@event4u/agent-config 16.1.0 → 16.3.0

package/dist/cli-delegate/{chunk-UNCRJBT3.js → chunk-JQVYKIZA.js}

@@ -4198,6 +4198,37 @@ var settingsSchema = external_exports.object({
       "How a mission's work is shaped into pull requests. single (default) = one branch, one pull request. stacked = a dependent series. stacked is never chosen by the agent and never asked about at roadmap creation \u2014 the owner plans it or it does not happen."
     )
   }),
+  /**
+   * What this package may write into the HOST's own environment.
+   *
+   * THE GUARANTEE IS THE SHAPE, not a check. Only two keys exist here, and
+   * both are request-SIZE caps. Neither traffic variable is expressible —
+   * `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` and `DISABLE_AUTOUPDATER` both
+   * reach the host's update-disabled resolver (the blanket one as its third
+   * rung, measured on Claude Code 2.1.284), so a profile able to write either
+   * could disable a consumer's security updates. Owner-decided 2026-09-30:
+   * they are not writable through this package at all, and the strongest way
+   * to hold that is a schema that cannot say them rather than an exclusion
+   * list somebody has to maintain.
+   *
+   * `null` is the default on both, and it is the off switch: nothing is
+   * written. There is no separate enable flag, because a flag plus a value is
+   * two ways to say off and one of them would drift.
+   */
+  host_environment: external_exports.object({
+    request_size_caps: external_exports.object({
+      bash_max_output_length: external_exports.number().int().positive().max(15e4).nullable().default(null).describe(
+        "Character cap on Bash tool output the host places inline into a model request. null (default) = this package writes nothing and the host default of 30000 applies. A number is written into the host env block. Values above 150000 are capped by the host itself, so the schema refuses them here rather than writing a value the host silently changes. Bounds request SIZE, never request COUNT: lowering it suppresses no telemetry, no update check and no download."
+      ),
+      max_mcp_output_tokens: external_exports.number().int().positive().nullable().default(null).describe(
+        "Token cap on a single MCP tool result the host places into a model request. null (default) = nothing written, host default 25000 applies. Same size-not-count caveat: it does not govern MCP connections, timeouts, or whether a tool runs."
+      )
+    }).default({}).describe(
+      "Request-size caps this package may write into the host env block. Both null by default. No traffic or auto-updater variable is expressible here, by construction \u2014 see the block comment."
+    )
+  }).default({}).describe(
+    'What this package may write into the host environment. ABSENT resolves to the all-null shape, which is the same thing as off \u2014 a settings file predating this section must not fail to parse, and "no section" and "both caps null" both mean write nothing.'
+  ),
   augment: external_exports.object({
     rules_use_symlinks: external_exports.boolean().default(false).describe(
       "When true, .augment/rules/*.md are symlinks into dist/agent-src/rules/ \u2014 edits flow back to source on save. When false (default), they are copies \u2014 safer on Windows and shared volumes, but rule edits in .augment/ are lost on the next `task sync`."
@@ -4305,6 +4336,11 @@ var settingsSchema = external_exports.object({
     fidelity_mode: "strict",
     approximation: { enabled: false, tolerance: { color: null, length: null } }
   }),
+  code_graph: external_exports.object({
+    consumer_index_paths: external_exports.array(external_exports.string()).default([]).describe(
+      "Extra project-relative paths where THIS project keeps a code-graph index another tool wrote. The built-in list is deliberately vendor-neutral (graph.json, code-graph.json, .code-graph/graph.json) and names no tool, so a tool that writes its index elsewhere is named here rather than waited for. A graph found this way LOADS and answers query and explain with every edge tagged read-from-elsewhere; the gate verbs (impact, untested, dead) refuse a graph made only of such edges and say so, because an empty answer from a gate must not read as 'nothing found' when it means 'nothing trusted'. Absolute paths and paths escaping the project root are ignored."
+    )
+  }).default({}),
   consistency: external_exports.object({
     cross_source: crossSourceMode.default("on").describe(
       "Consumed by the cross-source-consistency rule. When the agent works from multiple sources (ticket text, an attached image/mockup, the spec, the codebase) it checks them against each other and asks before proceeding on a discrepancy \u2014 instead of silently guessing. on (default) = surface every real cross-source contradiction / silent-scope-expansion as one question; auto = surface only high-confidence contradictions, state low-confidence as an assumption; off = no cross-source checking."
@@ -4572,6 +4608,11 @@ var settingsSchema = external_exports.object({
         "When a hook exceeds hooks.concern_budget.max_per_event, fail the run (true) instead of warning and continuing (false, default). Turn on in CI when you want hook quality to gate merges."
       )
     }),
+    verify_before_complete: external_exports.object({
+      touched_file_quality: external_exports.enum(["off", "shadow", "warn"]).default("off").describe(
+        "Stop-slot pass that runs the project's OWN quality commands \u2014 the ones resolve_toolchain() already reports \u2014 over the files this turn edited. Default off. `shadow` records a per-run result and emits nothing; `warn` adds ONE advisory line of at most 200 bytes. Never blocks and never counts as verification: a command recorded here never reaches _lib/verification_command.ts, so a clean eslint run cannot let a turn claim it verified anything. A writing command runs only in its check form (pint --test) or not at all, and a command with no per-file form is skipped rather than run project-wide at every stop."
+      )
+    }).default({}),
     injection_scan: external_exports.object({
       enabled: external_exports.boolean().default(false).describe(
         "PostToolUse prompt-injection scanner (road-to-security-pillar.md P3.2). Default off. When on, scans tool output (file reads, web fetches, MCP responses) for injection signatures and WARNS in context (never blocks). Runtime backstop on top of the always-on untrusted-input-defense rule; detection is probabilistic."

