@event4u/agent-config 14.19.0 → 14.20.0

package/dist/mcp/server.mjs

@@ -1502,6 +1502,7 @@ __export(resources_exports, {
   MIME_MARKDOWN: () => MIME_MARKDOWN,
   ResourceCache: () => ResourceCache,
   load_all_resources: () => load_all_resources,
+  resourcePriority: () => resourcePriority,
   scan_contexts: () => scan_contexts,
   scan_guidelines: () => scan_guidelines,
   scan_rules: () => scan_rules,
@@ -1600,9 +1601,18 @@ function _load(p, options) {
     body: _rstrip2(text) + "\n",
     source: meta.source ?? "package",
     mime_type: MIME_MARKDOWN,
-    kind
+    kind,
+    ...meta.type === void 0 ? {} : { rule_type: meta.type.trim() },
+    ..._mtimeIso(p) === null ? {} : { last_modified: _mtimeIso(p) }
   };
 }
+function _mtimeIso(p) {
+  try {
+    return fs5.statSync(p).mtime.toISOString();
+  } catch {
+    return null;
+  }
+}
 function scan_rules(root) {
   const base = root ?? _project_root();
   const rules_root = path5.join(base, "dist/agent-src", "rules");
@@ -1684,12 +1694,23 @@ function _strCmp2(a, b) {
   }
   return 0;
 }
+function resourcePriority(resource) {
+  if (resource.rule_type === "always") return 1;
+  if (resource.rule_type === "auto") return 0.7;
+  if (resource.rule_type === "manual") return 0.3;
+  return resource.kind === "rule" ? 0.7 : resource.kind === "context" ? 0.5 : 0.3;
+}
 function to_mcp_resource_meta(resource) {
   return {
     uri: resource.uri,
     name: resource.name,
     description: resource.description,
     mimeType: resource.mime_type,
+    // `audience` is the model, not the end user: these are governance
+    // assets a host injects, never something a person reads in a client.
+    audience: ["assistant"],
+    priority: resourcePriority(resource),
+    ...resource.last_modified === void 0 ? {} : { lastModified: resource.last_modified },
     _meta: { source: resource.source, kind: resource.kind }
   };
 }
@@ -9092,6 +9113,7 @@ var require_dist = __commonJS({
 });
 
 // src/scripts/_lib/security_lint.ts
+import { createHash as createHash2 } from "node:crypto";
 import * as fs6 from "node:fs";
 import * as path6 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -9101,6 +9123,9 @@ function is_example_path(rel_path) {
 function path_weight(rel_path) {
   return is_example_path(rel_path) ? 0.25 : 1;
 }
+function source_identity(rel) {
+  return rel.startsWith(PROJECTION_PREFIX) ? `src/${rel.slice(PROJECTION_PREFIX.length)}` : rel;
+}
 function _splitlines(text) {
   const out = [];
   let buf = "";
@@ -9176,11 +9201,18 @@ function scan_file(filePath) {
     }
   }
   const pragmas = {};
+  const pragmaHashes = {};
   for (const text of lines) {
     _PRAGMA.lastIndex = 0;
     let m;
     while ((m = _PRAGMA.exec(text)) !== null) {
-      pragmas[m[1]] = m[2];
+      const check = m[1];
+      pragmas[check] = m[2];
+      const hashes = (m[3] ?? "").match(/sha256:([0-9a-f]{64})/g) ?? [];
+      pragmaHashes[check] = [
+        ...pragmaHashes[check] ?? [],
+        ...hashes.map((h) => h.slice("sha256:".length))
+      ];
       if (m.index === _PRAGMA.lastIndex) {
         _PRAGMA.lastIndex += 1;
       }
@@ -9193,7 +9225,29 @@ function scan_file(filePath) {
     in_example,
     in_any,
     pragmas,
-    path_weight(rel)
+    path_weight(rel),
+    pragmaHashes
+  );
+}
+function scan_path(filePath, base) {
+  const sf = scan_file(filePath);
+  let rel;
+  const baseResolved = path6.resolve(base);
+  const fileResolved = path6.resolve(filePath);
+  if (fileResolved === baseResolved || fileResolved.startsWith(baseResolved + path6.sep)) {
+    rel = path6.relative(baseResolved, fileResolved).split(path6.sep).join("/");
+  } else {
+    rel = path6.basename(filePath);
+  }
+  return new ScannedFile(
+    sf.path,
+    rel,
+    sf.lines,
+    sf.in_example_fence,
+    sf.in_any_fence,
+    sf.pragmas,
+    path_weight(rel),
+    sf.pragma_hashes
   );
 }
 function _rglobSorted(base) {
@@ -9229,9 +9283,9 @@ function _pathCmp(a, b) {
   if (pa.length > pb.length) return 1;
   return 0;
 }
-function* iter_corpus(roots = DEFAULT_SCAN_ROOTS, exts = [".md"]) {
+function* iter_corpus(roots = DEFAULT_SCAN_ROOTS, exts = [".md"], scanBase = ROOT) {
   for (const root of roots) {
-    const base = path6.join(ROOT, root);
+    const base = path6.join(scanBase, root);
     if (!fs6.existsSync(base)) {
       continue;
     }
@@ -9243,11 +9297,25 @@ function* iter_corpus(roots = DEFAULT_SCAN_ROOTS, exts = [".md"]) {
         continue;
       }
       if (st.isFile() && exts.includes(path6.extname(p))) {
-        yield scan_file(p);
+        yield scan_path(p, scanBase);
       }
     }
   }
 }
+function legacy_pragma_finding(sf, check) {
+  return new Finding(
+    sf.rel,
+    0,
+    LEGACY_PRAGMA_CHECK,
+    "LOW",
+    `unbound \`security-lint: allow ${check}\` pragma suppresses this whole file \u2014 it accepts whatever the matched text is later changed to say. Bind it with \`sha256:<hex>\` per accepted match.`,
+    sf.weight
+  );
+}
+function report_child_scanned(count) {
+  process.stderr.write(`${CHILD_SCANNED_PREFIX}${String(count)}
+`);
+}
 function report(findings, opts) {
   const check_label = opts.check_label;
   if (findings.length === 0) {
@@ -9431,7 +9499,7 @@ function _pyJsonScalarAscii(value) {
   if (typeof value === "string") return _pyJsonStrAscii(value);
   return _pyJsonScalar(value);
 }
-var _HERE, ROOT, EXAMPLE_FENCE_LANG, GUIDELINE, GUIDELINE_EPILOG, DEFAULT_SCAN_ROOTS, _EXAMPLE_PATH, _PRAGMA, _FENCE, SEVERITY_RANK, Finding, ScannedFile, PyFloat;
+var _HERE, ROOT, EXAMPLE_FENCE_LANG, GUIDELINE, GUIDELINE_EPILOG, DEFAULT_SCAN_ROOTS, _EXAMPLE_PATH, _PRAGMA, _FENCE, SEVERITY_RANK, Finding, PROJECTION_PREFIX, ScannedFile, LEGACY_PRAGMA_CHECK, CHILD_SCANNED_PREFIX, PyFloat;
 var init_security_lint = __esm({
   "src/scripts/_lib/security_lint.ts"() {
     "use strict";
@@ -9448,7 +9516,7 @@ var init_security_lint = __esm({
       "dist/agent-src"
     ];
     _EXAMPLE_PATH = /(^|\/)(docs|evals|tests?|fixtures?)(\/|$)|example|template|sample|\/_template/i;
-    _PRAGMA = /<!--\s*security-lint:\s*allow\s+([A-Za-z0-9_-]+)\s+"([^"]+)"\s*-->/g;
+    _PRAGMA = /<!--\s*security-lint:\s*allow\s+([A-Za-z0-9_-]+)\s+"([^"]+)"((?:\s+sha256:[0-9a-f]{64})*)\s*-->/g;
     _FENCE = /^(\s*)(`{3,}|~{3,})\s*([A-Za-z0-9_-]*)\s*$/;
     SEVERITY_RANK = { LOW: 1, MED: 2, HIGH: 3 };
     Finding = class {
@@ -9488,6 +9556,7 @@ var init_security_lint = __esm({
         };
       }
     };
+    PROJECTION_PREFIX = "dist/agent-src/";
     ScannedFile = class {
       path;
       // absolute or as-given path
@@ -9498,8 +9567,10 @@ var init_security_lint = __esm({
       in_any_fence;
       pragmas;
       // check id → reason
+      /** check id → the sha256 fingerprints that pragma accepts. Empty = unbound. */
+      pragma_hashes;
       weight;
-      constructor(pathArg, rel, lines, in_example_fence, in_any_fence, pragmas, weight) {
+      constructor(pathArg, rel, lines, in_example_fence, in_any_fence, pragmas, weight, pragma_hashes = {}) {
         this.path = pathArg;
         this.rel = rel;
         this.lines = lines;
@@ -9507,10 +9578,74 @@ var init_security_lint = __esm({
         this.in_any_fence = in_any_fence;
         this.pragmas = pragmas;
         this.weight = weight;
+        this.pragma_hashes = pragma_hashes;
       }
       pragma_allows(check) {
         return Object.prototype.hasOwnProperty.call(this.pragmas, check);
       }
+      /**
+       * Which form of pragma this file carries for `check`.
+       *
+       * `absent`  — no pragma; scan normally.
+       * `legacy`  — a pragma with no fingerprint. Suppresses the whole file, as it
+       *             always did, and says so: a key lookup accepts whatever the
+       *             line is later changed to say, which is the defect being paid
+       *             down, not a mode anybody should choose.
+       * `bound`   — a pragma listing fingerprints. Suppresses exactly the matches
+       *             whose evidence hashes to one of them; anything else survives.
+       */
+      pragma_form(check) {
+        if (!this.pragma_allows(check)) return "absent";
+        return (this.pragma_hashes[check] ?? []).length > 0 ? "bound" : "legacy";
+      }
+      /**
+       * The fingerprint one finding's evidence hashes to.
+       *
+       * WHAT IS HASHED, and each part earns its place:
+       *   check id      — the same line may legitimately be accepted for one check
+       *                   and not another.
+       *   rel path      — the location IDENTITY. Not the line NUMBER: an unrelated
+       *                   insert above would otherwise break every pragma in the
+       *                   file, and a suppression that breaks on unrelated edits
+       *                   gets deleted rather than re-derived. A `dist/agent-src/`
+       *                   path folds to its `src/` original first, because the
+       *                   projection is byte-exact by contract (ADR-201) and
+       *                   carries the pragma verbatim — without the fold, every
+       *                   migrated pragma would suppress the source and leave its
+       *                   own copy flagged, which is a gate that reds on a file
+       *                   nobody may edit.
+       *   matched line, — the evidence. ASCII whitespace runs collapse so a reflow
+       *   normalized      does not invalidate the binding, `sha256:<hex>` tokens are
+       *                   removed, and NOTHING else is stripped: the zero-width
+       *                   characters this suite hunts are exactly what a wider
+       *                   normalizer would erase.
+       *
+       * WHY THE HASH TOKENS COME OUT. A pragma's own reason string can be the
+       * matched evidence — two in this tree are, because they quote the very
+       * phrases their check detects in order to explain themselves. Without this
+       * the fingerprint would have to be computed over a line that already
+       * contains it, which has no fixed point: writing the hash changes the line,
+       * which changes the hash. Stripping the tokens makes the fingerprint stable
+       * under the act of recording it, and costs nothing elsewhere — a `sha256:`
+       * token in ordinary prose is not evidence of anything a linter here checks.
+       *
+       * Deliberately NOT the whole file: incidental content elsewhere would make
+       * every unrelated edit re-fire the pragma, which is the noise that produces
+       * blanket suppressions.
