@event4u/agent-config 16.5.0 → 17.0.0

package/dist/cli-delegate/chunk-GOMILC3O.js

@@ -0,0 +1,918 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+import {
+  require_dist
+} from "./chunk-OY53J6II.js";
+import {
+  event4u_root
+} from "./chunk-T6BP34WI.js";
+import {
+  __toESM
+} from "./chunk-J55WI3RR.js";
+
+// src/install/atomic.ts
+import {
+  closeSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeSync
+} from "node:fs";
+import { dirname, join } from "node:path";
+function atomicWriteFile(target, data, options = {}) {
+  const mode = options.mode ?? 420;
+  const parent = dirname(target);
+  mkdirSync(parent, { recursive: true });
+  const tmp = join(parent, `.tmp.${process.pid}.${randSuffix()}`);
+  let fd = null;
+  try {
+    fd = openSync(tmp, "w", mode);
+    const buf = typeof data === "string" ? Buffer.from(data, "utf8") : data;
+    writeSync(fd, buf, 0, buf.length, 0);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmp, target);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function atomicAppendLine(target, line) {
+  let existing = "";
+  try {
+    existing = readFileSync(target, "utf8");
+  } catch {
+    existing = "";
+  }
+  const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  atomicWriteFile(target, `${existing}${sep}${line}
+`);
+}
+function randSuffix() {
+  return Math.floor(Math.random() * 281474976710655).toString(16).padStart(12, "0");
+}
+
+// src/scripts/_lib/claude_settings_hooks.ts
+var YAML = __toESM(require_dist(), 1);
+import * as fs from "node:fs";
+import * as path from "node:path";
+function _yaml_parse(text) {
+  return YAML.parse(text);
+}
+var MANAGED_SIGNATURE = "dispatch:hook --platform claude";
+var CorruptSettingsError = class extends Error {
+  constructor(file, cause) {
+    super(
+      `${file} exists but is not valid JSON (${cause}). Refusing to overwrite a user-owned settings file \u2014 fix or remove it, then re-run.`
+    );
+    this.name = "CorruptSettingsError";
+  }
+};
+var SettingsLockError = class extends Error {
+  constructor(lockPath) {
+    super(
+      `settings lock ${lockPath} is held by another process. Re-run when the concurrent install finishes (stale lock: delete the file).`
+    );
+    this.name = "SettingsLockError";
+  }
+};
+function build_claude_hook_matrix(manifest_path) {
+  const raw = fs.readFileSync(manifest_path, "utf8");
+  const manifest = _yaml_parse(raw) ?? {};
+  const hook_spec = manifest["schema_version"] ?? 1;
+  const platforms = manifest["platforms"] ?? {};
+  const claude_events = (platforms["claude"] ?? {}) || {};
+  const aliasesAll = manifest["native_event_aliases"] ?? {};
+  const aliases = (aliasesAll["claude"] ?? {}) || {};
+  const matrix = {};
+  for (const [native, ac_raw] of Object.entries(aliases)) {
+    const ac_event = String(ac_raw);
+    const concerns = claude_events[ac_event];
+    if (!concerns || Array.isArray(concerns) && concerns.length === 0) continue;
+    const dispatchArgs = `--platform claude --event ${ac_event} --native-event ${native} --project-dir "$CLAUDE_PROJECT_DIR" --min-version ${String(hook_spec)}`;
+    matrix[native] = `R="\${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime"; S="$R/current"; N=""; [ -f "$S/node" ] && read -r N < "$S/node"; if [ -n "$N" ] && [ -x "$N" ] && [ -f "$S/dist/hooks/dispatch.js" ]; then ${native === "PreToolUse" ? "" : "exec "}"$N" "$S/dist/hooks/dispatch.js" ${dispatchArgs}; ${native === "PreToolUse" ? "else " : "fi; "}BIN=$(command -v agent-config); [ "\${BIN#/}" = "$BIN" ] && BIN=""; [ -n "$CLAUDE_PROJECT_DIR" ] && [ "\${BIN#"$CLAUDE_PROJECT_DIR"/}" != "$BIN" ] && BIN=""; [ -n "$BIN" ] || { ${_no_dispatcher_notice(native)}${_thinned_dead_carrier(native)}${_no_dispatcher_exit(native)} }; "$BIN" dispatch:hook ${dispatchArgs}` + (native === "PreToolUse" ? _pre_tool_use_exit_guard() : "");
+  }
+  return matrix;
+}
+var NO_DISPATCHER_STDERR = "agent-config: no hook dispatcher reachable, so no agent-config hook runs in this session. Hooks need the npm package where they can reach it: npm i -g @event4u/agent-config (then npx -y @event4u/agent-config init)";
+var NO_DISPATCHER_CONTEXT = "agent-config hooks are NOT running in this session: the plugin found no dispatcher, so no concern runs, the fail_closed guards block-no-verify, block-kernel-rule-writes and block-plumbing-writes included.";
