@event4u/agent-config 14.18.0 → 14.20.0

package/dist/cli-delegate/cmd_conformance.js

@@ -2,20 +2,21 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 import {
   deriveSessionKey,
   foldRefusal,
-  parseRecord,
-  readInstallBoundary,
-  sessionRefusalFile
-} from "./chunk-2GNWGMAL.js";
-import {
   isCiPoll,
   isVacuousOutput,
+  parseRecord,
   pendingCount,
+  readInstallBoundary,
+  sessionRefusalFile,
   statePathFor,
   validateAssumption
-} from "./chunk-7PRE6ZV2.js";
+} from "./chunk-YS6XTLEK.js";
 import {
   readHookStdin
 } from "./chunk-F7DQWYR5.js";
+import {
+  reportScanned
+} from "./chunk-I3EIN2YG.js";
 import {
   ArgparseExit,
   STATUS_SYMBOLS,
@@ -33,7 +34,7 @@ import {
   frontmatterPaths,
   proseEqual,
   splitFrontmatter
-} from "./chunk-7RXIKF62.js";
+} from "./chunk-NUMQHLS5.js";
 import "./chunk-FTAISGDQ.js";
 import "./chunk-M2DPGFZ4.js";
 import "./chunk-BTWUYDGN.js";
@@ -57,8 +58,9 @@ import {
 import {
   atomicAppendLine,
   manifest_path,
+  probeHostCapabilities,
   read_manifest
-} from "./chunk-PMEKGDED.js";
+} from "./chunk-PI2GU3DP.js";
 import "./chunk-MWRD5YOH.js";
 import "./chunk-T7L2QK3K.js";
 import "./chunk-DMSZHXZS.js";
@@ -81,7 +83,7 @@ var YAML = __toESM(require_dist(), 1);
 import * as fs13 from "node:fs";
 import * as os7 from "node:os";
 import * as path13 from "node:path";
-import process6 from "node:process";
+import process5 from "node:process";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL13 } from "node:url";
 
@@ -147,7 +149,7 @@ function routeTargetPathsPosix(target) {
 import * as fs12 from "node:fs";
 import * as os6 from "node:os";
 import * as path12 from "node:path";
-import process5 from "node:process";
+import process4 from "node:process";
 import { fileURLToPath as fileURLToPath12, pathToFileURL as pathToFileURL12 } from "node:url";
 
 // src/scripts/conformance_scan.ts
@@ -739,6 +741,128 @@ function humanTypedThisTurn(prompt) {
   return true;
 }
 
+// src/scripts/_lib/consequence_objects.ts
+var CONSEQUENCE_PHRASES = [
+  {
+    op: "prod-deploy",
+    re: /(?<![A-Za-z0-9_À-ɏ])(deploy(e|en|t|st)?|ausroll(e|en)?|ship(pe|pen)?|live\s*schalt(e|en)?|rollout)\b[^.\n]{0,30}\b(produktion|production|prod|live|prod-umgebung)\b|\b(produktion|production|prod|live)\b[^.\n]{0,30}\b(deploy(e|en)?|ausrollen|ausroll(e|en)?|live\s*schalten|rollout)\b/i
+  },
+  {
+    op: "prod-data-destroy",
+    re: /(?<![A-Za-z0-9_À-ɏ])(l(ö|oe)sch(e|en)?|entfern(e|en)?|leer(e|en)?|verwerf(e|en)?|drop|truncate|delete|wipe|purge|zerst(ö|oe)r(e|en)?)\b[^.\n]{0,40}\b(tabelle|tabellen|datenbank|daten|bucket|collection|zeilen|rows|table|database|dataset)\b|\b(tabelle|tabellen|datenbank|daten|bucket|collection|table|database)\b[^.\n]{0,40}\b(l(ö|oe)schen|leeren|verwerfen|droppen|truncaten|entfernen|drop|truncate|delete|wipe|purge)\b/i
+  },
+  {
+    op: "prod-infra-change",
+    re: /(?<![A-Za-z0-9_À-ɏ])((ver)?(ä|ae)nder(e|n)?|anpass(e|en)?|umbau(e|en)?|apply|destroy|(neu\s*)?provisionier(e|en)?)\b[^.\n]{0,40}\b(infrastruktur|infrastructure|cluster|terraform|iam|dns|netzwerk|network|firewall|policy|policies|security[-\s]group)\b|\b(infrastruktur|infrastructure|cluster|terraform|iam|dns|netzwerk|firewall)\b[^.\n]{0,40}\b((ver)?(ä|ae)ndern|anpassen|umbauen|zerst(ö|oe)ren|apply|destroy)\b/i
+  },
+  {
+    op: "external-send",
+    re: /(?<![A-Za-z0-9_À-ɏ])(schick(e|en)?|verschick(e|en)?|send(e|en|et)?|mail(e|en)?|raussend(e|en)?|versend(e|en)?|post|publish)\b[^.\n]{0,40}\b(mail|mails|email|e-mail|nachricht|nachrichten|newsletter|webhook|kunden|kundin|kunde|empf(ä|ae)nger|customers?|recipients?|message)\b|\b(mail|email|e-mail|nachricht|newsletter|kunden|customers?)\b[^.\n]{0,40}\b(schicken|verschicken|senden|versenden|rausschicken|send|deliver)\b/i
+  },
+  {
+    op: "money-movement",
+    re: /(?<![A-Za-z0-9_À-ɏ])(erstatt(e|en)?|r(ü|ue)ckerstatt(e|en)?|zahl(e|en)?|(ü|ue)berweis(e|en)?|abbuch(e|en)?|belast(e|en)?|refund|charge|payout|transfer|bill)\b[^.\n]{0,40}\b(betrag|geld|rechnung|zahlung|euro|dollar|kunde|kunden|karte|konto|invoice|payment|customer|card|account)\b|\b(betrag|geld|rechnung|zahlung|invoice|payment)\b[^.\n]{0,40}\b(erstatten|zur(ü|ue)ckzahlen|(ü|ue)berweisen|abbuchen|belasten|refund|charge|transfer)\b/i
+  },
+  {
+    op: "trunk-force-push",
+    re: /(?<![A-Za-z0-9_À-ɏ])(force[-\s]?push(e|en|t)?|force[-\s]?pushen|(ü|ue)berschreib(e|en)?)\b[^.\n]{0,40}\b(main|master|trunk|produktions?[-\s]?branch|production|release[-\s]?branch)\b|\b(main|master|trunk|production)\b[^.\n]{0,40}\b(force[-\s]?pushen|force[-\s]?push|(ü|ue)berschreiben)\b/i
+  },
+  {
+    op: "out-of-scope-destruction",
