@event4u/agent-config 8.1.0 → 8.3.0

package/dist/agent-src/templates/scripts/memory_signal.ts

@@ -31,7 +31,7 @@ import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 // Mutable so tests can repoint at a tmp tree (monkeypatch parity).
 export let INTAKE_ROOT = path.join('agents', 'memory', 'intake');
@@ -415,8 +415,30 @@ export function main(): number {
     return 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/memory_status.ts

@@ -22,7 +22,9 @@
  */
 
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 // Retrieval contract version served by the file-backed backend.
 // Source of truth: internal/schemas/retrieval-v1.schema.json.
@@ -176,8 +178,30 @@ export function main(): number {
     return 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+    _isCliEntry();
 if (_isMain) {
     try {
         process.exitCode = main();

package/dist/agent-src/templates/scripts/ownership-map.example.yml

@@ -1,4 +1,4 @@
-# Ownership map — consumed by scripts/pr_review_routing.py
+# Ownership map — consumed by scripts/pr_review_routing.ts
 #
 # Copy this file to `.github/ownership-map.yml` (preferred) or
 # `agents/ownership-map.yml` and adapt the entries to your stack.

package/dist/agent-src/templates/scripts/pr-risk-config.example.yml

@@ -1,4 +1,4 @@
-# PR risk config — consumed by scripts/pr_risk_review.py
+# PR risk config — consumed by scripts/pr_risk_review.ts
 #
 # Copy this file to `.github/pr-risk-config.yml` and adapt the patterns to
 # your stack. Omitting the file entirely is fine — the script ships with

package/dist/agent-src/templates/scripts/pr_review_routing.ts

@@ -27,7 +27,7 @@ import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import * as fs from 'node:fs';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 import type * as YamlModule from 'yaml';
 
@@ -515,9 +515,30 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     return 0;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }

package/dist/agent-src/templates/scripts/telemetry_record.ts

@@ -15,7 +15,7 @@
  */
 import * as fs from 'node:fs';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 
 import { record_event } from './telemetry/boundary.js';
@@ -247,9 +247,30 @@ function _osErr(exc: unknown): string {
     return exc instanceof Error ? exc.message : String(exc);
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }

package/dist/agent-src/templates/scripts/telemetry_report.ts

@@ -11,7 +11,8 @@
  *       failure on a row sourced from the log
  */
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import * as fs from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 
 import { aggregate } from './telemetry/aggregator.js';
@@ -181,9 +182,30 @@ function _osErr(exc: unknown): string {
     return exc instanceof Error ? exc.message : String(exc);
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }

package/dist/agent-src/templates/scripts/telemetry_status.ts

@@ -8,7 +8,7 @@
  */
 import * as fs from 'node:fs';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 
 import { EngagementSchemaError, parse_event } from './telemetry/engagement.js';
@@ -304,9 +304,30 @@ function _pyJsonStringAscii(s: string): string {
     return `${out}"`;
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _invokedDirectly =
-    process.argv[1] !== undefined &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_invokedDirectly) {
     process.exitCode = main();
 }

package/dist/agent-src/templates/scripts/tier_usage_report.ts

@@ -43,7 +43,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parse as parseYaml } from 'yaml';
 
 // Contract whitelist (see `docs/contracts/command-clusters.md`).
@@ -590,8 +590,30 @@ function _osErrorMessage(exc: unknown, log_path: string): string {
     return err && err.message ? err.message : String(exc);
 }
 
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
 const _isMain =
-    process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+    _isCliEntry();
 if (_isMain) {
     process.exit(main());
 }

package/dist/agent-src/templates/scripts/work_engine/_lib/agent_settings.ts

@@ -1131,18 +1131,36 @@ function _posix_join(a: string, b: string): string {
 
 export type DisciplineProfile = 'off' | 'essential' | 'full' | 'custom';
 
+export type LiftDefault = 'lift_enabled' | 'lift_disabled';
+
 export interface HostCapabilities {
     /** Models with a MEASURED null discipline lift (prefix-matched ids). */
     lift_disabled_models: string[];
-    /** Resolution for unmatched/unknown models. Fail-safe: lift_enabled. */
-    unknown_default: 'lift_enabled' | 'lift_disabled';
+    /**
+     * Resolution for UNMEASURED models, per vendor family (P2-verdict
+     * council 2026-07-07): keys are family names plus a required `default`.
+     * Evidence-structure granularity — anthropic keeps the fail-safe toward
+     * the one measured lift; everything else defaults off after the failed
+     * GPT-weak replication.
+     */
+    unknown_defaults: Record<string, LiftDefault> & { default: LiftDefault };
 }
 
 const _CAPABILITIES_FALLBACK: HostCapabilities = {
     lift_disabled_models: [],
-    unknown_default: 'lift_enabled',
+    // File missing/unreadable → mirror the SHIPPED yml (anthropic enabled,
+    // rest disabled) so a broken read never silently widens the lift.
+    unknown_defaults: { anthropic: 'lift_enabled', default: 'lift_disabled' },
 };
 
+/** Map a session model id onto a vendor family for unknown_defaults. */
+export function vendor_family(model_id: string | null): string {
+    if (!model_id) {
+        return 'default';
+    }
+    return model_id.trim().toLowerCase().startsWith('claude-') ? 'anthropic' : 'default';
+}
+
 /**
  * Load `host-capabilities.yml` — tolerant like every settings read: a
  * missing / unreadable / malformed file resolves to the fail-safe fallback
@@ -1167,8 +1185,22 @@ export function load_host_capabilities(p: string): HostCapabilities {
             }
         }
     }
-    const unknown = raw['unknown_default'] === 'lift_disabled' ? 'lift_disabled' : 'lift_enabled';
-    return { lift_disabled_models: ids, unknown_default: unknown };
+    const unknown_defaults: Record<string, 'lift_enabled' | 'lift_disabled'> & {
+        default: 'lift_enabled' | 'lift_disabled';
+    } = { ..._CAPABILITIES_FALLBACK.unknown_defaults };
+    const granular = raw['unknown_defaults'];
+    if (_is_plain_dict(granular)) {
+        for (const [family, value] of Object.entries(granular)) {
+            if (value === 'lift_enabled' || value === 'lift_disabled') {
+                unknown_defaults[family] = value;
+            }
+        }
+    } else if (raw['unknown_default'] === 'lift_disabled' || raw['unknown_default'] === 'lift_enabled') {
+        // Legacy single-value key (pre-P2 files) maps onto the blanket default.
+        unknown_defaults['default'] = raw['unknown_default'];
+        unknown_defaults['anthropic'] = raw['unknown_default'];
+    }
+    return { lift_disabled_models: ids, unknown_defaults };
 }
 
 /** Prefix match a session model id against the measured disable-list. */
@@ -1187,10 +1219,10 @@ export function is_lift_disabled_model(model_id: string | null, caps: HostCapabi
  * `rule_loading_tier` mapping (minimal→off, balanced→essential, full→full,
  * custom→custom); both absent → `essential` (the successor of the
  * documented `balanced` default). `auto` resolves against the capabilities:
- * measured NULL-lift model → `off`; anything else — including an unknown or
- * missing model id — → `essential` under `lift_enabled` (fail-safe: never
- * silently drop the measured lift on a possibly-weak host) or `off` under
- * `lift_disabled`.
+ * measured NULL-lift model → `off`; unmeasured models resolve per
+ * `unknown_defaults[vendor_family(model_id)]` (anthropic → essential, the
+ * one family with a measured lift; everything else — including a missing
+ * model id — → off, per the failed P2 replication).
  *
  * Pure function — callers pass the merged settings dict, the session model
  * id (null when the host does not expose one), and the loaded capabilities.
@@ -1208,7 +1240,9 @@ export function resolve_discipline_profile(
         if (is_lift_disabled_model(model_id, caps)) {
             return 'off';
         }
-        return caps.unknown_default === 'lift_disabled' ? 'off' : 'essential';
+        const family = vendor_family(model_id);
+        const fallback = caps.unknown_defaults[family] ?? caps.unknown_defaults['default'];
+        return fallback === 'lift_disabled' ? 'off' : 'essential';
     }
     const legacy = settings['rule_loading_tier'];
     if (legacy === 'minimal') {

package/dist/agent-src/templates/scripts/work_engine/hooks/builtin/_chat_history_base.ts

@@ -11,6 +11,7 @@ import { spawnSync, type SpawnSyncReturns } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as process from 'node:process';
+import { fileURLToPath } from 'node:url';
 
 /**
  * Subset of Python's `subprocess.CompletedProcess[str]` the hooks read:
@@ -56,21 +57,33 @@ export function _default_runner(cmd: string[]): CompletedProcess {
 export function _resolve_chat_history_invocation(script_path: string): string[] {
     const tsScript = script_path.replace(/\.py$/, '.ts');
     const binName = process.platform === 'win32' ? 'tsx.cmd' : 'tsx';
-    let dir = path.dirname(path.resolve(tsScript));
-    for (;;) {
-        const candidate = path.join(dir, 'node_modules', '.bin', binName);
-        try {
-            if (fs.statSync(candidate).isFile()) {
-                return [candidate, tsScript];
+    const walkUp = (start: string): string | null => {
+        let dir = start;
+        for (;;) {
+            const candidate = path.join(dir, 'node_modules', '.bin', binName);
+            try {
+                if (fs.statSync(candidate).isFile()) {
+                    return candidate;
+                }
+            } catch {
+                // not here — keep walking up.
             }
-        } catch {
-            // not here — keep walking up.
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir) {
-            break;
+            const parent = path.dirname(dir);
+            if (parent === dir) {
+                return null;
+            }
+            dir = parent;
         }
-        dir = parent;
+    };
+    // Script's tree first, then THIS module's package tree (the package
+    // ships tsx as a runtime dependency). `npx tsx` stays last-resort only:
+    // it runs against the consumer's npm config and fails hard on e.g.
+    // devEngines pins (the 8.1.0 EBADDEVENGINES regression).
+    const tsx =
+        walkUp(path.dirname(path.resolve(tsScript))) ??
+        walkUp(path.dirname(fileURLToPath(import.meta.url)));
+    if (tsx !== null) {
+        return [tsx, tsScript];
     }
     return ['npx', 'tsx', tsScript];
 }

package/dist/agent-src/templates/skill.md

@@ -139,7 +139,7 @@ Do NOT use when:
 <!-- FRUGALITY STANDARDS (writer skills only — REQUIRED for skills whose
   name ends in `-writing`, `-authoring`, or `-create`, AND for any
   skill on the `FRUGALITY_WRITER_SKILLS` allowlist in
-  `scripts/skill_linter.py`. Mid-/untiered non-writer skills MUST
+  `scripts/skill_linter.ts`. Mid-/untiered non-writer skills MUST
   remove this section entirely.
 
   Layer-1 of the linter checks for:
@@ -173,7 +173,7 @@ Do NOT use when:
   blocks per `.agent-src.uncondensed/rules/skill-quality.md` §
   Senior-Tier Required Structure. Mid-tier and untiered skills MUST
   remove this section entirely. The four blocks are enforced by
-  `scripts/skill_linter.py` for `tier: senior` skills only.
+  `scripts/skill_linter.ts` for `tier: senior` skills only.
 
   ## Related Skills
 

package/dist/cli/python/knowledge_ingest.js

@@ -74,7 +74,7 @@ import { spawnSync } from 'node:child_process';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import process from 'node:process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as workspace_secrets from './workspace_secrets.js';
 // --- Bounds (contract §Bounds) ---------------------------------------------
 export const KNOWLEDGE_ROOT = path.join('agents', 'memory', 'knowledge');
@@ -1030,8 +1030,29 @@ export function _cli(argv = null) {
     }
     return 1;
 }
-const _isMain = typeof process.argv[1] === 'string' &&
-    import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+function _isCliEntry() {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    // A symlinked invocation (e.g. via an installed `.augment/` projection,
+    // or macOS /var → /private/var temp dirs) makes the raw URLs differ:
+    // import.meta.url is the resolved real path while argv[1] keeps the
+    // symlink path. Compare realpaths so the entry guard still fires
+    // (without this the CLI silently no-ops when run through a symlink).
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    }
+    catch {
+        return false;
+    }
+}
+const _isMain = _isCliEntry();
 if (_isMain) {
     try {
         process.exitCode = _cli();