@event4u/agent-config 16.5.0 → 17.0.0

package/dist/scripts/_lib/workspace_secrets.js

@@ -0,0 +1,229 @@
+/**
+ * Shared secret-detection + scrub primitives for the workspace stores.
+ *
+ * Lives under `src/scripts/_lib/` because a shipped module
+ * (`cross_repo_retrieve.ts`) reads it and `src/cli/` is not in the package;
+ * `src/cli/python/workspace_secrets.ts` re-exports it for the workspace stores.
+ * The contract — the exported names, the per-call match counts, `scrub_obj`'s
+ * depth and cycle guard and the `[SECRET]` placeholder — is pinned by
+ * `tests/scripts/cli/python/workspace_secrets.test.ts`, and what it detects by
+ * `egress_legacy_superset.test.ts`.
+ *
+ * Near-leaf module — its one import is the pure rule table (no I/O) — so the
+ * hot-path analytics `emit()` and the heavier `knowledge_ingest` can both
+ * depend on it cheaply without dragging in PII redaction, chunking, or file
+ * I/O. Every workspace store that persists text or arbitrary payloads at rest
+ * routes through this module before writing (Phase 8 Step 5 secret-hygiene
+ * sweep).
+ *
+ * Two confidence tiers:
+ *
+ * - **HIGH** — structurally unambiguous credentials: the credential rows of
+ *   the one rule table (vendor keys, tokens, PEM private-key block, a
+ *   connection URI with an inline password). Near-zero false-positive rate, so
+ *   safe to scrub destructively or to refuse a write over.
+ * - **FUZZY** — the generic `key/secret/token/password = <value>` assignment.
+ *   Fires on legitimate prose ("password reset token: see attached"), so it is
+ *   warn-only on user-authored content and only scrubbed on disposable,
+ *   machine-generated telemetry (sessions / analytics).
+ *
+ * The `[SECRET]` placeholder matches the knowledge-ingestion redactor so the
+ * two surfaces stay byte-consistent.
+ */
+import { assignmentPattern, detect, EGRESS_RULES, maskingEnd, prefixesOf, rawKeyPrefixPattern, } from './egress_rules.js';
+export const PLACEHOLDER = '[SECRET]';
+// --- HIGH-confidence tier: the credential rows of the one rule table -------
+//
+// Detection lives in `src/scripts/_lib/egress_rules.ts`, the only place a
+// credential pattern is defined (road-to-one-detector-and-the-senders-we-own
+// 2.2); this module keeps its own policy — the `[SECRET]` placeholder, the
+// HIGH/FUZZY tiers and the counts. `generic-assignment` is left to the FUZZY tier
+// below, which is this module's own, looser reading of the same shape.
+const HIGH_RULES = EGRESS_RULES.filter((r) => r.class === 'credential' && r.rule !== 'generic-assignment');
+// The finding names this module has always reported; a row without one reports
+// its rule id.
+const LEGACY_NAME = {
+    'pem-private-key': 'private_key',
+    'aws-access-key': 'aws_access_key',
+    'github-pat': 'github_pat',
+    'github-app-token': 'github_pat',
+    'openai-api-key': 'openai_key',
+};
+const LEGACY_ORDER = ['private_key', 'aws_access_key', 'github_pat', 'openai_key'];
+const rank = (name) => {
+    const i = LEGACY_ORDER.indexOf(name);
+    return i < 0 ? LEGACY_ORDER.length : i;
+};
+// This module's own, looser readings of two shapes, kept so the move to the
+// table narrows nothing: the GitHub token family at any length and an OpenAI key
+// glued to a preceding word. The prefixes are the table's.
+const OWN_SHAPES = [
+    [
+        'github_pat',
+        rawKeyPrefixPattern(36, [...prefixesOf('github-pat'), ...prefixesOf('github-app-token')], {
+            boundary: 'never',
+            tail: 'A-Za-z0-9',
+        }),
+    ],
+    ['openai_key', rawKeyPrefixPattern(20, prefixesOf('openai-api-key'), { boundary: 'never', tail: 'A-Za-z0-9' })],
+];
+/** HIGH spans in report order, each widened to the bytes a scrub must remove. */
+function highSpans(text) {
+    const spans = detect(text, HIGH_RULES).map((s) => ({
+        name: LEGACY_NAME[s.rule] ?? s.rule,
+        start: s.start,
+        end: maskingEnd(text, s),
+    }));
+    for (const [name, re] of OWN_SHAPES) {
+        for (const m of text.matchAll(re))
+            spans.push({ name, start: m.index, end: m.index + m[0].length });
+    }
+    // One finding per value: a span inside another span of the same name is that span.
+    const kept = spans.filter((a, i) => !spans.some((b, j) => j !== i &&
+        b.name === a.name &&
+        b.start <= a.start &&
+        b.end >= a.end &&
+        (b.end - b.start > a.end - a.start || j < i)));
+    return kept.sort((x, y) => rank(x.name) - rank(y.name) || x.start - y.start);
+}
+// --- FUZZY pattern (heuristic key/value assignment) -------------------------
+// Python `(?i)` inline flag → JS `i` flag. Character class is identical.
+// The keyword shape is the table's; the 12-character value is this module's threshold.
+const _RE_KV_SECRET = assignmentPattern({
+    keywords: ['apiKey', 'secret', 'token', 'password', 'passwd', 'bearer'],