+    re: /(?<![A-Za-z0-9_À-ɏ])(l(ö|oe)sch(e|en)?|entfern(e|en)?|r(ä|ae)um(e|en)?\s*auf|aufr(ä|ae)um(e|en)?|delete|remove|wipe)\b[^.\n]{0,40}\b(au(ß|ss)erhalb|ausserhalb|unabh(ä|ae)ngig|nicht\s+zur\s+aufgabe|outside\s+(the\s+)?(task|scope)|unrelated|everything\s+else|alles\s+andere)\b|\b(au(ß|ss)erhalb|outside\s+(the\s+)?(task|scope)|unrelated)\b[^.\n]{0,40}\b(l(ö|oe)schen|entfernen|aufr(ä|ae)umen|delete|remove|wipe)\b/i
+  }
+];
+var OBJECT_REQUIRED_OPS = /* @__PURE__ */ new Set([
+  "prod-data-destroy",
+  "external-send",
+  "money-movement"
+]);
+var OBJECT_STOP_WORDS = /* @__PURE__ */ new Set([
+  "bitte",
+  "doch",
+  "mal",
+  "nicht",
+  "jetzt",
+  "gleich",
+  "auch",
+  "noch",
+  "wieder",
+  "in",
+  "im",
+  "aus",
+  "von",
+  "vom",
+  ": ",
+  "der",
+  "die",
+  "das",
+  "den",
+  "dem",
+  "und",
+  "oder",
+  "mit",
+  "auf",
+  "zu",
+  "komplett",
+  "ganz",
+  "alle",
+  "allen",
+  "please",
+  "now",
+  "again",
+  "too",
+  "also",
+  "from",
+  "and",
+  "or",
+  "the",
+  "a",
+  "an",
+  "there",
+  "here",
+  "completely",
+  "all",
+  "with",
+  "on",
+  "to",
+  "in"
+]);
+function _normalizeObject(raw) {
+  return raw.trim().replace(/^["'`]+|["'`]+$/g, "").replace(/[.,;:]+$/, "").toLowerCase();
+}
+var OBJECT_PATTERNS = {
+  "prod-data-destroy": [
+    /\b(?:tabelle|table|datenbank|database|schema|collection|index)\s+["'`]?([A-Za-z_][\w.$-]*)/gi,
+    /\bs3:\/\/([\w.-]+)/gi,
+    /\b(?:bucket)\s+["'`]?([A-Za-z_][\w.-]*)/gi
+  ],
+  "external-send": [
+    /([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/g,
+    /\bhttps?:\/\/([^\s/"'`]+)/gi,
+    /\b(?:an\s+(?:die|den|alle)|to\s+(?:the|all))\s+([A-Za-z][\w-]*)/gi
+  ],
+  "money-movement": [
+    /(\d[\d.,]*)\s*(?:€|eur\b|euro\b|\$|usd\b)/gi,
+    /(?:€|\$)\s*(\d[\d.,]*)/g,
+    /\b(?:kunde|kunden|customer|account|konto)\s+["'`]?([A-Za-z0-9][\w.-]*)/gi
+  ]
+};
+function extractObjects(op, text) {
+  const patterns = OBJECT_PATTERNS[op];
+  if (!patterns) return [];
+  const out = [];
+  for (const re of patterns) {
+    const local = new RegExp(re.source, re.flags.includes("g") ? re.flags : `${re.flags}g`);
+    let m;
+    while ((m = local.exec(text)) !== null) {
+      const value = _normalizeObject(m[1] ?? "");
+      if (value && !OBJECT_STOP_WORDS.has(value) && !out.includes(value)) out.push(value);
+      if (m.index === local.lastIndex) local.lastIndex++;
+    }
+  }
+  return out;
+}
+
 // src/scripts/git_authorization_hook.ts
 var EXIT_ALLOW2 = 0;
 var STATE_FILE2 = path2.join("agents", "state", "git-authorization.json");
@@ -790,7 +914,14 @@ var ALL_OPS = [
   "clean",
   "stash-drop",
   "branch-delete",
-  "close"
+  "close",
+  "prod-deploy",
+  "prod-data-destroy",
+  "prod-infra-change",
+  "external-send",
+  "money-movement",
+  "trunk-force-push",
+  "out-of-scope-destruction"
 ];
 var PHRASES = [
   { op: "commit", re: /\b(commit(e|et|te|ten)?|committe|einchecken)\b/i },
@@ -948,7 +1079,8 @@ var PHRASES = [
   {
     op: "pr-merge-auto",
     re: /\bauto[-\s]?merge\b|\bmerge\b[^.\n]{0,20}\bautomatisch\b|\bautomatisch\b[^.\n]{0,20}\bmerg(e|en)\b/i
-  }
+  },
+  ...CONSEQUENCE_PHRASES
 ];
 var OUTPUT_LINE = /^\s*(To\s+\S+|remote:|error:|fatal:|hint:|warning:|!\s|\?\?\s|\s*\^|[-+]{3}\s|@@\s|\$\s|>\s|\d+\s+(pass|fail)|npm ERR!|Error:|Traceback|at\s+\S+:\d+)/i;
 function isInterrogative(prose) {
@@ -1317,6 +1449,11 @@ function run2(stdin_text, options) {
     authorized.push(pending.op);
     evidence[pending.op] = `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): "${prompt.trim().slice(0, 40)}"`;
   }
+  const objects = {};
+  for (const op of authorized) {
+    const named = extractObjects(op, prompt);
+    if (named.length > 0) objects[op] = named;
+  }
   const now = /* @__PURE__ */ new Date();
   const ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
@@ -1324,6 +1461,7 @@ function run2(stdin_text, options) {
     authorized,
     evidence,
     prompt_chars: prompt.length,
+    objects,
     // Grants survive this write; `authorized` does not. That asymmetry IS the
     // decision. A bare operation name stays one-shot exactly as `commit-policy`
     // requires, and only an authorization that also froze its objects earns a
@@ -1415,10 +1553,26 @@ var BLOCK_OPS = /* @__PURE__ */ new Set([
   /** Destroys uncommitted work belonging to a session this one cannot see. */
   "worktree-remove",
   /** `-x` is the flag that takes `.env` and local certificates. */
-  "clean-ignored"
+  "clean-ignored",
+  // ── The consequence vocabulary, added 2026-09-06. Every one is already
+  // never-autonomous in the `non-destructive-by-default` prose.
+  //
+  // MEMBERSHIP HERE IS A COUNTING DECISION, NOT A REFUSAL. The set's name
+  // predates ADR-254, which deleted the reader that blocked: the one consumer
+  // that acts on it now is `conformance_scan`'s after-the-fact tally, so
+  // "blocked" describes what the Hard Floor requires of the model, never what
+  // this package does at tool-call time.
+  "prod-deploy",
+  "prod-data-destroy",
+  "prod-infra-change",
+  "external-send",
+  "money-movement",
+  "trunk-force-push",
+  "out-of-scope-destruction"
 ]);
 var G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
 var P = "^(?:\\S*\\/)?";
+var CONSEQUENCE_TOOL_HEAD = /^(?:\S*\/)?(terraform|pulumi|kubectl|helm|aws|gcloud|az|vercel|netlify|flyctl|fly|wrangler|serverless|sls|eb|heroku|cap|psql|mysql|mariadb|sqlite3|mongosh|mongo|redis-cli|sendmail|msmtp|mail|mailx|curl|stripe|braintree|paypal|rm)\b/i;
 function ghApiWrite(pathRe) {
   return new RegExp(
     `${P}gh\\s+api\\b(?=[^\\n]*${pathRe})(?=[^\\n]*(?:-X|--method)\\s+(?:POST|PATCH|PUT|DELETE)\\b)`,
@@ -1499,6 +1653,13 @@ var COMMAND_OPS = [
   // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
   // "safe force" is in the same class here because what it is safe against is a
   // stale local view, not a collaborator who pushed after your fetch.
+  {
+    op: "trunk-force-push",
+    re: new RegExp(
+      `${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)[^\\n;|&]*\\b(main|master|trunk|production|prod)\\b`,
+      "i"
+    )
+  },
   {
     op: "force-push",
     re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i")
@@ -1527,6 +1688,60 @@ var COMMAND_OPS = [
     )
   },
   { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
+  // ── Consequence operations, added 2026-09-06
+  // (`road-to-authorization-that-reaches-further` 2.1).
+  //
+  // ORDER: above the generic `push`/`commit` fallbacks, because
+  // `trunk-force-push` is a `git push` and the most specific pattern must win —
+  // the rule this table states at its head.
+  //
+  // These classify commands the count could not see before. They add NOTHING to
+  // any refusal path: `commandOp` and `BLOCK_OPS` have exactly one consumer
+  // that acts on them, the after-the-fact tally in `conformance_scan`, and this
+  // change does not add a second.
+  {
+    op: "prod-data-destroy",
+    re: new RegExp(
+      `${P}(psql|mysql|mariadb|sqlite3|mongosh?)\\b[^\\n]*\\b(drop\\s+(table|database|schema)|truncate|delete\\s+from)\\b|${P}aws\\s+s3\\s+(rm|rb)\\b|${P}aws\\s+(dynamodb|rds)\\s+delete-\\S+|${P}redis-cli\\b[^\\n]*\\bflush(all|db)\\b`,
+      "i"
+    )
+  },
+  {
+    op: "prod-infra-change",
+    re: new RegExp(
+      `${P}terraform\\s+(apply|destroy)\\b|${P}pulumi\\s+(up|destroy)\\b|${P}kubectl\\s+(apply|delete|scale|drain)\\b|${P}helm\\s+(install|upgrade|uninstall|rollback)\\b|${P}aws\\s+(iam|ec2|route53|elbv2)\\s+(create|delete|put|update|modify|attach|detach)-\\S+|${P}(gcloud|az)\\s+\\S+\\s+(create|delete|update)\\b`,
+      "i"
+    )
+  },
+  {
+    op: "prod-deploy",
+    re: new RegExp(
+      `${P}(vercel|netlify|flyctl|fly|wrangler|serverless|sls|eb|heroku)\\s+${G}deploy\\b|${P}(vercel|netlify)\\b[^\\n]*--prod\\b|${P}(npm|pnpm|yarn)\\s+run\\s+deploy\\b|${P}cap\\s+production\\s+deploy\\b`,
+      "i"
+    )
+  },
+  {
+    op: "external-send",
+    re: new RegExp(
+      `${P}(sendmail|msmtp|mailx?)\\b|${P}curl\\b(?=[^\\n]*(?:-X|--request)\\s+(?:POST|PUT|PATCH)\\b)(?=[^\\n]*https?:\\/\\/)`,
+      "i"
+    )
+  },
+  {
+    op: "money-movement",
+    re: new RegExp(
+      `${P}(stripe|braintree|paypal)\\s+\\S*(charge|refund|payout|transfer|payment)\\S*\\b`,
+      "i"
+    )
+  },
+  {
+    // `rm -rf` on an ABSOLUTE path or a home-relative one. Deliberately not
+    // "outside the working tree" — this function receives a command string and
+    // no cwd, so that reading is not decidable here and a classifier that
+    // guesses is worse than one that under-reports.
