@event4u/agent-config 14.6.0 → 14.8.0

package/dist/cli-delegate/{chunk-63WSP6YZ.js → chunk-PMEKGDED.js}

@@ -1,112 +1,20 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
-  write_target
-} from "./chunk-NDJLNC6Q.js";
+  write_atomic
+} from "./chunk-MWRD5YOH.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
+import {
+  write_target
+} from "./chunk-NDJLNC6Q.js";
 import {
   __export,
   __toESM
 } from "./chunk-J55WI3RR.js";
 
-// src/scripts/_lib/fs_atomic.ts
-import fs from "node:fs";
-import path from "node:path";
-import { randomBytes } from "node:crypto";
-function _normalize_encoding(encoding) {
-  const compact = encoding.toLowerCase().replace(/[-_\s]/g, "");
-  const candidates = [encoding, compact];
-  if (compact === "latin1" || compact === "iso88591") candidates.push("latin1");
-  if (compact === "utf8") candidates.push("utf8");
-  if (compact === "utf16le" || compact === "utf16") candidates.push("utf16le");
-  if (compact === "usascii") candidates.push("ascii");
-  for (const c of candidates) {
-    if (Buffer.isEncoding(c)) return c;
-  }
-  throw new Error(`unknown encoding: ${encoding}`);
-}
-function write_atomic(p, data, options = {}) {
-  const encoding = options.encoding ?? "utf-8";
-  const target = path.normalize(p);
-  const parent = path.dirname(target);
-  fs.mkdirSync(parent, { recursive: true });
-  let payload;
-  if (typeof data === "string") {
-    payload = Buffer.from(data, _normalize_encoding(encoding));
-  } else if (data instanceof Uint8Array) {
-    payload = Buffer.from(data);
-  } else {
-    throw new TypeError(
-      `write_atomic: data must be str or bytes, got ${typeof data}`
-    );
-  }
-  let fd = null;
-  let tmp_path = "";
-  for (let attempt = 0; attempt < 32; attempt += 1) {
-    tmp_path = path.join(
-      parent,
-      `.${path.basename(target)}.tmp.${randomBytes(6).toString("hex")}`
-    );
-    try {
-      fd = fs.openSync(tmp_path, "wx", 384);
-      break;
-    } catch (err) {
-      if (err.code === "EEXIST") continue;
-      throw err;
-    }
-  }
-  if (fd === null) {
-    throw new Error("write_atomic: could not create a unique temp file");
-  }
-  let closed = false;
-  try {
-    let offset = 0;
-    while (offset < payload.length) {
-      offset += fs.writeSync(fd, payload, offset, payload.length - offset);
-    }
-    try {
-      fs.fsyncSync(fd);
-    } catch {
-    }
-    fs.closeSync(fd);
-    closed = true;
-    fs.renameSync(tmp_path, target);
-  } catch (err) {
-    if (!closed) {
-      try {
-        fs.closeSync(fd);
-      } catch {
-      }
-    }
-    try {
-      fs.unlinkSync(tmp_path);
-    } catch {
-    }
-    throw err;
-  }
-  _fsync_dir(parent);
-  return target;
-}
-function _fsync_dir(directory) {
-  let dir_fd;
-  try {
-    dir_fd = fs.openSync(directory, fs.constants.O_RDONLY);
-  } catch {
-    return;
-  }
-  try {
-    try {
-      fs.fsyncSync(dir_fd);
-    } catch {
-    }
-  } finally {
-    fs.closeSync(dir_fd);
-  }
-}
-
 // src/scripts/_lib/installed_tools.ts
-import * as fs2 from "node:fs";
+import * as fs from "node:fs";
 import * as os from "node:os";
 import * as fsPath from "node:path";
 var MANIFEST_ENV = "AGENT_CONFIG_INSTALLED_TOOLS";
@@ -144,18 +52,18 @@ function manifest_path(project_root, env) {
 var _TOP_KEY_RE = /^([A-Za-z_][A-Za-z0-9_]*)\s*:\s*"?([^"\n]*?)"?\s*$/;
 var _LIST_DASH_RE = /^\s*-\s*(.+?)\s*$/;
 var _INDENT_KEY_RE = /^\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*"?([^"\n]*?)"?\s*$/;
-function read_manifest(path4) {
+function read_manifest(path3) {
   let text;
   try {
-    text = require_read_text(path4);
+    text = require_read_text(path3);
   } catch {
     return null;
   }
   const data = _parse_manual(text);
   return _normalise_v2_shape(data);
 }
-function require_read_text(path4) {
-  return fs2.readFileSync(path4, { encoding: "utf-8" });
+function require_read_text(path3) {
+  return fs.readFileSync(path3, { encoding: "utf-8" });
 }
 function _normalise_v2_shape(data) {
   if (data["tools"] === void 0 || data["tools"] === null) {
@@ -336,9 +244,9 @@ function stable_sort(items, key) {
     return a.index - b.index;
   }).map((entry) => entry.item);
 }
-function write_manifest(path4, version, tools, options = {}) {
+function write_manifest(path3, version, tools, options = {}) {
   const rendered = _render(version, tools, { deploy_roots: options.deploy_roots ?? null });
-  return write_atomic(path4, rendered);
+  return write_atomic(path3, rendered);
 }
 var ScopeMismatchError = class extends Error {
   name_;
@@ -483,8 +391,8 @@ function randSuffix() {
 
 // src/scripts/_lib/claude_settings_hooks.ts
 var YAML = __toESM(require_dist(), 1);
-import * as fs3 from "node:fs";
-import * as path2 from "node:path";
+import * as fs2 from "node:fs";
+import * as path from "node:path";
 function _yaml_parse(text) {
   return YAML.parse(text);
 }
@@ -506,7 +414,7 @@ var SettingsLockError = class extends Error {
   }
 };
 function build_claude_hook_matrix(manifest_path2) {
-  const raw = fs3.readFileSync(manifest_path2, "utf8");
+  const raw = fs2.readFileSync(manifest_path2, "utf8");
   const manifest = _yaml_parse(raw) ?? {};
   const hook_spec = manifest["schema_version"] ?? 1;
   const platforms = manifest["platforms"] ?? {};
@@ -536,8 +444,8 @@ function _is_managed_group(group) {
   );
 }
 function _read_settings(settings_path) {
-  if (!fs3.existsSync(settings_path)) return {};
-  const raw = fs3.readFileSync(settings_path, "utf8");
+  if (!fs2.existsSync(settings_path)) return {};
+  const raw = fs2.readFileSync(settings_path, "utf8");
   if (raw.trim() === "") return {};
   let parsed;
   try {
@@ -552,18 +460,18 @@ function _read_settings(settings_path) {
 }
 function _with_lock(settings_path, fn) {
   const lockPath = settings_path + ".agent-config.lock";
-  fs3.mkdirSync(path2.dirname(lockPath), { recursive: true });
+  fs2.mkdirSync(path.dirname(lockPath), { recursive: true });
   let fd;
   try {
-    fd = fs3.openSync(lockPath, "wx");
+    fd = fs2.openSync(lockPath, "wx");
   } catch {
     throw new SettingsLockError(lockPath);
   }
   try {
     return fn();
   } finally {
-    fs3.closeSync(fd);
-    fs3.rmSync(lockPath, { force: true });
+    fs2.closeSync(fd);
+    fs2.rmSync(lockPath, { force: true });
   }
 }
 function ensure_managed_hooks(settings_path, matrix) {
@@ -592,7 +500,7 @@ function ensure_managed_hooks(settings_path, matrix) {
   });
 }
 function remove_managed_hooks(settings_path) {
-  if (!fs3.existsSync(settings_path)) return { changed: false, events: [] };
+  if (!fs2.existsSync(settings_path)) return { changed: false, events: [] };
   return _with_lock(settings_path, () => {
     const settings = _read_settings(settings_path);
     const hooks = settings["hooks"];
@@ -637,10 +545,10 @@ __export(global_deploy_inventory_exports, {
   record_deploy: () => record_deploy,
   save_inventory: () => save_inventory
 });
-import { randomBytes as randomBytes2 } from "node:crypto";
-import * as fs4 from "node:fs";
+import { randomBytes } from "node:crypto";
+import * as fs3 from "node:fs";
 import * as os2 from "node:os";
-import * as path3 from "node:path";
+import * as path2 from "node:path";
 var SCHEMA_VERSION2 = 1;
