@event4u/agent-config 17.0.0 → 17.2.0

package/dist/hooks/instructions_observer.chunk.cjs

@@ -0,0 +1,301 @@
+#!/usr/bin/env tsx
+const __acChunkMetaUrl = require('node:url').pathToFileURL(__filename).href; const __acChunkMeta = { url: __acChunkMetaUrl, dirname: __dirname, filename: __filename };
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/scripts/hooks/instructions_observer_hook.ts
+var instructions_observer_hook_exports = {};
+__export(instructions_observer_hook_exports, {
+  KEEP_SESSIONS: () => KEEP_SESSIONS,
+  KILL_SWITCH_ENV: () => KILL_SWITCH_ENV,
+  MAX_SESSION_BYTES: () => MAX_SESSION_BYTES,
+  arrivalsDir: () => arrivalsDir,
+  main: () => main,
+  processEnvelope: () => processEnvelope
+});
+module.exports = __toCommonJS(instructions_observer_hook_exports);
+var fs2 = __toESM(require("node:fs"), 1);
+var path2 = __toESM(require("node:path"), 1);
+var import_node_url = require("node:url");
+
+// src/scripts/_lib/user_global_paths.ts
+var os = __toESM(require("node:os"), 1);
+var path = __toESM(require("node:path"), 1);
+var EVENT4U_HOME_ENV = "EVENT4U_CONFIG_HOME";
+var DEFAULT_EVENT4U_ROOT_RELATIVE = path.join(".event4u", "agent-config");
+var LEGACY_XDG_ROOT_RELATIVE = path.join(".config", "agent-config");
+function expanduser(p) {
+  if (p === "~") {
+    return os.homedir();
+  }
+  if (p.startsWith("~/") || process.platform === "win32" && p.startsWith("~\\")) {
+    return path.join(os.homedir(), p.slice(2));
+  }
+  return p;
+}
+function event4u_root(env) {
+  const env_map = env ?? process.env;
+  const override = env_map[EVENT4U_HOME_ENV];
+  if (override) {
+    return expanduser(override);
+  }
+  return path.join(os.homedir(), DEFAULT_EVENT4U_ROOT_RELATIVE);
+}
+
+// src/scripts/_lib/instructions_loaded_event.ts
+var ID_SHAPE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var isSessionFile = (f) => f.endsWith(".jsonl") && ID_SHAPE_RE.test(f.slice(0, -6));
+var idShaped = (v) => typeof v === "string" && ID_SHAPE_RE.test(v) ? v : null;
+function captureInstructionsLoaded(payload, ts, home, env) {
+  const p = typeof payload === "object" && payload !== null && !Array.isArray(payload) ? payload : {};
+  const raw = String(p["file_path"] ?? "").replace(/\\/g, "/");
+  const norm = /^([A-Za-z]:)?\//.test(raw) && !/\/\.{0,2}\//.test(raw) ? raw : "";
+  const h = home.replace(/\\/g, "/").replace(/\/+$/, "");
+  return {
+    v: 2,
+    ts,
+    agent: idShaped(env["AI_AGENT"]),
+    launch: idShaped(env["CLAUDE_CODE_ENTRYPOINT"]),
+    session: idShaped(p["session_id"]),
+    name: idShaped(p["hook_event_name"]),
+    reason: idShaped(p["load_reason"]),
+    file: idShaped(norm.slice(norm.lastIndexOf("/") + 1)),
+    rules: norm.includes("/.claude/rules/"),
+    user: h !== "" && norm.startsWith(`${h}/.claude/`)
+  };
+}
+
+// src/scripts/hooks/state_io.ts
+var REPLAY_ENV_VAR = "AGENT_CONFIG_REPLAY";
+function is_replay_mode() {
+  return (process.env[REPLAY_ENV_VAR] ?? "").trim() === "1";
+}
+
+// src/scripts/hooks/hook_stdin.ts
+var tty = __toESM(require("node:tty"), 1);
+
+// src/scripts/_lib/stdin.ts
+var fs = __toESM(require("node:fs"), 1);
+var CHUNK = 64 * 1024;
+var RETRY_SLEEP_MS = 5;
+var MAX_RETRIES = 2e3;
+function _sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function readStdinText(fd = 0, opts = {}) {
+  const chunks = [];
+  const buf = Buffer.alloc(CHUNK);
+  let retries = 0;
+  let got_any = false;
+  const first_byte_deadline = opts.firstByteTimeoutMs === void 0 ? null : Date.now() + opts.firstByteTimeoutMs;
+  for (; ; ) {
+    let read;
+    try {
+      read = fs.readSync(fd, buf, 0, CHUNK, null);
+      retries = 0;
+    } catch (exc) {
+      const code = exc.code;
+      if (code === "EAGAIN") {
+        if (!got_any && first_byte_deadline !== null && Date.now() >= first_byte_deadline) {
+          return "";
+        }
+        retries += 1;
+        if (retries > MAX_RETRIES) {
+          throw new Error(
+            `readStdinText: stdin stayed unreadable across ${String(MAX_RETRIES)} retries (~${String(MAX_RETRIES * RETRY_SLEEP_MS / 1e3)}s). Refusing to report an empty read as empty input.`
+          );
+        }
+        _sleepSync(RETRY_SLEEP_MS);
+        continue;
+      }
+      if (code === "EOF") break;
+      throw exc;
+    }
+    if (read === 0) break;
+    got_any = true;
+    chunks.push(Buffer.from(buf.subarray(0, read)));
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+
+// src/scripts/hooks/hook_stdin.ts
+var OVERRIDE_KEY = /* @__PURE__ */ Symbol.for("agent-config.hookStdinOverride");
+function host() {
+  return globalThis;
+}
+var HOOK_FIRST_BYTE_TIMEOUT_MS = 25;
+function readFd0ToEnd() {
+  void process.stdin;
+  return readStdinText(0, { firstByteTimeoutMs: HOOK_FIRST_BYTE_TIMEOUT_MS });
+}
+function readHookStdin() {
+  const override = host()[OVERRIDE_KEY];
+  if (override !== null && override !== void 0) return override;
+  try {
+    if (tty.isatty(0)) return "";
+    return readFd0ToEnd();
+  } catch {
+    return "";
+  }
+}
+
+// src/scripts/hooks/exit_codes.ts
+var EXIT_ALLOW = 0;
+var EXIT_BLOCK = 1;
+var EXIT_WARN = 2;
+var EXIT_ERROR = 3;
+var EXIT_CODES = Object.freeze([
+  Object.freeze({
+    code: EXIT_ALLOW,
+    name: "allow",
+    meaning: "no objection; the dispatcher passes the call through",
+    owner: "every concern \u2014 the default verdict",
+    authorizedBy: "nothing; allowing needs no authority"
+  }),
+  Object.freeze({
+    code: EXIT_BLOCK,
+    name: "block",
+    meaning: "refuse the call; the dispatcher lowers this onto the host deny channel",
+    owner: "a concern declared `severity: blocking` in hook_manifest.yaml",
+    authorizedBy: "the manifest entry plus its row in the BLOCKING_ALLOWLIST of tests/hooks/concern_severity.test.ts \u2014 an advisory concern emitting this is downgraded to warn by dispatch_hook._is_advisory"
+  }),
+  Object.freeze({
+    code: EXIT_WARN,
+    name: "warn",
+    meaning: "advisory; the dispatcher exits 0 and surfaces the reason",
+    owner: "any concern",
+    authorizedBy: "nothing; warning is the ceiling for an advisory concern and is always available to a blocking one"
+  }),
+  Object.freeze({
+    code: EXIT_ERROR,
+    name: "error",
+    meaning: "the concern crashed, timed out, or could not decide \u2014 any rc >= 3. The dispatcher resolves it by the concern`s declared severity, never by the number itself",
+    owner: "no concern emits this on purpose; the runtime does",
+    authorizedBy: "hook_manifest.yaml `severity` alone \u2014 blocking refuses, anything else fails open; `fail_closed` is no longer read on this branch. See docs/contracts/hook-architecture-v1.md \xA7 Exit-code semantics"
+  })
+]);
+
+// src/scripts/hooks/instructions_observer_hook.ts
+var KILL_SWITCH_ENV = "AGENT_CONFIG_INSTRUCTIONS_OBSERVER";
+var KEEP_SESSIONS = 50;
+var MAX_SESSION_BYTES = 256 * 1024;
+var C = fs2.constants;
+var NOFOLLOW = C.O_NOFOLLOW ?? 0;
+var APPEND_NOFOLLOW = C.O_WRONLY | C.O_APPEND | C.O_CREAT | C.O_NONBLOCK | NOFOLLOW;
+var TRUNC_NOFOLLOW = C.O_WRONLY | C.O_TRUNC | C.O_CREAT | C.O_NONBLOCK | NOFOLLOW;
+function writePrivate(file, text, flags, cap = Infinity) {
+  const fd = fs2.openSync(file, flags, 384);
+  try {
+    const st = fs2.fstatSync(fd);
+    if (!st.isFile() || (st.mode & 63) !== 0) throw new Error("EREFUSED");
+    if (st.size < cap && fs2.writeSync(fd, text) !== text.length) throw new Error("ESHORT");
+  } finally {
+    fs2.closeSync(fd);
+  }
+}
+function privateDir(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  const st = fs2.lstatSync(dir);
+  const uid = process.getuid?.();
+  if (!st.isDirectory() || (st.mode & 63) !== 0 || uid !== void 0 && st.uid !== uid) throw new Error("EREFUSED_DIR");
+}
+function arrivalsDir(env = process.env) {
+  return path2.join(event4u_root(env), "runtime", "arrivals");
+}
+function prune(dir) {
+  const files = [];
+  for (const f of fs2.readdirSync(dir)) {
+    if (!isSessionFile(f)) continue;
+    try {
+      const st = fs2.lstatSync(path2.join(dir, f));
+      if (st.isFile()) files.push({ f, t: st.mtimeMs });
+    } catch {
+    }
+  }
+  files.sort((a, b) => b.t - a.t || (a.f < b.f ? -1 : 1));
+  for (const { f } of files.slice(KEEP_SESSIONS)) fs2.rmSync(path2.join(dir, f), { force: true });
+}
+function processEnvelope(raw, env = process.env) {
+  let dir = "";
+  try {
+    if (env[KILL_SWITCH_ENV] === "off" || is_replay_mode()) return EXIT_ALLOW;
+    dir = arrivalsDir(env);
+    let parsed = null;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+    }
+    const envelope = parsed ?? {};
+    const inner = envelope["payload"];
+    const cap = captureInstructionsLoaded(typeof inner === "object" && inner !== null ? inner : envelope, (/* @__PURE__ */ new Date()).toISOString(), env["HOME"] ?? "", env);
+    if (cap.session === null) return EXIT_ALLOW;
+    privateDir(dir);
+    writePrivate(path2.join(dir, `${cap.session}.jsonl`), `${JSON.stringify(cap)}
+`, APPEND_NOFOLLOW, MAX_SESSION_BYTES);
+    prune(dir);
+  } catch (e) {
+    try {
+      const code = String(e.code ?? e.message);
+      if (dir) writePrivate(`${dir}.last-error`, `${(/* @__PURE__ */ new Date()).toISOString()} ${code}
+`, TRUNC_NOFOLLOW);
+    } catch {
+    }
+  }
+  return EXIT_ALLOW;
+}
+function main() {
+  try {
+    return processEnvelope(readHookStdin());
+  } catch {
+    return EXIT_ALLOW;
+  }
+}
+function _isCliEntry() {
+  if (true) {
+    return false;
+  }
+  if (process.argv[1] === void 0) return false;
+  const argvUrl = (0, import_node_url.pathToFileURL)(path2.resolve(process.argv[1])).href;
+  if (__acChunkMetaUrl === argvUrl) return true;
+  try {
+    return fs2.realpathSync((0, import_node_url.fileURLToPath)(__acChunkMetaUrl)) === fs2.realpathSync(path2.resolve(process.argv[1]));
+  } catch {
+    return false;
+  }
+}
+if (_isCliEntry()) process.exit(main());
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  KEEP_SESSIONS,
+  KILL_SWITCH_ENV,
+  MAX_SESSION_BYTES,
+  arrivalsDir,
+  main,
+  processEnvelope
+});

package/dist/hooks/instructions_observer.chunk.cjs.sha256

@@ -0,0 +1 @@
+fd1fae855375fc9885203e448f92e2a0b9f74a14cf7f35bf255bcaff391736bb  instructions_observer.chunk.cjs

package/dist/install/claudeRuleRewrite.js

@@ -46,6 +46,9 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { _claude_paths_plan } from './claudePathsPlan.js';
+// Re-exported for `install.ts`, which sits past the source-size ceiling and so
+// reaches it through the namespace it already imports instead of a new line.
+export { onlyDeployed } from './loggedWrites.js';
 import { parseFrontmatter } from './ruleInScope.js';
 /**
  * Frontmatter keys the rewrite must carry across, and why each one.
@@ -109,8 +112,8 @@ export function _withPreservedKeys(rendered, original) {
  * extraction and never up through a baseline raise. So the caller gets one call
  * and a list of strings.
  */
-export function rewriteAndReport(rulesDir, quiet, info, warn, wrappers, preserved = new Set()) {
-    const result = rewriteClaudeRules(rulesDir, preserved);
+export function rewriteAndReport(rulesDir, quiet, info, warn, wrappers, preserved = new Set(), onWrite) {
+    const result = rewriteClaudeRules(rulesDir, preserved, onWrite);
     // The flat-command wrapper report rides along rather than sitting at the
     // call site: `install.ts` is thousands of lines past
     // `check_source_size_budget`'s ceiling, and this module is the one place
@@ -205,8 +208,11 @@ export function renderClaudeRule(sourceText) {
  * disappearing from the frontmatter.
  *
  * Returns counts rather than printing. The caller owns the reporting surface.
+ * `onWrite` receives each rewritten path, so the installer can log it: the
+ * transaction log is read back as proof the bytes on disk are ours, and a
+ * write it never saw would leave every rewritten rule unprovable.
  */
-export function rewriteClaudeRules(rulesDir, preserved = new Set()) {
+export function rewriteClaudeRules(rulesDir, preserved = new Set(), onWrite) {
     const result = { rewritten: 0, scoped: [], dropped: [], failed: [] };
     let entries;
     try {
@@ -258,6 +264,7 @@ export function rewriteClaudeRules(rulesDir, preserved = new Set()) {
                 });
                 continue;
             }
+            onWrite?.(full);
             result.rewritten += 1;
         }
         const stem = name.slice(0, -3);

package/dist/install/conflict.js

@@ -16,7 +16,8 @@
  */
 import { existsSync } from 'node:fs';
 import { sha256File } from './plan.js';
-import { isLedgerMigration } from './preserve.js';
+import { loggedWriteDigests, wroteTheseBytes } from './loggedWrites.js';
+import { isLedgerMigration, logProofApplies, sidecarPathFor } from './preserve.js';
 import { classifyOwnership, ledgerListedPaths, recordedHashesWithLedger, } from './recordedOwnership.js';
 /**
  * Decide what to do with a single planned target.
@@ -161,8 +162,10 @@ export const CONFLICT_BATCH_THRESHOLD = 5;
  *
  * `recorded` is injectable for tests; by default it is read from the
  * manifest at `plan.root`, with the user-scoped ownership ledger laid over it.
+ * `logged` likewise; by default it is the install transaction log, opened only
+ * for an entry `logProofApplies` to.
  */
-export function computeConflicts(plan, recordedOverride) {
+export function computeConflicts(plan, recordedOverride, loggedOverride) {
     // Force returns before the manifest is read. As a default parameter the
     // map was built at call entry and discarded on the next line, so every
     // force-mode plan paid a read and a YAML parse for nothing.
@@ -173,6 +176,7 @@ export function computeConflicts(plan, recordedOverride) {
     // digests never reaches the branch that needs this, and an unconditional
     // read would charge every plan for an answer most of them discard.
     let ledgerFiles = null;
+    let logged;
     const ledgerLists = (p) => {
         ledgerFiles ??= ledgerListedPaths();
         return ledgerFiles.has(p);
@@ -197,6 +201,24 @@ export function computeConflicts(plan, recordedOverride) {
             const ownership = classifyOwnership(recorded.get(entry.path), onDisk);
             if (ownership === 'recorded-unchanged')
                 continue;
+            // The writer's transaction-log proof, under the writer's own
+            // condition (`logProofApplies`): where it holds and the log records
+            // these bytes, the writer replaces the file, so the preview must
+            // not name it.
+            const recordedSha = recorded.get(entry.path);
+            const unproven = {
+                exists: true,
+                recordedSha256: recordedSha,
+                onDiskSha256: onDisk,
+                force: false,
+                ledgerListed: ledgerLists(entry.path),
+                recordedIsStaged: typeof recordedSha === 'string' && recordedSha === recorded.get(sidecarPathFor(entry.path)),
+            };
+            if (logProofApplies(unproven)) {
+                logged ??= loggedOverride ?? loggedWriteDigests();
+                if (wroteTheseBytes(entry.path, onDisk, logged))
+                    continue;
+            }
             if (ownership === 'unknown' && plan.policy.knownPaths.has(entry.path))
                 continue;
             // CANDIDACY, not the verdict, and it is computed BEFORE the

package/dist/install/conflictTracker.js

@@ -21,7 +21,8 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { mkdirp, pathExists, resolvePath, sha256OfFile } from './fsPrimitives.js';
-import { EXIT_COMPLETED_WITH_CONFLICTS, conflictSummaryMessage, decideDeployWrite, foreignSidecarMessage, isLedgerMigration, migrationPreservedMessage, preservedFileMessage, sidecarPathFor, } from './preserve.js';
+import { EXIT_COMPLETED_WITH_CONFLICTS, conflictSummaryMessage, decideDeployWrite, foreignSidecarMessage, isLedgerMigration, logProofApplies, migrationPreservedMessage, preservedFileMessage, sidecarPathFor, } from './preserve.js';
+import { loggedWriteDigests, wroteTheseBytes } from './loggedWrites.js';
 import { ledgerListedPaths, recordedHashesWithLedger } from './recordedOwnership.js';
 /**
  * Build a tracker bound to one installer's reporting surface.
@@ -37,6 +38,7 @@ export function createConflictTracker(host) {
         root: null,
         recorded: null,
         ledgerFiles: null,
+        logged: null,
         preserved: [],
         migrated: new Set(),
         staged: new Map(),
@@ -210,6 +212,7 @@ export function createConflictTracker(host) {
             conflictState.root = root;
             conflictState.recorded = null;
             conflictState.ledgerFiles = null;
+            conflictState.logged = null;
             conflictState.preserved = [];
             conflictState.migrated = new Set();
             conflictState.staged = new Map();
@@ -222,13 +225,21 @@ export function createConflictTracker(host) {
          */
         resolve(target, force, would) {
             const exists = pathExists(target);
-            const base = {
+            const recordedSha256 = exists ? recordedHashFor(target) : undefined;
+            const unproven = {
                 exists,
-                recordedSha256: exists ? recordedHashFor(target) : undefined,
+                recordedSha256,
                 onDiskSha256: exists ? sha256OfFile(target) : null,
                 force,
                 ledgerListed: exists && ledgerLists(target),
+                recordedIsStaged: typeof recordedSha256 === 'string' && recordedSha256 === recordedHashFor(sidecarPathFor(target)),
             };
+            // The log is opened only where the record alone would preserve
+            // without cause, and read once per run: this run's own appends
+            // cannot prove a file it has not reached yet.
+            const loggedWrite = logProofApplies(unproven) &&
+                wroteTheseBytes(target, unproven.onDiskSha256, (conflictState.logged ??= loggedWriteDigests()));
+            const base = { ...unproven, loggedWrite };
             // The packaged digest costs a temp write and a tag, so it is
             // computed only for the targets that can consume it. On a tree
             // where every ledger-listed path carries a digest — which is every