@event4u/agent-config 8.1.0 → 8.3.0

package/dist/agent-src/templates/github-workflows/pr-risk-review.yml

@@ -9,6 +9,10 @@
 # under `.augment/templates/scripts/pr-risk-config.example.yml`). Without a
 # config file the script falls back to sensible cross-stack defaults.
 #
+# Runtime: Node/tsx (py2ts migration) — the classifiers ship inside the
+# `@event4u/agent-config` package and run through the package's own tsx
+# runner; no Python and no consumer-local script copy required.
+#
 # This workflow is purely informational — it does NOT block merges. Gate the
 # PR on a separate required check if you want a hard stop.
 
@@ -34,21 +38,26 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Set up Node
+        uses: actions/setup-node@v4
         with:
-          python-version: "3.12"
+          node-version: "22"
 
-      - name: Install dependencies
-        run: pip install pyyaml
+      - name: Install agent-config
+        run: npm install -g @event4u/agent-config
 
       - name: Classify risk
         id: risk
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        # Runs the packaged classifier via the package's own tsx runner; a
+        # consumer-local `scripts/pr_risk_review.ts` customization wins.
         run: |
-          python3 scripts/pr_risk_review.py \
+          PKG="$(npm root -g)/@event4u/agent-config"
+          SCRIPT="$PKG/dist/agent-src/templates/scripts/pr_risk_review.ts"
+          [ -f scripts/pr_risk_review.ts ] && SCRIPT=scripts/pr_risk_review.ts
+          node "$PKG/node_modules/tsx/dist/cli.mjs" "$SCRIPT" \
             --base "$BASE_SHA" \
             --head "$HEAD_SHA" \
             --config .github/pr-risk-config.yml \
@@ -100,7 +109,6 @@ jobs:
 
       - name: Classify review routing
         id: routing
-        if: hashFiles('scripts/pr_review_routing.py') != ''
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -109,7 +117,10 @@ jobs:
         # back to agents/ — matching the reviewer-awareness rule.
         # Missing data files emit a generic fallback, not an error.
         run: |
-          python3 scripts/pr_review_routing.py \
+          PKG="$(npm root -g)/@event4u/agent-config"
+          SCRIPT="$PKG/dist/agent-src/templates/scripts/pr_review_routing.ts"
+          [ -f scripts/pr_review_routing.ts ] && SCRIPT=scripts/pr_review_routing.ts
+          node "$PKG/node_modules/tsx/dist/cli.mjs" "$SCRIPT" \
             --base "$BASE_SHA" \
             --head "$HEAD_SHA" \
             --output routing-report.md \

package/dist/agent-src/templates/github-workflows/proposal-drift.yml

@@ -15,9 +15,12 @@
 # This workflow is intentionally read-only — it never blocks a PR and
 # never modifies the repo. It only opens / updates a tracking issue.
 #
+# Runtime: Node/tsx (py2ts migration) — the report runs through the
+# repo's own tsx runner (`./scripts-run`); no Python required.
+#
 # Prerequisites:
-#   - `scripts/memory_report.py` present in the repo (ships with the
-#     package).
+#   - `dist/agent-src/templates/scripts/memory_report.ts` present in the
+#     repo (ships with the package).
 #   - Proposals live under `agents/proposals/` with the schema defined
 #     in `dist/agent-src/templates/agents/proposal.example.md`.
 
@@ -45,13 +48,13 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Set up Node
+        uses: actions/setup-node@v4
         with:
-          python-version: "3.12"
+          node-version: "22"
 
-      - name: Install PyYAML
-        run: pip install pyyaml
+      - name: Install dependencies
+        run: npm ci
 
       - name: Build quarterly report
         id: report
@@ -63,7 +66,7 @@ jobs:
             echo "Accepted vs. retired for the last quarter."
             echo
             echo '```'
-            python3 scripts/memory_report.py --quarterly --format text
+            ./scripts-run dist/agent-src/templates/scripts/memory_report --format text
             echo '```'
             echo
             echo "Open proposals by stage:"

package/dist/agent-src/templates/github-workflows/roadmap-progress-check.yml

@@ -9,12 +9,10 @@
 # A green check here proves the dashboard reflects reality on every PR
 # that touches roadmaps.
 #
-# Prerequisites:
-#   - `.augment/scripts/update_roadmap_progress.py` installed by
-#     `task install` (or `./agent-config install`).
-#   - At least one file exists under `agents/roadmaps/` — absence
-#     short-circuits the check with a passing exit (consumer projects
-#     that haven't adopted roadmaps stay green).
+# Runtime: Node/tsx (py2ts migration) — the check runs through the
+# `@event4u/agent-config` package via npx; no Python, no local install
+# required. Absence of `agents/roadmaps/` short-circuits with a passing
+# exit (consumer projects that haven't adopted roadmaps stay green).
 #
 # This workflow is intentionally narrow: it only runs when relevant
 # files change, so it adds zero overhead to unrelated PRs.
@@ -27,12 +25,12 @@ on:
     paths:
       - "agents/roadmaps/**"
       - "agents/roadmaps-progress.md"
-      - ".augment/scripts/update_roadmap_progress.py"
+      - ".augment/scripts/update_roadmap_progress.ts"
   pull_request:
     paths:
       - "agents/roadmaps/**"
       - "agents/roadmaps-progress.md"
-      - ".augment/scripts/update_roadmap_progress.py"
+      - ".augment/scripts/update_roadmap_progress.ts"
   workflow_dispatch: {}
 
 permissions:
@@ -45,12 +43,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-node@v4
         with:
-          python-version: "3.11"
+          node-version: "22"
 
       - name: Run roadmap progress check
-        run: python3 .augment/scripts/update_roadmap_progress.py --check
+        run: npx --yes @event4u/agent-config roadmap:progress-check
 
       - name: Remediation hint on failure
         if: failure()
@@ -58,6 +56,6 @@ jobs:
           echo "::error::roadmaps-progress.md is stale."
           echo "Regenerate locally with one of:"
           echo "  ./agent-config roadmap:progress"
+          echo "  agent-config roadmap:progress"
           echo "  task roadmap-progress"
-          echo "  python3 .augment/scripts/update_roadmap_progress.py"
           echo "Then commit and push the updated agents/roadmaps-progress.md."

package/dist/agent-src/templates/hooks/pre-commit-frontmatter

@@ -16,22 +16,23 @@
 set -e
 
 # Only act on commits that touch the source-of-truth artefact tree
-# (or the linter / vocabulary that govern it).
+# (or the linter / vocabulary that govern it). The runtime is Node/tsx
+# (py2ts migration) — the linter runs through the package tsx runner,
+# never python3.
 staged="$(git diff --cached --name-only --diff-filter=ACMR 2>/dev/null || true)"
 case "$staged" in
-  *.agent-src.uncondensed/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.py*)
+  *.agent-src.uncondensed/*.md*|*src/agent-src/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.ts*)
     : ;;
   *)
     exit 0 ;;
 esac
 
-# Resolve the linter — prefer the consumer-shipped path, fall back to
-# the source-of-truth copy when run from inside the package itself.
+# Resolve the linter — a source-repo artefact (the frontmatter contract
+# governs the source tree; consumer repos have nothing to lint).
 script=""
 for cand in \
-  ".augment/scripts/lint_artefact_frontmatter.py" \
-  "dist/agent-src/scripts/lint_artefact_frontmatter.py" \
-  "scripts/lint_artefact_frontmatter.py"; do
+  "src/scripts/lint_artefact_frontmatter.ts" \
+  ".augment/scripts/lint_artefact_frontmatter.ts"; do
   if [ -f "$cand" ]; then
     script="$cand"
     break
@@ -39,17 +40,26 @@ for cand in \
 done
 
 if [ -z "$script" ]; then
-  echo "⚠️  pre-commit-frontmatter: lint_artefact_frontmatter.py not found." >&2
-  echo "    Run \`task install\` (or \`./agent-config install\`) and retry." >&2
+  echo "⚠️  pre-commit-frontmatter: lint_artefact_frontmatter.ts not found." >&2
   echo "    Skipping check — letting commit through." >&2
   exit 0
 fi
 
-if ! python3 "$script" --quiet >/dev/null 2>&1; then
+run_lint() {
+  if [ -x "./scripts-run" ]; then
+    ./scripts-run src/scripts/lint_artefact_frontmatter --quiet
+  elif [ -x "node_modules/.bin/tsx" ]; then
+    node_modules/.bin/tsx "$script" --quiet
+  else
+    npx tsx "$script" --quiet
+  fi
+}
+
+if ! run_lint >/dev/null 2>&1; then
   echo "❌  Artefact frontmatter lint failed (ADR-013 contract violation)." >&2
   echo "" >&2
   echo "    Re-run for details:" >&2
-  echo "      python3 $script" >&2
+  echo "      ./scripts-run src/scripts/lint_artefact_frontmatter" >&2
   echo "      task lint-artefact-frontmatter" >&2
   echo "" >&2
   echo "    Common fixes:" >&2

package/dist/agent-src/templates/hooks/pre-commit-roadmap-progress

@@ -5,11 +5,14 @@
 # Two opt-in checks run on relevant staged paths and short-circuit
 # otherwise:
 #   1. agents/roadmaps-progress.md sync (against agents/roadmaps/*.md)
-#   2. ADR-013 per-artefact frontmatter contract (.agent-src.uncondensed/*.md)
+#   2. ADR-013 per-artefact frontmatter contract (source repo only)
+#
+# The runtime is Node/tsx (py2ts migration) — both checks run through the
+# `agent-config` CLI / the package tsx runner, never python3.
 #
 # To run manually:
 #   ./agent-config roadmap:progress-check
-#   python3 scripts/lint_artefact_frontmatter.py
+#   ./scripts-run src/scripts/lint_artefact_frontmatter
 #
 # To uninstall:
 #   rm .git/hooks/pre-commit
@@ -20,11 +23,11 @@ staged="$(git diff --cached --name-only --diff-filter=ACMR 2>/dev/null || true)"
 roadmap_relevant=false
 frontmatter_relevant=false
 case "$staged" in
-  *agents/roadmaps/*.md*|*agents/roadmaps-progress.md*|*.augment/scripts/update_roadmap_progress.py*)
+  *agents/roadmaps/*.md*|*agents/roadmaps-progress.md*|*.augment/scripts/update_roadmap_progress.ts*)
     roadmap_relevant=true ;;
 esac
 case "$staged" in
-  *.agent-src.uncondensed/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.py*)
+  *.agent-src.uncondensed/*.md*|*src/agent-src/*.md*|*config/discovery/*.yml*|*scripts/lint_artefact_frontmatter.ts*)
     frontmatter_relevant=true ;;
 esac
 
@@ -32,33 +35,32 @@ if ! $roadmap_relevant && ! $frontmatter_relevant; then
   exit 0
 fi
 
-resolve() {
-  local cand
-  for cand in "$@"; do
-    if [ -f "$cand" ]; then
-      printf '%s\n' "$cand"
-      return 0
-    fi
-  done
+# Resolve the agent-config CLI: project wrapper first (customization wins),
+# then the global binary (ADR-020 global-only consumers).
+agent_config_bin() {
+  if [ -x "./agent-config" ]; then
+    printf '%s\n' "./agent-config"
+    return 0
+  fi
+  if command -v agent-config >/dev/null 2>&1; then
+    printf '%s\n' "agent-config"
+    return 0
+  fi
   return 1
 }
 
 # --- Check 1: roadmap progress dashboard sync --------------------------
 if $roadmap_relevant; then
-  rp_script="$(resolve \
-    ".augment/scripts/update_roadmap_progress.py" \
-    "dist/agent-src/scripts/update_roadmap_progress.py" \
-    ".agent-src.uncondensed/scripts/update_roadmap_progress.py" || true)"
-
-  if [ -z "$rp_script" ]; then
-    echo "⚠️  pre-commit: update_roadmap_progress.py not found — skipping roadmap check." >&2
-  elif ! python3 "$rp_script" --check >/dev/null 2>&1; then
+  ac_bin="$(agent_config_bin || true)"
+  if [ -z "$ac_bin" ]; then
+    echo "⚠️  pre-commit: agent-config CLI not found — skipping roadmap check." >&2
+    echo "    Install it: npm install -g @event4u/agent-config" >&2
+  elif ! "$ac_bin" roadmap:progress-check >/dev/null 2>&1; then
     echo "❌  agents/roadmaps-progress.md is stale relative to your staged changes." >&2
     echo "" >&2
     echo "    Regenerate the dashboard with one of:" >&2
-    echo "      ./agent-config roadmap:progress" >&2
+    echo "      $ac_bin roadmap:progress" >&2
     echo "      task roadmap-progress" >&2
-    echo "      python3 $rp_script" >&2
     echo "" >&2
     echo "    Then \`git add agents/roadmaps-progress.md\` and retry the commit." >&2
     echo "" >&2
@@ -69,19 +71,31 @@ if $roadmap_relevant; then
 fi
 
 # --- Check 2: ADR-013 artefact frontmatter contract --------------------
+# Source-repo concern: the linter and the artefact tree only exist in the
+# agent-config source repo; consumer repos skip silently.
 if $frontmatter_relevant; then
-  fm_script="$(resolve \
-    ".augment/scripts/lint_artefact_frontmatter.py" \
-    "dist/agent-src/scripts/lint_artefact_frontmatter.py" \
-    "scripts/lint_artefact_frontmatter.py" || true)"
+  fm_script=""
+  if [ -f "src/scripts/lint_artefact_frontmatter.ts" ]; then
+    fm_script="src/scripts/lint_artefact_frontmatter.ts"
+  fi
+
+  run_fm() {
+    if [ -x "./scripts-run" ]; then
+      ./scripts-run src/scripts/lint_artefact_frontmatter --quiet
+    elif [ -x "node_modules/.bin/tsx" ]; then
+      node_modules/.bin/tsx "$fm_script" --quiet
+    else
+      npx tsx "$fm_script" --quiet
+    fi
+  }
 
   if [ -z "$fm_script" ]; then
-    echo "⚠️  pre-commit: lint_artefact_frontmatter.py not found — skipping frontmatter check." >&2
-  elif ! python3 "$fm_script" --quiet >/dev/null 2>&1; then
+    : # not the source repo — frontmatter contract does not apply
+  elif ! run_fm >/dev/null 2>&1; then
     echo "❌  Artefact frontmatter lint failed (ADR-013 contract violation)." >&2
     echo "" >&2
     echo "    Re-run for details:" >&2
-    echo "      python3 $fm_script" >&2
+    echo "      ./scripts-run src/scripts/lint_artefact_frontmatter" >&2
     echo "      task lint-artefact-frontmatter" >&2
     echo "" >&2
     echo "    Common fixes:" >&2

package/dist/agent-src/templates/roadmaps.md

@@ -158,15 +158,20 @@ Templates for roadmap files stored in `agents/roadmaps/` or `{module_root}/{Modu
 
 ---
 
-## Quality Gates (always apply at completion)
+## Quality Gates (remote CI by default)
 
 Every roadmap must pass the project's quality pipeline before it is
-considered done. **When** the pipeline runs during
+considered done. **Where** that gate runs depends on
+`quality.local_auto_run`: `false` or missing (default) → agent does NOT
+run the pipeline locally — user runs it manually, remote CI on the PR
+is the authoritative gate; run-end report says *"quality gates
+delegated to remote CI"*, never that the tools passed. When
+`local_auto_run: true`, **when** the local pipeline runs during
 `/roadmap:process-step|phase|full` is governed by
 `roadmap.quality_cadence` in `.agent-settings.yml`
 (`end_of_roadmap` default → once before archival; `per_phase` → after
-every phase; `per_step` → after every step). Either way, a final fresh
-run is mandatory before "complete" per `verify-before-complete`.
+every phase; `per_step` → after every step), with a final fresh run
+before "complete" per `verify-before-complete`.
 
 Common commands:
 

package/dist/agent-src/templates/rule.md

@@ -22,9 +22,9 @@ consumer's `.augment/`.
 
 Use **logical names** rooted at the source — never the
 `.agent-src.uncondensed/` prefix. The condense-time rewriter
-(`scripts/condense.py::_rewrite_paths`) resolves logical names to
+(`scripts/condense.ts::_rewrite_paths`) resolves logical names to
 deployment-correct relative paths; the schema regex
-(`scripts/schemas/rule.schema.json`) and `scripts/lint_load_context.py`
+(`scripts/schemas/rule.schema.json`) and `scripts/lint_load_context.ts`
 both reject the legacy prefix.
 
 | Write this (logical) | Forbidden (legacy) |
@@ -121,7 +121,7 @@ for full detail; rules are pointers, not playbooks.}
 | `tier` | yes | `kernel` (Iron Law floor), `tier-1` (default), `tier-2` (full profile only). Legacy values still accepted. |
 | `description` | yes | One sentence, ≤ 500 chars. Trigger-clarity wins over poetry. |
 | `source` | yes | `package` (this repo) or `project` (consumer override). |
-| `load_context` | no | Lazy context list — logical names only. Budget enforced by `lint_load_context.py`. |
+| `load_context` | no | Lazy context list — logical names only. Budget enforced by `lint_load_context.ts`. |
 | `load_context_eager` | no | Eager context list — counts against per-rule char budget. |
 | `triggers` | no | Required on non-kernel rules per `rule-router.md`. |
 | `routes_to` | no | `skill:`, `guideline:`, `command:`, `contract:` targets. Forbidden on kernel rules. |

