@event4u/agent-config 9.12.0 → 9.13.0

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-08-01T06:24:46Z`
+- Generated: `2026-08-02T08:46:05Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 
@@ -10,7 +10,7 @@
 |---|---|---|---|---|---|
 | `agent-config-maintainer` | 317 | 0 | 3 | 0 | 0 |
 | `construction` | 25 | 0 | 0 | 0 | 0 |
-| `engineering` | 178 | 62 | 3 | 0 | 0 |
+| `engineering` | 179 | 62 | 3 | 0 | 0 |
 | `finance` | 28 | 4 | 0 | 1 | 0 |
 | `founder` | 32 | 0 | 1 | 1 | 0 |
 | `gtm` | 30 | 13 | 1 | 0 | 0 |

package/dist/discovery/workspaces.json

@@ -1,10 +1,10 @@
 {
-  "checksum": "sha256:335f47a33f49c3f6151d562ba524c3082e4e15055cc97b6f89e5170e507890df",
-  "generated_at": "2026-08-01T06:24:46Z",
+  "checksum": "sha256:74659b35e73b3393f9513080eef4952f14c11925462a587d1dec82af830345d8",
+  "generated_at": "2026-08-02T08:46:05Z",
   "scanner_version": "c24312e116f8",
   "workspaces": [
     {
-      "artefact_count": 198,
+      "artefact_count": 199,
       "default_packs": [
         "engineering-base",
         "git"
@@ -29,7 +29,7 @@
       ],
       "packs": [
         {
-          "artefact_count": 116,
+          "artefact_count": 117,
           "artefacts": [
             "src/domains/engineering-base/mission/upgrade/command.md",
             "src/rules/active-remediation.md",
@@ -108,6 +108,7 @@
             "src/skills/mobile-e2e-strategy/SKILL.md",
             "src/skills/multi-tenancy/SKILL.md",
             "src/skills/openapi/SKILL.md",
+            "src/skills/overbuild-review-lens/SKILL.md",
             "src/skills/performance-analysis/SKILL.md",
             "src/skills/performance/SKILL.md",
             "src/skills/playwright-architect/SKILL.md",

package/dist/hooks/dispatch.js

@@ -17175,6 +17175,27 @@ var _SHELL_SEPARATORS = /* @__PURE__ */ new Set(["&&", "||", ";", "|"]);
 var _NO_VERIFY_FLAGS = /* @__PURE__ */ new Set(["--no-verify"]);
 var _NO_VERIFY_SHORT = /* @__PURE__ */ new Set(["-n"]);
 var _HOOKS_PATH_RE = /^core\.hooksPath\s*=/i;
+var _HOOKS_PATH_KEY_RE = /^core\.hooksPath$/i;
+var _GIT_GLOBAL_OPTS_WITH_VALUE = /* @__PURE__ */ new Set([
+  "-C",
+  "-c",
+  "--config",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--exec-path",
+  "--super-prefix"
+]);
+var _CONFIG_READ_OR_RESTORE = /* @__PURE__ */ new Set([
+  "--get",
+  "--get-all",
+  "--get-regexp",
+  "--get-urlmatch",
+  "--list",
+  "-l",
+  "--unset",
+  "--unset-all"
+]);
 var ShlexError = class extends Error {
 };
 function shlexSplit(s) {
@@ -17285,7 +17306,53 @@ function _git_base(tokens) {
   }
   return null;
 }
+function _is_config_hookspath_write(git_tokens) {
+  const rest = git_tokens.slice(1);
+  let subIdx = -1;
+  for (let k = 0; k < rest.length; k += 1) {
+    const tok = rest[k];
+    if (!tok.startsWith("-")) {
+      subIdx = k;
+      break;
+    }
+    if (_GIT_GLOBAL_OPTS_WITH_VALUE.has(tok)) {
+      k += 1;
+    }
+  }
+  if (subIdx === -1 || rest[subIdx] !== "config") {
+    return [false, ""];
+  }
+  const args = rest.slice(subIdx + 1);
+  if (args.some((t) => _CONFIG_READ_OR_RESTORE.has(t))) {
+    return [false, ""];
+  }
+  for (let k = 0; k < args.length; k += 1) {
+    const tok = args[k];
+    if (_HOOKS_PATH_RE.test(tok)) {
+      return [
+        true,
+        `'git config ${tok}' disables git hooks via hooksPath (git-history-discipline)`
+      ];
+    }
+    if (!_HOOKS_PATH_KEY_RE.test(tok)) {
+      continue;
+    }
+    const next = args.slice(k + 1).find((t) => !t.startsWith("-"));
+    if (next !== void 0) {
+      return [
+        true,
+        `'git config ${tok} ${next}' disables git hooks via hooksPath (git-history-discipline)`
+      ];
+    }
+    return [false, ""];
+  }
+  return [false, ""];
+}
 function _is_blocked(git_tokens) {
+  const [cfgBlocked, cfgReason] = _is_config_hookspath_write(git_tokens);
+  if (cfgBlocked) {
+    return [cfgBlocked, cfgReason];
+  }
   let i = 1;
   while (i < git_tokens.length) {
     const tok = git_tokens[i];
@@ -17554,32 +17621,126 @@ function targets_kernel_rule(filePath) {
   if (segments.length === 0) {
     return null;
   }
-  const basename5 = segments[segments.length - 1];
-  if (!is_kernel_rule(basename5)) {
+  const basename6 = segments[segments.length - 1];
+  if (!is_kernel_rule(basename6)) {
     return null;
   }
   const dirSegments = segments.slice(0, -1);
   if (!dirSegments.includes("rules")) {
     return null;
   }
-  return basename5.replace(/\.md$/, "");
+  return basename6.replace(/\.md$/, "");
+}
+var _MUTATOR_VERBS = /* @__PURE__ */ new Set([
+  "sed",
+  "tee",
+  "truncate",
+  "rm",
+  "shred"
+]);
+var _DEST_LAST_VERBS = /* @__PURE__ */ new Set(["mv", "cp", "install", "rsync"]);
+function _bash_targets_kernel_rule(command) {
+  const tokens = command.split(/\s+/).filter((t) => t.length > 0);
+  const stripped = tokens.map((t) => t.replace(/^['"]|['"]$/g, ""));
+  const ruleOf = (t) => targets_kernel_rule(t);
+  if (!stripped.some((t) => ruleOf(t) !== null)) {
+    return null;
+  }
+  for (let i = 0; i < stripped.length; i += 1) {
+    const tok = stripped[i];
+    const inline = /^>{1,2}(.+)$/.exec(tok);
+    if (inline) {
+      const r = ruleOf(inline[1]);
+      if (r !== null) {
+        return r;
+      }
+    }
+    if (tok === ">" || tok === ">>") {
+      const next = stripped[i + 1];
+      if (typeof next === "string") {
+        const r = ruleOf(next);
+        if (r !== null) {
+          return r;
+        }
+      }
+    }
+  }
+  const verbs = /* @__PURE__ */ new Set();
+  let prevWasSeparator = true;
+  for (const tok of stripped) {
+    if (["&&", "||", ";", "|"].includes(tok)) {
+      prevWasSeparator = true;
+      continue;
+    }
+    if (prevWasSeparator && !tok.startsWith("-")) {
+      verbs.add(path32.basename(tok));
+      prevWasSeparator = false;
+    }
+  }
+  const sedInPlace = verbs.has("sed") && stripped.some((t) => /^-i/.test(t));
+  for (const verb of verbs) {
+    if (verb === "sed" && !sedInPlace) {
+      continue;
+    }
+    if (_MUTATOR_VERBS.has(verb)) {
+      const hit = stripped.map(ruleOf).find((r) => r !== null);
+      if (hit !== void 0 && hit !== null) {
+        return hit;
+      }
+    }
+    if (_DEST_LAST_VERBS.has(verb)) {
+      const last = stripped[stripped.length - 1];
+      const r = ruleOf(last);
+      if (r !== null) {
+        return r;
+      }
+    }
+  }
+  return null;
 }
 function check_envelope(envelope) {
   const { tool, paths } = _extract(envelope);
-  if (!tool || !EDIT_TOOLS.has(tool)) {
+  if (!tool) {
     return [false, ""];
   }
-  for (const p of paths) {
-    const ruleName = targets_kernel_rule(p);
-    if (ruleName !== null) {
-      return [
-        true,
-        `kernel rule ${ruleName} is immutable \u2014 tighten-only via the override exception registry; see docs/contracts/kernel-membership.md`
-      ];
+  const deny = (ruleName) => [
+    true,
+    `kernel rule ${ruleName} is immutable \u2014 tighten-only via the override exception registry; see docs/contracts/kernel-membership.md`
+  ];
+  if (EDIT_TOOLS.has(tool)) {
+    for (const p of paths) {
+      const ruleName = targets_kernel_rule(p);
+      if (ruleName !== null) {
+        return deny(ruleName);
+      }
+    }
+    return [false, ""];
+  }
+  if (COMMAND_TOOLS.has(tool)) {
+    const cmd = _extract_command3(envelope);
+    if (cmd !== null) {
+      const ruleName = _bash_targets_kernel_rule(cmd);
+      if (ruleName !== null) {
+        return deny(ruleName);
+      }
     }
   }
   return [false, ""];
 }
+function _extract_command3(envelope) {
+  const payload = _isObject6(envelope["payload"]) ? envelope["payload"] : envelope;
+  const ti = _isObject6(payload["tool_input"]) ? payload["tool_input"] : _isObject6(envelope["tool_input"]) ? envelope["tool_input"] : null;
+  for (const src of [ti, payload]) {
+    if (src === null) {
+      continue;
+    }
+    const v = src["command"];
+    if (typeof v === "string" && v) {
+      return v;
+    }
+  }
+  return null;
+}
 function _asObject2(v) {
   return _isObject6(v) ? v : null;
 }
@@ -17833,7 +17994,7 @@ function rtk_available(env = process.env) {
   }
   return false;
 }
-function _extract_command3(envelope) {
+function _extract_command4(envelope) {
   const payload = _isObject7(envelope["payload"]) ? envelope["payload"] : {};
   const tool_input = _isObject7(payload["tool_input"]) ? payload["tool_input"] : {};
   for (const src of [tool_input["command"], payload["command"], envelope["command"]]) {
@@ -17886,7 +18047,7 @@ function main24() {
   if (!_enabled2(root)) return EXIT_ALLOW5;
   if (!rtk_available()) return EXIT_ALLOW5;
   if (detectRtkCached().identity !== "token-killer") return EXIT_ALLOW5;
-  const command = _extract_command3(envelope);
+  const command = _extract_command4(envelope);
   if (!command) return EXIT_ALLOW5;
   const verdict = classify(command);
   if (!verdict.eligible) return EXIT_ALLOW5;

package/dist/mcp/registry-manifest.json

@@ -1,15 +1,15 @@
 {
   "discovery": {
-    "artefact_count": 592,
+    "artefact_count": 593,
     "scanner_version": "c24312e116f8"
   },
-  "generated_at": "2026-08-01",
+  "generated_at": "2026-08-02",
   "package": {
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) \u2014 every claim machine-checked, including \"zero runtime daemon\".",
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "9.12.0"
+    "version": "9.13.0"
   },
   "registries": [
     {

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "9.12.0"
+      "version": "9.13.0"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "9.12.0"
+  "version": "9.13.0"
 }