package/dist/cli-delegate/{chunk-FC75PGJE.js → chunk-JY2I2DXV.js}

@@ -221,7 +221,18 @@ var MERGEABLE_KEYS = [
   // be followed. Class C, so a user still sets it by hand or through the
   // GUI; whitelisting decides only whether the value SURVIVES the merge
   // (ADR-271, road-to-design-intent-conformance 2.3).
-  "design.fidelity_mode"
+  "design.fidelity_mode",
+  // `lean_projection.*` is a per-MACHINE setting and the install it governs is
+  // a user-scope one: the layer being thinned is `~/.claude/rules`, which
+  // belongs to the machine and not to any checkout. Without these two rows a
+  // consumer who wrote the opt-in into the user-global file got no error, no
+  // warning and no effect — the same silent-filter defect the two entries
+  // above repair, reaching a third key, and unsatisfiable-by-construction on
+  // an ADR-020 global-only install, where no project layer exists to carry it.
+  // Whitelisting decides only whether a value SURVIVES the merge: it sets
+  // nothing, and `installerThinsHost` still refuses a template-only value.
+  "lean_projection.mode",
+  "lean_projection.hosts"
 ];
 var TEMPLATE_RELATIVE = path.join("src", "config", "agent-settings.template.yml");
 var _PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");

package/dist/cli-delegate/chunk-KB5FZ655.js

@@ -0,0 +1,208 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/scripts/_lib/secret_detector.ts
+var ENTROPY_MIN_TOKEN_LENGTH = 20;
+var BASE64_ENTROPY_THRESHOLD = 4.5;
+var HEX_ENTROPY_THRESHOLD = 3;
+var RULES = [
+  { rule: "anthropic-api-key", kind: "anthropic-api-key", regex: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+  { rule: "anthropic-project-key", kind: "anthropic-api-key", regex: /sk-proj-[A-Za-z0-9_-]{20,}/g },
+  { rule: "aws-access-key", kind: "aws-access-key", regex: /AKIA[0-9A-Z]{16}/g },
+  { rule: "google-api-key", kind: "google-api-key", regex: /AIza[0-9A-Za-z_-]{35}/g },
+  { rule: "github-pat", kind: "github-pat", regex: /ghp_[0-9A-Za-z]{36}/g },
+  // Fine-grained PATs (github_pat_…) were a measured detector gap: the
+  // 2026-07-28 adversarial corpus pass flagged them as missed positives.
+  { rule: "github-fine-grained-pat", kind: "github-pat", regex: /github_pat_[0-9A-Za-z_]{22,}/g },
+  {
+    rule: "jwt",
+    kind: "jwt",
+    regex: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+  },
+  // Extensions.
+  { rule: "stripe-secret-key", kind: "stripe-secret-key", regex: /sk_(?:live|test)_[0-9A-Za-z]{16,}/g },
+  { rule: "slack-token", kind: "slack-token", regex: /xox[baprs]-[0-9A-Za-z-]{10,}/g },
+  { rule: "pem-private-key", kind: "pem-private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  {
+    rule: "db-connection-uri",
+    kind: "db-connection-uri",
+    regex: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/g
+  },
+  {
+    rule: "generic-assignment",
+    kind: "generic-assignment",
+    regex: /(?:password|passwd|pwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token)\s*[:=]\s*['"]?([^'"\s]{8,})['"]?/gi,
+    valueGroup: 1
+  }
+];
+var SECRET_ALLOW = /secret-allow/;
+var PLACEHOLDER_PATTERNS = [
+  /x{4,}/i,
+  /example/i,
+  /changeme/i,
+  /your[_-].*here/i,
+  /<[^>]+>/,
+  /\.\.\./,
+  /^your[_-]/i,
+  /placeholder/i
+];
+var DATA_URI = /data:[\w.+-]+\/[\w.+-]+;base64,/i;
+var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var KEYWORD_CONTEXT = /password|secret|token|api[_-]?key|credential/i;
+var ENTROPY_TOKEN = /[A-Za-z0-9+=_-]{20,}/g;
+var IS_HEX = /^[0-9a-fA-F]+$/;
+var HASH_HEX_LENGTHS = /* @__PURE__ */ new Set([32, 40, 64]);
+function isAllSameChar(value) {
+  return value.length > 0 && /^(.)\1*$/.test(value);
+}
+var GENERIC_MIN_LENGTH = 16;
+var GENERIC_MIN_ENTROPY = 3.3;
+var CODE_EXPR = /[()$`{}<>[\];,]|->|=>|\.\w/;
+function looksLikeSecretValue(value) {
+  if (value.length < GENERIC_MIN_LENGTH) {
+    return false;
+  }
+  if (CODE_EXPR.test(value)) {
+    return false;
+  }
+  const hasDigit = /[0-9]/.test(value);
+  const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
+  if (!hasDigit && !mixedCase) {
+    return false;
+  }
+  return shannonEntropy(value) >= GENERIC_MIN_ENTROPY;
+}
+function isPlaceholderValue(value, pathHint) {
+  if (pathHint !== void 0) {
+    if (pathHint.endsWith(".example") || pathHint.endsWith(".sample") || pathHint.includes(".env.example")) {
+      return true;
+    }
+  }
+  if (isAllSameChar(value)) {
+    return true;
+  }
+  return PLACEHOLDER_PATTERNS.some((p) => p.test(value));
+}
+function maskSecret(value) {
+  const front = value.slice(0, 4);
+  const back = value.length > 6 ? value.slice(-2) : "";
+  if (front.length + back.length >= value.length) {
+    return `${value.slice(0, 1)}\u2026`;
+  }
+  return `${front}\u2026${back}`;
+}
+function shannonEntropy(value) {
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of value) {
+    freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  }
+  const n = value.length;
+  let entropy = 0;
+  for (const count of freq.values()) {
+    const p = count / n;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function overlaps(spans, start, end) {
+  return spans.some(([s, e]) => start < e && s < end);
+}
+function scanText(text, opts = {}) {
+  const pathHint = opts.path;
+  const findings = [];
+  const lines = text.split(/\r\n|\r|\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    if (SECRET_ALLOW.test(line)) {
+      continue;
+    }
+    const covered = [];
+    for (const rule of RULES) {
+      rule.regex.lastIndex = 0;
+      let m;
+      while ((m = rule.regex.exec(line)) !== null) {
+        const value = rule.valueGroup !== void 0 ? m[rule.valueGroup] : m[0];
+        if (value === void 0) {
+          if (m.index === rule.regex.lastIndex) {
+            rule.regex.lastIndex += 1;
+          }
+          continue;
+        }
+        if (rule.rule === "generic-assignment" && !looksLikeSecretValue(value)) {
+          if (m.index === rule.regex.lastIndex) {
+            rule.regex.lastIndex += 1;
+          }
+          continue;
+        }
+        const valueStart = m.index + m[0].indexOf(value);
+        const confidence = isPlaceholderValue(value, pathHint) ? "low" : "high";
+        findings.push({
+          rule: rule.rule,
+          kind: rule.kind,
+          line: lineNo,
+          column: valueStart + 1,
+          masked: maskSecret(value),
+          confidence
+        });
+        covered.push([valueStart, valueStart + value.length]);
+        if (m.index === rule.regex.lastIndex) {
+          rule.regex.lastIndex += 1;
+        }
+      }
+    }
+    if (!DATA_URI.test(line)) {
+      const hasKeyword = KEYWORD_CONTEXT.test(line);
+      ENTROPY_TOKEN.lastIndex = 0;
+      let tm;
+      while ((tm = ENTROPY_TOKEN.exec(line)) !== null) {
+        const token = tm[0];
+        const start = tm.index;
+        const end = start + token.length;
+        if (token.length < ENTROPY_MIN_TOKEN_LENGTH) {
+          continue;
+        }
+        if (overlaps(covered, start, end)) {
+          continue;
+        }
+        if (UUID.test(token)) {
+          continue;
+        }
+        if (/^sha(?:256|384|512)-/.test(token)) {
+          continue;
+        }
+        const entropy = shannonEntropy(token);
+        const isHex = IS_HEX.test(token);
+        if (isHex && HASH_HEX_LENGTHS.has(token.length)) {
+          continue;
+        }
+        let confidence = null;
+        if (isHex) {
+          if (entropy >= HEX_ENTROPY_THRESHOLD && hasKeyword) {
+            confidence = "high";
+          }
+        } else if (entropy >= BASE64_ENTROPY_THRESHOLD) {
+          confidence = hasKeyword ? "high" : "medium";
+        }
+        if (confidence === null) {
+          continue;
+        }
+        if (isPlaceholderValue(token, pathHint)) {
+          confidence = "low";
+        }
+        findings.push({
+          rule: "entropy",
+          kind: "high-entropy-string",
+          line: lineNo,
+          column: start + 1,
+          masked: maskSecret(token),
+          confidence
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+export {
+  scanText
+};