+    op: "out-of-scope-destruction",
+    re: new RegExp(`${P}rm\\s+(-\\S+\\s+)*-\\S*[rR]\\S*\\s+(-\\S+\\s+)*(~|/)\\S*`, "i")
+  },
   { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
   { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
   { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") }
@@ -1677,7 +1892,7 @@ function invokedSegments(command, depth = 0) {
 function commandOp(command) {
   let found = null;
   for (const seg of invokedSegments(command)) {
-    if (!/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg)) {
+    if (!/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg) && !CONSEQUENCE_TOOL_HEAD.test(seg)) {
       continue;
     }
     for (const { op, re } of COMMAND_OPS) {
@@ -1692,6 +1907,37 @@ function commandOp(command) {
   }
   return found;
 }
+function commandObject(op, command) {
+  const patterns = COMMAND_OBJECTS[op];
+  if (!patterns) return null;
+  for (const re of patterns) {
+    const m = new RegExp(re.source, re.flags.replace("g", "")).exec(command);
+    const raw = m?.[1];
+    if (raw) {
+      const value = raw.trim().replace(/^["'`]+|["'`]+$/g, "").replace(/[.,;:]+$/, "").toLowerCase();
+      if (value) return value;
+    }
+  }
+  return null;
+}
+var COMMAND_OBJECTS = {
+  "prod-data-destroy": [
+    /\bdrop\s+(?:table|database|schema|collection)\s+(?:if\s+exists\s+)?["'`]?([\w.$-]+)/i,
+    /\btruncate\s+(?:table\s+)?["'`]?([\w.$-]+)/i,
+    /\bdelete\s+from\s+["'`]?([\w.$-]+)/i,
+    /\bs3:\/\/([\w.-]+)/i,
+    /--table-name[= ]["'`]?([\w.-]+)/i
+  ],
+  "external-send": [
+    /\bhttps?:\/\/([^\s/"'`]+)/i,
+    /([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/
+  ],
+  "money-movement": [
+    /--customer[= ]["'`]?([\w.-]+)/i,
+    /--amount[= ]["'`]?([\d.,]+)/i,
+    /\b(\d[\d.,]*)\s*(?:eur|usd)\b/i
+  ]
+};
 
 // src/scripts/hooks/turn_end_gate_hook.ts
 import * as fs5 from "node:fs";
@@ -1706,6 +1952,19 @@ import * as os from "node:os";
 import * as path3 from "node:path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL3 } from "node:url";
 
+// src/scripts/_lib/audit_field_provenance.ts
+var MAX_APPLIED_IDS = 32;
+function appliedIds(values) {
+  const out = [];
+  for (const raw of values ?? []) {
+    const v = String(raw).trim();
+    if (v === "" || out.includes(v)) continue;
+    out.push(v);
+    if (out.length >= MAX_APPLIED_IDS) break;
+  }
+  return out;
+}
+
 // src/scripts/_lib/review_skipped_record.ts
 var PRODUCER_PRIVACY_CLASS = "ids-only";
 function isNonNegInt(n) {
@@ -1734,7 +1993,8 @@ function buildReviewSkippedLine(input) {
     risk_class: input.diff_lines >= HIGH_RISK_DIFF_LINES ? "high" : "medium",
     memory: { asks: 0, hits: 0 },
     verify: { claims: 0, first_try_passes: 0 },
-    rules_applied: ["delegation-policy"],
+    // COMPUTED, never a producer constant.
+    rules_applied: appliedIds(input.rules_applied),
     // MANDATORY on every audit line, same as the orchestration producer.
     privacy_class: PRODUCER_PRIVACY_CLASS,
     // `skills_applied` is OMITTED here, deliberately and not by oversight.
@@ -3204,55 +3464,6 @@ import fs7 from "node:fs";
 import path7 from "node:path";
 import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
 
-// src/scripts/_lib/host_capability.ts
-import process2 from "node:process";
-var SAFE_DEFAULT = {
-  schema_version: 1,
-  subagent_spawn: false,
-  parallel_spawn: false,
-  status_polling: false,
-  separate_quota_pool: false,
-  agent_teams: false,
-  worker_respawn: false
-};
-function asBool(value) {
-  return value === true;
-}
-function normalizeHostManifest(input) {
-  if (input === null || typeof input !== "object") {
-    return { ...SAFE_DEFAULT };
-  }
-  const src = input;
-  return {
-    schema_version: 1,
-    subagent_spawn: asBool(src.subagent_spawn),
-    parallel_spawn: asBool(src.parallel_spawn),
-    status_polling: asBool(src.status_polling),
-    separate_quota_pool: asBool(src.separate_quota_pool),
-    agent_teams: asBool(src.agent_teams),
-    worker_respawn: asBool(src.worker_respawn)
-  };
-}
-var HOST_CAPABILITY_REGISTRY = {
-  claude: { subagent_spawn: true, parallel_spawn: true }
-};
-function resolveHostCapabilities(hostId, override) {
-  if (override !== void 0 && override !== null && typeof override === "object" && !Array.isArray(override)) {
-    return normalizeHostManifest(override);
-  }
-  const row = hostId !== null && hostId !== void 0 ? HOST_CAPABILITY_REGISTRY[hostId] : void 0;
-  if (row === void 0) {
-    return { ...SAFE_DEFAULT };
-  }
-  return { ...SAFE_DEFAULT, ...row, schema_version: 1 };
-}
-function probeHostCapabilities(hostId) {
-  const base = resolveHostCapabilities(hostId);
-  const flag = process2.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
-  const probedAgentTeams = typeof flag === "string" && flag !== "";
-  return { ...base, agent_teams: base.agent_teams || probedAgentTeams };
-}
-
 // src/scripts/_lib/auto_dispatch.ts
 var SIZE_FLOOR = 1;
 function inSession(reason) {
@@ -3914,6 +4125,7 @@ function scanSession(sessionId, lines) {
   let pinned = null;
   let pendingPoll = null;
   let authorized = /* @__PURE__ */ new Set();
+  let authorizedObjects = /* @__PURE__ */ new Map();
   let sawPending = false;
   let evaluationsThisTurn = 0;
   let turnsSincePrompt = 0;
@@ -4007,7 +4219,11 @@ function scanSession(sessionId, lines) {
       if (c.language !== "und") {
         pinned = c.language;
       }
-      authorized = new Set(classifyAuthorization(ut).authorized);
+      const classified = classifyAuthorization(ut);
+      authorized = new Set(classified.authorized);
+      authorizedObjects = new Map(
+        classified.authorized.map((op) => [op, new Set(extractObjects(op, ut))])
