@event4u/agent-config 17.3.0 → 17.4.0

package/dist/cli-delegate/{chunk-MT2WOOCY.js → chunk-WY5ZZPGL.js}

@@ -12,7 +12,7 @@ import {
   EGRESS_RULES,
   evaluateMatch,
   shannonEntropy
-} from "./chunk-DHSSP7V3.js";
+} from "./chunk-5AYJGUA3.js";
 import {
   SRC_SKILLS
 } from "./chunk-YCU3TIXH.js";
@@ -35,7 +35,7 @@ import {
 import {
   TOKEN_RE,
   classifyToken
-} from "./chunk-BMGUGSY6.js";
+} from "./chunk-TQG6UMPC.js";
 import {
   readHookStdin
 } from "./chunk-RAXQOETZ.js";

package/dist/cli-delegate/{chunk-ORJPBER2.js → chunk-X6LZ7W5A.js}

@@ -21,7 +21,8 @@ import {
 } from "./chunk-FTAISGDQ.js";
 import {
   STATE_FILENAME,
-  classify_install_origin
+  classify_install_origin,
+  compare_versions
 } from "./chunk-5VO3RTMV.js";
 import {
   DEFAULT_GITATTRIBUTES,
@@ -63,11 +64,12 @@ import {
   scanTranscripts,
   validateAssumption,
   weightedInputUnits
-} from "./chunk-FKYZOWVD.js";
+} from "./chunk-QBAFP67O.js";
 import {
   git_common_dir
 } from "./chunk-IAYTIIQW.js";
 import {
+  lockfile_path,
   read_lockfile
 } from "./chunk-LQOCRFWT.js";
 import {
@@ -89,19 +91,17 @@ import {
   readCanaryStatusLine,
   runCensus,
   summaryLine
-} from "./chunk-MT2WOOCY.js";
+} from "./chunk-WY5ZZPGL.js";
 import {
   EGRESS_RULES,
   REVIEW_CREDENTIAL_ROWS,
   detect,
-  findSpans,
   maskingEnd,
   prefixesOf,
   rawKeyPrefixPattern,
   replaceSpans,
-  resolveOverlaps,
   vendorPrefix
-} from "./chunk-DHSSP7V3.js";
+} from "./chunk-5AYJGUA3.js";
 import {
   classifyFileState,
   classifyOwnership,
@@ -5795,7 +5795,11 @@ function readInstalledVersion(projectRoot) {
     return null;
   }
 }
-function checkVersionAxis(projectRoot, resolvableNow) {
+function readGlobalVersion() {
+  const recorded = read_lockfile(lockfile_path())?.["agent_config_version"];
+  return typeof recorded === "string" && recorded.trim() !== "" ? recorded.trim().replace(/^v+/, "") : null;
+}
+function checkVersionAxis(projectRoot, resolvableNow, globalVersion = readGlobalVersion()) {
   const id = "version-axis";
   const pins = readVersionPins(projectRoot);
   const installed = readInstalledVersion(projectRoot);
@@ -5803,7 +5807,16 @@ function checkVersionAxis(projectRoot, resolvableNow) {
     return { id, status: "skipped", message: "no version pin and no install lockfile in this tree", remedy: "" };
   }
   const pinText = pins.length === 0 ? "pinned: none" : `pinned: ${pins.map((p) => `${p.version} (${p.file}${p.legacy ? ", LEGACY filename" : ""})`).join(" \xB7 ")}`;
-  const line = `${pinText} \xB7 installed: ${installed ?? "unknown"} \xB7 resolvable now: ${resolvableNow ?? "unknown"}`;
+  const line = `${pinText} \xB7 installed: ${installed ?? "unknown"} \xB7 global: ${globalVersion ?? "none"} \xB7 resolvable now: ${resolvableNow ?? "unknown"}`;
+  const ahead = pins.filter((p) => globalVersion !== null && compare_versions(p.version, globalVersion) === 1);
+  if (ahead.length > 0) {
+    return {
+      id,
+      status: "warn",
+      message: `${line} \u2014 the pin names ${ahead.map((p) => p.version).join(", ")} but the global install, which every session's hooks, rules and skills run from, is ${globalVersion}.`,
+      remedy: "run `agent-config update` (it installs the pinned version globally) or `agent-config upgrade`"
+    };
+  }
   const divergent = pins.filter((p) => installed !== null && p.version !== installed);
   if (divergent.length === 0) {
     return { id, status: "ok", message: line, remedy: "" };
@@ -6731,6 +6744,55 @@ function resumeBound(bound) {
   return [...bound.slice(0, i), "-c", `sandbox_mode="${bound[i + 1]}"`, ...bound.slice(i + 2)];
 }
 
