@event4u/agent-config 16.1.0 → 16.3.0

package/src/install/globalRuleScope.ts

@@ -0,0 +1,109 @@
+/**
+ * The rule scope governing a GLOBAL deploy.
+ *
+ * Moved out of `src/scripts/install.ts` by
+ * `road-to-an-installed-layer-that-is-thinned` step 1.1, which adds the thinning
+ * call to the same deploy loop. `check_source_size_budget` is a one-way ratchet
+ * with no per-change headroom, and this repository's stated convention is that
+ * the total falls through EXTRACTION and never rises through a baseline edit —
+ * the same reason `claudeRuleRewrite` holds the claude-code post-copy reporting
+ * rather than the installer. This function is the nearest self-contained block
+ * to the change: it is the predicate the deploy loop resolves once per run, it
+ * reaches nothing else in the installer, and its four environment touches are
+ * already parameters in all but name.
+ *
+ * BEHAVIOUR IS UNCHANGED, DELIBERATELY. The body is the installer's, verbatim
+ * apart from the four injected seams below; `install.ts` keeps a wrapper of the
+ * same name and signature, so its re-export and every caller and test see what
+ * they saw before. A behaviour change smuggled into an extraction is the one
+ * thing that would make the line saving not worth having.
+ *
+ * The seams are injected rather than imported because each one is an
+ * install-time decision the installer owns: where the global settings doc lives,
+ * how this build reads and parses YAML, what the packaged template says, and
+ * where a warning goes.
+ */
+
+import { LEGACY_ALL, ruleScopeFromSettings, type RuleScope } from './rule_scope.js';
+
+export interface GlobalRuleScopeInputs {
+    /** The global settings file, or `null` when no artefact exists at all. */
+    readonly settingsPath: string | null;
+    /** The package being installed from. */
+    readonly packageRoot: string;
+    /** Read a file as text; throws like `fs.readFileSync` when it cannot. */
+    readonly readText: (p: string) => string;
+    /** Parse YAML permissively — anything unparseable comes back non-object. */
+    readonly parseYaml: (text: string) => unknown;
+    /** The packaged template settings, read only on a genuinely fresh machine. */
+    readonly loadDefaults: () => Record<string, unknown>;
+    /** Where a loud fallback goes. */
+    readonly warn: (message: string) => void;
+}
+
+function isPlainObject(v: unknown): boolean {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+/**
+ * Resolve the rule scope governing THIS global deploy — the same way the wizard
+ * does (`src/server/routes/install.ts::_resolveRuleScope`), so the two global
+ * paths cannot ship different rule sets for the same settings.
+ *
+ * Settings resolution mirrors `_resolve_scoped_projection` above: an existing
+ * global settings doc is authoritative, and only a genuinely fresh machine falls
+ * through to the packaged template. Any read or parse failure resolves to
+ * `LEGACY_ALL` — over-shipping is the safe direction, and the compat exclusion
+ * (`source-of-truth.md`) still applies even then.
+ */
+export function resolveGlobalRuleScope(inputs: GlobalRuleScopeInputs): RuleScope {
+    const { packageRoot, warn } = inputs;
+    const settings_path = inputs.settingsPath;
+
+    // No global settings artefact at all — a genuinely fresh machine. Fall
+    // through to the packaged template silently: there is no user decision to
+    // contradict, and this is the documented upgrade-compat path.
+    if (settings_path === null) {
+        try {
+            return ruleScopeFromSettings(inputs.loadDefaults(), packageRoot);
+        } catch {
+            return LEGACY_ALL;
+        }
+    }
+
+    // A doc EXISTS, so the user has expressed a configuration. Failing to read
+    // it is not the same as not having one: falling back to legacy-all here
+    // ships the maintainer-only rules the user may have deliberately scoped out,
+    // and `_load_yaml_doc` would report that as an indistinguishable `{}`. So
+    // parse it explicitly and be LOUD when it does not parse — over-shipping
+    // stays the safe direction, but it must not be a silent one.
+    let text: string;
+    try {
+        text = inputs.readText(settings_path);
+    } catch (e) {
+        warn(
+            `could not read ${settings_path} (${String(e)}) — rule scoping falls back ` +
+                'to legacy-all, so ALL rules including maintainer-only ones will be ' +
+                'installed. Fix the file to restore scoping.',
+        );
+        return LEGACY_ALL;
+    }
+    const parsed = inputs.parseYaml(text);
+    if (!isPlainObject(parsed)) {
+        warn(
+            `${settings_path} is not a YAML mapping — rule scoping falls back to ` +
+                'legacy-all, so ALL rules including maintainer-only ones will be ' +
+                'installed. Fix the file to restore scoping.',
+        );
+        return LEGACY_ALL;
+    }
+    try {
+        return ruleScopeFromSettings(parsed as Record<string, unknown>, packageRoot);
+    } catch (e) {
+        warn(
+            `could not derive rule scope from ${settings_path} (${String(e)}) — ` +
+                'falling back to legacy-all; ALL rules will be installed.',
+        );
+        return LEGACY_ALL;
+    }
+}

package/src/install/host_rule_ownership.ts

@@ -0,0 +1,170 @@
+/**
+ * Which host-rule files this package may delete or overwrite.
+ *
+ * The defect this closes: `_cleanDir` removed every entry under
+ * `.cursor/rules` and `.windsurf/rules` whose NAME was not one this run had
+ * just emitted, and `.windsurfrules` was overwritten unconditionally. A rule
+ * file another agent package wrote — or one the consumer wrote by hand — was
+ * destroyed on every install, which is the opposite of what the uninstall
+ * claim promises.
+ *
+ * Ownership is read from the installed-tools manifest's `files[]` inventory,
+ * never from a marker inside the file. The `.mdc` emitter writes no package
+ * tag (`condense.ts` `_emit_cursor_mdc`), so a tag-based gate would classify
+ * every file this package ever wrote as foreign and therefore never remove a
+ * stale one — it would read as conservative and in fact be inert. The manifest
+ * is the record of what this installer actually put on disk, so it is the
+ * thing that can answer the question.
+ *
+ * This module only READS that manifest. It never rewrites it: the available
+ * reader (`installed_tools.read_manifest`) drops nested `files[]` by design,
+ * so a read-modify-write through it would erase every other tool's inventory —
+ * the failure `manifestFiles.ts` documents at length.
+ *
+ * The consequence, stated rather than implied: a consumer whose manifest does
+ * not claim a path gets that path KEPT. Unproven means kept, never deleted.
+ * That is the safe direction for this lane and it is also a real limit — a
+ * stale file of ours sitting under an unclaimed path stays until something
+ * claims it.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { sha256OfFile } from './fsPrimitives.js';
+import { classifyOwnership, recordedHashesForRoot, type RecordedHashes } from './recordedOwnership.js';
+
+/** The first line every `.windsurfrules` this package generates carries. */
+export const WINDSURFRULES_HEADER = '# Auto-generated from .augment/rules/ — do not edit directly';
+
+export interface CleanResult {
+    /** Entry names removed from the directory. */
+    removed: string[];
+    /** Entries kept because nothing proves this package wrote them. */
+    kept: number;
+}
+
+/** Every file path beneath `full`, or `[full]` when it is a file. */
+function filesUnder(full: string): string[] {
+    let stat: fs.Stats;
+    try {
+        stat = fs.lstatSync(full);
+    } catch {
+        return [];
+    }
+    if (!stat.isDirectory()) return [full];
+    const out: string[] = [];
+    for (const name of fs.readdirSync(full)) {
+        out.push(...filesUnder(path.join(full, name)));
+    }
+    return out;
+}
+
+/**
+ * Is this exact file ours AND still carrying the bytes we wrote?
+ *
+ * The recorded digest is the point, not the path. A path-membership test
+ * answers "did we ever write here", which merges two materially different
+ * trees: a generated file still as we left it, and one the consumer has since
+ * edited. Deleting the second loses their work, and `recordedOwnership` exists
+ * to tell them apart — importing its map and then ignoring its hashes was the
+ * defect an independent review named here.
+ */
+function isUnchangedOurs(file: string, owned: RecordedHashes): boolean {
+    const target = path.resolve(file);
+    if (!owned.has(target)) return false;
+    return classifyOwnership(owned.get(target), sha256OfFile(target)) === 'recorded-unchanged';
+}
+
+/**
+ * Remove the stale entries of ours from `dir`, keeping everything else.
+ *
+ * An entry is removable only when every file it contains is ours AND
+ * unmodified: one unclaimed or edited file inside a directory keeps the whole
+ * directory, because removing it would take that file with it.
+ */
+export function cleanOwnedOnly(
+    dir: string,
+    valid: ReadonlySet<string>,
+    owned: RecordedHashes,
+): CleanResult {
+    let entries: string[];
+    try {
+        entries = fs.readdirSync(dir);
+    } catch {
+        return { removed: [], kept: 0 };
+    }
+    const removed: string[] = [];
+    let kept = 0;
+    for (const name of entries) {
+        if (name === 'README.md' || valid.has(name)) continue;
+        const full = path.join(dir, name);
+        const contained = filesUnder(full);
+        const ours = contained.length > 0 && contained.every((f) => isUnchangedOurs(f, owned));
+        if (!ours) {
+            kept += 1;
+            continue;
+        }
+        try {
+            fs.rmSync(full, { recursive: true, force: true });
+            removed.push(name);
+        } catch {
+            kept += 1;
+        }
+    }
+    return { removed, kept };
+}
+
+/**
+ * May this package write `.windsurfrules` at `target`?
+ *
+ * Yes when the file is absent, or when it still carries the header this
+ * package generates. Nothing else.
+ *
+ * A manifest claim is deliberately NOT a second route in. The file is
+ * generated and overwritten on every install, so the header IS the ownership
+ * signal and it is content-derived: if the header is gone, something replaced
+ * the file, and "the manifest says we wrote here once" is exactly the stale
+ * fact that would let us overwrite a neighbour's replacement. An independent
+ * review caught that route open, with a fixture asserting it.
+ */
+export function mayWriteWindsurfRules(target: string, owned: RecordedHashes): boolean {
+    void owned;
+    if (!fs.existsSync(target)) return true;
+    let head: string;
+    try {
+        head = fs.readFileSync(target, 'utf-8').split('\n', 1)[0] ?? '';
+    } catch {
+        // Unreadable is unproven, and unproven means do not touch it.
+        return false;
+    }
+    return head.trim() === WINDSURFRULES_HEADER;
+}
+
+/**
+ * May this package write a rule file at `target`?
+ *
+ * The cleanup pass is not enough on its own, and an independent review found
+ * the hole: `_cleanDir` skips every name this run just emitted, so a
+ * neighbour's `foo.mdc` that happens to share a basename with one of our
+ * rules was already OVERWRITTEN by the time ownership was consulted. The
+ * check has to run BEFORE the write, which is what this is for.
+ *
+ * Absent, or ours and unmodified → write. Anything else is someone's file or
+ * someone's edit, and is left exactly as it is.
+ */
+export function mayWriteRuleFile(target: string, owned: RecordedHashes): boolean {
+    if (!fs.existsSync(target)) return true;
+    return isUnchangedOurs(target, owned);
+}
+
+/** The manifest's claimed paths for a consumer root; empty when none resolves. */
+export function ownedPaths(projectRoot: string): RecordedHashes {
+    return recordedHashesForRoot(projectRoot);
+}
+
+/** The one line the emitter prints when it kept a neighbour's files. */
+export function keptLine(kept: number): string | null {
+    if (kept <= 0) return null;
+    return `kept: ${kept} neighbour file(s)`;
+}

package/src/install/installThinLayer.ts

@@ -0,0 +1,312 @@
+/**
+ * Thin an INSTALLED Claude Code rule layer, in place, after the copy.
+ *
+ * `road-to-an-installed-layer-that-is-thinned` step 1.1. The global install step
+ * copies `dist/agent-src/rules` verbatim into `~/.claude/rules`
+ * (`install.ts::_copy_dir_dereferencing_symlinks`), so a consumer receives every
+ * rule body whether or not any trigger ever fires. The round that opened that
+ * roadmap measured a fresh install at 102 unconditional files and 338,225
+ * characters against a host that reports a 150,000 budget. Thinning existed —
+ * `project_thin_rules::build_thin` — but ran only on the maintainer projection,
+ * which no consumer receives.
+ *
+ * Three properties, each a defect this would otherwise reintroduce.
+ *
+ * **The stub is built from the SOURCE tree, never from the installed file.**
+ * `claudeRuleRewrite` runs immediately before this and reduces each installed
+ * rule to the host's activation vocabulary — `paths:` plus the ownership keys —
+ * dropping `description:` and the `triggers:` block. Those two are exactly what
+ * `thin_entry` reads to write the stub's matching signal, so a stub built from
+ * the rewritten file would carry an empty description and no `Fires on:` hint.
+ * Reading `<packageRoot>/dist/agent-src/rules/<name>` keeps the signal intact.
+ *
+ * **The installed frontmatter is kept verbatim.** The roadmap's step 1.1 ends
+ * "Ownership keys survive", and it is not decoration: `reap_tagged_orphans`
+ * calls the literal `package:` line "the only path with ownership proof
+ * independent of inventory history", and doctor's stale-orphan check reads the
+ * same tag. A stub that replaced the whole file would delete the reaper's only
+ * evidence for every thinned rule. So only the BODY is replaced; the header the
+ * copy and the rewrite produced is written back unchanged, which also preserves
+ * any `paths:` block — harmless, since a path-only rule is never thinned.
+ *
+ * **A user-modified file is skipped, not overwritten.** The preserved set comes
+ * from the conflict tracker, the same one the copy consulted. Step 1.3 requires
+ * an upgrade to preserve and report those files; thinning one would destroy an
+ * edit the copy had just declined to destroy.
+ *
+ * The rollback of step 1.2 needs nothing here, and the reason is the ordering.
+ *
+ * The install manifest records each deployed file's digest from the bytes ON
+ * DISK at manifest-write time, which is after this pass. So the next run sees
+ * `recorded-unchanged` for a thinned file, `decideDeployWrite` returns `write`,
+ * and the verbatim copy restores the full body. Switching the mode back to
+ * `eager-all` therefore un-thins by simply not running this pass — no inverse
+ * operation, and no stub left behind. The property that carries it is the
+ * ordering, which `tests/scripts/install_thin_layer.test.ts` pins directly.
+ *
+ * Side-effect-free apart from the writes it is asked to make. No CLI entry, no
+ * `process.exit` — this module is reachable from the `build:install-bundle`
+ * entry and `check_installer_import_purity` forbids both.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import * as os from 'node:os';
+
+import {
+    buildHostLimitRows,
+    loadHostInstructionLimits,
+    readLayer,
+    renderHostLimitRows,
+    type LayerReading,
+} from '../scripts/_lib/installed_layer.js';
+import { GLOBAL_RULE_DIRS, globalRuleLayerPath } from './globalRuleLayers.js';
+import { manifest_path } from '../scripts/_lib/installed_tools.js';
+import { NO_RECORDED_HASHES, readRecordedHashes } from './recordedOwnership.js';
+import {
+    absoluteBodyLinkPrefix,
+    build_thin,
+    split_frontmatter,
+} from '../scripts/_lib/thin_rules.js';
+
+export interface ThinInstalledLayerResult {
+    /** Files that stand as a stub after this pass, whether or not it wrote them. */
+    readonly thinned: number;
+    /**
+     * Of those, the ones whose bytes actually changed.
+     *
+     * Separate from {@link thinned} so a repeat install's receipt does not claim
+     * work it did not do: on an already-thinned layer every file is `thinned`
+     * and none is `rewritten`.
+     */
+    readonly rewritten: number;
+    /** Installed rules the predicate keeps full-bodied (kernel, trigger-less, path-only, `no_stub`). */
+    readonly kept: number;
+    /** Basenames skipped because the conflict tracker preserved a user-modified file. */
+    readonly preserved: readonly string[];
+    /** Basenames the stub map names that this layer does not carry — out of rule scope. */
+    readonly absent: readonly string[];
+    /** Per-rule write failures, reported rather than thrown. */
+    readonly failed: ReadonlyArray<{ readonly rule: string; readonly reason: string }>;
+    /** The absolute prefix every stub's `Body:` link was built on. */
+    readonly bodyLinkPrefix: string;
+    /** Characters the layer held before and after, over the files this pass examined. */
+    readonly charsBefore: number;
+    readonly charsAfter: number;
+}
+
+export interface ThinInstalledLayerOptions {
+    /** The installed rule directory, e.g. `~/.claude/rules`. */
+    readonly rulesDir: string;
+    /** The package this install was made from — carries `dist/`, `src/config/`. */
+    readonly packageRoot: string;
+    /** Absolute paths the conflict tracker preserved; never rewritten here. */
+    readonly preserved?: ReadonlySet<string>;
+}
+
+/**
+ * Replace the body of every thinnable rule in `rulesDir` with its stub.
+ *
+ * Idempotent: a layer already thinned is rewritten to byte-identical content,
+ * so a repeated install neither grows nor drifts.
+ */
+export function thinInstalledRuleLayer(opts: ThinInstalledLayerOptions): ThinInstalledLayerResult {
+    const packageRoot = path.resolve(opts.packageRoot);
+    const bodySourceDir = path.join(packageRoot, 'dist', 'agent-src', 'rules');
+    const bodyLinkPrefix = absoluteBodyLinkPrefix(packageRoot);
+    const preserved = opts.preserved ?? new Set<string>();
+
+    // Scope is `null` on purpose. The copy already applied the install's rule
+    // scope, so the files that EXIST in `rulesDir` are the scoped set; asking
+    // `build_thin` to resolve the scope a second time would be a second reader
+    // of the same decision, and the two could disagree. Anything the stub map
+    // names that is not on disk is simply out of scope and is reported as such.
+    const stubs = build_thin(bodySourceDir, null, null, null, { packageRoot, bodyLinkPrefix });
+
+    let thinned = 0;
+    let rewritten = 0;
+    let kept = 0;
+    let charsBefore = 0;
+    let charsAfter = 0;
+    const preservedHits: string[] = [];
+    const absent: string[] = [];
+    const failed: Array<{ rule: string; reason: string }> = [];
+
+    for (const [name, stubText] of stubs) {
+        const target = path.join(opts.rulesDir, name);
+        let installed: string;
+        try {
+            installed = fs.readFileSync(target, 'utf-8');
+        } catch (e) {
+            // ENOENT is the documented meaning of `absent` — the copy's rule
+            // scope did not place this rule here. Anything else (EACCES, EISDIR,
+            // EIO) is a FAILURE wearing a scoping outcome's clothes, and the
+            // receipt prints failures and does not print absences, so the two
+            // must not share a bucket.
+            if ((e as NodeJS.ErrnoException).code === 'ENOENT') absent.push(name);
+            else failed.push({ rule: name, reason: String(e) });
+            continue;
+        }
+        // KEPT-VS-THINNED IS DECIDED BY IDENTITY, NOT BY A CONTENT SNIFF.
+        // `build_thin` returns either a stub or the SOURCE TEXT VERBATIM, so
+        // the full-bodied branch is exactly "the map value equals the source
+        // file". Testing `is_thin_entry(stubText)` instead would misread a
+        // source rule whose own body happened to contain the marker — and that
+        // rule would then be written as `installedFrontmatter + fullSourceText`,
+        // duplicating the frontmatter block. Zero such rules ship today, which
+        // makes it latent rather than live, and `THIN_ENTRY_MARKER`'s own
+        // docstring argues against exactly this kind of inferred detection.
+        let sourceText: string | null;
+        try {
+            sourceText = fs.readFileSync(path.join(bodySourceDir, name), 'utf-8');
+        } catch {
+            sourceText = null;
+        }
+        if (stubText === sourceText) {
+            // Kept full-bodied by `build_thin`'s own predicate — kernel,
+            // trigger-less, path-only, or a declared `no_stub` member. The
+            // installed copy is already the right shape; touching it would be
+            // this pass inventing a decision the projector did not make.
+            kept += 1;
+            charsBefore += installed.length;
+            charsAfter += installed.length;
+            continue;
+        }
+        if (preserved.has(path.resolve(target))) {
+            preservedHits.push(name);
+            charsBefore += installed.length;
+            charsAfter += installed.length;
+            continue;
+        }
+        const [frontmatter] = split_frontmatter(installed);
+        charsBefore += installed.length;
+        // `split_frontmatter` answers `['', text]` for a file that OPENS a
+        // frontmatter block and never closes it — a truncated write, a file
+        // ending exactly on the closing fence with no trailing newline, CRLF.
+        // Writing `'' + stub` there would delete the `package:` line this
+        // module's header calls the reaper's only evidence, which is the one
+        // corruption this pass could cause. A file that claims a block it does
+        // not have is left exactly as found and reported.
+        //
+        // The test is a REGEX rather than `startsWith('---')` because the
+        // claim can be preceded by a BOM or by leading whitespace, and either
+        // one took the prefix check's "no block here" branch straight into the
+        // write it exists to prevent.
+        if (frontmatter === '' && /^\uFEFF?[\s]*---/.test(installed)) {
+            failed.push({
+                rule: name,
+                reason: 'opens a frontmatter block that never closes — left untouched so its ' +
+                    'ownership keys survive',
+            });
+            charsAfter += installed.length;
+            continue;
+        }
+        const next = `${frontmatter}${stubText}`;
+        try {
+            if (next !== installed) {
+                fs.writeFileSync(target, next, 'utf-8');
+                rewritten += 1;
+            }
+            thinned += 1;
+            charsAfter += next.length;
+        } catch (e) {
+            failed.push({ rule: name, reason: String(e) });
+            charsAfter += installed.length;
+        }
+    }
+
+    if (stubs.size === 0) {
+        // A ZERO-STUB MAP AND A ZERO-THINNABLE LAYER PRINT THE SAME RECEIPT, so
+        // the one that is a failure has to say so. `_globSortedMd` swallows an
+        // unreadable directory and answers `[]`, which is what a wrongly
+        // resolved package root produces — the hazard `ThinRoots` exists for.
+        // Without this the feature would be silently not applied behind a
+        // success-shaped line, and the installer's try/catch sees only throws.
+        failed.push({
+            rule: bodySourceDir,
+            reason: 'no rule bodies found to build stubs from — the layer was left full-bodied',
+        });
+    }
+
+    return {
+        thinned,
+        rewritten,
+        kept,
+        preserved: preservedHits,
+        absent,
+        failed,
+        bodyLinkPrefix,
+        charsBefore,
+        charsAfter,
+    };
+}
+
+/**
+ * One receipt line per outcome, for a caller that prints.
+ *
+ * Returns the lines rather than writing them, so the installer's `--quiet` and
+ * its progress-event emitter stay the only things deciding what a consumer sees.
+ */
+export function describeThinInstalledLayer(res: ThinInstalledLayerResult): string[] {
+    const out: string[] = [];
+    out.push(
+        res.rewritten === 0 && res.thinned > 0
+            ? `  claude-code: ${String(res.thinned)} rule(s) already thinned, ` +
+                  `${String(res.kept)} kept full-bodied; ` +
+                  `${String(res.charsAfter)} chars — nothing to rewrite`
+            : `  claude-code: thinned ${String(res.rewritten)} rule(s) to stubs, ` +
+                  `${String(res.kept)} kept full-bodied; ` +
+                  `${String(res.charsBefore)} -> ${String(res.charsAfter)} chars`,
+    );
+    if (res.preserved.length > 0) {
+        out.push(
+            `  claude-code: ${String(res.preserved.length)} rule(s) left full — you edited them ` +
+                `and they are preserved, never overwritten (${res.preserved.join(', ')})`,
+        );
+    }
+    for (const f of res.failed) {
+        out.push(`  claude-code: ${f.rule}: could not write stub — ${f.reason}`);
+    }
+    return out;
+}
+
+/**
+ * The install receipt's instruction-budget block — step 1.4's "at install".
+ *
+ * The step asks for the limit, the split and the 80 % warning AT INSTALL, and
+ * the measurement existed only behind the standalone `installed_layer_report`
+ * CLI: `buildHostLimitRows`'s own docstring named "the install receipt" as the
+ * caller it was exported for, and that caller did not exist. A consumer whose
+ * layer is over budget learned it from the host, which is the notice the
+ * roadmap exists to remove.
+ *
+ * Global layers only, deliberately. The install writes `~/.claude/rules` and
+ * its siblings; a project layer is not what this run just changed, and folding
+ * one in would make the receipt's number disagree with the thing it is a
+ * receipt FOR.
+ *
+ * Never throws. A receipt that cannot be measured is silent rather than fatal —
+ * the deploy it describes has already happened correctly.
+ */
+export function installReceiptBudgetLines(packageRoot: string, home: string = os.homedir()): string[] {
+    try {
+        const recorded = (() => {
+            try {
+                return readRecordedHashes(manifest_path(packageRoot), packageRoot);
+            } catch {
+                return NO_RECORDED_HASHES;
+            }
+        })();
+        const layers: LayerReading[] = [];
+        for (const host of Object.keys(GLOBAL_RULE_DIRS).sort()) {
+            const dir = globalRuleLayerPath(host, home);
+            if (dir === null) continue;
+            layers.push(readLayer(host, 'global', dir, recorded));
+        }
+        const rows = buildHostLimitRows(layers, loadHostInstructionLimits());
+        return rows.length === 0 ? [] : renderHostLimitRows(rows).map((l) => `  ${l}`);
+    } catch {
+        return [];
+    }
+}