+      );
       sawPending = false;
       evaluationsThisTurn = 0;
       pendingPoll = null;
@@ -4073,6 +4289,17 @@ function scanSession(sessionId, lines) {
             at,
             detail: `irreversible \`${op}\` with no authorization in the turn's prompt: ${cmd.slice(0, 110)}`
           });
+        } else if (op !== null && authorized.has(op) && OBJECT_REQUIRED_OPS.has(op)) {
+          const object = commandObject(op, cmd);
+          const named = authorizedObjects.get(op);
+          if (object !== null && !(named?.has(object) ?? false)) {
+            report.violations.push({
+              check: "git-authorization",
+              session: sessionId,
+              at,
+              detail: `\`${op}\` authorized, but its object \`${object}\` is not one the turn's prompt named (${named && named.size > 0 ? [...named].join(", ") : "no object named"}): ` + cmd.slice(0, 110)
+            });
+          }
         }
         if (isCiPoll(cmd)) {
           pendingPoll = { at, cmd };
@@ -4405,7 +4632,7 @@ if (_isCliEntry8()) {
 import * as fs9 from "node:fs";
 import * as os3 from "node:os";
 import * as path9 from "node:path";
-import process3 from "node:process";
+import process2 from "node:process";
 import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
 var _HERE = fileURLToPath9(import.meta.url);
 var REPO_ROOT2 = path9.resolve(path9.dirname(_HERE), "..", "..");
@@ -4614,7 +4841,7 @@ function render2(d) {
   return lines.join("\n");
 }
 function main9(argv) {
-  const args = argv ?? process3.argv.slice(2);
+  const args = argv ?? process2.argv.slice(2);
   let projectDir = path9.join(REPO_ROOT2, PROJECT_RULES);
   let globalDir = path9.join(os3.homedir(), GLOBAL_RULES);
   let sourceDir = path9.join(REPO_ROOT2, PROJECTION_SOURCE);
@@ -4627,7 +4854,7 @@ function main9(argv) {
     if (a === "--project" || a === "--global" || a === "--source") {
       const v = value(i);
       if (v === null) {
-        process3.stderr.write(`report_carrier_divergence: ${a} needs a directory
+        process2.stderr.write(`report_carrier_divergence: ${a} needs a directory
 `);
         return 1;
       }
@@ -4637,31 +4864,31 @@ function main9(argv) {
       else sourceDir = resolved;
       i += 1;
     } else if (a === "--help" || a === "-h") {
-      process3.stdout.write(
+      process2.stdout.write(
         "usage: report_carrier_divergence [--project DIR] [--global DIR] [--source DIR]\n"
       );
       return 0;
     } else if (a !== void 0 && a.startsWith("--") && a !== "--quiet") {
-      process3.stderr.write(`report_carrier_divergence: unknown flag ${a}
+      process2.stderr.write(`report_carrier_divergence: unknown flag ${a}
 `);
       return 1;
     }
   }
-  process3.stdout.write(`${render2(compareCarriers(projectDir, globalDir, sourceDir))}
+  process2.stdout.write(`${render2(compareCarriers(projectDir, globalDir, sourceDir))}
 `);
   return 0;
 }
 function _isCliEntry9() {
-  if (process3.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL9(path9.resolve(process3.argv[1])).href) return true;
+  if (process2.argv[1] === void 0) return false;
+  if (import.meta.url === pathToFileURL9(path9.resolve(process2.argv[1])).href) return true;
   try {
-    return fs9.realpathSync(_HERE) === fs9.realpathSync(path9.resolve(process3.argv[1]));
+    return fs9.realpathSync(_HERE) === fs9.realpathSync(path9.resolve(process2.argv[1]));
   } catch {
     return false;
   }
 }
 if (_isCliEntry9()) {
-  process3.exit(main9());
+  process2.exit(main9());
 }
 
 // src/scripts/report_skill_activation.ts
@@ -4675,7 +4902,12 @@ var SKILLS_ROOT = "src/skills";
 var TRIGGER_KEYS = ["triggers:", "trigger_description:", "file_pattern:", "path_prefix:"];
 var DETERMINISTIC_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?(MUST|NEVER|ALWAYS)\b/m;
 function censusSkills(root) {
-  const out = { total: 0, withTriggerKey: [], withDeterministicObligation: [] };
+  const out = {
+    total: 0,
+    withTriggerKey: [],
+    withTriggerCorpus: [],
+    withDeterministicObligation: []
+  };
   if (!fs10.existsSync(root)) {
     return out;
   }
@@ -4694,6 +4926,9 @@ function censusSkills(root) {
     if (TRIGGER_KEYS.some((k) => new RegExp(`^${k}`, "m").test(fm))) {
       out.withTriggerKey.push(entry.name);
     }
+    if (fs10.existsSync(path10.join(root, entry.name, "evals", "triggers.json"))) {
+      out.withTriggerCorpus.push(entry.name);
+    }
     const body = fmEnd === -1 ? text : text.slice(fmEnd + 4);
     if (DETERMINISTIC_RE.test(body)) {
       out.withDeterministicObligation.push(entry.name);
@@ -4752,7 +4987,50 @@ function measureUsage(store, limit) {
 function _pct(n, d) {
   return d === 0 ? "n/a" : `${(100 * n / d).toFixed(1)}%`;
 }
-function render3(census, usage) {
+var RECORD_PATH = "agents/evidence/metrics/skill-activation-census.json";
+function populations(census) {
+  const corpus = new Set(census.withTriggerCorpus);
+  const both = census.withTriggerKey.filter((s) => corpus.has(s));
+  const eitherOne = /* @__PURE__ */ new Set([...census.withTriggerKey, ...census.withTriggerCorpus]);
+  return {
+    shipped: census.total,
+    triggerKey: census.withTriggerKey.length,
+    triggerCorpus: census.withTriggerCorpus.length,
+    bothKeyAndCorpus: both.length,
+    humanNamedOnly: census.total - eitherOne.size
+  };
+}
+function buildRecord(census, usage, today) {
+  const pop = populations(census);
+  const distinct = /* @__PURE__ */ new Set();
+  for (const u of usage) {
+    for (const k of Object.keys(u.bySkill)) {
+      distinct.add(k);
+    }
+  }
+  return {
+    schema_version: 1,
+    measured_at: today,
+    skills_shipped: pop.shipped,
+    with_trigger_key: pop.triggerKey,
