@event4u/agent-config 14.19.0 → 14.20.0

package/dist/cli-delegate/{chunk-IDHUQIXP.js → chunk-NUMQHLS5.js}

@@ -34,11 +34,13 @@ import {
   DEFAULT_DEPLOY_ROOTS,
   MANAGED_SIGNATURE,
   SCHEMA_VERSIONS_SUPPORTED,
+  TOOL_TO_HOST,
   build_claude_hook_matrix,
   global_deploy_inventory_exports,
   manifest_path,
-  read_manifest
-} from "./chunk-PMEKGDED.js";
+  read_manifest,
+  residualReport
+} from "./chunk-PI2GU3DP.js";
 import {
   read_lockfile
 } from "./chunk-T7L2QK3K.js";
@@ -2779,12 +2781,27 @@ function checkOverrideSet(projectRoot) {
     remedy: "route it through the upstream-contribution path, never by changing a shipped default on one install"
   };
 }
-var REACH_CHECK_IDS = ["instruction-path-reach", "version-axis", "override-set"];
+function checkMcpConsentResidual() {
+  const id = "mcp-consent-residual";
+  const lines = residualReport(Object.keys(TOOL_TO_HOST));
+  if (lines.length === 0) {
+    return { id, status: "ok", message: "no MCP consent residual recorded for any known host", remedy: "" };
+  }
+  const actionable = lines.filter((l) => l.state === "residual");
+  return {
+    id,
+    status: "warn",
+    message: lines.map((l) => l.text).join(" \xB7 "),
+    remedy: actionable.length > 0 ? "complete the step named above on each host you use" : "record an observation for the unchecked hosts, or ignore if you do not use them"
+  };
+}
+var REACH_CHECK_IDS = ["instruction-path-reach", "version-axis", "override-set", "mcp-consent-residual"];
 function reachRunners(opts) {
   return {
     "instruction-path-reach": () => checkInstructionPaths(opts.projectRoot),
     "version-axis": () => checkVersionAxis(opts.projectRoot, opts.resolvableVersion),
-    "override-set": () => checkOverrideSet(opts.projectRoot)
+    "override-set": () => checkOverrideSet(opts.projectRoot),
+    "mcp-consent-residual": () => checkMcpConsentResidual()
   };
 }
 

