@event4u/agent-config 16.0.0 → 16.1.0

package/dist/cli-delegate/{chunk-2XY7ILBT.js → chunk-FC75PGJE.js}

@@ -65,6 +65,46 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/scripts/_lib/settings_renamed_keys.ts
+var RENAMED_KEYS = /* @__PURE__ */ new Map([
+  ["planning.challenge_on_create", "planning.closure_pass"]
+]);
+var _warned = /* @__PURE__ */ new Set();
+function _read(tree, dotted) {
+  let cur = tree;
+  for (const part of dotted.split(".")) {
+    if (cur === null || typeof cur !== "object" || Array.isArray(cur)) return void 0;
+    cur = cur[part];
+  }
+  return cur;
+}
+function _write(tree, dotted, value) {
+  const parts = dotted.split(".");
+  let cur = tree;
+  for (const part of parts.slice(0, -1)) {
+    const next = cur[part];
+    if (next === null || typeof next !== "object" || Array.isArray(next)) cur[part] = {};
+    cur = cur[part];
+  }
+  cur[parts[parts.length - 1]] = value;
+}
+function applyRenamedKeys(layer) {
+  for (const [oldKey, newKey] of RENAMED_KEYS) {
+    const oldValue = _read(layer, oldKey);
+    if (oldValue === void 0) continue;
+    if (_read(layer, newKey) === void 0) _write(layer, newKey, oldValue);
+    if (_warned.has(oldKey)) continue;
+    _warned.add(oldKey);
+    process.stderr.write(
+      `\u26A0\uFE0F  settings: \`${oldKey}\` was renamed to \`${newKey}\`. The old key still works for one minor; rename it in your .agent-settings.yml.
+`
+    );
+  }
+  return layer;
+}
+
+// src/scripts/_lib/agent_settings.ts
 var _require = createRequire(import.meta.url);
 var Logger = class {
   name = "scripts._lib.agent_settings";
@@ -504,9 +544,9 @@ function load_agent_settings(options = {}) {
   }
   const cascade = _resolve_cascade_paths(cwd, project_path);
   const merged = template_defaults(template_path ?? void 0);
-  _deep_merge(merged, user_global_filtered);
+  _deep_merge(merged, applyRenamedKeys(user_global_filtered));
   for (const p of cascade) {
-    const layer = _read_yaml(p) ?? {};
+    const layer = applyRenamedKeys(_read_yaml(p) ?? {});
     if (Object.keys(layer).length > 0) {
       _deep_merge(merged, layer);
     }

package/dist/cli-delegate/{chunk-GYC3VRYN.js → chunk-FXYUYU4N.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-OY53J6II.js";
 import {
   load_agent_settings
-} from "./chunk-2XY7ILBT.js";
+} from "./chunk-FC75PGJE.js";
 import {
   resolve_with_fallback,
   write_target
@@ -2805,7 +2805,7 @@ function buildSecondModel(entry, cls, locked, d) {
   if (!("second_model" in entry)) return null;
   if (locked.has(cls)) {
     throw d.error(
-      `decision_resolution.classes.${cls}.second_model=${d.repr(entry["second_model"])}: a second-model rung is not configurable for high-impact / user-required decisions \u2014 those classes are LOCKED to \`user\` (Iron Law) and never resolve on a model of any kind.`
+      `decision_resolution.classes.${cls}.second_model=${d.repr(entry["second_model"])}: a second-model rung is not configurable for an owner-routed class (high-impact / user-required on the impact axis; product-owned / business-owned / destructive-owned on the ownership axis) \u2014 those classes are LOCKED to \`user\` (Iron Law) and never resolve on a model of any kind.`
     );
   }
   const raw = entry["second_model"];
@@ -2818,6 +2818,54 @@ function buildSecondModel(entry, cls, locked, d) {
   return raw;
 }
 
+// src/scripts/ai_council/ownership_classes.ts
+var OWNERSHIP_CLASSES = [
+  "deterministic",
+  "reversible-technical",
+  "contested-technical",
+  "critical-technical",
+  "product-owned",
+  "business-owned",
+  "destructive-owned",
+  "spend-exhaustion"
+];
+var OWNER_LOCKED_CLASSES = /* @__PURE__ */ new Set([
+  "product-owned",
+  "business-owned",
+  "destructive-owned"
+]);
+var NEVER_OWNER_CLASSES = /* @__PURE__ */ new Set(["spend-exhaustion"]);
+function allOwnerLocked(impactLocked) {
+  return /* @__PURE__ */ new Set([...impactLocked, ...OWNER_LOCKED_CLASSES]);
+}
+var DEFAULT_RESOLUTION_MODES = {
+  trivial: "agent",
+  low_impact: "agent",
+  medium_impact: "council",
+  high_impact: "user",
+  user_required: "user",
+  deterministic: "agent",
+  "reversible-technical": "agent",
+  "contested-technical": "council",
+  "critical-technical": "council",
+  "product-owned": "user",
+  "business-owned": "user",
+  "destructive-owned": "user",
+  "spend-exhaustion": "agent"
+};
+function defaultModeFor(cls) {
+  return DEFAULT_RESOLUTION_MODES[cls] ?? "agent";
+}
+function ownershipModeError(cls, mode, repr) {
+  if (OWNER_LOCKED_CLASSES.has(cls) && mode !== "user") {
+    return `decision_resolution.classes.${cls}.mode=${repr(mode)}: class \`${cls}\` is LOCKED to \`user\` (Iron Law) \u2014 product, business and destructive decisions are owner-owned and never resolve on a model.`;
+  }
+  if (NEVER_OWNER_CLASSES.has(cls) && mode === "user") {
+    return `decision_resolution.classes.${cls}.mode=${repr(mode)}: class \`${cls}\` is never owner-routed (Iron Law) \u2014 spend exhaustion pauses and reports, it does not ask.`;
+  }
+  return null;
+}
+
 // src/scripts/ai_council/py_format.ts
 function _pyReprStr(s) {
   const hasSingle = s.includes("'");
@@ -3445,13 +3493,7 @@ var _LOCKED_IMPACT_CLASSES = /* @__PURE__ */ new Set([
   "high_impact",
   "user_required"
 ]);
-var _DEFAULT_RESOLUTION_MODES = {
-  trivial: "agent",
-  low_impact: "agent",
-  medium_impact: "council",
-  high_impact: "user",
-  user_required: "user"
-};
+var _ALL_OWNER_LOCKED = allOwnerLocked(_LOCKED_IMPACT_CLASSES);
 function _build_decision_resolution(d) {
   if (!_isDict(d)) {
     throw new CouncilConfigError("`decision_resolution` must be a mapping.");
@@ -3469,14 +3511,14 @@ function _build_decision_resolution(d) {
     );
   }
   const classes = /* @__PURE__ */ new Map();
-  for (const cls of _IMPACT_CLASSES) {
+  for (const cls of [..._IMPACT_CLASSES, ...OWNERSHIP_CLASSES]) {
     const entry_raw = _orEmpty(classes_raw[cls] ?? null);
     if (!_isDict(entry_raw)) {
       throw new CouncilConfigError(
         `\`decision_resolution.classes.${cls}\` must be a mapping.`
       );
     }
-    const mode = _get(entry_raw, "mode", _DEFAULT_RESOLUTION_MODES[cls]);
+    const mode = _get(entry_raw, "mode", defaultModeFor(cls));
     if (!(_isStr(mode) && _VALID_RESOLUTION_MODES.has(mode))) {
       throw new CouncilConfigError(
         `decision_resolution.classes.${cls}.mode=${_pyRepr3(mode)} not in ${_sortedListRepr(_VALID_RESOLUTION_MODES)}.`
@@ -3487,7 +3529,9 @@ function _build_decision_resolution(d) {
         `decision_resolution.classes.${cls}.mode=${_pyRepr3(mode)}: class \`${cls}\` is LOCKED to \`user\` (Iron Law) \u2014 high-impact and user-required decisions never bypass the user.`
       );
     }
-    if (_LOCKED_IMPACT_CLASSES.has(cls) && "dispatch" in entry_raw) {
+    const ownErr = ownershipModeError(cls, mode, _pyRepr3);
+    if (ownErr !== null) throw new CouncilConfigError(ownErr);
+    if (_ALL_OWNER_LOCKED.has(cls) && "dispatch" in entry_raw) {
       throw new CouncilConfigError(
         `decision_resolution.classes.${cls}.dispatch=${_pyRepr3(entry_raw.dispatch)}: dispatch is not configurable for high-impact / user-required decisions \u2014 always full council.`
       );
@@ -3501,7 +3545,7 @@ function _build_decision_resolution(d) {
     const second_model = buildSecondModel(
       entry_raw,
       cls,
-      _LOCKED_IMPACT_CLASSES,
+      _ALL_OWNER_LOCKED,
       _FALLBACK_DEPS
     );
     classes.set(cls, { mode, confidence_threshold: threshold, second_model });

package/dist/cli-delegate/{chunk-55ACLDUE.js → chunk-GJCBB2UG.js}

@@ -15,6 +15,10 @@ import {
   SECTION_HEADER,
   _is_source_repo
 } from "./chunk-M2DPGFZ4.js";
+import {
+  executionPostureFromOverrides,
+  resolveExecutionPosture
+} from "./chunk-ROYYTEZU.js";
 import {
   DEFAULT_PROJECTS_ROOT,
   DEFAULT_SEAT_CEILING,
@@ -29,21 +33,17 @@ import {
   projectStoreSlug,
   scanTranscripts,
   weightedInputUnits
-} from "./chunk-GYC3VRYN.js";
+} from "./chunk-FXYUYU4N.js";
 import {
   git_common_dir
 } from "./chunk-E4XIZDIB.js";
 import {
-  DEFAULT_DEPLOY_ROOTS,
   MANAGED_SIGNATURE,
-  SCHEMA_VERSIONS_SUPPORTED,
   TOOL_TO_HOST,
   build_claude_hook_matrix,
   global_deploy_inventory_exports,
-  manifest_path,
-  read_manifest,
   residualReport
-} from "./chunk-2TAQ2K4V.js";
+} from "./chunk-6KM6ORRY.js";
 import {
   read_lockfile
 } from "./chunk-T7L2QK3K.js";
@@ -52,6 +52,12 @@ import {
   excludedRuleBasenames,
   ruleScopeFromSettings
 } from "./chunk-DMSZHXZS.js";
+import {
+  DEFAULT_DEPLOY_ROOTS,
+  SCHEMA_VERSIONS_SUPPORTED,
+  manifest_path,
+  read_manifest
+} from "./chunk-4E2W63DA.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
@@ -66,7 +72,7 @@ import {
   iter_setting_overrides,
   project_settings_path,
   resolve_project_root
-} from "./chunk-2XY7ILBT.js";
+} from "./chunk-FC75PGJE.js";
 import {
   event4u_root,
   resolve_with_fallback
@@ -2835,6 +2841,158 @@ function checkHumanizerRuntime(which) {
   };
 }
 
+// src/scripts/_lib/forge_protection.ts
+var SOURCE = {
+  rulesets: "GET repos/{owner}/{repo}/rulesets + GET .../rulesets/{id}",
+  repo: "GET repos/{owner}/{repo} (allow_auto_merge)",
+  environments: "GET repos/{owner}/{repo}/environments (deployment_branch_policy)"
+};
+function isActiveBranchRuleset(rs) {
+  return rs.enforcement === "active" && rs.target === "branch";
+}
+function reachesDefaultBranch(rs, defaultBranch) {
+  const include = rs.conditions?.ref_name?.include ?? [];
+  return include.some(
+    (p) => p === "~DEFAULT_BRANCH" || p === "~ALL" || p === `refs/heads/${defaultBranch}`
+  );
+}
+function hasRule(rs, type) {
+  return (rs.rules ?? []).some((r) => r.type === type);
+}
+function requiredContexts(rs) {
+  for (const r of rs.rules ?? []) {
+    if (r.type !== "required_status_checks") continue;
+    const p = r.parameters;
+    if (p === null || typeof p !== "object") continue;
+    const list = p["required_status_checks"];
+    if (!Array.isArray(list)) continue;
+    return list.map(
+      (e) => e !== null && typeof e === "object" ? e["context"] : null
+    ).filter((c) => typeof c === "string");
+  }
+  return [];
+}
+function forgeProtectionRows(reading) {
+  const rows = [];
+  const rulesets = reading.rulesets;
+  const branch = reading.defaultBranch;
+  const covering = rulesets === null || branch === null ? null : rulesets.filter((rs) => isActiveBranchRuleset(rs) && reachesDefaultBranch(rs, branch));
+  rows.push(
+    covering === null ? {
+      id: "default_branch_protected",
+      state: "unread",
+      source: SOURCE.rulesets,
+      detail: "the rulesets were not queried"
+    } : covering.length > 0 ? {
+      id: "default_branch_protected",
+      state: "satisfied",
+      source: SOURCE.rulesets,
+      detail: `${String(covering.length)} active branch ruleset(s) cover the default branch`
+    } : {
+      id: "default_branch_protected",
+      state: "unsatisfied",
+      source: SOURCE.rulesets,
+      detail: "no active branch ruleset covers the default branch. NOTE: the classic branches/<b>/protection endpoint 404s on a ruleset-protected repository, so a 404 there is not evidence for this row."
+    }
+  );
+  const contexts = covering === null ? null : covering.flatMap(requiredContexts);
+  rows.push(
+    contexts === null ? {
+      id: "required_checks_present",
+      state: "unread",
+      source: SOURCE.rulesets,
+      detail: "the rulesets were not queried"
+    } : contexts.length > 0 ? {
+      id: "required_checks_present",
+      state: "satisfied",
+      source: SOURCE.rulesets,
+      detail: `${String(contexts.length)} required context(s): ${contexts.join(", ")}`
+    } : {
+      id: "required_checks_present",
+      state: "unsatisfied",
+      source: SOURCE.rulesets,
+      detail: "no required status check context is configured"
+    }
+  );
+  const noFastForward = covering === null ? null : covering.some((rs) => hasRule(rs, "non_fast_forward"));
+  rows.push(
+    noFastForward === null ? {
+      id: "force_push_disabled",
+      state: "unread",
+      source: SOURCE.rulesets,
+      detail: "the rulesets were not queried"
+    } : {
+      id: "force_push_disabled",
+      state: noFastForward ? "satisfied" : "unsatisfied",
+      source: SOURCE.rulesets,
+      detail: noFastForward ? "a non_fast_forward rule is active on the default branch" : "no non_fast_forward rule covers the default branch"
+    }
+  );
+  rows.push(
+    reading.allowAutoMerge === null ? {
+      id: "auto_merge_available",
+      state: "unread",
+      source: SOURCE.repo,
+      detail: "the repository record was not queried"
+    } : {
+      id: "auto_merge_available",
+      state: reading.allowAutoMerge ? "satisfied" : "unsatisfied",
+      source: SOURCE.repo,
+      detail: reading.allowAutoMerge ? "allow_auto_merge is enabled" : "allow_auto_merge is disabled \u2014 merge delivery cannot queue behind checks"
+    }
+  );
+  rows.push(
+    reading.deployRestricted === null ? {
+      id: "deploy_via_pipeline_only",
+      state: "unread",
+      source: SOURCE.environments,
+      detail: "the environments were not queried"
+    } : {
+      id: "deploy_via_pipeline_only",
+      state: reading.deployRestricted ? "satisfied" : "unsatisfied",
+      source: SOURCE.environments,
+      detail: reading.deployRestricted ? "every environment restricts its deployment branches" : "at least one environment accepts a deployment from any branch"
+    }
+  );
+  return rows;
+}
+function protectionActions(rows) {
+  return rows.filter((r) => r.state !== "satisfied").map((r) => `${r.id}: ${r.state} \u2014 ${r.detail} (source: ${r.source})`);
+}
+
+// src/scripts/_cli/doctor_execution.ts
+function executionJson(overrides) {
+  let posture;
+  try {
+    posture = executionPostureFromOverrides(overrides());
+  } catch {
+    posture = resolveExecutionPosture({});
+  }
+  return {
+    fix_loop_max: posture.fix_loop_max,
+    escalation: [...posture.escalation]
+  };
+}
+function forgeProtectionJson(reading) {
+  const rows = forgeProtectionRows(reading);
+  return {
+    rows: rows.map((r) => ({
+      id: r.id,
+      state: r.state,
+      source: r.source,
+      detail: r.detail
+    })),
+    actions: protectionActions(rows),
+    read_from_forge: rows.some((r) => r.state !== "unread")
+  };
+}
+var UNREAD_FORGE = {
+  rulesets: null,
+  defaultBranch: null,
+  allowAutoMerge: null,
+  deployRestricted: null
+};
+
 // src/scripts/_lib/environment_detector.ts
 import { spawnSync } from "node:child_process";
 import * as fs13 from "node:fs";
@@ -5919,9 +6077,9 @@ function _emit_json(project_root, missing, modified, foreign, tag_drift, checks
     foreign,
     tag_drift
   };
-  if (origin !== null) {
-    payload["project_root_origin"] = origin;
-  }
+  if (origin !== null) payload["project_root_origin"] = origin;
+  payload["execution"] = executionJson(() => iter_setting_overrides({ cwd: project_root }));
+  payload["forge_protection"] = forgeProtectionJson(UNREAD_FORGE);
   if (checks !== null) {
     payload["checks"] = checks;
     const drift = missing.length + modified.length + foreign.length + tag_drift.length;