@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/self_review_gate.ts

@@ -35,6 +35,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { CLI_CONSUMER_SELF_REVIEW } from './ai_council/cli_call_budget.js';
+import { councilEgress } from './ai_council/council_egress.js';
 import {
     AnthropicClient,
     AnthropicCliClient,
@@ -664,6 +665,22 @@ export const PROMPT_BUDGET_CHARS = Math.floor(180_000 * BUDGET_CHARS_PER_TOKEN);
  */
 export const MAX_REVIEW_CHUNKS = 6;
 
+/**
+ * `--redact-egress`: a chunk carrying a credential-shaped fixture is refused by
+ * the egress guard before it is sent, so a test of the secret detector could
+ * never be reviewed. With the flag, every detected value is replaced by a typed
+ * token through the same engine that later checks the payload, and the
+ * reviewer is told what the tokens are (AI council 2026-10-22, 2/2).
+ */
+export const REDACTION_NOTE =
+    'NOTE: credential-shaped literals in this diff were replaced by typed placeholder tokens before sending, ' +
+    'because they are test fixtures the egress guard does not let leave the machine. Review the logic around them; ' +
+    'do not report the placeholders themselves as findings.\n\n';
+
+export function redactEgress(text: string): string {
+    return councilEgress().replace(text);
+}
+
 /** How many unreviewed paths `--dry-run` names before collapsing to a count. */
 export const DRY_RUN_UNREVIEWED_SAMPLE = 5;
 
@@ -786,7 +803,23 @@ export interface ReviewPlan {
     release?: ReleaseInfo;
 }
 
-export function buildPlan(baseRef: string, cwd: string = REPO_ROOT): ReviewPlan {
+/**
+ * A run narrowed to part of the span, for a local review driven to completion.
+ * `scope` keeps only changed files under one of the given path prefixes, and
+ * names itself in the coverage record so a reader sees what was out of reach;
+ * `maxChunks` lifts the per-run ceiling for a run that is meant to finish. CI
+ * passes neither and keeps the ceiling.
+ */
+export interface PlanOptions {
+    scope?: readonly string[];
+    maxChunks?: number;
+}
+
+export function inScope(file: string, scope: readonly string[] | undefined): boolean {
+    return scope === undefined || scope.some((prefix) => file === prefix || file.startsWith(prefix.endsWith('/') ? prefix : `${prefix}/`));
+}
+
+export function buildPlan(baseRef: string, cwd: string = REPO_ROOT, opts: PlanOptions = {}): ReviewPlan {
     const packagingFiles = changedFiles(baseRef, cwd);
     const releaseVersion = detectReleaseVersionFromGit(baseRef, cwd);
 
@@ -805,7 +838,9 @@ export function buildPlan(baseRef: string, cwd: string = REPO_ROOT): ReviewPlan
         }
     }
 
-    const files = analysisBase === baseRef ? packagingFiles : changedFiles(analysisBase, cwd);
+    const files = (analysisBase === baseRef ? packagingFiles : changedFiles(analysisBase, cwd)).filter((f) =>
+        inScope(f, opts.scope),
+    );
     const reviewCopies = allChangedFiles(analysisBase, cwd).filter(isReviewCopyPath);
     const diff = diffText(analysisBase, files, cwd);
     const escalation = escalationReasons(files, changedLineCount(analysisBase, files, cwd));
@@ -824,6 +859,7 @@ export function buildPlan(baseRef: string, cwd: string = REPO_ROOT): ReviewPlan
     const partition = partitionDiff(
         perFileDiffs(analysisBase, files, cwd),
         Math.max(1, PROMPT_BUDGET_CHARS - facts.length),
+        opts.maxChunks ?? MAX_REVIEW_CHUNKS,
     );
     return {
         partition,
@@ -925,6 +961,12 @@ export function coverageBlock(coverage?: ReviewCoverage): string {
         `\n\n**Coverage.** ${String(coverage.chunks)} request(s) over ` +
             `${String(coverage.filesReviewed)} of ${String(coverage.filesTotal)} changed file(s).`,
     ];
+    if (coverage.scope && coverage.scope.length > 0) {
+        parts.push(
+            ` Scoped to ${coverage.scope.map((s) => `\`${s}\``).join(', ')}: changed files outside ` +
+                'these prefixes were not part of this run and are not counted above.',
+        );
+    }
     if ((coverage.reviewCopies ?? 0) > 0) {
         parts.push(
             ` ${String(coverage.reviewCopies)} further path(s) under \`${REVIEW_COPY_PREFIX}\` are ` +
@@ -960,6 +1002,8 @@ export interface ReviewCoverage {
      * in `filesTotal`. Optional: a record written before this field has none.
      */
     reviewCopies?: number;
+    /** The path prefixes a scoped run was narrowed to; absent for a whole-span run. */
+    scope?: readonly string[];
 }
 