+function _no_dispatcher_notice(native) {
+  const context = native === "SessionStart" ? ` echo '${NO_DISPATCHER_CONTEXT}';` : "";
+  return `[ -n "$CLAUDE_PLUGIN_ROOT" ] && { echo '${NO_DISPATCHER_STDERR}' >&2;${context} }; `;
+}
+var NO_DISPATCHER_REFUSAL = "agent-config: no hook dispatcher reachable, so this tool call is refused: the fail_closed guards block-no-verify, block-kernel-rule-writes and block-plumbing-writes cannot run. Repair in a terminal: npm i -g @event4u/agent-config then npx -y @event4u/agent-config init. To drop the hooks instead: agent-config uninstall, or delete the agent-config entries from ~/.claude/settings.json.";
+function _no_dispatcher_exit(native) {
+  if (native !== "PreToolUse") return "exit 0;";
+  return `[ -z "$CLAUDE_PLUGIN_ROOT" ] && { echo '${NO_DISPATCHER_REFUSAL}' >&2; exit 2; }; exit 0;`;
+}
+var DISPATCHER_FAILED_REFUSAL = "agent-config: the hook dispatcher did not return a verdict, so this tool call is refused: the fail_closed guards could not decide. If an agent-config upgrade is running, retry once it has finished.";
+function _pre_tool_use_exit_guard() {
+  return `; fi; RC=$?; [ "$RC" = 0 ] || [ "$RC" = 2 ] || { echo '${DISPATCHER_FAILED_REFUSAL}' >&2; exit 2; }; exit $RC`;
+}
+var THINNED_DEAD_CARRIER_LINE = "agent-config: no hook dispatcher was reached and the rule layer on disk is thinned, so routed rule bodies will not arrive in this session. Open a rule body from the absolute Body path in its stub. The full rule layer is restored for the next session.";
+function _thinned_dead_carrier(native) {
+  if (native !== "SessionStart") return "";
+  return `[ -z "$AC_HOOK_PROBE" ] && [ -f "$R/thinned" ] && { echo '${THINNED_DEAD_CARRIER_LINE}'; L=""; read -r L < "$R/thinned"; F=1; if [ -d "$L" ] && [ -d "$S/claude-rules" ]; then F=0; for f in "$S/claude-rules"/*.md; do [ -f "$f" ] || continue; t="$L/\${f##*/}"; if [ ! -e "$t" ] || grep -qx "package: event4u/agent-config" "$t"; then cp "$f" "$t.ac-restore" && mv -f "$t.ac-restore" "$t" || F=1; fi; done; fi; [ "$F" = 0 ] && mv -f "$R/thinned" "$R/demoted"; }; `;
+}
+function _is_managed_group(group) {
+  if (typeof group !== "object" || group === null || Array.isArray(group)) return false;
+  const hooks = group.hooks;
+  if (!Array.isArray(hooks)) return false;
+  return hooks.some(
+    (h) => typeof h === "object" && h !== null && typeof h.command === "string" && h.command.includes(MANAGED_SIGNATURE)
+  );
+}
+function _read_settings(settings_path) {
+  if (!fs.existsSync(settings_path)) return {};
+  const raw = fs.readFileSync(settings_path, "utf8");
+  if (raw.trim() === "") return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new CorruptSettingsError(settings_path, e.message);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new CorruptSettingsError(settings_path, "top level is not an object");
+  }
+  return parsed;
+}
+function _with_lock(settings_path, fn) {
+  const lockPath = settings_path + ".agent-config.lock";
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+  let fd;
+  try {
+    fd = fs.openSync(lockPath, "wx");
+  } catch {
+    throw new SettingsLockError(lockPath);
+  }
+  try {
+    return fn();
+  } finally {
+    fs.closeSync(fd);
+    fs.rmSync(lockPath, { force: true });
+  }
+}
+function ensure_managed_hooks(settings_path, matrix) {
+  return _with_lock(settings_path, () => {
+    const settings = _read_settings(settings_path);
+    const before = JSON.stringify(settings);
+    const hooks = (settings["hooks"] ?? {}) || {};
+    const touched = [];
+    for (const [native, command] of Object.entries(matrix)) {
+      const existing = Array.isArray(hooks[native]) ? hooks[native] : [];
+      const user_groups = existing.filter((g) => !_is_managed_group(g));
+      const managed_group = {
+        hooks: [{ type: "command", command }]
+      };
+      const next = [...user_groups, managed_group];
+      if (JSON.stringify(next) !== JSON.stringify(existing)) touched.push(native);
+      hooks[native] = next;
+    }
+    settings["hooks"] = hooks;
+    const after = JSON.stringify(settings);
+    if (after === before) {
+      return { changed: false, events: [] };
+    }
+    atomicWriteFile(settings_path, JSON.stringify(settings, null, 2) + "\n");