+    value: `['"]?[A-Za-z0-9_\\-+/=]{12,}['"]?`,
+}, 'i');
+export const FUZZY = [['kv_secret', _RE_KV_SECRET]];
+// Recursion guard for `scrub_obj` — deep / cyclic structures degrade to a
+// controlled return instead of a RangeError on the never-raises hot path.
+const _MAX_DEPTH = 50;
+/**
+ * Build a global-flagged clone of `pat` so `matchAll` / `replace` get
+ * left-to-right non-overlapping iteration matching Python `finditer` / `subn`,
+ * without mutating the shared stateless module-level pattern.
+ */
+function _global(pat) {
+    const flags = pat.flags.includes('g') ? pat.flags : pat.flags + 'g';
+    return new RegExp(pat.source, flags);
+}
+/** Count of non-overlapping matches — mirrors `len(list(pat.finditer(text)))`. */
+function _finditerCount(pat, text) {
+    let n = 0;
+    for (const _m of text.matchAll(_global(pat)))
+        n += 1;
+    return n;
+}
+/** `pat.subn(repl, text)` → `[clean, count]` (non-overlapping, left-to-right). */
+function _subn(pat, repl, text) {
+    let count = 0;
+    const clean = text.replace(_global(pat), () => {
+        count += 1;
+        return repl;
+    });
+    return [clean, count];
+}
+/**
+ * Non-destructive detection: one {@link Finding} per match.
+ *
+ * Never echoes the matched secret value — only the pattern name and tier,
+ * so a caller can warn or refuse without re-leaking the secret into a log.
+ */
+export function scan(text, opts) {
+    const include_fuzzy = opts?.include_fuzzy ?? true;
+    if (typeof text !== 'string' || !text) {
+        return [];
+    }
+    const out = highSpans(text).map((s) => ({ pattern: s.name, confidence: 'high' }));
+    if (include_fuzzy) {
+        for (const [name, pat] of FUZZY) {
+            const n = _finditerCount(pat, text);
+            for (let i = 0; i < n; i += 1)
+                out.push({ pattern: name, confidence: 'fuzzy' });
+        }
+    }
+    return out;
+}
+/** Replace every secret match with `[SECRET]`; return `[clean, count]`. */
+export function scrub(text, opts) {
+    const include_fuzzy = opts?.include_fuzzy ?? true;
+    if (typeof text !== 'string' || !text) {
+        return [text, 0];
+    }
+    const spans = highSpans(text).sort((x, y) => x.start - y.start);
+    const merged = [];
+    for (const sp of spans) {
+        const last = merged[merged.length - 1];
+        if (last !== undefined && sp.start < last.end)
+            last.end = Math.max(last.end, sp.end);
+        else
+            merged.push({ start: sp.start, end: sp.end });
+    }
+    let out = text;
+    for (let i = merged.length - 1; i >= 0; i -= 1) {
+        const m = merged[i];
+        out = out.slice(0, m.start) + PLACEHOLDER + out.slice(m.end);
+    }
+    let count = merged.length;
+    if (include_fuzzy) {
+        for (const [, pat] of FUZZY) {
+            const [next, n] = _subn(pat, PLACEHOLDER, out);
+            out = next;
+            count += n;
+        }
+    }
+    return [out, count];
+}
+/**
+ * Recursively scrub string leaves in object / array structures.
+ *
+ * Non-string leaves (number, boolean, null) pass through untouched. Recursion
+ * is bounded by a depth cap and a cycle guard so malformed or self-referential
+ * payloads degrade to a controlled return, never a stack overflow — callers on
+ * a never-raises hot path (`workspace_analytics.emit`) rely on this. Returns
+ * `[clean, count]`.
+ *
+ * Python distinguishes `list` (→ list) from `tuple` (→ tuple); JS has only
+ * `Array`, so an array round-trips as an array, matching the Python `list`
+ * branch (the workspace stores never feed a tuple through this path).
+ */
+export function scrub_obj(obj, opts) {
+    const include_fuzzy = opts?.include_fuzzy ?? true;
+    const _depth = opts?._depth ?? 0;
+    const _seen = opts?._seen ?? new Set();
+    if (_depth > _MAX_DEPTH) {
+        return [obj, 0];
+    }
+    if (typeof obj === 'string') {
+        return scrub(obj, { include_fuzzy });
+    }
+    if (Array.isArray(obj)) {
+        if (_seen.has(obj)) {
+            return [obj, 0];
+        }
+        _seen.add(obj);
+        let total = 0;
+        const items = [];
+        for (const value of obj) {
+            const [cv, n] = scrub_obj(value, { include_fuzzy, _depth: _depth + 1, _seen });
+            items.push(cv);
+            total += n;
+        }
+        return [items, total];
+    }
+    if (obj !== null && typeof obj === 'object') {
+        if (_seen.has(obj)) {
+            return [obj, 0];
+        }
+        _seen.add(obj);
+        let total = 0;
+        const clean = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const [cv, n] = scrub_obj(value, { include_fuzzy, _depth: _depth + 1, _seen });
+            clean[key] = cv;
+            total += n;
+        }
+        return [clean, total];
+    }
+    return [obj, 0];
+}
+//# sourceMappingURL=workspace_secrets.js.map