 var INVENTORY_BASENAME = "deployed-files.json";
 var INVENTORY_ENV = "AGENT_CONFIG_DEPLOY_INVENTORY";
@@ -649,22 +557,22 @@ function expanduser2(p) {
     return os2.homedir();
   }
   if (p.startsWith("~/") || process.platform === "win32" && p.startsWith("~\\")) {
-    return path3.join(os2.homedir(), p.slice(2));
+    return path2.join(os2.homedir(), p.slice(2));
   }
   return p;
 }
 function resolve_path(p) {
   try {
-    return fs4.realpathSync(p);
+    return fs3.realpathSync(p);
   } catch {
-    const abs = path3.resolve(p);
-    const parts = abs.split(path3.sep);
+    const abs = path2.resolve(p);
+    const parts = abs.split(path2.sep);
     for (let i = parts.length; i > 0; i -= 1) {
-      const prefix = parts.slice(0, i).join(path3.sep) || path3.sep;
+      const prefix = parts.slice(0, i).join(path2.sep) || path2.sep;
       try {
-        const real = fs4.realpathSync(prefix);
+        const real = fs3.realpathSync(prefix);
         const rest = parts.slice(i);
-        return rest.length > 0 ? path3.join(real, ...rest) : real;
+        return rest.length > 0 ? path2.join(real, ...rest) : real;
       } catch {
         continue;
       }
@@ -674,7 +582,7 @@ function resolve_path(p) {
 }
 function path_exists(p) {
   try {
-    fs4.statSync(p);
+    fs3.statSync(p);
     return true;
   } catch {
     return false;
@@ -692,7 +600,7 @@ function load_inventory(p) {
   const target = p ?? inventory_path();
   let data;
   try {
-    data = JSON.parse(fs4.readFileSync(target, { encoding: "utf-8" }));
+    data = JSON.parse(fs3.readFileSync(target, { encoding: "utf-8" }));
   } catch {
     return { schema_version: SCHEMA_VERSION2, tools: {} };
   }
@@ -703,15 +611,15 @@ function load_inventory(p) {
 }
 function save_inventory(data, p) {
   const target = p ?? inventory_path();
-  fs4.mkdirSync(path3.dirname(target), { recursive: true });
+  fs3.mkdirSync(path2.dirname(target), { recursive: true });
   const payload = json_dumps_sorted(data, 2) + "\n";
-  const parent = path3.dirname(target);
+  const parent = path2.dirname(target);
   let fd = null;
   let tmp_name = "";
   for (let attempt = 0; attempt < 32; attempt += 1) {
-    tmp_name = path3.join(parent, `${path3.basename(target)}.${randomBytes2(6).toString("hex")}`);
+    tmp_name = path2.join(parent, `${path2.basename(target)}.${randomBytes(6).toString("hex")}`);
     try {
-      fd = fs4.openSync(tmp_name, "wx", 384);
+      fd = fs3.openSync(tmp_name, "wx", 384);
       break;
     } catch (err) {
       if (err.code === "EEXIST") {
@@ -724,16 +632,16 @@ function save_inventory(data, p) {
     throw new Error("save_inventory: could not create a unique temp file");
   }
   try {
-    fs4.writeFileSync(fd, payload, { encoding: "utf-8" });
-    fs4.closeSync(fd);
-    fs4.renameSync(tmp_name, target);
+    fs3.writeFileSync(fd, payload, { encoding: "utf-8" });
+    fs3.closeSync(fd);
+    fs3.renameSync(tmp_name, target);
   } catch (err) {
     try {
-      fs4.closeSync(fd);
+      fs3.closeSync(fd);
     } catch {
     }
     try {
-      fs4.unlinkSync(tmp_name);
+      fs3.unlinkSync(tmp_name);
     } catch {
     }
     throw err;
@@ -792,7 +700,7 @@ function expected_deploy_files(src, dest_rel, file_filter = null) {
   const out = /* @__PURE__ */ new Set();
   let src_stat;
   try {
-    src_stat = fs4.statSync(src);
+    src_stat = fs3.statSync(src);
   } catch {
     return out;
   }
@@ -804,23 +712,23 @@ function expected_deploy_files(src, dest_rel, file_filter = null) {
     return out;
   }
   const _walk = (node, prefix) => {
-    const entries = fs4.readdirSync(node).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+    const entries = fs3.readdirSync(node).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     for (const name of entries) {
-      const entry = path3.join(node, name);
+      const entry = path2.join(node, name);
       const rel = join_rel(prefix, name);
-      const lst = fs4.lstatSync(entry);
+      const lst = fs3.lstatSync(entry);
       if (lst.isDirectory() && !lst.isSymbolicLink()) {
         _walk(entry, rel);
         continue;
       }
       let resolved_is_dir = false;
       try {
-        resolved_is_dir = fs4.statSync(entry).isDirectory();
+        resolved_is_dir = fs3.statSync(entry).isDirectory();
       } catch {
         resolved_is_dir = false;
       }
       if (resolved_is_dir) {
-        _walk(fs4.realpathSync(entry), rel);
+        _walk(fs3.realpathSync(entry), rel);
         continue;
       }
       if (file_filter !== null && !file_filter(entry)) {
@@ -833,13 +741,13 @@ function expected_deploy_files(src, dest_rel, file_filter = null) {
   return out;
 }
 function join_rel(prefix, name) {
-  return prefix ? path3.join(prefix, name) : name;
+  return prefix ? path2.join(prefix, name) : name;
 }
 function as_posix(p) {
   if (p === "") {
     return ".";
   }
-  return p.split(path3.sep).join("/");
+  return p.split(path2.sep).join("/");
 }
 function reap_stale(tool_id, anchor, current_files, inventory, dry_run = false) {
   const tools = inventory["tools"] ?? {};
@@ -864,15 +772,15 @@ function reap_stale(tool_id, anchor, current_files, inventory, dry_run = false)
     if (typeof rel !== "string" || !rel || rel.startsWith("/") || rel.startsWith("..")) {
       continue;
     }
-    const target = path3.join(anchor_resolved, rel);
+    const target = path2.join(anchor_resolved, rel);
     try {
-      relative_to(resolve_path(path3.dirname(target)), anchor_resolved);
+      relative_to(resolve_path(path2.dirname(target)), anchor_resolved);
     } catch {
       continue;
     }
     let lst = null;
     try {
-      lst = fs4.lstatSync(target);
+      lst = fs3.lstatSync(target);
     } catch {
       lst = null;
     }
@@ -886,12 +794,12 @@ function reap_stale(tool_id, anchor, current_files, inventory, dry_run = false)
       continue;
     }
     try {
-      fs4.unlinkSync(target);
+      fs3.unlinkSync(target);
     } catch {
       continue;
     }
     deleted.push(target);
-    prune_candidates.add(path3.dirname(target));
+    prune_candidates.add(path2.dirname(target));
   }
   prune_empty_dirs(prune_candidates, anchor_resolved);
   return deleted;
@@ -902,10 +810,10 @@ function reap_tagged_orphans(anchor, dest_subs, current_files, package_tag, dry_
   const prune_candidates = /* @__PURE__ */ new Set();
   const needle = `package: ${package_tag}`;
   for (const dest_sub of dest_subs) {
-    const root = dest_sub ? path3.join(anchor_resolved, dest_sub) : anchor_resolved;
+    const root = dest_sub ? path2.join(anchor_resolved, dest_sub) : anchor_resolved;
     let root_stat;
     try {
-      root_stat = fs4.statSync(root);
+      root_stat = fs3.statSync(root);
     } catch {
       continue;
     }
@@ -915,7 +823,7 @@ function reap_tagged_orphans(anchor, dest_subs, current_files, package_tag, dry_
     for (const md of rglob_md(root)) {
       let md_lst;
       try {
-        md_lst = fs4.lstatSync(md);
+        md_lst = fs3.lstatSync(md);
       } catch {
         continue;
       }
@@ -927,13 +835,13 @@ function reap_tagged_orphans(anchor, dest_subs, current_files, package_tag, dry_
         continue;
       }
       try {
-        relative_to(resolve_path(path3.dirname(md)), anchor_resolved);
+        relative_to(resolve_path(path2.dirname(md)), anchor_resolved);
       } catch {
         continue;
       }
       let head;
       try {
-        head = fs4.readFileSync(md, { encoding: "utf-8" });
+        head = fs3.readFileSync(md, { encoding: "utf-8" });
       } catch {
         continue;
       }
@@ -951,12 +859,12 @@ function reap_tagged_orphans(anchor, dest_subs, current_files, package_tag, dry_
         continue;
       }
       try {
-        fs4.unlinkSync(md);
+        fs3.unlinkSync(md);
       } catch {
         continue;
       }
       deleted.push(md);
-      prune_candidates.add(path3.dirname(md));
+      prune_candidates.add(path2.dirname(md));
     }
   }
   prune_empty_dirs(prune_candidates, anchor_resolved);
@@ -976,51 +884,51 @@ function record_deploy(tool_id, anchor, current_files, inventory) {
 }
 function prune_empty_dirs(prune_candidates, anchor_resolved) {
   const ordered = [...prune_candidates].sort(
-    (a, b) => b.split(path3.sep).length - a.split(path3.sep).length
+    (a, b) => b.split(path2.sep).length - a.split(path2.sep).length
   );
   for (const start of ordered) {
     let node = start;
     while (node !== anchor_resolved && is_ancestor(anchor_resolved, node)) {
       try {
-        fs4.rmdirSync(node);
+        fs3.rmdirSync(node);
       } catch {
         break;
       }
-      node = path3.dirname(node);
+      node = path2.dirname(node);
     }
   }
 }
 function is_ancestor(anchor, node) {
-  const rel = path3.relative(anchor, node);
-  return rel !== "" && !rel.startsWith("..") && !path3.isAbsolute(rel);
+  const rel = path2.relative(anchor, node);
+  return rel !== "" && !rel.startsWith("..") && !path2.isAbsolute(rel);
 }
 function relative_to(child, parent) {
   if (child === parent) {
     return "";
   }
-  const rel = path3.relative(parent, child);
-  if (rel.startsWith("..") || path3.isAbsolute(rel)) {
+  const rel = path2.relative(parent, child);
+  if (rel.startsWith("..") || path2.isAbsolute(rel)) {
     throw new Error(`'${child}' is not in the subpath of '${parent}'`);
   }
   return rel;
 }
 function relative_to_posix(child, parent) {
-  return path3.relative(parent, child).split(path3.sep).join("/");
+  return path2.relative(parent, child).split(path2.sep).join("/");
 }
 function rglob_md(root) {
   const out = [];
   const walk = (dir) => {
     let names;
     try {
-      names = fs4.readdirSync(dir).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+      names = fs3.readdirSync(dir).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     } catch {
       return;
     }
     for (const name of names) {
-      const full = path3.join(dir, name);
+      const full = path2.join(dir, name);
       let lst;
       try {
-        lst = fs4.lstatSync(full);
+        lst = fs3.lstatSync(full);
       } catch {
         continue;
       }
@@ -1061,7 +969,6 @@ function splitlines2(text) {
 }
 
 export {
-  write_atomic,
   SCHEMA_VERSIONS_SUPPORTED,
   DEFAULT_DEPLOY_ROOTS,
   manifest_path,

package/dist/cli-delegate/{chunk-GRRPEPRN.js → chunk-T7L2QK3K.js}

@@ -58,6 +58,7 @@ var _VERSION_RE = /^\s*agent_config_version\s*:\s*"?([^"\s]+)"?\s*$/;
 var _SCHEMA_RE = /^\s*schema_version\s*:\s*(\d+)\s*$/;
 var _LAYOUT_RE = /^\s*install_layout_version\s*:\s*(\d+)\s*$/;
 var _INSTALLED_AT_RE = /^\s*installed_at\s*:\s*"?([^"\s]+)"?\s*$/;
+var _FINGERPRINT_RE = /^\s*host_layer_fingerprint\s*:\s*"?([0-9a-f]{64})"?\s*$/;
 var _TOOL_RE = /^\s*-\s*([A-Za-z0-9_\-.]+)\s*$/;
 function expanduser(p) {
   if (p === "~") {
@@ -123,6 +124,12 @@ function read_lockfile(path2) {
