@event4u/agent-config 14.17.0 → 14.19.0

package/dist/cli-delegate/{chunk-7RXIKF62.js → chunk-IDHUQIXP.js}

@@ -74,9 +74,9 @@ import {
 // src/scripts/_cli/cmd_doctor.ts
 var YAML2 = __toESM(require_dist(), 1);
 import * as crypto2 from "node:crypto";
-import * as fs14 from "node:fs";
-import * as os3 from "node:os";
-import * as path19 from "node:path";
+import * as fs15 from "node:fs";
+import * as os4 from "node:os";
+import * as path20 from "node:path";
 import process3 from "node:process";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL6 } from "node:url";
 
@@ -2132,8 +2132,8 @@ if (_isCliEntry()) process.exit(main5(process.argv.slice(2)));
 
 // src/scripts/_lib/runtime_wiring_checks.ts
 var import_yaml = __toESM(require_dist(), 1);
-import * as fs10 from "node:fs";
-import * as path14 from "node:path";
+import * as fs11 from "node:fs";
+import * as path15 from "node:path";
 import process2 from "node:process";
 
 // src/scripts/_lib/repo_root.ts
@@ -2152,6 +2152,152 @@ function inheritedGitOverrides(env = process.env) {
   return out;
 }
 
+// src/scripts/_lib/host_permission_checks.ts
+import * as fs10 from "node:fs";
+import * as os from "node:os";
+import * as path14 from "node:path";
+var READ_SHAPED = [
+  "Read",
+  "Glob",
+  "Grep",
+  "LS",
+  "NotebookRead",
+  "Bash(cat",
+  "Bash(ls",
+  "Bash(head",
+  "Bash(tail",
+  "Bash(grep",
+  "Bash(rg",
+  "Bash(find",
+  "Bash(wc",
+  "Bash(git status",
+  "Bash(git log",
+  "Bash(git diff",
+  "Bash(git show"
+];
+var KNOWN_MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];
+function _strings(value) {
+  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+function defaultHostPermissionDeps(projectRoot) {
+  return {
+    projectRoot,
+    homeDir: os.homedir(),
+    readFile: (p) => {
+      try {
+        return fs10.readFileSync(p, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    isDirectory: (p) => {
+      try {
+        return fs10.statSync(p).isDirectory();
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function readSettingsLayers(deps) {
+  const candidates = [
+    ["user-global", path14.join(deps.homeDir, ".claude", "settings.json")],
+    ["project", path14.join(deps.projectRoot, ".claude", "settings.json")],
+    ["project-local", path14.join(deps.projectRoot, ".claude", "settings.local.json")]
+  ];
+  return candidates.map(([label, file]) => {
+    const raw = deps.readFile(file);
+    if (raw === null) {
+      return { label, file, present: false, unreadable: false, permissions: {} };
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      const perms = parsed["permissions"];
+      return {
+        label,
+        file,
+        present: true,
+        unreadable: false,
+        permissions: perms !== null && typeof perms === "object" ? perms : {}
+      };
+    } catch {
+      return { label, file, present: true, unreadable: true, permissions: {} };
+    }
+  });
+}
+function readDenyRules(layers) {
+  const hits = [];
+  for (const layer of layers) {
+    for (const rule of _strings(layer.permissions.deny)) {
+      if (READ_SHAPED.some((prefix) => rule.startsWith(prefix))) {
+        hits.push([layer.label, rule]);
+      }
+    }
+  }
+  return hits;
+}
+function additionalDirectories(layers) {
+  const seen = [];
+  for (const layer of layers) {
+    for (const dir of _strings(layer.permissions.additionalDirectories)) {
+      if (!seen.includes(dir)) seen.push(dir);
+    }
+  }
+  return seen;
+}
+function resolvedDefaultMode(layers) {
+  let winner = null;
+  for (const layer of layers) {
+    const mode = layer.permissions.defaultMode;
+    if (typeof mode === "string" && mode.trim()) winner = mode.trim();
+  }
+  return winner;
+}
+function isLinkedWorktree(deps) {
+  const dotGit = path14.join(deps.projectRoot, ".git");
+  const raw = deps.readFile(dotGit);
+  if (raw === null) return false;
+  return !deps.isDirectory(dotGit) && raw.trimStart().startsWith("gitdir:");
+}
+function permissionSnippet(projectRoot) {
+  return JSON.stringify(
+    { permissions: { additionalDirectories: [projectRoot], defaultMode: "default" } },
+    null,
+    2
+  );
+}
+function checkHostPermissionSettings(deps) {
+  const layers = readSettingsLayers(deps);
+  const unreadable = layers.filter((l) => l.unreadable);
+  const denies = readDenyRules(layers);
+  const dirs = additionalDirectories(layers);
+  const mode = resolvedDefaultMode(layers);
+  const worktree = isLinkedWorktree(deps);
+  const rootListed = dirs.some(
+    (d) => path14.resolve(d) === path14.resolve(deps.projectRoot)
+  );
+  const lines = [];
+  lines.push(
+    denies.length === 0 ? "read-deny rules: absent \u2014 no permissions.deny rule covers a read" : `read-deny rules: ${denies.length} \u2014 ` + denies.map(([layer, rule]) => `${rule} (${layer})`).join(", ")
+  );
+  lines.push(
+    rootListed ? `working tree in additionalDirectories: present (${deps.projectRoot})` : `working tree in additionalDirectories: absent (${deps.projectRoot}${worktree ? ", a linked worktree" : ""})`
