@event4u/agent-config 5.9.0 → 5.10.1

package/scripts/_cli/cmd_refresh.py

@@ -84,7 +84,7 @@ def _is_source_repo(project_root: Path) -> bool:
 def _refresh_project(project_root: Path, out, err) -> int:
     # Imported lazily: scripts.install is large and only needed for --project.
     from scripts import install as installer
-    from scripts._lib import installed_lock
+    from scripts._lib import cli_wrapper, installed_lock
 
     if _is_source_repo(project_root):
         print("ℹ️  refresh --project skipped: this is the agent-config package "
@@ -114,6 +114,12 @@ def _refresh_project(project_root: Path, out, err) -> int:
             encoding="utf-8")
     print(f"✅  overrides scaffold: {overrides}", file=out)
 
+    # Re-stamp the ``./agent-config`` wrapper from the canonical template so
+    # an older, fallback-less wrapper cannot linger and break the hooks.
+    wrapper = cli_wrapper.install_cli_wrapper(project_root)
+    if wrapper is not None:
+        print(f"✅  ./agent-config wrapper refreshed: {wrapper}", file=out)
+
     rc = _sync_gitignore(project_root, out, err)
     if rc != 0:
         return rc

package/scripts/_cli/cmd_upgrade.py

@@ -8,12 +8,16 @@ goal: it installs the latest published package globally and re-runs the
 global install so new skills / rules / hooks reach every consumer at
 once.
 
-Two side effects, in order:
+Side effects, in order:
 
 1. ``npm install -g @event4u/agent-config@latest`` — refresh the global
    binary on PATH (the binary the Claude plugin hook resolves).
 2. ``agent-config global`` (→ ``install.py --global``) — refresh the
    global root (``~/.event4u/agent-config/``) + regenerate plugin hooks.
+3. If run from inside a consumer project that already has a
+   ``./agent-config`` wrapper, re-stamp that wrapper from the canonical
+   template so an older, fallback-less copy cannot linger and break the
+   hooks. Skipped in the source repo and never creates a wrapper.
 
 The **Claude marketplace plugin** updates on Claude Code's own cadence,
 independent of npm; ``upgrade`` cannot drive it. ``agent-config doctor``
@@ -72,12 +76,36 @@ def _agent_config_bin() -> str:
         Path(__file__).resolve().parents[2] / "agent-config")
 
 
+def _maybe_refresh_project_wrapper(project_root: Path, out, err) -> None:
+    """Re-stamp the project-local ``./agent-config`` wrapper after a global
+    upgrade — but only when the upgrade was run from inside a consumer
+    project that *already* has a wrapper. Never creates one (that is an
+    install action, out of scope), never touches the source repo.
+
+    This closes the gap where ``upgrade`` refreshed the global binary while
+    an older, fallback-less project wrapper kept breaking the Claude hooks.
+    """
+    from scripts._lib import cli_wrapper
+    from scripts._cli.cmd_refresh import _is_source_repo
+
+    if _is_source_repo(project_root):
+        return
+    if not (project_root / "agent-config").is_file():
+        return  # not a consumer project root (or never installed) — leave it
+    if not cli_wrapper.needs_refresh(project_root):
+        return
+    wrapper = cli_wrapper.install_cli_wrapper(project_root)
+    if wrapper is not None:
+        print(f"✅  refreshed stale project wrapper: {wrapper}", file=out)
+
+
 def main(
     argv: Optional[list[str]] = None,
     *,
     runner: Runner = _default_runner,
     fetcher=update_check.fetch_latest_from_npm,
     installed: Optional[str] = None,
+    project_root: Optional[Path] = None,
     out=sys.stdout,
     err=sys.stderr,
 ) -> int:
@@ -128,6 +156,8 @@ def main(
                   f"{' '.join(cmd)}", file=err)
             return 1
 
+    _maybe_refresh_project_wrapper(project_root or Path.cwd(), out, err)
+
     print("✅  agent-config upgraded. Run `agent-config doctor` to verify "
           "PATH + plugin parity.", file=out)
     return 0

package/scripts/_dispatch.bash

@@ -782,6 +782,16 @@ cmd_council() {
   exec env PYTHONPATH="$PACKAGE_ROOT" python3 "$script" "$sub" "$@"
 }
 
+# `use --profile=<id>` — switch the active experience/profile. Writes
+# profile.id into the canonical .agent-settings.yml; the explicit
+# profile-switch seam named by ADR-040 (road-to-6.0.0-a Step 8).
+cmd_use() {
+  require_python3
+  local script
+  script="$(resolve_script "scripts/profile_use.py")" || return 1
+  exec env PYTHONPATH="$PACKAGE_ROOT" python3 "$script" "$@"
+}
+
 # `agent-config update` — flip the agent_config_version pin in
 # .agent-settings.yml. See scripts/_cli/cmd_update.py (P3.1 of
 # road-to-portable-runtime-and-update-check.md).
@@ -928,6 +938,7 @@ main() {
     mcp:check)               cmd_mcp_check "$@" ;;
     mcp:setup)               cmd_mcp_setup "$@" ;;
     mcp:run)                 cmd_mcp_run "$@" ;;
+    use)                     cmd_use "$@" ;;
     roadmap:progress)        cmd_roadmap_progress "$@" ;;
     roadmap:progress-check)  cmd_roadmap_progress_check "$@" ;;
     hooks:install)           cmd_hooks_install "$@" ;;

package/scripts/_lib/cli_wrapper.py

@@ -0,0 +1,64 @@
+"""Install / refresh the consumer-facing ``./agent-config`` wrapper.
+
+Python counterpart to ``install_cli_wrapper`` in ``scripts/install.sh``.
+The wrapper is gitignored and meant to be regenerated on every install,
+but the normal update cadence (``upgrade``, ``refresh --project``) never
+re-ran the bash installer — so an older, fallback-less wrapper could
+linger in a consumer project and break every Claude hook (the hook
+resolves the master CLI *through* this wrapper). These helpers let the
+update commands re-stamp the wrapper from the canonical template.
+
+The template is the single source of truth (``templates/agent-config-wrapper.sh``);
+the installer copies it verbatim with no substitution, so refreshing is a
+plain copy + ``chmod``.
+"""
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+from typing import Optional
+
+# scripts/_lib/cli_wrapper.py → parents[2] is the package root.
+_PACKAGE_ROOT = Path(__file__).resolve().parents[2]
+_TEMPLATE = _PACKAGE_ROOT / "templates" / "agent-config-wrapper.sh"
+
+
+def template_path() -> Path:
+    """Absolute path to the canonical wrapper template."""
+    return _TEMPLATE
+
+
+def _target(project_root: Path) -> Path:
+    return Path(project_root) / "agent-config"
+
+
+def needs_refresh(project_root: Path) -> bool:
+    """True when the project wrapper is missing or differs from the template.
+
+    Returns ``False`` when the template itself is unavailable (corrupt /
+    maintainer-only checkout) — there is nothing to refresh *to*.
+    """
+    if not _TEMPLATE.is_file():
+        return False
+    target = _target(project_root)
+    if not target.is_file():
+        return True
+    try:
+        return target.read_text(encoding="utf-8") != _TEMPLATE.read_text(
+            encoding="utf-8")
+    except OSError:
+        return True
+
+
+def install_cli_wrapper(project_root: Path) -> Optional[Path]:
+    """Copy the canonical wrapper template to ``<project_root>/agent-config``.
+
+    Returns the written target path, or ``None`` when the template is
+    missing (corrupt package / maintainer checkout without templates).
+    """
+    if not _TEMPLATE.is_file():
+        return None
+    target = _target(project_root)
+    shutil.copyfile(_TEMPLATE, target)
+    target.chmod(0o755)
+    return target

package/scripts/ai-video/lib/probe-audio.sh

@@ -36,6 +36,14 @@
 #   2  usage / file missing
 #   3  required tool missing (ffprobe / ffmpeg)
 #   4  no audio stream in the file
+#
+# Runtime requirements (trust boundary — AI-council note 2026-06-02):
+#   - ffmpeg + ffprobe on PATH (enforced, exit 3).
+#   - POSIX awk. Both GNU awk (CI/Linux) and BSD awk (macOS) are supported;
+#     the window arrays are passed via ENVIRON, not -v, because BSD awk
+#     rejects literal newlines in a -v value. The honesty invariant
+#     (interval <=> warning) is regression-guarded by
+#     tests/test_probe_audio.py::test_corpus_sweep_honesty_invariant.
 
 set -euo pipefail
 
@@ -99,7 +107,9 @@ sil_bounds="$(ffmpeg -hide_banner -nostats -i "${song}" \
       /silence_start/ { for(i=1;i<=NF;i++) if($i=="silence_start:") s=$(i+1) }
       /silence_end/   { for(i=1;i<=NF;i++) if($i=="silence_end:")   { e=$(i+1); printf "%.3f\n", (s+e)/2 } }
     ' 2>/dev/null || true)"
-n_sil="$(printf '%s' "${sil_bounds}" | sed '/^$/d' | wc -l | tr -d ' ')"
+# Trailing \n so `wc -l` counts the last line: command substitution strips
+# the trailing newline, and two boundaries without it count as one.
+n_sil="$(printf '%s\n' "${sil_bounds}" | sed '/^$/d' | wc -l | tr -d ' ')"
 
 # --- 4. choose method + build section boundaries ------------------------
 # A method needs >= 3 sections (>= 2 internal boundaries) to count as
@@ -125,7 +135,7 @@ if [ -z "${method}" ]; then
             prev=en[k]
           }
         }')"
-  n_rms="$(printf '%s' "${rms_bounds}" | sed '/^$/d' | wc -l | tr -d ' ')"
+  n_rms="$(printf '%s\n' "${rms_bounds}" | sed '/^$/d' | wc -l | tr -d ' ')"
   if [ "${n_rms}" -ge 2 ]; then
     method="rms"
     boundaries="$(printf '%s\n' "${rms_bounds}" | sed '/^$/d' | sort -n | uniq)"
@@ -145,10 +155,15 @@ fi
 # = mean of the RMS windows whose start falls inside it.
 printf '%s' "${boundaries}" \
   | sed '/^$/d' \
-  | awk -v d="${duration}" -v method="${method}" -v warning="${warning}" \
-        -v wins="$(printf '%b' "${win_starts}")" -v ens="$(printf '%b' "${win_energy}")" '
+  | _PROBE_WINS="$(printf '%b' "${win_starts}")" _PROBE_ENS="$(printf '%b' "${win_energy}")" \
+    awk -v d="${duration}" -v method="${method}" -v warning="${warning}" '
     BEGIN {
-      nw=split(wins, ws, "\n"); split(ens, es, "\n")
+      # Read the window arrays from the environment, not -v: BSD awk (macOS)
+      # rejects literal newlines inside a -v value ("newline in string"),
+      # while GNU awk (CI/Linux) tolerates them. ENVIRON is POSIX and
+      # portable across both. (Surfaced 2026-06-02 once ffmpeg landed on a
+      # macOS authoring host — CI on gawk never hit it.)
+      nw=split(ENVIRON["_PROBE_WINS"], ws, "\n"); split(ENVIRON["_PROBE_ENS"], es, "\n")
       # build edges
       ne=0; edges[ne++]=0
     }

package/scripts/hook_manifest.yaml

@@ -62,16 +62,25 @@ concerns:
     script: scripts/profile_staleness_hook.py
     args: []
     fail_closed: false
+  # Defense-in-depth twin of the update-command wrapper refresh
+  # (cmd_upgrade / cmd_refresh). On session_start, re-stamps a stale
+  # project-local ./agent-config wrapper from the canonical template so
+  # an outdated, fallback-less copy cannot keep breaking the hooks.
+  # Never creates a wrapper, never touches the source repo, fail-open.
+  wrapper-freshness:
+    script: scripts/wrapper_freshness_hook.py
+    args: []
+    fail_closed: false
 
 platforms:
   augment:
-    session_start:    [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness]
+    session_start:    [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness]
     session_end:      [chat-history]
     stop:             [chat-history, verify-before-complete]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff]
 
   claude:
-    session_start:    [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness]
+    session_start:    [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness]
     session_end:      [chat-history]
     stop:             [chat-history, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
@@ -92,7 +101,7 @@ platforms:
   # Decision matrix + upstream blockers tracked in
   # agents/settings/contexts/chat-history-platform-hooks.md § Cowork.
   cowork:
-    session_start:    [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness]
+    session_start:    [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness]
     session_end:      [chat-history]
     stop:             [chat-history, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
@@ -106,7 +115,7 @@ platforms:
   # IDE-only — CLI-only users fall back to /checkpoint per
   # agents/settings/contexts/chat-history-platform-hooks.md.
   cursor:
-    session_start:      [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness]
+    session_start:      [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness]
     session_end:        [chat-history]
     stop:               [chat-history, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
@@ -121,7 +130,7 @@ platforms:
   # both map to session_start. TaskCancel maps to stop because the
   # session is interrupted with partial state (mirrors Augment Stop).
   cline:
-    session_start:      [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness]
+    session_start:      [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness]
     session_end:        [chat-history]
     stop:               [chat-history, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
@@ -140,7 +149,7 @@ platforms:
   # surface to record verification commands; documented limitation).
   # minimal-safe-diff is omitted entirely on Windsurf for the same reason.
   windsurf:
-    session_start:      [chat-history, first-run-gate, onboarding-gate, verify-before-complete, profile-staleness]
+    session_start:      [chat-history, first-run-gate, onboarding-gate, verify-before-complete, profile-staleness, wrapper-freshness]
     stop:               [chat-history, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete]
 
@@ -155,7 +164,7 @@ platforms:
   # turn-check semantics. AfterAgent fires when the agent loop ends
   # — this is our `stop` slot.
   gemini:
-    session_start:      [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness]
+    session_start:      [chat-history, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness]
     session_end:        [chat-history]
     stop:               [chat-history, verify-before-complete]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]

package/scripts/profile_use.py

@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+"""`agent-config use --profile=<id>` — switch the active experience.
+
+The explicit profile-switch entry point named by the Execution-Model ADR
+(`docs/decisions/ADR-040-execution-model-projection-time-filtering.md`) and
+wired in `road-to-6.0.0-a-positioning-and-validation` Phase 2 / Step 8.
+
+In 6.0.0-A this writes `profile.id` into the canonical project
+`.agent-settings.yml` and prints what changed — it does **NOT** narrow what
+gets projected into the tool trees. Pack-scoped surfacing (projection-time
+filtering) activates in 6.0.0-B behind a staged, opt-in rollout. This command
+is the stable seam that 6.0.0-B hooks projection into.
+
+Comment-preserving: the canonical settings file is hand-editable and richly
+commented, so the write is a surgical text edit of the `profile:` block, not a
+yaml round-trip that would strip comments.
+
+CLI:
+    agent-config use --profile=<id>
+    agent-config use --profile <id>
+
+Valid ids (the six seed profiles, docs/contracts/profile-system.md):
+    developer · content_creator · founder · agency · finance · ops
+"""
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from _lib.agent_settings import (  # noqa: E402
+    canonical_settings_write_path,
+    find_project_root,
+)
+
+VALID_PROFILES = (
+    "developer",
+    "content_creator",
+    "founder",
+    "agency",
+    "finance",
+    "ops",
+)
+
+# Matches a top-level `profile:` block and the `id:` leaf under it. The id
+# value may be bare, single-, or double-quoted; we only rewrite the value.
+_PROFILE_ID_RE = re.compile(
+    r"(?m)^(?P<head>profile:[ \t]*\n(?:[ \t]+#[^\n]*\n|[ \t]*\n)*"
+    r"[ \t]+id:[ \t]*)(?P<val>[^\n#]*)",
+)
+
+
+def _resolve_write_path() -> Path:
+    cwd = Path.cwd()
+    root = find_project_root(cwd) or cwd
+    return canonical_settings_write_path(root)
+
+
+def _set_profile_id(text: str, profile_id: str) -> tuple[str, str | None]:
+    """Return (new_text, previous_id). Append a block if none exists."""
+    m = _PROFILE_ID_RE.search(text)
+    if m:
+        previous = m.group("val").strip().strip("'\"") or None
+        new_text = text[: m.start("val")] + profile_id + text[m.end("val") :]
+        return new_text, previous
+    # No profile block — append one. Keep a single trailing newline.
+    block = f"\n# --- Profile (experience) ---\nprofile:\n  id: {profile_id}\n"
+    sep = "" if text.endswith("\n") else "\n"
+    return text + sep + block, None
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="agent-config use",
+        description="Switch the active experience/profile (writes profile.id).",
+    )
+    parser.add_argument(
+        "--profile",
+        metavar="ID",
+        help=f"Experience to switch to. One of: {', '.join(VALID_PROFILES)}.",
+    )
+    args = parser.parse_args(argv)
+
+    if not args.profile:
+        print(
+            "❌  `use` requires --profile=<id>. Valid: "
+            + " · ".join(VALID_PROFILES),
+            file=sys.stderr,
+        )
+        return 2
+
+    profile_id = args.profile.strip()
+    if profile_id not in VALID_PROFILES:
+        print(
+            f"❌  unknown profile `{profile_id}`. Valid: "
+            + " · ".join(VALID_PROFILES),
+            file=sys.stderr,
+        )
+        return 2
+
+    path = _resolve_write_path()
+    text = path.read_text(encoding="utf-8") if path.exists() else ""
+    new_text, previous = _set_profile_id(text, profile_id)
+
+    if previous == profile_id and path.exists():
+        print(f"✅  Already on experience `{profile_id}` — no change ({path}).")
+        return 0
+
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(new_text, encoding="utf-8")
+
+    arrow = f"`{previous}` → `{profile_id}`" if previous else f"`{profile_id}`"
+    print(f"✅  Experience set to {arrow} in {path}.")
+    print(
+        "ℹ️   6.0.0-A records the choice only — it does not yet narrow what is "
+        "projected into .claude/ .cursor/ .augment/. Pack-scoped surfacing "
+        "(ADR-040) activates in 6.0.0-B behind a staged, opt-in rollout."
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/wrapper_freshness_hook.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""session_start concern — keep the project-local ``./agent-config`` fresh.
+
+Defense-in-depth twin of the update-command refresh (``upgrade`` /
+``refresh --project``). On every session_start the dispatcher runs this in
+the consumer workspace; if a ``./agent-config`` wrapper exists there and
+differs from the canonical template, it is re-stamped so an outdated,
+fallback-less copy cannot keep breaking the hooks.
+
+Bootstrapping note: this can only heal a wrapper functional enough to
+invoke the dispatcher in the first place (the current template's global +
+npx fallbacks guarantee that). A *completely* broken wrapper never reaches
+this concern — that recovery path is ``agent-config upgrade`` /
+``refresh --project``.
+
+Contract: never creates a wrapper where none exists (that is an install
+action); never touches the agent-config source repo; always fail-open
+(exit 0) — hook self-heal must not block a session.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+
+# Make `scripts` importable when invoked as a bare script path.
+_REPO = Path(__file__).resolve().parent.parent
+if str(_REPO) not in sys.path:
+    sys.path.insert(0, str(_REPO))
+
+EXIT_ALLOW = 0
+
+
+def _project_root() -> Path:
+    env = os.environ.get("CLAUDE_PROJECT_DIR") or os.environ.get(
+        "AGENT_CONFIG_PROJECT_DIR")
+    if env:
+        return Path(env)
+    return Path.cwd()
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(
+        description="Project ./agent-config wrapper freshness (session_start).")
+    ap.add_argument("--root", default=None)
+    args, _ = ap.parse_known_args(argv)
+
+    # Drain stdin (the dispatcher passes a JSON envelope); we do not need it.
+    try:
+        if not sys.stdin.isatty():
+            sys.stdin.read()
+    except Exception:
+        pass
+
+    try:
+        from scripts._lib import cli_wrapper
+        from scripts._cli.cmd_refresh import _is_source_repo
+    except Exception:  # pragma: no cover — defensive; never block the loop
+        return EXIT_ALLOW
+
+    root = Path(args.root) if args.root else _project_root()
+    try:
+        if _is_source_repo(root):
+            return EXIT_ALLOW
+        if not (root / "agent-config").is_file():
+            return EXIT_ALLOW  # no wrapper here — never create one
+        if not cli_wrapper.needs_refresh(root):
+            return EXIT_ALLOW
+        wrapper = cli_wrapper.install_cli_wrapper(root)
+    except Exception:
+        return EXIT_ALLOW  # fail-open — never block the session
+
+    if wrapper is not None:
+        print(f"[wrapper] re-stamped stale ./agent-config at {wrapper}",
+              file=sys.stderr)
+        sys.stdout.write(json.dumps({
+            "decision": "allow",
+            "reason": f"refreshed stale ./agent-config wrapper at {wrapper}",
+        }))
+    return EXIT_ALLOW
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())