+    with_trigger_corpus: pop.triggerCorpus,
+    trigger_key_and_corpus: pop.bothKeyAndCorpus,
+    human_named_only: pop.humanNamedOnly,
+    sessions: usage.reduce((a, u) => a + u.sessions, 0),
+    assistant_turns: usage.reduce((a, u) => a + u.assistantTurns, 0),
+    invocations: usage.reduce((a, u) => a + u.invocations, 0),
+    distinct_skills_invoked: distinct.size,
+    stores: usage.map((u) => path10.basename(u.store))
+  };
+}
+function readRecord(repoRoot) {
+  const file = path10.join(repoRoot, RECORD_PATH);
+  if (!fs10.existsSync(file)) {
+    return null;
+  }
+  return JSON.parse(fs10.readFileSync(file, "utf8"));
+}
+function render3(census, usage, published = null) {
   const lines = [];
   lines.push("skill activation census \u2014 advisory, gates on nothing");
   lines.push("");
@@ -4767,6 +5045,16 @@ function render3(census, usage) {
     lines.push(`      ${census.withDeterministicObligation.join(", ")}`);
   }
   lines.push("");
+  const pop = populations(census);
+  lines.push("  populations \u2014 the three ways a skill can be reached, reconciled");
+  lines.push(`    machine-matchable trigger key        ${pop.triggerKey}`);
+  lines.push(`    evals/triggers.json corpus           ${pop.triggerCorpus}  (a test fixture; no host reads it at routing time)`);
+  lines.push(`    both of the above                    ${pop.bothKeyAndCorpus}`);
+  lines.push(`    human-named only (remainder)         ${pop.humanNamedOnly}`);
+  lines.push(
+    `    reconciles                           ${pop.triggerKey} + ${pop.triggerCorpus} - ${pop.bothKeyAndCorpus} + ${pop.humanNamedOnly} = ${String(pop.triggerKey + pop.triggerCorpus - pop.bothKeyAndCorpus + pop.humanNamedOnly)} of ${pop.shipped}`
+  );
+  lines.push("");
   let totalInv = 0;
   const distinct = /* @__PURE__ */ new Set();
   for (const u of usage) {
@@ -4787,6 +5075,51 @@ function render3(census, usage) {
     lines.push(`      ${[...distinct].sort().join(", ")}`);
   }
   lines.push("");
+  const sessionsRead = usage.reduce((a, u) => a + u.sessions, 0);
+  if (sessionsRead === 0) {
+    lines.push('  EMPTY STORE: 0 sessions were read, so the zero above is "no transcripts at');
+    lines.push('  this path", NOT "no activations". It is not a measurement of the surface and');
+    lines.push("  must not be published as one. Run this where the store lives, or pass --store.");
+    lines.push("");
+  }
+  if (published !== null) {
+    const live = buildRecord(census, usage, published.measured_at);
+    const REPO_FIELDS = [
+      "skills_shipped",
+      "with_trigger_key",
+      "with_trigger_corpus",
+      "trigger_key_and_corpus",
+      "human_named_only"
+    ];
+    const STORE_FIELDS = [
+      "sessions",
+      "assistant_turns",
+      "invocations",
+      "distinct_skills_invoked"
+    ];
+    const repoDrift = REPO_FIELDS.filter((k) => live[k] !== published[k]);
+    const storeDrift = STORE_FIELDS.filter((k) => live[k] !== published[k]);
+    lines.push(`  PUBLISHED RECORD (${RECORD_PATH}), measured ${published.measured_at}:`);
+    lines.push(
+      `    sessions=${String(published.sessions)} asst=${String(published.assistant_turns)} invocations=${String(published.invocations)} distinct=${String(published.distinct_skills_invoked)}`
+    );
+    if (repoDrift.length > 0) {
+      lines.push(`    STALE: the published population split no longer describes this tree \u2014`);
+      lines.push(`    ${repoDrift.join(", ")} moved. Re-take with --emit.`);
+    } else {
+      lines.push("    population split still describes this tree.");
+    }
+    if (sessionsRead === 0) {
+      lines.push("    Store reading: UNDECIDED \u2014 this run read no store, so it cannot say whether");
+      lines.push("    the published figures still hold. Re-run where the store lives.");
+    } else if (storeDrift.length === 0) {
+      lines.push("    Store reading: reproduces the published figures exactly.");
+    } else {
+      lines.push(`    Store reading: moved since the record (${storeDrift.join(", ")}). Expected \u2014`);
+      lines.push("    the store is rolling, not append-only, and a later reading can be lower.");
+    }
+    lines.push("");
+  }
   if (census.withTriggerKey.length === 0) {
     lines.push("  VERDICT: activation is not measurable as a rate. No skill declares a");
     lines.push("  machine-matchable trigger, so a missed-activation detector has nothing to");
@@ -4800,19 +5133,30 @@ function render3(census, usage) {
   lines.push("  catalogue once per session, then count descriptions against bare names.");
   return lines.join("\n");
 }
+var USAGE = "usage: report_skill_activation [--root DIR] [--limit N] [--store PATH]... [--emit] [--allow-empty-store]\n";
 function main10(argv) {
   let limit = 30;
+  let emit = false;
+  let allowEmpty = false;
+  const rootIdx = argv.indexOf("--root");
+  const root = rootIdx === -1 ? REPO_ROOT3 : argv[rootIdx + 1] ?? REPO_ROOT3;
   const stores = [];
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
-    if (a === "--limit" && argv[i + 1] !== void 0) {
+    if (a === "--root" && argv[i + 1] !== void 0) {
+      i += 1;
+    } else if (a === "--limit" && argv[i + 1] !== void 0) {
       limit = Number.parseInt(argv[i + 1], 10);
       i += 1;
     } else if (a === "--store" && argv[i + 1] !== void 0) {
       stores.push(argv[i + 1]);
       i += 1;
+    } else if (a === "--emit") {
+      emit = true;
+    } else if (a === "--allow-empty-store") {
+      allowEmpty = true;
     } else if (a === "--help" || a === "-h") {
-      process.stdout.write("usage: report_skill_activation [--limit N] [--store PATH]...\n");
+      process.stdout.write(USAGE);
       return 0;
