@event4u/agent-config 14.21.0 → 14.23.0

package/src/scripts/hooks/block_speaking_inbox_dir.ts

@@ -22,7 +22,13 @@
  *
  * Refuses: a Write/Edit/NotebookEdit (or cross-platform equivalent) whose
  * target path introduces a **new** first-level directory under `agents/tmp/`
- * or `agents/tmp.old/` whose name is not an opaque round identifier.
+ * or `agents/tmp.old/` whose name is not an opaque round identifier — and a
+ * shell command carrying its path. Two narrowings bring the code closer to
+ * that sentence without classifying commands: a read tool's `file_path` is
+ * filtered by `_READ_ONLY_TOOLS`, and a directory name that is a GLOB over an
+ * acceptable one is not a creatable literal
+ * ({@link isGlobOverAcceptableInboxDir}). Both were judged unconditionally
+ * before, which is what refused a read command in this guard's own workflow.
  *
  * Allowed, deliberately:
  *
@@ -62,6 +68,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { isNonHarvestTmpDir, isOpaqueRoundId } from '../_lib/source_shape.js';
+import { invokedSegments } from './git_command_classifier.js';
 import { readHookStdin } from './hook_stdin.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -76,10 +83,146 @@ const _PATH_KEYS: readonly string[] = [
     'file_path', 'path', 'target_file', 'filename', 'filePath', 'notebook_path',
 ];
 
+/**
+ * Tools whose `file_path` names something to READ, never something to write.
+ *
+ * `_PATH_KEYS` covers `file_path` and `path`, which is exactly what a Read,
+ * Grep or Glob call carries — so a search under a speaking round that does not
+ * exist yet was refused by a guard whose own docstring scopes itself to
+ * `Write/Edit/NotebookEdit`. Filtering here rather than through the manifest's
+ * `tools:` key on purpose: that key is an exact match on the host's own tool
+ * name, so an allowlist written in Claude's vocabulary would silence this
+ * guard on every host that spells its write tools differently. A DENY-list of
+ * read tools fails the other way — an unrecognised tool is still judged.
+ *
+ * An envelope with no tool name is judged too, for the same reason
+ * `_concern_matches_tool` runs a concern when the field is absent: a key that
+ * cannot decide must not be what silences a blocking guard.
+ */
+const _READ_ONLY_TOOLS: ReadonlySet<string> = new Set([
+    'read', 'grep', 'glob', 'notebookread', 'ls', 'view', 'search',
+    'codebase-retrieval', 'codebase_retrieval', 'file_search', 'grep_search',
+    'read_file', 'list_dir', 'semantic_search',
+]);
+
 function _isObject(v: JsonValue | undefined): v is JsonObject {
     return v !== null && v !== undefined && typeof v === 'object' && !Array.isArray(v);
 }
 
+/**
+ * A directory name that is a GLOB over an already-acceptable name.
+ *
+ * READING IS NOT CREATING, AND THE COMMAND SCAN DID NOT KNOW IT. Measured
+ * twice in one session while running the inbox flow over a real round:
+ * `ls -d agents/tmp/inbox-2026-09-*` — the command the naming rule tells an
+ * operator to run to find a free round identifier — was refused, because the
+ * scan in `main` offered every whitespace token to the same verdict that judges
+ * a Write target and `inbox-2026-09-*` is not an opaque identifier: the `*`
+ * fails the 1-3 char disambiguator. So the guard stood between the operator and
+ * the rule it exists to enforce.
+ *
+ * WHY THIS AXIS AND NOT THE VERB. The first two attempts classified the
+ * COMMAND — an allowlist of read-only verbs, then per-verb writing markers.