+       */
+      evidence_fingerprint(finding) {
+        const text = finding.line > 0 ? this.lines[finding.line - 1] ?? "" : "";
+        const normalized = text.replace(/\s*sha256:[0-9a-f]{64}/g, "").replace(/[ \t]+/g, " ").trim();
+        return createHash2("sha256").update(`${finding.check}
+${source_identity(this.rel)}
+${normalized}`, "utf-8").digest("hex");
+      }
+      /** Drop the findings this file's BOUND pragma for `check` accepts. */
+      filter_bound_pragma(check, findings) {
+        const accepted = new Set(this.pragma_hashes[check] ?? []);
+        if (accepted.size === 0) return [...findings];
+        return findings.filter((f) => !accepted.has(this.evidence_fingerprint(f)));
+      }
       /** Yield [lineno, text] honouring the fence masks (mirrors iter_lines). */
       *iter_lines(opts = {}) {
         const skip_example_fence = opts.skip_example_fence ?? true;
@@ -9526,6 +9661,8 @@ var init_security_lint = __esm({
         }
       }
     };
+    LEGACY_PRAGMA_CHECK = "legacy-pragma";
+    CHILD_SCANNED_PREFIX = "scanned: ";
     PyFloat = class {
       constructor(value) {
         this.value = value;
@@ -9604,9 +9741,11 @@ function _cpName(cp) {
   return n !== void 0 ? n : "<unnamed>";
 }
 function _scan(sf) {
-  if (sf.pragma_allows(CHECK)) {
-    return [];
+  const pragmaForm = sf.pragma_form(CHECK);
+  if (pragmaForm === "legacy") {
+    return [legacy_pragma_finding(sf, CHECK)];
   }
+  const finish = (hits) => pragmaForm === "bound" ? sf.filter_bound_pragma(CHECK, hits) : hits;
   const out = [];
   for (const [lineno, text] of sf.iter_lines({ skip_example_fence: true })) {
     let vs_run = 0;
@@ -9644,7 +9783,7 @@ function _scan(sf) {
       );
     }
   }
-  return out;
+  return finish(out);
 }
 function _isGenerated(rel) {
   return _GENERATED_PREFIXES.some((p) => rel.startsWith(p));
@@ -9728,7 +9867,7 @@ function _sanitize(filePath) {
   return out;
 }
 function _argError(msg) {
-  process.stderr.write("usage: lint_hidden_unicode [-h] [--json] [--fix]\n");
+  process.stderr.write("usage: lint_hidden_unicode [-h] [--json] [--fix] [--root DIR]\n");
   process.stderr.write(`lint_hidden_unicode: error: ${msg}
 `);
   process.exit(2);
@@ -9736,14 +9875,27 @@ function _argError(msg) {
 function parse_args(argv) {
   const out = { json: false, fix: false };
   const extra = [];
+  let rootPending = false;
   for (const a of argv) {
+    if (rootPending) {
+      out.root = a;
+      rootPending = false;
+      continue;
+    }
     if (a === "-h" || a === "--help") {
-      process.stdout.write("usage: lint_hidden_unicode [-h] [--json] [--fix]\n");
+      process.stdout.write("usage: lint_hidden_unicode [-h] [--json] [--fix] [--root DIR]\n");
       process.exit(0);
     } else if (a === "--json") {
       out.json = true;
     } else if (a === "--fix") {
       out.fix = true;
+    } else if (a === "--root" || a.startsWith("--root=")) {
+      const eq = a.indexOf("=");
+      if (eq !== -1) {
+        out.root = a.slice(eq + 1);
+      } else {
+        rootPending = true;
+      }
     } else {
       extra.push(a);
     }
@@ -9755,10 +9907,11 @@ function parse_args(argv) {
 }
 function main(argv = null) {
   const args = parse_args(argv ?? process.argv.slice(2));
+  const scanBase = args.root === void 0 ? ROOT : path7.resolve(args.root);
   const findings = [];
   const flagged = /* @__PURE__ */ new Set();
   let corpusFiles = 0;
-  for (const sf of iter_corpus()) {
+  for (const sf of iter_corpus(DEFAULT_SCAN_ROOTS, [".md"], scanBase)) {
     corpusFiles += 1;
     const hits = _scan(sf);
     for (const h of hits) {
@@ -9783,7 +9936,7 @@ function main(argv = null) {
     }
     throw exc;
   }
-  const sourceFiles = _eligibleSourceFiles();
+  const sourceFiles = args.root === void 0 ? _eligibleSourceFiles() : [];
   for (const h of _scanSourceControlBytes(sourceFiles)) {
     findings.push(h);
   }
@@ -9802,6 +9955,9 @@ function main(argv = null) {
 `);
     }
   }
+  if (args.json) {
+    report_child_scanned(corpusFiles + (sourceFiles === null ? 0 : sourceFiles.length));
+  }
   if (args.json) {
     const payload = py_json_dumps_indent2(findings.map((f) => f.toDict()));
     process.stdout.write(payload + "\n");
@@ -11467,7 +11623,7 @@ var init_memory_fts_index = __esm({
 });
 
 // src/scripts/learning_sidecar.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import * as fs11 from "node:fs";
 import * as path11 from "node:path";
 import process5 from "node:process";
@@ -11477,7 +11633,7 @@ function _parseTsMs(ts) {
   return Number.isNaN(t) ? null : t;
 }
 function _bodyHash(body) {
-  return createHash2("sha256").update(body.trim().toLowerCase()).digest("hex").slice(0, 12);
+  return createHash3("sha256").update(body.trim().toLowerCase()).digest("hex").slice(0, 12);
 }
 function _globSignalFiles(dir) {
   let names;
@@ -27740,6 +27896,168 @@ var init_runtime_wiring_checks = __esm({
   }
 });
 
+// src/scripts/_lib/host_capability.ts
+import process17 from "node:process";
+function asBool(value) {
+  return value === true;
+}
+function normalizeHostManifest(input) {
+  if (input === null || typeof input !== "object") {
+    return { ...SAFE_DEFAULT };
+  }
+  const src = input;
+  return {
+    schema_version: 1,
+    subagent_spawn: asBool(src.subagent_spawn),
+    parallel_spawn: asBool(src.parallel_spawn),
+    status_polling: asBool(src.status_polling),
+    separate_quota_pool: asBool(src.separate_quota_pool),
+    agent_teams: asBool(src.agent_teams),
+    worker_respawn: asBool(src.worker_respawn),
+    reads_project_mcp_config: asBool(src.reads_project_mcp_config),
+    // Inverted coercion, matching the inverted default: only an explicit
+    // `false` clears the residual, so an absent or malformed value keeps
+    // the manual step visible instead of silently dropping it.