       in_tools = false;
       continue;
     }
+    const fp_m = _FINGERPRINT_RE.exec(raw_line);
+    if (fp_m) {
+      data.host_layer_fingerprint = fp_m[1];
+      in_tools = false;
+      continue;
+    }
     if (raw_line.trim().startsWith("tools:")) {
       in_tools = true;
       continue;
@@ -145,14 +152,17 @@ function splitlines(text) {
   }
   return parts;
 }
-function _render(version, tools, installed_at) {
+function _render(version, tools, installed_at, fingerprint) {
   const lines = [
     `schema_version: ${SCHEMA_VERSION}`,
     `install_layout_version: ${INSTALL_LAYOUT_VERSION}`,
     `agent_config_version: "${version}"`,
-    `installed_at: "${installed_at}"`,
-    "tools:"
+    `installed_at: "${installed_at}"`
   ];
+  if (fingerprint) {
+    lines.push(`host_layer_fingerprint: "${fingerprint}"`);
+  }
+  lines.push("tools:");
   for (const tool of tools) {
     lines.push(`  - ${tool}`);
   }
@@ -162,7 +172,12 @@ function write_lockfile(version, tools, options = {}) {
   const target = options.path ?? lockfile_path();
   fs.mkdirSync(path.dirname(target), { recursive: true });
   const stamp = strftime_iso_z(options.now ?? /* @__PURE__ */ new Date());
-  const rendered = _render(version, sorted_unique(tools), stamp);
+  const rendered = _render(
+    version,
+    sorted_unique(tools),
+    stamp,
+    options.host_layer_fingerprint ?? null
+  );
   const parent = path.dirname(target);
   const { fd, tmp_name } = mkstemp(parent, ".installed.lock.");
   try {
@@ -218,7 +233,11 @@ function migrate_layout(options = {}) {
   const version = existing.agent_config_version || current_package_version();
   const tools = [...existing.tools ?? []];
   const when = options.now ?? _parse_installed_at(existing.installed_at);
-  write_lockfile(version, tools, { path: target, now: when });
+  write_lockfile(version, tools, {
+    path: target,
+    now: when,
+    host_layer_fingerprint: existing.host_layer_fingerprint ?? null
+  });
   return {
     from: from_v,
     to: INSTALL_LAYOUT_VERSION,

package/dist/cli-delegate/{chunk-EVTY7ISR.js → chunk-YM4GZDJG.js}

@@ -4230,7 +4230,15 @@ var settingsSchema = external_exports.object({
     ),
     horizon_weeks: external_exports.number().int().min(0).default(0).describe(
       'Optional planning horizon (weeks) the agent shows in roadmap framing ("next 4 weeks"). Set 0 to omit the horizon \u2014 most teams prefer to ship without a hardcoded window.'
-    )
+    ),
+    gate_budget: external_exports.object({
+      max_cost_per_run_usd: external_exports.number().min(0).default(5).describe(
+        "Per-run USD ceiling for a CLASS-1 roadmap blocker executed via `agent-config gates --execute`. A class-1 entry whose **Budget:** field states a larger figure renders its consent line instead of running. Bounds the size of an authorised spend; never supplies the authorisation \u2014 `--confirm` is still required on every class-1 run."
+      ),
+      max_cost_per_rolling_7d_usd: external_exports.number().min(0).default(25).describe(
+        "Rolling 7-day USD ceiling for class-1 gate execution, summed from the append-only receipt ledger at agents/runtime/state/gate-budget-ledger.jsonl. A run whose estimate would cross it renders instead of running. A per-run cap alone bounds one mistake, not a week of them, which is why option (a) of b-gate-budget-preauth carries two numbers."
+      )
+    }).default({ max_cost_per_run_usd: 5, max_cost_per_rolling_7d_usd: 25 })
   }),
   planning: external_exports.object({
     challenge_on_create: external_exports.boolean().default(true).describe(