+  );
+  lines.push(
+    mode === null ? "permissions.defaultMode: absent \u2014 the host's own built-in default applies" : `permissions.defaultMode: ${mode}` + (KNOWN_MODES.includes(mode) ? "" : " \u2014 not a value this tree has probed")
+  );
+  for (const layer of unreadable) {
+    lines.push(`unreadable: ${layer.file} (${layer.label}) is not valid JSON`);
+  }
+  const reportable = denies.length > 0 || unreadable.length > 0 || worktree && !rootListed;
+  return {
+    id: "host-permission-settings",
+    status: reportable ? "warn" : "ok",
+    message: lines.join("; "),
+    remedy: `agent-config never writes permissions \u2014 paste this into ${path14.join(deps.projectRoot, ".claude", "settings.local.json")} yourself if you want it: ` + permissionSnippet(deps.projectRoot).replace(/\s+/g, " ")
+  };
+}
+
 // src/scripts/_lib/runtime_wiring_checks.ts
 function checkSettingsResolution(iterOverrides) {
   let pairs;
@@ -2182,7 +2328,7 @@ function checkSettingsResolution(iterOverrides) {
   for (const [key, , file] of pairs) winner.set(key, file);
   const byFile = /* @__PURE__ */ new Map();
   for (const file of winner.values()) byFile.set(file, (byFile.get(file) ?? 0) + 1);
-  const summary = [...byFile.entries()].sort((a, b) => b[1] - a[1]).map(([f, n]) => `${path14.basename(f)}=${String(n)}`).join(" \xB7 ");
+  const summary = [...byFile.entries()].sort((a, b) => b[1] - a[1]).map(([f, n]) => `${path15.basename(f)}=${String(n)}`).join(" \xB7 ");
   return {
     id: "settings-resolution",
     status: "ok",
@@ -2191,8 +2337,8 @@ function checkSettingsResolution(iterOverrides) {
   };
 }
 function checkRouterArtifact(repoRoot, rel = "dist/router.json") {
-  const abs = path14.join(repoRoot, rel);
-  if (!fs10.existsSync(abs)) {
+  const abs = path15.join(repoRoot, rel);
+  if (!fs11.existsSync(abs)) {
     return {
       id: "router-artifact",
       status: "warn",
@@ -2202,7 +2348,7 @@ function checkRouterArtifact(repoRoot, rel = "dist/router.json") {
   }
   let doc;
   try {
-    doc = JSON.parse(fs10.readFileSync(abs, "utf8"));
+    doc = JSON.parse(fs11.readFileSync(abs, "utf8"));
   } catch (e) {
     return {
       id: "router-artifact",
@@ -2234,8 +2380,8 @@ function _routerRuleCount(doc) {
   return n;
 }
 function checkHookResolution(repoRoot, manifestRel = "src/scripts/hook_manifest.yaml", probe = null) {
-  const abs = path14.join(repoRoot, manifestRel);
-  if (!fs10.existsSync(abs)) {
+  const abs = path15.join(repoRoot, manifestRel);
+  if (!fs11.existsSync(abs)) {
     return {
       check: {
         id: "hook-resolution",
@@ -2248,7 +2394,7 @@ function checkHookResolution(repoRoot, manifestRel = "src/scripts/hook_manifest.
   }
   let concerns;
   try {
-    const doc = (0, import_yaml.parse)(fs10.readFileSync(abs, "utf8"));
+    const doc = (0, import_yaml.parse)(fs11.readFileSync(abs, "utf8"));
     concerns = doc.concerns ?? {};
   } catch (e) {
     return {
@@ -2264,7 +2410,7 @@ function checkHookResolution(repoRoot, manifestRel = "src/scripts/hook_manifest.
   const probes = [];
   for (const [id, c] of Object.entries(concerns)) {
     const script = typeof c.script === "string" ? c.script : "";
-    const resolves = script !== "" && fs10.existsSync(path14.join(repoRoot, script));
+    const resolves = script !== "" && fs11.existsSync(path15.join(repoRoot, script));
     probes.push({ id, script, resolves, ms: resolves && probe !== null ? probe(script) : null });
   }
   const broken = probes.filter((p) => !p.resolves);
@@ -2308,7 +2454,7 @@ function checkInheritedGitEnv(env = process2.env) {
     remedy: "unset them before running a gate from inside a git hook (`env -u GIT_DIR -u GIT_WORK_TREE \u2026`), or resolve the root with _lib/repo_root.ts, which refuses instead of guessing"
   };
 }
-var WIRING_CHECK_IDS = ["settings-resolution", "router-artifact", "hook-resolution", "inherited-git-env", "hooks-kill-switch"];
+var WIRING_CHECK_IDS = ["settings-resolution", "router-artifact", "hook-resolution", "inherited-git-env", "hooks-kill-switch", "host-permission-settings"];
 function checkHooksDisabled(env = process2.env) {
   const raw = env["AGENT_CONFIG_DISABLE_HOOKS"];
   if (raw !== "1") {
@@ -2335,7 +2481,12 @@ function wiringRunners(opts) {
     // a multi-second one. `probeHookCost` is exported for a caller that wants it.
     "hook-resolution": () => checkHookResolution(opts.packageRoot).check,
     "inherited-git-env": () => checkInheritedGitEnv(),
-    "hooks-kill-switch": () => checkHooksDisabled()
+    "hooks-kill-switch": () => checkHooksDisabled(),
+    // The host's own permission settings, which decide how often a call is
+    // confirmed. It lives with this family rather than its own because
+    // `checkHookWiring` below already reads the same `~/.claude/settings.json`
+    // for the same host — the question is the same surface, one key over.