 export function renderReview(findings: Finding[], enforce: boolean, escalation: readonly string[] = [], coverage?: ReviewCoverage): string {
@@ -1100,8 +1144,17 @@ export function main(argv: string[]): 0 | 2 {
     const enforce = argv.includes('--enforce');
     const baseIdx = argv.indexOf('--base');
     const baseRef = (baseIdx >= 0 ? argv[baseIdx + 1] : undefined) ?? 'origin/main';
+    const scopeIdx = argv.indexOf('--scope');
+    const scope = scopeIdx >= 0 ? (argv[scopeIdx + 1] ?? '').split(',').map((p) => p.trim()).filter((p) => p !== '') : undefined;
+    const maxIdx = argv.indexOf('--max-chunks');
+    const maxChunks = maxIdx >= 0 ? Number(argv[maxIdx + 1]) : undefined;
+    if (maxChunks !== undefined && !(Number.isInteger(maxChunks) && maxChunks > 0)) {
+        process.stderr.write('self-review-gate: --max-chunks takes a positive integer\n');
+        return 2;
+    }
 
-    const plan = buildPlan(baseRef);
+    const plan = buildPlan(baseRef, REPO_ROOT, { ...(scope ? { scope } : {}), ...(maxChunks ? { maxChunks } : {}) });
+    const redact = argv.includes('--redact-egress');
 
     // The request the live run would send, verbatim and unspent. A summary
     // would be this script's description of the request rather than the
@@ -1237,7 +1290,8 @@ export function main(argv: string[]): 0 | 2 {
             // Facts FIRST, then the partition. The reviewer reads what the
             // range did before it reads the fragment it was given, so "absent
             // from my chunk" can no longer be mistaken for "deleted".
-            const resp = client.ask(systemPrompt, plan.facts + chunk.text, 4096);
+            const body = redact ? `${REDACTION_NOTE}${redactEgress(plan.facts + chunk.text)}` : plan.facts + chunk.text;
+            const resp = client.ask(systemPrompt, body, 4096);
             if (resp.error) {
                 process.stdout.write(
                     `::warning::self-review-gate — chunk ${String(i + 1)}/` +
@@ -1279,6 +1333,7 @@ export function main(argv: string[]): 0 | 2 {
             filesTotal: plan.files.length,
             unreviewed,
             reviewCopies: plan.reviewCopies.length,
+            ...(scope ? { scope } : {}),
         };
         // Ground-truth pass, ONCE, before anything reads the finding set. A
         // deletion claim the range and the tree both disprove is annotated

package/src/scripts/session_register_hook.ts

@@ -61,6 +61,7 @@ import {
     foreign_live_records,
     iso_now,
     read_own_record,
+    global_register_dir,
     register_dir,
     safe_stem,
     stop_means_session_end,
@@ -68,8 +69,17 @@ import {
     ttl_seconds_for,
     write_record,
 } from './_lib/session_register.js';
+import { pr_watch_block } from './_lib/session_pr_watch.js';
 import { pruneAgedRefusalState, readSessionCounts } from './_lib/turn_end_refusals.js';
 import { readHookStdin } from './hooks/hook_stdin.js';
+import { probeRanToday, stampProbeRun } from './hooks/probe_throttle.js';
+import { retroDailyProbe } from './retro_sweep.js';
+import { dailyCleanup } from './worktree_cleanup_check.js';
+import { sessionNotice } from './_lib/advisory_notice.js';
+
+/** The `probe_throttle` stamp of the retro's daily probe. */
+const RETRO_PROBE_STAMP = 'retro-sweep';
+const WORKTREE_PROBE_STAMP = 'worktree-cleanup';
 
 /** Replay-fixture runs must never mutate state (same contract as chat_history). */
 const REPLAY_ENV_VAR = 'AGENT_CONFIG_REPLAY';
@@ -597,7 +607,29 @@ export function touch(
     // Preserve the original started_at across beats; first beat sets it.
     const existing = read_own_record(dir, session_id);
     const started_at = existing?.started_at ?? iso_now(now);
-    return write_record(dir, build_record(workspace_root, session_id, platform, started_at, now));
+    const rec = build_record(workspace_root, session_id, platform, started_at, now);
+    // road-to-an-update-that-installs-itself-only-when-it-is-safe 1.4 — the
+    // same record, a second time, in the MACHINE-wide register. Two writes
+    // rather than one register because the two answer different questions: the
+    // repo register drives the collision block, which is meaningless across
+    // repositories, while `upgrade --unattended` has to know whether ANY
+    // session is live before it swaps a binary every session's hooks run.
+    //
+    // Best-effort by construction: `write_record` creates its directory and
+    // swallows every write error, and its result never decides this function's
+    // return value, so a read-only or absent global root leaves session
+    // registration working exactly as it did. The try covers the one call that
+    // can still throw — resolving the home directory. The cost of best-effort is
+    // stated where it matters: `any_live_session` reads a missing record as "no
+    // session", so the unattended run leans on its lock and age gates too.
+    // Written as compactly as it is because the hook bundle is byte-budgeted:
+    // the first version (a separate mkdir and a second try) put the bundle over.
+    try {
+        write_record(global_register_dir(), rec);
+    } catch {
+        /* a session that cannot reach the global root still starts */
+    }
+    return write_record(dir, rec);
 }
 