package/dist/scripts/ai_council/seat_policy.js

@@ -103,4 +103,31 @@ export function parseSeatFields(name, raw) {
         },
     };
 }
+/**
+ * Council roles, and the three a route this package does not pay for may never
+ * hold (ADR-257: an unpaid route may propose and score, never decide). Kept
+ * apart from `PolicyExclusion`: that union makes a seat ABSENT for the whole
+ * run, while a role refusal leaves the seat free to propose or judge.
+ */
+export const COUNCIL_ROLES = ['proposer', 'juror', 'chair', 'synthesis', 'verdict'];
+export const HEAD_ROLES = new Set(['chair', 'synthesis', 'verdict']);
+const _PAID_BILLING = new Set(['subscription', 'per-token']);
+/** The classes positively known to cost the package nothing per call. */
+export const UNPAID_BILLING_CLASSES = ['free-quota', 'self-hosted'];
+/**
+ * True unless the billing class is a paid one. Absent means a seat configured
+ * before billing classes existed, all of them paid; any other unrecognised
+ * value fails closed, so a typo cannot hand a free route the chair.
+ */
+export function isUnpaidBilling(billing) {
+    return billing !== undefined && billing !== null && !_PAID_BILLING.has(billing);
+}
+export function seatRoleRefusal(role, billing, seat = 'this seat') {
+    if (!HEAD_ROLES.has(role) || !isUnpaidBilling(billing))
+        return null;
+    return {
+        reason: 'unpaid_head_role',
+        message: `${seat} (billing ${String(billing)}) may not hold the ${role} role: an unpaid route proposes and scores, never decides (ADR-257)`,
+    };
+}
 //# sourceMappingURL=seat_policy.js.map

package/dist/scripts/ai_council/transport_resolver.js

@@ -40,7 +40,7 @@
  */
 import { classifyBilling, isCommunityCli, strongestAuth, PROVIDER_CLI_META, } from '../_lib/environment_detector.js';
 import { resolve_mode } from './modes.js';
-import { admitsContent, DEFAULT_SEAT_CEILING, } from './content_ceiling.js';
+import { admitsContent, DEFAULT_CONTENT_CLASS, DEFAULT_SEAT_CEILING, } from './content_ceiling.js';
 import { policyExclusionReason } from './seat_policy.js';
 /** The accepted values of the `mode` key, including the resolver-only `auto`. */
 export const VALID_TRANSPORT_MODES = new Set([
@@ -93,14 +93,12 @@ export function resolveTransport(opts) {
     if (exclusion !== null) {
         return unavailable(provider, billing, policyExclusionReason(exclusion, provider), exclusion);
     }
-    // Content ceiling (2.2). Only runs when the caller declared what it would
-    // send; an undeclared pass is unchanged, not silently refused.
-    const contentClass = opts.contentClass ?? null;
-    if (contentClass !== null) {
-        const verdict = admitsContent(opts.seatCeiling ?? DEFAULT_SEAT_CEILING, contentClass);
-        if (!verdict.admitted) {
-            return unavailable(provider, billing, `${provider}: ${verdict.reason ?? 'content ceiling refused the payload'}`, 'policy_content_ceiling');
-        }
+    // Content ceiling (2.2). An undeclared payload is project-content: a seat
+    // cleared only for public artefacts refuses it, and a default seat is unchanged.
+    const contentClass = opts.contentClass ?? DEFAULT_CONTENT_CLASS;
+    const verdict = admitsContent(opts.seatCeiling ?? DEFAULT_SEAT_CEILING, contentClass);
+    if (!verdict.admitted) {
+        return unavailable(provider, billing, `${provider}: ${verdict.reason ?? 'content ceiling refused the payload'}`, 'policy_content_ceiling');
     }
     if (mode === 'manual') {
         return {
@@ -311,7 +309,8 @@ export function classifyCliFailure(raw) {
     if (s === 'auth_expired' || s === 'auth_rejected' || s === 'unauthorized') {
         return 'auth_rejected';
     }
-    if (s === 'cli_unsupported' || s === 'unsupported' || s === 'parse_failed') {
+    // `parse_failed` is NOT here: answered-unreadably, so a replay pays twice.
+    if (s === 'cli_unsupported' || s === 'unsupported') {
         return 'cli_unsupported';
     }
     // Prefix match, not equality: the detail carries the operator-facing reason

