@event4u/agent-config 14.19.0 → 14.20.0

package/src/scripts/release_publication.ts

@@ -731,8 +731,12 @@ export function guard_release_curation(version: string, prMerged = false): void
                   marked.join('\n')
                 : '') +
             '\n    Stopped BEFORE committing — no release commit, no branch on ' +
-            `${REMOTE}, no pull request, no tag. Curate the ` +
-            '`### Release highlights` head, then re-run `task release`.',
+            `${REMOTE}, no pull request, no tag. HEAD is on the LOCAL ` +
+            `\`release/${version}\` branch and the generated section is in the working ` +
+            'tree: curate the `### Release highlights` head in `CHANGELOG.md` there, then ' +
+            're-run `task release`. That re-run works from this position — `preflightPosition` ' +
+            'accepts the release branch with the uncommitted step-2 output, which it did not ' +
+            'until 2026-09-07 (both spellings of the re-run were refused before step 1).',
     );
 }
 

package/src/scripts/self_repair_cli.ts

@@ -48,6 +48,7 @@ import {
     attachReleaseErrors,
     listRecords,
     markReleased,
+    writeTargetIndex,
     openRecords,
     readOverflow,
     readRecord,
@@ -503,6 +504,30 @@ function releaseCmd(root: string, argv: string[]): number {
     return EXIT_OK;
 }
 
+/**
+ * Rebuild the per-target occurrence index and print it.
+ *
+ * A DERIVED read: the record files are the source, the index is regenerable
+ * and gitignored with the rest of `agents/runtime/`. It exists because
+ * `occurrences` counts a fingerprint (class + normalised evidence shape), so a
+ * rule's weakness showing up in three different shapes was three records with
+ * one occurrence each — and the third-recurrence escalation had nothing that
+ * could ever establish its own precondition.
+ */
+function targetsCmd(root: string): number {
+    const counts = writeTargetIndex(root);
+    if (counts.length === 0) {
+        process.stdout.write('self-repair: no record carries a resolved target yet.\n');
+        return EXIT_OK;
+    }
+    for (const c of counts) {
+        process.stdout.write(
+            `  ${c.target}  ${c.occurrences} occurrence(s) across ${c.records.length} record(s)\n`,
+        );
+    }
+    return EXIT_OK;
+}
+
 export function main(argv: readonly string[]): number {
     const root = process.cwd();
     const sub = argv[0] ?? 'status';
@@ -512,7 +537,12 @@ export function main(argv: readonly string[]): number {
     if (sub === 'release') {
         return releaseCmd(root, [...argv.slice(1)]);
     }
-    process.stderr.write(`self-repair: unknown subcommand '${sub}' (status | release).\n`);
+    if (sub === 'targets') {
+        return targetsCmd(root);
+    }
+    process.stderr.write(
+        `self-repair: unknown subcommand '${sub}' (status | release | targets).\n`,
+    );
     return EXIT_FAIL;
 }
 

package/src/scripts/skill_scout.ts

@@ -48,6 +48,12 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { collect, _keyword_vector, _cosine } from './audit_skill_overlap.js';
 import { reportScanned, DeadScopeError } from './_lib/scan_scope.js';
+import * as sl from './_lib/security_lint.js';
+import { _scan as _scanHiddenUnicode } from './lint_hidden_unicode.js';
+import { _scan as _scanConfusables } from './lint_confusables.js';
+import { _scan as _scanInstructionSmuggling } from './lint_instruction_smuggling.js';
+import { _scan as _scanMcpConfigSecurity } from './lint_mcp_config_security.js';
+import { _scan as _scanFrontmatterSafety } from './lint_skill_frontmatter_safety.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 const _DEFAULT_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
@@ -262,6 +268,60 @@ export function resolveCandidateDir(
     return { dir, refusal: null };
 }
 