 /**
@@ -821,6 +853,15 @@ export function main(): number {
         if (event === 'session_end' || (event === 'stop' && stop_means_session_end(platform))) {
             const dir = register_dir(root);
             if (dir !== null) delete_record(dir, session_id);
+            // 1.4 — the global mirror dies with the session on the same beat.
+            // Without this the machine-wide register would only ever shrink by
+            // TTL expiry, so a clean exit would still block an unattended
+            // upgrade for the whole TTL window of its platform.
+            try {
+                delete_record(global_register_dir(), session_id);
+            } catch {
+                /* unreachable global root is not a reason to fail session end */
+            }
             // The claim file dies with the session too. Keyed on a session id it is
             // never read again once that session ends, so leaving it behind grows one
             // file per session forever — the same unbounded-growth defect the register
@@ -880,13 +921,59 @@ export function main(): number {
                     /* an unprunable directory keeps its files; it is not an error */
                 }
             }
+            if (event === 'user_prompt_submit') {
+                // The live state of PRs this session opened. `warn` is the one
+                // decision whose context reaches the model on this slot; the
+                // dispatcher turns it into a host-facing exit 0, so it never blocks.
+                const prs = pr_watch_block(root, session_id, new Date());
+                if (prs !== null) {
+                    process.stdout.write(
+                        JSON.stringify({ decision: 'warn', reason: 'session PR state', additional_context: prs }) + '\n',
+                    );
+                    return 2;
+                }
+            }
             if (event === 'session_start') {
-                const block = foreign_sessions_block(root, session_id, new Date());
-                if (block !== null) {
+                // The retro's daily probe (docs/contracts/retro-v1.md, path C)
+                // rides this slot rather than a concern of its own: it fires once
+                // per session, the concern count is ratcheted, and it never throws.
+                const retro = retroDailyProbe(root, {
+                    ranToday: (r) => probeRanToday(r, RETRO_PROBE_STAMP),
+                    stamp: (r) => stampProbeRun(r, RETRO_PROBE_STAMP),
+                });
+                // The worktree pass rides the same slot on the same terms
+                // (worktrees roadmap 3.3, council 2026-10-21 Q1): once a day,
+                // a 3 s subprocess deadline, never throws. Under
+                // `worktrees.cleanup: auto` it removes the proven set — a
+                // declared authority expansion the user-owned key arms (ADR-295).
+                const worktrees =
+                    dailyCleanup(root, {
+                        ranToday: (r) => probeRanToday(r, WORKTREE_PROBE_STAMP),
+                        stamp: (r) => stampProbeRun(r, WORKTREE_PROBE_STAMP),
+                    })?.line ?? null;
+                // The advisory notice (advisories roadmap 4.2): read-only — one
+                // cache file read, one "shown today" stamp written, no network
+                // and no action. `advisories.mode: off` silences it.
+                let advisories: string | null = null;
+                try {
+                    advisories = sessionNotice(root);
+                } catch {
+                    advisories = null;
+                }
+                const foreign = foreign_sessions_block(root, session_id, new Date());
+                const block = [foreign, retro, worktrees, advisories].filter((b): b is string => b !== null).join('\n\n');
+                if (block !== '') {
                     process.stdout.write(
                         JSON.stringify({
                             decision: 'allow',
-                            reason: 'live foreign sessions on this repository',
+                            reason: [
+                                foreign !== null ? 'live foreign sessions on this repository' : null,
+                                retro !== null ? 'retro queue' : null,
+                                worktrees !== null ? 'worktree cleanup' : null,
+                                advisories !== null ? 'advisories' : null,
+                            ]
+                                .filter((r): r is string => r !== null)
+                                .join(', '),
                             context: block,
                         }) + '\n',
                     );