+    "host-permission-settings": () => checkHostPermissionSettings(defaultHostPermissionDeps(opts.projectRoot))
   };
 }
 function checkHookWiring(deps) {
@@ -2348,11 +2499,11 @@ function checkHookWiring(deps) {
       remedy: ""
     };
   }
-  const settings_path = path14.join(deps.homeDir, ".claude", "settings.json");
+  const settings_path = path15.join(deps.homeDir, ".claude", "settings.json");
   let missing;
   try {
-    const matrix = deps.buildMatrix(path14.join(deps.packageRoot, "src", "scripts", "hook_manifest.yaml"));
-    const settings = fs10.existsSync(settings_path) ? JSON.parse(fs10.readFileSync(settings_path, "utf8")) : {};
+    const matrix = deps.buildMatrix(path15.join(deps.packageRoot, "src", "scripts", "hook_manifest.yaml"));
+    const settings = fs11.existsSync(settings_path) ? JSON.parse(fs11.readFileSync(settings_path, "utf8")) : {};
     const hooks = (settings["hooks"] ?? {}) || {};
     missing = Object.keys(matrix).filter((ev) => {
       const groups = hooks[ev];
@@ -2399,8 +2550,8 @@ function checkHookWiring(deps) {
 }
 
 // src/scripts/_lib/install_reach_checks.ts
-import * as fs11 from "node:fs";
-import * as path15 from "node:path";
+import * as fs12 from "node:fs";
+import * as path16 from "node:path";
 var ROOT_INSTRUCTION_FILES = [
   "AGENTS.md",
   "CLAUDE.md",
@@ -2433,7 +2584,7 @@ function _isAnchored(projectRoot, token) {
   const first = token.split("/")[0];
   if (first === void 0 || first === "" || first === token) return false;
   try {
-    return fs11.statSync(path15.join(projectRoot, first)).isDirectory();
+    return fs12.statSync(path16.join(projectRoot, first)).isDirectory();
   } catch {
     return false;
   }
@@ -2470,19 +2621,19 @@ function classifyNamedPath(projectRoot, entry) {
   if (rel === "") {
     return { ...entry, normalised: null, outcome: "unresolvable", reason: "empty after normalisation" };
   }
-  const abs = path15.join(projectRoot, rel);
-  if (!path15.resolve(abs).startsWith(path15.resolve(projectRoot))) {
+  const abs = path16.join(projectRoot, rel);
+  if (!path16.resolve(abs).startsWith(path16.resolve(projectRoot))) {
     return { ...entry, normalised: rel, outcome: "unresolvable", reason: "escapes the repository root" };
   }
-  return { ...entry, normalised: rel, outcome: fs11.existsSync(abs) ? "present" : "dangling" };
+  return { ...entry, normalised: rel, outcome: fs12.existsSync(abs) ? "present" : "dangling" };
 }
 function resolveInstructionPaths(projectRoot) {
   const out = [];
   for (const rel of ROOT_INSTRUCTION_FILES) {
-    const abs = path15.join(projectRoot, rel);
+    const abs = path16.join(projectRoot, rel);
     let text;
     try {
-      text = fs11.readFileSync(abs, "utf8");
+      text = fs12.readFileSync(abs, "utf8");
     } catch {
       continue;
     }
@@ -2523,7 +2674,7 @@ function checkInstructionPaths(projectRoot) {
   };
 }
 var SETTINGS_PIN_FILES = [
-  { rel: path15.join("agents", "settings", ".agent-settings.yml"), legacy: false },
+  { rel: path16.join("agents", "settings", ".agent-settings.yml"), legacy: false },
   { rel: ".agent-settings.yml", legacy: true },
   { rel: ".agent-project-settings.yml", legacy: true },
   { rel: "agent-settings.yml", legacy: true }
@@ -2535,7 +2686,7 @@ function readVersionPins(projectRoot) {
   for (const { rel, legacy } of SETTINGS_PIN_FILES) {
     let text;
     try {
-      text = fs11.readFileSync(path15.join(projectRoot, rel), "utf8");
+      text = fs12.readFileSync(path16.join(projectRoot, rel), "utf8");
     } catch {
       continue;
     }
@@ -2546,7 +2697,7 @@ function readVersionPins(projectRoot) {
 }
 function readInstalledVersion(projectRoot) {
   try {
-    const text = fs11.readFileSync(path15.join(projectRoot, "agents", "installed-tools.lock"), "utf8");
+    const text = fs12.readFileSync(path16.join(projectRoot, "agents", "installed-tools.lock"), "utf8");
     return LOCK_VERSION_RE.exec(text)?.[1] ?? null;
   } catch {
     return null;
@@ -2573,8 +2724,8 @@ function checkVersionAxis(projectRoot, resolvableNow) {
   };
 }
 var OVERRIDE_LAYERS = [
-  path15.join("agents", "overrides"),
-  path15.join(".agent", "overrides")
+  path16.join("agents", "overrides"),
+  path16.join(".agent", "overrides")
 ];
 var KIND_DIRS = [
   { dir: "rules", kind: "rule" },
@@ -2587,7 +2738,7 @@ function collectOverrideSet(projectRoot) {
     for (const { dir, kind } of KIND_DIRS) {
       let entries;
       try {
-        entries = fs11.readdirSync(path15.join(projectRoot, layer, dir));
+        entries = fs12.readdirSync(path16.join(projectRoot, layer, dir));
       } catch {
         continue;
       }
@@ -2666,14 +2817,14 @@ function checkHumanizerRuntime(which) {
 
 // src/scripts/_lib/environment_detector.ts
 import { spawnSync } from "node:child_process";
-import * as fs12 from "node:fs";
-import * as os from "node:os";
-import * as path16 from "node:path";
+import * as fs13 from "node:fs";
+import * as os2 from "node:os";
+import * as path17 from "node:path";
 
 // src/install/toolDetection.ts
 import { existsSync as existsSync9 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { delimiter, join as join15 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { delimiter, join as join16 } from "node:path";
 var TOOL_SIGNALS = {
   "claude-code": { bins: ["claude"], homePaths: [".claude", ".claude.json", ".config/claude"] },
   "claude-desktop": { absPaths: ["/Applications/Claude.app"], homePaths: ["Library/Application Support/Claude", ".config/Claude"] },
@@ -2718,7 +2869,7 @@ function resolveBinaryPath(name, pathEnv) {