+    mcp_needs_manual_activation: src.mcp_needs_manual_activation !== false
+  };
+}
+function resolveHostCapabilities(hostId, override) {
+  if (override !== void 0 && override !== null && typeof override === "object" && !Array.isArray(override)) {
+    return normalizeHostManifest(override);
+  }
+  const row = hostId !== null && hostId !== void 0 ? HOST_CAPABILITY_REGISTRY[hostId] : void 0;
+  if (row === void 0) {
+    return { ...SAFE_DEFAULT };
+  }
+  return { ...SAFE_DEFAULT, ...row, schema_version: 1 };
+}
+function probeHostCapabilities(hostId) {
+  const base = resolveHostCapabilities(hostId);
+  const flag = process17.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+  const probedAgentTeams = typeof flag === "string" && flag !== "";
+  return { ...base, agent_teams: base.agent_teams || probedAgentTeams };
+}
+function describeHostCapabilities(hostId) {
+  const manifest = probeHostCapabilities(hostId);
+  const row = hostId !== null && hostId !== void 0 ? HOST_CAPABILITY_REGISTRY[hostId] : void 0;
+  const flag = process17.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+  const probedAgentTeams = typeof flag === "string" && flag !== "";
+  const sources = {};
+  for (const field of CAPABILITY_FIELDS) {
+    if (row !== void 0 && typeof row[field] === "boolean") {
+      sources[field] = "registry";
+    } else if (field === "agent_teams" && probedAgentTeams) {
+      sources[field] = "live-probe";
+    } else {
+      sources[field] = "default";
+    }
+  }
+  return { manifest, sources };
+}
+var SAFE_DEFAULT, HOST_CAPABILITY_REGISTRY, CAPABILITY_FIELDS;
+var init_host_capability = __esm({
+  "src/scripts/_lib/host_capability.ts"() {
+    "use strict";
+    SAFE_DEFAULT = {
+      schema_version: 1,
+      subagent_spawn: false,
+      parallel_spawn: false,
+      status_polling: false,
+      separate_quota_pool: false,
+      agent_teams: false,
+      worker_respawn: false,
+      reads_project_mcp_config: false,
+      // `true` because the safe answer here is "there is still a step", not
+      // "there is nothing to do" — see the field's own note.
+      mcp_needs_manual_activation: true
+    };
+    HOST_CAPABILITY_REGISTRY = {
+      claude: { subagent_spawn: true, parallel_spawn: true }
+    };
+    CAPABILITY_FIELDS = [
+      "subagent_spawn",
+      "parallel_spawn",
+      "status_polling",
+      "separate_quota_pool",
+      "agent_teams",
+      "worker_respawn",
+      "reads_project_mcp_config",
+      "mcp_needs_manual_activation"
+    ];
+  }
+});
+
+// src/scripts/_lib/mcp_consent_residual.ts
+function residualFor(hostId) {
+  const { manifest, sources } = describeHostCapabilities(hostId);
+  if (sources.mcp_needs_manual_activation === "registry" && !manifest.mcp_needs_manual_activation) {
+    return null;
+  }
+  return SEEDED[hostId] ?? null;
+}
+function isRecorded(hostId) {
+  const { sources } = describeHostCapabilities(hostId);
+  return hostId in SEEDED || sources.mcp_needs_manual_activation === "registry";
+}
+function residualLine(hostId) {
+  const r = residualFor(hostId);
+  if (r !== null) {
+    return {
+      hostId,
+      state: "residual",
+      text: `${hostId}: ${r.residual} (source: ${r.source} \u2014 not observed here)`
+    };
+  }
+  if (isRecorded(hostId)) {
+    return {
+      hostId,
+      state: "cleared",
+      text: `${hostId}: nothing left to do (source: observed)`
+    };
+  }
+  return {
+    hostId,
+    state: "unrecorded",
+    text: `${hostId}: no residual recorded \u2014 nobody checked this host, which is not the same as nothing to do`
+  };
+}
+function residualReport(toolIds) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const toolId of toolIds) {
+    const hostId = TOOL_TO_HOST[toolId];
+    if (hostId === void 0 || seen.has(hostId)) continue;
+    seen.add(hostId);
+    const line = residualLine(hostId);
+    if (line.state !== "cleared") out.push(line);
+  }
+  return out;
+}
+var SEEDED, TOOL_TO_HOST;
+var init_mcp_consent_residual = __esm({
+  "src/scripts/_lib/mcp_consent_residual.ts"() {
+    "use strict";
+    init_host_capability();
+    SEEDED = {
+      claude: {
+        hostId: "claude",
+        residual: "Approve the project-scoped `agent-config` server the first time the host prompts \u2014 the installer writes `.mcp.json` but does not pre-approve it.",
+        source: "vendor-doc",
+        cite: "Host documentation: a project-scope MCP server requires explicit approval, suppressible only through the user-global `enabledMcpjsonServers` key, which this package deliberately does not write (blocker `mcp-user-scope-approval-consent`)."
