@event4u/agent-config 17.2.1 → 17.4.0

package/dist/scripts/_lib/egress_rules.js

@@ -53,12 +53,18 @@ export const ASSIGNMENT_KEYWORDS = {
     token: 'token',
     bearer: 'bearer',
 };
-/** Source of a keyword-assignment shape: keyword group, operator, then the consumer's value. */
+/**
+ * Source of a keyword-assignment shape: keyword group, operator, then the consumer's value.
+ * Not an assignment: `===` (strict equality), `==` followed by whitespace (a spaced
+ * comparison) and `=>` (an arrow) — read as one, `token === 'x'` yielded the value `==` and
+ * the council bundle refused every later `==`. A shell `name==value` stays an assignment,
+ * and its second `=` belongs to the operator, so the value read is `value`, never a lone `=`.
+ */
 export function assignmentSource(shape) {
     const alt = shape.keywords.map((k) => ASSIGNMENT_KEYWORDS[k]).join('|');
     const group = shape.capture === true ? `(${alt})` : `(?:${alt})`;
     const gap = shape.gap ?? '\\s*';
-    const head = `${shape.before ?? ''}${group}${shape.after ?? ''}${gap}[:=]`;
+    const head = `${shape.before ?? ''}${group}${shape.after ?? ''}${gap}(?::|=(?!==|=\\s|>)=?)`;
     return shape.value === undefined ? head : `${head}${gap}${shape.value}`;
 }
 export function assignmentPattern(shape, flags) {

package/dist/scripts/condense.js

@@ -1930,19 +1930,19 @@ export const PLUGIN_POINTER_SLUG = 'install-agent-config';
 export const PLUGIN_POINTER_SKILL_BODY = `---
 name: install-agent-config
 description: >-
-  Install or upgrade the event4u agent-config suite. This marketplace plugin
-  is a bootstrap shim — it ships hooks plus this pointer only; ALL skills,
-  rules, and commands are installed via \`npx -y @event4u/agent-config init\`.
-  Use when the user asks to install, set up, or upgrade agent-config, or
+  Governance rules, skills and commands for AI coding agents in Claude Code, Cursor, GitHub Copilot and Gemini CLI —
+  install or upgrade the full event4u agent-config suite. No plugin that ships this pointer is the full suite (the Claude
+  Code one adds hooks, the Copilot one a read-only MCP server); ALL content installs via \`npx -y @event4u/agent-config init\`.
+  Use when the user asks to install, set up, or upgrade agent-config, wants coding-agent rules or skills, or
   wonders why this plugin contains no other skills.
 ---
 
 # Install agent-config
 
-This plugin is a **bootstrap shim** kept so the marketplace listing stays
-discoverable. Its hooks run only alongside a global npm install of the package (never a project-local one) —
-on a plugin-only install no hook runs, so the \`fail_closed\` guards (\`block-no-verify\`, \`block-kernel-rule-writes\`,
-\`block-plumbing-writes\`) are **off**; the session start says so once. Content ships as a file projection.
+The plugin that delivered this skill is a **discovery entry**, not the suite. The Claude Code plugin adds hooks that
+run only alongside a global npm install of the package (never a project-local one) — on a plugin-only install no hook
+runs, so the \`fail_closed\` guards (\`block-no-verify\`, \`block-kernel-rule-writes\`, \`block-plumbing-writes\`) are
+**off**; the session start says so once. The Copilot plugin adds a read-only MCP server and no hooks.
 
 ## Install (canonical, one command)
 
@@ -1952,7 +1952,7 @@ npx -y @event4u/agent-config init
 
 The installer writes the full content projection, registers the dispatcher
 hooks as a managed block in \`~/.claude/settings.json\` (byte-identical to
-this plugin's hooks, so nothing double-fires), and keeps everything
+the Claude Code plugin's hooks, so nothing double-fires), and keeps everything
 upgradeable via \`agent-config upgrade\`.
 
 ## Already installed both?
@@ -1969,11 +1969,14 @@ export function generate_plugin_command_skills() {
     const pointer_dir = path.join(MODULE_STATE.PLUGIN_SKILLS_DIR, PLUGIN_POINTER_SLUG);
     _mkdirp(pointer_dir);
     const pointer_file = path.join(pointer_dir, 'SKILL.md');
-    if (_isSymlink(pointer_file)) {
-        fs.unlinkSync(pointer_file);
-    }
-    if (!_isFile(pointer_file) || fs.readFileSync(pointer_file, 'utf-8') !== PLUGIN_POINTER_SKILL_BODY) {
-        fs.writeFileSync(pointer_file, PLUGIN_POINTER_SKILL_BODY);
+    for (const file of [pointer_file, path.join(MODULE_STATE.PROJECT_ROOT, '.github', 'plugin', 'skills', PLUGIN_POINTER_SLUG, 'SKILL.md')]) {
+        if (_isSymlink(file)) {
+            fs.unlinkSync(file);
+        }
+        if (!_isFile(file) || fs.readFileSync(file, 'utf-8') !== PLUGIN_POINTER_SKILL_BODY) {
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            fs.writeFileSync(file, PLUGIN_POINTER_SKILL_BODY);
+        }
     }
     // 2. Prune every other skill dir so the tree converges to shim shape
     //    from any prior state. Removable = every entry is a symlink (the
@@ -2001,7 +2004,7 @@ export function generate_plugin_command_skills() {
             removed_dirs += 1;
         }
     }
-    let msg = '  ✅  Plugin skills: bootstrap shim (1 pointer skill) in .claude-plugin/skills/';
+    let msg = '  ✅  Plugin skills: bootstrap shim (1 pointer skill) in .claude-plugin/skills/ and .github/plugin/skills/';
     if (removed_dirs) {
         msg += ` (${removed_dirs} content entries pruned)`;
     }

package/dist/server/routes/discovery.js

@@ -12,7 +12,7 @@
  * (PR working tree, dev install) rather than a runtime bug. See ADR-013
  * and the R3 roadmap for the broader contract.
  */
-import { z } from 'zod';
+import * as z from 'zod';
 import { loadManifest, ManifestNotFoundError, ManifestParseError, } from '../../cli/discovery/loadManifest.js';
 export const DiscoverySliceSchema = z.enum(['workspaces', 'packs', 'artefacts', 'unassigned']);
 function pickSlice(manifest, slice) {

package/dist/server/routes/install.js

@@ -12,7 +12,7 @@
  * road-to-single-install-source-of-truth § Phase 3 — this module now only
  * serves the read-only detect / plan-preview / recovery / legacy-v3 routes.
  */
-import { z } from 'zod';
+import * as z from 'zod';
 import { computeConflicts } from '../../install/conflict.js';
 import { cpSync, existsSync, mkdirSync } from 'node:fs';
 import { detectLegacyV3, detectPackageRoot, detectProjectShape, detectScope, detectToolPresence, } from '../../install/detect.js';