+// src/scripts/_lib/egress_normalize.ts
+var FOREIGN = "43043543e4404414434454554564584bb50151b41041241541a41c41d41e4204214224234254054064083b13b53bf3bd3c13c53c73ba39139239539639739939a39c39d39f3a13a43a53a7";
+var LATIN = "aeopcyxsijhdqABEKMHOPCTYXSIJaeovpuxkABEZHIKMNOPTYX";
+var LATIN_TWIN = new Map([...LATIN].map((c, i) => [parseInt(FOREIGN.slice(i * 3, i * 3 + 3), 16), c]));
+var HIDDEN_UNICODE_RE = /[­​-‏‪-‮⁠-⁤⁦-⁩\u{E0000}-\u{E007F}]/gu;
+function normalizeForDetection(text) {
+  let out = "";
+  const origin = [];
+  let hidden = 0;
+  let folded = 0;
+  let at = 0;
+  for (const ch of text) {
+    HIDDEN_UNICODE_RE.lastIndex = 0;
+    if (HIDDEN_UNICODE_RE.test(ch)) {
+      hidden += 1;
+    } else {
+      const emit = LATIN_TWIN.get(ch.codePointAt(0)) ?? ch;
+      if (emit !== ch) folded += 1;
+      out += emit;
+      for (let k = 0; k < emit.length; k += 1) origin.push(at);
+    }
+    at += ch.length;
+  }
+  return { text: out, origin, hidden, folded };
+}
+function detectWithExtent(text, rules = EGRESS_RULES) {
+  const n = normalizeForDetection(text);
+  if (n.hidden === 0 && n.folded === 0) return { spans: detect(text, rules), end: (s, read) => read(text, s) };
+  const back = (i) => {
+    const o = n.origin[i - 1];
+    return o + (text.codePointAt(o) > 65535 ? 2 : 1);
+  };
+  const fwd = (o) => {
+    let i = 0;
+    while (i < n.origin.length && n.origin[i] < o) i += 1;
+    return i;
+  };
+  return {
+    spans: detect(n.text, rules).map((s) => ({ ...s, start: n.origin[s.start], end: back(s.end) })),
+    end: (s, read) => {
+      const e = read(n.text, { ...s, start: fwd(s.start), end: fwd(s.end) });
+      return e === null ? null : back(e);
+    }
+  };
+}
+function detectNormalized(text, rules = EGRESS_RULES) {
+  return detectWithExtent(text, rules).spans;
+}
+
 // src/scripts/_lib/egress_token.ts
 import { createHmac, randomBytes } from "node:crypto";
 var TOKEN_FP_LENGTH = 6;
@@ -6979,7 +7041,8 @@ var CouncilEgress = class {
    * proven is replaced through the nearest END marker, as the line masks did.
    */
   replace(text) {
-    const spans = resolveOverlaps(findSpans(text, BUNDLE_RULES)).filter((s) => s.class === "credential" || this.opts.identifiers).map((s) => ({ ...s, end: maskingEnd(text, s) }));
+    const at = detectWithExtent(text, BUNDLE_RULES);
+    const spans = at.spans.filter((s) => s.class === "credential" || this.opts.identifiers).map((s) => ({ ...s, end: at.end(s, maskingEnd) ?? s.end }));
     spans.sort((a, b) => a.start - b.start);
     const merged = [];
     for (const s of spans) {
@@ -7008,7 +7071,7 @@ var CouncilEgress = class {
     for (const value of this.replaced) {
       if (body.includes(value)) return { reason: "replaced-value-present", what: "value replaced in this run" };
     }
-    for (const s of detect(body)) {
+    for (const s of detectNormalized(body)) {
       const high = s.class === "credential" ? s.rule !== "generic-assignment" : s.validated && this.opts.identifiers;
       if (high) return { reason: "high-confidence-finding", what: s.rule };
     }