+    return { changed: true, events: touched };
+  });
+}
+function remove_managed_hooks(settings_path) {
+  if (!fs.existsSync(settings_path)) return { changed: false, events: [] };
+  return _with_lock(settings_path, () => {
+    const settings = _read_settings(settings_path);
+    const hooks = settings["hooks"];
+    if (typeof hooks !== "object" || hooks === null || Array.isArray(hooks)) {
+      return { changed: false, events: [] };
+    }
+    const hooksRec = hooks;
+    const touched = [];
+    for (const [native, groups] of Object.entries(hooksRec)) {
+      if (!Array.isArray(groups)) continue;
+      const kept = groups.filter((g) => !_is_managed_group(g));
+      if (kept.length !== groups.length) {
+        touched.push(native);
+        if (kept.length === 0) {
+          delete hooksRec[native];
+        } else {
+          hooksRec[native] = kept;
+        }
+      }
+    }
+    if (touched.length === 0) return { changed: false, events: [] };
+    if (Object.keys(hooksRec).length === 0) {
+      delete settings["hooks"];
+    }
+    atomicWriteFile(settings_path, JSON.stringify(settings, null, 2) + "\n");
+    return { changed: true, events: touched };
+  });
+}
+
+// src/install/stagedRuntime.ts
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import * as fs3 from "node:fs";
+import { createRequire } from "node:module";
+import * as os from "node:os";
+import * as path3 from "node:path";
+
+// src/install/userPin.ts
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+var RECEIPT_FILE = "carrier.json";
+var USER_PIN_FIELD = "user_pin";
+function readReceipt(runtimeRoot) {
+  try {
+    const raw = JSON.parse(fs2.readFileSync(path2.join(runtimeRoot, RECEIPT_FILE), "utf8"));
+    return typeof raw === "object" && raw !== null && !Array.isArray(raw) ? raw : {};
+  } catch {
+    return {};
+  }
+}
+function readUserPin(runtimeRoot) {
+  const v = readReceipt(runtimeRoot)[USER_PIN_FIELD];
+  if (v === void 0 || v === null) return null;
+  const o = typeof v === "object" ? v : {};
+  return { form: "full", set_at: typeof o["set_at"] === "string" ? o["set_at"] : "unknown" };
+}
+function writeUserPin(runtimeRoot, now = /* @__PURE__ */ new Date()) {
+  fs2.mkdirSync(runtimeRoot, { recursive: true });
+  const receipt = readReceipt(runtimeRoot);
+  const pin = { form: "full", set_at: now.toISOString().slice(0, 10) };
+  receipt[USER_PIN_FIELD] = pin;
+  fs2.writeFileSync(path2.join(runtimeRoot, RECEIPT_FILE), `${JSON.stringify(receipt, null, 2)}
+`);
+  return pin;
+}
+function describeUserPin(pin) {
+  return pin === null ? null : `rule layer pinned full by \`install --full\` (since ${pin.set_at}) \u2014 the package will not thin it on this machine`;
+}
+
+// src/install/stagedRuntime.ts
+var RUNTIME_DIRNAME = "runtime";
+var CLAUDE_LAYER_DIRNAME = "claude-rules";
+var THINNED_MARKER = "thinned";
+var DEMOTED_MARKER = "demoted";
+var CARRIER_RECORD = "carrier.json";
+var PACKAGE_STAMP_LINE = "package: event4u/agent-config";
+var STAGED_ENTRIES = [
+  "package.json",
+  "dist/hooks",
+  "dist/agent-src",
+  "dist/router.json",
+  "src/scripts",
+  "src/config"
+];
+var STAGED_RUNTIME_DEPS = ["yaml"];
+function stageRuntimeDeps(packageRoot, stage) {
+  const req = createRequire(path3.join(packageRoot, "package.json"));
+  for (const dep of STAGED_RUNTIME_DEPS) {
+    let manifest;
+    try {
+      manifest = req.resolve(`${dep}/package.json`);
+    } catch {
+      continue;
+    }
+    fs3.cpSync(path3.dirname(manifest), path3.join(stage, "node_modules", dep), { recursive: true, dereference: true });
+  }
+}
+function stagedFilter(src) {
+  return !/\.m?ts$/.test(src);
+}
+function runtimeRootFor(env) {
+  return path3.join(event4u_root(env ?? process.env), RUNTIME_DIRNAME);
+}
+function currentRuntimeDir(runtimeRoot) {
+  return path3.join(runtimeRoot, "current");
+}
+function readVersion(packageRoot) {
+  try {
+    const pkg = JSON.parse(fs3.readFileSync(path3.join(packageRoot, "package.json"), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function snapshotStampedLayer(rulesDir, dest) {
+  fs3.mkdirSync(dest, { recursive: true });
+  let names;
+  try {
+    names = fs3.readdirSync(rulesDir);
+  } catch {
+    return;
+  }
+  for (const name of names.sort()) {
+    if (!name.endsWith(".md")) continue;
+    const src = path3.join(rulesDir, name);
+    let text;
+    try {
+      if (!fs3.statSync(src).isFile()) continue;
+      text = fs3.readFileSync(src, "utf8");
+    } catch {
+      continue;
+    }
+    if (!text.split(/\r?\n/).includes(PACKAGE_STAMP_LINE)) continue;
+    fs3.writeFileSync(path3.join(dest, name), text);
+  }
+}
+function sweepStale(runtimeRoot, keep) {
+  for (const name of fs3.readdirSync(runtimeRoot)) {
+    const stale = name.startsWith("v-") && name !== keep || name.startsWith(".stage-") || name.startsWith(".current-");
+    if (stale) fs3.rmSync(path3.join(runtimeRoot, name), { recursive: true, force: true });
+  }
+}
+function stageRuntime(opts) {
+  const runtimeRoot = path3.resolve(opts.runtimeRoot);
+  const packageRoot = path3.resolve(opts.packageRoot);
+  fs3.mkdirSync(runtimeRoot, { recursive: true });
+  const version = readVersion(packageRoot);
+  const nonce = `${process.pid}-${randomBytes(4).toString("hex")}`;
+  const stage = path3.join(runtimeRoot, `.stage-${nonce}`);
+  fs3.mkdirSync(stage);
+  let copied = 0;
+  for (const rel of STAGED_ENTRIES) {
+    const src = path3.join(packageRoot, rel);
+    if (!fs3.existsSync(src)) continue;
+    fs3.cpSync(src, path3.join(stage, rel), { recursive: true, dereference: true, filter: stagedFilter });
+    copied += 1;
+    if (opts._failAfterEntries !== void 0 && copied >= opts._failAfterEntries) {
+      throw new Error("stageRuntime: injected fault");
+    }
+  }
+  stageRuntimeDeps(packageRoot, stage);
+  if (opts.claudeRulesDir) snapshotStampedLayer(opts.claudeRulesDir, path3.join(stage, CLAUDE_LAYER_DIRNAME));
+  fs3.writeFileSync(path3.join(stage, "node"), `${opts.nodePath}
+`);
+  const versionDir = `v-${version.replace(/[^A-Za-z0-9._-]/g, "_")}-${nonce}`;
+  fs3.renameSync(stage, path3.join(runtimeRoot, versionDir));
+  const current = currentRuntimeDir(runtimeRoot);
+  const link = path3.join(runtimeRoot, `.current-${nonce}`);
+  if (process.platform === "win32") {
+    fs3.symlinkSync(path3.join(runtimeRoot, versionDir), link, "junction");
+    fs3.rmSync(current, { recursive: true, force: true });
+  } else {
+    fs3.symlinkSync(versionDir, link);
+  }
+  fs3.renameSync(link, current);
+  sweepStale(runtimeRoot, versionDir);
+  return {
+    currentDir: current,
+    version,
+    dispatcher: fs3.existsSync(path3.join(current, "dist", "hooks", "dispatch.js"))
+  };
+}
+function markClaudeLayer(runtimeRoot, opts) {
+  fs3.mkdirSync(runtimeRoot, { recursive: true });
+  const marker = path3.join(runtimeRoot, THINNED_MARKER);
+  fs3.rmSync(path3.join(runtimeRoot, DEMOTED_MARKER), { force: true });
+  if (opts.thinned) fs3.writeFileSync(marker, `${path3.resolve(opts.rulesDir)}
+`);
+  else fs3.rmSync(marker, { force: true });
+}
+function readCarrierState(runtimeRoot) {
+  const layer = fs3.existsSync(path3.join(runtimeRoot, DEMOTED_MARKER)) ? "demoted" : fs3.existsSync(path3.join(runtimeRoot, THINNED_MARKER)) ? "thinned" : "full";
+  let probe = null;
+  try {
+    const raw = JSON.parse(fs3.readFileSync(path3.join(runtimeRoot, CARRIER_RECORD), "utf8"));
+    probe = raw.hosts?.["claude"] ?? null;
+  } catch {
+    probe = null;
+  }
+  return { layer, probe };
+}
+function layerAfterInstall(state, opts) {
+  if (!opts.wantsThin) return "full";
+  if (opts.probe === "reached") return "thinned";
+  return state === "demoted" ? "demoted" : "full";
+}
+var STRIPPED_PATH = "/usr/bin:/bin";
+function probeHookCommand(command, env = process.env) {
+  const probeCommand = command.replace(/--min-version (\d+)/g, "--min-version $1 --read-exit");
+  const project = fs3.mkdtempSync(path3.join(os.tmpdir(), "ac-carrier-probe-"));
+  const stdinPath = path3.join(project, "stdin.json");
+  fs3.writeFileSync(stdinPath, "{}");
+  const fd = fs3.openSync(stdinPath, "r");
+  try {
+    const childEnv = {
+      PATH: STRIPPED_PATH,
+      CLAUDE_PROJECT_DIR: project,
+      AC_HOOK_PROBE: "1"
+    };
+    for (const key of ["HOME", "USERPROFILE", "EVENT4U_CONFIG_HOME"]) {
+      if (env[key] !== void 0) childEnv[key] = env[key];
+    }
+    const res = spawnSync("/bin/sh", ["-c", probeCommand], {
+      cwd: project,
+      stdio: [fd, "pipe", "pipe"],
+      encoding: "utf-8",
+      env: childEnv,
+      timeout: 3e4
+    });
+    return typeof res.stderr === "string" && res.stderr.includes("--read-exit ok") ? "reached" : "not-reached";
+  } catch {
+    return "not-reached";
+  } finally {
+    fs3.closeSync(fd);
+    fs3.rmSync(project, { recursive: true, force: true });
+  }
+}
+function recordCarrierProbe(runtimeRoot, host, outcome, version, now = /* @__PURE__ */ new Date()) {
+  fs3.mkdirSync(runtimeRoot, { recursive: true });
+  const file = path3.join(runtimeRoot, CARRIER_RECORD);
+  let receipt = {};
+  try {
+    receipt = JSON.parse(fs3.readFileSync(file, "utf8"));
+  } catch {
+    receipt = {};
+  }
+  const hosts = receipt.hosts ?? {};
+  const date = now.toISOString().slice(0, 10);
+  const previous = hosts[host];
+  const since = previous !== void 0 && previous.outcome === outcome ? previous.since ?? previous.date : date;
+  const record = { host, outcome, date, version, since };
+  hosts[host] = record;
+  fs3.writeFileSync(file, `${JSON.stringify({ ...receipt, hosts }, null, 2)}
+`);
+  return record;
+}
+function describeCarrierProbe(probe) {
+  if (probe === null) return ["hook carrier (claude): not probed"];
+  const verdict = probe.outcome === "reached" ? "reached" : "NOT reached";
+  return [
+    `hook carrier (${probe.host}): ${verdict} from a stripped environment (PATH=${STRIPPED_PATH}) \u2014 probed ${probe.date}, package ${probe.version}`
+  ];
+}
+function describeCarrierState(state) {
+  const since = state.probe === null ? "never probed" : `carrier ${state.probe.outcome} since ${state.probe.since ?? state.probe.date}`;
+  return `hook carrier (claude): rule layer ${state.layer}, ${since}`;
+}
+function prepareClaudeCarrier(opts) {
+  const env = opts.env ?? process.env;
+  const runtimeRoot = runtimeRootFor(env);
+  const warnings = [];
+  let staged = null;
+  try {
+    staged = stageRuntime({
+      packageRoot: opts.packageRoot,
+      runtimeRoot,
+      nodePath: process.execPath,
+      claudeRulesDir: opts.rulesDir
+    });
+  } catch (e) {
+    warnings.push(`claude-code: runtime not staged under ${runtimeRoot} \u2014 ${String(e)}`);
+  }
+  if (opts.userPin === true) writeUserPin(runtimeRoot);
+  const pin = readUserPin(runtimeRoot);
+  const wantsThin = opts.wantsThin && staged !== null && pin === null;
+  const probe = process.platform === "win32" || opts.sessionStartCommand === null ? null : probeHookCommand(opts.sessionStartCommand, env);
+  if (probe !== null) recordCarrierProbe(runtimeRoot, "claude", probe, staged?.version ?? "unknown");
+  const before = readCarrierState(runtimeRoot);
+  const next = probe === null ? wantsThin ? "thinned" : "full" : layerAfterInstall(before.layer, { wantsThin, probe });
+  if (next === "full") markClaudeLayer(runtimeRoot, { thinned: false, rulesDir: opts.rulesDir });
+  const lines = describeCarrierProbe(readCarrierState(runtimeRoot).probe);
+  const pinLine = describeUserPin(pin);
+  if (pinLine !== null) lines.push(pinLine);
+  if (next === "demoted") {
+    lines.push("hook carrier (claude): machine demoted \u2014 the rule layer stays full until the probe passes");
+  }
+  return { thin: next === "thinned", bodyLinkRoot: staged?.currentDir ?? null, runtimeRoot, lines, warnings };
+}
+function probeAndPromote(sessionStartCommand, env = process.env) {
+  const runtimeRoot = runtimeRootFor(env);
+  const before = readCarrierState(runtimeRoot);
+  if (process.platform === "win32") return before;
+  const outcome = probeHookCommand(sessionStartCommand, env);
+  const staged = readVersion(currentRuntimeDir(runtimeRoot));
+  const version = staged !== "unknown" ? staged : before.probe?.version ?? "unknown";
+  recordCarrierProbe(runtimeRoot, "claude", outcome, version);
+  if (before.layer === "demoted" && outcome === "reached") {
+    fs3.rmSync(path3.join(runtimeRoot, DEMOTED_MARKER), { force: true });
+  }
+  return readCarrierState(runtimeRoot);
+}
+function removeStagedRuntime(env = process.env) {
+  const runtimeRoot = runtimeRootFor(env);
+  if (!fs3.existsSync(runtimeRoot)) return null;
+  fs3.rmSync(runtimeRoot, { recursive: true, force: true });
+  return runtimeRoot;
+}
+function sessionStartCommandFor(packageRoot) {
+  try {
+    return build_claude_hook_matrix(path3.join(packageRoot, "src", "scripts", "hook_manifest.yaml"))["SessionStart"] ?? null;
