@event4u/agent-config 16.3.0 → 16.5.0

package/dist/cli-delegate/{chunk-NQ7WT43P.js → chunk-TMWYUOK4.js}

@@ -1,7 +1,7 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
-  readHookStdin
-} from "./chunk-F7DQWYR5.js";
+  read_lockfile
+} from "./chunk-LQOCRFWT.js";
 import {
   has_stable_session_id,
   owns_session_state,
@@ -9,13 +9,13 @@ import {
   prune_stale_session_states,
   session_state_file,
   update_json_under_lock
-} from "./chunk-E4XIZDIB.js";
-import {
-  read_lockfile
-} from "./chunk-T7L2QK3K.js";
+} from "./chunk-7HKRE54K.js";
 import {
   scanText
 } from "./chunk-KB5FZ655.js";
+import {
+  readHookStdin
+} from "./chunk-F7DQWYR5.js";
 
 // src/scripts/_lib/subagent_capsule.ts
 var EPISTEMIC_STATES = ["verified", "assumed", "gap"];
@@ -562,6 +562,8 @@ function segmentVerifies(rawWords) {
     case "node":
     case "deno":
       return rest.some((a) => a === "test" || a.startsWith("--test"));
+    case "agent-config":
+      return false;
     case "scripts-run": {
       const script = bareName(arg1);
       return /^(check|lint|verify|validate)[-_]/.test(script);
@@ -579,6 +581,12 @@ var _WIDE_CANDIDATE_RE = /\b(test|tests|vitest|jest|pytest|phpunit|pest|tsc|esli
 function mightBeVerification(command) {
   return _WIDE_CANDIDATE_RE.test(command);
 }
+function isAssetRenderCommand(command) {
+  return /\bui:render\b/.test(command) && /--profile[= ]\s*asset\b/.test(command);
+}
+function isVerificationAttempt(command) {
+  return isVerificationCommand(command) || isAssetRenderCommand(command);
+}
 
 // src/scripts/_lib/touched_file_quality.ts
 import { spawnSync } from "node:child_process";
@@ -586,9 +594,18 @@ import * as fs2 from "node:fs";
 import * as path2 from "node:path";
 var OUTPUT_HEAD_LINES = 20;
 var DEFAULT_TIMEOUT_MS = 3e4;
+var ESLINT_IGNORED = /^\s+\d+:\d+\s+warning\s+File ignored because of a matching ignore pattern\b/;
 var JS_EXTENSIONS = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mts", ".cts"];
 var SCOPED_FORMS = /* @__PURE__ */ new Map([
-  ["npx eslint .", { argv: ["npx", "eslint"], extensions: JS_EXTENSIONS, check_form: false }],
+  [
+    "npx eslint .",
+    {
+      argv: ["npx", "eslint"],
+      extensions: JS_EXTENSIONS,
+      check_form: false,
+      ignored_signal: ESLINT_IGNORED
+    }
+  ],
   [
     "vendor/bin/phpstan analyse",
     { argv: ["vendor/bin/phpstan", "analyse"], extensions: [".php"], check_form: false }
@@ -605,6 +622,15 @@ var SCOPED_FORMS = /* @__PURE__ */ new Map([
   ["mypy .", { argv: ["mypy"], extensions: [".py"], check_form: false }]
 ]);
 var MUTATING_WITHOUT_CHECK_FORM = /* @__PURE__ */ new Set([]);
+var SCOPED_FORM_COMMANDS = [...SCOPED_FORMS.keys()];
+var MUTATING_COMMANDS = [...MUTATING_WITHOUT_CHECK_FORM];
+var TYPE_CHECK_COMMANDS = /* @__PURE__ */ new Set([
+  "npx tsc --noEmit",
+  "vendor/bin/phpstan analyse",
+  "mypy .",
+  "go vet ./...",
+  "cargo clippy"
+]);
 function extensionOf(file) {
   const base = path2.basename(file);
   const dot = base.lastIndexOf(".");
@@ -665,6 +691,7 @@ function runTouchedFileQuality(opts) {
         output_head: [],
         skipped: plan.skipped,
         files: [],
+        ignored_files: [],
         at: now()
       });
       continue;
@@ -681,25 +708,60 @@ function runTouchedFileQuality(opts) {
       enoent = true;
     }
     const absent = enoent || status === 127;
+    const signal = SCOPED_FORMS.get(plan.source_command)?.ignored_signal;
+    const ignored = absent || signal === void 0 ? [] : ignoredFiles(output2, signal, plan.files);
+    const nothingLooked = ignored.length === plan.files.length && status === 0;
     out.push({
       command: renderCommand(plan.argv),
       source_command: plan.source_command,
-      exit_code: absent ? null : status,
+      exit_code: absent || nothingLooked ? null : status,
       output_head: absent ? [] : headLines(output2, OUTPUT_HEAD_LINES),
       skipped: absent ? "absent" : null,
       files: plan.files,
+      ignored_files: ignored,
       at: now()
     });
   }
-  return out;
+  const typecheck_not_run = out.filter(
+    (r) => TYPE_CHECK_COMMANDS.has(r.source_command) && r.exit_code === null && r.skipped !== "no_files" && r.skipped !== null
+  ).map((r) => r.source_command);
+  return out.map((r) => ({ ...r, typecheck_not_run: [...typecheck_not_run] }));
+}
+function ignoredFiles(output2, signal, files) {
+  const reported = [];
+  let unattributed = false;
+  let current = null;
+  for (const line of output2.split(/\r\n|\r|\n/)) {
+    if (signal.test(line)) {
+      if (current === null) unattributed = true;
+      else reported.push(normalizePath(current));
+      continue;
+    }
+    if (line !== "" && !/^\s/.test(line)) current = line.trim();
+  }
+  const hit = files.filter((f) => {
+    const want = normalizePath(f);
+    return reported.some((r) => r === want || r.endsWith(`/${want}`));
+  });
+  if (hit.length === 0 && unattributed && files.length === 1) return [...files];
+  return hit;
 }
 var WARN_LINE_MAX_BYTES = 200;
 function advisoryLine(runs) {
+  const ignored = [...new Set(runs.flatMap((r) => r.ignored_files))];
+  const ignoredPart = ignored.length === 0 ? "" : `ignored ${ignored[0] ?? ""}${ignored.length > 1 ? ` (+${String(ignored.length - 1)} more)` : ""}`;
   const failed = runs.find((r) => r.skipped === null && r.exit_code !== null && r.exit_code !== 0);
-  if (failed === void 0) return null;
+  if (failed === void 0) {
+    if (ignored.length === 0) return null;
+    return truncateToBytes(
+      `touched-file quality: no verdict, ${ignoredPart}`,
+      WARN_LINE_MAX_BYTES
+    );
+  }
   const file = failed.files[0] ?? "(no file)";
   const more = failed.files.length > 1 ? ` (+${String(failed.files.length - 1)} more)` : "";
-  const line = `touched-file quality: ${failed.source_command} exited ${String(failed.exit_code)} on ${file}${more}`;
+  const tail = ignoredPart === "" ? "" : `; ${ignoredPart}`;
+  const line = `touched-file quality: ${failed.source_command} exited ${String(failed.exit_code)} on ${file}${more}${tail}`;
   return truncateToBytes(line, WARN_LINE_MAX_BYTES);
 }
 function truncateToBytes(text, max) {
@@ -2699,7 +2761,8 @@ function pruneAgedRefusalState(workspaceRoot, opts = {}) {
 }
 
 export {
-  isVerificationCommand,
+  isAssetRenderCommand,
+  isVerificationAttempt,
   readRunEvidence,
   hasRedThenGreen,
   describeRecordFinding,

package/dist/cli-delegate/{chunk-EEHDXSYD.js → chunk-WQWXGIWB.js}

@@ -5,7 +5,7 @@ import {
 import {
   resolve_with_fallback,
   write_target
-} from "./chunk-NDJLNC6Q.js";
+} from "./chunk-T6BP34WI.js";
 import {
   __export,
   __toESM
@@ -875,7 +875,7 @@ function _build_debate(d) {
   if (!_isDict(d)) {
     throw new CouncilConfigError("`debate` must be a mapping.");
   }
-  const cap = _pyFloat(_get(d, "max_cost_usd", 5));
+  const cap = _pyFloat(_get(d, "max_cost_usd", 0));
   if (cap < 0) {
     throw new CouncilConfigError(
       `debate.max_cost_usd must be >= 0 (got ${_pyRepr(_f(cap))}; use 0 to disable the cap).`
@@ -1400,10 +1400,14 @@ function _build_cost_budget(d) {
     throw new CouncilConfigError("`cost_budget` must be a mapping.");
   }
   const cb = {
-    max_input_tokens: _pyInt(_get(d, "max_input_tokens", 5e5)),
-    max_output_tokens: _pyInt(_get(d, "max_output_tokens", 2e5)),
+    max_input_tokens: _pyInt(_get(d, "max_input_tokens", 0)),
+    // 0 = unbounded (ADR-279)
+    max_output_tokens: _pyInt(_get(d, "max_output_tokens", 0)),
+    // 0 = unbounded (ADR-279)
     max_calls: _pyInt(_get(d, "max_calls", 50)),
-    max_total_usd: _pyFloat(_get(d, "max_total_usd", 20)),
+    // fan-out, not money — kept
+    max_total_usd: _pyFloat(_get(d, "max_total_usd", 0)),
+    // 0 = unbounded (ADR-279)
     daily_limit_usd: _pyFloat(_get(d, "daily_limit_usd", 0))
   };
   const fields = [
@@ -1749,275 +1753,7 @@ function _pyTruthy(value) {
   return Object.keys(value).length > 0;
 }
 
-// src/scripts/_lib/cc_transcript.ts
-import * as fs3 from "node:fs";
-import * as path3 from "node:path";
-import { homedir as homedir2 } from "node:os";
-var DEFAULT_PROJECTS_ROOT = path3.join(homedir2(), ".claude", "projects");
-function projectStoreSlug(cwd) {
-  return cwd.replace(/[^A-Za-z0-9-]/g, "-");
-}
-function billableInputTokens(u) {
-  return u.input_tokens + u.cache_read_input_tokens + u.cache_creation_input_tokens;
-}
-function weightedInputUnits(u) {
-  const knownSplit = u.ephemeral_5m_input_tokens + u.ephemeral_1h_input_tokens;
-  const unaccounted = Math.max(0, u.cache_creation_input_tokens - knownSplit);
-  return u.input_tokens * 1 + u.cache_read_input_tokens * 0.1 + (u.ephemeral_5m_input_tokens + unaccounted) * 1.25 + u.ephemeral_1h_input_tokens * 2;
-}
-function numOr0(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : 0;
-}
-function toTokenCounts(raw) {
-  const cc = raw?.cache_creation ?? {};
-  return {
-    input_tokens: numOr0(raw?.input_tokens),
-    cache_read_input_tokens: numOr0(raw?.cache_read_input_tokens),
-    cache_creation_input_tokens: numOr0(raw?.cache_creation_input_tokens),
-    output_tokens: numOr0(raw?.output_tokens),
-    ephemeral_5m_input_tokens: numOr0(cc.ephemeral_5m_input_tokens),
-    ephemeral_1h_input_tokens: numOr0(cc.ephemeral_1h_input_tokens)
-  };
-}
-function measureContentBytes(raw) {
-  const content = raw.message?.content;
-  if (content === void 0 || content === null) return null;
-  if (typeof content === "string") return Buffer.byteLength(content, "utf8");
-  try {
-    return Buffer.byteLength(JSON.stringify(content), "utf8");
-  } catch {
-    return null;
-  }
-}
-function classifyBucket(raw) {
-  const hasAgentId = typeof raw.agentId === "string" && raw.agentId.length > 0;
-  return hasAgentId || raw.isSidechain === true ? "subagent" : "main";
-}
-function dedupKey(raw) {
-  const id = typeof raw.message?.id === "string" ? raw.message.id : "";
-  const reqId = typeof raw.requestId === "string" ? raw.requestId : "";
-  return `${id}\0${reqId}`;
-}
-function parseLine(line) {
-  if (line.trim().length === 0) return null;
-  try {
-    return JSON.parse(line);
-  } catch {
-    return null;
-  }
-}
-function listTranscriptFiles(opts = {}) {
-  const root = opts.root ?? DEFAULT_PROJECTS_ROOT;
-  const base = opts.projectDir ? path3.isAbsolute(opts.projectDir) ? opts.projectDir : path3.join(root, opts.projectDir) : root;
-  if (!fs3.existsSync(base)) return [];
-  const cutoffMs = opts.maxAgeDays !== void 0 ? (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.maxAgeDays * 24 * 60 * 60 * 1e3 : null;
-  const out = [];
-  const stack = [base];
-  while (stack.length > 0) {
-    const dir = stack.pop();
-    let entries;
-    try {
-      entries = fs3.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const full = path3.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        stack.push(full);
-        continue;
-      }
-      if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
-      if (cutoffMs !== null) {
-        let mtimeMs;
-        try {
-          mtimeMs = fs3.statSync(full).mtimeMs;
-        } catch {
-          continue;
-        }
-        if (mtimeMs < cutoffMs) continue;
-      }
-      out.push(full);
-    }
-  }
-  return out.sort();
-}
-function scanTranscripts(opts = {}) {
-  const files = listTranscriptFiles(opts);
-  const seen = /* @__PURE__ */ new Set();
-  const records = [];
-  let totalSeen = 0;
-  for (const file of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(file, "utf-8");
-    } catch {
-      continue;
-    }
-    for (const line of text.split("\n")) {
-      const raw = parseLine(line);
-      if (!raw || raw.type !== "assistant" || !raw.message?.usage) continue;
-      totalSeen += 1;
-      const key = dedupKey(raw);
-      if (seen.has(key)) continue;
-      seen.add(key);
-      records.push({
-        bucket: classifyBucket(raw),
-        agentId: typeof raw.agentId === "string" ? raw.agentId : null,
-        model: typeof raw.message.model === "string" ? raw.message.model : "unknown",
-        timestamp: typeof raw.timestamp === "string" ? raw.timestamp : null,
-        usage: toTokenCounts(raw.message.usage),
-        content_bytes: opts.measureBytes === true ? measureContentBytes(raw) : null
-      });
-    }
-  }
-  const dedupedCount = records.length;
-  return {
-    records,
-    totalSeen,
-    dedupedCount,
-    dedup_ratio: totalSeen > 0 ? (totalSeen - dedupedCount) / totalSeen : 0
-  };
-}
-function measureBytesPerToken(records) {
-  let bytes = 0;
-  let tokens = 0;
-  let n = 0;
-  for (const rec of records) {
-    if (rec.content_bytes === null || rec.usage.output_tokens <= 0) continue;
-    bytes += rec.content_bytes;
-    tokens += rec.usage.output_tokens;
-    n += 1;
-  }
-  if (n === 0 || tokens <= 0) return null;
-  return {
-    basis: "measured",
-    content_bytes: bytes,
-    output_tokens: tokens,
-    bytes_per_token: bytes / tokens,
-    records: n
-  };
-}
-function derivedBytes(tokens, factor) {
-  if (factor === null) return null;
-  return {
-    basis: "derived",
-    tokens,
-    factor,
-    bytes: Math.round(tokens * factor.bytes_per_token)
-  };
-}
-function emptyAggregate(bucket) {
-  return {
-    bucket,
-    calls: 0,
-    input_tokens: 0,
-    cache_read_input_tokens: 0,
-    cache_creation_input_tokens: 0,
-    output_tokens: 0,
-    ephemeral_5m_input_tokens: 0,
-    ephemeral_1h_input_tokens: 0,
-    read_share: 0,
-    weighted_input_units: 0
-  };
-}
-function aggregateByBucket(records) {
-  const buckets = {
-    main: emptyAggregate("main"),
-    subagent: emptyAggregate("subagent")
-  };
-  for (const rec of records) {
-    const agg = buckets[rec.bucket];
-    agg.calls += 1;
-    agg.input_tokens += rec.usage.input_tokens;
-    agg.cache_read_input_tokens += rec.usage.cache_read_input_tokens;
-    agg.cache_creation_input_tokens += rec.usage.cache_creation_input_tokens;
-    agg.output_tokens += rec.usage.output_tokens;
-    agg.ephemeral_5m_input_tokens += rec.usage.ephemeral_5m_input_tokens;
-    agg.ephemeral_1h_input_tokens += rec.usage.ephemeral_1h_input_tokens;
-  }
-  for (const bucket of Object.values(buckets)) {
-    const billable = billableInputTokens(bucket);
-    bucket.read_share = billable > 0 ? bucket.cache_read_input_tokens / billable : 0;
-    bucket.weighted_input_units = weightedInputUnits(bucket);
-  }
-  return buckets;
-}
-
-// src/scripts/_lib/spawn_env.ts
-var DENY_EXACT = /* @__PURE__ */ new Set([
-  // dynamic loader
-  "LD_PRELOAD",
-  "LD_LIBRARY_PATH",
-  "LD_AUDIT",
-  "DYLD_INSERT_LIBRARIES",
-  "DYLD_LIBRARY_PATH",
-  "DYLD_FRAMEWORK_PATH",
-  "GCONV_PATH",
-  // git command-injection
-  "GIT_EXTERNAL_DIFF",
-  "GIT_SSH",
-  "GIT_SSH_COMMAND",
-  "GIT_PROXY_COMMAND",
-  "GIT_PAGER",
-  "PAGER",
-  // git config-injection: GIT_ALTERNATE_OBJECT_DIRECTORIES can point git at
-  // attacker-controlled object stores; the GIT_CONFIG* family is handled by
-  // prefix below (it is a general arbitrary-config-injection primitive).
-  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-  // git path-redirection: GIT_DIR / GIT_INDEX_FILE / GIT_NAMESPACE point a
-  // child's git at an attacker-controlled repo, index file, or ref namespace
-  // — ordinary git ops then read and write attacker state (low severity,
-  // same family as GIT_ALTERNATE_OBJECT_DIRECTORIES above).
-  "GIT_DIR",
-  "GIT_INDEX_FILE",
-  "GIT_NAMESPACE",
-  // resolver hijack: HOSTALIASES remaps hostnames via an attacker file,
-  // redirecting any network fetch the child performs (CWE-427-adjacent).
-  "HOSTALIASES",
-  // runtime auto-exec hooks
-  "NODE_OPTIONS",
-  "BASH_ENV",
-  "ENV",
-  "PYTHONPATH",
-  "PYTHONSTARTUP",
-  "PYTHONINSPECT",
-  "PERL5OPT",
-  "PERL5LIB",
-  "RUBYOPT",
-  // shell field-splitting
-  "IFS"
-]);
-function isDeniedByFamily(name) {
-  if (name.startsWith("LD_") || name.startsWith("DYLD_")) return true;
-  if (name.startsWith("GIT_") && name.endsWith("_COMMAND")) return true;
-  if (name === "GIT_CONFIG" || name.startsWith("GIT_CONFIG_")) return true;
-  return false;
-}
-function hardenedSpawnEnv(overrides = {}) {
-  const out = {};
-  for (const [key, value] of Object.entries(process.env)) {
-    if (value === void 0) continue;
-    if (DENY_EXACT.has(key)) continue;
-    if (isDeniedByFamily(key)) continue;
-    out[key] = value;
-  }
-  for (const [key, value] of Object.entries(overrides)) {
-    out[key] = value;
-  }
-  return out;
-}
-
 export {
-  DEFAULT_PROJECTS_ROOT,
-  projectStoreSlug,
-  billableInputTokens,
-  weightedInputUnits,
-  scanTranscripts,
-  measureBytesPerToken,
-  derivedBytes,
-  aggregateByBucket,
-  hardenedSpawnEnv,
   CLI_CALLS_ATTRIBUTION_SUFFIX,
   CLI_CONSUMER_COUNCIL,
   CLI_CONSUMER_TEAM,
@@ -2036,5 +1772,8 @@ export {
   admitsContent,
   policyExclusionReason,
   _RAW_KEY_PREFIXES,
+  COUNCIL_CONFIG_ENV,
+  resolve_config_path,
+  load_council_config,
   config_exports
 };

package/dist/cli-delegate/{chunk-QLDHIPWR.js → chunk-XQTPXKFA.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-F7DQWYR5.js";
 import {
   load_agent_settings
-} from "./chunk-JY2I2DXV.js";
+} from "./chunk-H76PHZBI.js";
 
 // src/scripts/chat_history.ts
 import { createHash } from "node:crypto";