+ * Two rounds of neutral review took that apart from both ends: round 1 found
+ * `sed -i`, `find -exec` and `awk system()` allowed where the plain token scan
+ * had blocked them; round 2 found the siblings the resulting deny-list did not
+ * reach (`sed`'s `s///w`, `awk`'s output pipe, `sort -o`, `yq -i`), a false
+ * positive the awk marker reintroduced by running past the program into a shell
+ * redirect, mention-blocking on heredoc bodies, and a fail-OPEN when the
+ * segmenter returned nothing. Its handoff named the shape of the problem:
+ * *"3 and 5 pull in opposite directions, so patching them one probe at a time
+ * will keep oscillating."*
+ *
+ * It was the wrong axis, and the measured defect never needed it. What is
+ * actually decidable from the token alone is whether the name could be created
+ * AS WRITTEN, and a glob cannot: the shell expands it against what exists. The
+ * one thing that could — `mkdir 'inbox-2026-09-*'`, creating a literal
+ * directory with a `*` in it — produces a name this predicate accepts anyway,
+ * because its non-glob part is opaque and carries no source. So the carve-out
+ * is safe by construction rather than by enumeration, and every writing form
+ * above is judged again by the unchanged token scan.
+ *
+ * A pattern over a SPEAKING name (`my-source-*`) is not accepted: the glob
+ * characters are removed and the remainder must itself pass.
+ */
+function isGlobOverAcceptableInboxDir(name: string): boolean {
+    if (!/[*?[\]]/.test(name)) {
+        return false;
+    }
+    const literal = name.replace(/[*?]|\[[^\]]*\]/g, '');
+    const trimmed = literal.replace(/-+$/, '');
+    return trimmed !== '' && isAcceptableInboxDir(trimmed);
+}
+
+/**
+ * The paths a redirect inside one segment would create.
+ *
+ * `splitOutsideQuotes` treats `;`, `|`, `&` and newline as separators and `>`
+ * as ordinary text, so a redirect target stays inside its segment. Collected
+ * separately from the token scan because the quotes matter: the token split
+ * removes them, this does not, and both inbox regexes need `agents` at a `/`
+ * or at the start — so `> "agents/tmp/<name>/x"` read as not-an-inbox-path
+ * until the strip below. Also run over the RAW command, because the heredoc
+ * regex in `invokedSegments` swallows a redirect that follows the delimiter.
+ */
+function _redirectTargets(segment: string): string[] {
+    const out: string[] = [];
+    const re = /(?:^|[^0-9<>&])[0-9]*>>?\s*([^\s|&;<>]+)/g;
+    let m: RegExpExecArray | null = re.exec(segment);
+    while (m !== null) {
+        // The character class stops at whitespace and separators but NOT at a
+        // quote, while both inbox regexes require `agents` at a `/` or at the
+        // start of the string. So `> "agents/tmp/<name>/x"` came back as
+        // `"agents/tmp/…` and read as not-an-inbox-path — allowed, where the
+        // unquoted form blocked. A neutral review probed it; stripping the
+        // quotes is the whole fix.
+        const target = (m[1] ?? '').replace(/^['"`]+|['"`]+$/g, '');
+        if (target) {
+            out.push(target);
+        }
+        m = re.exec(segment);
+    }
+    return out;
+}
+
+/**
+ * The tokens of a shell command whose CREATION this guard should judge.
+ *
+ * Every whitespace token, exactly as before this change — the classification
+ * that tried to be cleverer than this is gone, and the docstring on
+ * {@link isGlobOverAcceptableInboxDir} records why. The two things kept are
+ * the ones no review disputed: the RAW command is scanned as well, because
+ * `invokedSegments` strips heredoc bodies as data and a `python3 - <<PY` body
+ * calling `makedirs` is precisely this guard's input; and redirect targets are
+ * collected separately with their quotes stripped, because `>` is not a
+ * segment separator and `> "path"` otherwise read as not-a-path.
+ *
+ * Scanning the raw command in addition to the segments is deliberately
+ * redundant rather than conditional: a heredoc predicate is one more thing to
+ * get wrong, the extra tokens can only ever matter if one of them names a
+ * speaking inbox directory, and the mention-blocking a review found came from
+ * the read-only SKIP being dropped for heredocs — not from the extra scan.
+ *
+ * Exported so the harness can pin the polarity pair on the tokens themselves,
+ * without an envelope.