+      }
+    };
+    TOOL_TO_HOST = {
+      "claude-code": "claude",
+      cursor: "cursor",
+      "gemini-cli": "gemini",
+      windsurf: "windsurf",
+      cline: "cline",
+      copilot: "copilot",
+      augment: "augment"
+    };
+  }
+});
+
 // src/scripts/_lib/install_reach_checks.ts
 import * as fs52 from "node:fs";
 import * as path53 from "node:path";
@@ -27928,17 +28246,33 @@ function checkOverrideSet(projectRoot) {
     remedy: "route it through the upstream-contribution path, never by changing a shipped default on one install"
   };
 }
+function checkMcpConsentResidual() {
+  const id = "mcp-consent-residual";
+  const lines = residualReport(Object.keys(TOOL_TO_HOST));
+  if (lines.length === 0) {
+    return { id, status: "ok", message: "no MCP consent residual recorded for any known host", remedy: "" };
+  }
+  const actionable = lines.filter((l) => l.state === "residual");
+  return {
+    id,
+    status: "warn",
+    message: lines.map((l) => l.text).join(" \xB7 "),
+    remedy: actionable.length > 0 ? "complete the step named above on each host you use" : "record an observation for the unchecked hosts, or ignore if you do not use them"
+  };
+}
 function reachRunners(opts) {
   return {
     "instruction-path-reach": () => checkInstructionPaths(opts.projectRoot),
     "version-axis": () => checkVersionAxis(opts.projectRoot, opts.resolvableVersion),
-    "override-set": () => checkOverrideSet(opts.projectRoot)
+    "override-set": () => checkOverrideSet(opts.projectRoot),
+    "mcp-consent-residual": () => checkMcpConsentResidual()
   };
 }
 var ROOT_INSTRUCTION_FILES, UNRESOLVABLE_REASONS, BACKTICKED, LINK_TARGET, EXTENSION, SETTINGS_PIN_FILES, PIN_RE, LOCK_VERSION_RE, OVERRIDE_LAYERS, KIND_DIRS, REACH_CHECK_IDS;
 var init_install_reach_checks = __esm({
   "src/scripts/_lib/install_reach_checks.ts"() {
     "use strict";
+    init_mcp_consent_residual();
     ROOT_INSTRUCTION_FILES = [
       "AGENTS.md",
       "CLAUDE.md",
@@ -27981,7 +28315,7 @@ var init_install_reach_checks = __esm({
       { dir: "skills", kind: "skill" },
       { dir: "commands", kind: "command" }
     ];
-    REACH_CHECK_IDS = ["instruction-path-reach", "version-axis", "override-set"];
+    REACH_CHECK_IDS = ["instruction-path-reach", "version-axis", "override-set", "mcp-consent-residual"];
   }
 });
 
@@ -33220,7 +33554,7 @@ var init_detection_report = __esm({
 });
 
 // src/scripts/hooks/state_io.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import fs59 from "node:fs";
 import path61 from "node:path";
 function is_replay_mode() {
@@ -33418,7 +33752,7 @@ function has_stable_session_id(session_id) {
   return typeof session_id === "string" && session_id.trim() !== "";
 }
 function session_state_file(dir, session_id) {
-  const digest = createHash6("sha256").update(session_id, "utf8").digest("hex").slice(0, 32);
+  const digest = createHash7("sha256").update(session_id, "utf8").digest("hex").slice(0, 32);
   return path61.join(dir, `${digest}.json`);
 }
 function restore_claimed_state(tomb, live, link = fs59.linkSync) {
@@ -34093,7 +34427,7 @@ import * as crypto6 from "node:crypto";
 import * as fs64 from "node:fs";
 import * as os14 from "node:os";
 import * as path65 from "node:path";
-import process17 from "node:process";
+import process18 from "node:process";
 import { fileURLToPath as fileURLToPath31, pathToFileURL as pathToFileURL21 } from "node:url";
 function expanduser5(p) {
   if (p === "~") return os14.homedir();
@@ -34230,10 +34564,10 @@ function yamlSafeLoad2(text) {
   }
 }
 function print2(line = "") {
-  process17.stdout.write(line + "\n");
+  process18.stdout.write(line + "\n");
 }
 function eprint2(line = "") {
-  process17.stderr.write(line + "\n");
+  process18.stderr.write(line + "\n");
 }
 function _resolve_project_root(arg) {
   return resolve_project_root(arg);
@@ -34284,7 +34618,7 @@ function _detect_wrapper(project_root) {
   };
 }
 function _emit_trace_text(root, anchor, trace, origin) {
-  print2(`  \u{1F4CD}  start: ${process17.cwd()}`);
+  print2(`  \u{1F4CD}  start: ${process18.cwd()}`);
   print2(`  \u{1F4CD}  origin: ${origin}`);
   if (trace.length > 0) {
     print2("  trace:");
@@ -34304,7 +34638,7 @@ function _emit_trace_text(root, anchor, trace, origin) {
 }
 function _emit_trace_json(root, anchor, trace, origin) {
   const payload = {
-    start: process17.cwd(),
+    start: process18.cwd(),
     origin,
     resolved_root: root !== null ? String(root) : null,
     anchor,
@@ -34744,10 +35078,10 @@ function shutilWhich(name) {
   if (path65.dirname(name) !== "." && (name.includes("/") || name.includes("\\"))) {
     return isExecutableFile(name) ? name : null;
   }
-  const pathEnv = process17.env["PATH"] || "";
-  const sep16 = process17.platform === "win32" ? ";" : ":";
+  const pathEnv = process18.env["PATH"] || "";
+  const sep16 = process18.platform === "win32" ? ";" : ":";
   const dirs = pathEnv.split(sep16);
-  const exts = process17.platform === "win32" ? (process17.env["PATHEXT"] || ".COM;.EXE;.BAT;.CMD").split(";") : [""];
+  const exts = process18.platform === "win32" ? (process18.env["PATHEXT"] || ".COM;.EXE;.BAT;.CMD").split(";") : [""];
   const seenDirs = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
     const d = dir === "" ? "." : dir;
@@ -34770,7 +35104,7 @@ function isExecutableFile(p) {
   try {
     const st = fs64.statSync(p);
     if (!st.isFile()) return false;
-    if (process17.platform === "win32") return true;
+    if (process18.platform === "win32") return true;
     fs64.accessSync(p, fs64.constants.X_OK);
     return true;
   } catch {
@@ -36236,8 +36570,8 @@ function _emit_detection_text(project_root, checks) {
   print2("");
 }
 function _argError9(msg) {
-  process17.stderr.write(USAGE2);
-  process17.stderr.write(`${PROG4}: error: ${msg}
+  process18.stderr.write(USAGE2);
+  process18.stderr.write(`${PROG4}: error: ${msg}
 `);
   throw new ArgparseExit4(2);
 }
@@ -36258,7 +36592,7 @@ function _parse3(argv) {
   while (i < argv.length) {
     const a = argv[i];
     if (a === "-h" || a === "--help") {
-      process17.stdout.write(USAGE2);
+      process18.stdout.write(USAGE2);
       throw new ArgparseExit4(0);
     }
     const eq = a.startsWith("--") ? a.indexOf("=") : -1;
@@ -36316,14 +36650,14 @@ function argMetaName(flag) {
   return flag;
 }
 function _run_trace_root(opts) {
-  const start = process17.cwd();
+  const start = process18.cwd();
   const [root, anchor, trace] = find_project_root_with_trace(start);
   let origin;
-  if (process17.env[ROOT_OVERRIDE_ENV] === "1" && process17.env[PROJECT_ROOT_ENV]) {
+  if (process18.env[ROOT_OVERRIDE_ENV] === "1" && process18.env[PROJECT_ROOT_ENV]) {
     origin = "root-flag";
   } else if (opts.project) {
     origin = "explicit";
-  } else if (process17.env[PROJECT_ROOT_ENV]) {
+  } else if (process18.env[PROJECT_ROOT_ENV]) {
     origin = "env";
   } else if (root !== null) {
     origin = anchor || "unknown";
@@ -36355,8 +36689,8 @@ function _run_context(opts) {
     origin,
     install_mode: mode,
     install_mode_source: mode_source,
-    env_pin: process17.env[PROJECT_ROOT_ENV] || null,
-    root_override: process17.env[ROOT_OVERRIDE_ENV] === "1",
+    env_pin: process18.env[PROJECT_ROOT_ENV] || null,
+    root_override: process18.env[ROOT_OVERRIDE_ENV] === "1",
     settings_layers: _settings_layer_chain(project_root),
     wrapper: _detect_wrapper(project_root)
   };
@@ -36376,7 +36710,7 @@ function _run_anatomy(opts) {
   try {
     economyReport = economy.buildReport({
       root: economy.DEFAULT_PROJECTS_ROOT,
-      auditDir: path65.join(process17.cwd(), economy.DEFAULT_AUDIT_DIR),
+      auditDir: path65.join(process18.cwd(), economy.DEFAULT_AUDIT_DIR),
       maxAgeDays: 14
     });
   } catch (err) {
@@ -36442,7 +36776,7 @@ function _run_repair(opts) {
   return 2;
 }
 function main21(argv = null) {
-  const opts = _parse3(argv !== null ? Array.from(argv) : process17.argv.slice(2));
+  const opts = _parse3(argv !== null ? Array.from(argv) : process18.argv.slice(2));
   validateStrictLevelOr(opts.strict_level, _argError9);
   if (opts.ci) {
     opts.json = true;
@@ -36518,21 +36852,21 @@ function _isCliEntry17() {
   if (bundled && !cliDelegate) {
     return false;
   }
-  if (process17.argv[1] === void 0) {
+  if (process18.argv[1] === void 0) {
     return false;
   }
   if (cliDelegate) {
-    if (path65.basename(process17.argv[1], ".js") === "cmd_doctor") {
+    if (path65.basename(process18.argv[1], ".js") === "cmd_doctor") {
       return true;
     }
   }
-  const argvUrl = pathToFileURL21(path65.resolve(process17.argv[1])).href;
+  const argvUrl = pathToFileURL21(path65.resolve(process18.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
     const here = fs64.realpathSync(fileURLToPath31(import.meta.url));
-    const argv = fs64.realpathSync(path65.resolve(process17.argv[1]));
+    const argv = fs64.realpathSync(path65.resolve(process18.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -36693,12 +37027,12 @@ var init_cmd_doctor = __esm({
       "--check": "check",
       "--repair": "repair"
     };
-    if (_isCliEntry17() || process17.argv[1] === _HERE18) {
+    if (_isCliEntry17() || process18.argv[1] === _HERE18) {
       try {
-        process17.exitCode = main21(process17.argv.slice(2));
+        process18.exitCode = main21(process18.argv.slice(2));
       } catch (e) {
         if (e instanceof ArgparseExit4) {
-          process17.exitCode = e.code;
+          process18.exitCode = e.code;
         } else {
           throw e;
         }
@@ -38963,6 +39297,25 @@ var init_before_complete_hook = __esm({
   }
 });
 
+// src/scripts/_lib/audit_field_provenance.ts
+function appliedIds(values) {
+  const out = [];
+  for (const raw of values ?? []) {
+    const v = String(raw).trim();
+    if (v === "" || out.includes(v)) continue;
+    out.push(v);
+    if (out.length >= MAX_APPLIED_IDS) break;
+  }
+  return out;
+}
+var MAX_APPLIED_IDS;
+var init_audit_field_provenance = __esm({
+  "src/scripts/_lib/audit_field_provenance.ts"() {
+    "use strict";
+    MAX_APPLIED_IDS = 32;
+  }
+});
+
 // src/scripts/_lib/review_skipped_record.ts
 function isNonNegInt(n) {
   return typeof n === "number" && Number.isFinite(n) && Number.isInteger(n) && n >= 0;
@@ -38989,7 +39342,8 @@ function buildReviewSkippedLine(input) {
     risk_class: input.diff_lines >= HIGH_RISK_DIFF_LINES ? "high" : "medium",
     memory: { asks: 0, hits: 0 },
     verify: { claims: 0, first_try_passes: 0 },
-    rules_applied: ["delegation-policy"],
+    // COMPUTED, never a producer constant.