package/dist/agent-src/templates/scripts/README.md

@@ -18,8 +18,8 @@ high-risk PRs.
 | File in package | Copy to | Purpose |
 |---|---|---|
 | `templates/github-workflows/pr-risk-review.yml` | `.github/workflows/pr-risk-review.yml` | GitHub Actions workflow |
-| `templates/scripts/pr_risk_review.ts` | `scripts/pr_risk_review.py` | Risk classifier (Python 3.10+, PyYAML) |
-| `templates/scripts/pr_review_routing.ts` | `scripts/pr_review_routing.py` | Routing classifier |
+| `templates/scripts/pr_risk_review.ts` | `scripts/pr_risk_review.ts` | Risk classifier (TypeScript, run via tsx) |
+| `templates/scripts/pr_review_routing.ts` | `scripts/pr_review_routing.ts` | Routing classifier |
 | `templates/scripts/pr-risk-config.example.yml` | `.github/pr-risk-config.yml` | Risk patterns (optional) |
 | `templates/scripts/ownership-map.example.yml` | `.github/ownership-map.yml` | Ownership entries (optional) |
 | `templates/scripts/historical-bug-patterns.example.yml` | `.github/historical-bug-patterns.yml` | Registered failure modes (optional) |
@@ -37,7 +37,7 @@ cp .augment/templates/scripts/historical-bug-patterns.example.yml .github/histor
 ```
 
 The routing step in the workflow is **conditional** — it only runs if
-`scripts/pr_review_routing.py` exists, so risk classification alone works
+`scripts/pr_review_routing.ts` exists, so risk classification alone works
 without routing being installed.
 
 Create the three labels once (or let them be auto-created on first run):
@@ -118,8 +118,8 @@ the full schema.
 
 ```bash
 rm .github/workflows/pr-risk-review.yml
-rm scripts/pr_risk_review.py
-rm scripts/pr_review_routing.py
+rm scripts/pr_risk_review.ts
+rm scripts/pr_review_routing.ts
 rm .github/pr-risk-config.yml .github/ownership-map.yml .github/historical-bug-patterns.yml
 gh label delete risk:low risk:medium risk:high
 ```
@@ -168,7 +168,7 @@ PRs.
 | File in package | Copy to | Purpose |
 |---|---|---|
 | `templates/github-workflows/memory-hygiene.yml` | `.github/workflows/memory-hygiene.yml` | Weekly staleness workflow |
-| `templates/scripts/check_memory.ts` | `scripts/check_memory.py` | YAML schema + staleness validator |
+| `templates/scripts/check_memory.ts` | `scripts/check_memory.ts` | YAML schema + staleness validator |
 
 ## Install
 

package/dist/agent-src/templates/scripts/check_memory.ts

@@ -53,7 +53,7 @@ import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import YAML, { parseDocument } from 'yaml';
 
 type Severity = 'error' | 'warning' | 'info';
@@ -631,8 +631,30 @@ function _emit(findings: Finding[], fmt: string): number {
     return errors.length > 0 ? 1 : 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/check_memory_proposal.ts

@@ -332,10 +332,29 @@ function _set_intake_root_for_test(root: string): void {
     INTAKE_ROOT = root;
 }
 
-const _isCliEntry =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
-if (_isCliEntry || process.argv[1] === _HERE) {
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry() || process.argv[1] === _HERE) {
     process.exit(main());
 }
 

package/dist/agent-src/templates/scripts/historical-bug-patterns.example.yml

@@ -1,4 +1,4 @@
-# Historical bug patterns — consumed by scripts/pr_review_routing.py
+# Historical bug patterns — consumed by scripts/pr_review_routing.ts
 #
 # Copy this file to `.github/historical-bug-patterns.yml` (preferred) or
 # `agents/historical-bug-patterns.yml` and curate the patterns from your

package/dist/agent-src/templates/scripts/memory_hash.ts

@@ -28,7 +28,7 @@
 import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 import YAML, { parseDocument } from 'yaml';
 
@@ -326,8 +326,30 @@ function _parseArgs(argv: string[]): ParsedArgs {
     return args;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/memory_lookup.ts

@@ -33,7 +33,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import YAML, { parseDocument } from 'yaml';
 
 
@@ -1060,8 +1060,30 @@ function _escapeNonAscii(s: string): string {
     return out;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/memory_report.ts

@@ -30,7 +30,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import YAML, { parseDocument } from 'yaml';
 
 import * as memory_status from './memory_status.js';
@@ -839,8 +839,30 @@ export function main(): number {
     return 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }