@event4u/agent-config 17.2.1 → 17.4.0

package/CREDITS.md

@@ -13,7 +13,7 @@ contributors whose skills, rules or commands were merged.
 | `design-intelligence` (`ui-styling`-derived assets) | "claudekit" | Apache-2.0 | [`LICENSE.apache-2.0.txt`](src/skills/design-intelligence/LICENSE.apache-2.0.txt) + modified-file markers per §4b |
 | `corpus-grounding`, `design-tokens`, `react-shadcn-ui`, `tailwind-engineer` (derived slices) | see per-skill notices | MIT / Apache-2.0 | ADR-061 — the per-skill attribution notice is authoritative |
 | `src/scripts/cost/budget.mjs`, `src/scripts/cost/track.mjs` | ruvnet/ruflo — `plugins/ruflo-cost-tracker` | MIT | full notice below; transformation record in [`provenance/borrows.jsonl`](provenance/borrows.jsonl) and [`docs/THIRD-PARTY-NOTICES.md`](docs/THIRD-PARTY-NOTICES.md) |
-| `src/vendor/grammars/*.wasm` (3 compiled tree-sitter grammars) | `tree-sitter/tree-sitter-{php,typescript,javascript}`, packaged by `tree-sitter-wasms` (Unlicense) | MIT | full notice below; provenance and refresh procedure in [`src/vendor/grammars/README.md`](src/vendor/grammars/README.md) |
+| `src/vendor/grammars/*.wasm` (8 compiled tree-sitter grammars) | `tree-sitter/tree-sitter-{php,typescript,javascript,python,go,java,c-sharp,ruby}`, packaged by `tree-sitter-wasms` (Unlicense) | MIT | full notice below; provenance and refresh procedure in [`src/vendor/grammars/README.md`](src/vendor/grammars/README.md) |
 
 #### MIT notice — ruvnet/ruflo
 
@@ -49,7 +49,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #### MIT notice — tree-sitter grammars
 
-Reproduced in full for the same reason as the notice above: the three
+Reproduced in full for the same reason as the notice above: the eight
 WebAssembly grammars under `src/vendor/grammars/` are **verbatim, unmodified
 binary copies**, which is the clearest possible case of "copies or substantial
 portions of the Software". They ship in the npm package (`package.json` →

package/README.md

@@ -1,4 +1,4 @@
-<p align="center"><a href="https://event4u.app"><img alt="event4u Agent Config" src=".github/assets/banner.png"></a></p>
+<p align="center"><a href="https://event4u.app"><img alt="event4u Agent Config" src=".github/assets/info-banner.png"></a></p>
 
 # Agent Config — every claim machine-checked, including the artifact counts in these badges
 

package/dist/agent-src/skills/code-intelligence/SKILL.md

@@ -45,10 +45,9 @@ code-graph and no appetite to build one — plain `grep`/read is right there.
 1. **Detect the source.** `agent-config code-graph detect` — is a fresh consumer
    `graph.json` or native cache present? (A consumer-shipped fresh index wins;
    the native engine covers stale-or-absent — ADR-124 § 2.)
-2. **Build if absent and worthwhile.** No graph + a repo in the launch set
-   (PHP / TS / JS)? `agent-config code-graph build` (deterministic, LLM-free,
-   ~seconds). Skip for a one-off question in an unsupported stack — grep
-   instead.
+2. **Build if absent and worthwhile.** No graph + PHP, TS/JS, Python, Go, Java
+   or C#? `agent-config code-graph build` (deterministic, LLM-free, ~seconds).
+   Unsupported stack, one-off ask — grep.
 3. **Query.** Pick the verb:
    - `agent-config code-graph query <symbol>` — direct relations of a symbol.
    - `agent-config code-graph affected <symbol>` — reverse: who calls /
@@ -82,25 +81,27 @@ Every answer built with this skill MUST:
 
 ## Gotcha
 
+- **No provider, no framework links.** `MAP.md` names the active providers;
+  without one, missing routes mean "not covered", not "none".
 - **A stale graph lies confidently.** If `detect` reports the index is N commits
   behind, rebuild (`agent-config code-graph build --update`) before trusting
   relationship answers, or say the answer is from a stale index.
 - **Dynamic dispatch is honestly ambiguous — where there is anything to be
   ambiguous ABOUT.** A `$obj->m()` whose name matches a method declared
-  somewhere in the repo is `AMBIGUOUS` and carries those candidates: the engine
-  being honest, not broken — do not "resolve" them yourself by guessing. A
+  somewhere in the repo is `AMBIGUOUS` and carries those candidates: honest,
+  not broken — never "resolve" them by guessing. A
   dynamic call whose name matches **no** in-repo method (`xs.push()`,
   `map.get()`) is not emitted at all, and the count is published as
   `suppressed_edge_counts.dynamic_no_candidate`. It used to be 39 % of this
-  engine's own graph, pointing at `symbol:push`, which is not a node and which
-  no query verb could reach.
+  engine's own graph, pointing at `symbol:push` — no node, unreachable by any
+  query verb.
 - **The AMBIGUOUS share is a property of the code, not a constant.** Measured
   2026-09-04 over the three roots the v2 benchmark uses: `AMBIGUOUS` is 0 of 495
-  edges under the package's own graph-engine root, 0 of 181 under `src/shared`, and 121 of
+  edges under the graph-engine root, 0 of 181 under `src/shared`, and 121 of
   4,002 (3.0 %) under its council root — class-free TypeScript has
-  almost no in-repo method to be ambiguous between. A Laravel codebase, where
-  facades and injected services dispatch onto real in-repo methods, is the
-  opposite case. Read the counts in the graph rather than a remembered ratio.
+  few in-repo methods to confuse. A Laravel codebase (facades,
+  injected services dispatching onto in-repo methods) is the opposite. Read the
+  graph's counts, not a remembered ratio.
 
 ## Measured twice, and it has not won (v2, 2026-08-29)
 
@@ -252,6 +253,9 @@ paragraph claiming "the same five answers" directly after a list of four:
 | `graph_node` | no CLI verb — one symbol's location, in-edges, out-edges and degree |
 | `graph_map_status` | whether `agents/map/` exists, its counts and freshness | <!-- ref-ignore -->
 | `graph_area` | one area of the map: files, hubs, what it depends on |
+| `graph_estate` | `estate` — across registered projects, from the local index (opt-in: `projects index on`) |
+
+Every other tool takes `project` (a registered repo id, name or path).
 
 `untested` has no tool of its own; it is a flag on `graph_impact`, because the
 two answer the same question over the same diff and a separate tool would have

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "17.2.1"
+agent_config_version: "17.4.0"
 
 # --- Project identity ---
 project:

package/dist/agent-src/templates/scripts/check_memory.ts

@@ -136,7 +136,7 @@ export const REDACTION_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
     // Key=value secret with a clear credential-word prefix. The value must
     // be a single token (no spaces, no "/" — skips filepaths and URLs).
     [
-        /\b(api[_-]?key|auth[_-]?token|access[_-]?token|bearer|secret|password|passwd|private[_-]?key)\b\s*[:=]\s*[A-Za-z0-9+/=_\-]{8,}(?![/.\w])/i,
+        /\b(api[_-]?key|auth[_-]?token|access[_-]?token|bearer|secret|password|passwd|private[_-]?key)\b\s*(?::|=(?!==|=\s|>)=?)\s*[A-Za-z0-9+/=_\-]{8,}(?![/.\w])/i,
         'inline credential',
     ],
     [/https?:\/\/[^\s"'/]*:[^\s"'/]*@/, 'url with credentials'],

package/dist/cli/commands/recordTriggerEval.js

@@ -31,7 +31,7 @@
  */
 import { readFileSync, writeFileSync } from 'node:fs';
 import { sep } from 'node:path';
-import { z } from 'zod';
+import * as z from 'zod';
 import { logger } from '../log/logger.js';
 // Floors shared with the weekly canary rotation (ADR-118 §4) — values
 // unchanged, single source of truth.

package/dist/cli/registry.js

@@ -15,7 +15,7 @@ export const REGISTRY = [
     { name: 'validate', disposition: 'delegate', synopsis: 'Drift detection on the manifest.' },
     { name: 'work', disposition: 'delegate', synopsis: 'Drive the work_engine on a prompt.' },
     { name: 'implement-ticket', disposition: 'delegate', synopsis: 'Drive the work_engine on a ticket.' },
-    { name: 'update', disposition: 'delegate', synopsis: 'Update the agent_config_version pin in .agent-settings.yml.' },
+    { name: 'update', disposition: 'delegate', synopsis: 'Pin agent_config_version, installing that version globally first when the global install is older.' },
     { name: 'upgrade', disposition: 'delegate', synopsis: 'Install the latest package globally + refresh the global install.' },
     { name: 'refresh', disposition: 'delegate', synopsis: 'Idempotent re-install (no version change): --global or --project.' },
     { name: 'versions', disposition: 'native', synopsis: 'List @event4u/agent-config versions.' },
@@ -77,7 +77,7 @@ export const REGISTRY = [
     { name: 'affected', disposition: 'delegate', synopsis: 'Artefacts related to <artefact> via the discovery relation-graph (BFS).' },
     { name: 'graph-explain', disposition: 'delegate', synopsis: 'Seed on a <concept>, expand 2 hops over the discovery relation-graph with a node budget.' },
     { name: 'benchmark', disposition: 'delegate', synopsis: 'Report context-token reduction vs the full always-loaded projection.' },
-    { name: 'code-graph', disposition: 'delegate', synopsis: 'Deterministic code-graph engine: build|detect|refresh|validate|query|affected|path|explain|map, plus the gate verbs impact|tests-for|untested|dead.' },
+    { name: 'code-graph', disposition: 'delegate', synopsis: 'Deterministic code-graph engine: build|detect|refresh|validate|query|affected|path|explain|map, plus the gate verbs impact|tests-for|untested|dead, the user-global projects registry with its estate index and the lineage ledger.' },
     { name: 'hooks:install', disposition: 'delegate', synopsis: 'Install the combined pre-commit hook.' },
     { name: 'hooks:status', disposition: 'delegate', synopsis: 'Print the runtime hook matrix (per-platform install + bindings).' },
     { name: 'hooks:doctor', disposition: 'delegate', synopsis: 'Diagnose hook health: concerns, posture, missing trampolines (read-only).' },

package/dist/cli-delegate/{chunk-KR5ZIFPO.js → chunk-5AYJGUA3.js}

@@ -46,7 +46,7 @@ function assignmentSource(shape) {
   const alt = shape.keywords.map((k) => ASSIGNMENT_KEYWORDS[k]).join("|");
   const group = shape.capture === true ? `(${alt})` : `(?:${alt})`;
   const gap = shape.gap ?? "\\s*";
-  const head = `${shape.before ?? ""}${group}${shape.after ?? ""}${gap}[:=]`;
+  const head = `${shape.before ?? ""}${group}${shape.after ?? ""}${gap}(?::|=(?!==|=\\s|>)=?)`;
   return shape.value === void 0 ? head : `${head}${gap}${shape.value}`;
 }
 function assignmentPattern(shape, flags) {
@@ -574,8 +574,6 @@ export {
   rawKeyPrefixPattern,
   maskingEnd,
   evaluateMatch,
-  findSpans,
-  resolveOverlaps,
   detect,
   replaceSpans
 };