package/dist/scripts/condense.js

@@ -43,6 +43,7 @@ import { build_thin } from './project_thin_rules.js';
 import { build_claude_hook_matrix } from './_lib/claude_settings_hooks.js';
 import { describeDroppedHosts, resolveLeanProjection, thinsHost, writesThinFiles } from './_lib/lean_projection_mode.js';
 import { is_claude_builtin_name } from './_lib/claude_builtin_names.js';
+import { nativeFieldLines } from './_lib/subagent_native_fields.js';
 import { project_settings_path, load_agent_settings } from './_lib/agent_settings.js';
 import { rule_is_compile_enabled } from './_lib/compile_time_toggles.js';
 import { resolve_rule_pack_scope } from './_lib/scoped_projection.js';
@@ -386,14 +387,12 @@ function _read_projection_scope_dedup() {
     return false;
 }
 function _lean_projection_settings() {
-    // Step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo`: this is
-    // now the shared resolver rather than one of three private readers. The
-    // INPUT is unchanged — `MODULE_STATE.SETTINGS_FILE` is still the file, so
-    // the projector's answer is the answer it always gave — and only the code
-    // that interprets it is shared. That is risk 2 of the roadmap's register
-    // ("making the hook agree with the projector could also move the
-    // projector") discharged by construction instead of by a test alone.
-    return resolveLeanProjection({ settingsPath: MODULE_STATE.SETTINGS_FILE });
+    // Step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo` made this
+    // the ONE shared resolver; ADR-293 changed what it reads — the settings key
+    // is gone, so the input is `PROJECT_ROOT`, where the form record lives.
+    // Projector and hook still share one reader, which is how risk 2 of that
+    // roadmap's register is discharged by construction.
+    return resolveLeanProjection({ packageRoot: MODULE_STATE.PROJECT_ROOT });
 }
 // --- hashing -----------------------------------------------------------------
 export function apply_path_rewriter(relative_path) {
@@ -828,10 +827,10 @@ export function _rewrite_paths(content, source_relative_path) {
 export { _HRR_BANNER_MARKER };
 // ── Consumer-scoped rule projection (road-to-request-scoped-rule-load P1) ──
 //
-// Opt-in via `projection.rule_workspaces: [<workspace-id>, …]` in
-// `.agent-settings.yml`. Absent / empty = legacy-all (every rule projects —
-// today's behaviour, non-breaking). When set, a non-kernel rule projects
-// only if its `workspaces:` frontmatter intersects the configured set.
+// Scope came from `projection.rule_workspaces` until ADR-293 step 4.6 removed
+// the key; `consumerRuleWorkspaces` derives the CONSUMER scope now and the
+// MAINTAINER projection below is unscoped by construction. A non-kernel rule
+// projects into a scoped tree only if its `workspaces:` frontmatter intersects.
 // Kernel rules (`type: always` / `alwaysApply: true`) ALWAYS project —
 // the kernel is unconditional and workspace-independent by definition
 // (rule-router contract § Schema v2). Untagged rules fail safe: they ship.
@@ -843,15 +842,16 @@ function _read_projection_raw(key) {
         ? proj[key]
         : null;
 }
-function _read_projection_list(key) {
-    const value = _read_projection_raw(key);
-    if (Array.isArray(value) && value.length > 0) {
-        return value.map((v) => String(v));
-    }
-    return null;
-}
+/**
+ * The MAINTAINER projection is never workspace-scoped — a constant since
+ * ADR-293 step 4.6, not a settings read. `consumerRuleWorkspaces` subtracts
+ * `agent-config-maintainer`, and this is the one tree where that subtraction
+ * would be wrong: the repository's own `.claude/rules` must carry exactly the
+ * rules it drops. So this stays the inactive axis, which is what an absent key
+ * always meant here.
+ */
 function _read_rule_workspaces() {
-    return _read_projection_list('rule_workspaces');
+    return null;
 }
 /** `runtime.active_packs` overlay, empty when unset (fresh-install default). */
 function _read_runtime_active_packs() {
@@ -1766,10 +1766,6 @@ export function generate_claude_subagents() {
         const tools = Array.isArray(toolsRaw) ? toolsRaw.map((t) => String(t)).join(', ') : String(toolsRaw ?? '');
         const tier = typeof fm['model_tier'] === 'string' ? fm['model_tier'] : 'inherit';
         const model = tier === 'inherit' ? 'inherit' : (_TIER_TO_CLAUDE_MODEL[tier] ?? 'inherit');
-        // Optional pinned reasoning effort (skill-quality-gates Phase 4, Source S):
-        // pass through to the native frontmatter only when the source declares it —
-        // hosts without an effort knob never see the key.
-        const effort = typeof fm['effort'] === 'string' ? fm['effort'] : null;
         const guardedBody = defense !== '' && !body.includes('prompt-defense-preamble')
             ? `\n${defense}\n${body}`
             : body;
@@ -1778,7 +1774,7 @@ export function generate_claude_subagents() {
             `description: ${description}\n` +
             `tools: ${tools}\n` +
             `model: ${model}\n` +
-            (effort !== null ? `effort: ${effort}\n` : '') +
+            nativeFieldLines(fm) + // effort, maxTurns, background, skills, omitClaudeMd — only when declared
             '---\n' +
             guardedBody;
         const target = path.join(MODULE_STATE.CLAUDE_AGENTS_DIR, `${name}.md`);
@@ -1943,10 +1939,10 @@ description: >-
 
 # Install agent-config
 
-This plugin is a **bootstrap shim**. It exists so the marketplace listing
-stays discoverable and existing plugin installs keep working hooks — the
-content surface (skills, rules, commands, personas) is distributed as a
-file projection, not through this plugin.
+This plugin is a **bootstrap shim** kept so the marketplace listing stays
+discoverable. Its hooks run only alongside a global npm install of the package (never a project-local one) —
+on a plugin-only install no hook runs, so the \`fail_closed\` guards (\`block-no-verify\`, \`block-kernel-rule-writes\`,
+\`block-plumbing-writes\`) are **off**; the session start says so once. Content ships as a file projection.
 
