@event4u/agent-config 16.0.0 → 16.2.0

package/dist/cli-delegate/{chunk-55ACLDUE.js → chunk-FP36SWJD.js}

@@ -15,6 +15,10 @@ import {
   SECTION_HEADER,
   _is_source_repo
 } from "./chunk-M2DPGFZ4.js";
+import {
+  executionPostureFromOverrides,
+  resolveExecutionPosture
+} from "./chunk-ROYYTEZU.js";
 import {
   DEFAULT_PROJECTS_ROOT,
   DEFAULT_SEAT_CEILING,
@@ -23,27 +27,25 @@ import {
   billableInputTokens,
   clients_exports,
   config_exports,
+  derivedBytes,
   hardenedSpawnEnv,
   load_cli_call_counts,
+  measureBytesPerToken,
   policyExclusionReason,
   projectStoreSlug,
   scanTranscripts,
   weightedInputUnits
-} from "./chunk-GYC3VRYN.js";
+} from "./chunk-JNMVLWLR.js";
 import {
   git_common_dir
 } from "./chunk-E4XIZDIB.js";
 import {
-  DEFAULT_DEPLOY_ROOTS,
   MANAGED_SIGNATURE,
-  SCHEMA_VERSIONS_SUPPORTED,
   TOOL_TO_HOST,
   build_claude_hook_matrix,
   global_deploy_inventory_exports,
-  manifest_path,
-  read_manifest,
   residualReport
-} from "./chunk-2TAQ2K4V.js";
+} from "./chunk-6KM6ORRY.js";
 import {
   read_lockfile
 } from "./chunk-T7L2QK3K.js";
@@ -52,6 +54,12 @@ import {
   excludedRuleBasenames,
   ruleScopeFromSettings
 } from "./chunk-DMSZHXZS.js";
+import {
+  DEFAULT_DEPLOY_ROOTS,
+  SCHEMA_VERSIONS_SUPPORTED,
+  manifest_path,
+  read_manifest
+} from "./chunk-4E2W63DA.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
@@ -66,7 +74,7 @@ import {
   iter_setting_overrides,
   project_settings_path,
   resolve_project_root
-} from "./chunk-2XY7ILBT.js";
+} from "./chunk-FC75PGJE.js";
 import {
   event4u_root,
   resolve_with_fallback
@@ -79,9 +87,9 @@ import {
 // src/scripts/_cli/cmd_doctor.ts
 var YAML2 = __toESM(require_dist(), 1);
 import * as crypto2 from "node:crypto";
-import * as fs15 from "node:fs";
+import * as fs16 from "node:fs";
 import * as os4 from "node:os";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 import process3 from "node:process";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL6 } from "node:url";
 
@@ -1349,7 +1357,8 @@ function computePrefixStability(drift) {
   };
 }
 function buildReport2(opts) {
-  const scan = scanTranscripts({ root: opts.root, maxAgeDays: opts.maxAgeDays });
+  const scan = scanTranscripts({ root: opts.root, maxAgeDays: opts.maxAgeDays, measureBytes: true });
+  const bytesFactor = measureBytesPerToken(scan.records);
   const buckets = aggregateByBucket(scan.records);
   const subagentColdStart = computeColdStarts(scan.records);
   const byAgent = aggregateByAgent(scan.records);
@@ -1394,6 +1403,11 @@ function buildReport2(opts) {
     council_mispricing: councilMispricing,
     worktree_fragmentation: worktreeFragmentation,
     prefix_stability: prefixStability,
+    provider_bytes: {
+      factor: bytesFactor,
+      main: derivedBytes(billableInputTokens(buckets.main), bytesFactor),
+      subagent: derivedBytes(billableInputTokens(buckets.subagent), bytesFactor)
+    },
     claims
   };
 }
@@ -1419,6 +1433,25 @@ function renderText3(r) {
   out.push(`  unstable cohort: n=${ps.unstable_cohort.n} read_share=${share(ps.unstable_cohort.read_share)}`);
   out.push(`  ${ps.reason}`);
   out.push("");
+  const pb = r.provider_bytes;
+  out.push("Provider bytes (DERIVED - never a counted wire figure):");
+  if (pb.factor === null) {
+    out.push("  basis: unavailable - this corpus supplied no bytes-per-token factor");
+    out.push("  no figure is emitted; a ratio from another corpus would not be this one");
+  } else {
+    out.push(
+      `  factor: ${pb.factor.bytes_per_token.toFixed(4)} bytes/token (basis: ${pb.factor.basis}, ${pb.factor.content_bytes} content bytes / ${pb.factor.output_tokens} output tokens over ${pb.factor.records} records)`
+    );
+    for (const bucket of ["main", "subagent"]) {
+      const d = pb[bucket];
+      out.push(
+        d === null ? `  ${bucket}: basis: unavailable` : `  ${bucket}: ${d.bytes} bytes (basis: ${d.basis}, from ${d.tokens} billable input tokens)`
+      );
+    }
+    out.push("  the factor is measured over assistant OUTPUT content; the request payload is");
+    out.push("  not in any transcript, so this is an estimate of volume, not a wire measurement");
+  }
+  out.push("");
   out.push("By bucket:");
   for (const bucket of ["main", "subagent"]) {
     const b = r.buckets[bucket];
@@ -2835,16 +2868,444 @@ function checkHumanizerRuntime(which) {
   };
 }
 
-// src/scripts/_lib/environment_detector.ts
+// src/scripts/_lib/forge_protection.ts
+var UNREAD_FORGE = {
+  rulesets: null,
+  defaultBranch: null,
+  allowAutoMerge: null,
+  deployRestricted: null
+};
+function deployRestrictedFrom(environments, patternsByEnv) {
+  if (environments.length === 0) return null;
+  return environments.every((env) => {
+    const policy = env.deployment_branch_policy;
+    if (policy === null || policy === void 0) return false;
+    if (policy.protected_branches === true) return true;
+    if (policy.custom_branch_policies !== true) return false;
+    const patterns = patternsByEnv?.[env.name];
+    if (patterns === void 0) return true;
+    return patterns.length > 0 && !patterns.some((p) => p === "*" || p === "**");
+  });
+}
+var SOURCE = {
+  rulesets: "GET repos/{owner}/{repo}/rulesets + GET .../rulesets/{id}",
+  repo: "GET repos/{owner}/{repo} (allow_auto_merge)",
+  environments: "GET repos/{owner}/{repo}/environments (deployment_branch_policy)"
+};
+function isActiveBranchRuleset(rs) {
+  return rs.enforcement === "active" && rs.target === "branch";
+}
+function reachesDefaultBranch(rs, defaultBranch) {
+  const include = rs.conditions?.ref_name?.include ?? [];
+  return include.some(
+    (p) => p === "~DEFAULT_BRANCH" || p === "~ALL" || p === `refs/heads/${defaultBranch}`
+  );
+}
+function hasRule(rs, type) {
+  return (rs.rules ?? []).some((r) => r.type === type);
+}
+function requiredContexts(rs) {
+  for (const r of rs.rules ?? []) {
+    if (r.type !== "required_status_checks") continue;
+    const p = r.parameters;
+    if (p === null || typeof p !== "object") continue;
+    const list = p["required_status_checks"];
+    if (!Array.isArray(list)) continue;
+    return list.map(
+      (e) => e !== null && typeof e === "object" ? e["context"] : null
+    ).filter((c) => typeof c === "string");
+  }
+  return [];
+}
+function forgeProtectionRows(reading) {
+  const rows = [];
+  const rulesets = reading.rulesets;
+  const branch = reading.defaultBranch;
+  const covering = rulesets === null || branch === null ? null : rulesets.filter((rs) => isActiveBranchRuleset(rs) && reachesDefaultBranch(rs, branch));
+  rows.push(
+    covering === null ? {
+      id: "default_branch_protected",
+      state: "unread",
+      source: SOURCE.rulesets,
+      detail: "the rulesets were not queried"
+    } : covering.length > 0 ? {
+      id: "default_branch_protected",
+      state: "satisfied",
+      source: SOURCE.rulesets,
+      detail: `${String(covering.length)} active branch ruleset(s) cover the default branch`
+    } : {
+      id: "default_branch_protected",
+      state: "unsatisfied",
+      source: SOURCE.rulesets,
+      detail: "no active branch ruleset covers the default branch. NOTE: the classic branches/<b>/protection endpoint 404s on a ruleset-protected repository, so a 404 there is not evidence for this row."