   for (const dir of pathEnv.split(delimiter)) {
     if (dir.length === 0) continue;
     for (const candidate of [name, `${name}.exe`, `${name}.cmd`]) {
-      const full = join15(dir, candidate);
+      const full = join16(dir, candidate);
       if (existsSync9(full)) return full;
     }
   }
@@ -2729,7 +2880,7 @@ function binOnPath(name, pathEnv) {
 }
 function isToolInstalled(signal, home, pathEnv) {
   for (const rel of signal.homePaths ?? []) {
-    if (existsSync9(join15(home, rel))) return true;
+    if (existsSync9(join16(home, rel))) return true;
   }
   for (const abs of signal.absPaths ?? []) {
     if (existsSync9(abs)) return true;
@@ -2740,7 +2891,7 @@ function isToolInstalled(signal, home, pathEnv) {
   return false;
 }
 function detectInstalledTools(opts = {}) {
-  const home = opts.home ?? homedir3();
+  const home = opts.home ?? homedir4();
   const pathEnv = opts.pathEnv ?? process.env["PATH"] ?? "";
   const out = {};
   for (const [id, signal] of Object.entries(TOOL_SIGNALS)) {
@@ -2791,12 +2942,12 @@ function classifyBilling(provider, source) {
 function codexHome(env) {
   const map = env ?? process.env;
   const override = (map["CODEX_HOME"] ?? "").trim();
-  return override !== "" ? override : path16.join(homeOf(env), ".codex");
+  return override !== "" ? override : path17.join(homeOf(env), ".codex");
 }
 function homeOf(env) {
   const map = env ?? process.env;
   const injected = (map["HOME"] ?? "").trim();
-  return injected !== "" ? injected : os.homedir();
+  return injected !== "" ? injected : os2.homedir();
 }
 var VERSION_PROBE_TIMEOUT_MS = 2e3;
 var CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
@@ -2832,14 +2983,14 @@ ${res.stderr ?? ""}`;
 }
 function isFile3(p) {
   try {
-    return fs12.statSync(p).isFile();
+    return fs13.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function exists(p) {
   try {
-    return fs12.existsSync(p);
+    return fs13.existsSync(p);
   } catch {
     return false;
   }
@@ -2847,7 +2998,7 @@ function exists(p) {
 function classifyCodexAuth(authPath) {
   let data;
   try {
-    data = JSON.parse(fs12.readFileSync(authPath, "utf-8"));
+    data = JSON.parse(fs13.readFileSync(authPath, "utf-8"));
   } catch {
     return "cli-api-key";
   }
@@ -2864,7 +3015,7 @@ function cliSubscriptionEvidence(provider, home, env, claudeConfigDir, probeKeyc
   if (provider === "anthropic") {
     const configDir = claudeConfigDir;
     for (const rel of [".credentials.json", "credentials.json"]) {
-      const p = path16.join(configDir, rel);
+      const p = path17.join(configDir, rel);
       if (isFile3(p)) return { source: "cli-subscription", evidence: p };
     }
     if (probeKeychain(CLAUDE_KEYCHAIN_SERVICE)) {
@@ -2873,12 +3024,12 @@ function cliSubscriptionEvidence(provider, home, env, claudeConfigDir, probeKeyc
     return null;
   }
   if (provider === "openai") {
-    const p = path16.join(codexHome(env), "auth.json");
+    const p = path17.join(codexHome(env), "auth.json");
     if (isFile3(p)) return { source: classifyCodexAuth(p), evidence: p };
     return null;
   }
   if (provider === "gemini") {
-    const p = path16.join(home, ".gemini", "oauth_creds.json");
+    const p = path17.join(home, ".gemini", "oauth_creds.json");
     if (isFile3(p)) return { source: "cli-subscription", evidence: p };
     return null;
   }
@@ -2910,7 +3061,7 @@ function detectHosts(opts) {
 function detectAuth(opts) {
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeOf(opts.env);
-  const claudeConfigDir = opts.home === void 0 && opts.env === void 0 ? claude_config_dir() : (env["CLAUDE_CONFIG_DIR"] ?? "").trim() || path16.join(home, ".claude");
+  const claudeConfigDir = opts.home === void 0 && opts.env === void 0 ? claude_config_dir() : (env["CLAUDE_CONFIG_DIR"] ?? "").trim() || path17.join(home, ".claude");
   const probeKeychain = opts.probeKeychain ?? defaultProbeKeychain;
   const auth = [];
   const keys = [];
@@ -2965,7 +3116,7 @@ function detectEnvironment(opts = {}) {
 }
 
 // src/scripts/_cli/detection_report.ts
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 
 // src/scripts/ai_council/transport_resolver.ts
 var VALID_TRANSPORT_MODES = /* @__PURE__ */ new Set([
@@ -3167,7 +3318,7 @@ function cliBinaryPresent(environment, provider, binaryOverride) {
   const expected = PROVIDER_CLI_META[provider]?.[0];
   if (expected === void 0) return false;
   return environment.hosts.some(
-    (h) => h.binary !== null && stripExe(path17.basename(h.binary)) === expected
+    (h) => h.binary !== null && stripExe(path18.basename(h.binary)) === expected
   );
 }
 function stripExe(name) {
@@ -3328,9 +3479,9 @@ function absentCouncilFacts(configPath) {
 
 // src/scripts/ai_team/review_gate.ts
 import * as crypto from "node:crypto";
-import * as fs13 from "node:fs";
-import * as os2 from "node:os";
-import * as path18 from "node:path";
+import * as fs14 from "node:fs";
+import * as os3 from "node:os";
+import * as path19 from "node:path";
 
 // src/scripts/ai_team/config.ts
 var AI_TEAM_REVIEW_GATE_DEFAULTS = Object.freeze({
@@ -3346,16 +3497,16 @@ var AI_TEAM_DEFAULTS = Object.freeze({
 });
 
 // src/scripts/ai_team/review_gate.ts
-var GATE_LEDGER_RELPATH = path18.join("agents", "runtime", "team", "events.log");
+var GATE_LEDGER_RELPATH = path19.join("agents", "runtime", "team", "events.log");
 var _CODEX_PLUGIN_DATA_DIRNAME = `${CODEX_PLUGIN_ID}-${CODEX_MARKETPLACE_NAME}`;
 function _workspace_state_segment(workspace_root) {
   let canonical = workspace_root;
   try {
-    canonical = fs13.realpathSync.native(workspace_root);
+    canonical = fs14.realpathSync.native(workspace_root);
   } catch {
     canonical = workspace_root;
   }
-  const slug_source = path18.basename(workspace_root) || "workspace";
+  const slug_source = path19.basename(workspace_root) || "workspace";
   const slug = slug_source.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "workspace";
   const hash = crypto.createHash("sha256").update(canonical).digest("hex").slice(0, 16);
   return `${slug}-${hash}`;
@@ -3365,19 +3516,19 @@ function upstream_state_dir_candidates(workspace_root) {
   const candidates = [];
   const env = (process.env["CLAUDE_PLUGIN_DATA"] ?? "").trim();
   if (env !== "") {
-    candidates.push(path18.join(env, "state", segment));
+    candidates.push(path19.join(env, "state", segment));
   }
   candidates.push(
-    path18.join(claude_config_dir(), "plugins", "data", _CODEX_PLUGIN_DATA_DIRNAME, "state", segment)
+    path19.join(claude_config_dir(), "plugins", "data", _CODEX_PLUGIN_DATA_DIRNAME, "state", segment)
   );
-  candidates.push(path18.join(os2.tmpdir(), "codex-companion", segment));
+  candidates.push(path19.join(os3.tmpdir(), "codex-companion", segment));
   return candidates;
 }
 function upstream_gate_enabled(workspace_root) {
   for (const dir of upstream_state_dir_candidates(workspace_root)) {
     let parsed;
     try {
-      parsed = JSON.parse(fs13.readFileSync(path18.join(dir, "state.json"), "utf-8"));
+      parsed = JSON.parse(fs14.readFileSync(path19.join(dir, "state.json"), "utf-8"));
     } catch {
       continue;
     }
@@ -3532,15 +3683,15 @@ var ArgparseExit = class extends Error {
   code;
 };
 function expanduser(p) {
-  if (p === "~") return os3.homedir();
+  if (p === "~") return os4.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\")) {
-    return path19.join(os3.homedir(), p.slice(2));
+    return path20.join(os4.homedir(), p.slice(2));
   }
   return p;
 }
 function pathExists(p) {
   try {
-    fs14.statSync(p);
+    fs15.statSync(p);
     return true;
   } catch {
     return false;
@@ -3548,27 +3699,27 @@ function pathExists(p) {
 }
 function isFile4(p) {
   try {
-    return fs14.statSync(p).isFile();
+    return fs15.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir3(p) {
   try {
-    return fs14.statSync(p).isDirectory();
+    return fs15.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function resolvePath(p) {
   try {
-    return fs14.realpathSync(path19.resolve(p));
+    return fs15.realpathSync(path20.resolve(p));
   } catch {
-    return path19.resolve(p);
+    return path20.resolve(p);
   }
 }
 function readText(p) {
-  return fs14.readFileSync(p, "utf-8");
+  return fs15.readFileSync(p, "utf-8");
 }
 function _jsonStrAscii(s) {
   let out = '"';
@@ -3679,7 +3830,7 @@ function _resolve_project_root(arg) {
 }
 var _INSTALL_MODE_MARKER_REL = "agents/.agent-state/install-mode.txt";
 function _detect_install_mode(project_root) {
-  const marker = path19.join(project_root, _INSTALL_MODE_MARKER_REL);
+  const marker = path20.join(project_root, _INSTALL_MODE_MARKER_REL);
   if (isFile4(marker)) {
     let value;
     try {
@@ -3691,9 +3842,9 @@ function _detect_install_mode(project_root) {
       return [value, "marker-file"];
     }
   }
-  const has_agents_md = pathExists(path19.join(project_root, "AGENTS.md"));
+  const has_agents_md = pathExists(path20.join(project_root, "AGENTS.md"));
   const has_copilot = pathExists(
-    path19.join(project_root, ".github", "copilot-instructions.md")
+    path20.join(project_root, ".github", "copilot-instructions.md")
   );
   if (has_agents_md && has_copilot) {
     return ["full", "heuristic"];
@@ -3713,7 +3864,7 @@ function _settings_layer_chain(project_root) {
   return layers;
 }
 function _detect_wrapper(project_root) {
-  const wrapper = path19.join(project_root, "agent-config");
+  const wrapper = path20.join(project_root, "agent-config");
   if (!pathExists(wrapper)) {
     return { path: String(wrapper), exists: false, embedded_root: null };
   }
@@ -3780,14 +3931,14 @@ function _emit_context_text(ctx) {
 }
 function _resolve_path(project_root, raw) {
   let p = expanduser(raw);
-  if (!path19.isAbsolute(p)) {
-    p = path19.join(project_root, p);
+  if (!path20.isAbsolute(p)) {
+    p = path20.join(project_root, p);
   }
   return p;
 }
 function _sha256(p) {
   try {
-    const data = fs14.readFileSync(p);
+    const data = fs15.readFileSync(p);
     return crypto2.createHash("sha256").update(data).digest("hex");
   } catch {
     return null;
@@ -3796,7 +3947,7 @@ function _sha256(p) {
 var PACKAGE_TAG_ID2 = "event4u/agent-config";
 var _FRONTMATTER_PACKAGE_RE = /^package:\s*(.+?)\s*$/m;
 function _read_inline_package_tag(p) {
-  if (path19.extname(p) !== ".md") {
+  if (path20.extname(p) !== ".md") {
     return NO_FRONTMATTER;
   }
   let text;
@@ -3925,13 +4076,13 @@ function rglob(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = fs14.readdirSync(dir, { withFileTypes: true });
+      entries = fs15.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const ent of entries) {
-      const full = path19.join(dir, ent.name);
+      const full = path20.join(dir, ent.name);
       out.push(full);
       let dirLike = ent.isDirectory();
       if (ent.isSymbolicLink()) {
@@ -4006,9 +4157,9 @@ function _foreign_records(project_root, foreign) {
   return out;
 }
 function relativeTo(p, base) {
-  const rel = path19.relative(base, p);
+  const rel = path20.relative(base, p);
   if (rel === "") return rel;
-  if (rel.startsWith("..") || path19.isAbsolute(rel)) {
+  if (rel.startsWith("..") || path20.isAbsolute(rel)) {
     return null;
   }
   return rel;
@@ -4094,7 +4245,7 @@ var STATUS_SYMBOLS = {
 var MIN_PYTHON = [3, 10];
 function _check_scope(project_root) {
   for (const marker of ["pnpm-workspace.yaml", "lerna.json"]) {
-    if (pathExists(path19.join(project_root, marker))) {
+    if (pathExists(path20.join(project_root, marker))) {
       return {
         id: "scope",
         status: "warn",
@@ -4103,7 +4254,7 @@ function _check_scope(project_root) {
       };
     }
   }
-  const pkg = path19.join(project_root, "package.json");
+  const pkg = path20.join(project_root, "package.json");
   if (pathExists(pkg)) {
     try {
       const data = JSON.parse(readText(pkg));
@@ -4129,7 +4280,7 @@ var _PLACEHOLDER_EMAIL_RE = /^(t@t\.t|.*@example\.(com|org)|.*@localhost)$/i;
 var _PLACEHOLDER_NAME_RE = /^(t|test|user|nobody|x)$/i;
 function _git_config_path(project_root) {
   const common = git_common_dir(project_root);
-  return common === null ? null : path19.join(common, "config");
+  return common === null ? null : path20.join(common, "config");
 }
 function _parse_git_user(configText) {
   let inUser = false;
@@ -4159,7 +4310,7 @@ function _check_git_identity(project_root) {
   }
   let ident = _parse_git_user(readText(cfgPath));
   if (ident.name === null && ident.email === null) {
-    const globalCfg = path19.join(os3.homedir(), ".gitconfig");
+    const globalCfg = path20.join(os4.homedir(), ".gitconfig");
     if (pathExists(globalCfg)) {
       ident = _parse_git_user(readText(globalCfg));
     }
@@ -4220,7 +4371,7 @@ function _package_root() {
 }
 function _current_package_version() {
   try {
-    const data = JSON.parse(readText(path19.join(_package_root(), "package.json")));
+    const data = JSON.parse(readText(path20.join(_package_root(), "package.json")));
     const v = data["version"];
     if (typeof v === "string" && v.trim()) {
       return v.trim();
@@ -4264,7 +4415,7 @@ function _check_lockfile_freshness(manifest) {
   };
 }
 function shutilWhich(name) {
-  if (path19.dirname(name) !== "." && (name.includes("/") || name.includes("\\"))) {
+  if (path20.dirname(name) !== "." && (name.includes("/") || name.includes("\\"))) {
     return isExecutableFile(name) ? name : null;
   }
   const pathEnv = process3.env["PATH"] || "";
@@ -4277,12 +4428,12 @@ function shutilWhich(name) {
     if (seenDirs.has(d)) continue;
     seenDirs.add(d);
     for (const ext of exts) {
-      const candidate = path19.join(d, name + (ext === "" ? "" : ext.toLowerCase() === ext ? ext : ext));
+      const candidate = path20.join(d, name + (ext === "" ? "" : ext.toLowerCase() === ext ? ext : ext));
       if (isExecutableFile(candidate)) {
         return candidate;
       }
       if (ext !== "") {
-        const upper = path19.join(d, name + ext);
+        const upper = path20.join(d, name + ext);
         if (isExecutableFile(upper)) return upper;
       }
     }
@@ -4291,10 +4442,10 @@ function shutilWhich(name) {
 }
 function isExecutableFile(p) {
   try {
-    const st = fs14.statSync(p);
+    const st = fs15.statSync(p);
     if (!st.isFile()) return false;
     if (process3.platform === "win32") return true;
-    fs14.accessSync(p, fs14.constants.X_OK);
+    fs15.accessSync(p, fs15.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -4358,7 +4509,7 @@ function _check_claude_plugin() {
       remedy: ""
     };
   }
-  const projection = path19.join(os3.homedir(), ".claude", "skills");
+  const projection = path20.join(os4.homedir(), ".claude", "skills");
   const projection_present = isDir3(projection);
   if (projection_present) {
     return {
@@ -4395,8 +4546,8 @@ function _check_claude_command_wrappers() {
       remedy: ""
     };
   }
-  const anchor = path19.join(os3.homedir(), ".claude");
-  const commands_dir = path19.join(anchor, "commands");
+  const anchor = path20.join(os4.homedir(), ".claude");
+  const commands_dir = path20.join(anchor, "commands");
   if (!isDir3(commands_dir)) {
     return {
       id: "claude-command-wrappers",
@@ -4405,8 +4556,8 @@ function _check_claude_command_wrappers() {
       remedy: ""
     };
   }
-  const flat_probe = fs14.existsSync(path19.join(commands_dir, "commit.md"));
-  const wrapper_probe = fs14.existsSync(path19.join(anchor, "skills", "commit", "SKILL.md"));
+  const flat_probe = fs15.existsSync(path20.join(commands_dir, "commit.md"));
+  const wrapper_probe = fs15.existsSync(path20.join(anchor, "skills", "commit", "SKILL.md"));
   if (wrapper_probe) {
     return {
       id: "claude-command-wrappers",
@@ -4431,7 +4582,7 @@ function _check_claude_command_wrappers() {
   };
 }
 function _check_surface_state() {
-  const matrix_path = path19.join(_package_root(), "src", "config", "surface-matrix.yml");
+  const matrix_path = path20.join(_package_root(), "src", "config", "surface-matrix.yml");
   if (!isFile4(matrix_path)) {
     return {
       id: "surface-state",
@@ -4455,7 +4606,7 @@ function _check_surface_state() {
       remedy: "agent-config upgrade (reinstalls the package data files)"
     };
   }
-  const _expand = (p) => p.startsWith("~/") ? path19.join(os3.homedir(), p.slice(2)) : path19.join(_package_root(), p);
+  const _expand = (p) => p.startsWith("~/") ? path20.join(os4.homedir(), p.slice(2)) : path20.join(_package_root(), p);
   const violations = [];
   const remedies = [];
   let checked = 0;
@@ -4497,7 +4648,7 @@ function _check_surface_state() {
 }
 function pathExistsAny(p) {
   try {
-    fs14.statSync(p);
+    fs15.statSync(p);
     return true;
   } catch {
     return false;
@@ -4507,7 +4658,7 @@ function _check_hook_wiring() {
   return checkHookWiring({
     which: shutilWhich,
     packageRoot: _package_root(),
-    homeDir: os3.homedir(),
+    homeDir: os4.homedir(),
     buildMatrix: (mp) => build_claude_hook_matrix(mp),
     managedSignature: MANAGED_SIGNATURE,
     pluginInstalled: () => claude_plugin_installed()
@@ -4543,7 +4694,7 @@ function _check_mcp_mode(project_root) {
   ];
   const found = [];
   for (const [rel, label] of candidates) {
-    const p = path19.join(project_root, rel);
+    const p = path20.join(project_root, rel);
     if (!pathExists(p)) {
       continue;
     }
@@ -4575,7 +4726,7 @@ function _check_mcp_mode(project_root) {
   };
 }
 function _check_offline_readiness() {
-  const script = path19.join(_package_root(), "src", "scripts", "hermetic-install.sh");
+  const script = path20.join(_package_root(), "src", "scripts", "hermetic-install.sh");
   if (!pathExists(script)) {
     return {
       id: "offline-readiness",
@@ -4633,7 +4784,7 @@ function _check_stale_orphans() {
       (a, b) => a < b ? -1 : a > b ? 1 : 0
     );
     for (const root_name of ownedSorted) {
-      const root = path19.join(anchor, root_name);
+      const root = path20.join(anchor, root_name);
       if (!isDir3(root)) {
         continue;
       }
@@ -4648,7 +4799,7 @@ function _check_stale_orphans() {
         if (rel === null) {
           continue;
         }
-        const relPosix = rel.split(path19.sep).join("/");
+        const relPosix = rel.split(path20.sep).join("/");
         if (recorded_set.has(relPosix)) {
           continue;
         }
@@ -4703,14 +4854,14 @@ function _check_rule_scope_drift(project_root) {
   let rules_dir = null;
   let found = 0;
   for (const rel of _RULE_PROJECTION_DIRS) {
-    const cand = path19.join(project_root, rel);
+    const cand = path20.join(project_root, rel);
     if (!isDir3(cand)) {
       continue;
     }
     let count = 0;
     try {
-      for (const name of fs14.readdirSync(cand)) {
-        if (name.endsWith(".md") && isFile4(path19.join(cand, name))) {
+      for (const name of fs15.readdirSync(cand)) {
+        if (name.endsWith(".md") && isFile4(path20.join(cand, name))) {
           count += 1;
         }
       }
@@ -4764,14 +4915,14 @@ function _check_rule_scope_drift(project_root) {
   };
 }
 function _check_duplicate_scope_rules(project_root, userRulesDirOverride) {
-  const user_rules_dir = userRulesDirOverride ?? path19.join(os3.homedir(), ".claude", "rules");
+  const user_rules_dir = userRulesDirOverride ?? path20.join(os4.homedir(), ".claude", "rules");
   let project_rules_dir = null;
   if (_is_source_repo(project_root)) {
-    const cand = path19.join(project_root, "dist", "agent-src", "rules");
+    const cand = path20.join(project_root, "dist", "agent-src", "rules");
     if (isDir3(cand)) project_rules_dir = cand;
   } else {
     for (const rel of _RULE_PROJECTION_DIRS) {
-      const cand = path19.join(project_root, rel);
+      const cand = path20.join(project_root, rel);
       if (isDir3(cand)) {
         project_rules_dir = cand;
         break;
@@ -4817,7 +4968,7 @@ function _check_mcp_beta_readiness(project_root) {
   }
   const pending = [];
   for (const [gate_id, rel] of MCP_BETA_GATES) {
-    if (!pathExists(path19.join(project_root, rel))) {
+    if (!pathExists(path20.join(project_root, rel))) {
       pending.push(`${gate_id} (${rel})`);
     }
   }
@@ -4838,7 +4989,7 @@ function _check_mcp_beta_readiness(project_root) {
 }
 function _check_tier_usage_readiness(project_root) {
   const settings_file = project_settings_path(project_root);
-  let log_path = path19.join(project_root, ".agent-tier-usage.jsonl");
+  let log_path = path20.join(project_root, ".agent-tier-usage.jsonl");
   let enabled = false;
   if (isFile4(settings_file)) {
     let raw;
@@ -4857,7 +5008,7 @@ function _check_tier_usage_readiness(project_root) {
         const outputRaw = tu["output"];
         const output = typeof outputRaw === "object" && outputRaw !== null && !Array.isArray(outputRaw) ? outputRaw : {};
         if (typeof output["path"] === "string" && output["path"].trim()) {
-          log_path = path19.join(project_root, output["path"].trim());
+          log_path = path20.join(project_root, output["path"].trim());
         }
         const val = tu["enabled"];
         if (typeof val === "boolean") {
@@ -4882,7 +5033,7 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "warn",
-      message: `tier-usage telemetry on but ${path19.basename(log_path)} not yet written \u2014 no signal accumulated`,
+      message: `tier-usage telemetry on but ${path20.basename(log_path)} not yet written \u2014 no signal accumulated`,
       remedy: "run any tracked command to seed the log; the dispatcher writes one record per invocation"
     };
   }
@@ -4897,7 +5048,7 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "fail",
-      message: `cannot read ${path19.basename(log_path)}: ${osErrorStr(exc)}`,
+      message: `cannot read ${path20.basename(log_path)}: ${osErrorStr(exc)}`,
       remedy: "fix permissions on the tier-usage log"
     };
   }
@@ -4928,7 +5079,7 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "fail",
-      message: `${total} record(s) in ${path19.basename(log_path)} but 0 passed the privacy floor \u2014 report would refuse to render`,
+      message: `${total} record(s) in ${path20.basename(log_path)} but 0 passed the privacy floor \u2014 report would refuse to render`,