+/**
+ * The five content linters, by the check id each one reports under.
+ *
+ * The SAME functions the `lint_agent_security` umbrella spawns as processes.
+ * Called in-process here rather than shelled out: five `tsx` cold starts per
+ * candidate is a cost with no benefit, and the thing that must be identical is
+ * the DETECTION, which is these functions.
+ */
+const CONTENT_LINTERS: ReadonlyArray<readonly [string, (sf: sl.ScannedFile) => sl.Finding[]]> = [
+    ['hidden-unicode', _scanHiddenUnicode],
+    ['mixed-script-confusable', _scanConfusables],
+    ['instruction-smuggling', _scanInstructionSmuggling],
+    ['mcp-config-security', _scanMcpConfigSecurity],
+    ['dangerous-frontmatter', _scanFrontmatterSafety],
+];
+
+/**
+ * Read what a quarantined candidate SAYS, and refuse on a payload.
+ *
+ * `intake`'s other checks are properties of the file — symlink, extension, exec
+ * bit, size. Every one of them can be true of a file whose text tells an agent
+ * to hide its output from the user. "Inert" was a claim about the container that
+ * the gate read as a claim about the contents.
+ *
+ * TWO DELIBERATE DIFFERENCES FROM HOW THESE LINTERS RUN OVER THIS PACKAGE:
+ *
+ * 1. **Any HIGH refuses, whatever its weight.** The 0.25 confidence weighting is
+ *    a false-positive containment device for THIS repository's own corpus, where
+ *    a path containing `docs` or `examples` really is documentation somebody
+ *    here wrote. A quarantined third-party candidate carries no such provenance,
+ *    and a directory named `examples/` in it is an attacker's word for it. A
+ *    refusal is also cheaper than a false pass in exactly this direction: the
+ *    candidate is rejected and a human reads it.
+ * 2. **Every text extension is scanned, not just `.md`.** The candidate
+ *    allow-list already bounds what may be present; a payload in the `.yml` a
+ *    candidate ships is a payload.
+ *
+ * The refusal NAMES the linter, because "the content scan refused this" sends a
+ * reader to five detectors.
+ */
+export function scanCandidateContent(candidateDir: string): string[] {
+    const out: string[] = [];
+    for (const sf of sl.iter_corpus(['.'], [...ALLOWED_EXT], candidateDir)) {
+        for (const [check, scan] of CONTENT_LINTERS) {
+            for (const finding of scan(sf)) {
+                if (finding.severity !== 'HIGH') continue;
+                const loc = finding.line ? `${sf.rel}:${String(finding.line)}` : sf.rel;
+                out.push(`${loc}: flagged by ${check} — ${finding.message}`);
+            }
+        }
+    }
+    return out;
+}
+
 /**
  * Refuse a candidate that is not inert.
  *
@@ -296,6 +356,15 @@ export function intake(candidateDir: string): IntakeResult {
     if (files.length === 0) {
         refusals.push('candidate directory is empty');
     }
+    // Content, after the file properties. Ordering is not cosmetic: a candidate
+    // that fails an inertness check may not be safe to READ (a symlink out of
+    // quarantine is the case the read-time re-check exists for), so the bytes
+    // are only opened once the container has been judged.
+    if (refusals.length === 0) {
+        for (const flagged of scanCandidateContent(candidateDir)) {
+            refusals.push(flagged);
+        }
+    }
     return { accepted: refusals.length === 0, refusals, files_seen: files.length };
 }
 

package/dist/cli-delegate/chunk-2GNWGMAL.js

@@ -1,172 +0,0 @@
-import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
-import {
-  read_lockfile
-} from "./chunk-T7L2QK3K.js";
-
-// src/scripts/_lib/turn_end_refusals.ts
-import * as crypto from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-var DETECTOR_IDS = [
-  "promissory",
-  "language",
-  "verification",
-  "completion"
-];
-var REFUSAL_STATE_REL = path.join("agents", "runtime", "state", "turn-end-gate");
-function refusalStateDir(workspaceRoot) {
-  return path.join(workspaceRoot, REFUSAL_STATE_REL);
-}
-function deriveSessionKey(sessionId) {
-  return crypto.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
-}
-function sessionRefusalFile(workspaceRoot, sessionKey) {
-  return path.join(refusalStateDir(workspaceRoot), `${sessionKey}.json`);
-}
-function readSessionCounts(workspaceRoot, sessionId) {
-  try {
-    const raw = fs.readFileSync(
-      sessionRefusalFile(workspaceRoot, deriveSessionKey(sessionId)),
-      "utf-8"
-    );
-    const rec = parseRecord(raw);
-    return rec === null ? null : countsOf(rec);
-  } catch {
-    return null;
-  }
-}
-function emptyCounts() {
-  return { promissory: 0, language: 0, verification: 0, completion: 0 };
-}
-function isDetector(v) {
-  return typeof v === "string" && DETECTOR_IDS.includes(v);
-}
-function parseRecord(raw) {
-  let decoded;
-  try {
-    decoded = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return null;
-  const o = decoded;
-  if (typeof o["refused_at"] !== "string") return null;
-  if (typeof o["refused_turn"] !== "number") return null;
-  if (!isDetector(o["detector"])) return null;
-  const rec = {
-    refused_at: o["refused_at"],
-    refused_turn: o["refused_turn"],
-    detector: o["detector"]
-  };
-  if (typeof o["first_refused_at"] === "string") rec.first_refused_at = o["first_refused_at"];
-  if (typeof o["agent_config_version"] === "string") {
-    rec.agent_config_version = o["agent_config_version"];
-  }
-  const counts = o["counts"];
-  if (typeof counts === "object" && counts !== null && !Array.isArray(counts)) {
-    const parsed = {};
-    for (const id of DETECTOR_IDS) {
-      const n = counts[id];
-      if (typeof n === "number" && Number.isFinite(n) && n >= 0) parsed[id] = n;
-    }
-    rec.counts = parsed;
-  }
-  return rec;
-}
-function countsOf(rec) {
-  const out = emptyCounts();
-  if (rec.counts === void 0) {
-    out[rec.detector] = 1;
-    return out;
-  }
-  let any = false;
-  for (const id of DETECTOR_IDS) {
-    const n = rec.counts[id];
-    if (typeof n === "number" && n > 0) {
-      out[id] = n;
-      any = true;
-    }
-  }
-  if (!any) out[rec.detector] = 1;
-  return out;
-}
-function foldRefusal(prev, input) {
-  const counts = prev === null ? emptyCounts() : countsOf(prev);
-  for (const d of input.detectors) counts[d] += 1;
-  const primary = input.detectors[0] ?? prev?.detector ?? "verification";
-  const rec = {
-    refused_at: input.at,
-    refused_turn: input.turnOrdinal,
-    detector: primary,
-    first_refused_at: prev?.first_refused_at ?? prev?.refused_at ?? input.at,
-    counts
-  };
-  if (input.version !== void 0) rec.agent_config_version = input.version;
-  else if (prev?.agent_config_version !== void 0) {
-    rec.agent_config_version = prev.agent_config_version;
-  }
-  return rec;
-}
-function readInstallBoundary() {
-  try {
-    const lock = read_lockfile();
-    if (lock === null) return { version: null, installed_at: null };
-    return {
-      version: lock.agent_config_version ?? null,
-      installed_at: lock.installed_at ?? null
-    };
-  } catch {
-    return { version: null, installed_at: null };
-  }
-}
-var REFUSAL_STATE_MAX_AGE_DAYS = 90;
-function pruneAgedRefusalState(workspaceRoot, opts = {}) {
-  const maxAgeDays = opts.maxAgeDays ?? REFUSAL_STATE_MAX_AGE_DAYS;
-  const now = opts.now ?? /* @__PURE__ */ new Date();
-  const dir = refusalStateDir(workspaceRoot);
-  const result = { scanned: 0, pruned: 0, kept: 0 };
-  let entries;
-  try {
-    entries = fs.readdirSync(dir);
-  } catch {
-    return result;
-  }
-  const cutoffMs = now.getTime() - maxAgeDays * 24 * 60 * 60 * 1e3;
-  for (const name of entries) {
-    if (!name.endsWith(".json")) continue;
-    result.scanned += 1;
-    const file = path.join(dir, name);
-    let rec = null;
-    try {
-      rec = parseRecord(fs.readFileSync(file, "utf-8"));
-    } catch {
-      rec = null;
-    }
-    if (rec === null) {
-      result.kept += 1;
-      continue;
-    }
-    const at = Date.parse(rec.refused_at);
-    if (!Number.isFinite(at) || at >= cutoffMs) {
-      result.kept += 1;
-      continue;
-    }
-    try {
-      fs.unlinkSync(file);
-      result.pruned += 1;
-    } catch {
-      result.kept += 1;
-    }
-  }
-  return result;
-}
-
-export {
-  deriveSessionKey,
-  sessionRefusalFile,
-  readSessionCounts,
-  parseRecord,
-  foldRefusal,
-  readInstallBoundary,
-  pruneAgedRefusalState
-};

package/dist/cli-delegate/chunk-LPPWO5CE.js

@@ -1,161 +0,0 @@
-import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
-import {
-  statePathFor
-} from "./chunk-7PRE6ZV2.js";
-import {
-  git_common_dir
-} from "./chunk-E4XIZDIB.js";
-
-// src/scripts/_lib/envelope_grounding.ts
-import { execFileSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-// src/scripts/_lib/git_env.ts
-var GIT_DISCOVERY_VARS = [
-  "GIT_DIR",
-  "GIT_WORK_TREE",
-  "GIT_INDEX_FILE",
-  "GIT_OBJECT_DIRECTORY",
-  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-  "GIT_COMMON_DIR",
-  "GIT_NAMESPACE",
-  "GIT_PREFIX"
-];
-function gitEnv(base = process.env) {
-  const env = { ...base };
-  for (const key of GIT_DISCOVERY_VARS) {
-    delete env[key];
-  }
-  return env;
-}
-
-// src/scripts/_lib/envelope_grounding.ts
-var MAX_FIELD_CHARS = 200;
-var MAX_PATHS = 40;
-function git(root, args) {
-  try {
-    return execFileSync("git", args, {
-      cwd: root,
-      env: gitEnv(),
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function canonicalizeRepoIdentity(raw) {
-  let s = raw.trim();
-  s = s.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
-  s = s.replace(/^[^/@]+@/, "");
-  s = s.replace(/^([^/:]+):(?!\/)/, "$1/");
-  s = s.replace(/\/+$/, "");
-  s = s.replace(/\.git$/i, "");
-  const slash = s.indexOf("/");
-  if (slash > 0) {
-    s = s.slice(0, slash).toLowerCase() + s.slice(slash);
-  } else {
-    s = s.toLowerCase();
-  }
-  return s;
-}
-function collectRepoAnchor(root) {
-  const remote = git(root, ["config", "--get", "remote.origin.url"]);
-  let identity = null;
-  if (remote) {
-    identity = canonicalizeRepoIdentity(remote);
-  } else {
-    const common = git_common_dir(root);
-    if (common !== null) {
-      try {
-        identity = fs.realpathSync(common);
-      } catch {
-        identity = common;
-      }
-    }
-  }
-  return {
-    repo_identity: identity ? identity.slice(0, MAX_FIELD_CHARS) : null,
-    branch: git(root, ["rev-parse", "--abbrev-ref", "HEAD"]),
-    head: git(root, ["rev-parse", "HEAD"])
-  };
-}
-function readLastVerify(root, session_id) {
-  if (typeof session_id !== "string" || session_id.trim() === "") return null;
-  try {
-    const raw = fs.readFileSync(path.join(root, statePathFor(session_id)), "utf-8");
-    const state = JSON.parse(raw);
-    const lv = state["last_verification"];
-    if (typeof lv !== "object" || lv === null || Array.isArray(lv)) return null;
-    const rec = lv;
-    const command = typeof rec["command"] === "string" ? rec["command"] : null;
-    if (!command) return null;
-    const at = typeof rec["at"] === "string" ? rec["at"] : "unknown time";
-    const flat = `${command} @ ${at} (no exit status is recorded anywhere)`.replace(/\s+/g, " ").trim();