+  } catch {
+    return null;
+  }
+}
+function deployClaudeCarrier(opts) {
+  const carrier = prepareClaudeCarrier({
+    packageRoot: opts.packageRoot,
+    rulesDir: opts.rulesDir,
+    sessionStartCommand: sessionStartCommandFor(opts.packageRoot),
+    wantsThin: opts.wantsThin,
+    ...opts.userPin === true ? { userPin: true } : {}
+  });
+  for (const w of carrier.warnings) opts.warn(w);
+  if (!opts.quiet) for (const l of carrier.lines) opts.info(l);
+  if (!carrier.thin) return;
+  try {
+    const lines = opts.thin(carrier.bodyLinkRoot);
+    markClaudeLayer(carrier.runtimeRoot, { thinned: true, rulesDir: opts.rulesDir });
+    if (!opts.quiet) for (const l of lines) opts.info(l);
+  } catch (e) {
+    markClaudeLayer(carrier.runtimeRoot, { thinned: false, rulesDir: opts.rulesDir });
+    opts.warn(`claude-code: thinned rule layer not written \u2014 ${String(e)}`);
+  }
+}
+function checkHookCarrier(packageRoot, env = process.env) {
+  const runtimeRoot = runtimeRootFor(env);
+  const command = sessionStartCommandFor(packageRoot);
+  if (!fs3.existsSync(currentRuntimeDir(runtimeRoot)) || command === null) {
+    return {
+      id: "hook-carrier",
+      status: "skipped",
+      message: `no staged runtime under ${runtimeRoot}`,
+      remedy: "run `agent-config upgrade` (or `npx -y @event4u/agent-config init`) to stage it"
+    };
+  }
+  const state = probeAndPromote(command, env);
+  const reached = state.probe?.outcome === "reached";
+  return {
+    id: "hook-carrier",
+    status: reached ? "ok" : "warn",
+    message: [...describeCarrierProbe(state.probe), describeCarrierState(state)].join(" \xB7 "),
+    remedy: reached ? "" : "install node where the hook launcher can run it, then run `agent-config upgrade`"
+  };
+}
+
+// src/scripts/_lib/rule_consequence_class.ts
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+var CLASS_CONFIG_REL = "src/config/rule-consequence-class.json";
+function readConsequenceClass(repoRoot) {
+  const raw = JSON.parse(fs4.readFileSync(path4.join(repoRoot, CLASS_CONFIG_REL), "utf-8"));
+  return {
+    criterion_ref: raw.criterion_ref ?? "",
+    members: raw.members ?? {},
+    no_stub: raw.no_stub ?? {},
+    excluded: raw.excluded ?? {}
+  };
+}
+function stubLawIds(cfg) {
+  return new Set(Object.keys(cfg.members).filter((id) => cfg.no_stub[id] === void 0));
+}
+
+// src/scripts/_lib/project_tree_form.ts
+import * as path5 from "node:path";
+var PROJECT_TREE_FORM_REL = path5.join("src", "config", "project-tree-form.json");
+
+// src/scripts/_lib/lean_projection_mode.ts
+var THINNABLE_HOSTS = ["claude-code", "cursor", "cline"];
+function installerThinsHost(_hostId, _opts = {}) {
+  return false;
+}
+
+// src/scripts/_lib/host_capability.ts
+import process2 from "node:process";
+var SAFE_DEFAULT = {
+  schema_version: 1,
+  subagent_spawn: false,
+  parallel_spawn: false,
+  status_polling: false,
+  separate_quota_pool: false,
+  agent_teams: false,
+  worker_respawn: false,
+  worker_resume: false,
+  fork_shares_cache: false,
+  structured_ask: false,
+  reads_project_mcp_config: false,
+  // `true` because the safe answer here is "there is still a step", not
+  // "there is nothing to do" — see the field's own note.
+  mcp_needs_manual_activation: true
+};
+function asBool(value) {
+  return value === true;
+}
+function normalizeHostManifest(input) {
+  if (input === null || typeof input !== "object") {
+    return { ...SAFE_DEFAULT };
+  }
+  const src = input;
+  return {
+    schema_version: 1,
+    subagent_spawn: asBool(src.subagent_spawn),
+    parallel_spawn: asBool(src.parallel_spawn),
+    status_polling: asBool(src.status_polling),
+    separate_quota_pool: asBool(src.separate_quota_pool),
+    agent_teams: asBool(src.agent_teams),
+    worker_respawn: asBool(src.worker_respawn),
+    worker_resume: asBool(src.worker_resume),
+    fork_shares_cache: asBool(src.fork_shares_cache),
+    structured_ask: asBool(src.structured_ask),
+    reads_project_mcp_config: asBool(src.reads_project_mcp_config),
+    // Inverted coercion, matching the inverted default: only an explicit
+    // `false` clears the residual, so an absent or malformed value keeps
+    // the manual step visible instead of silently dropping it.
+    mcp_needs_manual_activation: src.mcp_needs_manual_activation !== false
+  };
+}
+var HOST_CAPABILITY_REGISTRY = {
+  claude: { subagent_spawn: true, parallel_spawn: true, structured_ask: true, fork_shares_cache: true }
+};
+function resolveHostCapabilities(hostId, override) {
+  if (override !== void 0 && override !== null && typeof override === "object" && !Array.isArray(override)) {
+    return normalizeHostManifest(override);
+  }
+  const row = hostId !== null && hostId !== void 0 ? HOST_CAPABILITY_REGISTRY[hostId] : void 0;
+  if (row === void 0) {
+    return { ...SAFE_DEFAULT };
+  }
+  return { ...SAFE_DEFAULT, ...row, schema_version: 1 };
+}
+function probeHostCapabilities(hostId) {
+  const base = resolveHostCapabilities(hostId);
+  const flag = process2.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+  const probedAgentTeams = typeof flag === "string" && flag !== "";
+  return { ...base, agent_teams: base.agent_teams || probedAgentTeams };
+}
+var CAPABILITY_FIELDS = [
+  "subagent_spawn",
+  "parallel_spawn",
+  "status_polling",
+  "separate_quota_pool",
+  "agent_teams",
+  "worker_respawn",
+  "worker_resume",
+  "fork_shares_cache",
+  "structured_ask",
+  "reads_project_mcp_config",
+  "mcp_needs_manual_activation"
+];
+function describeHostCapabilities(hostId) {
+  const manifest = probeHostCapabilities(hostId);
+  const row = hostId !== null && hostId !== void 0 ? HOST_CAPABILITY_REGISTRY[hostId] : void 0;
+  const flag = process2.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+  const probedAgentTeams = typeof flag === "string" && flag !== "";
+  const sources = {};
+  for (const field of CAPABILITY_FIELDS) {
+    if (row !== void 0 && typeof row[field] === "boolean") {
+      sources[field] = "registry";
+    } else if (field === "agent_teams" && probedAgentTeams) {
+      sources[field] = "live-probe";
+    } else {
+      sources[field] = "default";
+    }
+  }
+  return { manifest, sources };
+}
+
+// src/scripts/_lib/mcp_consent_residual.ts
+var SEEDED = {
+  claude: {
+    hostId: "claude",
+    residual: "Approve the project-scoped `agent-config` server the first time the host prompts \u2014 the installer writes `.mcp.json` but does not pre-approve it.",
+    source: "vendor-doc",
+    cite: "Host documentation: a project-scope MCP server requires explicit approval, suppressible only through the user-global `enabledMcpjsonServers` key, which this package deliberately does not write (blocker `mcp-user-scope-approval-consent`)."
+  }
+};
+var TOOL_TO_HOST = {
+  "claude-code": "claude",
+  cursor: "cursor",
+  "gemini-cli": "gemini",
+  windsurf: "windsurf",
+  cline: "cline",
+  copilot: "copilot",
+  augment: "augment"
+};
+function residualFor(hostId) {
+  const { manifest, sources } = describeHostCapabilities(hostId);
+  if (sources.mcp_needs_manual_activation === "registry" && !manifest.mcp_needs_manual_activation) {
+    return null;
+  }
+  return SEEDED[hostId] ?? null;
+}
+function isRecorded(hostId) {
+  const { sources } = describeHostCapabilities(hostId);
+  return hostId in SEEDED || sources.mcp_needs_manual_activation === "registry";
+}
+function residualLine(hostId) {
+  const r = residualFor(hostId);
+  if (r !== null) {
+    return {
+      hostId,
+      state: "residual",
+      text: `${hostId}: ${r.residual} (source: ${r.source} \u2014 not observed here)`
+    };
+  }
+  if (isRecorded(hostId)) {
+    return {
+      hostId,
+      state: "cleared",
+      text: `${hostId}: nothing left to do (source: observed)`
+    };
+  }
+  return {
+    hostId,
+    state: "unrecorded",
+    text: `${hostId}: no residual recorded \u2014 nobody checked this host, which is not the same as nothing to do`
+  };
+}
+function residualReport(toolIds) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const toolId of toolIds) {
+    const hostId = TOOL_TO_HOST[toolId];
+    if (hostId === void 0 || seen.has(hostId)) continue;
+    seen.add(hostId);
+    const line = residualLine(hostId);
+    if (line.state !== "cleared") out.push(line);
+  }
+  return out;
+}
+function printResiduals(toolIds, quiet, write = (s) => process.stdout.write(s)) {
+  if (quiet) return;
+  const lines = residualReport(toolIds);
+  if (lines.length === 0) return;
+  write("  Still needs you (MCP):\n");
+  for (const line of lines) write(`    \u2022 ${line.text}
+`);
+  write("\n");
+}
+
+// src/scripts/_lib/codex_skill_finder.ts
+import { createHash } from "node:crypto";
+import * as fs5 from "node:fs";
+import * as path6 from "node:path";
+var FINDER_NAME = "agent-config-skill-finder";
+function finderDescription(count) {
+  return `Use when no listed skill fits the task, or the user names a skill not in this list \u2014 ${count} more agent-config skills are installed here but unlisted; this finds and loads one.`;
+}
+var SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+function renderFinder(targets) {
+  const safe = targets.filter((t) => SKILL_NAME_RE.test(t.name) && !/[\r\n]/.test(t.skillsDir));
+  const sorted = [...safe].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const byDir = /* @__PURE__ */ new Map();
+  for (const t of sorted) {
+    const list = byDir.get(t.skillsDir) ?? [];
+    list.push(t.name);