+    }
+  );
+  const contexts = covering === null ? null : covering.flatMap(requiredContexts);
+  rows.push(
+    contexts === null ? {
+      id: "required_checks_present",
+      state: "unread",
+      source: SOURCE.rulesets,
+      detail: "the rulesets were not queried"
+    } : contexts.length > 0 ? {
+      id: "required_checks_present",
+      state: "satisfied",
+      source: SOURCE.rulesets,
+      detail: `${String(contexts.length)} required context(s): ${contexts.join(", ")}`
+    } : {
+      id: "required_checks_present",
+      state: "unsatisfied",
+      source: SOURCE.rulesets,
+      detail: "no required status check context is configured"
+    }
+  );
+  const noFastForward = covering === null ? null : covering.some((rs) => hasRule(rs, "non_fast_forward"));
+  rows.push(
+    noFastForward === null ? {
+      id: "force_push_disabled",
+      state: "unread",
+      source: SOURCE.rulesets,
+      detail: "the rulesets were not queried"
+    } : {
+      id: "force_push_disabled",
+      state: noFastForward ? "satisfied" : "unsatisfied",
+      source: SOURCE.rulesets,
+      detail: noFastForward ? "a non_fast_forward rule is active on the default branch" : "no non_fast_forward rule covers the default branch"
+    }
+  );
+  rows.push(
+    reading.allowAutoMerge === null ? {
+      id: "auto_merge_available",
+      state: "unread",
+      source: SOURCE.repo,
+      detail: "the repository record was not queried"
+    } : {
+      id: "auto_merge_available",
+      state: reading.allowAutoMerge ? "satisfied" : "unsatisfied",
+      source: SOURCE.repo,
+      detail: reading.allowAutoMerge ? "allow_auto_merge is enabled" : "allow_auto_merge is disabled \u2014 merge delivery cannot queue behind checks"
+    }
+  );
+  rows.push(
+    reading.deployRestricted === null ? {
+      id: "deploy_via_pipeline_only",
+      state: "unread",
+      source: SOURCE.environments,
+      detail: "the environments were not queried"
+    } : {
+      id: "deploy_via_pipeline_only",
+      state: reading.deployRestricted ? "satisfied" : "unsatisfied",
+      source: SOURCE.environments,
+      detail: reading.deployRestricted ? "every environment restricts its deployment branches" : "at least one environment accepts a deployment from any branch"
+    }
+  );
+  return rows;
+}
+function protectionActions(rows) {
+  return rows.filter((r) => r.state !== "satisfied").map((r) => `${r.id}: ${r.state} \u2014 ${r.detail} (source: ${r.source})`);
+}
+
+// src/scripts/_lib/forge_reader.ts
 import { spawnSync } from "node:child_process";
+var FORGE_CALL_TIMEOUT_MS = 1e4;
+var GIT_REMOTE_TIMEOUT_MS = 2e3;
+var FORGE_TOTAL_BUDGET_MS = 15e3;
+var NO_FORGE_ENV = ["AGENT_CONFIG_DOCTOR_NO_FORGE", "AGENT_CONFIG_OFFLINE"];
+function forgeReadDisabled(env) {
+  return NO_FORGE_ENV.some((k) => env[k] === "1");
+}
+function asObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+var defaultRunner = (cmd, args, timeoutMs, cwd) => spawnSync(cmd, [...args], {
+  encoding: "utf8",
+  timeout: timeoutMs,
+  maxBuffer: 32 * 1024 * 1024,
+  ...cwd === void 0 ? {} : { cwd }
+});
+function callTimeout(remainingMs) {
+  return Math.max(1, Math.floor(Math.min(FORGE_CALL_TIMEOUT_MS, remainingMs)));
+}
+function liveForgeApi(timeoutFor = () => FORGE_CALL_TIMEOUT_MS, run = defaultRunner, where = {}) {
+  const hostArgs = where.host === void 0 || where.host.toLowerCase() === "github.com" ? [] : ["--hostname", where.host];
+  return {
+    get(apiPath, paginate = false) {
+      const budget = timeoutFor();
+      if (budget <= 0) return null;
+      const args = paginate ? ["api", "--paginate", "--slurp", ...hostArgs, apiPath] : ["api", ...hostArgs, apiPath];
+      let r;
+      try {
+        r = run("gh", args, callTimeout(budget), where.cwd);
+      } catch {
+        return null;
+      }
+      if (r.status !== 0 || typeof r.stdout !== "string" || r.stdout.trim() === "") {
+        return null;
+      }
+      try {
+        return JSON.parse(r.stdout);
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+function resolveForgeRepo(originUrl2) {
+  if (originUrl2 === null || originUrl2.trim() === "") return null;
+  const url = originUrl2.trim();
+  const m = /^(?:[A-Za-z][A-Za-z0-9+.-]*:\/\/)?(?:[^@/]+@)?([^/:]+)[:/]([^/:]+\/[^/]+?)(?:\.git)?$/.exec(
+    url
+  );
+  const host = m?.[1];
+  const slug = m?.[2];
+  if (host === void 0 || slug === void 0) return null;
+  if (!host.toLowerCase().includes("github")) return null;
+  if (!/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(slug)) return null;
+  if (slug.split("/").some((seg) => seg === "." || seg === "..")) return null;
+  return { host, slug };
+}
+function originUrl(root, run = defaultRunner, timeoutMs = GIT_REMOTE_TIMEOUT_MS) {
+  let r;
+  try {
+    r = run("git", ["ls-remote", "--get-url", "origin"], timeoutMs, root);
+  } catch {
+    return null;
+  }
+  if (r.status !== 0 || typeof r.stdout !== "string") return null;
+  const out = r.stdout.trim();
+  return out === "" || out === "origin" ? null : out;
+}
+function readRulesets(repo, api) {
+  const list = slurped(api.get(`repos/${repo}/rulesets`, true), "rulesets");
+  if (list === null) return null;
+  const out = [];
+  for (const entry of list) {
+    const id = asObject(entry)?.["id"];
+    if (typeof id !== "number") return null;
+    const detail = api.get(`repos/${repo}/rulesets/${String(id)}`);
+    if (asObject(detail) === null) return null;
+    out.push(detail);
+  }
+  return out;
+}
+function slurped(payload, key) {
+  if (Array.isArray(payload)) {
+    if (payload.length > 0 && payload.every((p) => Array.isArray(p))) {
+      return payload.flat();
+    }
+    if (payload.length > 0 && payload.every((p) => Array.isArray(asObject(p)?.[key]))) {
+      return payload.flatMap((p) => asObject(p)?.[key]);
+    }
+    return payload;
+  }
+  const listed = asObject(payload)?.[key];
+  return Array.isArray(listed) ? [...listed] : null;
+}
+function readDeployRestricted(repo, api) {
+  const envsRaw = slurped(api.get(`repos/${repo}/environments`, true), "environments");
+  if (envsRaw === null) return null;
+  const envs = [];
+  const patternsByEnv = {};
+  for (const raw of envsRaw) {
+    const env = asObject(raw);
+    const name = env?.["name"];
+    if (typeof name !== "string") return null;
+    const policy = asObject(env?.["deployment_branch_policy"]);
+    for (const k of ["protected_branches", "custom_branch_policies"]) {
+      const v = policy?.[k];
+      if (v !== void 0 && typeof v !== "boolean") return null;
+    }
+    envs.push({
+      name,
+      deployment_branch_policy: policy === null ? null : {
+        ...typeof policy["protected_branches"] === "boolean" ? { protected_branches: policy["protected_branches"] } : {},
+        ...typeof policy["custom_branch_policies"] === "boolean" ? { custom_branch_policies: policy["custom_branch_policies"] } : {}
+      }
+    });
+    if (policy?.["custom_branch_policies"] !== true) continue;
+    if (policy["protected_branches"] === true) continue;
+    const names = api.get(
+      `repos/${repo}/environments/${encodeURIComponent(name)}/deployment-branch-policies`,
+      true
+    );
+    const listed = slurped(names, "branch_policies");
+    if (listed === null) return null;
+    const patterns = listed.map((p) => asObject(p)?.["name"]);
+    if (patterns.some((n) => typeof n !== "string")) return null;
+    patternsByEnv[name] = patterns;
+  }
+  return deployRestrictedFrom(envs, patternsByEnv);
+}
+function readForge(repo, api) {
+  const record = asObject(api.get(`repos/${repo}`));
+  if (record === null) return UNREAD_FORGE;
+  const branch = record["default_branch"];
+  const autoMerge = record["allow_auto_merge"];
+  return {
+    defaultBranch: typeof branch === "string" && branch !== "" ? branch : null,
+    // Never coerced: a flag the payload did not carry as a boolean is a flag
+    // nobody read, and `unread` is the state reserved for exactly that.
+    allowAutoMerge: typeof autoMerge === "boolean" ? autoMerge : null,
+    rulesets: readRulesets(repo, api),
+    deployRestricted: readDeployRestricted(repo, api)
+  };
+}
+function withDeadline(api, remaining) {
+  return {
+    get(apiPath, paginate) {
+      return remaining() <= 0 ? null : api.get(apiPath, paginate);
+    }
+  };
+}
+function budgetOf(ms, now = () => performance.now()) {
+  const until = now() + ms;
+  return () => Math.max(0, until - now());
+}
+function forgeReadingFor(req) {
+  if (forgeReadDisabled(req.env)) return { repo: null, reading: UNREAD_FORGE };
+  const remaining = req.remaining ?? budgetOf(FORGE_TOTAL_BUDGET_MS);
+  try {
+    const target = req.resolveRepo();
+    if (target === null) return { repo: null, reading: UNREAD_FORGE };
+    const reading = readForge(target.slug, withDeadline(req.apiFor(target), remaining));
+    return { repo: target.slug, reading };
+  } catch {
+    return { repo: null, reading: UNREAD_FORGE };
+  }
+}
+
+// src/scripts/_cli/doctor_execution.ts
+function executionJson(overrides) {
+  let posture;
+  try {
+    posture = executionPostureFromOverrides(overrides());
+  } catch {
+    posture = resolveExecutionPosture({});
+  }
+  return {
+    fix_loop_max: posture.fix_loop_max,
+    escalation: [...posture.escalation]
+  };
+}
+function forgeProtectionJson(reading, repo = null) {
+  const rows = forgeProtectionRows(reading);
+  const readFromForge = rows.some((r) => r.state !== "unread");
+  const anonymous = repo === null || !readFromForge;
+  const name = (s) => anonymous ? s : s.replace(/\{owner\}\/\{repo\}/g, () => repo);
+  return {
+    repository: readFromForge ? repo : null,
+    rows: rows.map((r) => ({
+      id: r.id,
+      state: r.state,
+      source: name(r.source),
+      detail: r.detail
+    })),
+    actions: protectionActions(rows).map(name),
+    read_from_forge: readFromForge
+  };
+}
+function forgeProtectionJsonFor(root, deps = {}) {
+  const env = deps.env ?? process.env;
+  const run = deps.run;
+  const remaining = budgetOf(FORGE_TOTAL_BUDGET_MS);
+  const read = forgeReadingFor({
+    env,
+    // A thunk, so the opt-out short-circuits before `git` spawns.
+    resolveRepo: () => resolveForgeRepo(originUrl(root, run)),
+    // Built from the RESOLVED target, so `gh` is addressed at the host and
+    // directory the slug came from. The per-call ceiling is whatever is
+    // left of the whole-read budget, so a call admitted near the deadline
+    // cannot run past it.
+    apiFor: (t) => liveForgeApi(remaining, run, { host: t.host, cwd: root }),
+    remaining
+  });
+  return forgeProtectionJson(read.reading, read.repo);
+}
+
+// src/scripts/_cli/doctor_network_posture.ts
 import * as fs13 from "node:fs";
-import * as os2 from "node:os";
 import * as path17 from "node:path";
+var NOT_APPLICABLE = "not applicable on this host";
+var TRAFFIC_DOC = "docs/setup/host-traffic-environment.md";
+var UNKNOWN_HOST = "unknown";
+var CHECKED = "claude-code 2.1.284 \xB7 2026-09-29";
+var TRAFFIC_VARIABLES = [
+  // Both traffic variables reach the host's update-disabled resolver, the
+  // blanket one as its third rung, so neither is writable by this package —
+  // owner-decided 2026-09-30.
+  { variable: "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC", hosts: ["claude-code"], checked_against: CHECKED, writable_by_this_package: false },
+  { variable: "DISABLE_AUTOUPDATER", hosts: ["claude-code"], checked_against: CHECKED, writable_by_this_package: false },
+  // Size caps. Neither reaches the updater resolver, and neither suppresses a
+  // call, an update check or a download.
+  { variable: "BASH_MAX_OUTPUT_LENGTH", hosts: ["claude-code"], checked_against: CHECKED, writable_by_this_package: true },
+  { variable: "MAX_MCP_OUTPUT_TOKENS", hosts: ["claude-code"], checked_against: CHECKED, writable_by_this_package: true }
+];
+function resolveTrafficHost(env) {
+  const claude = (env["CLAUDECODE"] ?? "").trim() !== "" || (env["CLAUDE_CODE_SESSION_ID"] ?? "").trim() !== "";
+  if (claude) return { host: "claude-code", observed: true };
+  return { host: UNKNOWN_HOST, observed: false };
+}
+function trafficRow(spec, env, host) {
+  const raw = env[spec.variable];
+  const present = raw !== void 0 && raw !== "";
+  const applicable = spec.hosts.includes(host);
+  return {
+    variable: spec.variable,
+    state: applicable ? present ? "set" : "unset" : NOT_APPLICABLE,
+    value: present ? String(raw) : null,
+    checked_against: spec.checked_against,
+    writable_by_this_package: spec.writable_by_this_package
+  };
+}
+function trafficEnvironmentJson(env, hostOverride) {
+  const resolved = hostOverride ?? resolveTrafficHost(env);
+  return {
+    host: resolved.host,
+    host_observed: resolved.observed,
+    doc: TRAFFIC_DOC,
+    reporting_read_only: true,
+    writable_by_this_package: TRAFFIC_VARIABLES.filter((v) => v.writable_by_this_package).map(
+      (v) => v.variable
+    ),
+    rows: TRAFFIC_VARIABLES.map((spec) => trafficRow(spec, env, resolved.host))
+  };
+}
+function pathExists(p) {
+  try {
+    fs13.statSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function checkOfflineReadiness(packageRoot) {
+  const script = path17.join(packageRoot, "src", "scripts", "hermetic-install.sh");
+  if (!pathExists(script)) {
+    return {
+      id: "offline-readiness",
+      status: "warn",
+      message: "src/scripts/hermetic-install.sh not found in package",
+      remedy: "reinstall @event4u/agent-config or pull missing files"
+    };
+  }
+  return {
+    id: "offline-readiness",
+    status: "ok",
+    message: "verified-offline install entrypoint present",
+    remedy: ""
+  };
+}
+
+// src/scripts/_lib/environment_detector.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import * as fs14 from "node:fs";
+import * as os2 from "node:os";
+import * as path18 from "node:path";
 
 // src/install/toolDetection.ts
 import { existsSync as existsSync9 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { delimiter, join as join16 } from "node:path";
+import { delimiter, join as join17 } from "node:path";
 var TOOL_SIGNALS = {
   "claude-code": { bins: ["claude"], homePaths: [".claude", ".claude.json", ".config/claude"] },
   "claude-desktop": { absPaths: ["/Applications/Claude.app"], homePaths: ["Library/Application Support/Claude", ".config/Claude"] },
@@ -2889,7 +3350,7 @@ function resolveBinaryPath(name, pathEnv) {
   for (const dir of pathEnv.split(delimiter)) {
     if (dir.length === 0) continue;
     for (const candidate of [name, `${name}.exe`, `${name}.cmd`]) {
-      const full = join16(dir, candidate);
+      const full = join17(dir, candidate);
       if (existsSync9(full)) return full;
     }
   }
@@ -2900,7 +3361,7 @@ function binOnPath(name, pathEnv) {
 }
 function isToolInstalled(signal, home, pathEnv) {
   for (const rel of signal.homePaths ?? []) {
-    if (existsSync9(join16(home, rel))) return true;
+    if (existsSync9(join17(home, rel))) return true;
   }
   for (const abs of signal.absPaths ?? []) {
     if (existsSync9(abs)) return true;
@@ -2962,7 +3423,7 @@ function classifyBilling(provider, source) {
 function codexHome(env) {
   const map = env ?? process.env;
   const override = (map["CODEX_HOME"] ?? "").trim();
-  return override !== "" ? override : path17.join(homeOf(env), ".codex");
+  return override !== "" ? override : path18.join(homeOf(env), ".codex");
 }
 function homeOf(env) {
   const map = env ?? process.env;
@@ -2974,7 +3435,7 @@ var CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
 function defaultProbeKeychain(service) {
   if (process.platform !== "darwin") return false;
   try {
-    const res = spawnSync("security", ["find-generic-password", "-s", service], {
+    const res = spawnSync2("security", ["find-generic-password", "-s", service], {
       timeout: VERSION_PROBE_TIMEOUT_MS,
       encoding: "utf-8",
       windowsHide: true,
@@ -2988,7 +3449,7 @@ function defaultProbeKeychain(service) {
 }
 function defaultProbeVersion(binary) {
   try {
-    const res = spawnSync(binary, ["--version"], {
+    const res = spawnSync2(binary, ["--version"], {
       timeout: VERSION_PROBE_TIMEOUT_MS,
       encoding: "utf-8",
       windowsHide: true,
@@ -3003,14 +3464,14 @@ ${res.stderr ?? ""}`;
 }
 function isFile3(p) {
   try {
-    return fs13.statSync(p).isFile();
+    return fs14.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function exists(p) {
   try {
-    return fs13.existsSync(p);
+    return fs14.existsSync(p);
   } catch {
     return false;
   }
@@ -3018,7 +3479,7 @@ function exists(p) {
 function classifyCodexAuth(authPath) {
   let data;
   try {
-    data = JSON.parse(fs13.readFileSync(authPath, "utf-8"));
+    data = JSON.parse(fs14.readFileSync(authPath, "utf-8"));
   } catch {
     return "cli-api-key";
   }
@@ -3035,7 +3496,7 @@ function cliSubscriptionEvidence(provider, home, env, claudeConfigDir, probeKeyc
   if (provider === "anthropic") {
     const configDir = claudeConfigDir;
     for (const rel of [".credentials.json", "credentials.json"]) {
-      const p = path17.join(configDir, rel);
+      const p = path18.join(configDir, rel);
       if (isFile3(p)) return { source: "cli-subscription", evidence: p };
     }
     if (probeKeychain(CLAUDE_KEYCHAIN_SERVICE)) {
@@ -3044,12 +3505,12 @@ function cliSubscriptionEvidence(provider, home, env, claudeConfigDir, probeKeyc
     return null;
   }
   if (provider === "openai") {
-    const p = path17.join(codexHome(env), "auth.json");
+    const p = path18.join(codexHome(env), "auth.json");
     if (isFile3(p)) return { source: classifyCodexAuth(p), evidence: p };
     return null;
   }
   if (provider === "gemini") {
-    const p = path17.join(home, ".gemini", "oauth_creds.json");
+    const p = path18.join(home, ".gemini", "oauth_creds.json");
     if (isFile3(p)) return { source: "cli-subscription", evidence: p };
     return null;
   }
@@ -3081,7 +3542,7 @@ function detectHosts(opts) {
 function detectAuth(opts) {
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeOf(opts.env);
-  const claudeConfigDir = opts.home === void 0 && opts.env === void 0 ? claude_config_dir() : (env["CLAUDE_CONFIG_DIR"] ?? "").trim() || path17.join(home, ".claude");
+  const claudeConfigDir = opts.home === void 0 && opts.env === void 0 ? claude_config_dir() : (env["CLAUDE_CONFIG_DIR"] ?? "").trim() || path18.join(home, ".claude");
   const probeKeychain = opts.probeKeychain ?? defaultProbeKeychain;
   const auth = [];
   const keys = [];
@@ -3136,7 +3597,7 @@ function detectEnvironment(opts = {}) {
 }
 
 // src/scripts/_cli/detection_report.ts
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 
 // src/scripts/ai_council/transport_resolver.ts
 var VALID_TRANSPORT_MODES = /* @__PURE__ */ new Set([
@@ -3354,7 +3815,7 @@ function cliBinaryPresent(environment, provider, binaryOverride) {
   const expected = PROVIDER_CLI_META[provider]?.[0];
   if (expected === void 0) return false;
   return environment.hosts.some(
-    (h) => h.binary !== null && stripExe(path18.basename(h.binary)) === expected
+    (h) => h.binary !== null && stripExe(path19.basename(h.binary)) === expected
   );
 }
 function stripExe(name) {
@@ -3515,9 +3976,9 @@ function absentCouncilFacts(configPath) {
 
 // src/scripts/ai_team/review_gate.ts
 import * as crypto from "node:crypto";
-import * as fs14 from "node:fs";
+import * as fs15 from "node:fs";
 import * as os3 from "node:os";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 
 // src/scripts/ai_team/config.ts
 var AI_TEAM_REVIEW_GATE_DEFAULTS = Object.freeze({
@@ -3533,16 +3994,16 @@ var AI_TEAM_DEFAULTS = Object.freeze({
 });
 
 // src/scripts/ai_team/review_gate.ts
-var GATE_LEDGER_RELPATH = path19.join("agents", "runtime", "team", "events.log");
+var GATE_LEDGER_RELPATH = path20.join("agents", "runtime", "team", "events.log");
 var _CODEX_PLUGIN_DATA_DIRNAME = `${CODEX_PLUGIN_ID}-${CODEX_MARKETPLACE_NAME}`;
 function _workspace_state_segment(workspace_root) {
   let canonical = workspace_root;
   try {
-    canonical = fs14.realpathSync.native(workspace_root);
+    canonical = fs15.realpathSync.native(workspace_root);
   } catch {
     canonical = workspace_root;
   }
-  const slug_source = path19.basename(workspace_root) || "workspace";
+  const slug_source = path20.basename(workspace_root) || "workspace";
   const slug = slug_source.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "workspace";
   const hash = crypto.createHash("sha256").update(canonical).digest("hex").slice(0, 16);
   return `${slug}-${hash}`;
@@ -3552,19 +4013,19 @@ function upstream_state_dir_candidates(workspace_root) {
   const candidates = [];
   const env = (process.env["CLAUDE_PLUGIN_DATA"] ?? "").trim();
   if (env !== "") {
-    candidates.push(path19.join(env, "state", segment));
+    candidates.push(path20.join(env, "state", segment));
   }
   candidates.push(
-    path19.join(claude_config_dir(), "plugins", "data", _CODEX_PLUGIN_DATA_DIRNAME, "state", segment)
+    path20.join(claude_config_dir(), "plugins", "data", _CODEX_PLUGIN_DATA_DIRNAME, "state", segment)
   );
-  candidates.push(path19.join(os3.tmpdir(), "codex-companion", segment));
+  candidates.push(path20.join(os3.tmpdir(), "codex-companion", segment));
   return candidates;
 }
 function upstream_gate_enabled(workspace_root) {
   for (const dir of upstream_state_dir_candidates(workspace_root)) {
     let parsed;
     try {
-      parsed = JSON.parse(fs14.readFileSync(path19.join(dir, "state.json"), "utf-8"));
+      parsed = JSON.parse(fs15.readFileSync(path20.join(dir, "state.json"), "utf-8"));
     } catch {
       continue;
     }
@@ -3721,13 +4182,13 @@ var ArgparseExit = class extends Error {
 function expanduser(p) {
   if (p === "~") return os4.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\")) {
-    return path20.join(os4.homedir(), p.slice(2));
+    return path21.join(os4.homedir(), p.slice(2));
   }
   return p;
 }
-function pathExists(p) {
+function pathExists2(p) {
   try {
-    fs15.statSync(p);
+    fs16.statSync(p);
     return true;
   } catch {
     return false;
@@ -3735,27 +4196,27 @@ function pathExists(p) {
 }
 function isFile4(p) {
   try {
-    return fs15.statSync(p).isFile();
+    return fs16.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir3(p) {
   try {
-    return fs15.statSync(p).isDirectory();
+    return fs16.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function resolvePath(p) {
   try {
-    return fs15.realpathSync(path20.resolve(p));
+    return fs16.realpathSync(path21.resolve(p));
   } catch {
-    return path20.resolve(p);
+    return path21.resolve(p);
   }
 }
 function readText(p) {
-  return fs15.readFileSync(p, "utf-8");
+  return fs16.readFileSync(p, "utf-8");
 }
 function _jsonStrAscii(s) {
   let out = '"';
@@ -3866,7 +4327,7 @@ function _resolve_project_root(arg) {
 }
 var _INSTALL_MODE_MARKER_REL = "agents/.agent-state/install-mode.txt";
 function _detect_install_mode(project_root) {
-  const marker = path20.join(project_root, _INSTALL_MODE_MARKER_REL);
+  const marker = path21.join(project_root, _INSTALL_MODE_MARKER_REL);
   if (isFile4(marker)) {
     let value;
     try {
@@ -3878,9 +4339,9 @@ function _detect_install_mode(project_root) {
       return [value, "marker-file"];
     }
   }
-  const has_agents_md = pathExists(path20.join(project_root, "AGENTS.md"));
-  const has_copilot = pathExists(
-    path20.join(project_root, ".github", "copilot-instructions.md")
+  const has_agents_md = pathExists2(path21.join(project_root, "AGENTS.md"));
+  const has_copilot = pathExists2(
+    path21.join(project_root, ".github", "copilot-instructions.md")
   );
   if (has_agents_md && has_copilot) {
     return ["full", "heuristic"];
@@ -3900,8 +4361,8 @@ function _settings_layer_chain(project_root) {
   return layers;
 }
 function _detect_wrapper(project_root) {
-  const wrapper = path20.join(project_root, "agent-config");
-  if (!pathExists(wrapper)) {
+  const wrapper = path21.join(project_root, "agent-config");
+  if (!pathExists2(wrapper)) {
     return { path: String(wrapper), exists: false, embedded_root: null };
   }
   return {
@@ -3967,14 +4428,14 @@ function _emit_context_text(ctx) {
 }
 function _resolve_path(project_root, raw) {
   let p = expanduser(raw);
-  if (!path20.isAbsolute(p)) {
-    p = path20.join(project_root, p);
+  if (!path21.isAbsolute(p)) {
+    p = path21.join(project_root, p);
   }
   return p;
 }
 function _sha256(p) {
   try {
-    const data = fs15.readFileSync(p);
+    const data = fs16.readFileSync(p);
     return crypto2.createHash("sha256").update(data).digest("hex");
   } catch {
     return null;
@@ -3983,7 +4444,7 @@ function _sha256(p) {
 var PACKAGE_TAG_ID2 = "event4u/agent-config";
 var _FRONTMATTER_PACKAGE_RE = /^package:\s*(.+?)\s*$/m;
 function _read_inline_package_tag(p) {
-  if (path20.extname(p) !== ".md") {
+  if (path21.extname(p) !== ".md") {
     return NO_FRONTMATTER;
   }
   let text;
@@ -4084,7 +4545,7 @@ function _scan_foreign(project_root, manifest, known) {
   const seen = /* @__PURE__ */ new Set();
   for (const root_rel of roots) {
     const root = _resolve_path(project_root, String(root_rel));
-    if (!pathExists(root) || !isDir3(root)) {
+    if (!pathExists2(root) || !isDir3(root)) {
       continue;
     }
     for (const child of rglob(root)) {
@@ -4112,13 +4573,13 @@ function rglob(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = fs15.readdirSync(dir, { withFileTypes: true });
+      entries = fs16.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const ent of entries) {
-      const full = path20.join(dir, ent.name);
+      const full = path21.join(dir, ent.name);
       out.push(full);
       let dirLike = ent.isDirectory();
       if (ent.isSymbolicLink()) {
@@ -4137,7 +4598,7 @@ function _classify(records) {
   const modified = [];
   const tag_drift = [];
   for (const [tool_id, target, kind, expected] of records) {
-    if (!pathExists(target)) {
+    if (!pathExists2(target)) {
       missing.push({
         tool: tool_id,
         path: String(target),
@@ -4193,9 +4654,9 @@ function _foreign_records(project_root, foreign) {
   return out;
 }
 function relativeTo(p, base) {
-  const rel = path20.relative(base, p);
+  const rel = path21.relative(base, p);
   if (rel === "") return rel;
-  if (rel.startsWith("..") || path20.isAbsolute(rel)) {
+  if (rel.startsWith("..") || path21.isAbsolute(rel)) {
     return null;
   }
   return rel;
@@ -4281,7 +4742,7 @@ var STATUS_SYMBOLS = {
 var MIN_PYTHON = [3, 10];
 function _check_scope(project_root) {
   for (const marker of ["pnpm-workspace.yaml", "lerna.json"]) {
-    if (pathExists(path20.join(project_root, marker))) {
+    if (pathExists2(path21.join(project_root, marker))) {
       return {
         id: "scope",
         status: "warn",
@@ -4290,8 +4751,8 @@ function _check_scope(project_root) {
       };
     }
   }
-  const pkg = path20.join(project_root, "package.json");
-  if (pathExists(pkg)) {
+  const pkg = path21.join(project_root, "package.json");
+  if (pathExists2(pkg)) {
     try {
       const data = JSON.parse(readText(pkg));
       if (data["workspaces"]) {
@@ -4316,7 +4777,7 @@ var _PLACEHOLDER_EMAIL_RE = /^(t@t\.t|.*@example\.(com|org)|.*@localhost)$/i;
 var _PLACEHOLDER_NAME_RE = /^(t|test|user|nobody|x)$/i;
 function _git_config_path(project_root) {
   const common = git_common_dir(project_root);
-  return common === null ? null : path20.join(common, "config");
+  return common === null ? null : path21.join(common, "config");
 }
 function _parse_git_user(configText) {
   let inUser = false;
@@ -4341,13 +4802,13 @@ function _parse_git_user(configText) {
 }
 function _check_git_identity(project_root) {
   const cfgPath = _git_config_path(project_root);
-  if (cfgPath === null || !pathExists(cfgPath)) {
+  if (cfgPath === null || !pathExists2(cfgPath)) {
     return { id: "git-identity", status: "skipped", message: "not a git repository", remedy: "" };
   }
   let ident = _parse_git_user(readText(cfgPath));
   if (ident.name === null && ident.email === null) {
-    const globalCfg = path20.join(os4.homedir(), ".gitconfig");
-    if (pathExists(globalCfg)) {
+    const globalCfg = path21.join(os4.homedir(), ".gitconfig");
+    if (pathExists2(globalCfg)) {
       ident = _parse_git_user(readText(globalCfg));
     }
   }
@@ -4407,7 +4868,7 @@ function _package_root() {
 }
 function _current_package_version() {
   try {
-    const data = JSON.parse(readText(path20.join(_package_root(), "package.json")));
+    const data = JSON.parse(readText(path21.join(_package_root(), "package.json")));
     const v = data["version"];
     if (typeof v === "string" && v.trim()) {
       return v.trim();
@@ -4451,7 +4912,7 @@ function _check_lockfile_freshness(manifest) {
   };
 }
 function shutilWhich(name) {
-  if (path20.dirname(name) !== "." && (name.includes("/") || name.includes("\\"))) {
+  if (path21.dirname(name) !== "." && (name.includes("/") || name.includes("\\"))) {
     return isExecutableFile(name) ? name : null;
   }
   const pathEnv = process3.env["PATH"] || "";
@@ -4464,12 +4925,12 @@ function shutilWhich(name) {
     if (seenDirs.has(d)) continue;
     seenDirs.add(d);
     for (const ext of exts) {
-      const candidate = path20.join(d, name + (ext === "" ? "" : ext.toLowerCase() === ext ? ext : ext));
+      const candidate = path21.join(d, name + (ext === "" ? "" : ext.toLowerCase() === ext ? ext : ext));
       if (isExecutableFile(candidate)) {
         return candidate;
       }
       if (ext !== "") {
-        const upper = path20.join(d, name + ext);
+        const upper = path21.join(d, name + ext);
         if (isExecutableFile(upper)) return upper;
       }
     }
@@ -4478,10 +4939,10 @@ function shutilWhich(name) {
 }
 function isExecutableFile(p) {
   try {
-    const st = fs15.statSync(p);
+    const st = fs16.statSync(p);
     if (!st.isFile()) return false;
     if (process3.platform === "win32") return true;
-    fs15.accessSync(p, fs15.constants.X_OK);
+    fs16.accessSync(p, fs16.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -4545,7 +5006,7 @@ function _check_claude_plugin() {
       remedy: ""
     };
   }
-  const projection = path20.join(os4.homedir(), ".claude", "skills");
+  const projection = path21.join(os4.homedir(), ".claude", "skills");
   const projection_present = isDir3(projection);
   if (projection_present) {
     return {
@@ -4582,8 +5043,8 @@ function _check_claude_command_wrappers() {
       remedy: ""
     };
   }
-  const anchor = path20.join(os4.homedir(), ".claude");
-  const commands_dir = path20.join(anchor, "commands");
+  const anchor = path21.join(os4.homedir(), ".claude");
+  const commands_dir = path21.join(anchor, "commands");
   if (!isDir3(commands_dir)) {
     return {
       id: "claude-command-wrappers",
@@ -4592,8 +5053,8 @@ function _check_claude_command_wrappers() {
       remedy: ""
     };
   }
-  const flat_probe = fs15.existsSync(path20.join(commands_dir, "commit.md"));
-  const wrapper_probe = fs15.existsSync(path20.join(anchor, "skills", "commit", "SKILL.md"));
+  const flat_probe = fs16.existsSync(path21.join(commands_dir, "commit.md"));
+  const wrapper_probe = fs16.existsSync(path21.join(anchor, "skills", "commit", "SKILL.md"));
   if (wrapper_probe) {
     return {
       id: "claude-command-wrappers",
@@ -4618,7 +5079,7 @@ function _check_claude_command_wrappers() {
   };
 }
 function _check_surface_state() {
-  const matrix_path = path20.join(_package_root(), "src", "config", "surface-matrix.yml");
+  const matrix_path = path21.join(_package_root(), "src", "config", "surface-matrix.yml");
   if (!isFile4(matrix_path)) {
     return {
       id: "surface-state",
@@ -4642,7 +5103,7 @@ function _check_surface_state() {
       remedy: "agent-config upgrade (reinstalls the package data files)"
     };
   }
-  const _expand = (p) => p.startsWith("~/") ? path20.join(os4.homedir(), p.slice(2)) : path20.join(_package_root(), p);
+  const _expand = (p) => p.startsWith("~/") ? path21.join(os4.homedir(), p.slice(2)) : path21.join(_package_root(), p);
   const violations = [];
   const remedies = [];
   let checked = 0;
@@ -4684,7 +5145,7 @@ function _check_surface_state() {
 }
 function pathExistsAny(p) {
   try {
-    fs15.statSync(p);
+    fs16.statSync(p);
     return true;
   } catch {
     return false;
@@ -4730,8 +5191,8 @@ function _check_mcp_mode(project_root) {
   ];
   const found = [];
   for (const [rel, label] of candidates) {
-    const p = path20.join(project_root, rel);
-    if (!pathExists(p)) {
+    const p = path21.join(project_root, rel);
+    if (!pathExists2(p)) {
       continue;
     }
     try {
@@ -4761,23 +5222,7 @@ function _check_mcp_mode(project_root) {
     remedy: ""
   };
 }
-function _check_offline_readiness() {
-  const script = path20.join(_package_root(), "src", "scripts", "hermetic-install.sh");
-  if (!pathExists(script)) {
-    return {
-      id: "offline-readiness",
-      status: "warn",
-      message: "src/scripts/hermetic-install.sh not found in package",
-      remedy: "reinstall @event4u/agent-config or pull missing files"
-    };
-  }
-  return {
-    id: "offline-readiness",
-    status: "ok",
-    message: "verified-offline install entrypoint present",
-    remedy: ""
-  };
-}
+var _check_offline_readiness = () => checkOfflineReadiness(_package_root());
 function _check_stale_orphans() {
   const gdi = global_deploy_inventory_exports;
   const inv = gdi.load_inventory();
@@ -4820,7 +5265,7 @@ function _check_stale_orphans() {
       (a, b) => a < b ? -1 : a > b ? 1 : 0
     );
     for (const root_name of ownedSorted) {
-      const root = path20.join(anchor, root_name);
+      const root = path21.join(anchor, root_name);
       if (!isDir3(root)) {
         continue;
       }
@@ -4835,7 +5280,7 @@ function _check_stale_orphans() {
         if (rel === null) {
           continue;
         }
-        const relPosix = rel.split(path20.sep).join("/");
+        const relPosix = rel.split(path21.sep).join("/");
         if (recorded_set.has(relPosix)) {
           continue;
         }
@@ -4890,14 +5335,14 @@ function _check_rule_scope_drift(project_root) {
   let rules_dir = null;
   let found = 0;
   for (const rel of _RULE_PROJECTION_DIRS) {
-    const cand = path20.join(project_root, rel);
+    const cand = path21.join(project_root, rel);
     if (!isDir3(cand)) {
       continue;
     }
     let count = 0;
     try {
-      for (const name of fs15.readdirSync(cand)) {
-        if (name.endsWith(".md") && isFile4(path20.join(cand, name))) {
+      for (const name of fs16.readdirSync(cand)) {
+        if (name.endsWith(".md") && isFile4(path21.join(cand, name))) {
           count += 1;
         }
       }
@@ -4951,14 +5396,14 @@ function _check_rule_scope_drift(project_root) {
   };
 }
 function _check_duplicate_scope_rules(project_root, userRulesDirOverride) {
-  const user_rules_dir = userRulesDirOverride ?? path20.join(os4.homedir(), ".claude", "rules");
+  const user_rules_dir = userRulesDirOverride ?? path21.join(os4.homedir(), ".claude", "rules");
   let project_rules_dir = null;
   if (_is_source_repo(project_root)) {
-    const cand = path20.join(project_root, "dist", "agent-src", "rules");
+    const cand = path21.join(project_root, "dist", "agent-src", "rules");
     if (isDir3(cand)) project_rules_dir = cand;
   } else {
     for (const rel of _RULE_PROJECTION_DIRS) {
-      const cand = path20.join(project_root, rel);
+      const cand = path21.join(project_root, rel);
       if (isDir3(cand)) {
         project_rules_dir = cand;
         break;
@@ -5004,7 +5449,7 @@ function _check_mcp_beta_readiness(project_root) {
   }
   const pending = [];
   for (const [gate_id, rel] of MCP_BETA_GATES) {
-    if (!pathExists(path20.join(project_root, rel))) {
+    if (!pathExists2(path21.join(project_root, rel))) {
       pending.push(`${gate_id} (${rel})`);
     }
   }
@@ -5025,7 +5470,7 @@ function _check_mcp_beta_readiness(project_root) {
 }
 function _check_tier_usage_readiness(project_root) {
   const settings_file = project_settings_path(project_root);
-  let log_path = path20.join(project_root, ".agent-tier-usage.jsonl");
+  let log_path = path21.join(project_root, ".agent-tier-usage.jsonl");
   let enabled = false;
   if (isFile4(settings_file)) {
     let raw;
@@ -5044,7 +5489,7 @@ function _check_tier_usage_readiness(project_root) {
         const outputRaw = tu["output"];
         const output = typeof outputRaw === "object" && outputRaw !== null && !Array.isArray(outputRaw) ? outputRaw : {};
         if (typeof output["path"] === "string" && output["path"].trim()) {
-          log_path = path20.join(project_root, output["path"].trim());
+          log_path = path21.join(project_root, output["path"].trim());
         }
         const val = tu["enabled"];
         if (typeof val === "boolean") {
@@ -5065,11 +5510,11 @@ function _check_tier_usage_readiness(project_root) {
       remedy: "set `telemetry.tier_usage.enabled: true` in .agent-settings.yml (default-off; opt-in)"
     };
   }
-  if (!pathExists(log_path)) {
+  if (!pathExists2(log_path)) {
     return {
       id: "tier-usage-readiness",
       status: "warn",
-      message: `tier-usage telemetry on but ${path20.basename(log_path)} not yet written \u2014 no signal accumulated`,
+      message: `tier-usage telemetry on but ${path21.basename(log_path)} not yet written \u2014 no signal accumulated`,
       remedy: "run any tracked command to seed the log; the dispatcher writes one record per invocation"
     };
   }
@@ -5084,7 +5529,7 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "fail",
-      message: `cannot read ${path20.basename(log_path)}: ${osErrorStr(exc)}`,
+      message: `cannot read ${path21.basename(log_path)}: ${osErrorStr(exc)}`,
       remedy: "fix permissions on the tier-usage log"
     };
   }
@@ -5115,7 +5560,7 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "fail",
-      message: `${total} record(s) in ${path20.basename(log_path)} but 0 passed the privacy floor \u2014 report would refuse to render`,
+      message: `${total} record(s) in ${path21.basename(log_path)} but 0 passed the privacy floor \u2014 report would refuse to render`,
       remedy: "inspect the log; the dispatcher is writing records the contract forbids (paths, argv, message bodies)"
     };
   }
@@ -5123,19 +5568,19 @@ function _check_tier_usage_readiness(project_root) {
     return {
       id: "tier-usage-readiness",
       status: "warn",
-      message: `${path20.basename(log_path)} present but empty \u2014 no signal yet`,
+      message: `${path21.basename(log_path)} present but empty \u2014 no signal yet`,
       remedy: "run any tracked command to seed the log"
     };
   }
   return {
     id: "tier-usage-readiness",
     status: "ok",
-    message: `${valid} record(s) past the privacy floor in ${path20.basename(log_path)} \u2014 retiering signal available`,
+    message: `${valid} record(s) past the privacy floor in ${path21.basename(log_path)} \u2014 retiering signal available`,
     remedy: ""
   };
 }
 function readText0(p) {
-  return fs15.readFileSync(p, "utf-8");
+  return fs16.readFileSync(p, "utf-8");
 }
 function osErrorStr(exc) {
   if (exc && typeof exc === "object" && "message" in exc) {
@@ -5155,7 +5600,7 @@ function _check_council_cli(project_root) {
   const { load_cli_call_counts: load_cli_call_counts2 } = clients_exports;
   const { load_council_config, resolve_config_path } = config_exports;
   const council_path = resolve_config_path(project_root);
-  if (!pathExists(String(council_path))) {
+  if (!pathExists2(String(council_path))) {
     return {
       id: "council-cli",
       status: "ok",
@@ -5265,7 +5710,7 @@ function _team_codex_binary_name(project_root) {
   const default_bin = _CLI_PROVIDER_META["openai"][0];
   const { load_council_config, resolve_config_path } = config_exports;
   const council_path = resolve_config_path(project_root);
-  if (!pathExists(String(council_path))) {
+  if (!pathExists2(String(council_path))) {
     return default_bin;
   }
   let cfg;
@@ -5308,7 +5753,7 @@ function _epoch_seconds(value) {
 function _codex_auth_expiry(auth_path) {
   let data;
   try {
-    data = JSON.parse(fs15.readFileSync(auth_path, "utf-8"));
+    data = JSON.parse(fs16.readFileSync(auth_path, "utf-8"));
   } catch {
     return null;
   }
@@ -5346,7 +5791,7 @@ var _detection_memo = null;
 function _read_council_facts(project_root) {
   const { load_council_config, resolve_config_path } = config_exports;
   const config_path = String(resolve_config_path(project_root));
-  if (!pathExists(config_path)) {
+  if (!pathExists2(config_path)) {
     return absentCouncilFacts(config_path);
   }
   let cfg;
@@ -5454,8 +5899,8 @@ function _check_team(project_root) {
   if (binary_missing) {
     remedies.push("install the codex CLI: `npm install -g @openai/codex`");
   }
-  const auth_path = path20.join(_codex_home(), "auth.json");
-  const authed = pathExists(auth_path);
+  const auth_path = path21.join(_codex_home(), "auth.json");
+  const authed = pathExists2(auth_path);
   let auth_str;
   if (!authed) {
     auth_str = `codex auth \u274C (${auth_path})`;
@@ -5471,7 +5916,7 @@ function _check_team(project_root) {
       auth_str = `codex auth \u2705 (${auth_path})`;
     }
   }
-  const is_claude_host = shutilWhich("claude") !== null || pathExists(claude_config_dir());
+  const is_claude_host = shutilWhich("claude") !== null || pathExists2(claude_config_dir());
   let plugin_str;
   if (is_claude_host) {
     const identity = codex_plugin_identity();
@@ -5542,11 +5987,11 @@ function _check_unsupported_combos(manifest) {
   };
 }
 function _wizard_state_path() {
-  return path20.join(event4u_root(), "state", "wizard-state.json");
+  return path21.join(event4u_root(), "state", "wizard-state.json");
 }
 function _check_wizard_state() {
   const state_pth = _wizard_state_path();
-  if (!pathExists(state_pth)) {
+  if (!pathExists2(state_pth)) {
     return {
       id: "wizard-state",
       status: "ok",
@@ -5622,8 +6067,8 @@ function _check_wizard_state() {
   };
 }
 function _check_settings_review_pending() {
-  const delta_pth = path20.join(event4u_root(), "state", "settings-delta.json");
-  if (!pathExists(delta_pth)) {
+  const delta_pth = path21.join(event4u_root(), "state", "settings-delta.json");
+  if (!pathExists2(delta_pth)) {
     return {
       id: "settings-review-pending",
       status: "ok",
@@ -5648,8 +6093,8 @@ function _check_settings_review_pending() {
 }
 function _check_memory_merge_union(project_root) {
   const remedy = "run: npx tsx src/scripts/sync_gitattributes.ts (or `agent-config refresh --project`)";
-  const target = path20.join(project_root, DEFAULT_GITATTRIBUTES);
-  if (!pathExists(target)) {
+  const target = path21.join(project_root, DEFAULT_GITATTRIBUTES);
+  if (!pathExists2(target)) {
     return {
       id: "memory-merge-union",
       status: "warn",
@@ -5919,9 +6364,10 @@ function _emit_json(project_root, missing, modified, foreign, tag_drift, checks
     foreign,
     tag_drift
   };
-  if (origin !== null) {
-    payload["project_root_origin"] = origin;
-  }
+  if (origin !== null) payload["project_root_origin"] = origin;
+  payload["execution"] = executionJson(() => iter_setting_overrides({ cwd: project_root }));
+  payload["forge_protection"] = forgeProtectionJsonFor(String(project_root));
+  payload["traffic_environment"] = trafficEnvironmentJson(process3.env);
   if (checks !== null) {
     payload["checks"] = checks;
     const drift = missing.length + modified.length + foreign.length + tag_drift.length;
@@ -6113,7 +6559,7 @@ function _run_anatomy(opts) {
   try {
     economyReport = economy.buildReport({
       root: economy.DEFAULT_PROJECTS_ROOT,
-      auditDir: path20.join(process3.cwd(), economy.DEFAULT_AUDIT_DIR),
+      auditDir: path21.join(process3.cwd(), economy.DEFAULT_AUDIT_DIR),
       maxAgeDays: 14
     });
   } catch (err) {
@@ -6144,7 +6590,7 @@ function _run_repair(opts) {
   const target = opts.repair;
   if (target === "wizard-state") {
     const state_pth = _wizard_state_path();
-    const exists2 = pathExists(state_pth);
+    const exists2 = pathExists2(state_pth);
     const payload = {
       id: "wizard-state",
       path: String(state_pth),
@@ -6152,7 +6598,7 @@ function _run_repair(opts) {
     };
     if (exists2) {
       try {
-        fs15.unlinkSync(state_pth);
+        fs16.unlinkSync(state_pth);
       } catch (exc) {
         payload["action"] = "error";
         payload["error"] = osErrorStr(exc);
@@ -6259,17 +6705,17 @@ function _isCliEntry2() {
     return false;
   }
   if (cliDelegate) {
-    if (path20.basename(process3.argv[1], ".js") === "cmd_doctor") {
+    if (path21.basename(process3.argv[1], ".js") === "cmd_doctor") {
       return true;
     }
   }
-  const argvUrl = pathToFileURL6(path20.resolve(process3.argv[1])).href;
+  const argvUrl = pathToFileURL6(path21.resolve(process3.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs15.realpathSync(fileURLToPath5(import.meta.url));
-    const argv = fs15.realpathSync(path20.resolve(process3.argv[1]));
+    const here = fs16.realpathSync(fileURLToPath5(import.meta.url));
+    const argv = fs16.realpathSync(path21.resolve(process3.argv[1]));
     return here === argv;
   } catch {
     return false;