@event4u/agent-config 14.19.0 → 14.21.0

package/dist/cli-delegate/{chunk-IDHUQIXP.js → chunk-J3RFNKG4.js}

@@ -17,16 +17,19 @@ import {
 } from "./chunk-M2DPGFZ4.js";
 import {
   DEFAULT_PROJECTS_ROOT,
+  DEFAULT_SEAT_CEILING,
+  admitsContent,
   aggregateByBucket,
   billableInputTokens,
   clients_exports,
   config_exports,
   hardenedSpawnEnv,
   load_cli_call_counts,
+  policyExclusionReason,
   projectStoreSlug,
   scanTranscripts,
   weightedInputUnits
-} from "./chunk-KPBWFOPZ.js";
+} from "./chunk-2FTMENJL.js";
 import {
   git_common_dir
 } from "./chunk-E4XIZDIB.js";
@@ -34,11 +37,13 @@ import {
   DEFAULT_DEPLOY_ROOTS,
   MANAGED_SIGNATURE,
   SCHEMA_VERSIONS_SUPPORTED,
+  TOOL_TO_HOST,
   build_claude_hook_matrix,
   global_deploy_inventory_exports,
   manifest_path,
-  read_manifest
-} from "./chunk-PMEKGDED.js";
+  read_manifest,
+  residualReport
+} from "./chunk-2TAQ2K4V.js";
 import {
   read_lockfile
 } from "./chunk-T7L2QK3K.js";
@@ -2779,12 +2784,27 @@ function checkOverrideSet(projectRoot) {
     remedy: "route it through the upstream-contribution path, never by changing a shipped default on one install"
   };
 }
-var REACH_CHECK_IDS = ["instruction-path-reach", "version-axis", "override-set"];
+function checkMcpConsentResidual() {
+  const id = "mcp-consent-residual";
+  const lines = residualReport(Object.keys(TOOL_TO_HOST));
+  if (lines.length === 0) {
+    return { id, status: "ok", message: "no MCP consent residual recorded for any known host", remedy: "" };
+  }
+  const actionable = lines.filter((l) => l.state === "residual");
+  return {
+    id,
+    status: "warn",
+    message: lines.map((l) => l.text).join(" \xB7 "),
+    remedy: actionable.length > 0 ? "complete the step named above on each host you use" : "record an observation for the unchecked hosts, or ignore if you do not use them"
+  };
+}
+var REACH_CHECK_IDS = ["instruction-path-reach", "version-axis", "override-set", "mcp-consent-residual"];
 function reachRunners(opts) {
   return {
     "instruction-path-reach": () => checkInstructionPaths(opts.projectRoot),
     "version-axis": () => checkVersionAxis(opts.projectRoot, opts.resolvableVersion),
-    "override-set": () => checkOverrideSet(opts.projectRoot)
+    "override-set": () => checkOverrideSet(opts.projectRoot),
+    "mcp-consent-residual": () => checkMcpConsentResidual()
   };
 }
 
@@ -3151,6 +3171,22 @@ function resolveTransport(opts) {
   const auth = strongestAuth(report, provider);
   const authSource = auth?.source ?? null;
   const billing = classifyBilling(provider, authSource);
+  const exclusion = opts.policyExclusion ?? null;
+  if (exclusion !== null) {
+    return unavailable(provider, billing, policyExclusionReason(exclusion, provider), exclusion);
+  }
+  const contentClass = opts.contentClass ?? null;
+  if (contentClass !== null) {
+    const verdict = admitsContent(opts.seatCeiling ?? DEFAULT_SEAT_CEILING, contentClass);
+    if (!verdict.admitted) {
+      return unavailable(
+        provider,
+        billing,
+        `${provider}: ${verdict.reason ?? "content ceiling refused the payload"}`,
+        "policy_content_ceiling"
+      );
+    }
+  }
   if (mode === "manual") {
     return {
       available: true,

package/dist/cli-delegate/{chunk-7PRE6ZV2.js → chunk-YS6XTLEK.js}

@@ -9,6 +9,9 @@ import {
   session_state_file,
   update_json_under_lock
 } from "./chunk-E4XIZDIB.js";
+import {
+  read_lockfile
+} from "./chunk-T7L2QK3K.js";
 