-    return flat.slice(0, MAX_FIELD_CHARS);
-  } catch {
-    return null;
-  }
-}
-function collectGrounding(root, session_id) {
-  const anchor = collectRepoAnchor(root);
-  const porcelain = git(root, ["status", "--porcelain"]);
-  if (porcelain === null) {
-    return { ...anchor, uncommitted_paths: [], status_summary: null, last_verify: readLastVerify(root, session_id) };
-  }
-  const lines = porcelain.split("\n").filter((l) => l.trim().length > 0);
-  const paths = lines.map((l) => l.slice(3).trim()).filter((p) => p.length > 0 && p.length <= MAX_FIELD_CHARS).slice(0, MAX_PATHS);
-  return {
-    ...anchor,
-    uncommitted_paths: paths,
-    status_summary: lines.length === 0 ? "clean working tree" : `${lines.length} uncommitted path(s)${lines.length > MAX_PATHS ? `, first ${MAX_PATHS} listed` : ""}`,
-    last_verify: readLastVerify(root, session_id)
-  };
-}
-function describeDrift(envelope, actual) {
-  if (typeof envelope !== "object" || envelope === null || Array.isArray(envelope)) return [];
-  const e = envelope;
-  const drift = [];
-  const recordedIdentity = typeof e["repo_identity"] === "string" ? e["repo_identity"] : null;
-  if (recordedIdentity && actual.repo_identity && recordedIdentity !== actual.repo_identity) {
-    drift.push(
-      `IDENTITY DRIFT: this envelope was written in "${recordedIdentity}", you are in "${actual.repo_identity}". Re-verify every path before acting \u2014 same branch name does not mean same working tree.`
-    );
-  }
-  const recordedBranch = typeof e["branch"] === "string" ? e["branch"] : null;
-  if (recordedBranch && actual.branch && recordedBranch !== actual.branch) {
-    drift.push(
-      `BRANCH DRIFT: envelope written on "${recordedBranch}", checkout is on "${actual.branch}".`
-    );
-  }
-  const recordedHead = typeof e["head"] === "string" ? e["head"] : null;
-  if (recordedHead && actual.head && recordedHead !== actual.head) {
-    drift.push(
-      `COMMIT DRIFT: envelope written at ${recordedHead.slice(0, 12)}, HEAD is now ${actual.head.slice(0, 12)} \u2014 re-read anything the envelope quotes.`
-    );
-  }
-  return drift;
-}
-
-// src/scripts/_lib/recycle_envelope_paths.ts
-import * as path2 from "node:path";
-var RECYCLE_ENVELOPE_REL = path2.join("agents", "runtime", "state", "recycle-envelope.json");
-var RECYCLE_CONSUMED_REL = path2.join(
-  "agents",
-  "runtime",
-  "state",
-  "recycle-envelope.consumed.json"
-);
-var RECYCLE_MAX_AGE_HOURS = 48;
-var RECYCLE_ENVELOPE_MAX_BYTES = 6144;
-
-export {
-  collectRepoAnchor,
-  collectGrounding,
-  describeDrift,
-  RECYCLE_ENVELOPE_REL,
-  RECYCLE_CONSUMED_REL,
-  RECYCLE_MAX_AGE_HOURS,
-  RECYCLE_ENVELOPE_MAX_BYTES
-};