@event4u/agent-config 8.0.0 → 8.2.0

package/dist/agent-src/templates/hooks/pre-commit-roadmap-progress

@@ -5,11 +5,14 @@
 # Two opt-in checks run on relevant staged paths and short-circuit
 # otherwise:
 #   1. agents/roadmaps-progress.md sync (against agents/roadmaps/*.md)
-#   2. ADR-013 per-artefact frontmatter contract (.agent-src.uncondensed/*.md)
+#   2. ADR-013 per-artefact frontmatter contract (source repo only)
+#
+# The runtime is Node/tsx (py2ts migration) — both checks run through the
+# `agent-config` CLI / the package tsx runner, never python3.
 #
 # To run manually:
 #   ./agent-config roadmap:progress-check
-#   python3 scripts/lint_artefact_frontmatter.py
+#   ./scripts-run src/scripts/lint_artefact_frontmatter
 #
 # To uninstall:
 #   rm .git/hooks/pre-commit
@@ -20,11 +23,11 @@ staged="$(git diff --cached --name-only --diff-filter=ACMR 2>/dev/null || true)"
 roadmap_relevant=false
 frontmatter_relevant=false
 case "$staged" in
-  *agents/roadmaps/*.md*|*agents/roadmaps-progress.md*|*.augment/scripts/update_roadmap_progress.py*)
+  *agents/roadmaps/*.md*|*agents/roadmaps-progress.md*|*.augment/scripts/update_roadmap_progress.ts*)
     roadmap_relevant=true ;;
 esac
 case "$staged" in
-  *.agent-src.uncondensed/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.py*)
+  *.agent-src.uncondensed/*.md*|*src/agent-src/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.ts*)
     frontmatter_relevant=true ;;
 esac
 
@@ -32,33 +35,32 @@ if ! $roadmap_relevant && ! $frontmatter_relevant; then
   exit 0
 fi
 
-resolve() {
-  local cand
-  for cand in "$@"; do
-    if [ -f "$cand" ]; then
-      printf '%s\n' "$cand"
-      return 0
-    fi
-  done
+# Resolve the agent-config CLI: project wrapper first (customization wins),
+# then the global binary (ADR-020 global-only consumers).
+agent_config_bin() {
+  if [ -x "./agent-config" ]; then
+    printf '%s\n' "./agent-config"
+    return 0
+  fi
+  if command -v agent-config >/dev/null 2>&1; then
+    printf '%s\n' "agent-config"
+    return 0
+  fi
   return 1
 }
 
 # --- Check 1: roadmap progress dashboard sync --------------------------
 if $roadmap_relevant; then
-  rp_script="$(resolve \
-    ".augment/scripts/update_roadmap_progress.py" \
-    "dist/agent-src/scripts/update_roadmap_progress.py" \
-    ".agent-src.uncondensed/scripts/update_roadmap_progress.py" || true)"
-
-  if [ -z "$rp_script" ]; then
-    echo "⚠️  pre-commit: update_roadmap_progress.py not found — skipping roadmap check." >&2
-  elif ! python3 "$rp_script" --check >/dev/null 2>&1; then
+  ac_bin="$(agent_config_bin || true)"
+  if [ -z "$ac_bin" ]; then
+    echo "⚠️  pre-commit: agent-config CLI not found — skipping roadmap check." >&2
+    echo "    Install it: npm install -g @event4u/agent-config" >&2
+  elif ! "$ac_bin" roadmap:progress-check >/dev/null 2>&1; then
     echo "❌  agents/roadmaps-progress.md is stale relative to your staged changes." >&2
     echo "" >&2
     echo "    Regenerate the dashboard with one of:" >&2
-    echo "      ./agent-config roadmap:progress" >&2
+    echo "      $ac_bin roadmap:progress" >&2
     echo "      task roadmap-progress" >&2
-    echo "      python3 $rp_script" >&2
     echo "" >&2
     echo "    Then \`git add agents/roadmaps-progress.md\` and retry the commit." >&2
     echo "" >&2
@@ -69,19 +71,31 @@ if $roadmap_relevant; then
 fi
 
 # --- Check 2: ADR-013 artefact frontmatter contract --------------------
+# Source-repo concern: the linter and the artefact tree only exist in the
+# agent-config source repo; consumer repos skip silently.
 if $frontmatter_relevant; then
-  fm_script="$(resolve \
-    ".augment/scripts/lint_artefact_frontmatter.py" \
-    "dist/agent-src/scripts/lint_artefact_frontmatter.py" \
-    "scripts/lint_artefact_frontmatter.py" || true)"
+  fm_script=""
+  if [ -f "src/scripts/lint_artefact_frontmatter.ts" ]; then
+    fm_script="src/scripts/lint_artefact_frontmatter.ts"
+  fi
+
+  run_fm() {
+    if [ -x "./scripts-run" ]; then
+      ./scripts-run src/scripts/lint_artefact_frontmatter --quiet
+    elif [ -x "node_modules/.bin/tsx" ]; then
+      node_modules/.bin/tsx "$fm_script" --quiet
+    else
+      npx tsx "$fm_script" --quiet
+    fi
+  }
 
   if [ -z "$fm_script" ]; then
-    echo "⚠️  pre-commit: lint_artefact_frontmatter.py not found — skipping frontmatter check." >&2
-  elif ! python3 "$fm_script" --quiet >/dev/null 2>&1; then
+    : # not the source repo — frontmatter contract does not apply
+  elif ! run_fm >/dev/null 2>&1; then
     echo "❌  Artefact frontmatter lint failed (ADR-013 contract violation)." >&2
     echo "" >&2
     echo "    Re-run for details:" >&2
-    echo "      python3 $fm_script" >&2
+    echo "      ./scripts-run src/scripts/lint_artefact_frontmatter" >&2
     echo "      task lint-artefact-frontmatter" >&2
     echo "" >&2
     echo "    Common fixes:" >&2

package/dist/agent-src/templates/roadmaps.md

@@ -158,15 +158,20 @@ Templates for roadmap files stored in `agents/roadmaps/` or `{module_root}/{Modu
 
 ---
 
-## Quality Gates (always apply at completion)
+## Quality Gates (remote CI by default)
 
 Every roadmap must pass the project's quality pipeline before it is
-considered done. **When** the pipeline runs during
+considered done. **Where** that gate runs depends on
+`quality.local_auto_run`: `false` or missing (default) → agent does NOT
+run the pipeline locally — user runs it manually, remote CI on the PR
+is the authoritative gate; run-end report says *"quality gates
+delegated to remote CI"*, never that the tools passed. When
+`local_auto_run: true`, **when** the local pipeline runs during
 `/roadmap:process-step|phase|full` is governed by
 `roadmap.quality_cadence` in `.agent-settings.yml`
 (`end_of_roadmap` default → once before archival; `per_phase` → after
-every phase; `per_step` → after every step). Either way, a final fresh
-run is mandatory before "complete" per `verify-before-complete`.
+every phase; `per_step` → after every step), with a final fresh run
+before "complete" per `verify-before-complete`.
 
 Common commands:
 

package/dist/agent-src/templates/rule.md

@@ -22,9 +22,9 @@ consumer's `.augment/`.
 
 Use **logical names** rooted at the source — never the
 `.agent-src.uncondensed/` prefix. The condense-time rewriter
-(`scripts/condense.py::_rewrite_paths`) resolves logical names to
+(`scripts/condense.ts::_rewrite_paths`) resolves logical names to
 deployment-correct relative paths; the schema regex
-(`scripts/schemas/rule.schema.json`) and `scripts/lint_load_context.py`
+(`scripts/schemas/rule.schema.json`) and `scripts/lint_load_context.ts`
 both reject the legacy prefix.
 
 | Write this (logical) | Forbidden (legacy) |
@@ -121,7 +121,7 @@ for full detail; rules are pointers, not playbooks.}
 | `tier` | yes | `kernel` (Iron Law floor), `tier-1` (default), `tier-2` (full profile only). Legacy values still accepted. |
 | `description` | yes | One sentence, ≤ 500 chars. Trigger-clarity wins over poetry. |
 | `source` | yes | `package` (this repo) or `project` (consumer override). |
-| `load_context` | no | Lazy context list — logical names only. Budget enforced by `lint_load_context.py`. |
+| `load_context` | no | Lazy context list — logical names only. Budget enforced by `lint_load_context.ts`. |
 | `load_context_eager` | no | Eager context list — counts against per-rule char budget. |
 | `triggers` | no | Required on non-kernel rules per `rule-router.md`. |
 | `routes_to` | no | `skill:`, `guideline:`, `command:`, `contract:` targets. Forbidden on kernel rules. |

package/dist/agent-src/templates/scripts/README.md

@@ -18,8 +18,8 @@ high-risk PRs.
 | File in package | Copy to | Purpose |
 |---|---|---|
 | `templates/github-workflows/pr-risk-review.yml` | `.github/workflows/pr-risk-review.yml` | GitHub Actions workflow |
-| `templates/scripts/pr_risk_review.ts` | `scripts/pr_risk_review.py` | Risk classifier (Python 3.10+, PyYAML) |
-| `templates/scripts/pr_review_routing.ts` | `scripts/pr_review_routing.py` | Routing classifier |
+| `templates/scripts/pr_risk_review.ts` | `scripts/pr_risk_review.ts` | Risk classifier (TypeScript, run via tsx) |
+| `templates/scripts/pr_review_routing.ts` | `scripts/pr_review_routing.ts` | Routing classifier |
 | `templates/scripts/pr-risk-config.example.yml` | `.github/pr-risk-config.yml` | Risk patterns (optional) |
 | `templates/scripts/ownership-map.example.yml` | `.github/ownership-map.yml` | Ownership entries (optional) |
 | `templates/scripts/historical-bug-patterns.example.yml` | `.github/historical-bug-patterns.yml` | Registered failure modes (optional) |
@@ -37,7 +37,7 @@ cp .augment/templates/scripts/historical-bug-patterns.example.yml .github/histor
 ```
 
 The routing step in the workflow is **conditional** — it only runs if
-`scripts/pr_review_routing.py` exists, so risk classification alone works
+`scripts/pr_review_routing.ts` exists, so risk classification alone works
 without routing being installed.
 
 Create the three labels once (or let them be auto-created on first run):
@@ -118,8 +118,8 @@ the full schema.
 
 ```bash
 rm .github/workflows/pr-risk-review.yml
-rm scripts/pr_risk_review.py
-rm scripts/pr_review_routing.py
+rm scripts/pr_risk_review.ts
+rm scripts/pr_review_routing.ts
 rm .github/pr-risk-config.yml .github/ownership-map.yml .github/historical-bug-patterns.yml
 gh label delete risk:low risk:medium risk:high
 ```
@@ -168,7 +168,7 @@ PRs.
 | File in package | Copy to | Purpose |
 |---|---|---|
 | `templates/github-workflows/memory-hygiene.yml` | `.github/workflows/memory-hygiene.yml` | Weekly staleness workflow |
-| `templates/scripts/check_memory.ts` | `scripts/check_memory.py` | YAML schema + staleness validator |
+| `templates/scripts/check_memory.ts` | `scripts/check_memory.ts` | YAML schema + staleness validator |
 
 ## Install
 

package/dist/agent-src/templates/scripts/check_memory.ts

@@ -53,7 +53,7 @@ import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import YAML, { parseDocument } from 'yaml';
 
 type Severity = 'error' | 'warning' | 'info';
@@ -631,8 +631,30 @@ function _emit(findings: Finding[], fmt: string): number {
     return errors.length > 0 ? 1 : 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/check_memory_proposal.ts

@@ -332,10 +332,29 @@ function _set_intake_root_for_test(root: string): void {
     INTAKE_ROOT = root;
 }
 
-const _isCliEntry =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
-if (_isCliEntry || process.argv[1] === _HERE) {
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry() || process.argv[1] === _HERE) {
     process.exit(main());
 }
 

package/dist/agent-src/templates/scripts/historical-bug-patterns.example.yml

@@ -1,4 +1,4 @@
-# Historical bug patterns — consumed by scripts/pr_review_routing.py
+# Historical bug patterns — consumed by scripts/pr_review_routing.ts
 #
 # Copy this file to `.github/historical-bug-patterns.yml` (preferred) or
 # `agents/historical-bug-patterns.yml` and curate the patterns from your

package/dist/agent-src/templates/scripts/memory_hash.ts

@@ -28,7 +28,7 @@
 import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 import YAML, { parseDocument } from 'yaml';
 
@@ -326,8 +326,30 @@ function _parseArgs(argv: string[]): ParsedArgs {
     return args;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/memory_lookup.ts

@@ -33,7 +33,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import YAML, { parseDocument } from 'yaml';
 
 
@@ -1060,8 +1060,30 @@ function _escapeNonAscii(s: string): string {
     return out;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/memory_report.ts

@@ -30,7 +30,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import YAML, { parseDocument } from 'yaml';
 
 import * as memory_status from './memory_status.js';
@@ -839,8 +839,30 @@ export function main(): number {
     return 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/memory_signal.ts

@@ -31,7 +31,7 @@ import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 // Mutable so tests can repoint at a tmp tree (monkeypatch parity).
 export let INTAKE_ROOT = path.join('agents', 'memory', 'intake');
@@ -415,8 +415,30 @@ export function main(): number {
     return 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/memory_status.ts

@@ -22,7 +22,9 @@
  */
 
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 // Retrieval contract version served by the file-backed backend.
 // Source of truth: internal/schemas/retrieval-v1.schema.json.
@@ -176,8 +178,30 @@ export function main(): number {
     return 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+    _isCliEntry();
 if (_isMain) {
     try {
         process.exitCode = main();

package/dist/agent-src/templates/scripts/ownership-map.example.yml

@@ -1,4 +1,4 @@
-# Ownership map — consumed by scripts/pr_review_routing.py
+# Ownership map — consumed by scripts/pr_review_routing.ts
 #
 # Copy this file to `.github/ownership-map.yml` (preferred) or
 # `agents/ownership-map.yml` and adapt the entries to your stack.

package/dist/agent-src/templates/scripts/pr-risk-config.example.yml

@@ -1,4 +1,4 @@
-# PR risk config — consumed by scripts/pr_risk_review.py
+# PR risk config — consumed by scripts/pr_risk_review.ts
 #
 # Copy this file to `.github/pr-risk-config.yml` and adapt the patterns to
 # your stack. Omitting the file entirely is fine — the script ships with

package/dist/agent-src/templates/scripts/pr_review_routing.ts

@@ -27,7 +27,7 @@ import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import * as fs from 'node:fs';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 import type * as YamlModule from 'yaml';
 
@@ -515,9 +515,30 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     return 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }

package/dist/agent-src/templates/scripts/telemetry_record.ts

@@ -15,7 +15,7 @@
  */
 import * as fs from 'node:fs';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 
 import { record_event } from './telemetry/boundary.js';
@@ -247,9 +247,30 @@ function _osErr(exc: unknown): string {
     return exc instanceof Error ? exc.message : String(exc);
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }

package/dist/agent-src/templates/scripts/telemetry_report.ts

@@ -11,7 +11,8 @@
  *       failure on a row sourced from the log
  */
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import * as fs from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 
 import { aggregate } from './telemetry/aggregator.js';
@@ -181,9 +182,30 @@ function _osErr(exc: unknown): string {
     return exc instanceof Error ? exc.message : String(exc);
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }