@event4u/agent-config 9.35.0 → 10.0.0

package/src/scripts/_lib/ui_surface.ts

@@ -0,0 +1,97 @@
+/**
+ * ui_surface — the ONE definition of "this path is a UI surface".
+ *
+ * Three consumers need the same answer and were about to disagree about it:
+ * the anti-slop PreToolUse hook (which had the only copy), the UI-turn
+ * definition the catalogue analyzer counts against, and the route nudge.
+ * A UI-turn rate measured against one extension set and a nudge fired against
+ * another would produce a consultation rate that no fix could ever move,
+ * because the denominator and the trigger would be different populations.
+ *
+ * `.blade.php` is deliberately part of the set and was absent from the hook's
+ * original regex: a two-part extension does not match a `\.(…)$` alternation,
+ * so every Blade template — the single largest UI surface in a Laravel
+ * consumer — read as a non-UI file. That is why `isUiPath` matches on the
+ * path tail rather than on `path.extname`, which returns `.php` for
+ * `page.blade.php` and would silently reproduce the same hole.
+ */
+
+/** Single-segment UI extensions, without the leading dot. */
+export const UI_EXTENSIONS = [
+    'html',
+    'htm',
+    'css',
+    'scss',
+    'sass',
+    'less',
+    'vue',
+    'svelte',
+    'astro',
+    'jsx',
+    'tsx',
+] as const;
+
+/**
+ * Multi-segment UI suffixes. These cannot be expressed as an extension
+ * alternation — `path.extname('x.blade.php')` is `.php`.
+ */
+export const UI_COMPOUND_SUFFIXES = ['.blade.php'] as const;
+
+/** Equivalent to the historical hook regex, plus the compound suffixes. */
+export const UI_EXT = new RegExp(
+    `(\\.(${UI_EXTENSIONS.join('|')})|${UI_COMPOUND_SUFFIXES.map((s) => s.replace(/\./g, '\\.')).join('|')})$`,
+    'i',
+);
+
+/** True when `p` names a file on a UI surface. Case-insensitive. */
+export function isUiPath(p: string): boolean {
+    return UI_EXT.test(p);
+}
+
+/**
+ * Directory fragments that mark a UI tree across frameworks. The two UI rules
+ * carried only the Laravel pair (`resources/views/`, `resources/js/`), so a
+ * React, Vue, Next or Svelte consumer writing to `src/components/` matched no
+ * path trigger at all. Kept as fragments, not anchored prefixes: a consumer's
+ * UI tree is rarely at the repo root.
+ *
+ * `app/` is deliberately NOT in this list although it is the Next.js router
+ * directory. In a Laravel consumer `app/` is the entire backend, so the
+ * fragment would fire on every controller, model and job — a trigger that
+ * over-fires on the largest directory of a whole ecosystem is worse than the
+ * gap it closes. Next.js route files are caught by extension instead
+ * (`page.tsx`, `layout.tsx` match `isUiPath`), which is the precise signal.
+ */
+export const UI_PATH_FRAGMENTS = [
+    'resources/views/',
+    'resources/js/',
+    // `components/` already subsumes `src/components/` under substring
+    // matching — listing both here would be dead weight. The rules' own
+    // `path_prefix` list keeps both because matching there is anchored.
+    'components/',
+    'pages/',
+] as const;
+
+/**
+ * Fragments that sit INSIDE a UI tree and are not UI. Checked first, because a
+ * substring fragment cannot express "pages/ but not pages/api/" on its own —
+ * and `pages/api/` is server-only Next.js code, the exact over-fire the `app/`
+ * exclusion above exists to avoid. Leaving it in would have put backend files
+ * in the pre-registered UI-turn denominator, which is worse than the nudge
+ * firing on them: a rate is harder to un-break than a warning.
+ */
+export const UI_TREE_EXCLUSIONS = ['pages/api/'] as const;
+
+/**
+ * True when `p` sits inside a conventional UI tree.
+ *
+ * Note this does NOT require a UI extension — that is the point: a `.js` file
+ * under `resources/js/` is UI. The cost is that a non-code file in a UI tree
+ * (a README, a fixture) also matches; callers that need the narrower answer
+ * combine this with `isUiPath`.
+ */
+export function isUiTreePath(p: string): boolean {
+    const normalized = p.replace(/\\/g, '/').toLowerCase();
+    if (UI_TREE_EXCLUSIONS.some((fragment) => normalized.includes(fragment))) return false;
+    return UI_PATH_FRAGMENTS.some((fragment) => normalized.includes(fragment));
+}

package/src/scripts/ai_council/config.ts

@@ -639,6 +639,20 @@ export interface CouncilConfig {
     readonly low_impact: LowImpactConfig;
     readonly lens_overrides: LensOverridesConfig;
     readonly source_path: PathLike | null;
+    /**
+     * Transport keys the config file still carries and the loader deliberately
+     * IGNORED — dotted paths, e.g. `defaults.mode`, `members.anthropic.mode`.
+     *
+     * Transport is resolved per machine per invocation, never configured: the
+     * chain is `cli → api → unavailable`, and an airgapped host forces the
+     * `api` rung. Deleting the keys from the schema outright would have made
+     * every pre-existing installation fail to load, so a stale key is
+     * accepted, ignored, and reported once — the migration IS the ignore.
+     *
+     * Empty on a config that never carried one, which is the shape the current
+     * template ships.
+     */
+    readonly ignored_transport_keys: readonly string[];
 }
 
 // ── default factories (dataclass defaults) ─────────────────────────
@@ -796,7 +810,11 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
         throw new CouncilConfigError('`enabled` must be a bool.');
     }
 
-    const defaults = _build_defaults(_asDict(_getOr(raw, 'defaults', {})));
+    const ignored_transport_keys: string[] = [];
+    const defaults = _build_defaults(
+        _asDict(_getOr(raw, 'defaults', {})),
+        ignored_transport_keys,
+    );
     const cost_budget = _build_cost_budget(
         _asDict(_getOr(raw, 'cost_budget', {})),
     );
@@ -809,7 +827,12 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
     for (const [name, cfg] of Object.entries(members_raw)) {
         members.set(
             name,
-            _build_member(name, _asDict(_orEmpty(cfg)), defaults.mode),
+            _build_member(
+                name,
+                _asDict(_orEmpty(cfg)),
+                defaults.mode,
+                ignored_transport_keys,
+            ),
         );
     }
 
@@ -920,6 +943,7 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
         low_impact,
         lens_overrides,
         source_path,
+        ignored_transport_keys,
     };
 }
 
@@ -1508,23 +1532,36 @@ function _build_consensus_scoring(d: Dict): ConsensusScoringConfig {
 
 const _VALID_MEMBER_MODES: ReadonlySet<string> = new Set(['cli', 'api']);
 
-function _build_defaults(d: Dict): DefaultsConfig {
+function _build_defaults(d: Dict, ignored: string[] = []): DefaultsConfig {
     if (!_isDict(d)) {
         throw new CouncilConfigError('`defaults` must be a mapping.');
     }
-    // road-to-always-on-orchestration Phase 3.1: CLI-first is the shipped
-    // default (was `api`) — see the module docstring rule 2. `manual` and a
-    // pinned `api`/`cli` remain valid overrides at every layer resolve_mode
-    // checks; this only changes what a config that never sets `mode` gets.
-    const mode = _get(d, 'mode', 'auto');
-    if (!(_isStr(mode) && _VALID_MODES.has(mode))) {
-        throw new CouncilConfigError(
-            `defaults.mode=${_pyRepr(mode)} not in ${_sortedListRepr(_VALID_MODES)}.`,
-        );
-    }
+    // Transport is RESOLVED, never configured.
+    //
+    // The CLI-first flip (road-to-always-on-orchestration Phase 3.1) changed
+    // only what a config that OMITS `mode` receives. Every installation that
+    // spelled the key out — which the wizard did, and which every pre-flip
+    // template shipped — kept its old `api` value forever, silently, and went
+    // on paying per token while a subscription CLI sat unused on the same
+    // machine. A default that only fires on an absent key does not migrate
+    // anybody; it just makes the docs read better than the behaviour.
+    //
+    // So the key is no longer read. `auto` is the only value this loader
+    // produces, and `transport_resolver` picks the concrete rung per machine
+    // per invocation (`cli → api → unavailable`, airgap forcing `api`). A file
+    // still carrying `mode:` loads fine and is reported via
+    // `ignored_transport_keys` — see `CouncilConfig`.
+    // `null` as the sentinel, not `undefined`: `_get`'s default parameter is
+    // typed `Json`, which excludes `undefined`. A config spelling `mode: null`
+    // is indistinguishable from an absent key here, and that is correct — a
+    // null transport is not a pin worth reporting.
+    if (_get(d, 'mode', null) !== null) {
+        ignored.push('defaults.mode');
+    }
+    const mode = 'auto';
     // `member_mode` (step-9 P8 · U1) — global preference for solo /
-    // CLI-mode invocations. Narrower set than `defaults.mode` because
-    // `manual` makes no sense as a per-member dispatch default.
+    // CLI-mode invocations. Narrower set than the retired `defaults.mode`
+    // because `manual` makes no sense as a per-member dispatch default.
     const member_mode = _get(d, 'member_mode', 'cli');
     if (!(_isStr(member_mode) && _VALID_MEMBER_MODES.has(member_mode))) {
         throw new CouncilConfigError(
@@ -1726,6 +1763,7 @@ function _build_member(
     // a future caller that omits the third argument observes the same
     // doctrine rather than silently reverting to the retired `api` default.
     default_mode = 'auto',
+    ignored: string[] = [],
 ): MemberConfig {
     if (!_VALID_PROVIDERS.has(name)) {
         throw new CouncilConfigError(
@@ -1738,15 +1776,15 @@ function _build_member(
     const model = _pyTruthy(modelVal) ? (modelVal as string) : '';
     const api_key_ref_raw = _get(cfg, 'api_key_ref', null);
     const api_key_ref = api_key_ref_raw === undefined ? null : api_key_ref_raw;
-    const member_mode_raw = _get(cfg, 'mode', null);
-    const member_mode = member_mode_raw === undefined ? null : member_mode_raw;
-    if (member_mode !== null && !(_isStr(member_mode) && _VALID_MODES.has(member_mode))) {
-        throw new CouncilConfigError(
-            `members.${name}.mode=${_pyRepr(member_mode)} not in ` +
-                `${_sortedListRepr(_VALID_MODES)}.`,
-        );
-    }
-    const effective_mode = member_mode !== null ? (member_mode as string) : default_mode;
+    // Per-member transport is no longer configurable either — same reasoning
+    // as `_build_defaults`. A member that pinned `mode: api` would reintroduce
+    // exactly the silent-spend path the global key was removed for, one
+    // provider at a time. Recorded as ignored, never read.
+    if (_get(cfg, 'mode', null) !== null) {
+        ignored.push(`members.${name}.mode`);
+    }
+    const member_mode: string | null = null;
+    const effective_mode = default_mode;
     const binary_raw = _get(cfg, 'binary', null);
     const binary = binary_raw === undefined ? null : binary_raw;
     if (binary !== null) {

package/src/scripts/before_complete_hook.ts

@@ -113,6 +113,14 @@ function _empty_state(): StateDict {
     verified_this_turn: false,
     ci_saw_pending: false,
     nonevidence_this_turn: 0,
+    // Round 7 § Phase 1 — the last CI read, SESSION-scoped on purpose. Every
+    // other counter here is turn-scoped because a stale POSITIVE would wrongly
+    // vouch ("I verified"). This one is a NEGATIVE ("CI was not settled"), and a
+    // stale negative only ever refuses more often — so surviving the turn
+    // boundary preserves the freshness invariant rather than bypassing it. It
+    // has to survive it: the measured failure is a completion claim in a LATER
+    // turn than the poll it rests on.
+    ci_last: null,
     checked_at: _now(),
   };
 }
@@ -303,6 +311,16 @@ function _update(state: StateDict, event: string, envelope: StateDict): StateDic
     // Session boundary — reset session-scoped counters.
     state["session_id"] = session_id;
     state["verifications_this_session"] = 0;
+    // R2 finding 1 (high). `ci_last` is SESSION-scoped, and until this line
+    // nothing cleared it: `_reset_turn` clears the turn-scoped witness,
+    // `_empty_state` sets it null only for a state file that does not exist yet,
+    // and `_load_state` merges the persisted value over that default. So session
+    // A polled CI, saw pending, and ended; session B — a doc-only session that
+    // never touched CI — said "Fertig" and was REFUSED, contradicting both the
+    // consumer's own comment ("a session that never polled CI must never be
+    // refused for it") and the negative case the roadmap pinned. Session-scoped
+    // has to mean cleared at the boundary, or it means never cleared.
+    state["ci_last"] = null;
     state = _reset_turn(state, session_id);
   }
 
@@ -338,6 +356,27 @@ function _update(state: StateDict, event: string, envelope: StateDict): StateDic
         } else {
           counts = false; // unrecognised or unreadable — never read as settled
         }
+        // Round 7 § 1.1 — the session-scoped negative the turn-end consumer reads.
+        //
+        // R2 finding 3 (medium), and it was the sharpest one: this said `settled:
+        // pending === 0` and CLAIMED "the same discrimination `counts` makes
+        // above". It was not. `counts` requires `!vacuous && ci_saw_pending`;
+        // `pending === 0` alone drops both. A post-push poll that reads a stale
+        // all-pass table returns pending 0 — verbatim the FC-3b failure documented
+        // twenty lines up — and recorded `settled: true`, so the completion
+        // detector went SILENT in exactly the premature-claim case it exists for.
+        // A detector defeated by the false settle it was built to catch is worse
+        // than no detector, because it reports coverage.
+        //
+        // Now it reuses `counts` itself, which is that discrimination rather than
+        // a paraphrase of it. `pending === null` (unreadable, and "no checks
+        // reported") stays not-a-settle by construction.
+        state["ci_last"] = {
+          at: _now(),
+          command: cmd.slice(0, 512),
+          pending,
+          settled: pending === 0 && counts === true,
+        };
       }
 
       state["last_verification"] = {