@event4u/agent-config 16.3.0 → 16.4.0

package/dist/install/installThinLayer.js

@@ -51,10 +51,9 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { buildHostLimitRows, loadHostInstructionLimits, readLayer, renderHostLimitRows, } from '../scripts/_lib/installed_layer.js';
+import { buildHostLimitRows, loadHostInstructionLimits, ownershipLine, readLayer, renderHostLimitRows, resolveLayerOwnership, } from '../scripts/_lib/installed_layer.js';
 import { GLOBAL_RULE_DIRS, globalRuleLayerPath } from './globalRuleLayers.js';
 import { manifest_path } from '../scripts/_lib/installed_tools.js';
-import { NO_RECORDED_HASHES, readRecordedHashes } from './recordedOwnership.js';
 import { absoluteBodyLinkPrefix, build_thin, split_frontmatter, } from '../scripts/_lib/thin_rules.js';
 /**
  * Replace the body of every thinnable rule in `rulesDir` with its stub.
@@ -234,16 +233,43 @@ export function describeThinInstalledLayer(res) {
  * Never throws. A receipt that cannot be measured is silent rather than fatal —
  * the deploy it describes has already happened correctly.
  */
-export function installReceiptBudgetLines(packageRoot, home = os.homedir()) {
+export function installReceiptBudgetLines(packageRoot, home = os.homedir(), opts = {}) {
     try {
-        const recorded = (() => {
-            try {
-                return readRecordedHashes(manifest_path(packageRoot), packageRoot);
-            }
-            catch {
-                return NO_RECORDED_HASHES;
-            }
-        })();
+        // ONE RESOLVER, SHARED WITH THE REPORT — step 1.2. This used to read
+        // `manifest_path(packageRoot)`, the PACKAGE root's lock, which on a
+        // global-only install names a file no global install ever writes; the
+        // receipt then printed `0 package-owned` for a layer it had itself just
+        // deployed. `resolveLayerOwnership` falls through to the inventory, and
+        // `thisDeploy` covers the first install, where the receipt prints
+        // before `record_deploy` has written anything.
+        const { recorded, sources } = resolveLayerOwnership({
+            manifestPath: opts.manifestPath === undefined ? manifest_path(packageRoot) : opts.manifestPath,
+            projectRoot: packageRoot,
+            // The same home the layers below are read from — the inventory's
+            // anchor is tilde-relative, so the two must agree or the receipt
+            // measures one install and claims ownership of another.
+            home,
+            // THE RECEIPT IS THE "ASKING PROCESS" CASE, so it names no home
+            // here. It runs inside the install that WROTE the inventory, and
+            // that writer resolves the path through `inventory_path()` —
+            // honouring `AGENT_CONFIG_DEPLOY_INVENTORY`, which names a FILE
+            // rather than a home, and `EVENT4U_CONFIG_HOME`. Passing `home`
+            // would take `defaultInventoryPath`'s stated-home branch and read
+            // `<home>/.event4u/...`, a file nothing wrote under either
+            // override, and the inventory evidence would be silently lost.
+            // UNDEFINED IS LEFT UNDEFINED so `resolveLayerOwnership` applies
+            // `defaultInventoryPath(home)` — the SAME resolution the report
+            // uses. Hardcoding `inventory_path()` here made the two readers
+            // step 1.2 exists to reconcile disagree for any home that is not
+            // the asking process's: the receipt read one install's inventory
+            // and then expanded its tilde-relative anchors against the OTHER
+            // home, which is the cross-home misattribution two docstrings in
+            // the resolver forbid. `defaultInventoryPath` already returns
+            // `inventory_path()` when the stated home IS this process's, which
+            // is the case that motivated the hardcode.
+            inventoryPath: opts.inventoryPath,
+            thisDeploy: opts.thisDeploy,
+        });
         const layers = [];
         for (const host of Object.keys(GLOBAL_RULE_DIRS).sort()) {
             const dir = globalRuleLayerPath(host, home);
@@ -252,7 +278,9 @@ export function installReceiptBudgetLines(packageRoot, home = os.homedir()) {
             layers.push(readLayer(host, 'global', dir, recorded));
         }
         const rows = buildHostLimitRows(layers, loadHostInstructionLimits());
-        return rows.length === 0 ? [] : renderHostLimitRows(rows).map((l) => `  ${l}`);
+        if (rows.length === 0)
+            return [];
+        return [`  ${ownershipLine(sources)}`, ...renderHostLimitRows(rows).map((l) => `  ${l}`)];
     }
     catch {
         return [];

package/dist/install/installedRuleLinks.js

@@ -105,33 +105,88 @@ const EMPTY_COUNTS = () => ({
     'file-missing': 0,
 });
 /**
- * Audit every link in every rule the plan installs.
+ * Every `.md` file under `dir`, as POSIX paths relative to it, sorted.
  *
- * `packageRoot` is the package checkout the installer copies FROM; the rule
- * bodies are read from the plan's own rules source, so the audit cannot drift
- * from what is shipped.
+ * Recursive because skills (`<name>/SKILL.md`), commands (`<cluster>/x.md`) and
+ * contexts nest.
  */
-export function auditInstalledRuleLinks(plan, packageRoot) {
+function markdownFilesUnder(dir) {
+    const out = [];
+    const walk = (rel) => {
+        for (const e of fs.readdirSync(path.join(dir, rel), { withFileTypes: true })) {
+            const child = rel === '' ? e.name : `${rel}/${e.name}`;
+            if (e.isDirectory())
+                walk(child);
+            else if (e.name.endsWith('.md'))
+                out.push(child);
+        }
+    };
+    walk('');
+    return out.sort();
+}
+/**
+ * Does this link point into a tree no install ever carries — `docs/`, which
+ * holds the ADRs?
+ *
+ * Decided from where the file sits in the PACKAGE (`dist/agent-src/<kind>/…`),
+ * not from where the install puts it: an author linking `docs/` meant the
+ * repository, whatever the host does. Two shapes count — a target landing under
+ * the top-level `docs/`, and a target naming a `docs/` segment or an ADR file
+ * that resolves to nothing in the package (an author writing `../docs/x` from
+ * a rule meant the repository's `docs/`, not a sibling that does not exist).
+ * `guidelines/docs/` is a real projected directory, which is why existence
+ * decides the second shape rather than the word alone.
+ */
+export function isNonProjectedTarget(packageRoot, packageFromDir, target) {
+    const bare = withoutAnchor(target);
+    const resolved = path.posix.normalize(path.posix.join(packageFromDir, bare));
+    if (resolved === 'docs' || resolved.startsWith('docs/'))
+        return true;
+    if (!/(^|\/)(docs\/|ADR-\d)/.test(bare))
+        return false;
+    return resolved.startsWith('..') || !fs.existsSync(path.join(packageRoot, resolved));
+}
+/**
+ * Audit every link in every file of ONE installed kind.
+ *
+ * `kindSource` is the package directory the plan copies (`dist/agent-src/skills`).
+ * A file nested at `<rel>/x.md` is installed at `<dest>/<rel>/x.md`, so its links
+ * resolve from that directory — through the same {@link auditLink} the rule
+ * audit uses, because a second resolver would be the drift this count exists to
+ * catch.
+ *
+ * Returns null when the plan does not install the kind at all: "not installed"
+ * is a different answer from "installed with zero links".
+ */
+export function auditInstalledKindLinks(plan, packageRoot, kindSource) {
+    let dest;
+    for (const [d, source] of plan)
+        if (source === kindSource)
+            dest = d;
+    if (dest === undefined)
+        return null;
     const audits = [];
-    for (const [dest, source] of plan) {
-        if (!source.endsWith('/rules'))
-            continue;
-        const dir = path.join(packageRoot, source);
-        if (!fs.existsSync(dir))
-            continue;
-        const files = fs
-            .readdirSync(dir, { withFileTypes: true })
-            .filter((e) => !e.isDirectory() && e.name.endsWith('.md'))
-            .map((e) => e.name)
-            .sort();
-        for (const file of files) {
-            const rule = file.replace(/\.md$/, '');
+    const nonProjected = [];
+    const dir = path.join(packageRoot, kindSource);
+    if (fs.existsSync(dir)) {
+        for (const file of markdownFilesUnder(dir)) {
+            const relDir = path.posix.dirname(file);
+            const installedDir = relDir === '.' ? dest : dest === '' ? relDir : `${dest}/${relDir}`;
+            const packageDir = relDir === '.' ? kindSource : `${kindSource}/${relDir}`;
+            const id = file.replace(/\.md$/, '');
             const body = fs.readFileSync(path.join(dir, file), 'utf8');
             for (const target of relativeLinkTargets(body)) {
-                audits.push(auditLink(rule, target, dest, plan, packageRoot));
+                const audit = auditLink(id, target, installedDir, plan, packageRoot);
+                if (isNonProjectedTarget(packageRoot, packageDir, target))
+                    nonProjected.push(audit);
+                else
+                    audits.push(audit);
             }
         }
     }
+    return { ...summarise(audits), non_projected: nonProjected };
+}
+function summarise(audits) {
     const counts = EMPTY_COUNTS();
     for (const a of audits)
         counts[a.verdict] += 1;
@@ -151,6 +206,37 @@ export function auditInstalledRuleLinks(plan, packageRoot) {
         .sort((a, b) => b.count - a.count || a.directory.localeCompare(b.directory));
     return { audits, counts, by_directory };
 }
+/**
+ * Audit every link in every rule the plan installs.
+ *
+ * `packageRoot` is the package checkout the installer copies FROM; the rule
+ * bodies are read from the plan's own rules source, so the audit cannot drift
+ * from what is shipped. Non-projected targets stay IN this reading: its
+ * recorded figures predate the per-kind split.
+ */
+export function auditInstalledRuleLinks(plan, packageRoot) {
+    const audits = [];
+    for (const [dest, source] of plan) {
+        if (!source.endsWith('/rules'))
+            continue;
+        const dir = path.join(packageRoot, source);
+        if (!fs.existsSync(dir))
+            continue;
+        const files = fs
+            .readdirSync(dir, { withFileTypes: true })
+            .filter((e) => !e.isDirectory() && e.name.endsWith('.md'))
+            .map((e) => e.name)
+            .sort();
+        for (const file of files) {
+            const rule = file.replace(/\.md$/, '');
+            const body = fs.readFileSync(path.join(dir, file), 'utf8');
+            for (const target of relativeLinkTargets(body)) {
+                audits.push(auditLink(rule, target, dest, plan, packageRoot));
+            }
+        }
+    }
+    return summarise(audits);
+}
 /**
  * Standing-text cost of the rewrite option, in characters.
  *

package/dist/mcp/awesome-mcp-servers.row.md

@@ -1 +1 @@
-| [@event4u/agent-config](https://event4u-app.github.io/agent-config) | Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges. | 31 tools (stdio, worker) | `npx -y @event4u/agent-config mcp-server` |
+| [@event4u/agent-config](https://event4u-app.github.io/agent-config) | Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges. | 37 tools (stdio, worker) | `agent-config mcp-server` |

package/dist/mcp/mcp-cloudflare-catalogue.json

@@ -1,10 +1,10 @@
 {
   "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) \u2014 every claim machine-checked, including the counts in these badges.",
   "homepage": "https://event4u-app.github.io/agent-config",
-  "install_hint_stdio": "npx -y @event4u/agent-config mcp-server",
+  "install_hint_stdio": "agent-config mcp-server",
   "name": "agent-config-mcp",
   "repository": "https://github.com/event4u-app/agent-config",
-  "tools_count": 31,
+  "tools_count": 37,
   "topics": [
     "agent-governance",
     "agent-skills",

package/dist/mcp/registry-manifest.json

@@ -1,15 +1,15 @@
 {
   "discovery": {
-    "artefact_count": 627,
+    "artefact_count": 628,
     "scanner_version": "de0a22b4ac4c"
   },
-  "generated_at": "2026-10-05",
+  "generated_at": "2026-10-10",
   "package": {
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) \u2014 every claim machine-checked, including the counts in these badges.",
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "16.3.0"
+    "version": "16.4.0"
   },
   "registries": [
     {
@@ -47,9 +47,9 @@
     }
   ],
   "server": {
-    "install_hint_stdio": "npx -y @event4u/agent-config mcp-server",
+    "install_hint_stdio": "agent-config mcp-server",
     "name": "agent-config-mcp",
-    "tools_count": 31,
+    "tools_count": 37,
     "transports": [
       "stdio",
       "worker"

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "16.3.0"
+      "version": "16.4.0"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "16.3.0"
+  "version": "16.4.0"
 }