package/src/scripts/sessions_cli.ts

@@ -26,7 +26,16 @@
  * - `claim <slug>` — record that THIS SESSION has taken a roadmap. Writes the
  *   bridge file the next heartbeat lifts into the register, keyed on the host
  *   session id where one exists.
- * - `claim --release` — clear the claim.
+ * - `claim <slug> --lane [--worktree P] [--branch B]` — take a roadmap for a
+ *   subagent lane of this session. Takes the per-slug lock only, so the
+ *   session's own claim is untouched and each lane keeps its roadmap.
+ * - `claim --release [<slug>]` — clear the claim and this session's locks, or
+ *   one slug's lock.
+ *
+ * Every claim also takes the per-slug lock (`_lib/roadmap_slug_lock.ts`): an
+ * exclusive create in the git common dir that a peer in any worktree sees at
+ * once, and that refuses a second live holder. The lock records the worktree
+ * and branch, so a holder killed mid-run leaves the place its work sits.
  *
  * ## Why two axes and not one
  *
@@ -44,6 +53,14 @@ import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
 import { write_atomic } from './_lib/fs_atomic.js';
+import { current_branch } from './_lib/git_common_dir.js';
+import {
+    acquire_lock,
+    holder_is_live,
+    read_holders,
+    read_locks,
+    release_locks,
+} from './_lib/roadmap_slug_lock.js';
 import {
     classify_collisions,
     iso_now,
@@ -66,7 +83,9 @@ function usage(): number {
             '                                           that axis to the JSON form)',
             '  agent-config sessions:claim <slug> [--paths <a,b,…>]       claim a roadmap for this session',
             '  agent-config sessions:claim <slug> --force   claim it even though a peer holds it',
-            '  agent-config sessions:claim --release    drop this session\'s roadmap claim',
+            '  agent-config sessions:claim <slug> --lane [--worktree P] [--branch B]',
+            '                                           claim a roadmap for a subagent lane of this session',
+            '  agent-config sessions:claim --release [<slug>]   drop this session\'s claim and locks, or one slug',
             '',
         ].join('\n'),
     );
@@ -422,6 +441,18 @@ export function claim_conflicts(
             }
         }
     }
+    // The lock is written at claim time, so it is the half of a peer's claim that
+    // a same-turn screen can see; the register record above arrives a heartbeat late.
+    const holders = read_holders(root);
+    for (const l of read_locks(root)) {
+        if (l.slug !== slug || !holder_is_live(l, holders)) continue;
+        if (sid !== null && l.session_id !== null && safe_stem(l.session_id) === safe_stem(sid)) continue;
+        if (sid === null && l.session_id === null && _same_path(l.worktree, root)) continue;
+        out.push({
+            kind: 'session',
+            detail: `${l.lane ? 'lane of a ' : ''}session on branch \`${l.branch ?? 'detached'}\` in ${l.worktree}`,
+        });
+    }
     for (const b of branch_name_hits(root, slug)) {
         out.push({ kind: 'branch', detail: `branch \`${b.branch}\` in ${b.worktree}` });
     }
@@ -450,6 +481,29 @@ function cmd_claim(argv: string[], root: string): number {
     // `claim_dir` in session_register_hook.ts for the full account.
     const target = claim_file(root, sid);
     if (argv.includes('--release')) {
+        const one = argv.find((a) => !a.startsWith('-')) ?? null;
+        const released = release_locks(root, sid, one);
+        if (one !== null) {
+            // One slug: the session's own claim file goes only if it names that slug.
+            const own = claim_read_paths(root, sid).find((p) => {
+                try {
+                    return (JSON.parse(fs.readFileSync(p, 'utf-8')) as { slug?: string }).slug === one;
+                } catch {
+                    return false;
+                }
+            });
+            if (own !== undefined && path.basename(own) === path.basename(target)) {
+                try {
+                    fs.unlinkSync(own);
+                } catch {
+                    /* already gone */
+                }
+            }
+            process.stdout.write(
+                released.length > 0 ? `Released "${one}".\n` : `No lock of this session on "${one}".\n`,
+            );
+            return 0;
+        }
         // Release only what this session could have written. An identified session
         // never writes the legacy file, so unlinking it would delete a PEER's claim
         // in a mixed-host checkout and leave that peer reporting nothing, with no
@@ -475,13 +529,17 @@ function cmd_claim(argv: string[], root: string): number {
     }
     const paths_idx = argv.indexOf('--paths');
     const paths_arg = paths_idx >= 0 ? (argv[paths_idx + 1] ?? '') : '';
+    const wt_idx = argv.indexOf('--worktree');
+    const br_idx = argv.indexOf('--branch');
+    const lane = argv.includes('--lane');
     const owned_paths = paths_arg
         .split(',')
         .map((x) => x.trim())
         .filter((x) => x !== '');
     // The slug is the first bare token that is not the VALUE of --paths; without
     // this the comma list would be read as the slug on `claim --paths a,b road-to-x`.
-    const slug = argv.find((a, i) => !a.startsWith('-') && i !== paths_idx + 1);
+    const value_at = new Set([paths_idx, wt_idx, br_idx].filter((i) => i >= 0).map((i) => i + 1));
+    const slug = argv.find((a, i) => !a.startsWith('-') && !value_at.has(i));
     if (slug === undefined || slug.trim() === '') {
         return usage();
     }
@@ -522,6 +580,40 @@ function cmd_claim(argv: string[], root: string): number {
         return 1;
     }
 