+    rules_applied: appliedIds(input.rules_applied),
     // MANDATORY on every audit line, same as the orchestration producer.
     privacy_class: PRODUCER_PRIVACY_CLASS,
     // `skills_applied` is OMITTED here, deliberately and not by oversight.
@@ -39010,6 +39364,7 @@ var PRODUCER_PRIVACY_CLASS, HIGH_RISK_DIFF_LINES;
 var init_review_skipped_record = __esm({
   "src/scripts/_lib/review_skipped_record.ts"() {
     "use strict";
+    init_audit_field_provenance();
     PRODUCER_PRIVACY_CLASS = "ids-only";
     HIGH_RISK_DIFF_LINES = 200;
   }
@@ -40674,61 +41029,6 @@ var init_evidence_independence = __esm({
   }
 });
 
-// src/scripts/_lib/host_capability.ts
-import process18 from "node:process";
-function asBool(value) {
-  return value === true;
-}
-function normalizeHostManifest(input) {
-  if (input === null || typeof input !== "object") {
-    return { ...SAFE_DEFAULT };
-  }
-  const src = input;
-  return {
-    schema_version: 1,
-    subagent_spawn: asBool(src.subagent_spawn),
-    parallel_spawn: asBool(src.parallel_spawn),
-    status_polling: asBool(src.status_polling),
-    separate_quota_pool: asBool(src.separate_quota_pool),
-    agent_teams: asBool(src.agent_teams),
-    worker_respawn: asBool(src.worker_respawn)
-  };
-}
-function resolveHostCapabilities(hostId, override) {
-  if (override !== void 0 && override !== null && typeof override === "object" && !Array.isArray(override)) {
-    return normalizeHostManifest(override);
-  }
-  const row = hostId !== null && hostId !== void 0 ? HOST_CAPABILITY_REGISTRY[hostId] : void 0;
-  if (row === void 0) {
-    return { ...SAFE_DEFAULT };
-  }
-  return { ...SAFE_DEFAULT, ...row, schema_version: 1 };
-}
-function probeHostCapabilities(hostId) {
-  const base = resolveHostCapabilities(hostId);
-  const flag = process18.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
-  const probedAgentTeams = typeof flag === "string" && flag !== "";
-  return { ...base, agent_teams: base.agent_teams || probedAgentTeams };
-}
-var SAFE_DEFAULT, HOST_CAPABILITY_REGISTRY;
-var init_host_capability = __esm({
-  "src/scripts/_lib/host_capability.ts"() {
-    "use strict";
-    SAFE_DEFAULT = {
-      schema_version: 1,
-      subagent_spawn: false,
-      parallel_spawn: false,
-      status_polling: false,
-      separate_quota_pool: false,
-      agent_teams: false,
-      worker_respawn: false
-    };
-    HOST_CAPABILITY_REGISTRY = {
-      claude: { subagent_spawn: true, parallel_spawn: true }
-    };
-  }
-});
-
 // src/scripts/_lib/auto_dispatch.ts
 function inSession(reason) {
   return { delegable: false, action: "in-session", mode: null, reason };
@@ -41265,7 +41565,7 @@ var init_delegation_nudge_hook = __esm({
 });
 
 // src/scripts/conformance_scan.ts
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import fs73 from "node:fs";
 import os16 from "node:os";
 import path75 from "node:path";
@@ -41636,7 +41936,7 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   };
 }
 function storeKey(store) {
-  return createHash12("sha256").update(path75.resolve(store)).digest("hex").slice(0, 12);
+  return createHash13("sha256").update(path75.resolve(store)).digest("hex").slice(0, 12);
 }
 function scanStore(store, limit) {
   const files = fs73.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs73.statSync(path75.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
@@ -44565,6 +44865,75 @@ var init_aggregator = __esm({
   }
 });
 
+// src/agent-src/templates/scripts/telemetry/mcp_lite.ts
+function _sorted(m) {
+  return [...m.entries()].sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+}
+function render_mcp_lite_markdown(agg) {
+  const lines = [];
+  lines.push("## MCP lite surface");
+  lines.push("");
+  lines.push(`- calls recorded: **${agg.calls}**`);
+  if (agg.earliest_ts && agg.latest_ts) {
+    lines.push(`- ts range: \`${agg.earliest_ts}\` \u2192 \`${agg.latest_ts}\``);
+  }
+  lines.push("");
+  if (agg.calls === 0) {
+    lines.push(ZERO_NOTE);
+    lines.push("");
+    return `${lines.join("\n")}`;
+  }
+  lines.push("| tool | calls |");
+  lines.push("|---|---:|");
+  for (const [tool, n] of _sorted(agg.by_tool)) {
+    check_id_redaction("mcp_lite.by_tool.id", tool);
+    lines.push(`| ${tool} | ${n} |`);
+  }
+  lines.push("");
+  lines.push("| host | calls |");
+  lines.push("|---|---:|");
+  for (const [host, n] of _sorted(agg.by_host)) {
+    check_id_redaction("mcp_lite.by_host.id", host);
+    lines.push(`| ${host} | ${n} |`);
+  }
+  lines.push("");
+  return `${lines.join("\n")}`;
+}
+function mcp_lite_json(agg) {
+  const by_tool = {};
+  for (const [tool, n] of _sorted(agg.by_tool)) {
+    check_id_redaction("mcp_lite.by_tool.id", tool);
+    by_tool[tool] = n;
+  }
+  const by_host = {};
+  for (const [host, n] of _sorted(agg.by_host)) {
+    check_id_redaction("mcp_lite.by_host.id", host);
+    by_host[host] = n;
+  }
+  const by_outcome = {};
+  for (const [outcome, n] of _sorted(agg.by_outcome)) {
+    by_outcome[outcome] = n;
+  }
+  return {