       remedy: "inspect the log; the dispatcher is writing records the contract forbids (paths, argv, message bodies)"
     };
   }
@@ -4936,19 +5087,19 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "warn",
-      message: `${path19.basename(log_path)} present but empty \u2014 no signal yet`,
+      message: `${path20.basename(log_path)} present but empty \u2014 no signal yet`,
       remedy: "run any tracked command to seed the log"
     };
   }
   return {
     id: "tier-usage-readiness",
     status: "ok",
-    message: `${valid} record(s) past the privacy floor in ${path19.basename(log_path)} \u2014 retiering signal available`,
+    message: `${valid} record(s) past the privacy floor in ${path20.basename(log_path)} \u2014 retiering signal available`,
     remedy: ""
   };
 }
 function readText0(p) {
-  return fs14.readFileSync(p, "utf-8");
+  return fs15.readFileSync(p, "utf-8");
 }
 function osErrorStr(exc) {
   if (exc && typeof exc === "object" && "message" in exc) {
@@ -5121,7 +5272,7 @@ function _epoch_seconds(value) {
 function _codex_auth_expiry(auth_path) {
   let data;
   try {
-    data = JSON.parse(fs14.readFileSync(auth_path, "utf-8"));
+    data = JSON.parse(fs15.readFileSync(auth_path, "utf-8"));
   } catch {
     return null;
   }
@@ -5267,7 +5418,7 @@ function _check_team(project_root) {
   if (binary_missing) {
     remedies.push("install the codex CLI: `npm install -g @openai/codex`");
   }
-  const auth_path = path19.join(_codex_home(), "auth.json");
+  const auth_path = path20.join(_codex_home(), "auth.json");
   const authed = pathExists(auth_path);
   let auth_str;
   if (!authed) {
@@ -5355,7 +5506,7 @@ function _check_unsupported_combos(manifest) {
   };
 }
 function _wizard_state_path() {
-  return path19.join(event4u_root(), "state", "wizard-state.json");
+  return path20.join(event4u_root(), "state", "wizard-state.json");
 }
 function _check_wizard_state() {
   const state_pth = _wizard_state_path();
@@ -5435,7 +5586,7 @@ function _check_wizard_state() {
   };
 }
 function _check_settings_review_pending() {
-  const delta_pth = path19.join(event4u_root(), "state", "settings-delta.json");
+  const delta_pth = path20.join(event4u_root(), "state", "settings-delta.json");
   if (!pathExists(delta_pth)) {
     return {
       id: "settings-review-pending",
@@ -5461,7 +5612,7 @@ function _check_settings_review_pending() {
 }
 function _check_memory_merge_union(project_root) {
   const remedy = "run: npx tsx src/scripts/sync_gitattributes.ts (or `agent-config refresh --project`)";
-  const target = path19.join(project_root, DEFAULT_GITATTRIBUTES);
+  const target = path20.join(project_root, DEFAULT_GITATTRIBUTES);
   if (!pathExists(target)) {
     return {
       id: "memory-merge-union",
@@ -5578,7 +5729,7 @@ function _run_checks(project_root, manifest, drift, only = null) {
     "claude-command-wrappers": _check_claude_command_wrappers,
     "surface-state": _check_surface_state,
     "hook-wiring": _check_hook_wiring,
-    ...wiringRunners({ packageRoot: _package_root(), iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }),
+    ...wiringRunners({ packageRoot: _package_root(), projectRoot: project_root, iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }),
     ...reachRunners({ projectRoot: project_root, resolvableVersion: _current_package_version() }),
     "stale-orphans": _check_stale_orphans,
     overrides: () => _check_overrides(project_root),
@@ -5648,7 +5799,7 @@ function _run_checks_no_manifest(project_root, bridge_present, only = null) {
     "claude-command-wrappers": _check_claude_command_wrappers,
     "surface-state": _check_surface_state,
     "hook-wiring": _check_hook_wiring,
-    ...wiringRunners({ packageRoot: _package_root(), iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }),
+    ...wiringRunners({ packageRoot: _package_root(), projectRoot: project_root, iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }),
     ...reachRunners({ projectRoot: project_root, resolvableVersion: _current_package_version() }),
     "stale-orphans": _check_stale_orphans,
     // BOTH registries need the id. Registering only the first one crashed with
@@ -5926,7 +6077,7 @@ function _run_anatomy(opts) {
   try {
     economyReport = economy.buildReport({
       root: economy.DEFAULT_PROJECTS_ROOT,
-      auditDir: path19.join(process3.cwd(), economy.DEFAULT_AUDIT_DIR),
+      auditDir: path20.join(process3.cwd(), economy.DEFAULT_AUDIT_DIR),
       maxAgeDays: 14
     });
   } catch (err) {
@@ -5965,7 +6116,7 @@ function _run_repair(opts) {
     };
     if (exists2) {
       try {
-        fs14.unlinkSync(state_pth);
+        fs15.unlinkSync(state_pth);
       } catch (exc) {
         payload["action"] = "error";
         payload["error"] = osErrorStr(exc);
@@ -6072,17 +6223,17 @@ function _isCliEntry2() {
     return false;
   }
   if (cliDelegate) {
-    if (path19.basename(process3.argv[1], ".js") === "cmd_doctor") {
+    if (path20.basename(process3.argv[1], ".js") === "cmd_doctor") {
       return true;
     }
   }
-  const argvUrl = pathToFileURL6(path19.resolve(process3.argv[1])).href;
+  const argvUrl = pathToFileURL6(path20.resolve(process3.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs14.realpathSync(fileURLToPath5(import.meta.url));
-    const argv = fs14.realpathSync(path19.resolve(process3.argv[1]));
+    const here = fs15.realpathSync(fileURLToPath5(import.meta.url));
+    const argv = fs15.realpathSync(path20.resolve(process3.argv[1]));
     return here === argv;
   } catch {
     return false;