+    const worktree = wt_idx >= 0 ? path.resolve(argv[wt_idx + 1] ?? root) : root;
+    const branch = br_idx >= 0 ? (argv[br_idx + 1] ?? null) : current_branch(worktree);
+    let took_over_from: string | null = null;
+    try {
+        const got = acquire_lock(
+            root,
+            { slug: slug.trim(), session_id: sid, lane, worktree, branch, written_at: iso_now() },
+            read_holders(root),
+            { force: forced },
+        );
+        if (!got.ok) {
+            process.stderr.write(
+                `sessions:claim: REFUSED — "${slug.trim()}" is locked by a live ${got.holder.lane ? 'lane' : 'session'}\n` +
+                    `  on branch \`${got.holder.branch ?? 'detached'}\` in ${got.holder.worktree}.\n` +
+                    'Pick another roadmap, or coordinate with that session first.\n',
+            );
+            return 1;
+        }
+        if (got.took_over !== null) {
+            took_over_from = `${got.took_over.worktree} (${got.took_over.branch ?? 'no branch'})`;
+        }
+    } catch (exc) {
+        process.stderr.write(`sessions:claim: could not take the lock — ${String(exc)}\n`);
+        return 1;
+    }
+    if (lane) {
+        process.stdout.write(
+            `Locked "${slug.trim()}" for a lane in ${worktree} (${branch ?? 'no branch'}).\n` +
+                (took_over_from !== null
+                    ? `Its previous holder is dead; its work sits in ${took_over_from} — continue there.\n`
+                    : ''),
+        );
+        return 0;
+    }
     try {
         write_atomic(
             target,
@@ -544,11 +636,14 @@ function cmd_claim(argv: string[], root: string): number {
         return 1; // the claim is the whole point of this verb; a silent no-op would lie
     }
     process.stdout.write(
-        `Claimed "${slug.trim()}" for this session. It becomes visible to other\n` +
+        (took_over_from !== null
+            ? `Its previous holder is dead; its work sits in ${took_over_from} — continue there.\n`
+            : '') +
+            `Claimed "${slug.trim()}" for this session. The lock is visible to every\n` +
+            'session at once; the register record follows on the next heartbeat.\n' +
             (owned_paths.length > 0
                 ? `Declared ${owned_paths.length} owned path(s); peers sharing one are labelled PATH OVERLAP.\n`
                 : '') +
-            'sessions on the next turn, when the heartbeat lifts it into the register.\n' +
             (sid === null
                 ? 'NOTE: this host exports no session id, so the claim is scoped to this\n' +
                   'WORKTREE — a second session in the same checkout will overwrite it.\n'

package/src/scripts/skill_collision_clusters.ts

@@ -37,7 +37,7 @@ const SKILLS_DIR = SRC_SKILLS();
 // `agents/runtime/reports/`, as this file's own header has always declared. The
 // code said `agents/reports/` (tracked) — harmless while the gate read a dead
 // root and never got far enough to write, load-bearing the moment it did.
-const OUT_JSON = path.join(REPO_ROOT, 'agents', 'runtime', 'reports', 'skill-collision-clusters.json');
+export const OUT_JSON = path.join(REPO_ROOT, 'agents', 'runtime', 'reports', 'skill-collision-clusters.json');
 
 const KEYWORD_OVERLAP_THRESHOLD = 0.4;
 const MIN_SHARED_KEYWORDS = 3;

package/src/scripts/skill_tools/score_skill_relevance.ts

@@ -51,6 +51,8 @@ import {
     type TermStats,
 } from '../../shared/skillRanking.js';
 
+declare const __AGENT_CONFIG_CLI_DELEGATE__: boolean | undefined;
+
 const _HERE = fileURLToPath(import.meta.url);
 // src/scripts/skill_tools/score_skill_relevance.ts → parents[3] of the .py
 // (skill_tools → scripts → src → repo root) is the package root.
@@ -553,7 +555,7 @@ export function rankDetailed(
     skillsDir: string | readonly string[],
     opts: RankOptions = {},
     ctx?: NeighbourContext,
-): { rows: RankRow[]; raw: ReadonlyMap<string, number> } {
+): { rows: RankRow[]; raw: ReadonlyMap<string, number>; descriptions: ReadonlyMap<string, string> } {
     const taskTerms = _tokenize(task);
     const skills = _load_skills_across(
         typeof skillsDir === 'string' ? [skillsDir] : skillsDir,
@@ -566,6 +568,12 @@ export function rankDetailed(
     const stats = opts.idfWeighting ? buildTermStats(skills.map(_rankable), termSets) : undefined;
     const rows: RankRow[] = [];
     const raw = new Map<string, number>();
+    // The description is carried OUT of the loop rather than added to `RankRow`:
+    // the tuple shape is the Python-parity one and several callers destructure
+    // it positionally, so widening it would break them for a field most of them
+    // do not want. A caller that needs the choosing text reads this map by the
+    // same qualified name the row carries.
+    const descriptions = new Map<string, string>();
     for (let i = 0; i < skills.length; i += 1) {
         const s = skills[i] as Skill;
         const unrounded = _rawScore(taskTerms, s, termSets[i] as ReadonlySet<string>, opts, stats);
@@ -573,12 +581,13 @@ export function rankDetailed(
         if (score > 0) {
             rows.push([s.qualified, score, [...s.personas]]);
             raw.set(s.qualified, unrounded);
+            descriptions.set(s.qualified, s.description);
         }
     }
     // rows.sort(key=lambda r: (-r[1], r[0])) — Python stable tuple sort, with
     // the opt-in unrounded tie-break between the two keys.
     rows.sort((a, b) => compareRanked(a[0], a[1], b[0], b[1], opts, raw));
-    return { rows, raw };
+    return { rows, raw, descriptions };
 }
 
 /** Mirror Python `f"{s:<{w}}"` (left-justify) over code-point width. */
@@ -872,6 +881,26 @@ export function main(argv: string[] | null = null): number {
 }
 
 function _isCliEntry(): boolean {
+    // INSIDE A CLI-DELEGATE BUNDLE THIS MODULE IS NEVER THE ENTRY.
+    //
+    // esbuild bundles every import of a `cmd_*.ts` into ONE file, and in that
+    // file `import.meta.url` is the BUNDLE's url for every inlined module. So
+    // the comparisons below see argv[1] and `import.meta.url` as the same path
+    // and fire — running this CLI's argparse over the HOST command's argv.
+    //
+    // Measured, not predicted: `route:explain "commit this and push to main"`
+    // answered `score_skill_relevance.py: error: unrecognized arguments` the
+    // moment `cmd_route_explain.ts` imported this module, and only through the
+    // bundle — the tsc path was green.
+    //
+    // The define is the right discriminator rather than a heuristic: the
+    // delegate bundles are built from `src/scripts/_cli/cmd_*.ts`,
+    // `src/agent-src/scripts/*.ts` and two named aux entries, and this file is
+    // none of them. It can be a LIBRARY in such a bundle; it can never be the
+    // entry.
+    if (typeof __AGENT_CONFIG_CLI_DELEGATE__ !== 'undefined' && __AGENT_CONFIG_CLI_DELEGATE__) {
+        return false;
+    }
     if (process.argv[1] === undefined) {
         return false;
     }

package/src/scripts/skill_trigger_eval.ts

@@ -22,6 +22,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { artefact_roots, resolve_logical } from './_lib/agent_src.js';
+import { vendorPrefix } from './_lib/egress_rules.js';
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 import * as user_global_paths from './_lib/user_global_paths.js';
 
@@ -414,9 +415,10 @@ export function load_anthropic_key(p: string = ANTHROPIC_KEY_PATH): string {
     if (!key) {
         throw new KeyGateError(`${p} is empty.`);
     }
-    if (!key.startsWith('sk-ant-')) {
+    const prefix = vendorPrefix('anthropic-api-key');
+    if (!key.startsWith(prefix)) {
         throw new KeyGateError(
-            `${p} does not contain an Anthropic key (expected 'sk-ant-' prefix).`,
+            `${p} does not contain an Anthropic key (expected '${prefix}' prefix).`,
         );
     }
     return key;