var SCHEMA_REMOVAL_BODY = /\b(dropColumn|dropTable|dropIfExists|removeColumn|drop_column|drop_table|DROP\s+(TABLE|COLUMN|INDEX|CONSTRAINT)|TRUNCATE\s+TABLE)\b/i;
+var RENAME_METADATA = /^rename (?:from|to) /m;
+function fileBlocks(patch) {
+  return patch.split(/^(?=diff --git )/m).filter((b) => b.startsWith("diff --git "));
+}
+function renamedSchemaRemoval(patch) {
+  for (const block of fileBlocks(patch)) {
+    if (!RENAME_METADATA.test(block)) {
+      continue;
+    }
+    for (const line of block.split("\n")) {
+      if (line.startsWith("-") && !line.startsWith("---") && SCHEMA_REMOVAL_BODY.test(line)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 var MAJOR_BUMP = /^-\s*"version"\s*:\s*"(\d+)\.[^"]*"[\s\S]{0,200}?^\+\s*"version"\s*:\s*"(\d+)\./m;
 function classifyDiff(patch) {
   if (patch.trim() === "") {
@@ -1311,6 +1429,9 @@ function classifyDiff(patch) {
       markers.push(label);
     }
   }
+  if (renamedSchemaRemoval(patch)) {
+    markers.push("a renamed file drops a column or table");
+  }
   const bump = MAJOR_BUMP.exec(patch);
   if (bump && bump[1] !== bump[2]) {
     markers.push(`major version bump ${bump[1]}.x to ${bump[2]}.x`);
@@ -1732,12 +1853,16 @@ function commandOp(command) {
   return found;
 }
 function mergeTargetOf(command) {
-  const gh = /\bgh\s+pr\s+merge\s+(?:-{1,2}\S+\s+)*?(\d{1,7})\b/i.exec(command);
+  const gh = /\bgh\s+pr\s+merge\s+(?:-{1,2}\S+\s+)*?(\d{1,10})\b/i.exec(command);
   if (gh) {
-    return Number.parseInt(gh[1], 10);
+    return _boundedTarget(gh[1]);
   }
-  const api = /\/pulls\/(\d{1,7})\/merge\b/i.exec(command);
-  return api ? Number.parseInt(api[1], 10) : null;
+  const api = /\/pulls\/(\d{1,10})\/merge\b/i.exec(command);
+  return api ? _boundedTarget(api[1]) : null;
+}
+function _boundedTarget(digits) {
+  const n = Number.parseInt(digits, 10);
+  return Number.isSafeInteger(n) && n > 0 && n <= PR_NUMBER_MAX ? n : null;
 }
 function grantCovers(grants, op, target) {
   if (op !== "pr-merge" || target === null) {

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-09-03T13:00:38Z`
+- Generated: `2026-09-04T03:43:39Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -7533,7 +7533,7 @@
     },
     {
       "category": "rule",
-      "checksum": "sha256:4b7bde90e07a74e274fc2c68fdd6afc5862549a8116553f207f907d3fdbe34c4",
+      "checksum": "sha256:ce1cb5a8edb4d7795812ee40d79ad6d65b12d4115c5ad08d405088ceb182b96d",
       "install": {
         "default": true,
         "removable": false
@@ -8159,7 +8159,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:6c28aee3cab7bc6b89e66dcb3e64034d7a3722ab59508715b7fd58d8bc2d6c45",
+      "checksum": "sha256:43e583f67648601be4b58d13b7e37a406a543adae9723d6aeeb0d977b4d5d32b",
       "install": {
         "default": true,
         "removable": false
@@ -10117,7 +10117,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:190b44d9a43e1ab3d556ed0ce5d3a728813762129487105c86dd5084eae24b54",
+      "checksum": "sha256:67b216c8bbadb98f913d974c4b4577b65877b06b17c4c3a42e4ebabbf2c7ab30",
       "install": {
         "default": true,
         "removable": false
@@ -10601,7 +10601,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:a6fa1458478db10bda583b341b2d7bcb361187fb57e3df918109834d04fb5798",
+      "checksum": "sha256:b5fbbb739c3aac24877c314bde4be904f9cd672613f51242ed97b21e84888330",
       "install": {
         "default": true,
         "removable": true
@@ -12983,7 +12983,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:b418af0901b1ca9696cca805079ffa5ff0bf730e9b877497417a8e9b32ca3765",
+      "checksum": "sha256:ed5fd6e152267b152c1a8e0719c8cf9fe3303c4b1662a8eb1e78cb060d18948d",
       "install": {
         "default": false,
         "removable": true
@@ -14760,7 +14760,7 @@
       "workspaces": []
     }
   ],
-  "checksum": "sha256:9aca1f614f7add7d67778fa6a96e9d0f003607832be5cd432d07759474a8d08f",
+  "checksum": "sha256:dd8fabe64f8d77c0d267127d1797192fba713fa8498e4b5883701c84fff20e6e",
   "deprecations": [
     {
       "key": "tier",
@@ -14909,7 +14909,7 @@
       "reason": "scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket"
     }
   ],
-  "generated_at": "2026-09-03T13:00:38Z",
+  "generated_at": "2026-09-04T03:43:39Z",
   "packs": [
     {
       "artefact_count": 128,

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-05ba9a2538875c8dbca0017cbf440896be64d6f737bfca1f5047a6835b75a5ea  discovery-manifest.json
+39bbab4136c262fec6b632f6019ca5269b010e6a49c660c6325014a2e72e304f  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,6 +1,6 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-09-03T13:00:38Z`
+- Generated: `2026-09-04T03:43:39Z`
 - Scanner: `de0a22b4ac4c`
 - Artefacts: **623**
 - Unassigned: **0**

package/dist/discovery/dormancy-report.md

@@ -1,6 +1,6 @@
 # Discovery — Dormancy Report
 
-- Generated: `2026-09-03T13:00:38Z`
+- Generated: `2026-09-04T03:43:39Z`
 - Window: **6 months** without a commit
 
 > Dormancy triggers **review, never auto-deprecation**

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-09-03T13:00:38Z`
+- Generated: `2026-09-04T03:43:39Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:9aca1f614f7add7d67778fa6a96e9d0f003607832be5cd432d07759474a8d08f",
-  "generated_at": "2026-09-03T13:00:38Z",
+  "checksum": "sha256:dd8fabe64f8d77c0d267127d1797192fba713fa8498e4b5883701c84fff20e6e",
+  "generated_at": "2026-09-04T03:43:39Z",
   "packs": [
     {
       "always_on": false,

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-09-03T13:00:38Z`
+- Generated: `2026-09-04T03:43:39Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 

package/dist/discovery/workspaces.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:9aca1f614f7add7d67778fa6a96e9d0f003607832be5cd432d07759474a8d08f",
-  "generated_at": "2026-09-03T13:00:38Z",
+  "checksum": "sha256:dd8fabe64f8d77c0d267127d1797192fba713fa8498e4b5883701c84fff20e6e",
+  "generated_at": "2026-09-04T03:43:39Z",
   "scanner_version": "de0a22b4ac4c",
   "workspaces": [
     {