package/dist/server/routes/ping.js

@@ -6,7 +6,7 @@
  * are connected to the right process. The zod schema is exported so
  * tests assert against the same source of truth as the handler.
  */
-import { z } from 'zod';
+import * as z from 'zod';
 import { readFileSync } from 'node:fs';
 import { PACKAGE_JSON } from '../../cli/paths.js';
 import { CAPABILITIES } from '../../shared/capabilities.js';

package/dist/server/routes/schema.js

@@ -3,7 +3,7 @@
  *
  * The SPA bundle does not ship Zod (council security-engineer mandate:
  * client and server cannot drift). Instead it fetches JSON-Schema once at
- * mount and feeds it to the form renderer. `zod-to-json-schema` does the
+ * mount and feeds it to the form renderer. `toJsonSchema7` does the
  * conversion in-process; the response is cached for the lifetime of the
  * server process because the schemas are compile-time constants.
  *
@@ -14,7 +14,7 @@
  *     generatedAt: ISO-8601 string,
  *   }
  */
-import { zodToJsonSchema } from 'zod-to-json-schema';
+import { toJsonSchema7 } from '../../shared/zodJsonSchema.js';
 import { settingsSchema } from '../schemas/settings.js';
 import { userIdentitySchema } from '../../shared/userMd/schema.js';
 let cached = null;
@@ -22,8 +22,8 @@ function build() {
     if (cached !== null)
         return cached;
     cached = {
-        settings: zodToJsonSchema(settingsSchema, { name: 'Settings', target: 'jsonSchema7' }),
-        userIdentity: zodToJsonSchema(userIdentitySchema, { name: 'UserIdentity', target: 'jsonSchema7' }),
+        settings: toJsonSchema7(settingsSchema, 'Settings'),
+        userIdentity: toJsonSchema7(userIdentitySchema, 'UserIdentity'),
         generatedAt: new Date().toISOString(),
     };
     return cached;

package/dist/server/routes/settings.js

@@ -1,7 +1,7 @@
 import { promises as fs } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
-import { zodToJsonSchema } from 'zod-to-json-schema';
+import { toJsonSchema7 } from '../../shared/zodJsonSchema.js';
 import { settingsSchema } from '../schemas/settings.js';
 import { parseYaml, mergeIntoTemplate, diffValues, deepMerge, renderSparseSettings, substituteTemplatePlaceholders, TEMPLATE_PLACEHOLDER_DEFAULTS } from '../io/yamlIO.js';
 import { sparseSettingsValues } from './wizard.js';
@@ -102,11 +102,7 @@ const SHARED_WRITE_MESSAGE = 'This write lands through an agent-switch shared sy
 // added there must get its default here, or `settingsSchema.safeParse` on
 // the merged defaults will reject the first save.
 // Computed once — Zod → JSON Schema conversion is pure and the schema is static.
-const SETTINGS_JSON_SCHEMA = zodToJsonSchema(settingsSchema, {
-    name: 'AgentSettings',
-    $refStrategy: 'none',
-    target: 'jsonSchema7',
-});
+const SETTINGS_JSON_SCHEMA = toJsonSchema7(settingsSchema, 'AgentSettings');
 const SETTINGS_RELATIVE = join('settings', '.agent-settings.yml');
 /** Pre-typed-subdir flat-root location. Read as fallback for migration. */
 const LEGACY_FLAT_RELATIVE = '.agent-settings.yml';

package/dist/server/routes/wizard.js

@@ -4,7 +4,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
-import { z } from 'zod';
+import * as z from 'zod';
 import { settingsSchema } from '../schemas/settings.js';
 import { userIdentitySchema } from '../../shared/userMd/schema.js';
 import { composeUserIdentity } from '../../shared/userMd/utils.js';
@@ -101,7 +101,7 @@ async function readInstalledPacks(writeRoot, legacyReadRoot, userGlobalReadRoot)
 const wizardStateSchema = z.object({
     step: z.number().int().min(0),
     totalSteps: z.number().int().min(1).optional(),
-    partial: z.record(z.unknown()).default({}),
+    partial: z.record(z.string(), z.unknown()).default({}),
     startedAt: z.string().nullable().default(null),
 });
 // road-to-global-only-install § Phase 1.5 — WizardApplyPayload shape.
@@ -112,14 +112,14 @@ const wizardStateSchema = z.object({
 const installerV1PayloadSchema = z.object({
     schema_version: z.literal('installer-v1'),
     ai_tools: z.array(z.string().min(1)).min(1),
-    configs: z.record(z.record(z.unknown())).default({}),
+    configs: z.record(z.string(), z.record(z.string(), z.unknown())).default({}),
     dry_run: z.boolean().optional(),
 });
 const wizardV2PayloadSchema = z.object({
     schema_version: z.literal('wizard-v2'),
     tools: z.array(z.string().min(1)).min(1),
     packs: z.array(z.string().min(1)).default([]),
-    settings: z.record(z.unknown()).default({}),
+    settings: z.record(z.string(), z.unknown()).default({}),
     scope_to_project_only: z.boolean().optional(),
     dry_run: z.boolean().optional(),
 });
@@ -501,12 +501,12 @@ const aiCouncilPayloadSchema = z.object({
     defaultMode: z.enum(['manual', 'api', 'cli', 'auto']).optional(),
     minRounds: z.number().int().min(1).optional(),
     maxTotalUsd: z.number().min(0).optional(),
-    members: z.record(z.object({
+    members: z.record(z.string(), z.object({
         enabled: z.boolean().optional(),
         participateLowImpact: z.boolean().optional(),
     })).optional(),
     // keys ∈ {trivial, low_impact, medium_impact} — others ignored.
-    decision: z.record(z.enum(['agent', 'council', 'user'])).optional(),
+    decision: z.record(z.string(), z.enum(['agent', 'council', 'user'])).optional(),
     /**
      * Declared so the operator can flip the one BILLING-CLASS decision in the
      * fallback design without hand-editing — NOT to stop the GUI stripping it:

