@event4u/agent-config 7.4.0 → 8.0.0

package/src/scripts/export_replay_corpus.ts

@@ -0,0 +1,187 @@
+#!/usr/bin/env tsx
+/**
+ * Field-corpus exporter for router-telemetry replays
+ * (road-to-token-proof-and-story Phase 2).
+ *
+ * Reads one or more `.agent-chat-history` JSONL logs (schema: one JSON object
+ * per line; user turns are `{"t": "user", "text": "..."}`), extracts real
+ * prompts, applies a built-in redaction pass, and emits a
+ * `router_telemetry`-compatible corpus (`prompts:` entries with
+ * `{id, text, command}`), so the three/four replay arms run on
+ * consumer-shaped traffic instead of synthetic tasks.
+ *
+ * PRIVACY GATE (operator, non-optional): the built-in redaction is a
+ * mechanical first pass — emails, home paths, key-shaped tokens, long hex,
+ * URLs with credentials. The exported file MUST be human-reviewed under the
+ * low-impact-corpus privacy floor BEFORE it is stored, committed, or fed to
+ * any report that leaves the machine. The tool prints this reminder and
+ * defaults to a `.local.yaml` output name so an unreviewed export cannot be
+ * committed silently (gitignored pattern).
+ *
+ * Usage:
+ *   ./scripts-run src/scripts/export_replay_corpus \
+ *     --history agents/runtime/.agent-chat-history \
+ *     [--history <other-repo>/agents/runtime/.agent-chat-history ...] \
+ *     [--out internal/bench/corpora/field-prompts.local.yaml] \
+ *     [--limit 200] [--min-chars 20]
+ *
+ * Exit codes: 0 written · 1 usage/file error.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const _HERE = fileURLToPath(import.meta.url);
+const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
+const DEFAULT_OUT = path.join(REPO_ROOT, 'internal/bench/corpora/field-prompts.local.yaml');
+
+export interface FieldPrompt {
+  id: string;
+  text: string;
+  command: string | null;
+}
+
+const REDACTIONS: Array<[RegExp, string]> = [
+  // emails
+  [/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, '<EMAIL>'],
+  // API-key-shaped tokens (sk-…, ghp_…, xox…, AKIA…, long base64-ish runs)
+  [/\b(?:sk-[A-Za-z0-9_-]{10,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|xox[a-z]-[A-Za-z0-9-]{10,}|AKIA[A-Z0-9]{12,})\b/g, '<KEY>'],
+  // credentials embedded in URLs
+  [/(https?:\/\/)[^\s/@]+:[^\s/@]+@/g, '$1<CREDENTIALS>@'],
+  // absolute home paths (macOS/Linux)
+  [/(?:\/Users|\/home)\/[A-Za-z0-9._-]+/g, '<HOME>'],
+  // long hex blobs (hashes, tokens)
+  [/\b[a-f0-9]{32,}\b/gi, '<HEX>'],
+  // IPv4
+  [/\b(?:\d{1,3}\.){3}\d{1,3}\b/g, '<IP>'],
+];
+
+/** Mechanical first-pass redaction — NOT a substitute for the operator review. */
+export function redact(text: string): string {
+  let out = text;
+  for (const [re, sub] of REDACTIONS) {
+    out = out.replace(re, sub);
+  }
+  return out;
+}
+
+/** Extract user prompts from one .agent-chat-history JSONL file. */
+export function extract_prompts(jsonlText: string, minChars: number): string[] {
+  const out: string[] = [];
+  for (const line of jsonlText.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let obj: Record<string, unknown>;
+    try {
+      obj = JSON.parse(trimmed) as Record<string, unknown>;
+    } catch {
+      continue; // tolerate partial/corrupt lines — logs are append-only
+    }
+    if (obj['t'] !== 'user' || typeof obj['text'] !== 'string') continue;
+    const text = (obj['text'] as string).trim();
+    if (text.length < minChars) continue;
+    out.push(text);
+  }
+  return out;
+}
+
+/** First `/token` of a prompt that looks like a slash command. */
+export function detect_command(text: string): string | null {
+  const m = /^\/([a-z0-9:_-]+)/i.exec(text.trim());
+  return m ? `/${(m[1] as string).toLowerCase()}` : null;
+}
+
+/** Build the corpus entries: redacted, de-duplicated, capped. */
+export function build_corpus(rawPrompts: string[], limit: number): FieldPrompt[] {
+  const seen = new Set<string>();
+  const out: FieldPrompt[] = [];
+  for (const raw of rawPrompts) {
+    const text = redact(raw);
+    const key = text.slice(0, 200);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({
+      id: `field-${String(out.length + 1).padStart(3, '0')}`,
+      text,
+      command: detect_command(text),
+    });
+    if (out.length >= limit) break;
+  }
+  return out;
+}
+
+function _yamlQuote(s: string): string {
+  return JSON.stringify(s); // JSON string is valid YAML double-quoted scalar
+}
+
+export function to_yaml(prompts: FieldPrompt[]): string {
+  const lines: string[] = [
+    '# Field replay corpus — exported by export_replay_corpus.',
+    '# PRIVACY: operator review REQUIRED before this file is stored/committed',
+    '# (low-impact-corpus privacy floor). Redaction here is a mechanical first',
+    '# pass only. Replay caveat: intent triggers are informational-only in',
+    '# router_telemetry — replay UNDERCOUNTS intent-triggered rule loads.',
+    'prompts:',
+  ];
+  for (const p of prompts) {
+    lines.push(`  - id: ${p.id}`);
+    lines.push(`    text: ${_yamlQuote(p.text)}`);
+    if (p.command) lines.push(`    command: ${_yamlQuote(p.command)}`);
+  }
+  return lines.join('\n') + '\n';
+}
+
+export function main(argv: string[]): number {
+  const histories: string[] = [];
+  let out = DEFAULT_OUT;
+  let limit = 200;
+  let minChars = 20;
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i] as string;
+    if (a === '--history') histories.push(String(argv[(i += 1)] ?? ''));
+    else if (a === '--out') out = path.resolve(String(argv[(i += 1)] ?? ''));
+    else if (a === '--limit') limit = Number(argv[(i += 1)]);
+    else if (a === '--min-chars') minChars = Number(argv[(i += 1)]);
+    else if (a === '-h' || a === '--help') {
+      process.stdout.write(
+        'usage: export_replay_corpus --history <jsonl> [--history ...] [--out FILE] [--limit N] [--min-chars N]\n',
+      );
+      return 0;
+    } else {
+      process.stderr.write(`error: unknown argument: ${a}\n`);
+      return 1;
+    }
+  }
+  if (histories.length === 0 || !Number.isFinite(limit) || limit <= 0) {
+    process.stderr.write('error: at least one --history <path> is required\n');
+    return 1;
+  }
+  const raw: string[] = [];
+  for (const h of histories) {
+    let text: string;
+    try {
+      text = fs.readFileSync(h, 'utf-8');
+    } catch (e) {
+      process.stderr.write(`error: cannot read ${h}: ${(e as Error).message}\n`);
+      return 1;
+    }
+    raw.push(...extract_prompts(text, minChars));
+  }
+  const corpus = build_corpus(raw, limit);
+  fs.mkdirSync(path.dirname(out), { recursive: true });
+  fs.writeFileSync(out, to_yaml(corpus), 'utf-8');
+  process.stdout.write(
+    `wrote ${corpus.length} prompt(s) → ${path.relative(REPO_ROOT, out)}\n` +
+      '⚠️  PRIVACY GATE: operator review required before this corpus is stored,\n' +
+      '   committed, or used in any report (low-impact-corpus privacy floor).\n',
+  );
+  return 0;
+}
+
+const _IS_MAIN =
+  process.argv[1] !== undefined &&
+  import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+if (_IS_MAIN) {
+  process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/external_sources_denylist.json

@@ -48,7 +48,13 @@
     "agency-agents",
     "msitarzewski",
     "610ClaudeSubagents",
-    "ChrisRoyse"
+    "ChrisRoyse",
+    "pbakaus",
+    "leonxlnx",
+    "gztchan",
+    "amaancoderx",
+    "npxskillui",
+    "\\bskillui\\b"
   ],
   "skip_paths": [
     "src/scripts/check_no_external_sources.py",
@@ -76,14 +82,19 @@
     "internal/workers/mcp/content.json.gz",
     "internal/workers/mcp/manifest.json",
     "src/rules/source-confidentiality.md",
-    "dist/agent-src/rules/source-confidentiality.md"
+    "dist/agent-src/rules/source-confidentiality.md",
+    "agents/roadmaps/archive/road-to-final-state-and-market-readiness.md",
+    "agents/roadmaps/archive/road-to-image-brand-typography.md",
+    "agents/roadmaps/archive/road-to-subagent-value-realization.md",
+    "agents/roadmap-assets/road-to-image-brand-typography.assets.md"
   ],
   "skip_reason": {
     "vendored_cluster": "design-intelligence/corpus-grounding/design-tokens/react-shadcn-ui/tailwind-engineer + cost/*.mjs ship vendored Apache/MIT code; their upstream attribution is license-required and must NOT be stripped (ADR-061).",
     "recommendation_docs": "mcp.md, mcp-registries.md, DISTRIBUTION_CHECKLIST.md, ADR-086, marketing-copy.yml reference registries (Smithery/Glama) as recommendations/distribution targets — allowed.",
     "generated_bundles": "content.json* bundle the vendored-cluster skill bodies above.",
     "self": "the linter + its denylist + the source-confidentiality rule necessarily contain the deny tokens as data.",
-    "validate_safe_paths": "telegraph-derived (MIT) ported code; upstream attribution is license-required."
+    "validate_safe_paths": "telegraph-derived (MIT) ported code; upstream attribution is license-required.",
+    "archived_roadmaps_newly_tracked": "Archived roadmaps (and their assets) that predate the source-confidentiality sweep became tracked via the 2026-07 agents-dir gitignore hygiene change. They are frozen historical records; the claudekit mentions are ADR-061 license-attribution work and the remaining names are historical planning references. New roadmaps stay subject to the gate."
   },
   "_excluded_tokens": {
     "agent-os": "collides with our own coined 'Agent-OS primitive' term (universal-skills) — too FP-prone to auto-deny; scrub external 'agent-os' mentions by review.",

package/src/scripts/fold_intake.ts

@@ -0,0 +1,281 @@
+#!/usr/bin/env tsx
+/**
+ * Idempotent extractive fold rollup over the gitignored intake JSONL —
+ * road-to-second-brain Phase 3 (council 2026-07-07, verdict:
+ * `agents/settings/contexts/second-brain-delta-verdict.md`).
+ *
+ * Deterministic compression for the linearly-growing intake stream:
+ *   - **2^k batching** — consecutive, non-overlapping batches of
+ *     `--batch-size` events (default 32; must be a power of two) in stable
+ *     file+line order. Only COMPLETE batches fold; the tail stays live.
+ *   - **Deterministic fold IDs** — sha256 over the batch's raw JSONL lines,
+ *     first 12 hex chars. Same input → same ID, always.
+ *   - **Children never mutated** — the intake files are read-only to this
+ *     script; a fold is an ADDITIVE archive page with link-backs
+ *     (`<file>:<first-line>-<last-line>` per child range), never a rewrite.
+ *   - **Idempotent** — an existing `fold-<id>.md` is skipped, so re-runs are
+ *     no-ops and interrupted runs resume cleanly.
+ *
+ * MANUAL TRIGGER ONLY (council decision): this script is deliberately NOT
+ * wired into hooks or CI. The Phase-0 intake tripwire
+ * (`lint_knowledge_scale.ts`, intake > 2000 events) names this script as its
+ * pre-decided activation path — when it fires, wire the script into the
+ * post-session/CI cadence. Tracked files (`agents/knowledge/sessions/`) are
+ * NEVER fold-compressed here; that path requires the consolidate gate.
+ *
+ * Usage:
+ *   fold_intake.ts [--intake-dir agents/knowledge/intake]
+ *                  [--out-dir agents/memory/archive]
+ *                  [--batch-size 32] [--dry-run] [--format text|json]
+ *
+ * Exit codes: 0 = ok (including nothing-to-fold), 2 = usage error,
+ * 3 = internal error.
+ */
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const PROG = 'fold_intake.ts';
+
+export const DEFAULT_BATCH_SIZE = 32;
+const DEFAULT_INTAKE_DIR = path.join('agents', 'knowledge', 'intake');
+const DEFAULT_OUT_DIR = path.join('agents', 'memory', 'archive');
+const SNIPPET_CHARS = 140;
+
+export interface IntakeLine {
+    file: string; // relative or absolute path as discovered
+    line: number; // 1-based line number within the file
+    raw: string; // raw JSONL line (trimmed)
+}
+
+export interface FoldPlan {
+    id: string;
+    index: number; // 0-based batch index in the stable order
+    children: IntakeLine[];
+}
+
+function listIntakeFiles(dir: string): string[] {
+    let names: string[];
+    try {
+        names = fs.readdirSync(dir);
+    } catch {
+        return [];
+    }
+    return names
+        .filter((n) => n.startsWith('events-') && n.endsWith('.jsonl'))
+        .sort()
+        .map((n) => path.join(dir, n));
+}
+
+/** Stable event order: sorted(files) then line order. Children read-only. */
+export function readIntakeLines(dir: string): IntakeLine[] {
+    const out: IntakeLine[] = [];
+    for (const file of listIntakeFiles(dir)) {
+        let text: string;
+        try {
+            text = fs.readFileSync(file, 'utf-8');
+        } catch {
+            continue;
+        }
+        const lines = text.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const raw = (lines[i] ?? '').trim();
+            if (!raw) continue;
+            out.push({ file, line: i + 1, raw });
+        }
+    }
+    return out;
+}
+
+export function foldId(children: IntakeLine[]): string {
+    const h = createHash('sha256');
+    for (const c of children) {
+        h.update(c.raw);
+        h.update('\n');
+    }
+    return h.digest('hex').slice(0, 12);
+}
+
+/** Consecutive complete batches of `batchSize`; the tail stays unfolded. */
+export function planFolds(lines: IntakeLine[], batchSize: number): FoldPlan[] {
+    const plans: FoldPlan[] = [];
+    const complete = Math.floor(lines.length / batchSize);
+    for (let b = 0; b < complete; b++) {
+        const children = lines.slice(b * batchSize, (b + 1) * batchSize);
+        plans.push({ id: foldId(children), index: b, children });
+    }
+    return plans;
+}
+
+function snippet(raw: string): string {
+    let parsed: unknown;
+    try {
+        parsed = JSON.parse(raw);
+    } catch {
+        return raw.slice(0, SNIPPET_CHARS);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return raw.slice(0, SNIPPET_CHARS);
+    }
+    const e = parsed as Record<string, unknown>;
+    const ts = typeof e.ts === 'string' ? e.ts : '';
+    const type = typeof e.type === 'string' ? e.type : 'event';
+    // First string field that carries the claim, by event-type precedence.
+    const claim =
+        [e.pattern, e.correction, e.endpoint, e.observation, e.body, e.text].find(
+            (v): v is string => typeof v === 'string' && v.trim().length > 0,
+        ) ?? '';
+    const oneLine = claim.replace(/\s+/g, ' ').trim();
+    const clipped = oneLine.length > SNIPPET_CHARS ? oneLine.slice(0, SNIPPET_CHARS - 1) + '…' : oneLine;
+    return [ts, type, clipped].filter(Boolean).join(' · ');
+}
+
+/** Contiguous per-file line ranges for the link-back section. */
+export function childRanges(children: IntakeLine[]): string[] {
+    const ranges: string[] = [];
+    let start: IntakeLine | null = null;
+    let prev: IntakeLine | null = null;
+    const flush = (): void => {
+        if (start && prev) {
+            ranges.push(
+                start.line === prev.line
+                    ? `${start.file}:${start.line}`
+                    : `${start.file}:${start.line}-${prev.line}`,
+            );
+        }
+    };
+    for (const c of children) {
+        if (prev && c.file === prev.file && c.line === prev.line + 1) {
+            prev = c;
+            continue;
+        }
+        flush();
+        start = c;
+        prev = c;
+    }
+    flush();
+    return ranges;
+}
+
+export function renderFold(plan: FoldPlan, batchSize: number): string {
+    const lines: string[] = [
+        `# Fold ${plan.id}`,
+        '',
+        '> Idempotent extractive rollup of a completed intake batch',
+        `> (batch ${plan.index}, size ${batchSize}). Children are never mutated —`,
+        '> this page is an additive archive with link-backs, not a rewrite.',
+        '> Generated by `src/scripts/fold_intake.ts` (deterministic, no LLM).',
+        '',
+        `Fold ID: ${plan.id}`,
+        `Batch index: ${plan.index}`,
+        `Events: ${plan.children.length}`,
+        '',
+        '## Extract',
+        '',
+    ];
+    for (const c of plan.children) {
+        lines.push(`- ${snippet(c.raw)}`);
+    }
+    lines.push('', '## Children (link-backs)', '');
+    for (const r of childRanges(plan.children)) {
+        lines.push(`- ${r}`);
+    }
+    lines.push('');
+    return lines.join('\n');
+}
+
+function main(argv: string[]): number {
+    let intakeDir = DEFAULT_INTAKE_DIR;
+    let outDir = DEFAULT_OUT_DIR;
+    let batchSize = DEFAULT_BATCH_SIZE;
+    let dryRun = false;
+    let format = 'text';
+
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = (): string => {
+            const v = argv[++i];
+            if (v === undefined) {
+                process.stderr.write(`${PROG}: error: ${a} requires a value\n`);
+                process.exit(2);
+            }
+            return v;
+        };
+        if (a === '--intake-dir') intakeDir = next();
+        else if (a === '--out-dir') outDir = next();
+        else if (a === '--batch-size') {
+            batchSize = Number(next());
+            if (!Number.isInteger(batchSize) || batchSize < 2 || (batchSize & (batchSize - 1)) !== 0) {
+                process.stderr.write(`${PROG}: error: --batch-size must be a power of two >= 2\n`);
+                return 2;
+            }
+        } else if (a === '--dry-run') dryRun = true;
+        else if (a === '--format') {
+            format = next();
+            if (format !== 'text' && format !== 'json') {
+                process.stderr.write(`${PROG}: error: --format must be text|json\n`);
+                return 2;
+            }
+        } else if (a === '-h' || a === '--help') {
+            process.stdout.write(
+                `usage: ${PROG} [--intake-dir <dir>] [--out-dir <dir>] ` +
+                    `[--batch-size <2^k>] [--dry-run] [--format text|json]\n`,
+            );
+            return 0;
+        } else {
+            process.stderr.write(`${PROG}: error: unknown argument ${a}\n`);
+            return 2;
+        }
+    }
+
+    try {
+        const lines = readIntakeLines(intakeDir);
+        const plans = planFolds(lines, batchSize);
+        const results: Array<{ id: string; index: number; events: number; action: string }> = [];
+
+        for (const plan of plans) {
+            const target = path.join(outDir, `fold-${plan.id}.md`);
+            let action: string;
+            if (fs.existsSync(target)) {
+                action = 'exists (skipped — idempotent)';
+            } else if (dryRun) {
+                action = 'would write';
+            } else {
+                fs.mkdirSync(outDir, { recursive: true });
+                const tmp = `${target}.tmp-${process.pid}`;
+                fs.writeFileSync(tmp, renderFold(plan, batchSize), 'utf-8');
+                fs.renameSync(tmp, target);
+                action = 'written';
+            }
+            results.push({ id: plan.id, index: plan.index, events: plan.children.length, action });
+        }
+
+        const tail = lines.length - plans.length * batchSize;
+        if (format === 'json') {
+            process.stdout.write(
+                JSON.stringify(
+                    { dry_run: dryRun, batch_size: batchSize, total_events: lines.length, unfolded_tail: tail, folds: results },
+                    null,
+                    2,
+                ) + '\n',
+            );
+        } else {
+            for (const r of results) {
+                process.stdout.write(`fold-${r.id}  batch=${r.index}  events=${r.events}  ${r.action}\n`);
+            }
+            process.stdout.write(
+                `${PROG}: ${results.length} fold(s), ${tail} event(s) in the live tail (batch size ${batchSize}${dryRun ? ', dry-run' : ''})\n`,
+            );
+        }
+        return 0;
+    } catch (exc) {
+        process.stderr.write(`${PROG}: internal error: ${String(exc)}\n`);
+        return 3;
+    }
+}
+
+if (fileURLToPath(import.meta.url) === path.resolve(process.argv[1] ?? '')) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/generate_capability_matrix.ts

@@ -65,7 +65,7 @@ const HOSTS = [
     'windsurf', 'cline', 'gemini', 'copilot', 'claude-desktop',
 ];
 
-const ARTIFACTS = ['rules', 'skills', 'commands', 'personas', 'user-types', 'hooks'];
+const ARTIFACTS = ['rules', 'skills', 'commands', 'subagents', 'personas', 'user-types', 'hooks'];
 
 interface FnSpec {
     artifact: string;
@@ -109,6 +109,14 @@ const _FN_SPEC: Record<string, FnSpec> = {
         artifact: 'commands',
         cells: { 'claude-code': 'native', augment: 'native' },
     },
+    generate_claude_subagents: {
+        artifact: 'subagents',
+        cells: { 'claude-code': 'native' },
+    },
+    generate_subagent_host_contexts: {
+        artifact: 'subagents',
+        cells: { cursor: 'adapter', windsurf: 'adapter', cline: 'adapter' },
+    },
     generate_plugin_command_skills: {
         artifact: 'skills', cells: { 'claude-plugin': 'native' },
     },