package/dist/cli-delegate/{chunk-PMEKGDED.js → chunk-PI2GU3DP.js}

@@ -968,6 +968,164 @@ function splitlines2(text) {
   return parts;
 }
 
+// src/scripts/_lib/host_capability.ts
+import process2 from "node:process";
+var SAFE_DEFAULT = {
+  schema_version: 1,
+  subagent_spawn: false,
+  parallel_spawn: false,
+  status_polling: false,
+  separate_quota_pool: false,
+  agent_teams: false,
+  worker_respawn: false,
+  reads_project_mcp_config: false,
+  // `true` because the safe answer here is "there is still a step", not
+  // "there is nothing to do" — see the field's own note.
+  mcp_needs_manual_activation: true
+};
+function asBool(value) {
+  return value === true;
+}
+function normalizeHostManifest(input) {
+  if (input === null || typeof input !== "object") {
+    return { ...SAFE_DEFAULT };
+  }
+  const src = input;
+  return {
+    schema_version: 1,
+    subagent_spawn: asBool(src.subagent_spawn),
+    parallel_spawn: asBool(src.parallel_spawn),
+    status_polling: asBool(src.status_polling),
+    separate_quota_pool: asBool(src.separate_quota_pool),
+    agent_teams: asBool(src.agent_teams),
+    worker_respawn: asBool(src.worker_respawn),
+    reads_project_mcp_config: asBool(src.reads_project_mcp_config),
+    // Inverted coercion, matching the inverted default: only an explicit
+    // `false` clears the residual, so an absent or malformed value keeps
+    // the manual step visible instead of silently dropping it.
+    mcp_needs_manual_activation: src.mcp_needs_manual_activation !== false
+  };
+}
+var HOST_CAPABILITY_REGISTRY = {
+  claude: { subagent_spawn: true, parallel_spawn: true }
+};
+function resolveHostCapabilities(hostId, override) {
+  if (override !== void 0 && override !== null && typeof override === "object" && !Array.isArray(override)) {
+    return normalizeHostManifest(override);
+  }
+  const row = hostId !== null && hostId !== void 0 ? HOST_CAPABILITY_REGISTRY[hostId] : void 0;
+  if (row === void 0) {
+    return { ...SAFE_DEFAULT };
+  }
+  return { ...SAFE_DEFAULT, ...row, schema_version: 1 };
+}
+function probeHostCapabilities(hostId) {
+  const base = resolveHostCapabilities(hostId);
+  const flag = process2.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+  const probedAgentTeams = typeof flag === "string" && flag !== "";
+  return { ...base, agent_teams: base.agent_teams || probedAgentTeams };
+}
+var CAPABILITY_FIELDS = [
+  "subagent_spawn",
+  "parallel_spawn",
+  "status_polling",
+  "separate_quota_pool",
+  "agent_teams",
+  "worker_respawn",
+  "reads_project_mcp_config",
+  "mcp_needs_manual_activation"
+];
+function describeHostCapabilities(hostId) {
+  const manifest = probeHostCapabilities(hostId);
+  const row = hostId !== null && hostId !== void 0 ? HOST_CAPABILITY_REGISTRY[hostId] : void 0;
+  const flag = process2.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+  const probedAgentTeams = typeof flag === "string" && flag !== "";
+  const sources = {};
+  for (const field of CAPABILITY_FIELDS) {
+    if (row !== void 0 && typeof row[field] === "boolean") {
+      sources[field] = "registry";
+    } else if (field === "agent_teams" && probedAgentTeams) {
+      sources[field] = "live-probe";
+    } else {
+      sources[field] = "default";
+    }
+  }
+  return { manifest, sources };
+}
+
+// src/scripts/_lib/mcp_consent_residual.ts
+var SEEDED = {
+  claude: {
+    hostId: "claude",
+    residual: "Approve the project-scoped `agent-config` server the first time the host prompts \u2014 the installer writes `.mcp.json` but does not pre-approve it.",
+    source: "vendor-doc",
+    cite: "Host documentation: a project-scope MCP server requires explicit approval, suppressible only through the user-global `enabledMcpjsonServers` key, which this package deliberately does not write (blocker `mcp-user-scope-approval-consent`)."
+  }
+};
+var TOOL_TO_HOST = {
+  "claude-code": "claude",
+  cursor: "cursor",
+  "gemini-cli": "gemini",
+  windsurf: "windsurf",
+  cline: "cline",
+  copilot: "copilot",
+  augment: "augment"
+};
+function residualFor(hostId) {
+  const { manifest, sources } = describeHostCapabilities(hostId);
+  if (sources.mcp_needs_manual_activation === "registry" && !manifest.mcp_needs_manual_activation) {
+    return null;
+  }
+  return SEEDED[hostId] ?? null;
+}
+function isRecorded(hostId) {
+  const { sources } = describeHostCapabilities(hostId);
+  return hostId in SEEDED || sources.mcp_needs_manual_activation === "registry";
+}
+function residualLine(hostId) {
+  const r = residualFor(hostId);
+  if (r !== null) {
+    return {
+      hostId,
+      state: "residual",
+      text: `${hostId}: ${r.residual} (source: ${r.source} \u2014 not observed here)`
+    };
+  }
+  if (isRecorded(hostId)) {
+    return {
+      hostId,
+      state: "cleared",
+      text: `${hostId}: nothing left to do (source: observed)`
+    };
+  }
+  return {
+    hostId,
+    state: "unrecorded",
+    text: `${hostId}: no residual recorded \u2014 nobody checked this host, which is not the same as nothing to do`
+  };
+}
+function residualReport(toolIds) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const toolId of toolIds) {
+    const hostId = TOOL_TO_HOST[toolId];
+    if (hostId === void 0 || seen.has(hostId)) continue;
+    seen.add(hostId);
+    const line = residualLine(hostId);
+    if (line.state !== "cleared") out.push(line);
+  }
+  return out;
+}
+function printResiduals(toolIds, quiet, write = (s) => process.stdout.write(s)) {
+  if (quiet) return;
+  const lines = residualReport(toolIds);
+  if (lines.length === 0) return;
+  write("  Still needs you (MCP):\n");
+  for (const line of lines) write(`    \u2022 ${line.text}
+`);
+  write("\n");
+}
+
 export {
   SCHEMA_VERSIONS_SUPPORTED,
   DEFAULT_DEPLOY_ROOTS,
@@ -977,6 +1135,7 @@ export {
   ScopeMismatchError,
   upsert_tool,
   atomicAppendLine,
+  probeHostCapabilities,
   MANAGED_SIGNATURE,
   build_claude_hook_matrix,
   ensure_managed_hooks,
@@ -988,5 +1147,8 @@ export {
   reap_tagged_orphans,
   record_deploy,
   is_ancestor,
-  global_deploy_inventory_exports
+  global_deploy_inventory_exports,
+  TOOL_TO_HOST,
+  residualReport,
+  printResiduals
 };

package/dist/cli-delegate/{chunk-7PRE6ZV2.js → chunk-YS6XTLEK.js}

@@ -9,6 +9,9 @@ import {
   session_state_file,
   update_json_under_lock
 } from "./chunk-E4XIZDIB.js";
+import {
+  read_lockfile
+} from "./chunk-T7L2QK3K.js";
 
