@event4u/agent-config 14.9.0 → 14.11.0

package/dist/cli-delegate/{chunk-G23AT6GD.js → chunk-DMSZHXZS.js}

@@ -201,6 +201,61 @@ function resolve_rule_pack_scope(raw, package_root, runtime_active_packs = []) {
   }
   return null;
 }
+function prune_modules_by(deploy_results, is_pruned) {
+  let pruned = 0;
+  const adjusted = {};
+  for (const tool_id of Object.keys(deploy_results)) {
+    const [written, skipped, status, paths] = deploy_results[tool_id];
+    const pruned_skill_dirs = /* @__PURE__ */ new Set();
+    for (const p of paths) {
+      const parts = p.split(path2.sep);
+      if (parts.includes("skills")) {
+        const i = parts.indexOf("skills");
+        if (i + 1 < parts.length) {
+          const skill_root = parts.slice(0, i + 2).join(path2.sep);
+          if (!pruned_skill_dirs.has(skill_root)) {
+            const skillmd = path2.join(skill_root, "SKILL.md");
+            if (fs2.existsSync(skillmd) && is_pruned(skillmd)) {
+              pruned_skill_dirs.add(skill_root);
+            }
+          }
+        }
+      }
+    }
+    const keep = [];
+    const delete_files = [];
+    for (const p of paths) {
+      const parts = p.split(path2.sep);
+      let is_target = false;
+      if (parts.includes("skills")) {
+        const i = parts.indexOf("skills");
+        if (i + 1 < parts.length && pruned_skill_dirs.has(parts.slice(0, i + 2).join(path2.sep))) {
+          is_target = true;
+        }
+      } else if (parts.includes("commands") && path2.extname(p) === ".md" && is_pruned(p)) {
+        is_target = true;
+      }
+      (is_target ? delete_files : keep).push(p);
+    }
+    for (const d of pruned_skill_dirs) {
+      fs2.rmSync(d, { recursive: true, force: true });
+    }
+    for (const p of delete_files) {
+      if (p.split(path2.sep).includes("commands") && fs2.existsSync(p)) {
+        try {
+          fs2.unlinkSync(p);
+        } catch {
+        }
+      }
+    }
+    pruned += delete_files.length;
+    adjusted[tool_id] = [Math.max(0, written - delete_files.length), skipped, status, keep];
+  }
+  return [pruned, adjusted];
+}
+function prune_lab_modules(deploy_results, lab_ids) {
+  return prune_modules_by(deploy_results, (p) => is_lab_artefact(p, lab_ids));
+}
 
 // src/install/ruleInScope.ts
 var YAML = __toESM(require_dist(), 1);
@@ -328,10 +383,11 @@ function excludedRuleBasenames(rulesDir, scope) {
 
 export {
   load_lab_pack_ids,
-  is_lab_artefact,
   load_packs_registry,
   compute_active_pack_ids,
   is_pruned_under_scoped,
+  prune_modules_by,
+  prune_lab_modules,
   parseFrontmatter,
   LEGACY_ALL,
   ruleScopeFromSettings,

package/dist/cli-delegate/{chunk-77GR3VD4.js → chunk-FF7WAFMR.js}

@@ -150,6 +150,61 @@ function hardenedSpawnEnv(overrides = {}) {
   return out;
 }
 
+// src/scripts/ai_council/cli_agency_bounds.ts
+var AGENCY_BOUNDS = [
+  {
+    member: "anthropic",
+    binary: "claude",
+    bound: ["--tools", ""],
+    // Omission IS the control here, and it is verified rather than assumed:
+    // the control arm created the sentinel on 2026-08-23, so the default
+    // genuinely grants the write capability.
+    control: [],
+    probed_version: "2.1.241 (Claude Code)",
+    probed_on: "2026-08-23",
+    rationale: '`claude` grants its full built-in tool set by default; `""` is the documented "disable all tools" value. Predates this module \u2014 added after a live context-window overflow rather than a security pass, which is why the canary exists at all.'
+  },
+  {
+    member: "openai",
+    binary: "codex",
+    bound: ["--sandbox", "read-only"],
+    control: ["--sandbox", "workspace-write"],
+    probed_version: "codex-cli 0.148.0",
+    probed_on: "2026-08-23",
+    rationale: "`codex exec --help` documents `-s, --sandbox <SANDBOX_MODE>` with `read-only`, `workspace-write`, `danger-full-access`. It sits BESIDE `--skip-git-repo-check`, never instead of it: the trust gate is what makes a worktree usable at all, the sandbox bounds what the session may then do, and before this the argv carried the guard REMOVAL with no counterpart. Control is `workspace-write`, the smallest documented step up \u2014 never `danger-full-access`."
+  },
+  {
+    member: "gemini",
+    binary: "gemini",
+    bound: ["--approval-mode", "plan"],
+    control: ["--approval-mode", "auto_edit"],
+    probed_version: "0.50.0",
+    probed_on: "2026-08-23",
+    rationale: "`gemini --help` lists `plan (read-only mode)`. NOT `--allowed-tools`, which the same help marks `DEPRECATED: Use Policy Engine instead` \u2014 pinning to it would bind the council to a surface the vendor is retiring. The siblings move the wrong way: `-y/--yolo` auto-accepts every action, `auto_edit` auto-approves edit tools, which is exactly why `auto_edit` is the control and not the bound."
+  },
+  {
+    member: "xai",
+    binary: "grok",
+    bound: [],
+    control: [],
+    probed_version: null,
+    probed_on: null,
+    rationale: "not-probed \u2014 binary absent on the probing machine. No flag is guessed: a member whose bound was never determined must not be rendered as bounded."
+  },
+  {
+    member: "perplexity",
+    binary: "perplexity",
+    bound: [],
+    control: [],
+    probed_version: null,
+    probed_on: null,
+    rationale: "not-probed \u2014 binary absent on the probing machine. Same refusal to guess as `xai`."
+  }
+];
+function boundFor(member) {
+  return AGENCY_BOUNDS.find((b) => b.member === member)?.bound ?? [];
+}
+
 // src/scripts/_lib/session_role.ts
 var SESSION_ROLE_ENV = "AGENT_CONFIG_SESSION_ROLE";
 var KNOWN_ROLES = /* @__PURE__ */ new Set(["orchestrator", "worker", "reviewer"]);
@@ -432,7 +487,7 @@ function isEnvKillSwitchActive(name) {
 var SOLO_FLOOR_MIN_PRESENT = 2;
 
 // src/scripts/ai_council/events_log.ts
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 5;
 var _VALID_ACTIONS = /* @__PURE__ */ new Set([
   "proceed",
   "skip_necessity",
@@ -1807,7 +1862,7 @@ var OpenAICliClient = class extends CliClient {
     void user_prompt;
     void max_tokens;
     const modelArgs = this.model === OPENAI_CLI_VENDOR_DEFAULT ? [] : ["--model", this.model];
-    return [this.binary, "exec", "--json", "--skip-git-repo-check", ...modelArgs, "-"];
+    return [this.binary, "exec", "--json", "--skip-git-repo-check", ...boundFor("openai"), ...modelArgs, "-"];
   }
   /**
    * Refuse a pin this estate has measured the transport rejecting.
@@ -1976,7 +2031,7 @@ var GeminiCliClient = class extends CliClient {
     void system_prompt;
     void user_prompt;
     void max_tokens;
-    return [this.binary, "--output-format", "json", "--model", this.model];
+    return [this.binary, "--output-format", "json", ...boundFor("gemini"), "--model", this.model];
   }
   /**
    * One payload on stdin, same shape and same reason as the codex adapter: