@event4u/agent-config 16.1.0 → 16.3.0

package/src/scripts/hooks/ui_route_nudge_hook.ts

@@ -48,9 +48,8 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { hookSectionEnabled } from '../_lib/hook_settings.js';
 import { isUiPath, isUiTreePath } from '../_lib/ui_surface.js';
 import { readHookStdin } from './hook_stdin.js';
+import { EXIT_ALLOW, EXIT_WARN } from './exit_codes.js';
 
-const EXIT_ALLOW = 0;
-const EXIT_WARN = 2;
 /** Nudges per session before the valve goes silent. */
 export const MAX_NUDGES = 2;
 

package/src/scripts/hooks_status.ts

@@ -23,11 +23,14 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { enforcementFor } from "./check_enforcement_matrix.js";
 import {
   type JsonObject,
   type JsonValue,
   _load_yaml,
 } from "./hooks/dispatch_hook.js";
+import { loadHostLowering } from "./hooks/host_lowering.js";
+import { type SlotReading, readSlots } from "./report_enforcement_drift.js";
 
 // src/scripts/hooks_status.ts → parents[1] is the repo root (.../parents[2]
 // in the Python which lives one level deeper relative computation).
@@ -90,6 +93,18 @@ export interface PlatformRow {
    */
   ask: AskShape;
   bindings: Record<string, string[]>;
+  /**
+   * For each slot that binds at least one `blocking` concern, what that host's
+   * slot can actually carry — `refusal`, `warning-only`, `unverified` or
+   * `proof-expired` (road-to-blocking-severities 1.2).
+   *
+   * Slots with no blocking concern are ABSENT rather than present with a
+   * value, so a reader cannot mistake "nothing here claims to refuse" for a
+   * capability reading. Derived from `host_lowering.yaml`, never from the
+   * manifest: the manifest declares intent and only the lowering table records
+   * whether a refusal can land.
+   */
+  blocking_enforcement: Record<string, string>;
   hint: string | null;
 }
 
@@ -123,10 +138,79 @@ function _bridge_status(project_root: string, rel_path: string): string {
   return stat && stat.isFile() ? "installed" : "missing";
 }
 
+/**
+ * `severity` per concern, read off the manifest this report already loaded.
+ *
+ * `(undeclared)` is folded into "not blocking": this report publishes the
+ * enforcement of concerns that CLAIM to refuse, and a concern that claims
+ * nothing has nothing to reconcile. `lint_hook_manifest` is what refuses an
+ * undeclared severity; duplicating that judgement here would put two answers
+ * in the tree.
+ */
+function _severities(manifest: JsonObject): Map<string, string> {
+  const out = new Map<string, string>();
+  const concerns = manifest["concerns"];
+  if (!_isObject(concerns)) {
+    return out;
+  }
+  for (const [name, spec] of Object.entries(concerns)) {
+    const sev = _isObject(spec) ? spec["severity"] : undefined;
+    if (typeof sev === "string") {
+      out.set(name, sev);
+    }
+  }
+  return out;
+}
+
+/**
+ * What each slot carrying a `blocking` concern can actually do on this host.
+ *
+ * road-to-blocking-severities 1.2, the third surface. The decision and the
+ * vocabulary live in `check_enforcement_matrix`; this reads them rather than
+ * restating them, so the published document and this report cannot drift into
+ * two different answers to one question.
+ *
+ * Failure is SILENT and the field is simply absent. This is a read-only status
+ * report that the post-install smoke probe runs, and a malformed or missing
+ * lowering table must degrade it, never abort it — the gate is where a broken
+ * lowering table is supposed to fail.
+ */
+function _blocking_enforcement(
+  platform: string,
+  bindings: Record<string, string[]>,
+  severities: Map<string, string>,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  let slots: SlotReading[];
+  try {
+    slots = readSlots(loadHostLowering(), platform).slots;
+  } catch {
+    return out;
+  }
+  const bySlot = new Map(slots.map((s) => [s.slot, s]));
+  for (const [event, concerns] of Object.entries(bindings)) {
+    if (!concerns.some((c) => severities.get(c) === "blocking")) {
+      continue;
+    }
+    const row = bySlot.get(event);
+    out[event] = enforcementFor(
+      row === undefined
+        ? "unlowerable"
+        : row.literal === null
+          ? "null-block"
+          : row.effective === null
+            ? "stale-proof"
+            : null,
+    );
+  }
+  return out;
+}
+
 /** Build the runtime matrix as a plain object — JSON-serialisable. */
 export function collect(project_root: string, manifest: JsonObject): StatusMatrix {
   const platformsRaw = manifest["platforms"];
   const platforms = _isObject(platformsRaw) ? platformsRaw : {};
+  const severities = _severities(manifest);
   const rows: PlatformRow[] = [];
   for (const platform of Object.keys(PLATFORM_BRIDGES)) {
     const [rel, hint] = PLATFORM_BRIDGES[platform] as [string, string];
@@ -148,6 +232,7 @@ export function collect(project_root: string, manifest: JsonObject): StatusMatri
     rows.push({
       platform,
       status,
+      blocking_enforcement: _blocking_enforcement(platform, bindings, severities),
       bridge_path: rel || null,
       fallback_only,
       ask,
@@ -160,6 +245,23 @@ export function collect(project_root: string, manifest: JsonObject): StatusMatri
   return { schema_version: 1, platforms: rows };
 }
 
+/**
+ * One short line per enforcement value, for the table.
+ *
+ * `unverified` says what is MISSING, never what the host cannot do — the same
+ * wording discipline `docs/enforcement-by-host.md` carries, and the reason this
+ * report distinguishes the two values at all.
+ */
+const _ENFORCEMENT_NOTE: Record<string, string> = {
+  refusal: "the slot denies, so a blocking verdict stops the call",
+  "proof-expired":
+    "the slot can deny; this package's `verified` citation has lapsed",
+  "warning-only":
+    "`block_exit` is null here — they run and warn, they cannot refuse",
+  unverified:
+    "no lowering row for this slot — nothing bound natively, nothing established",
+};
+
 const _STATUS_MARKER: Record<string, string> = {
   installed: "✅ ",
   missing: "❌ ",
@@ -199,6 +301,16 @@ export function _render_table(matrix: StatusMatrix): string {
     for (const event of Object.keys(row.bindings).sort()) {
       const concerns = row.bindings[event]?.join(", ") || "—";
       lines.push(`    ${event.padEnd(22)} → ${concerns}`);
+      // road-to-blocking-severities 1.2 — printed only where a concern on this
+      // slot DECLARES `blocking`, and worded so `unverified` never reads as a
+      // claim about the host.
+      const enforcement = row.blocking_enforcement[event];
+      if (enforcement !== undefined) {
+        lines.push(
+          `    ${" ".repeat(22)}   blocking concerns here: ${enforcement} — ` +
+            `${_ENFORCEMENT_NOTE[enforcement] ?? "see docs/enforcement-by-host.md"}`,
+        );
+      }
     }
     if (row.hint) {
       lines.push(`    hint: ${row.hint}`);

package/src/scripts/injection_scan_hook.ts

@@ -214,6 +214,13 @@ export const OUTPUT_KEYS: readonly string[] = [
   "toolResponse",
   "tool_result",
   "toolUseResult",
+  // The failure event's result body. A FAILING command on claude carries its
+  // stdout and stderr here and carries no `tool_response` at all, so without
+  // this line a failed `curl` of a hostile page would reach the model with
+  // nothing scanned — the one direction where the output is most likely to be
+  // attacker-shaped. Caught by this concern's own coverage test, which pins
+  // OUTPUT_KEYS as a superset of what the dispatcher serves.
+  "error",
   // Generic spellings accepted since this concern shipped.
   "output",
   "result",

package/src/scripts/install.ts

@@ -76,6 +76,10 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import type * as YamlModule from 'yaml';
 
 import { build_merge_entries } from './_lib/json_pointers.js';
+import { deepMerge as deep_merge, isPlainObject as _isPlainObject, jsonEqual } from './_lib/json_merge.js';
+import { mergeHostConfig, HOOK_SIGNATURES } from './_lib/host_hook_merge.js';
+import { sweepReservedNames } from './_lib/reserved_name_sweep.js';
+import { withHostEnv } from './_lib/host_env_write.js';
 import { jsonDumpsCompact, jsonDumpsIndent } from './_lib/json_python_parity.js';
 import { is_claude_builtin_name } from './_lib/claude_builtin_names.js';
 import * as installed_lock from './_lib/installed_lock.js';
@@ -92,6 +96,7 @@ import * as rule_layer_overlap from './_lib/rule_layer_overlap.js';
 import * as installed_tools from './_lib/installed_tools.js';
 import { collect_drift, format_drift_report } from './_lib/install_drift.js';
 import * as user_global_paths from './_lib/user_global_paths.js';
+import * as gitignore_block from './_lib/gitignore_block.js';
 // The LIBRARY half, deliberately not `capture_skill_catalogue.js`: that module
 // is a CLI entry with a top-level `process.exit()`, and esbuild would bundle
 // that exit into the installer a consumer loads (`check_installer_import_purity`
@@ -102,15 +107,17 @@ import * as claude_desktop_bundler from './_lib/claude_desktop_bundler.js';
 import * as claude_settings_hooks from './_lib/claude_settings_hooks.js';
 import { hostBindings } from './hooks/host_lowering.js';
 import { find_project_root_with_anchor, load_agent_settings } from './_lib/agent_settings.js';
-import {
-    LEGACY_ALL,
-    ruleFileArrives,
-    ruleScopeFromSettings,
-    type RuleScope,
-} from '../install/rule_scope.js';
+import { ruleFileArrives, type RuleScope } from '../install/rule_scope.js';
 import { isExclusivelyPackageOnly, stampHostLayerFingerprint } from '../install/partitionEligibility.js'; // ADR-236
 import * as claude_rule_rewrite from '../install/claudeRuleRewrite.js';
-import { RULE_SOURCE_REL } from '../install/wizard-plan.js';
+import {
+    describeThinInstalledLayer,
+    installReceiptBudgetLines,
+    thinInstalledRuleLayer,
+} from '../install/installThinLayer.js';
+import { resolveGlobalRuleScope } from '../install/globalRuleScope.js';
+import { installerThinsHost } from './_lib/lean_projection_mode.js';
+import { GLOBAL_DEPLOY_SOURCES, RULE_SOURCE_REL } from '../install/wizard-plan.js';
 import { flattenSurface, computeSurfaceDelta, type SettingsSurface } from '../shared/settingsSurface.js';
 import { settingsSchema } from '../server/schemas/settings.js';
 import { zodToJsonSchema } from 'zod-to-json-schema';
@@ -480,63 +487,6 @@ function write_json_file(p: string, data: unknown): void {
     write_file(p, content);
 }
 
-function _isPlainObject(v: unknown): v is Record<string, unknown> {
-    return typeof v === 'object' && v !== null && !Array.isArray(v);
-}
-
-/** `copy.deepcopy` for JSON-shaped values. */
-function deepcopy<T>(v: T): T {
-    if (v === null || typeof v !== 'object') return v;
-    if (Array.isArray(v)) return v.map((x) => deepcopy(x)) as unknown as T;
-    const out: Record<string, unknown> = {};
-    for (const k of Object.keys(v as Record<string, unknown>)) {
-        out[k] = deepcopy((v as Record<string, unknown>)[k]);
-    }
-    return out as unknown as T;
-}
-
-function deep_merge(
-    base: Record<string, unknown>,
-    overlay: Record<string, unknown>,
-): Record<string, unknown> {
-    const result = deepcopy(base);
-    for (const key of Object.keys(overlay)) {
-        const value = overlay[key];
-        if (
-            Object.prototype.hasOwnProperty.call(result, key) &&
-            _isPlainObject(result[key]) &&
-            _isPlainObject(value)
-        ) {
-            result[key] = deep_merge(
-                result[key] as Record<string, unknown>,
-                value as Record<string, unknown>,
-            );
-        } else {
-            result[key] = deepcopy(value);
-        }
-    }
-    return result;
-}
-
-/** Deep structural equality for JSON-shaped values (Python dict `==`). */
-function jsonEqual(a: unknown, b: unknown): boolean {
-    if (a === b) return true;
-    if (typeof a !== typeof b) return false;
-    if (Array.isArray(a) || Array.isArray(b)) {
-        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-        return a.every((v, i) => jsonEqual(v, b[i]));
-    }
-    if (_isPlainObject(a) && _isPlainObject(b)) {
-        const ka = Object.keys(a);
-        const kb = Object.keys(b);
-        if (ka.length !== kb.length) return false;
-        return ka.every(
-            (k) => Object.prototype.hasOwnProperty.call(b, k) && jsonEqual(a[k], (b as Record<string, unknown>)[k]),
-        );
-    }
-    return false;
-}
-
 function merge_json_file(
     p: string,
     new_data: Record<string, unknown>,
@@ -556,7 +506,9 @@ function merge_json_file(
     }
 
     const existing = read_json_file(p);
-    const merged = deep_merge(existing, new_data);
+    // Hook arrays are shared with whatever else the consumer installed, so the
+    // `hooks` key merges per event by signature instead of being replaced.
+    const merged = mergeHostConfig(existing, new_data, HOOK_SIGNATURES[label] ?? '', deep_merge);
 
     if (jsonEqual(merged, existing)) {
         skip(`${label} already configured`);
@@ -996,10 +948,8 @@ function _heal_legacy_claude_plugin_ids(p: string): string[] {
 function ensure_claude_bridge(project_root: string, force: boolean): Record<string, unknown>[] {
     const target = path.join(project_root, '.claude', 'settings.json');
     const healed = _heal_legacy_claude_plugin_ids(target);
-    for (const pid of healed) {
-        success(`.claude/settings.json: removed stale plugin id \`${pid}\``);
-    }
-    const bridge = { enabledPlugins: { [CLAUDE_PLUGIN_ID]: true } };
+    for (const pid of healed) success(`.claude/settings.json: removed stale plugin id \`${pid}\``);
+    const bridge = withHostEnv({ enabledPlugins: { [CLAUDE_PLUGIN_ID]: true } }, project_root, success);
     return merge_json_file(target, bridge, force || healed.length > 0, '.claude/settings.json');
 }
 
@@ -1804,48 +1754,20 @@ export const PROJECT_BRIDGE_MARKERS: Record<string, string> = {
     kiro: '.kiro/steering/agent-config.md',
 };
 
-const _CLAUDE_SKILL_BUNDLE: ReadonlyArray<readonly [string, string]> = [
-    ['dist/agent-src/rules', 'rules'],
-    ['dist/agent-src/skills', 'skills'],
-    ['dist/agent-src/commands', 'commands'],
-    ['dist/agent-src/personas', 'personas'],
-];
-
-export const GLOBAL_DEPLOY_SOURCES: Record<string, ReadonlyArray<readonly [string, string]>> = {
-    'claude-code': _CLAUDE_SKILL_BUNDLE,
-    augment: [
-        ['dist/agent-src/rules', 'rules'],
-        ['dist/agent-src/skills', 'skills'],
-        ['dist/agent-src/commands', 'commands'],
-        ['dist/agent-src/contexts', 'contexts'],
-        ['dist/agent-src/personas', 'personas'],
-        ['dist/agent-src/templates', 'templates'],
-    ],
-    cursor: [
-        ['dist/agent-src/rules', 'rules'],
-        ['dist/agent-src/commands', 'commands'],
-        ['dist/agent-src/personas', 'personas'],
-    ],
-    windsurf: [['dist/agent-src/rules', 'rules']],
-    cline: [['dist/agent-src/rules', '']],
-    'gemini-cli': _CLAUDE_SKILL_BUNDLE,
-    codex: _CLAUDE_SKILL_BUNDLE,
-    continue: _CLAUDE_SKILL_BUNDLE,
-    roocode: _CLAUDE_SKILL_BUNDLE,
-    kilocode: _CLAUDE_SKILL_BUNDLE,
-    qoder: _CLAUDE_SKILL_BUNDLE,
-    opencode: _CLAUDE_SKILL_BUNDLE,
-    trae: _CLAUDE_SKILL_BUNDLE,
-    antigravity: _CLAUDE_SKILL_BUNDLE,
-    codebuddy: _CLAUDE_SKILL_BUNDLE,
-    droid: _CLAUDE_SKILL_BUNDLE,
-    warp: _CLAUDE_SKILL_BUNDLE,
-    kiro: [
-        ['dist/agent-src/rules', 'rules'],
-        ['dist/agent-src/skills', 'steering'],
-        ['dist/agent-src/personas', 'personas'],
-    ],
-};
+/**
+ * Re-exported from `wizard-plan.ts`, which is now the ONLY definition.
+ *
+ * It was defined here too, and the two copies were byte-identical in every
+ * one of their 18 host rows — a duplicate of the same truth, and the kind
+ * that stays correct right up until somebody edits one of them. Step 1.2 of
+ * `road-to-rule-triggers-and-links-that-hold` did exactly that: it added two
+ * directories here and the wizard kept installing without them.
+ *
+ * Re-exported rather than moved-and-left-broken so every caller of
+ * `install.ts::GLOBAL_DEPLOY_SOURCES` keeps working unchanged. Imported as
+ * well as re-exported because this file's own call sites read the binding.
+ */
+export { GLOBAL_DEPLOY_SOURCES };
 
 const _CLAUDE_DESKTOP_MARKER_TEMPLATE_HEAD = `# agent-config — Claude Desktop marker
 
@@ -2109,8 +2031,9 @@ export function _gate_rule_layer_overlap(
     layer: string | null,
     dry_run: boolean,
 ): boolean {
-    const global_dir = path.join(os.homedir(), '.claude', 'rules');
-    const project_dir = path.join(project_root, '.claude', 'rules');
+    // ONE source of truth for which directories the host loads, shared with the
+    // delivery carrier's scope filter (`rule_layer_overlap.hostRuleLayerDirs`).
+    const [global_dir, project_dir] = rule_layer_overlap.hostRuleLayerDirs(project_root);
     const g = rule_layer_overlap.readRuleLayer(global_dir);
     const p = rule_layer_overlap.readRuleLayer(project_dir);
     if (g === null || p === null) return true; // only one layer exists — nothing to double
@@ -2958,26 +2881,12 @@ export function _apply_claude_flat_command_wrappers(
     anchor: string,
     package_root: string,
     current_files: Set<string>,
-): { wrapped: string[]; collisions: string[]; reserved: string[] } {
+    recorded_files: ReadonlySet<string> = new Set<string>(),
+): { wrapped: string[]; collisions: string[]; reserved: string[]; foreign: string[] } {
     const wrapped: string[] = [];
     const collisions: string[] = [];
-    const reserved: string[] = [];
-    // Reserved-name sweep over ALL flat command files (any tier): a name
-    // shadowing a Claude Code built-in never ships on the claude-code anchor.
     const commands_dir = path.join(anchor, 'commands');
-    let flat_entries: string[] = [];
-    try {
-        flat_entries = fs.readdirSync(commands_dir).filter((f) => f.endsWith('.md'));
-    } catch {
-        // No commands dir → nothing to sweep.
-    }
-    for (const fname of flat_entries.sort()) {
-        const slug = fname.slice(0, -'.md'.length);
-        if (!is_claude_builtin_name(slug)) continue;
-        fs.rmSync(path.join(commands_dir, fname), { force: true });
-        current_files.delete(`commands/${fname}`);
-        reserved.push(slug);
-    }
+    const { reserved, foreign } = sweepReservedNames(commands_dir, current_files, is_claude_builtin_name, recorded_files);
     // Visible command slugs from the locked discovery manifest. `visibility`
     // is the source of truth (ADR-090/092); the integer `tier` stays only as
     // the fallback for a manifest published before `visibility` was emitted,
@@ -3024,7 +2933,7 @@ export function _apply_claude_flat_command_wrappers(
         current_files.add(`skills/${slug}/SKILL.md`);
         wrapped.push(slug);
     }
-    return { wrapped, collisions, reserved };
+    return { wrapped, collisions, reserved, foreign };
 }
 
 function _deploy_global_content(
@@ -3097,15 +3006,33 @@ function _deploy_global_content(
         if (tool_id === 'claude-code') {
             // Rules land verbatim from the copy above; see the module. It also
             // renders the flat-command wrapper report, unchanged.
-            const res = _apply_claude_flat_command_wrappers(anchor, package_root, current_files);
+            const res = _apply_claude_flat_command_wrappers(anchor, package_root, current_files, global_deploy_inventory.recorded_rel_files(tool_id, anchor));
+            const preserved_now = new Set(
+                tracker.conflictState.preserved.map((p) => path.resolve(p)),
+            );
             claude_rule_rewrite.rewriteAndReport(
                 path.join(anchor, 'rules'),
                 state.QUIET,
                 info,
                 warn,
                 res,
-                new Set(tracker.conflictState.preserved.map((p) => path.resolve(p))),
+                preserved_now,
             );
+            // Steps 1.1 and 1.4 of road-to-an-installed-layer-that-is-thinned;
+            // both modules' headers carry the reasoning.
+            if (installerThinsHost(tool_id, { packageRoot: package_root })) {
+                try {
+                    const thin = thinInstalledRuleLayer({
+                        rulesDir: path.join(anchor, 'rules'),
+                        packageRoot: package_root,
+                        preserved: preserved_now,
+                    });
+                    if (!state.QUIET) for (const l of describeThinInstalledLayer(thin)) info(l);
+                } catch (e) {
+                    warn(`claude-code: thinned rule layer not written — ${String(e)}`);
+                }
+            }
+            if (!state.QUIET) for (const l of installReceiptBudgetLines(package_root)) info(l);
         }
 
         const missing_targets = _verify_deploy_targets(anchor, plan);
@@ -3340,65 +3267,21 @@ function _resolve_scoped_projection(
 }
 
 /**
- * Resolve the rule scope governing THIS global deploy — the same way the wizard
- * does (`src/server/routes/install.ts::_resolveRuleScope`), so the two global
- * paths cannot ship different rule sets for the same settings.
+ * Resolve the rule scope governing THIS global deploy.
  *
- * Settings resolution mirrors `_resolve_scoped_projection` above: an existing
- * global settings doc is authoritative, and only a genuinely fresh machine falls
- * through to the packaged template. Any read or parse failure resolves to
- * `LEGACY_ALL` — over-shipping is the safe direction, and the compat exclusion
- * (`source-of-truth.md`) still applies even then.
+ * Thin wrapper: the body moved to `src/install/globalRuleScope.ts` (see that
+ * module's header for why). Name, signature and behaviour are unchanged, so the
+ * re-export below and every caller and test keep what they had.
  */
 function _resolve_global_rule_scope(package_root: string): RuleScope {
-    const settings_path = _resolve_global_settings_path();
-
-    // No global settings artefact at all — a genuinely fresh machine. Fall
-    // through to the packaged template silently: there is no user decision to
-    // contradict, and this is the documented upgrade-compat path.
-    if (settings_path === null) {
-        try {
-            return ruleScopeFromSettings(_load_default_settings(package_root), package_root);
-        } catch {
-            return LEGACY_ALL;
-        }
-    }
-
-    // A doc EXISTS, so the user has expressed a configuration. Failing to read
-    // it is not the same as not having one: falling back to legacy-all here
-    // ships the maintainer-only rules the user may have deliberately scoped out,
-    // and `_load_yaml_doc` would report that as an indistinguishable `{}`. So
-    // parse it explicitly and be LOUD when it does not parse — over-shipping
-    // stays the safe direction, but it must not be a silent one.
-    let text: string;
-    try {
-        text = readText(settings_path);
-    } catch (e) {
-        warn(
-            `could not read ${settings_path} (${String(e)}) — rule scoping falls back ` +
-                'to legacy-all, so ALL rules including maintainer-only ones will be ' +
-                'installed. Fix the file to restore scoping.',
-        );
-        return LEGACY_ALL;
-    }
-    const parsed = yamlSafeLoad(text);
-    if (!_isPlainObject(parsed)) {
-        warn(
-            `${settings_path} is not a YAML mapping — rule scoping falls back to ` +
-                'legacy-all, so ALL rules including maintainer-only ones will be ' +
-                'installed. Fix the file to restore scoping.',
-        );
-        return LEGACY_ALL;
-    }
-    try {
-        return ruleScopeFromSettings(parsed as Record<string, unknown>, package_root);
-    } catch (e) {
-        warn(
-            `could not derive rule scope from ${settings_path} (${String(e)}) — ` +
-                'falling back to legacy-all; ALL rules will be installed.',
-        );
-        return LEGACY_ALL;
-    }
+    return resolveGlobalRuleScope({
+        settingsPath: _resolve_global_settings_path(),
+        packageRoot: package_root,
+        readText,
+        parseYaml: yamlSafeLoad,
+        loadDefaults: () => _load_default_settings(package_root),
+        warn,
+    });
 }
 
 /**
@@ -5137,6 +5020,9 @@ function _main_project_install(
     if (will_launch) {
         return _wizard_spawn(project_root);
     }
+    // No wizard, so nothing else installs the managed ignore block.
+    const ign = gitignore_block.write_managed_block(project_root, opts.dry_run);
+    if (ign > 0) success(`.gitignore: ${opts.dry_run ? 'would add ' : '+'}${ign} managed entries`);
     return 0;
 }
 

package/src/scripts/installed_layer_report.ts

@@ -0,0 +1,103 @@
+#!/usr/bin/env tsx
+/**
+ * Report what a host actually loads, per host rule directory (step 0.1).
+ *
+ * REPORT-ONLY, AND THE NAME SAYS SO. Phase 0 of
+ * `road-to-a-rule-carrier-that-works-outside-the-repo` makes no behavior
+ * change, so this never fails on a number: exit 0 whenever it could read, 2 on
+ * usage. It is also deliberately NOT named `check_*` or `lint_*` —
+ * `_lib/gate_population.ts` enters any script with those prefixes into the gate
+ * population and the ledger then owes it a per-target accounting, which is the
+ * wrong contract for an instrument. A later ceiling over this measurement is a
+ * different script with a `check_` name.
+ *
+ * `--home` and `--project` exist so this can be pointed at a temporary `HOME`,
+ * which is the step's own framing and the thing that refutes
+ * `check_standing_rule_delivery`'s "no CI workflow performs a user-scope
+ * install": the installer reads `HOME` from the environment, so a runner can
+ * stage one and measure it. The library behind this takes the same two as
+ * parameters, which is what keeps CI, `doctor` and the upgrade receipt from
+ * each growing their own reader.
+ */
+
+import * as os from 'node:os';
+import * as path from 'node:path';
+import process from 'node:process';
+
+import { hostVersion } from './cache_realization_report.js';
+import { manifest_path } from './_lib/installed_tools.js';
+import {
+    buildInstalledLayerReport,
+    renderInstalledLayerReport,
+    type InstalledLayerReport,
+} from './_lib/installed_layer.js';
+
+const PROG = 'installed_layer_report';
+
+interface Args {
+    home: string;
+    project: string;
+    json: boolean;
+}
+
+export function parseArgs(argv: readonly string[]): Args | null {
+    let home = process.env['HOME'] ?? os.homedir();
+    let project = process.cwd();
+    let json = false;
+    for (let i = 0; i < argv.length; i += 1) {
+        const a = argv[i];
+        if (a === '--json') {
+            json = true;
+        } else if (a === '--home') {
+            i += 1;
+            const v = argv[i];
+            if (v === undefined) return null;
+            home = v;
+        } else if (a === '--project') {
+            i += 1;
+            const v = argv[i];
+            if (v === undefined) return null;
+            project = v;
+        } else if (a === '--quiet') {
+            // Accepted and ignored: this prints one block either way, and a flag
+            // that silences a report leaves nothing to have run it for.
+        } else {
+            return null;
+        }
+    }
+    return { home, project, json };
+}
+
+/** Build the report for one machine, resolving the manifest from the project root. */
+export function reportFor(args: Args): InstalledLayerReport {
+    return buildInstalledLayerReport({
+        home: args.home,
+        projectRoot: args.project,
+        manifestPath: manifest_path(args.project),
+        hostVersion: hostVersion(),
+    });
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    const args = parseArgs(argv);
+    if (args === null) {
+        process.stderr.write(`usage: ${PROG} [--home <dir>] [--project <dir>] [--json]\n`);
+        return 2;
+    }
+    const report = reportFor(args);
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    } else {
+        process.stdout.write(`${renderInstalledLayerReport(report).join('\n')}\n`);
+    }
+    // One machine-readable line, in the shape every reporting script here uses.
+    // It counts FILES across every layer read, which is the denominator the
+    // character total is over — a reader comparing two runs needs both.
+    process.stdout.write(`scanned: ${String(report.totals.files)}\n`);
+    return 0;
+}
+
+const _entry = process.argv[1];
+if (_entry !== undefined && path.resolve(_entry) === path.resolve(new URL(import.meta.url).pathname)) {
+    process.exit(main());
+}