 ## Install (canonical, one command)
 

package/dist/server/io/substituteTemplate.js

@@ -1,7 +1,7 @@
 /**
  * Render `src/config/agent-settings.template.yml` for the wizard's "Skip" path.
  *
- * Source of truth for placeholder semantics is `scripts/install.py`
+ * Source of truth for placeholder semantics is the retired Python installer
  * (`_render_template`, `_parse_profile_ini`). The wizard's Skip handler
  * cannot shell out to Python — npm/npx flows ship Node only — so this
  * helper mirrors the install-time substitution in TypeScript.
@@ -21,7 +21,7 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 const PLACEHOLDER_RE = /__[A-Z][A-Z0-9_]*__/g;
 /**
- * Parse a profile `.ini` file the same way `scripts/install.py` does:
+ * Parse a profile `.ini` file the same way the retired Python installer does:
  * `key=value` per line, `;` line comments, blank lines ignored. Whitespace
  * around `=` is stripped. Duplicate keys: last wins.
  */

package/dist/server/io/yamlIO.js

@@ -4,7 +4,7 @@
  * Important contract: the template ships with comments that explain
  * every key — we MUST NOT discard them when the wizard writes back.
  * `js-yaml.dump` cannot preserve comments, so we use a key-level
- * replace strategy that mirrors `scripts/install.py::_replace_template_value`:
+ * replace strategy that mirrors `_replace_template_value` in the retired Python installer:
  * scan the rendered template line-by-line, replace only the scalar
  * value at each dotted path, leave comments and indentation alone.
  *
@@ -555,7 +555,7 @@ function isPlainObject(value) {
 }
 /**
  * Recursive dict merge — overlay wins, nested dicts are merged, lists
- * are replaced (not concatenated). Mirrors `scripts/install.py::deep_merge`
+ * are replaced (not concatenated). Mirrors `deep_merge` in the retired Python installer
  * so the Python installer and the Fastify server produce the same
  * three-layer settings tree (`defaults < global < project`).
  */

package/dist/server/routes/install.js

@@ -5,7 +5,7 @@
  *   POST /api/v1/install/plan   — build an {@link InstallPlan} from a
  *                                 declarative {@link PlanSource}[] body.
  *
- * The real *apply* path is owned by `scripts/install.py --apply-payload`
+ * The real *apply* path is owned by `src/scripts/install.ts --apply-payload`
  * (single source of truth, D12 / ADR-020) and surfaced to the GUI via
  * `POST /api/v1/wizard/apply` (see `wizard.ts`). The legacy TypeScript
  * apply engine + its `POST /api/v1/install/apply` SSE route were removed in
@@ -91,6 +91,10 @@ const ConflictEntrySchema = z.object({
     ownership: z
         .enum(['recorded-unchanged', 'recorded-modified', 'unknown'])
         .default('unknown'),
+    // Additive for the same reason and on the same terms: an older client
+    // omits it, and `false` is the answer every tree gave before the
+    // ledger-migration branch existed.
+    migration: z.boolean().default(false),
 });
 /**
  * Wire-shape of {@link InstallPlan} — Sets serialise as arrays over JSON,

package/dist/server/routes/settings.js

@@ -96,7 +96,7 @@ async function readClassIndex(packageRoot) {
 const SHARED_WRITE_MESSAGE = 'This write lands through an agent-switch shared symlink and affects ALL profiles. ' +
     'Re-send with confirmSharedWrite:true to proceed, or run `agent-switch share off` for profile-local writes.';
 // Installer placeholders in `src/config/agent-settings.template.yml` that
-// `scripts/install.py` substitutes per-user. The TypeScript defaults layer
+// `src/scripts/install.ts` substitutes per-user. The TypeScript defaults layer
 // renders the same scalars so the wizard's first-run form is schema-valid.
 // Keep this map in lockstep with the template — any new `__*__` placeholder
 // added there must get its default here, or `settingsSchema.safeParse` on
@@ -205,7 +205,7 @@ async function readSingleLayer(root) {
  * If neither global nor project exists, returns `hasRealFile: false`
  * so the route can emit 404 (ADR-020 § "Installed" semantic).
  *
- * Mirrors `scripts/install.py::read_layered_settings`.
+ * Mirrors `read_layered_settings` in the retired Python installer.
  */
 async function readLayeredSettings(packageRoot, writeRoot, legacyReadRoot, userGlobalReadRoot) {
     const defaults = await loadDefaultSettings(packageRoot);

package/dist/server/routes/wizard.js

@@ -986,7 +986,7 @@ export function wizardRoute(opts) {
         });
         // road-to-single-install-source-of-truth § Phase 2 — Wizard Apply bridge.
         // Validates the WizardApplyPayload envelope and spills it to a temp file,
-        // then dispatches `scripts/install.py --apply-payload <tmp>` — the single
+        // then dispatches `src/scripts/install.ts --apply-payload <tmp>` — the single
         // installer (D12 / ADR-020). Two modes on the SAME endpoint:
         //   • dry_run:true  → buffered plan-summary preview (JSON), used by the
         //     Review step. Adds `--dry-run`.

package/dist/server/schemas/settings.js

@@ -25,8 +25,6 @@ const replyMethod = z.enum(['replies_endpoint', 'create_review_comment', 'auto']
 const confidenceBand = z.enum(['off', 'low', 'medium', 'high']);
 const onBlock = z.enum(['stop', 'ask', 'warn']);
 const modelAutoSwitch = z.enum(['auto', 'suggest', 'off']);
-const leanProjectionMode = z.enum(['eager-all', 'thin', 'delivery']);
-const leanProjectionHost = z.enum(['claude-code', 'cursor', 'cline']);
 const projectionMode = z.enum(['legacy-all', 'scoped']);
 const projectAudience = z.enum(['self', 'internal', 'client', 'public']);
 const deliveryMerge = z.enum(['off', 'on-green']);
@@ -40,22 +38,10 @@ export const settingsSchema = z.object({
     }).default({ id: 'developer' }),
     projection: z.object({
         mode: projectionMode.default('legacy-all').describe('Whether the per-tool projector writes EVERY artefact into the host-tool trees (.claude/ .cursor/ .windsurf/) or only the active profile + packs\' artefacts (ADR-040, docs/contracts/capability-packs.md). legacy-all = (default, non-breaking) project the full surface exactly as 5.x did. scoped = project only the active profile\'s packs unioned with the runtime.active_packs overlay, expanded over the requires graph — opt in with `agent-config use --profile=<id>`. A failed scoped projection restores the full tree.'),
-        rule_workspaces: z.array(z.string()).default([]).describe('Workspace scope for the RULE layer only (road-to-request-scoped-rule-load P1/P1b, opt-in). Absent or empty = legacy-all: every rule projects AND installs. Non-empty = only rules whose workspaces frontmatter intersects this list are projected (condense) and installed (install.sh + global wizard payload). Kernel rules always ship; untagged rules fail safe. The default flip to a scoped value is a HUMAN release gate — do not set this from automation.'),
-        rule_packs: z.union([z.literal('auto'), z.array(z.string())]).default([]).describe('Optional second scoping axis for the RULE layer, per pack ids (src/config/discovery/packs.yml). When set, a non-kernel rule also needs a packs frontmatter intersection to ship — e.g. deselecting frontend-design drops ui-audit-gate + design-fidelity. Same opt-in / human-gate semantics as rule_workspaces. The literal "auto" derives the id list from the active-pack set (the same set the skill/command prune uses), so a domain safety floor stops shipping into installs that do not have the pack it guards; an explicit list stays supported and wins over the derivation.'),
+        rule_packs: z.union([z.literal('auto'), z.array(z.string())]).default([]).describe('Scoping axis for the RULE layer beyond the derived workspace set, per pack ids (src/config/discovery/packs.yml). When set, a non-kernel rule also needs a packs frontmatter intersection to ship — e.g. deselecting frontend-design drops ui-audit-gate + design-fidelity. Opt-in, and an empty list is inactive; the workspace axis beside it is derived rather than configured (ADR-293 step 4.6). The literal "auto" derives the id list from the active-pack set (the same set the skill/command prune uses), so a domain safety floor stops shipping into installs that do not have the pack it guards; an explicit list stays supported and wins over the derivation.'),
     }).default({ mode: 'legacy-all' }),
     rule_loading_tier: ruleLoadingTier.default('balanced').describe('Master switch for which rule tiers load and how cautiously the agent spends tokens. minimal = only the 9 kernel rules (cheapest, fewest guardrails). balanced = kernel + tier-1 (recommended default). full = kernel + tier-1 + tier-2 (most guardrails, highest token cost). custom = roll your own in agents/overrides/. LEGACY: superseded by discipline_profile — when that key is set it wins (mapping: minimal→off, balanced→essential, full→full).'),
     discipline_profile: disciplineProfile.optional().describe('The ONE runtime knob for the discipline-rule tier (successor of rule_loading_tier; council 2026-07-07). off = kernel only (~1x tokens). essential = kernel + the measured lift-carrying rules (~3.3x, keeps the weak-host discipline lift). full = everything (~11.7x, EXPERIMENTAL — residual lift over essential not established). auto = resolve per session against the evidence-gated NULL-lift disable-list in src/config/host-capabilities.yml (measured-null host → off, otherwise → essential). Optional and opt-in until the P1/P2 evidence gates pass (agents/roadmaps/road-to-discipline-profile-tiering.md); absent = legacy rule_loading_tier applies.'),
-    lean_projection: z.object({
-        mode: leanProjectionMode.default('eager-all').describe('How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session, exact-BPE — a different unit from the chars/4 figures below, never compare the two directly), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267. SAVING AND CHARGE, MEASURED TOGETHER so neither is published alone (2026-09-12, `check_preamble_payload_budget`): the rule bucket falls 122,769 -> 24,537 chars/4 tok per session on a thinned host (-80.0%), and a trigger match costs p50 6,728 B / p90 14,016 B / max 16,297 B per fire over 318 gate-open fires of the frozen tests/eval/routing-matrix corpus at the concern\'s 16,384 B cap. Bytes per fire and tokens per session are different denominators and are never summed; re-read both rather than quoting this line. The ceiling for that charge is registered in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384).'),
-        hosts: z.array(leanProjectionHost).default(['claude-code']).describe('Which hosts a thinning mode may thin (ADR-267). Absent resolves to [claude-code]. '
-            + 'Only the three hosts with a per-rule rule tree are accepted, and this enum is the '
-            + 'AUTHORING layer: an id outside it is a hard validation FAILURE here and under '
-            + 'validate_agent_settings, never a warning. resolveLeanProjectionHosts is the '
-            + 'READ-TIME backstop for a hand-edited .agent-settings.yml that passed neither, and '
-            + 'THERE the id is dropped with a warning (R2 finding 6 — the two layers answer '
-            + 'differently and neither said so). Every host outside this list receives exactly '