+    log_path: agg.log_path,
+    calls: agg.calls,
+    skipped_lines: agg.skipped_lines,
+    by_tool,
+    by_host,
+    by_outcome,
+    earliest_ts: agg.earliest_ts,
+    latest_ts: agg.latest_ts
+  };
+}
+var ZERO_NOTE;
+var init_mcp_lite = __esm({
+  "src/agent-src/templates/scripts/telemetry/mcp_lite.ts"() {
+    "use strict";
+    init_engagement();
+    ZERO_NOTE = "_No calls recorded. The lite-surface emitter is default-off (`telemetry.artifact_engagement.enabled`), so a zero here says the instrument was off or unused on this machine \u2014 it is not a measurement of what consumers do._";
+  }
+});
+
 // src/agent-src/templates/scripts/telemetry/report_renderer.ts
 var report_renderer_exports = {};
 __export(report_renderer_exports, {
@@ -44674,6 +45043,9 @@ function render_markdown(aggregate3, opts = {}) {
     }
     lines.push("");
   }
+  if (opts.mcp_lite) {
+    lines.push(render_mcp_lite_markdown(opts.mcp_lite));
+  }
   return `${_pyRStrip(lines.join("\n"))}
 `;
 }
@@ -44717,7 +45089,8 @@ function render_json2(aggregate3, opts = {}) {
       since_label
     },
     outcomes: outcomes_payload,
-    buckets: grouped
+    buckets: grouped,
+    ...opts.mcp_lite ? { mcp_lite: mcp_lite_json(opts.mcp_lite) } : {}
   };
   return `${_py_json_dumps_indent2_sorted(payload)}
 `;
@@ -44912,6 +45285,7 @@ var init_report_renderer = __esm({
     "use strict";
     init_aggregator();
     init_engagement();
+    init_mcp_lite();
     QUARTILE_TOP_RATIO = 0.2;
     QUARTILE_BOTTOM_RATIO = 0.2;
     BUCKET_TOP = "essential";
@@ -45516,9 +45890,9 @@ var init_consensus = __esm({
 });
 
 // src/scripts/ai_council/blind_review.ts
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 function _sha256_hex(s) {
-  return createHash13("sha256").update(s, "utf-8").digest("hex");
+  return createHash14("sha256").update(s, "utf-8").digest("hex");
 }
 function deterministic_shuffle_indices(seed, n) {
   const keyed = Array.from({ length: n }, (_, i) => ({ i, key: _sha256_hex(`${seed}\0${i}`) }));
@@ -51531,7 +51905,7 @@ __export(shadow_dispatch_exports, {
   slo_status: () => slo_status
 });
 import * as fs90 from "node:fs";
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 function should_shadow(sampleRate, opts = {}) {
   const rate = Math.max(0, Math.min(1, sampleRate));
   const rng = opts.rng ?? null;
@@ -51540,7 +51914,7 @@ function should_shadow(sampleRate, opts = {}) {
 }
 function _hashQuery(query) {
   const redacted = redact(query);
-  return createHash14("sha256").update(Buffer.from(redacted, "utf-8")).digest("hex").slice(0, 16);
+  return createHash15("sha256").update(Buffer.from(redacted, "utf-8")).digest("hex").slice(0, 16);
 }
 function _privacyDropped(redacted) {
   const stripped = _strip8(redacted);
@@ -56568,7 +56942,7 @@ import { fileURLToPath as fileURLToPath48 } from "node:url";
 init_memory_lookup();
 init_agent_settings();
 init_hook_stdin();
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import * as fs14 from "node:fs";
 import * as path13 from "node:path";
 import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL5 } from "node:url";
@@ -56788,7 +57162,7 @@ function _now() {
 }
 function fingerprint(value) {
   const normalized = _strip2((value || "").replace(_WS_RE, " "));
-  return createHash3("sha256").update(normalized, "utf-8").digest("hex");
+  return createHash4("sha256").update(normalized, "utf-8").digest("hex");
 }
 function derive_session_tag(session_id) {
   if (!session_id) {
@@ -57021,7 +57395,7 @@ function _atomic_write_text(target, text) {
     return;
   }
   const suffix = path13.extname(target);
-  const uniq = `${process.pid}.${createHash3("sha256").update(`${process.pid}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 8)}`;
+  const uniq = `${process.pid}.${createHash4("sha256").update(`${process.pid}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 8)}`;
   const tmp = target.slice(0, target.length - suffix.length) + `${suffix}.${uniq}.tmp`;
   try {
     fs14.writeFileSync(tmp, text, { encoding: "utf-8" });
@@ -58748,22 +59122,27 @@ function _now_iso() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
 }
 function build_record(options) {
-  const { tool_name, outcome, transport, client_id_hash_value, ts } = options;
-  return {
+  const { tool_name, outcome, transport, client_id_hash_value, ts, host } = options;
+  const record = {
     tool_name,
     client_id_hash: client_id_hash_value || hash_client_id(),
     ts: ts || _now_iso(),
     transport,
     outcome
   };
+  if (typeof host === "string" && host !== "") {
+    record.host = host;
+  }
+  return record;
 }
 function record_call(options) {
-  const { tool_name, outcome, transport, consumer_root, client_id_hash_value } = options;
+  const { tool_name, outcome, transport, consumer_root, client_id_hash_value, host } = options;
   const record = build_record({
     tool_name,
     outcome,
     transport,
-    client_id_hash_value
+    client_id_hash_value,
+    host
   });
   const target = _resolve_log_path(consumer_root ?? void 0);
   try {