 // src/scripts/_lib/secret_detector.ts
 var ENTROPY_MIN_TOKEN_LENGTH = 20;
@@ -219,7 +222,8 @@ var EPISTEMIC = new Set(EPISTEMIC_STATES);
 var MAX_REF_CHARS = 200;
 var MAX_LINE_CHARS = 240;
 var MAX_ENTRIES = 40;
-var CAPSULE_SCHEMA_VERSION = 3;
+var CAPSULE_SCHEMA_VERSION = 4;
+var ACCEPTED_CAPSULE_VERSIONS = [3, 4];
 function isShortLine(value, max) {
   return typeof value === "string" && value.length > 0 && value.length <= max && !value.includes("\n");
 }
@@ -378,6 +382,10 @@ var RECYCLE_ENVELOPE_KEYS = /* @__PURE__ */ new Set([
   "next_task",
   "suggested_skills",
   "failed_approaches",
+  "successful_approaches",
+  "open_questions",
+  "predecessor",
+  "session_id",
   "repo_identity",
   "branch",
   "head",
@@ -398,9 +406,11 @@ function validateRecycleEnvelope(input) {
       );
     }
   }
-  if (e["capsule_version"] !== CAPSULE_SCHEMA_VERSION) {
-    errors.push(`capsule_version must be ${CAPSULE_SCHEMA_VERSION}`);
+  const version = e["capsule_version"];
+  if (typeof version !== "number" || !ACCEPTED_CAPSULE_VERSIONS.includes(version)) {
+    errors.push(`capsule_version must be one of ${ACCEPTED_CAPSULE_VERSIONS.join(" | ")}`);
   }
+  const atV4 = version === 4;
   if (e["variant"] !== "main_session") {
     errors.push("variant must be 'main_session'");
   }
@@ -439,6 +449,26 @@ function validateRecycleEnvelope(input) {
       'failed_approaches must carry at least one entry \u2014 write "none" explicitly, so silence and "nothing was abandoned" stay distinguishable'
     );
   }
+  checkList(errors, "successful_approaches", e["successful_approaches"], MAX_LINE_CHARS, atV4);
+  if (Array.isArray(e["successful_approaches"]) && e["successful_approaches"].length === 0) {
+    errors.push(
+      'successful_approaches must carry at least one entry \u2014 write "none" explicitly, so silence and "nothing worked" stay distinguishable'
+    );
+  }
+  checkList(errors, "open_questions", e["open_questions"], MAX_LINE_CHARS, false);
+  const predecessor = e["predecessor"];
+  if (predecessor === void 0) {
+    if (atV4) {
+      errors.push(
+        'predecessor is required \u2014 name the session this one continues, or write "none" explicitly for the first session in a workspace'
+      );
+    }
+  } else if (!isShortLine(predecessor, MAX_REF_CHARS)) {
+    errors.push(`predecessor must be a single line of 1\u2013${MAX_REF_CHARS} chars ("none" when there is no predecessor)`);
+  }
+  if (e["session_id"] !== void 0 && !isShortLine(e["session_id"], MAX_REF_CHARS)) {
+    errors.push(`session_id must be a single line of 1\u2013${MAX_REF_CHARS} chars`);
+  }
   for (const field of ["repo_identity", "branch", "head", "status_summary", "last_verify"]) {
     if (e[field] !== void 0 && !isShortLine(e[field], MAX_REF_CHARS)) {
       errors.push(`${field} must be a single line of 1\u2013${MAX_REF_CHARS} chars`);
@@ -803,6 +833,164 @@ if (isCliEntry) {
   process.exit(main(process.argv.slice(2)));
 }
 