     }
   }
@@ -4823,9 +5167,33 @@ function main10(argv) {
   if (stores.length === 0) {
     stores.push(defaultStore2(REPO_ROOT3));
   }
-  const census = censusSkills(path10.join(REPO_ROOT3, SKILLS_ROOT));
+  const census = censusSkills(path10.join(root, SKILLS_ROOT));
   const usage = stores.map((s) => measureUsage(s, limit));
-  process.stdout.write(`${render3(census, usage)}
+  process.stdout.write(`${render3(census, usage, readRecord(root))}
+`);
+  reportScanned({
+    gate: "report_skill_activation",
+    scanned: census.total,
+    units: "SKILL.md file(s)",
+    roots: [SKILLS_ROOT]
+  });
+  if (!emit) {
+    return 0;
+  }
+  const sessionsRead = usage.reduce((a, u) => a + u.sessions, 0);
+  if (sessionsRead === 0 && !allowEmpty) {
+    process.stderr.write(
+      'report_skill_activation --emit: refusing to write a record from 0 sessions \u2014 that zero\nis "no transcripts at this path", not an activation reading. Run where the store lives,\npass --store, or pass --allow-empty-store if an empty store is genuinely the finding.\n'
+    );
+    return 1;
+  }
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const file = path10.join(root, RECORD_PATH);
+  fs10.mkdirSync(path10.dirname(file), { recursive: true });
+  fs10.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
+`);
+  process.stdout.write(`
+wrote ${RECORD_PATH} (measured ${today})
 `);
   return 0;
 }
@@ -4837,7 +5205,7 @@ if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL10(path10.res
 import * as fs11 from "node:fs";
 import * as os5 from "node:os";
 import * as path11 from "node:path";
-import process4 from "node:process";
+import process3 from "node:process";
 import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
 var _HERE3 = fileURLToPath11(import.meta.url);
 var REPO_ROOT4 = path11.resolve(path11.dirname(_HERE3), "..", "..");
@@ -5099,7 +5467,7 @@ function render4(r) {
   return lines.join("\n");
 }
 function main11(argv) {
-  const args = argv ?? process4.argv.slice(2);
+  const args = argv ?? process3.argv.slice(2);
   let limit = 30;
   let json = false;
   const stores = [];
@@ -5112,7 +5480,7 @@ function main11(argv) {
     if (a === "--limit") {
       const v = value(i);
       if (v === null) {
-        process4.stderr.write("report_skill_obligation_violations: --limit needs a number\n");
+        process3.stderr.write("report_skill_obligation_violations: --limit needs a number\n");
         return 1;
       }
       limit = Number.parseInt(v, 10);
@@ -5120,7 +5488,7 @@ function main11(argv) {
     } else if (a === "--store") {
       const v = value(i);
       if (v === null) {
-        process4.stderr.write("report_skill_obligation_violations: --store needs a path\n");
+        process3.stderr.write("report_skill_obligation_violations: --store needs a path\n");
         return 1;
       }
       stores.push(v);
@@ -5128,40 +5496,40 @@ function main11(argv) {
     } else if (a === "--json") {
       json = true;
     } else if (a === "--help" || a === "-h") {
-      process4.stdout.write(
+      process3.stdout.write(
         "usage: report_skill_obligation_violations [--limit N] [--store PATH]... [--json]\n"
       );
       return 0;
     } else if (a !== void 0 && a.startsWith("--") && a !== "--quiet") {
-      process4.stderr.write(`report_skill_obligation_violations: unknown flag ${a}
+      process3.stderr.write(`report_skill_obligation_violations: unknown flag ${a}
 `);
       return 1;
     }
   }
   if (!Number.isFinite(limit) || limit <= 0) {
-    process4.stderr.write("report_skill_obligation_violations: --limit must be a positive integer\n");
+    process3.stderr.write("report_skill_obligation_violations: --limit must be a positive integer\n");
     return 1;
   }
   if (stores.length === 0) stores.push(defaultStore3(REPO_ROOT4));
   for (const store of stores) {
     const r = scanStore2(REPO_ROOT4, store, limit);
-    process4.stdout.write(json ? `${JSON.stringify(r, null, 2)}
+    process3.stdout.write(json ? `${JSON.stringify(r, null, 2)}
 ` : `${render4(r)}
 `);
   }
   return 0;
 }
 function _isCliEntry10() {
-  if (process4.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL11(path11.resolve(process4.argv[1])).href) return true;
+  if (process3.argv[1] === void 0) return false;
+  if (import.meta.url === pathToFileURL11(path11.resolve(process3.argv[1])).href) return true;
   try {
-    return fs11.realpathSync(_HERE3) === fs11.realpathSync(path11.resolve(process4.argv[1]));
+    return fs11.realpathSync(_HERE3) === fs11.realpathSync(path11.resolve(process3.argv[1]));
   } catch {
     return false;
   }
 }
 if (_isCliEntry10()) {
-  process4.exit(main11());
+  process3.exit(main11());
 }
 
 // src/scripts/report_conformance_funnel.ts
@@ -5305,7 +5673,7 @@ function render5(r) {
   return lines.join("\n");
 }
 function main12(argv) {
-  const args = argv ?? process5.argv.slice(2);
+  const args = argv ?? process4.argv.slice(2);
   const opts = {};
   const value = (i) => {
     const v = args[i + 1];
@@ -5316,7 +5684,7 @@ function main12(argv) {
     if (a === "--store" || a === "--project" || a === "--global" || a === "--source") {
       const v = value(i);
       if (v === null) {
-        process5.stderr.write(`report_conformance_funnel: ${a} needs a value
+        process4.stderr.write(`report_conformance_funnel: ${a} needs a value
 `);
         return 1;
       }
@@ -5330,37 +5698,37 @@ function main12(argv) {
       const v = value(i);
       const n = v === null ? Number.NaN : Number.parseInt(v, 10);
       if (!Number.isFinite(n) || n <= 0) {
-        process5.stderr.write("report_conformance_funnel: --limit must be a positive integer\n");
+        process4.stderr.write("report_conformance_funnel: --limit must be a positive integer\n");
         return 1;
       }
       opts.limit = n;
       i += 1;
     } else if (a === "--help" || a === "-h") {
-      process5.stdout.write(
+      process4.stdout.write(
         "usage: report_conformance_funnel [--store PATH] [--limit N]\n                                 [--project DIR] [--global DIR] [--source DIR]\n"
       );
       return 0;
     } else if (a !== void 0 && a.startsWith("--") && a !== "--quiet") {
-      process5.stderr.write(`report_conformance_funnel: unknown flag ${a}
+      process4.stderr.write(`report_conformance_funnel: unknown flag ${a}
 `);
       return 1;
     }
   }
-  process5.stdout.write(`${render5(buildFunnel(opts))}
+  process4.stdout.write(`${render5(buildFunnel(opts))}
 `);
   return 0;
 }
 function _isCliEntry11() {
-  if (process5.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL12(path12.resolve(process5.argv[1])).href) return true;
+  if (process4.argv[1] === void 0) return false;
+  if (import.meta.url === pathToFileURL12(path12.resolve(process4.argv[1])).href) return true;
   try {
-    return fs12.realpathSync(_HERE4) === fs12.realpathSync(path12.resolve(process5.argv[1]));
+    return fs12.realpathSync(_HERE4) === fs12.realpathSync(path12.resolve(process4.argv[1]));
   } catch {
     return false;
   }
 }
 if (_isCliEntry11()) {
-  process5.exit(main12());
+  process4.exit(main12());
 }
 
 // src/scripts/_cli/cmd_conformance.ts
@@ -5375,22 +5743,22 @@ var CONFORMANCE_CHECK_IDS = [
 ];
 var THIN_STUB_MARKER = "Routed rule \u2014 load the body on trigger-match";
 function print(s = "") {
-  process6.stdout.write(`${s}
+  process5.stdout.write(`${s}
 `);
 }
 function eprint(s = "") {
-  process6.stderr.write(`${s}
+  process5.stderr.write(`${s}
 `);
 }
 function conformanceLogPath() {
-  const override = process6.env["AGENT_CONFIG_CONFORMANCE_LOG"];
+  const override = process5.env["AGENT_CONFIG_CONFORMANCE_LOG"];
   if (override && override.trim().length > 0) {
     return override;
   }
   return path13.join(os7.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
 }
 function installLogPath() {
-  const override = process6.env["AGENT_CONFIG_INSTALL_LOG"];
+  const override = process5.env["AGENT_CONFIG_INSTALL_LOG"];
   if (override && override.trim().length > 0) {
     return override;
   }
@@ -5688,7 +6056,7 @@ function _check_host_manifest(projectRoot) {
   };
 }
 function runConformanceChecks(opts = {}) {
-  const projectRoot = opts.projectRoot ?? process6.cwd();
+  const projectRoot = opts.projectRoot ?? process5.cwd();
   const packageRoot = opts.packageRoot ?? PACKAGE_ROOT;
   const checks = [];
   checks.push(_check_txlog_clean());
@@ -5722,14 +6090,14 @@ function appendConformanceReport(checks, projectRoot, logPath = conformanceLogPa
   } catch {
   }
 }
-var USAGE = "usage: agent-config conformance [-h] [--project PROJECT] [--json]\n                                [--skip-dispatcher] [--funnel]\n";
+var USAGE2 = "usage: agent-config conformance [-h] [--project PROJECT] [--json]\n                                [--skip-dispatcher] [--funnel]\n";
 function _parse(argv) {
   const opts = { project: null, json: false, skip_dispatcher: false, funnel: false };
   let i = 0;
   while (i < argv.length) {
     const a = argv[i];
     if (a === "-h" || a === "--help") {
-      process6.stdout.write(USAGE);
+      process5.stdout.write(USAGE2);
       throw new ArgparseExit(0);
     }
     if (a === "--json") {
@@ -5743,16 +6111,16 @@ function _parse(argv) {
         opts.project = a.slice(a.indexOf("=") + 1);
       } else {
         if (i + 1 >= argv.length) {
-          process6.stderr.write(USAGE);
-          process6.stderr.write("agent-config conformance: error: --project expects a value\n");
+          process5.stderr.write(USAGE2);
+          process5.stderr.write("agent-config conformance: error: --project expects a value\n");
           throw new ArgparseExit(2);
         }
         opts.project = argv[i + 1];
         i += 1;
       }
     } else {
-      process6.stderr.write(USAGE);
-      process6.stderr.write(`agent-config conformance: error: unrecognized argument ${a}
+      process5.stderr.write(USAGE2);
+      process5.stderr.write(`agent-config conformance: error: unrecognized argument ${a}
 `);
       throw new ArgparseExit(2);
     }
@@ -5761,7 +6129,7 @@ function _parse(argv) {
   return opts;
 }
 function main13(argv = null) {
-  const opts = _parse(argv !== null ? Array.from(argv) : process6.argv.slice(2));
+  const opts = _parse(argv !== null ? Array.from(argv) : process5.argv.slice(2));
   if (opts.funnel) {
     print(render5(buildFunnel()));
     return 0;
@@ -5832,27 +6200,27 @@ function main13(argv = null) {
   return failed ? 1 : 0;
 }
 function _isCliEntry12() {
-  if (process6.argv[1] === void 0) {
+  if (process5.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL13(path13.resolve(process6.argv[1])).href;
+  const argvUrl = pathToFileURL13(path13.resolve(process5.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
     const here = fs13.realpathSync(fileURLToPath13(import.meta.url));
-    const argv = fs13.realpathSync(path13.resolve(process6.argv[1]));
+    const argv = fs13.realpathSync(path13.resolve(process5.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry12() || process6.argv[1] === _HERE5) {
+if (_isCliEntry12() || process5.argv[1] === _HERE5) {
   try {
-    process6.exitCode = main13(process6.argv.slice(2));
+    process5.exitCode = main13(process5.argv.slice(2));
   } catch (e) {
     if (e instanceof ArgparseExit) {
-      process6.exitCode = e.code;
+      process5.exitCode = e.code;
     } else {
       throw e;
     }