 // src/scripts/_lib/secret_detector.ts
 var ENTROPY_MIN_TOKEN_LENGTH = 20;
@@ -219,7 +222,8 @@ var EPISTEMIC = new Set(EPISTEMIC_STATES);
 var MAX_REF_CHARS = 200;
 var MAX_LINE_CHARS = 240;
 var MAX_ENTRIES = 40;
-var CAPSULE_SCHEMA_VERSION = 3;
+var CAPSULE_SCHEMA_VERSION = 4;
+var ACCEPTED_CAPSULE_VERSIONS = [3, 4];
 function isShortLine(value, max) {
   return typeof value === "string" && value.length > 0 && value.length <= max && !value.includes("\n");
 }
@@ -378,6 +382,10 @@ var RECYCLE_ENVELOPE_KEYS = /* @__PURE__ */ new Set([
   "next_task",
   "suggested_skills",
   "failed_approaches",
+  "successful_approaches",
+  "open_questions",
+  "predecessor",
+  "session_id",
   "repo_identity",
   "branch",
   "head",
@@ -398,9 +406,11 @@ function validateRecycleEnvelope(input) {
       );
     }
   }
-  if (e["capsule_version"] !== CAPSULE_SCHEMA_VERSION) {
-    errors.push(`capsule_version must be ${CAPSULE_SCHEMA_VERSION}`);
+  const version = e["capsule_version"];
+  if (typeof version !== "number" || !ACCEPTED_CAPSULE_VERSIONS.includes(version)) {
+    errors.push(`capsule_version must be one of ${ACCEPTED_CAPSULE_VERSIONS.join(" | ")}`);
   }
+  const atV4 = version === 4;
   if (e["variant"] !== "main_session") {
     errors.push("variant must be 'main_session'");
   }
@@ -439,6 +449,26 @@ function validateRecycleEnvelope(input) {
       'failed_approaches must carry at least one entry \u2014 write "none" explicitly, so silence and "nothing was abandoned" stay distinguishable'
     );
   }
+  checkList(errors, "successful_approaches", e["successful_approaches"], MAX_LINE_CHARS, atV4);
+  if (Array.isArray(e["successful_approaches"]) && e["successful_approaches"].length === 0) {
+    errors.push(
+      'successful_approaches must carry at least one entry \u2014 write "none" explicitly, so silence and "nothing worked" stay distinguishable'
+    );
+  }
+  checkList(errors, "open_questions", e["open_questions"], MAX_LINE_CHARS, false);
+  const predecessor = e["predecessor"];
+  if (predecessor === void 0) {
+    if (atV4) {
+      errors.push(
+        'predecessor is required \u2014 name the session this one continues, or write "none" explicitly for the first session in a workspace'
+      );
+    }
+  } else if (!isShortLine(predecessor, MAX_REF_CHARS)) {
+    errors.push(`predecessor must be a single line of 1\u2013${MAX_REF_CHARS} chars ("none" when there is no predecessor)`);
+  }
+  if (e["session_id"] !== void 0 && !isShortLine(e["session_id"], MAX_REF_CHARS)) {
+    errors.push(`session_id must be a single line of 1\u2013${MAX_REF_CHARS} chars`);
+  }
   for (const field of ["repo_identity", "branch", "head", "status_summary", "last_verify"]) {
     if (e[field] !== void 0 && !isShortLine(e[field], MAX_REF_CHARS)) {
       errors.push(`${field} must be a single line of 1\u2013${MAX_REF_CHARS} chars`);
@@ -803,6 +833,164 @@ if (isCliEntry) {
   process.exit(main(process.argv.slice(2)));
 }
 