package/dist/server/schemas/settings.js

@@ -10,7 +10,7 @@
  * Render strategy: depth ≤ 2. The form renderer (`SchemaForm`, Phase 2)
  * recurses one level into nested objects; deeper trees fail render-time.
  */
-import { z } from 'zod';
+import * as z from 'zod';
 const ruleLoadingTier = z.enum(['minimal', 'balanced', 'full', 'custom']);
 const disciplineProfile = z.enum(['auto', 'off', 'essential', 'full']);
 const enforcementMode = z.enum(['advisory', 'hard-stop']);
@@ -35,11 +35,11 @@ export const settingsSchema = z.object({
     agent_config_version: z.string().default('').describe('Pin the package to an exact semver (e.g. "1.4.2") so all teammates load the same skill / rule set. Leave empty to track whatever is installed locally — useful for the maintainers of this package, risky for production projects.'),
     profile: z.object({
         id: profileId.default('developer').describe('Which experience you run — the audience identity that selects your default skill / command surface, README entry-path, and persona pre-selection (ADR-010, docs/contracts/profile-system.md). Six seed profiles: developer · content_creator · founder · agency · finance · ops. This is the first wizard question. In 6.0.0-A it records the choice only; pack-scoped surfacing (projection-time filtering, ADR-040) activates in 6.0.0-B behind a staged, opt-in rollout. Switch later with `agent-config use --profile=<id>`.'),
-    }).default({ id: 'developer' }),
+    }).prefault({ id: 'developer' }),
     projection: z.object({
         mode: projectionMode.default('legacy-all').describe('Whether the per-tool projector writes EVERY artefact into the host-tool trees (.claude/ .cursor/ .windsurf/) or only the active profile + packs\' artefacts (ADR-040, docs/contracts/capability-packs.md). legacy-all = (default, non-breaking) project the full surface exactly as 5.x did. scoped = project only the active profile\'s packs unioned with the runtime.active_packs overlay, expanded over the requires graph — opt in with `agent-config use --profile=<id>`. A failed scoped projection restores the full tree.'),
         rule_packs: z.union([z.literal('auto'), z.array(z.string())]).default([]).describe('Scoping axis for the RULE layer beyond the derived workspace set, per pack ids (src/config/discovery/packs.yml). When set, a non-kernel rule also needs a packs frontmatter intersection to ship — e.g. deselecting frontend-design drops ui-audit-gate + design-fidelity. Opt-in, and an empty list is inactive; the workspace axis beside it is derived rather than configured (ADR-293 step 4.6). The literal "auto" derives the id list from the active-pack set (the same set the skill/command prune uses), so a domain safety floor stops shipping into installs that do not have the pack it guards; an explicit list stays supported and wins over the derivation.'),
-    }).default({ mode: 'legacy-all' }),
+    }).prefault({ mode: 'legacy-all' }),
     rule_loading_tier: ruleLoadingTier.default('balanced').describe('Master switch for which rule tiers load and how cautiously the agent spends tokens. minimal = only the 9 kernel rules (cheapest, fewest guardrails). balanced = kernel + tier-1 (recommended default). full = kernel + tier-1 + tier-2 (most guardrails, highest token cost). custom = roll your own in agents/overrides/. LEGACY: superseded by discipline_profile — when that key is set it wins (mapping: minimal→off, balanced→essential, full→full).'),
     discipline_profile: disciplineProfile.optional().describe('The ONE runtime knob for the discipline-rule tier (successor of rule_loading_tier; council 2026-07-07). off = kernel only (~1x tokens). essential = kernel + the measured lift-carrying rules (~3.3x, keeps the weak-host discipline lift). full = everything (~11.7x, EXPERIMENTAL — residual lift over essential not established). auto = resolve per session against the evidence-gated NULL-lift disable-list in src/config/host-capabilities.yml (measured-null host → off, otherwise → essential). Optional and opt-in until the P1/P2 evidence gates pass (agents/roadmaps/road-to-discipline-profile-tiering.md); absent = legacy rule_loading_tier applies.'),
     cost: z.object({
@@ -51,13 +51,13 @@ export const settingsSchema = z.object({
                 cheap: z.number().min(0).nullable().default(null).describe('USD ceiling for the cheap model tier. Budget-aware delegation was ARCHIVED 2026-08-16 (docs/contracts/budget-routing.md), so no code routes on this today; the cap is still summed and reported by `budget.mjs tier`. null = no separate tier cap; global ceilings still apply.'),
                 medium: z.number().min(0).nullable().default(null).describe('USD ceiling for the medium model tier. null = no separate tier cap.'),
                 strong: z.number().min(0).nullable().default(null).describe('USD ceiling for the strong model tier. null = no separate tier cap. The never-block-to-save-money relation this used to describe went with the archived budget-routing layer (docs/contracts/budget-routing.md); nothing routes between tiers today.'),
-            }).default({ cheap: null, medium: null, strong: null }),
+            }).prefault({ cheap: null, medium: null, strong: null }),
         }),
         enforcement: enforcementMode.default('advisory').describe('What happens when a budget hits 100%. advisory = show a banner, keep working (default — never blocks an active task). hard-stop = refuse further model calls until the budget resets or you raise the ceiling.'),
     }),
     model: z.object({
         auto_switch: modelAutoSwitch.default('suggest').describe('Per-skill model auto-switch (ADR-035). Skills declare a vendor-neutral model_tier (lite/medium/high); the generator maps it to a native Claude model (high→opus, medium→sonnet, lite→haiku). suggest (default) = never emit a native Claude model: key; the model-recommendation rule names the tier as a one-question suggestion on every surface — your explicit /model choice is never silently overridden. auto = render a native Claude model: into lite/medium/high-tier skills so Claude Code switches automatically for that turn (reverts next prompt), and suggest on surfaces without a native override. off = inert, no native key and no suggestion.'),
-    }).default({ auto_switch: 'suggest' }),
+    }).prefault({ auto_switch: 'suggest' }),
     personal: z.object({
         ide: z.string().default('').describe('CLI binary your IDE registers (code, code-insiders, phpstorm, cursor, windsurf, idea, subl, …). Used by the file-editor skill to open edited files. Leave empty to disable IDE integration.'),
         open_edited_files: z.boolean().default(false).describe('After the agent edits a file, run `<ide> <path>` to surface it in your editor immediately. Off by default to avoid window-stealing during long agent runs.'),
@@ -76,7 +76,7 @@ export const settingsSchema = z.object({
         commit_format: gitCommitFormat.default('ticket-scope').describe('Where a ticket id goes in a commit subject. ticket-scope (default) = the ticket is the Conventional-Commits scope, `feat(DEV-1234): add export filter` — the behaviour every install had before this key existed. ticket-conventional = the ticket leads the subject and the scope names the system area, `DEV-1234 feat(exporter): add export filter`; a ticket is then never a scope. Without a ticket both shapes are plain Conventional Commits. A commit-linting config in the repository (commitlint, a commit-msg hook) outranks this key.'),
         branch_pattern: z.string().default('{type}/{slug}').describe('Shape of a branch name the agent creates. Placeholders: {type} (feat, fix, …), {ticket} (e.g. DEV-1234), {slug} (short kebab-case description). Default {type}/{slug}. {slug} is required, and characters outside the placeholders are limited to A-Z a-z 0-9 . _ / - so a rendered name is safe in a command; agent-config git:convention show reports anything else as invalid. A team that names branches after the ticket sets {ticket}-{slug}. A placeholder with no value is dropped together with the separator that follows it, or the one before it when it is last, so no name starts or ends with a separator ({type}/{ticket}-{slug} without a ticket gives feat/slug). Reading a ticket back out of an existing branch never depends on this pattern.'),
         update_strategy: gitUpdateStrategy.default('merge').describe('How a feature branch is brought up to date with its base. merge (default) = merge the base into the branch, as before this key existed. rebase = rebase the branch onto origin/<base> and publish with --force-with-lease, never a merge of the base into the branch. Rebase rewrites history, so the agent still asks for it unless the git-history-discipline rule already authorises the rewrite (the user asked this turn, an unrevoked standing instruction, or a pull --rebase the user started); this key decides which operation is proposed, never whether one is authorised.'),
-    }).default({}),
+    }).prefault({}),
     github: z.object({
         pr_reply_method: replyMethod.default('create_review_comment').describe('How the agent replies to PR review comments. create_review_comment = post a new review comment (works on every GitHub plan). replies_endpoint = thread the reply under the original comment (needs the newer REST endpoint). auto = detect at runtime, prefer threaded replies when available.'),
     }),
@@ -106,8 +106,8 @@ export const settingsSchema = z.object({
         request_size_caps: z.object({
             bash_max_output_length: z.number().int().positive().max(150_000).nullable().default(null).describe('Character cap on Bash tool output the host places inline into a model request. null (default) = this package writes nothing and the host default of 30000 applies. A number is written into the host env block. Values above 150000 are capped by the host itself, so the schema refuses them here rather than writing a value the host silently changes. Bounds request SIZE, never request COUNT: lowering it suppresses no telemetry, no update check and no download.'),
             max_mcp_output_tokens: z.number().int().positive().nullable().default(null).describe('Token cap on a single MCP tool result the host places into a model request. null (default) = nothing written, host default 25000 applies. Same size-not-count caveat: it does not govern MCP connections, timeouts, or whether a tool runs.'),
-        }).default({}).describe('Request-size caps this package may write into the host env block. Both null by default. No traffic or auto-updater variable is expressible here, by construction — see the block comment.'),
-    }).default({}).describe('What this package may write into the host environment. ABSENT resolves to the all-null shape, which is the same thing as off — a settings file predating this section must not fail to parse, and "no section" and "both caps null" both mean write nothing.'),
+        }).prefault({}).describe('Request-size caps this package may write into the host env block. Both null by default. No traffic or auto-updater variable is expressible here, by construction — see the block comment.'),
+    }).prefault({}).describe('What this package may write into the host environment. ABSENT resolves to the all-null shape, which is the same thing as off — a settings file predating this section must not fail to parse, and "no section" and "both caps null" both mean write nothing.'),
     augment: z.object({
         rules_use_symlinks: z.boolean().default(false).describe('When true, .augment/rules/*.md are symlinks into dist/agent-src/rules/ — edits flow back to source on save. When false (default), they are copies — safer on Windows and shared volumes, but rule edits in .augment/ are lost on the next `task sync`.'),
     }),
@@ -138,24 +138,24 @@ export const settingsSchema = z.object({
             // outcome than an uninformative table cell.
             max_cost_per_run_usd: z.number().min(0).nullable().default(null).describe('Per-run USD ceiling for a CLASS-1 roadmap blocker executed via `agent-config gates --execute`. A class-1 entry whose **Budget:** field states a larger figure renders its consent line instead of running. null (default) = no per-run ceiling, per ADR-279: a spend bound applies only where one was set, and the absence of a bound is not a refusal. Bounds the size of an authorised spend; never supplies the authorisation — `--confirm` is still required on every class-1 run, set or unset.'),
             max_cost_per_rolling_7d_usd: z.number().min(0).nullable().default(null).describe('Rolling 7-day USD ceiling for class-1 gate execution, summed from the append-only receipt ledger at agents/runtime/state/gate-budget-ledger.jsonl. A run whose estimate would cross it renders instead of running. null (default) = no rolling ceiling, per ADR-279. A per-run cap alone bounds one mistake, not a week of them, which is why option (a) of b-gate-budget-preauth carries two numbers — but each cap now bounds on its own, so setting one and leaving the other null is supported.'),
-        }).default({ max_cost_per_run_usd: null, max_cost_per_rolling_7d_usd: null }),
+        }).prefault({ max_cost_per_run_usd: null, max_cost_per_rolling_7d_usd: null }),
     }),
     planning: z.object({
         closure_pass: z.boolean().default(true).describe('Gate C — plan-closure pass. true (default) = a plan-artifact ask (/roadmap:create, roadmap-writing, /feature:plan, /feature:roadmap, /roadmap:materialize, /implement-ticket, /jira-ticket, /analyze:inbox, /analyze:roadmap-repos) ends in a closure pass (/challenge-me closure): every foreseeable decision is closed at the lowest rung that owns it and written into the roadmap\'s "## Decisions" table, so a long run never meets a question planning could have closed. false = inert, plan asks author directly. An explicit user bypass always wins for that turn and is counted as a bypass rather than as an absent closure.'),
         risk_review: z.boolean().default(true).describe('Gate R1 — plan-risk review. true (default) = every ready (non-draft) plan must carry a schema-valid "## Risk Register" section (ranked risks, mitigation + anchor per row, freshness marker, exact honest-null grammar), enforced by lint_plan_risk_register at pre-push + CI. false = escape hatch, the validator skips.'),
         completion_review: z.boolean().default(true).describe('Gate R2 — completion review at 100% roadmap completion / pre-PR. true (default) = a findings-before-fixes review by a fresh reviewer context must exist for the current diff hash (or an exact honest-null / skip declaration) before fix commits and PR creation, enforced by check_completion_review at pre-push + CI (CI authoritative; a crashed validator warns and allows). false = escape hatch, the validator skips.'),
     })
-        // `.default({})` is load-bearing, not cosmetic: without it the SECTION is
+        // `.prefault({})` is load-bearing, not cosmetic: without it the SECTION is
         // required, so any settings payload that omits `planning` fails with
         // `ZodError: planning Required` — which contradicts this gate family's own
         // contract ("missing key = true" for all three) and reds every server
         // test whose fixture predates the section. With the default, an absent
         // section materialises as the three `true` leaves the contract promises.
-        .default({}),
+        .prefault({}),
     execution: z.object({
         fix_loop_max: z.number().int().min(1).default(10).describe('Consecutive failed fix attempts against one validation target before the escalation ladder reaches its terminal rung. Reaching the bound triggers a strategy change, never a question. Overridable globally, per project and per prompt.'),
         escalation: z.array(z.string()).default(['independent', 'council', 'team', 'owner_owned_check']).describe('The escalation rungs, in order, walked when the fix-loop bound is reached: independent (another session or a provider-diverse reviewer), council, team, then owner_owned_check — which asks whether the residue is owner-owned, not whether to ask the owner now.'),
-    }).default({}),
+    }).prefault({}),
     quality: z.object({
         local_auto_run: z.boolean().default(false).describe('Run quality tools (linters, type-checks, formatters) and the local test suite autonomously after edits, IN CHAT. Off by default — in a chat turn a human is present and remote CI is the authoritative gate, so a local full-pipeline run duplicates it at wall-clock cost. The agent only runs a quality tool on an explicit ask, a concrete CI failure, or the new-gate carve-out. A mission is governed by local_auto_run_in_mission instead.'),
         local_auto_run_in_mission: z.boolean().default(true).describe('Run quality tools autonomously inside a mission — an autonomous roadmap run with a claimed contract. On by default: nobody is waiting, the next action belongs to the agent itself, and a red found twenty steps later costs more than the run that would have caught it at step one. Inert outside a mission, and a mission never lowers local_auto_run: true.'),
@@ -170,37 +170,37 @@ export const settingsSchema = z.object({
                 color: z.number().nullable().default(null).describe('Colour distance below which a value may be reconciled, in OKLab ΔEOK. Ships null, and null means "preserve and report" rather than "reconcile freely". No number is set because none is supported: zero of seven design-to-code benchmarks in the evidence set score token conformance, and a number in a config file — even flagged unmeasured — shapes behavior and acquires the authority of a default. Not an RGB channel delta: RGB distance is not perceptually uniform.'),
                 length: z.number().nullable().default(null).describe('Length distance below which a value may be reconciled, in absolute CSS pixels. Ships null, same reasoning as color. GitHub Primer\'s ±1px spacing widening is recorded as an externally observed candidate in src/scripts/_lib/design_tolerance.ts and is deliberately not the shipped value; max(1px, 2%) was rejected for growing more permissive at large dimensions with no evidence that this is wanted.'),
             })
-                .default({ color: null, length: null }),
+                .prefault({ color: null, length: null }),
         })
-            .default({ enabled: false, tolerance: { color: null, length: null } }),
-    }).default({
+            .prefault({ enabled: false, tolerance: { color: null, length: null } }),
+    }).prefault({
         fidelity_mode: 'strict',
         approximation: { enabled: false, tolerance: { color: null, length: null } },
     }),
     code_graph: z.object({
         consumer_index_paths: z.array(z.string()).default([]).describe("Extra project-relative paths where THIS project keeps a code-graph index another tool wrote. The built-in list is deliberately vendor-neutral (graph.json, code-graph.json, .code-graph/graph.json) and names no tool, so a tool that writes its index elsewhere is named here rather than waited for. A graph found this way LOADS and answers query and explain with every edge tagged read-from-elsewhere; the gate verbs (impact, untested, dead) refuse a graph made only of such edges and say so, because an empty answer from a gate must not read as 'nothing found' when it means 'nothing trusted'. Absolute paths and paths escaping the project root are ignored."),
-    }).default({}),
+    }).prefault({}),
     screenshots: z.object({
         identity_allowlist: z.array(z.string()).default([]).describe("Consumed by the doc-screenshot-hygiene rule and screenshot-hygiene skill. Public identity tokens SAFE to show unredacted in a documentation screenshot — the maintainer's own public handles plus well-known fake-data tokens. Not a general fake-data dictionary and not identity-resolution: everything not listed is treated as sensitive by default, and a public handle co-located with a real name does not whitelist the real name. Default [] = nothing auto-allowed."),
         forbid_terminal_capture: z.boolean().default(true).describe('Consumed by the doc-screenshot-hygiene rule. true (default) = terminal/CLI/IDE screenshots are forbidden (highest leak vector: absolute local paths, env tokens); use text code blocks with text redaction instead. false = allowed, still subject to the data-bearing human gate.'),
         data_bearing_gate: z.enum(['on', 'off']).default('on').describe('Consumed by the doc-screenshot-hygiene rule. on (default) = a data-bearing screenshot embed is gated behind this-turn human confirmation; uncertain/unresolved regions redact-or-refuse, never ship-and-hope; illustrative/no-data screenshots may embed with a stated justification. off = no data-bearing gate (the anonymization taxonomy still applies).'),
-    }).default({ identity_allowlist: [], forbid_terminal_capture: true, data_bearing_gate: 'on' }),
+    }).prefault({ identity_allowlist: [], forbid_terminal_capture: true, data_bearing_gate: 'on' }),
     verbosity: z.object({
         offer_council_in_delivery: z.boolean().default(false).describe('Offer "run AI Council on this?" inside delivery commands (/feature-plan, /review-changes, /roadmap-create). Council commands themselves are unaffected.'),
-    }).default({ offer_council_in_delivery: false }),
+    }).prefault({ offer_council_in_delivery: false }),
     code_style: z.object({
         docblocks: z.enum(['minimal', 'full']).default('minimal').describe('Consumed by the code-comment-discipline rule. minimal (default) = no signature-mirroring docblocks; docblocks only for machine-relevant precision (generics, array shapes) or genuine why-context. full = the exported public surface of a library package may carry one-line summary docblocks; the redundancy ban still holds.'),
-    }).default({ docblocks: 'minimal' }),
+    }).prefault({ docblocks: 'minimal' }),
     reasoning: z.object({
         enabled: z.boolean().default(true).describe('Master switch for the Reasoning Discipline Protocol (RDP). false = the whole layer is inert (zero overhead).'),
-    }).default({}),
+    }).prefault({}),
     subagents: z.object({
         quota_arbitrage: z.boolean().default(true).describe('Prefer a separate quota-pool model for delegable sub-tasks where the host manifest reports one. Optional bonus only — identical behaviour (minus the quota win) where unsupported. Never load-bearing.'),
         model_map: z.object({
             lite: z.string().default('').describe('Model alias for lite-tier sub-tasks. Empty = the tier runtime default.'),
             medium: z.string().default('').describe('Model alias for medium-tier sub-tasks. Empty = the tier runtime default.'),
             high: z.string().default('').describe('Model alias for high-tier sub-tasks. Empty = the tier runtime default.'),
-        }).default({}).describe('Per-tier model map for downshift routing. Each empty value uses the tier runtime default (no vendor model baked in).'),
+        }).prefault({}).describe('Per-tier model map for downshift routing. Each empty value uses the tier runtime default (no vendor model baked in).'),
         implementer_model: z.string().default('').describe('Override the model the orchestrator dispatches to subagents that write code (e.g. claude-sonnet-4, gpt-5). Empty (default) = inherit the session\'s primary model — cheapest and usually right.'),
         judge_model: z.string().default('').describe('Override the model used for review / judge subagents that critique implementer output. Empty (default) = one tier above the implementer model — picks up nuance the implementer missed.'),
         model_ceiling: z.string().default('').describe('Session-wide model CEILING for subagents (spend cap). Empty (default) = no ceiling. When set, suite-owned CLI spawn wrappers export CLAUDE_CODE_SUBAGENT_MODEL to the sessions they launch. Class C: a human sets it; the agent never writes or infers one.'),
@@ -213,7 +213,7 @@ export const settingsSchema = z.object({
     // `worktrees.cleanup` governs REMOVAL, a separate question (ADR-295).
     worktrees: z.object({
         cleanup: z.enum(['off', 'notify', 'auto']).default('notify').describe('What the agent may do about a worktree whose work is provably on the trunk (merged by merge commit, rebase or squash), that is clean, holds no ignored file a rebuild would not restore, and has no live session. notify (default, and what an absent key resolves to) says once a day how many exist and removes nothing; auto removes them right after /pr:merge and once a day on the first session start, without force, keeping local branches; off says nothing. The daily pass reads merged pull requests through your gh login (branch name and head commit only).'),
-    }).default({ cleanup: 'notify' }),
+    }).prefault({ cleanup: 'notify' }),
     ai_team: z.object({
         model: z.string().default('auto').describe("Model handed to the codex CLI. 'auto' (default) = pass no --model flag so the CLI's own default applies — tracks the subscription's current strongest model instead of pinning a stale ID. Any other value passes through verbatim as `--model <value>`."),
         allow_delegate: z.boolean().default(false).describe('Second opt-in for the only wrapper that delegates write access (/team:delegate). false (default) = delegate refuses even when /team itself is available. Availability (codex CLI installed + authenticated) is necessary but not sufficient — this key must ALSO be true before delegation is reachable.'),
@@ -221,12 +221,12 @@ export const settingsSchema = z.object({
         review_gate: z.object({
             managed: z.boolean().default(false).describe("Managed governance of the codex plugin's Stop-hook Review Gate (road-to-team-mode Phase 4). false (default) = byte-identical pre-Phase-4 behavior: no counting, no circuit breaker. true = count consecutive BLOCK verdicts per session and trip the circuit breaker at max_consecutive_blocks."),
             max_consecutive_blocks: z.number().int().min(1).default(3).describe('Circuit-breaker bound: after this many CONSECUTIVE BLOCK verdicts in one session, a visible notice is injected exactly once and the managed layer stops re-blocking — the user decides, never an infinite Claude↔Codex loop. An ALLOW verdict resets the counter. Positive integer.'),
-        }).default({ managed: false, max_consecutive_blocks: 3 }),
-    }).default({ model: 'auto', allow_delegate: false, max_calls_per_day: 50, review_gate: { managed: false, max_consecutive_blocks: 3 } }),
+        }).prefault({ managed: false, max_consecutive_blocks: 3 }),
+    }).prefault({ model: 'auto', allow_delegate: false, max_calls_per_day: 50, review_gate: { managed: false, max_consecutive_blocks: 3 } }),
     emergency: z.object({
         orchestration_halt: z.boolean().default(false).describe('The one audited incident switch over the always-on orchestration stack (subagents, council, team). NOT an activation gate: false (default) = the stack runs normally. true = halted; arming requires no ceremony. Disarming (returning to false) requires orchestration_halt_justification to be a non-empty string. Both transitions emit one telemetry line.'),
         orchestration_halt_justification: z.string().default('').describe('Required non-empty before orchestration_halt may return to false. Ignored while arming the halt.'),
-    }).default({ orchestration_halt: false, orchestration_halt_justification: '' }),
+    }).prefault({ orchestration_halt: false, orchestration_halt_justification: '' }),
     onboarding: z.object({
         onboarded: z.boolean().default(false).describe('Set to true once the developer has completed `agent-config setup`. The onboarding-gate rule blocks the first turn of every chat until this is true. Toggle back to false to re-trigger the wizard.'),
     }),
@@ -246,7 +246,7 @@ export const settingsSchema = z.object({
     }),
     retro: z.object({
         enabled: z.boolean().default(true).describe('Automatic retro after merged work (ADR-292, docs/contracts/retro-v1.md). true (default, owner directive 2026-10-12) = a merged PR and the first session of a new local day enqueue finished work; a deterministic triage picks what is worth one learning, and nothing behavior-changing is applied without a person. The one network read is the daily probe asking GitHub, through your own gh login, whether a pushed PR merged (repository and PR number only, three-second budget). false = no automatic path runs — no merge enqueue, no forge-merge marker, no daily probe and no network read; an explicit /retro still runs on request. Class C: an agent cannot set it; it cascades from the user-global file.'),
-    }).default({}),
+    }).prefault({}),
     memory: z.object({
         redact_patterns: z.array(z.string()).default([]).describe('Regex patterns (one per line) that scrub matches from chat-history transcripts and memory before they hit disk. Use for secrets, customer names, internal URLs. Patterns are anchored and case-insensitive.'),
         session_index: z.enum(['on', 'off']).default('off').describe('Opt-in compact memory index at session start (road-to-memory-retrieval-economy P5). on = inject a compact id + title + ~tokens index of curated entries (hard cap 30 rows, bodies never included) through the hot-context hook; the agent fetches full entries via memory_get on demand. off (default) = no injection — the ship-criterion (measured hit-rate gain) is unproven, so off unless proven.'),
@@ -256,44 +256,44 @@ export const settingsSchema = z.object({
         global_sharing: z.object({
             enabled: z.boolean().default(true).describe('Master switch for the file-first global knowledge-card store (ADR-100; default-ON per ADR-119, the validated bounded-downside flip superseding ADR-103 — write-time redaction incl. hidden-unicode hardening, narrowest tier default, pre-registered demotion trigger). User-global setting — keep in ~/.event4u/agent-config/agent-settings.yml. false fully no-ops the layer (single-key revert); project-local cards (v1) are unaffected.'),
             allowed_tiers: z.array(z.string()).default(['public']).describe('Origin tiers auto-eligible to cross a project boundary. proprietary is manual-only regardless (the gate hard-codes it), so an in-house schema never auto-shares.'),
-        }).default({}),
-    }).default({}),
+        }).prefault({}),
+    }).prefault({}),
     egress: z.object({
         placeholders: z.object({
             mode: z.enum(['off', 'observe', 'protect', 'strict']).default('off').describe('Dispatcher egress stage (docs/contracts/egress-placeholders-v1.md). off (default) = nothing. observe = detect and count listed values in prompts and tool bodies, types and counts only, and change nothing a hook concern sees. protect = also give every recording and advisory concern a copy with each value replaced by a placeholder token, so local stores keep tokens; guards still see the original. strict = as protect until the host rewrite exists. No mode yet changes what reaches the model; the rule table holds credential rows and the validated identifier rows. Project layers only.'),
-        }).default({}),
-    }).default({}),
+        }).prefault({}),
+    }).prefault({}),
     hooks: z.object({
         concern_budget: z.object({
             tier1_concerns: z.array(z.string()).default([]).describe('Concern IDs (one per line) that are allowed to block the run on failure rather than warn. Reserved for high-confidence guards — leave empty unless you maintain custom hooks.'),
         }),
         verify_before_complete: z.object({
             touched_file_quality: z.enum(['off', 'shadow', 'warn']).default('off').describe("Stop-slot pass that runs the project's OWN quality commands — the ones resolve_toolchain() already reports — over the files this turn edited. Default off. `shadow` records a per-run result and emits nothing; `warn` adds ONE advisory line of at most 200 bytes. Never blocks and never counts as verification: a command recorded here never reaches _lib/verification_command.ts, so a clean eslint run cannot let a turn claim it verified anything. A writing command runs only in its check form (pint --test) or not at all, and a command with no per-file form is skipped rather than run project-wide at every stop."),
-        }).default({}),
+        }).prefault({}),
         injection_scan: z.object({
             enabled: z.boolean().default(false).describe('PostToolUse prompt-injection scanner (road-to-security-pillar.md P3.2). Default off. When on, scans tool output (file reads, web fetches, MCP responses) for injection signatures and WARNS in context (never blocks). Runtime backstop on top of the always-on untrusted-input-defense rule; detection is probabilistic.'),
-        }).default({}),
+        }).prefault({}),
         runtime_journal: z.object({
             enabled: z.boolean().default(false).describe('Runtime event journal (road-to-runtime-event-journal Phase 1). Default off. When on, one durable, episode-keyed record per dispatched hook event is appended to <git-common-dir>/agent-journal/journal.sqlite — a Class-A write that opens, writes and exits. It emits nothing to the model, never warns and never blocks: a locked database, a missing node:sqlite, a malformed envelope or a full disk all degrade to silence. Off rather than on because it CREATES a storage surface (a SQLite database under your .git/) rather than appending to a directory that already exists. The record type has no field able to hold free-form content — ids, an event name, a bounded capability identifier, repo-relative locators and two 12-hex digests; no prompt, no file body, no absolute path. Retention: a 30-day TTL anchored on episode close, plus explicit, time-bounded, human-only holds that themselves expire.'),
-        }).default({}),
+        }).prefault({}),
         rtk_wrap: z.object({
             enabled: z.boolean().default(false).describe('PreToolUse RTK-wrap nudge (token-saving Phase 3). Default off. When on AND the binary on PATH is verified as Rust Token Killer (a live two-stage identity probe — not a self-reported flag, and never a colliding same-name binary), warns (never blocks) "re-run wrapped with rtk" before a single verbose CLI command (git/npm/cargo/docker/…) — upstream reports 60–90% output-token savings (their estimate). Skips completeness-critical / piped / compound commands and git diff. No-op when rtk is absent, unverified, or a different tool. Its own activation charge is one advisory line under the 1,024 B default concern cap in src/config/hook-token-budget.json; the per-fire distribution is UNMEASURED — stated rather than estimated, because the saving above is a third-party output-token claim and not a standing-payload reduction this package measured.'),
-        }).default({}),
+        }).prefault({}),
         design_slop: z.object({
             enabled: z.boolean().default(false).describe('PreToolUse anti-slop nudge (road-to-anti-slop-detector Phase 3). Default off. When on, runs the lint_design_slop registry against about-to-be-written UI content and WARNS (never blocks) on P0/P1 aesthetic tells (side-stripe, gradient-text, magic z-index, …). Flags are rebuttable via DESIGN.md / design-slop-disable. Anti-loop: a file::rule signature surfaced 3x goes silent. Host-limited convenience layer; the universal gate is the lint_design_slop linter/CI.'),
-        }).default({}),
+        }).prefault({}),
         design_pass: z.object({
             enabled: z.boolean().default(false).describe('PostToolUse + stop design pass (road-to-frontend-power E1.1/E1.2/E1.3). Default off. One concern on two slots: on post_tool_use a write to a UI surface delivers the design findings as context and never blocks; on stop the same pass runs over every UI file touched this session, deduped against what the post pass surfaced, and a P0 objective floor (contrast, font size, heading skip, focus) blocks with a continuation. P1-P3 never block. post_tool_use rather than pre_tool_use for two measured reasons: pre_tool_use is declared by three hosts and honoured by one while post_tool_use is declared by six, and _lib/ui_surface.ts is a path predicate, so a pre-write gate cannot fire on the first write of a new surface. A pass that could not fully run reports verification: degraded with a reason rather than passing silently. Does not replace design_slop: two design keys is the honest state until the tiering experiment has a number.'),
-        }).default({}),
+        }).prefault({}),
         ui_route_nudge: z.object({
             enabled: z.boolean().default(false).describe('PreToolUse UI-route nudge (road-to-frontend-skill-application Phase 4). Default off. When on, a Write/Edit to a UI surface with no design consultation latched this session WARNS (never blocks) naming the route — run existing-ui-audit, then the fe-design loop. A read or search touching fe-design / existing-ui-audit / design-review / design-intelligence latches consultation and silences it for the session. Anti-loop: at most 2 nudges per session. It does not read the rules: the UI-surface decision comes from _lib/ui_surface.ts and no code parses rule frontmatter, so this runs parallel to the two UI rules rather than consuming their triggers, and a test keeps the sets from drifting. It is a nudge, so their enforced_by: none stays accurate.'),
-        }).default({}),
+        }).prefault({}),
         code_graph: z.object({
             enabled: z.boolean().default(false).describe('PreToolUse code-graph nudge (ADR-124 Phase 4). Default off. When on AND a native code-graph cache or a consumer-shipped graph.json/SCIP index is present, warns once per session (never blocks) as the agent is about to Grep/Glob or Read a source file — query the graph first for who-calls/where-used/impact questions (or rebuild if stale, build if absent). Source G’s strict block-first-read mode is deliberately un-ported.'),
-        }).default({}),
+        }).prefault({}),
         suggestion_capture: z.object({
             enabled: z.boolean().default(false).describe('Suggestion-block capture (road-to-suggestion-block-capture Phase 2). Default off. Two slots: `stop` reads `last_assistant_message` — a payload field, so no transcript file is read — and latches that the assistant turn carried a numbered-options block; `user_prompt_submit` CONSUMES that latch and classifies the answering turn as option_n / as_is / other / stale_block. Consume-once is the correctness guard: the latch is deleted on read, so a bare "1" three turns later meets no latch and classifies `other`, and a latch past its TTL or unparseable is `stale_block` rather than a guess. Writes COUNTS ONLY to agents/runtime/state/audit/suggestion-capture.jsonl — the record type has no field able to hold a prompt, an option label or a command name, and a test asserts the written key set against src/config/suggestion-capture.json. Off by default because this is an INSTRUMENT rather than a feature: it exists so a capture rate can be measured on a maintainer workspace over a fixed soak window, and there is nothing in it for a consumer to gain.'),
-        }).default({}),
+        }).prefault({}),
         // `turn_end_gate` is deliberately ABSENT. The stop-slot turn-end gate is
         // always armed (2026-08-12) and has no settings surface: whether it
         // fires is decided by each detector's own trigger conditions, not by a
@@ -315,13 +315,13 @@ export const settingsSchema = z.object({
         mode: z.enum(['off', 'notify']).default('notify').describe('Whether the first session start of a day prints the advisory findings that need action today. notify (default) reads the local cache only — a session start never touches the network; off prints nothing, and agent-config audit:deps show still works.'),
         egress: z.enum(['none', 'query']).default('query').describe('What leaves the machine when agent-config audit:deps refresh runs. query (default) sends names and versions of public packages to api.osv.dev and reads endoflife.date and the PHP and Node release feeds; a private package name is never sent, and a native npm or composer audit, which sends the lockfile package list to the registry that tool is configured for, runs only for a lockfile with no private package. none sends nothing, and findings read unknown rather than clear.'),
         kev: z.enum(['off', 'on']).default('on').describe('Whether a refresh reads the CISA known-exploited catalog. on (default) downloads the whole catalog and matches it locally, so nothing about the project is sent, and a finding in it is raised one tier in a runtime scope; off leaves tiers to the other sources. Runs only where egress is query.'),
-    }).default({ mode: 'notify', egress: 'query', kev: 'on' }),
+    }).prefault({ mode: 'notify', egress: 'query', kev: 'on' }),
     update: z.object({
         mode: z.enum(['off', 'notify', 'ask', 'auto']).default('notify').describe('What the agent may do about a newer release. notify tells you and installs nothing (the default, and what an absent key resolves to); ask behaves as notify until the ring-0 exit ships a prompt; auto installs a staged release at a session start when every gate passes and no other session is live; off says nothing at all. Read from the user-global layer only — a repository cannot set how your global install updates itself.'),
-    }).default({ mode: 'notify' }),
+    }).prefault({ mode: 'notify' }),
     legal_review_prep: z.object({
         acknowledged: z.boolean().default(false).describe('I understand the legal-review-prep pack provides templates and general information ONLY — it is NOT legal advice, creates no attorney-client relationship, and never replaces a licensed lawyer. Individual cases require an attorney. The pack stays inactive until this is checked.'),
         require_council: z.boolean().default(true).describe('Gate legal work-product behind a multi-model AI-council / deep-research pass (defense-in-depth: documented multi-stage review + audit trail; fail-closed when no council is configured). Leave on for the safest posture. Turning it off lets single-model legal output through — not recommended for a high-risk pack.'),
-    }).default({ acknowledged: false, require_council: true }),
+    }).prefault({ acknowledged: false, require_council: true }),
 });
 //# sourceMappingURL=settings.js.map

package/dist/shared/settingsSurface.js

@@ -23,7 +23,7 @@ function unwrapRef(root) {
     return root;
 }
 /**
- * Flatten a `zodToJsonSchema` output into dotted leaf entries. Objects with
+ * Flatten a `toJsonSchema7` output into dotted leaf entries. Objects with
  * `properties` recurse; everything else (scalars, enums, arrays, free-form
  * maps) is a leaf. Deterministic key order (sorted) so snapshots diff
  * cleanly in git and across runs.

package/dist/shared/userMd/schema.js

@@ -10,7 +10,7 @@
  * wizard finish) and the Vite-bundled UI (form validation) consume
  * the same Zod schema. ESLint forbids Node-only imports in this tree.
  */
-import { z } from 'zod';
+import * as z from 'zod';
 /** Hard cap on the optional `notes` block. Keeps the file loadable into every reply. */
 export const USER_IDENTITY_NOTES_MAX_CHARS = 8_000;
 /** Hard cap on the `voice_sample` block — one to three sentences in practice. */

package/dist/shared/zodJsonSchema.js

@@ -0,0 +1,47 @@
+/**
+ * A Zod schema as a draft-07 JSON Schema, in the envelope the settings surface,
+ * the generated settings reference and the UI form renderer read:
+ * `{ $ref: '#/definitions/<name>', definitions: { <name>: … }, $schema }`.
+ *
+ * Zod 4 converts natively (`z.toJSONSchema`); this replaces `zod-to-json-schema`,
+ * which only understands Zod 3. `io: 'input'` keeps a defaulted field optional,
+ * as the old converter did, because a settings file may omit it.
+ */
+import * as z from 'zod';
+/**
+ * The places the native output differs from what consumers were built on: an
+ * object without `additionalProperties` (the old converter closed every
+ * object), an `enum` without a `type` (it named the primitive type), and an
+ * integer carrying the safe-integer bounds Zod 4 adds to `.int()`, which says
+ * nothing a reader of a settings schema can use.
+ */
+function normalise(node) {
+    if (Array.isArray(node)) {
+        for (const n of node)
+            normalise(n);
+        return;
+    }
+    if (typeof node !== 'object' || node === null)
+        return;
+    const o = node;
+    if (o['properties'] !== undefined && o['additionalProperties'] === undefined)
+        o['additionalProperties'] = false;
+    if (Array.isArray(o['enum']) && o['type'] === undefined) {
+        const kinds = new Set(o['enum'].map((v) => typeof v));
+        if (kinds.size === 1 && (kinds.has('string') || kinds.has('number') || kinds.has('boolean')))
+            o['type'] = [...kinds][0];
+    }
+    if (o['maximum'] === Number.MAX_SAFE_INTEGER)
+        delete o['maximum'];
+    if (o['minimum'] === Number.MIN_SAFE_INTEGER)
+        delete o['minimum'];
+    for (const v of Object.values(o))
+        normalise(v);
+}
+export function toJsonSchema7(schema, name) {
+    const body = z.toJSONSchema(schema, { target: 'draft-7', io: 'input', unrepresentable: 'any' });
+    normalise(body);
+    const { $schema: _drop, ...definition } = body;
+    return { $ref: `#/definitions/${name}`, definitions: { [name]: definition }, $schema: 'http://json-schema.org/draft-07/schema#' };
+}
+//# sourceMappingURL=zodJsonSchema.js.map