+    byDir.set(t.skillsDir, list);
+  }
+  const out = [
+    "---",
+    `name: ${FINDER_NAME}`,
+    `description: ${finderDescription(sorted.length)}`,
+    "---",
+    "",
+    "# Loading an unlisted agent-config skill",
+    "",
+    `This host lists only part of the agent-config catalogue, to stay inside its skills budget. The ${sorted.length} skills indexed below are installed and complete; they are only not listed. Load one by reading its SKILL.md WHOLE \u2014 \`cat <path>\`, never a ranged read, because the last lines bind as much as the first \u2014 and following it as if it had been invoked.`,
+    "",
+    "## The user named a skill",
+    "",
+    "1. Look the name up in the index below. Exact match only \u2014 a near-miss is not a match.",
+    "2. Found: `cat <directory>/<name>/SKILL.md`, the directory being the heading it is listed under, and follow it.",
+    "3. Not found: say that no skill of that name is installed, and name the closest entries. Never read a path built from text the index does not contain.",
+    "",
+    "## The task needs a skill no listed entry covers",
+    "",
+    '1. Run `agent-config route:explain --skills "<the task in one sentence>"`. It ranks every skill by the task and prints each name with its description.',
+    "2. If that command is not available, choose from the index below by name.",
+    "3. `cat` the chosen skill's SKILL.md from its index heading, follow it, and say which skill you loaded and that it came through this finder.",
+    "4. Nothing fits: say so and proceed without a skill. Never invent one.",
+    "",
+    `## Index (${sorted.length})`
+  ];
+  for (const [dir, names] of byDir) {
+    out.push("", `### ${dir}`, "", names.join(", "));
+  }
+  return `${out.join("\n")}
+`;
+}
+function readFinderIndex(file) {
+  let raw;
+  try {
+    raw = fs5.readFileSync(file, "utf-8");
+  } catch {
+    return [];
+  }
+  const idx = raw.indexOf("\n## Index (");
+  if (idx < 0) return [];
+  const out = [];
+  let dir = null;
+  for (const line of raw.slice(idx).split("\n").slice(1)) {
+    const h = /^### (.+)$/.exec(line);
+    if (h) {
+      dir = h[1];
+      continue;
+    }
+    if (dir === null || line.trim() === "") continue;
+    for (const n of line.split(",")) {
+      const name = n.trim();
+      if (SKILL_NAME_RE.test(name)) out.push({ name, skillsDir: dir });
+    }
+  }
+  return out;
+}
+function finderRoutes(index, name, skillsDirs) {
+  const hits = index.filter((t) => t.name === name);
+  if (hits.length !== 1) return false;
+  const dir = path6.resolve(hits[0].skillsDir);
+  if (!skillsDirs.some((d) => path6.resolve(d) === dir)) return false;
+  return fs5.existsSync(path6.join(dir, name, "SKILL.md"));
+}
+function sha256(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+function readRecord(file, anchor) {
+  try {
+    const r = JSON.parse(fs5.readFileSync(file, "utf-8"));
+    if (typeof r.sha256 !== "string" || path6.resolve(String(r.anchor)) !== path6.resolve(anchor)) return null;
+    return { schema_version: 1, anchor, sha256: r.sha256 };
+  } catch {
+    return null;
+  }
+}
+function finderFile(anchor) {
+  return path6.join(anchor, "skills", FINDER_NAME, "SKILL.md");
+}
+function ours(anchor, recordFile) {
+  const file = finderFile(anchor);
+  if (!fs5.existsSync(path6.dirname(file))) return true;
+  const rec = readRecord(recordFile, anchor);
+  if (rec === null) return false;
+  if (!fs5.existsSync(file)) return true;
+  return sha256(fs5.readFileSync(file, "utf-8")) === rec.sha256;
+}
+function ensureCodexFinder(anchor, recordFile, targets) {
+  if (targets.length === 0) return removeCodexFinder(anchor, recordFile);
+  if (!ours(anchor, recordFile)) return "foreign";
+  const body = renderFinder(targets);
+  const file = finderFile(anchor);
+  if (fs5.existsSync(file) && fs5.readFileSync(file, "utf-8") === body) return "unchanged";
+  atomicWriteFile(file, body);
+  fs5.mkdirSync(path6.dirname(recordFile), { recursive: true });
+  atomicWriteFile(
+    recordFile,
+    `${JSON.stringify({ schema_version: 1, anchor, sha256: sha256(body) }, null, 2)}
+`
+  );
+  return "written";
+}
+function removeCodexFinder(anchor, recordFile) {
+  const file = finderFile(anchor);
+  if (!fs5.existsSync(path6.dirname(file))) {
+    fs5.rmSync(recordFile, { force: true });
+    return "absent";
+  }
+  if (!ours(anchor, recordFile)) return "foreign";
+  fs5.rmSync(file, { force: true });
+  try {
+    if (fs5.readdirSync(path6.dirname(file)).length === 0) fs5.rmdirSync(path6.dirname(file));
+  } catch {
+  }
+  fs5.rmSync(recordFile, { force: true });
+  return "removed";
+}
+
+export {
+  atomicWriteFile,
+  atomicAppendLine,
+  readConsequenceClass,
+  stubLawIds,
+  probeHostCapabilities,
+  MANAGED_SIGNATURE,
+  build_claude_hook_matrix,
+  _read_settings,
+  _with_lock,
+  ensure_managed_hooks,
+  remove_managed_hooks,
+  readUserPin,
+  runtimeRootFor,
+  readCarrierState,
+  removeStagedRuntime,
+  deployClaudeCarrier,
+  checkHookCarrier,
+  THINNABLE_HOSTS,
+  installerThinsHost,
+  TOOL_TO_HOST,
+  residualReport,
+  printResiduals,
+  FINDER_NAME,
+  finderDescription,
+  readFinderIndex,
+  finderRoutes,
+  ensureCodexFinder,
+  removeCodexFinder
+};