+// src/scripts/_lib/turn_end_refusals.ts
+import * as crypto from "node:crypto";
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+var DETECTOR_IDS = [
+  "promissory",
+  "language",
+  "verification",
+  "completion"
+];
+var REFUSAL_STATE_REL = path2.join("agents", "runtime", "state", "turn-end-gate");
+function refusalStateDir(workspaceRoot) {
+  return path2.join(workspaceRoot, REFUSAL_STATE_REL);
+}
+function deriveSessionKey(sessionId) {
+  return crypto.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
+}
+function sessionRefusalFile(workspaceRoot, sessionKey) {
+  return path2.join(refusalStateDir(workspaceRoot), `${sessionKey}.json`);
+}
+function readSessionCounts(workspaceRoot, sessionId) {
+  try {
+    const raw = fs2.readFileSync(
+      sessionRefusalFile(workspaceRoot, deriveSessionKey(sessionId)),
+      "utf-8"
+    );
+    const rec = parseRecord(raw);
+    return rec === null ? null : countsOf(rec);
+  } catch {
+    return null;
+  }
+}
+function emptyCounts() {
+  return { promissory: 0, language: 0, verification: 0, completion: 0 };
+}
+function isDetector(v) {
+  return typeof v === "string" && DETECTOR_IDS.includes(v);
+}
+function parseRecord(raw) {
+  let decoded;
+  try {
+    decoded = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return null;
+  const o = decoded;
+  if (typeof o["refused_at"] !== "string") return null;
+  if (typeof o["refused_turn"] !== "number") return null;
+  if (!isDetector(o["detector"])) return null;
+  const rec = {
+    refused_at: o["refused_at"],
+    refused_turn: o["refused_turn"],
+    detector: o["detector"]
+  };
+  if (typeof o["first_refused_at"] === "string") rec.first_refused_at = o["first_refused_at"];
+  if (typeof o["agent_config_version"] === "string") {
+    rec.agent_config_version = o["agent_config_version"];
+  }
+  const counts = o["counts"];
+  if (typeof counts === "object" && counts !== null && !Array.isArray(counts)) {
+    const parsed = {};
+    for (const id of DETECTOR_IDS) {
+      const n = counts[id];
+      if (typeof n === "number" && Number.isFinite(n) && n >= 0) parsed[id] = n;
+    }
+    rec.counts = parsed;
+  }
+  return rec;
+}
+function countsOf(rec) {
+  const out = emptyCounts();
+  if (rec.counts === void 0) {
+    out[rec.detector] = 1;
+    return out;
+  }
+  let any = false;
+  for (const id of DETECTOR_IDS) {
+    const n = rec.counts[id];
+    if (typeof n === "number" && n > 0) {
+      out[id] = n;
+      any = true;
+    }
+  }
+  if (!any) out[rec.detector] = 1;
+  return out;
+}
+function foldRefusal(prev, input) {
+  const counts = prev === null ? emptyCounts() : countsOf(prev);
+  for (const d of input.detectors) counts[d] += 1;
+  const primary = input.detectors[0] ?? prev?.detector ?? "verification";
+  const rec = {
+    refused_at: input.at,
+    refused_turn: input.turnOrdinal,
+    detector: primary,
+    first_refused_at: prev?.first_refused_at ?? prev?.refused_at ?? input.at,
+    counts
+  };
+  if (input.version !== void 0) rec.agent_config_version = input.version;
+  else if (prev?.agent_config_version !== void 0) {
+    rec.agent_config_version = prev.agent_config_version;
+  }
+  return rec;
+}
+function readInstallBoundary() {
+  try {
+    const lock = read_lockfile();
+    if (lock === null) return { version: null, installed_at: null };
+    return {
+      version: lock.agent_config_version ?? null,
+      installed_at: lock.installed_at ?? null
+    };
+  } catch {
+    return { version: null, installed_at: null };
+  }
+}
+var REFUSAL_STATE_MAX_AGE_DAYS = 90;
+function pruneAgedRefusalState(workspaceRoot, opts = {}) {
+  const maxAgeDays = opts.maxAgeDays ?? REFUSAL_STATE_MAX_AGE_DAYS;
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const dir = refusalStateDir(workspaceRoot);
+  const result = { scanned: 0, pruned: 0, kept: 0 };
+  let entries;
+  try {
+    entries = fs2.readdirSync(dir);
+  } catch {
+    return result;
+  }
+  const cutoffMs = now.getTime() - maxAgeDays * 24 * 60 * 60 * 1e3;
+  for (const name of entries) {
+    if (!name.endsWith(".json")) continue;
+    result.scanned += 1;
+    const file = path2.join(dir, name);
+    let rec = null;
+    try {
+      rec = parseRecord(fs2.readFileSync(file, "utf-8"));
+    } catch {
+      rec = null;
+    }
+    if (rec === null) {
+      result.kept += 1;
+      continue;
+    }
+    const at = Date.parse(rec.refused_at);
+    if (!Number.isFinite(at) || at >= cutoffMs) {
+      result.kept += 1;
+      continue;
+    }
+    try {
+      fs2.unlinkSync(file);
+      result.pruned += 1;
+    } catch {
+      result.kept += 1;
+    }
+  }
+  return result;
+}
+
 export {
   statePathFor,
   isVacuousOutput,
@@ -813,5 +1001,12 @@ export {
   wrapAsPriorSessionData,
   hasBoundaryMarker,
   validateRecycleEnvelope,
-  validateAssumption
+  validateAssumption,
+  deriveSessionKey,
+  sessionRefusalFile,
+  readSessionCounts,
+  parseRecord,
+  foldRefusal,
+  readInstallBoundary,
+  pruneAgedRefusalState
 };