-            + 'what eager-all writes, asserted byte-for-byte by check_host_tree_parity.'),
-    }).default({ mode: 'eager-all', hosts: ['claude-code'] }),
     cost: z.object({
         budgets: z.object({
             daily: z.number().min(0).default(0).describe('Daily USD ceiling across all model calls. The agent warns at 50% / 75% / 90% and either stops or warns at 100% depending on cost.enforcement. Set 0 to disable the daily budget entirely.'),
@@ -218,12 +204,16 @@ export const settingsSchema = z.object({
         implementer_model: z.string().default('').describe('Override the model the orchestrator dispatches to subagents that write code (e.g. claude-sonnet-4, gpt-5). Empty (default) = inherit the session\'s primary model — cheapest and usually right.'),
         judge_model: z.string().default('').describe('Override the model used for review / judge subagents that critique implementer output. Empty (default) = one tier above the implementer model — picks up nuance the implementer missed.'),
         model_ceiling: z.string().default('').describe('Session-wide model CEILING for subagents (spend cap). Empty (default) = no ceiling. When set, suite-owned CLI spawn wrappers export CLAUDE_CODE_SUBAGENT_MODEL to the sessions they launch. Class C: a human sets it; the agent never writes or infers one.'),
-        max_parallel: z.number().int().min(1).default(3).describe('Limit on subagents running in parallel during /do-in-parallel, /do-competitively, and /judge runs — a value the model reads from settings; no code counts spawns against it. Raise for faster fan-out, lower if you hit rate limits or want lower token spend.'),
+        max_parallel: z.number().int().min(1).max(64).default(3).describe('Limit on subagents running in parallel during /do-in-parallel, /do-competitively, and /judge runs. On Claude Code the installer also writes it into CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS, the host cap on concurrent new spawns. That cap does not bound a resumed worker: on Claude Code 2.1.306 a resume was admitted past a cap of 1, so a resume is neither bounded by the host nor counted by any package code yet. Raise for faster fan-out, lower if you hit rate limits or want lower token spend.'),
         adversarial_council: z.enum(['off', 'ask', 'on']).default('off').describe('Opt-in adversarial-verification-council mode (subagent-orchestration Mode 9, ADR-122). off (default) = never runs; ask = offer it on an explicit high-risk change; on = auto-run on high-risk changes. Advisory only — a panel of distinct-model skeptics red-teams a real change for defect FINDING coverage and NEVER auto-gates it (Hard Floor). Stays default-off until the adversarial-council-finding-coverage claim is backed.'),
     }),
     // `worktrees.mode` was DELETED (ADR-229). Worktree creation is
     // instruction-only and hardcoded; there is nothing left to configure. A
     // leftover key is ignored with one deprecation line via REMOVED_KEYS.
+    // `worktrees.cleanup` governs REMOVAL, a separate question (ADR-295).
+    worktrees: z.object({
+        cleanup: z.enum(['off', 'notify', 'auto']).default('notify').describe('What the agent may do about a worktree whose work is provably on the trunk (merged by merge commit, rebase or squash), that is clean, holds no ignored file a rebuild would not restore, and has no live session. notify (default, and what an absent key resolves to) says once a day how many exist and removes nothing; auto removes them right after /pr:merge and once a day on the first session start, without force, keeping local branches; off says nothing. The daily pass reads merged pull requests through your gh login (branch name and head commit only).'),
+    }).default({ cleanup: 'notify' }),
     ai_team: z.object({
         model: z.string().default('auto').describe("Model handed to the codex CLI. 'auto' (default) = pass no --model flag so the CLI's own default applies — tracks the subscription's current strongest model instead of pinning a stale ID. Any other value passes through verbatim as `--model <value>`."),
         allow_delegate: z.boolean().default(false).describe('Second opt-in for the only wrapper that delegates write access (/team:delegate). false (default) = delegate refuses even when /team itself is available. Availability (codex CLI installed + authenticated) is necessary but not sufficient — this key must ALSO be true before delegation is reachable.'),
@@ -254,6 +244,9 @@ export const settingsSchema = z.object({
         auto_record: z.enum(['on', 'off']).default('on').describe('Deterministic continuity-record writer at session end (road-to-continuity-writer-activation Phase 1). on (default since 2026-09-10) = the session-eol concern writes the continuity_record capsule variant on Stop for a substantive session that has claimed a roadmap; every field is computed from on-disk state, with no model spend and no subprocess. off = no automatic record, and only the explicit agent-config session:recycle writes one. The default flipped once the parity evidence landed, so the normal path carries an automatic writer rather than a remembered command; session:recycle is retained because the automatic writer skips a session that claimed no roadmap and omits the git-status anchors.'),
         run_checkpoints: z.enum(['on', 'off']).default('on').describe('Deterministic run-checkpoint production at session end (road-to-continuity-writer-activation Phase 1.4). on (default) = a session above the recycle threshold and inside a running roadmap contract leaves agents/runtime/state/checkpoints/<run>.json, so a killed run resumes from a derived checkpoint rather than from bookkeeping. off = no checkpoint; continuity writing, the recycle advisory and the context-fill surface are unaffected. Default ON because it is the behavior the tree already had — the switch exists to make the three session-end handlers independently disableable, not to change what ships.'),
     }),
+    retro: z.object({
+        enabled: z.boolean().default(true).describe('Automatic retro after merged work (ADR-292, docs/contracts/retro-v1.md). true (default, owner directive 2026-10-12) = a merged PR and the first session of a new local day enqueue finished work; a deterministic triage picks what is worth one learning, and nothing behavior-changing is applied without a person. The one network read is the daily probe asking GitHub, through your own gh login, whether a pushed PR merged (repository and PR number only, three-second budget). false = no automatic path runs — no merge enqueue, no forge-merge marker, no daily probe and no network read; an explicit /retro still runs on request. Class C: an agent cannot set it; it cascades from the user-global file.'),
+    }).default({}),
     memory: z.object({
         redact_patterns: z.array(z.string()).default([]).describe('Regex patterns (one per line) that scrub matches from chat-history transcripts and memory before they hit disk. Use for secrets, customer names, internal URLs. Patterns are anchored and case-insensitive.'),
         session_index: z.enum(['on', 'off']).default('off').describe('Opt-in compact memory index at session start (road-to-memory-retrieval-economy P5). on = inject a compact id + title + ~tokens index of curated entries (hard cap 30 rows, bodies never included) through the hot-context hook; the agent fetches full entries via memory_get on demand. off (default) = no injection — the ship-criterion (measured hit-rate gain) is unproven, so off unless proven.'),
@@ -265,6 +258,11 @@ export const settingsSchema = z.object({
             allowed_tiers: z.array(z.string()).default(['public']).describe('Origin tiers auto-eligible to cross a project boundary. proprietary is manual-only regardless (the gate hard-codes it), so an in-house schema never auto-shares.'),
         }).default({}),
     }).default({}),
+    egress: z.object({
+        placeholders: z.object({
+            mode: z.enum(['off', 'observe', 'protect', 'strict']).default('off').describe('Dispatcher egress stage (docs/contracts/egress-placeholders-v1.md). off (default) = nothing. observe = detect and count listed values in prompts and tool bodies, types and counts only, and change nothing a hook concern sees. protect = also give every recording and advisory concern a copy with each value replaced by a placeholder token, so local stores keep tokens; guards still see the original. strict = as protect until the host rewrite exists. No mode yet changes what reaches the model; the rule table holds credential rules only. Project layers only.'),
+        }).default({}),
+    }).default({}),
     hooks: z.object({
         concern_budget: z.object({
             tier1_concerns: z.array(z.string()).default([]).describe('Concern IDs (one per line) that are allowed to block the run on failure rather than warn. Reserved for high-confidence guards — leave empty unless you maintain custom hooks.'),
@@ -313,6 +311,14 @@ export const settingsSchema = z.object({
     update_check: z.object({
         enabled: z.boolean().default(true).describe('Once per day the agent checks the npm registry for a newer agent-config release and surfaces a one-line banner if one exists. Turn off in air-gapped environments or to silence the banner.'),
     }),
+    advisories: z.object({
+        mode: z.enum(['off', 'notify']).default('notify').describe('Whether the first session start of a day prints the advisory findings that need action today. notify (default) reads the local cache only — a session start never touches the network; off prints nothing, and agent-config audit:deps show still works.'),
+        egress: z.enum(['none', 'query']).default('query').describe('What leaves the machine when agent-config audit:deps refresh runs. query (default) sends names and versions of public packages to api.osv.dev and reads endoflife.date and the PHP and Node release feeds; a private package name is never sent, and a native npm or composer audit, which sends the lockfile package list to the registry that tool is configured for, runs only for a lockfile with no private package. none sends nothing, and findings read unknown rather than clear.'),
+        kev: z.enum(['off', 'on']).default('on').describe('Whether a refresh reads the CISA known-exploited catalog. on (default) downloads the whole catalog and matches it locally, so nothing about the project is sent, and a finding in it is raised one tier in a runtime scope; off leaves tiers to the other sources. Runs only where egress is query.'),
+    }).default({ mode: 'notify', egress: 'query', kev: 'on' }),
+    update: z.object({
+        mode: z.enum(['off', 'notify', 'ask', 'auto']).default('notify').describe('What the agent may do about a newer release. notify tells you and installs nothing (the default, and what an absent key resolves to); ask behaves as notify until the ring-0 exit ships a prompt; auto installs a staged release at a session start when every gate passes and no other session is live; off says nothing at all. Read from the user-global layer only — a repository cannot set how your global install updates itself.'),
+    }).default({ mode: 'notify' }),
     legal_review_prep: z.object({
         acknowledged: z.boolean().default(false).describe('I understand the legal-review-prep pack provides templates and general information ONLY — it is NOT legal advice, creates no attorney-client relationship, and never replaces a licensed lawyer. Individual cases require an attorney. The pack stays inactive until this is checked.'),
         require_council: z.boolean().default(true).describe('Gate legal work-product behind a multi-model AI-council / deep-research pass (defense-in-depth: documented multi-stage review + audit trail; fail-closed when no council is configured). Leave on for the safest posture. Turning it off lets single-model legal output through — not recommended for a high-risk pack.'),

package/dist/server/serverInfo.js

@@ -1,6 +1,6 @@
 /**
  * On-disk record of the currently-running local server, so a fresh
- * `agent-config init` (via `scripts/install.py`) can find and terminate a
+ * `agent-config init` (via `src/scripts/install.ts`) can find and terminate a
  * previous instance before starting a new one — guaranteeing a single live
  * server and a fresh wizard that re-enters at step 1.
  *