+ */
+export function creatableTokens(command: string): string[] {
+    const out: string[] = [];
+    const segments = invokedSegments(command);
+    for (const seg of segments) {
+        out.push(..._redirectTargets(seg));
+    }
+    out.push(..._redirectTargets(command));
+    for (const text of [...segments, command]) {
+        for (const tok of text.split(/[\s"'`(){};|&<>]+/)) {
+            if (tok) {
+                out.push(tok);
+            }
+        }
+    }
+    return out;
+}
+
 /** `agents/tmp/<name>/…` or `agents/tmp.old/<name>/…`, after normalisation. */
 const INBOX_RE = /(?:^|\/)agents\/tmp(?:\.old)?\/([^/]+)\/./;
 
@@ -145,6 +288,9 @@ export function verdictFor(
     if (isAcceptableInboxDir(dir)) {
         return { block: false, dir, reason: 'opaque round identifier or named working set' };
     }
+    if (isGlobOverAcceptableInboxDir(dir)) {
+        return { block: false, dir, reason: 'glob over an acceptable name — not a creatable literal' };
+    }
     // Already created — a rename is the fix, and refusing every later write
     // would wedge the round without removing the name.
     //
@@ -153,17 +299,36 @@ export function verdictFor(
     // `agents/tmp-notes/` and `agents/tmpfiles/`, and taking the FIRST
     // occurrence meant a path carrying a decoy earlier segment probed the wrong
     // directory — in either direction. Found by the R2 review of this branch.
+    // THE CAPTURE CARRIES THE PATH'S OWN PREFIX, and it did not. Anchoring the
+    // group at `agents/` discarded everything before it, so a nested inbox —
+    // `app/Modules/<m>/agents/tmp/<round>/…`, the shape a module-per-package
+    // tree produces — probed `<repoRoot>/agents/tmp/<round>`, a directory that
+    // does not exist. The already-exists carve-out could therefore never fire
+    // there, and every write into a nested speaking round was refused forever
+    // instead of once.
+    //
+    // The prefix group is `??` — optional AND preferring ABSENT — and that is
+    // the half a neutral review had to point out. A greedy `(?:.*\/)?`
+    // resolves to the LAST inbox segment in the path while `inboxDirName`
+    // reads the FIRST, so a path carrying two of them judged one directory and
+    // probed another, reporting "already exists" for a name that does not.
+    // Making only `.*` lazy is NOT enough: `(...)?` still prefers one
+    // repetition, so the engine grows the prefix rather than trying the
+    // no-prefix branch, and the long match wins anyway — the test for this
+    // caught exactly that. `??` tries no-prefix first, so both reads agree.
+    // The decoy case below still resolves: `agents/tmp-notes/` fails the `/`
+    // after `tmp`, so the no-prefix branch is rejected and the match advances.
     const normalized = filePath.replace(/\\/g, '/').replace(/^(\.\/)+/, '');
     const m =
-        /(?:^|\/)(agents\/tmp(?:\.old)?\/[^/]+)\//.exec(normalized) ??
-        /(?:^|\/)(agents\/tmp(?:\.old)?\/[^/.]+)\/?$/.exec(normalized);
+        /^((?:.*?\/)??agents\/tmp(?:\.old)?\/[^/]+)\//.exec(normalized) ??
+        /^((?:.*?\/)??agents\/tmp(?:\.old)?\/[^/.]+)\/?$/.exec(normalized);
     if (m === null) {
         // `inboxDirName` matched but this did not — treat as unattributable and
         // BLOCK, since the name is speaking and we cannot prove it pre-exists.
         return { block: true, dir, reason: 'new inbox directory with a speaking name (path not re-anchorable)' };
     }
     const upto = m[1] as string;
-    const probe = repoRoot === '' ? upto : path.join(repoRoot, upto);
+    const probe = repoRoot === '' || path.isAbsolute(upto) ? upto : path.join(repoRoot, upto);
     if (exists(probe)) {
         return { block: false, dir, reason: 'directory already exists — rename, do not re-refuse' };
     }
@@ -216,11 +381,15 @@ export function main(): number {
             return 0;
         }
         const repoRoot = typeof envelope['project_dir'] === 'string' ? envelope['project_dir'] : '';
+        const rawTool = payload['tool_name'] ?? envelope['tool_name'];
+        const toolName = typeof rawTool === 'string' ? rawTool.trim().toLowerCase() : '';
         const candidates: string[] = [];
-        for (const key of _PATH_KEYS) {
-            const v = ti[key];
-            if (typeof v === 'string' && v) {
-                candidates.push(v);
+        if (!_READ_ONLY_TOOLS.has(toolName)) {
+            for (const key of _PATH_KEYS) {
+                const v = ti[key];
+                if (typeof v === 'string' && v) {
+                    candidates.push(v);
+                }
             }
         }
         // A shell command creates the directory just as effectively as a Write,
@@ -228,16 +397,13 @@ export function main(): number {
         // agents/tmp/<speaking-name>`, a `git mv` into one, or a redirect
         // bypassed it entirely. Both siblings on this slot (`block_no_verify`,
         // `block_kernel_rule_writes`) parse the command string; this one did
-        // not, and the R2 review of this branch caught it. Every whitespace
-        // token of the command is offered to the same pure verdict, so the
-        // decision logic is shared rather than duplicated.
+        // not, and the R2 review of this branch caught it. The tokens that
+        // could CREATE something are offered to the same pure verdict, so the
+        // decision logic is shared rather than duplicated — see
+        // `creatableTokens` for why "every whitespace token" was too many.
         const cmd = ti['command'] ?? (_isObject(envelope['payload']) ? (envelope['payload'] as JsonObject)['command'] : undefined);
         if (typeof cmd === 'string' && cmd) {
-            for (const tok of cmd.split(/[\s"'`(){};|&<>]+/)) {
-                if (tok) {
-                    candidates.push(tok);
-                }
-            }
+            candidates.push(...creatableTokens(cmd));
         }
         for (const v of candidates) {
             const verdict = verdictFor(v, (p) => fs.existsSync(p), repoRoot);

package/src/scripts/hooks/chain_nudge_hook.ts

@@ -0,0 +1,282 @@
+#!/usr/bin/env tsx
+/**
+ * PreToolUse chain nudge — deterministic, warn-only.
+ *
+ * WHY A CARRIER EXISTS AT ALL. `token-efficiency` § One command per Bash call
+ * is `type: auto`, so its triggers match the PROMPT, and no prompt announces
+ * that the next tool call will be a chained Bash command. The obligation
+ * applies at tool-call time and was reachable by nothing there. This concern
+ * is that reach, and it is the only thing in the tree that reads
+ * `tool_input.command` for this purpose.
+ *
+ * WHAT IT IS FOR, MEASURED. The host splits a compound command on `&&`, `||`,
+ * `;`, `|`, `|&`, `&` and newlines and requires each segment to match the
+ * allowlist independently, so one unmatched segment sends the whole call down
+ * the permission path even when every other segment was already allowed. Over
+ * 40,268 real Bash calls on the maintainer's machine, 17.9 % had a head token
+ * matching no pattern and 5,037 of those were a leading `VAR=…` assignment —
+ * a shape that cannot be written as an allowlist pattern at all. That class
+ * shrinks only by not writing it.
+ *
+ * WHAT IT DOES NOT FLAG, DELIBERATELY. A pipe of ordinary filters
+ * (`grep foo file | head`) is one command with a filter, not two work steps.
+ * A redirect has its target checked against the file rules on its own. A
+ * heredoc is a command with input. Flagging any of those would make the
+ * nudge noise, and a nudge that fires on correct usage is worse than none.
+ *
+ * NEVER BLOCKS. The dispatcher contract is 0 allow · 2 warn, and a warn on
+ * `pre_tool_use` with `severity: advisory` is an injection, not a deny — the
+ * same channel `code-graph-nudge` and `ui-route-nudge` already use. Every
+ * failure path returns allow: unreadable stdin, malformed JSON, unwritable
+ * latch. A token optimisation must never break a tool call.
+ *
+ * ONCE PER SESSION. A latch keyed by session id, in the state directory
+ * `code-graph-nudge.json` already occupies. The rule body reaches the model
+ * once, early, on the first chained call — repeating it every call would be
+ * the nagging this codebase refuses elsewhere.
+ *
+ * ON BY DEFAULT, WITH AN OPT-OUT. Unlike `code-graph-nudge`, which gates on a
+ * project capability that may not exist, the fact this nudge carries is a
+ * property of the HOST's permission matcher and is therefore true in every
+ * consumer. `hooks.chain_nudge.enabled: false` turns it off.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { readHookStdin } from './hook_stdin.js';
+
+const SETTINGS_FILE = '.agent-settings.yml';
+const EXIT_ALLOW = 0;
+const EXIT_WARN = 2;
+
+type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
+type JsonObject = { [k: string]: JsonValue };
+
+function isObject(v: unknown): v is JsonObject {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+/**
+ * `hooks.chain_nudge.enabled: false` mini-parser. Absent means ON, which is
+ * the inverse of `code_graph_nudge.enabled` and stated in the header: the
+ * fact carried here holds on every host, so absent-means-off would ship a
+ * carrier nobody receives.
+ */
+export function enabled(root: string): boolean {
+    let text: string;
+    try {
+        const f = path.join(root, SETTINGS_FILE);
+        if (!fs.statSync(f).isFile()) return true;
+        text = fs.readFileSync(f, 'utf-8');
+    } catch {
+        return true;
+    }
+    let inHooks = false;
+    let inCn = false;
+    for (const raw of text.split(/\r\n|\r|\n/)) {
+        const line = raw.replace(/\s+$/, '');
+        if (!line || line.replace(/^\s+/, '').startsWith('#')) continue;
+        if (!(line.startsWith(' ') || line.startsWith('\t'))) {
+            inHooks = /^hooks\s*:\s*$/.test(line);
+            inCn = false;
+            continue;
+        }
+        if (inHooks) {
+            if (/^\s+chain_nudge\s*:\s*$/.test(line)) {
+                inCn = true;
+                continue;
+            }
+            if (inCn && /^\s{0,3}\S/.test(line)) inCn = false;
+        }
+        if (inCn && /^\s+enabled\s*:\s*false\b/.test(line)) return false;
+    }
+    return true;
+}
+
+/**
+ * Strip quoted spans and heredoc bodies so an operator inside a string
+ * literal cannot be read as chaining. `grep "a && b" f` is one command, and a
+ * scanner that misses that fires on correct usage — the failure this concern
+ * must not have.
+ */
+export function stripLiterals(cmd: string): string {
+    let out = '';
+    let i = 0;
+    let quote: string | null = null;
+    while (i < cmd.length) {
+        const c = cmd[i] as string;
+        if (quote) {
+            if (c === '\\' && quote === '"') {
+                i += 2;
+                continue;
+            }
+            if (c === quote) quote = null;
+            i += 1;
+            continue;
+        }
+        if (c === '\\') {
+            i += 2;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            quote = c;
+            i += 1;
+            continue;
+        }
+        const heredoc = /^<<-?\s*'?"?([A-Za-z_][A-Za-z0-9_]*)'?"?/.exec(cmd.slice(i));
+        if (heredoc) {
+            const tag = heredoc[1] as string;
+            const end = cmd.indexOf(`\n${tag}`, i);
+            i = end === -1 ? cmd.length : end + tag.length + 1;
+            continue;
+        }
+        out += c;
+        i += 1;
+    }
+    return out;
+}
+
+/** What the nudge saw, or null when the command is not chained work. */
+export function detectChaining(command: string): string | null {
+    const bare = stripLiterals(command);
+    if (/^\s*[A-Za-z_][A-Za-z0-9_]*=/.test(bare) && /[;\n]/.test(bare)) {
+        return 'a leading `VAR=…` assignment carrying state into a later segment';
+    }
+    if (/&&|\|\|/.test(bare)) return 'work steps chained with `&&` / `||`';
+    if (/;\s*\S/.test(bare)) return 'work steps chained with `;`';
+    return null;
+}
+
+/**
+ * Tools that carry a shell command. Mirrors `ship_diff_volume_hook` and
+ * `git_command_classifier` rather than hardcoding `Bash`: the tool name is
+ * host-specific, and the manifest's own `code-graph-nudge` block warns about
+ * exactly this spread. A named tool outside the set is declined; a payload
+ * naming no tool still reads, which is the bare-host shape.
+ */
+const COMMAND_TOOLS: ReadonlySet<string> = new Set([
+    'launch-process',
+    'launch_process',
+    'Bash',
+    'BashTool',
+    'run-process',
+    'runProcess',
+    'shell',
+    'execute_shell',
+    'RunShellCommand',
+]);
+
+/** The shell command this call carries, or '' when it carries none. */
+export function bashCommand(envelope: JsonObject): string {
+    const payload = isObject(envelope['payload']) ? envelope['payload'] : envelope;
+    const nameVal = payload['tool_name'] ?? payload['toolName'] ?? payload['tool'];
+    if (typeof nameVal === 'string' && !COMMAND_TOOLS.has(nameVal)) return '';
+    const ti = payload['tool_input'] ?? payload['toolInput'];
+    if (isObject(ti)) {
+        const c = ti['command'];
+        if (typeof c === 'string') return c;
+    }
+    const c = payload['command'];
+    return typeof c === 'string' ? c : '';
+}
+
+function sessionId(envelope: JsonObject): string {
+    const s = envelope['session_id'] ?? envelope['sessionId'];
+    return typeof s === 'string' && s ? s : 'default';
+}
+
+function latchFile(root: string): string {
+    return path.join(root, 'agents', 'runtime', 'state', 'chain-nudge.json');
+}
+
+function alreadyNudged(root: string, session: string): boolean {
+    try {
+        const state = JSON.parse(fs.readFileSync(latchFile(root), 'utf-8')) as Record<string, boolean>;
+        return state[session] === true;
+    } catch {
+        return false;
+    }
+}
+
+function latch(root: string, session: string): void {
+    try {
+        const p = latchFile(root);
+        let state: Record<string, boolean> = {};
+        try {
+            state = JSON.parse(fs.readFileSync(p, 'utf-8')) as Record<string, boolean>;
+        } catch {
+            /* fresh */
+        }
+        state[session] = true;
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, JSON.stringify(state));
+    } catch {
+        /* fail-open: a persistence failure must not break the tool call */
+    }
+}
+
+/** The nudge line — one line, names what was seen and what to do instead. */
+export function nudgeReason(seen: string): string {
+    return (
+        `This Bash call chains work: ${seen}. The host matches each segment against ` +
+        'the allowlist independently, so one unmatched segment sends the whole call ' +
+        'down the permission path. Send N commands as N Bash calls in ONE block — ' +
+        'that is the batch. `D=/repo; cd $D && git status` is `git -C /repo status`. ' +
+        'Pipes of filters, redirects and heredocs are fine and are not what this flags. ' +
+        'See `token-efficiency` § One command per Bash call.'
+    );
+}
+
+export function main(): number {
+    let envelope: JsonValue;
+    try {
+        const raw = readHookStdin();
+        envelope = raw.trim() ? (JSON.parse(raw) as JsonValue) : {};
+    } catch {
+        return EXIT_ALLOW;
+    }
+    if (!isObject(envelope)) return EXIT_ALLOW;
+
+    // ORDER IS LOAD-BEARING, and getting it wrong cost 26 ms at p95. Every
+    // predicate below that touches the filesystem runs AFTER the in-memory
+    // ones, so the overwhelming majority of tool calls — every non-shell
+    // call, and every unchained shell call — exit having read no file at all.
+    // The first draft called `enabled()` first, which put a settings read in
+    // front of every single pre_tool_use event on the host.
+    const command = bashCommand(envelope);
+    if (!command) return EXIT_ALLOW;
+
+    const seen = detectChaining(command);
+    if (!seen) return EXIT_ALLOW;
+
+    const cwd = envelope['cwd'];
+    const pr = envelope['workspace_root'] ?? envelope['project_root'];
+    const root = typeof cwd === 'string' && cwd ? cwd : typeof pr === 'string' && pr ? pr : '.';
+    if (!enabled(root)) return EXIT_ALLOW;
+
+    const session = sessionId(envelope);
+    if (alreadyNudged(root, session)) return EXIT_ALLOW;
+
+    latch(root, session);
+    process.stdout.write(`${JSON.stringify({ decision: 'warn', reason: nudgeReason(seen) })}\n`);
+    return EXIT_WARN;
+}
+
+// Bundle-safety: never auto-run when inlined into an esbuild bundle, where
+// every module shares the bundle's `import.meta.url` (see cmd_migrate.ts).
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+function isCliEntry(): boolean {
+    if (typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__) {
+        return false;
+    }
+    if (process.argv[1] === undefined) return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) return true;
+    try {
+        return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(process.argv[1]));
+    } catch {
+        return false;
+    }
+}
+if (isCliEntry()) process.exit(main());