+// src/scripts/_lib/turn_end_refusals.ts
+import * as crypto from "node:crypto";
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+var DETECTOR_IDS = [
+  "promissory",
+  "language",
+  "verification",
+  "completion"
+];
+var REFUSAL_STATE_REL = path2.join("agents", "runtime", "state", "turn-end-gate");
+function refusalStateDir(workspaceRoot) {
+  return path2.join(workspaceRoot, REFUSAL_STATE_REL);
+}
+function deriveSessionKey(sessionId) {
+  return crypto.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
+}
+function sessionRefusalFile(workspaceRoot, sessionKey) {
+  return path2.join(refusalStateDir(workspaceRoot), `${sessionKey}.json`);
+}
+function readSessionCounts(workspaceRoot, sessionId) {
+  try {
+    const raw = fs2.readFileSync(
+      sessionRefusalFile(workspaceRoot, deriveSessionKey(sessionId)),
+      "utf-8"
+    );
+    const rec = parseRecord(raw);
+    return rec === null ? null : countsOf(rec);
+  } catch {
+    return null;
+  }
+}
+function emptyCounts() {
+  return { promissory: 0, language: 0, verification: 0, completion: 0 };
+}
+function isDetector(v) {
+  return typeof v === "string" && DETECTOR_IDS.includes(v);
+}
+function parseRecord(raw) {
+  let decoded;
+  try {
+    decoded = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return null;
+  const o = decoded;
+  if (typeof o["refused_at"] !== "string") return null;
+  if (typeof o["refused_turn"] !== "number") return null;
+  if (!isDetector(o["detector"])) return null;
+  const rec = {
+    refused_at: o["refused_at"],
+    refused_turn: o["refused_turn"],
+    detector: o["detector"]
+  };
+  if (typeof o["first_refused_at"] === "string") rec.first_refused_at = o["first_refused_at"];
+  if (typeof o["agent_config_version"] === "string") {
+    rec.agent_config_version = o["agent_config_version"];
+  }
+  const counts = o["counts"];
+  if (typeof counts === "object" && counts !== null && !Array.isArray(counts)) {
+    const parsed = {};
+    for (const id of DETECTOR_IDS) {
+      const n = counts[id];
+      if (typeof n === "number" && Number.isFinite(n) && n >= 0) parsed[id] = n;
+    }
+    rec.counts = parsed;
+  }
+  return rec;
+}
+function countsOf(rec) {
+  const out = emptyCounts();
+  if (rec.counts === void 0) {
+    out[rec.detector] = 1;
+    return out;
+  }
+  let any = false;
+  for (const id of DETECTOR_IDS) {
+    const n = rec.counts[id];
+    if (typeof n === "number" && n > 0) {
+      out[id] = n;
+      any = true;
+    }
+  }
+  if (!any) out[rec.detector] = 1;
+  return out;
+}
+function foldRefusal(prev, input) {
+  const counts = prev === null ? emptyCounts() : countsOf(prev);
+  for (const d of input.detectors) counts[d] += 1;
+  const primary = input.detectors[0] ?? prev?.detector ?? "verification";
+  const rec = {
+    refused_at: input.at,
+    refused_turn: input.turnOrdinal,
+    detector: primary,
+    first_refused_at: prev?.first_refused_at ?? prev?.refused_at ?? input.at,
+    counts
+  };
+  if (input.version !== void 0) rec.agent_config_version = input.version;
+  else if (prev?.agent_config_version !== void 0) {
+    rec.agent_config_version = prev.agent_config_version;
+  }
+  return rec;
+}
+function readInstallBoundary() {
+  try {
+    const lock = read_lockfile();
+    if (lock === null) return { version: null, installed_at: null };
+    return {
+      version: lock.agent_config_version ?? null,
+      installed_at: lock.installed_at ?? null
+    };
+  } catch {
+    return { version: null, installed_at: null };
+  }
+}
+var REFUSAL_STATE_MAX_AGE_DAYS = 90;
+function pruneAgedRefusalState(workspaceRoot, opts = {}) {
+  const maxAgeDays = opts.maxAgeDays ?? REFUSAL_STATE_MAX_AGE_DAYS;
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const dir = refusalStateDir(workspaceRoot);
+  const result = { scanned: 0, pruned: 0, kept: 0 };
+  let entries;
+  try {
+    entries = fs2.readdirSync(dir);
+  } catch {
+    return result;
+  }
+  const cutoffMs = now.getTime() - maxAgeDays * 24 * 60 * 60 * 1e3;
+  for (const name of entries) {
+    if (!name.endsWith(".json")) continue;
+    result.scanned += 1;
+    const file = path2.join(dir, name);
+    let rec = null;
+    try {
+      rec = parseRecord(fs2.readFileSync(file, "utf-8"));
+    } catch {
+      rec = null;
+    }
+    if (rec === null) {
+      result.kept += 1;
+      continue;
+    }
+    const at = Date.parse(rec.refused_at);
+    if (!Number.isFinite(at) || at >= cutoffMs) {
+      result.kept += 1;
+      continue;
+    }
+    try {
+      fs2.unlinkSync(file);
+      result.pruned += 1;
+    } catch {
+      result.kept += 1;
+    }
+  }
+  return result;
+}
+
 export {
   statePathFor,
   isVacuousOutput,
@@ -813,5 +1001,12 @@ export {
   wrapAsPriorSessionData,
   hasBoundaryMarker,
   validateRecycleEnvelope,
-  validateAssumption
+  validateAssumption,
+  deriveSessionKey,
+  sessionRefusalFile,
+  readSessionCounts,
+  parseRecord,
+  foldRefusal,
+  readInstallBoundary,
+  pruneAgedRefusalState
 };