@event4u/agent-config 9.9.0 → 9.11.0

package/src/scripts/lint_hidden_unicode.ts

@@ -30,6 +30,7 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import * as sl from './_lib/security_lint.js';
@@ -261,6 +262,191 @@ export function _scan(sf: sl.ScannedFile): sl.Finding[] {
     return out;
 }
 
+// ---------------------------------------------------------------------------
+// Source-file pass — raw C0 control bytes make a text file INVISIBLE to tools
+// ---------------------------------------------------------------------------
+//
+// The `.md` corpus pass above defends the model's eyes. This pass defends the
+// *reviewer's* and the *gate's* eyes, which is a different failure.
+//
+// A raw control byte (NUL above all) in a text-intended source file makes
+// `file(1)`, `grep`, and every tool that sniffs for binary content classify the
+// file as binary and SKIP IT SILENTLY. A linter grepping such a file reads
+// nothing and reports clean; an agent gathering evidence concludes the code
+// does not exist. That is indistinguishable from a pass, which is the point.
+//
+// Discovered the hard way: `road-to-runtime-encoding-hardening` was authored on
+// the premise that `memory_lookup.ts` had "zero imports" and that the sanitize
+// floor therefore ran nowhere. The file simply carried a raw NUL as a composite
+// map-key separator, so `grep` never read it. The premise was a measurement
+// artifact. See `agents/evidence/reports/nul-byte-source-census.md`.
+//
+// Precision by construction — this pass flags ONLY raw C0 controls, never the
+// invisible/confusable classes `_scan` owns. In a `.ts` file a real bidi or
+// zero-width codepoint is usually a deliberate test fixture or a regex
+// character class (this repo has several, legitimately), so flagging those here
+// would demand an allowlist that grows until the gate is worthless. A raw
+// control byte has NO legitimate use in text-intended source: the language
+// escape (`\0`, `\x01`) compiles to the identical runtime string and keeps the
+// file readable by tools. The fix is always available, so the false-positive
+// rate is structurally zero rather than merely low.
+
+/** Extensions whose content is legitimately binary — never flagged. */
+const _BINARY_EXT: ReadonlySet<string> = new Set([
+    'png', 'jpg', 'jpeg', 'gif', 'ico', 'webp', 'avif', 'bmp', 'tiff',
+    'pdf', 'woff', 'woff2', 'ttf', 'otf', 'eot',
+    'zip', 'gz', 'tgz', 'bz2', 'xz', 'zst', '7z', 'rar',
+    'wasm', 'mp3', 'mp4', 'wav', 'ogg', 'webm', 'mov', 'avi',
+    'so', 'dylib', 'dll', 'node', 'a', 'o', 'exe',
+    'jar', 'class', 'pyc', 'pyo',
+    'db', 'sqlite', 'sqlite3', 'bin', 'dat',
+    'docx', 'xlsx', 'pptx', 'doc', 'xls', 'ppt', 'odt', 'ods', 'odp',
+]);
+
+/**
+ * Generated trees — skipped, because this is an AUTHORING rule.
+ *
+ * `dist/` and the per-tool projections are outputs of `src/` (see the
+ * `source-of-truth` rule: a projection is never edited by hand). Flagging a
+ * control byte there would point the author at a file they must not touch, and
+ * `dist/install/*.mjs` is a bundler artifact whose bytes are not even
+ * hand-authorable. Fix the source; the projection follows on `task sync`.
+ */
+const _GENERATED_PREFIXES: readonly string[] = [
+    'dist/',
+    '.augment/',
+    '.claude/',
+    '.cursor/',
+    '.clinerules/',
+    // Verbatim captured tool output, not authored text. These are RECORDINGS:
+    // escaping a control byte inside one would falsify the record it exists to
+    // preserve. If a capture needs to stay grep-readable, the fix is to escape
+    // at capture time — never to edit the artifact afterwards.
+    'agents/evidence/analysis/',
+    // The frozen hostile-encoding corpus. Its positives ARE raw control
+    // characters — that is the thing under test, so flagging them would demand
+    // escaping the fixtures and thereby delete the test. The corpus has its own,
+    // stronger integrity controls: a sha256 freeze plus a scope-guard test that
+    // is itself falsified by an out-of-scope fixture. Excluded here because it
+    // is DATA, on the same principle as the captures above.
+    'internal/bench/corpora/encoding-channels/',
+];
+
+function _isGenerated(rel: string): boolean {
+    return _GENERATED_PREFIXES.some((p) => rel.startsWith(p));
+}
+
+/**
+ * True for a raw control CODEPOINT that is not benign whitespace.
+ *
+ * Codepoints, not bytes, and that distinction is the whole point. A first cut
+ * of this pass tested bytes ≤ 0x1F and let two classes through: DEL (U+007F,
+ * a single byte above the range) and the C1 controls (U+0080–009F, which encode
+ * to a two-byte UTF-8 sequence containing no byte ≤ 0x1F). Both make `file(1)`
+ * and git classify a file as binary — `tests/scripts/retrieval_sanitize.test.ts`
+ * carried U+007F and U+009F, rendered as `Bin` in `git diff`, unreviewable on a
+ * PR, and passed the byte-level check. A gate that misses the thing it exists to
+ * catch is the failure this whole roadmap is about, so the range now matches
+ * `_classify`'s: C0 + DEL + C1, minus tab / LF / CR.
+ */
+function _isRawControlCodepoint(cp: number): boolean {
+    if (cp === 0x09 || cp === 0x0a || cp === 0x0d) return false;
+    return cp <= 0x1f || (cp >= 0x7f && cp <= 0x9f);
+}
+
+function _extensionOf(rel: string): string {
+    const base = rel.slice(rel.lastIndexOf('/') + 1);
+    const dot = base.lastIndexOf('.');
+    return dot <= 0 ? '' : base.slice(dot + 1).toLowerCase();
+}
+
+/** Tracked files, or `null` when git is unavailable (then the pass no-ops). */
+function _trackedFiles(): string[] | null {
+    const res = spawnSync('git', ['ls-files', '-z'], {
+        cwd: sl.ROOT,
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    if (res.status !== 0 || res.stdout === null) return null;
+    return res.stdout
+        .toString('utf-8')
+        .split('\0')
+        .filter((p) => p !== '');
+}
+
+/**
+ * Tracked files this pass is responsible for — text-intended, non-generated.
+ *
+ * Exported so a green run can state HOW MANY files it actually read. A check
+ * that reports "clean" without naming its scope is indistinguishable from a
+ * check whose scope matched nothing, which is the failure class this repo has
+ * already been bitten by.
+ */
+export function _eligibleSourceFiles(): string[] | null {
+    const tracked = _trackedFiles();
+    if (tracked === null) return null;
+    return tracked.filter((rel) => !_isGenerated(rel) && !_BINARY_EXT.has(_extensionOf(rel)));
+}
+
+/**
+ * Flag raw C0 control bytes in every tracked, text-intended file.
+ *
+ * `files` is injectable so the regression test can assert a synthetic NUL is
+ * caught — without that assertion there is no way to know this pass can still
+ * fail, which is the failure mode the whole check exists to prevent.
+ */
+export function _scanSourceControlBytes(files: readonly string[] | null = null): sl.Finding[] {
+    const tracked = files ?? _eligibleSourceFiles();
+    if (tracked === null) return [];
+    const out: sl.Finding[] = [];
+    for (const rel of tracked) {
+        // Re-applied here, not only in `_eligibleSourceFiles`: the exclusions
+        // are a property of the CHECK, so an explicit `files` list (a caller, a
+        // test) can never widen the scan past what the check is willing to
+        // claim. `_eligibleSourceFiles` exists to count, not to be the gate.
+        if (_isGenerated(rel)) continue;
+        if (_BINARY_EXT.has(_extensionOf(rel))) continue;
+        let data: Buffer;
+        try {
+            data = fs.readFileSync(path.join(sl.ROOT, rel));
+        } catch {
+            continue; // deleted, unreadable, or a submodule pointer
+        }
+        // A file that is not valid UTF-8 is binary regardless of its extension
+        // (an extensionless fixture, say) — not this check's business.
+        try {
+            new TextDecoder('utf-8', { fatal: true }).decode(data);
+        } catch {
+            continue;
+        }
+        // Iterate CODEPOINTS (the string is already known-valid UTF-8 here), so
+        // DEL and the C1 range are visible — see `_isRawControlCodepoint`.
+        let line = 1;
+        for (const ch of data.toString('utf-8')) {
+            const cp = ch.codePointAt(0);
+            if (cp === undefined) continue;
+            if (cp === 0x0a) {
+                line += 1;
+                continue;
+            }
+            if (!_isRawControlCodepoint(cp)) continue;
+            const hex = cp.toString(16).toUpperCase().padStart(2, '0');
+            out.push(
+                new sl.Finding(
+                    rel,
+                    line,
+                    CHECK,
+                    'HIGH',
+                    `raw control character U+${hex} in a text source — makes ` +
+                        'grep/file(1)/git treat this file as binary and skip it ' +
+                        'silently; use the language escape (e.g. \\0, \\x7F) instead',
+                    1.0,
+                ),
+            );
+        }
+    }
+    return out;
+}
+
 export function _sanitize(filePath: string): string {
     const raw = fs.readFileSync(filePath, 'utf-8');
     let cleaned = '';
@@ -323,6 +509,28 @@ export function main(argv: readonly string[] | null = null): number {
         }
     }
 
+    // Second pass — raw control bytes in text-intended SOURCE files, which the
+    // `.md` corpus above does not cover. Deliberately not folded into
+    // `iter_corpus`: different scope (all tracked text files, not the `.md`
+    // corpus) and a narrower codepoint set (C0 only). `--fix` does not touch
+    // these — rewriting a source file's bytes is the author's call, and the
+    // finding names the escape to use.
+    const sourceFiles = _eligibleSourceFiles();
+    for (const h of _scanSourceControlBytes(sourceFiles)) {
+        findings.push(h);
+    }
+    if (!args.json) {
+        // State the scope on every run. A bare "clean" cannot be told apart
+        // from a pass whose file list was empty.
+        const n = sourceFiles === null ? 0 : sourceFiles.length;
+        process.stdout.write(
+            sourceFiles === null
+                ? '  source pass: SKIPPED — `git ls-files` unavailable, 0 files read for raw control bytes\n'
+                : `  source pass: ${n} tracked text file(s) read for raw C0 control bytes ` +
+                      '(generated trees + verbatim captures excluded)\n',
+        );
+    }
+
     if (args.fix) {
         // sorted(flagged) — by path string.
         for (const p of [...flagged].sort()) {

package/src/scripts/lint_load_context.ts

@@ -36,9 +36,15 @@ const QUIET = process.argv.slice(2).includes('--quiet');
 // src/scripts/lint_load_context.ts → three dirs up is the repo root.
 const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 
+// Retargeted 2026-07-29: the first two pointed at the ADR-051-emptied tree, so
+// this gate reported "clean (0 declarer(s))" in CI — the count was in its own
+// output the whole time. `agents/contexts` does not exist either (project-local
+// contexts live under agents/settings/contexts) and is kept only as a no-op for
+// consumer layouts that do have it.
 const SCAN_DIRS = [
-    path.join(ROOT, '.agent-src.uncondensed', 'rules'),
-    path.join(ROOT, '.agent-src.uncondensed', 'contexts'),
+    path.join(ROOT, 'src', 'rules'),
+    path.join(ROOT, 'src', 'agent-src', 'contexts'),
+    path.join(ROOT, 'agents', 'settings', 'contexts'),
     path.join(ROOT, 'agents', 'contexts'),
 ];
 
@@ -50,9 +56,10 @@ const ALLOWED_PREFIXES = [
 
 const LEGACY_PREFIX = '.agent-src.uncondensed/contexts/';
 
-const SOURCE_ROOT = path.join(ROOT, '.agent-src.uncondensed');
+// Base for resolving a logical `contexts/...` entry to a real file.
+const SOURCE_ROOT = path.join(ROOT, 'src', 'agent-src');
 
-const PUBLIC_RULE_PREFIX = '.agent-src.uncondensed/rules/';
+const PUBLIC_RULE_PREFIX = 'src/rules/';
 const PROJECT_LOCAL_PREFIX = 'agents/settings/contexts/';
 
 const HARD_FLOOR_RULES: ReadonlySet<string> = new Set([
@@ -217,7 +224,12 @@ function main(): number {
     const warnings: string[] = [];
     const graph: Record<string, string[]> = {};
 
-    for (const f of collect_files()) {
+    const _files = collect_files();
+    // Gate-coverage contract (src/config/gate-coverage.yml): count FILES INSPECTED,
+    // not declarers — "0 declarers" over 400 files is a legitimate result, "0 files"
+    // is blindness. Reporting declarers here would have hidden the dead root.
+    process.stdout.write(`scanned: ${String(_files.length)}\n`);
+    for (const f of _files) {
         const fm = parse_frontmatter(f);
         const lazyRaw = fm['load_context'];
         const eagerRaw = fm['load_context_eager'];

package/src/scripts/lint_new_skill_gate.ts

@@ -105,9 +105,15 @@ function _skill_roots(): string[] {
             }
         }
     }
-    const legacy = path.join(ROOT, '.agent-src.uncondensed', 'skills');
-    if (roots.length === 0 && _isDir(legacy)) {
-        roots = [legacy];
+    // ADR-051 moved skill authoring to `src/skills`; a later commit deleted
+    // `packages/` entirely. Until 2026-07-29 the only fallback was the retired
+    // container, so this resolved to [] and the overlap gate silently passed
+    // every new skill.
+    if (roots.length === 0) {
+        const cand = path.join(ROOT, 'src', 'skills');
+        if (_isDir(cand)) {
+            roots = [cand];
+        }
     }
     return roots;
 }

package/src/scripts/lint_no_python_twin_rationale.ts

@@ -26,9 +26,24 @@ const _HERE = fileURLToPath(import.meta.url);
 export const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 const SCOPE = path.join(ROOT, 'src', 'scripts');
 
-/** Banned rationale shapes (case-insensitive). */
+/**
+ * Banned rationale shapes (case-insensitive).
+ *
+ * `twin-of` is qualified with a Python signal on purpose. The bare `/\btwin of\b/`
+ * it replaced banned an English word rather than a claim shape, and produced 6 false
+ * positives out of 7 findings: a CLI twin of an MCP tool, a sync twin of an async
+ * probe in the same file, a debate twin of a sibling function, a SQLite twin of a
+ * JSON cache. None of those rationalise anything by fidelity to a deleted Python
+ * original — which is the only thing this gate exists to stop — and rewording correct
+ * comments to dodge a word would have been the tail wagging the dog.
+ *
+ * The narrowing does not weaken the gate: every shape it targets names Python by
+ * construction ("TypeScript twin of the Python original", "twin of the retired
+ * .py"), so the qualifier is satisfied precisely when the claim is the banned one.
+ * The other three patterns already carry their own Python signal.
+ */
 export const BANNED: ReadonlyArray<[string, RegExp]> = [
-    ['twin-of', /\btwin of\b/i],
+    ['twin-of', /\btwin of\b[^\n]*\b(?:python|py2ts|\.py)\b|\b(?:python|py2ts|\.py)\b[^\n]*\btwin of\b/i],
     ['latent-quirks', /latent (?:python )?(?:quirks|bugs) replicated/i],
     ['byte-identical-python', /byte-identical to the python/i],
     ['python-original', /\bthe python original\b/i],

package/src/scripts/lint_originality.ts

@@ -373,7 +373,7 @@ function _changed(files: string[]): { pairs: Pair[]; fails: number } {
     const seen = new Set<string>();
     const record = (a: Artifact, b: Artifact): void => {
         if (a.relpath === b.relpath) return;
-        const key = [a.relpath, b.relpath].sort().join('');
+        const key = [a.relpath, b.relpath].sort().join('\0');
         if (seen.has(key)) return;
         const o = overlap(a, b);
         if (o >= WARN) {

package/src/scripts/lint_skill_originality.ts

@@ -351,7 +351,7 @@ function _sortedSkillMds(root: string): string[] {
 
 /** frozenset((a, b)) — order-independent membership key. */
 function _frozenKey(a: string, b: string): string {
-    return a <= b ? `${a}${b}` : `${b}${a}`;
+    return a <= b ? `${a}\0${b}` : `${b}\0${a}`;
 }
 
 /** sorted(a & b) — codepoint-sorted intersection. */

package/src/scripts/lint_ticket_buildable.ts

@@ -838,7 +838,7 @@ function lint(): number {
                 } else {
                     // fm.get("id") is None → set contains None; an id-less ticket
                     // file. Represent the Python None membership separately.
-                    file_ids.add('__none__');
+                    file_ids.add('\0__none__');
                 }
             }
         }

package/src/scripts/lint_ui_stack_bundles.ts

@@ -0,0 +1,170 @@
+#!/usr/bin/env tsx
+/**
+ * Lint the UI-track verb → skill-bundle map.
+ *
+ * The stack-dispatched UI steps halt with a directive verb
+ * (`ui-apply-<stack>` and friends). Those verbs are agent-interpreted, not
+ * skill paths — only 2 of the engine's 11 literal verbs name a real skill — so
+ * the mapping from verb to the skills that implement it is a separate fact.
+ * It used to live only in a prose table in `docs/contracts/ui-track-flow.md`,
+ * unverified, and two of its four rows were wrong: `vue` named the verb itself
+ * (no skill at all) and `plain` — the fallback for every unrecognised project —
+ * named `blade-ui`, a `packs: [laravel]` skill that a non-Laravel consumer does
+ * not have installed.
+ *
+ * Two assertions, both decidable in this repo:
+ *
+ *   1. RESOLUTION — every bundle member is a real skill (`src/skills/<n>/SKILL.md`).
+ *   2. PACK REACH — a lane declared `pack_agnostic` names only skills that ship
+ *      in a stack-neutral pack. This is the assertion that actually matters: CI
+ *      here cannot see a consumer's installed pack combination, so "the skill
+ *      exists in our tree" would have passed the `plain → blade-ui` defect
+ *      unchanged.
+ *
+ * Exit codes: 0 clean, 1 one or more findings.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+    STACK_BUNDLES,
+    type StackBundle,
+} from '../agent-src/templates/scripts/work_engine/directives/ui/stack_bundles.js';
+
+const QUIET = process.argv.includes('--quiet');
+
+const _HERE = fileURLToPath(import.meta.url);
+const REPO = path.resolve(path.dirname(_HERE), '..', '..');
+const SKILLS_DIR = path.join(REPO, 'src', 'skills');
+
+/**
+ * Packs that ship regardless of the project's framework. A `pack_agnostic`
+ * lane may only draw on these — anything else is unavailable to some consumer.
+ */
+const STACK_NEUTRAL_PACKS: ReadonlySet<string> = new Set(['engineering-base', 'core', 'meta']);
+
+const findings: string[] = [];
+
+function skill_path(name: string): string {
+    return path.join(SKILLS_DIR, name, 'SKILL.md');
+}
+
+/** Return the `packs:` list from a skill's frontmatter, or `null` if absent. */
+function packs_of(name: string): string[] | null {
+    let text: string;
+    try {
+        text = fs.readFileSync(skill_path(name), { encoding: 'utf-8' });
+    } catch {
+        return null;
+    }
+    // Frontmatter only — a `packs:` mention in the body is not a declaration.
+    const end = text.indexOf('\n---', 4);
+    const front = end === -1 ? text : text.slice(0, end);
+    // `[ \t]*`, not `\s*`: `\s` matches a newline, so the greedy form swallowed
+    // the line break and captured the first block-list item as if it were an
+    // inline value — which made every block-list skill parse as "no packs".
+    const match = /^packs:[ \t]*(.*)$/m.exec(front);
+    if (match === null) return null;
+    const inline = (match[1] ?? '').trim();
+    if (inline.startsWith('[')) {
+        return inline
+            .replace(/^\[|\]$/g, '')
+            .split(',')
+            .map((s) => s.trim().replace(/^['"]|['"]$/g, ''))
+            .filter((s) => s !== '');
+    }
+    // Block list: consume the `  - name` lines that follow. `match[0]` stops
+    // before the newline, so the first split element is the empty tail of the
+    // matched line itself — dropping it is required, not cosmetic: treating it
+    // as a non-item ended the loop immediately and made every block-list skill
+    // parse as "no packs", which is how this linter first shipped green against
+    // the very defect it exists to catch.
+    const rest = front.slice(match.index + match[0].length).split('\n').slice(1);
+    const out: string[] = [];
+    for (const line of rest) {
+        const item = /^\s*-\s*(.+?)\s*$/.exec(line);
+        if (item === null) break;
+        out.push((item[1] ?? '').replace(/^['"]|['"]$/g, ''));
+    }
+    return out;
+}
+
+function check_lane(lane: string, bundle: StackBundle): void {
+    const members = [...bundle.build, ...bundle.review];
+    if (members.length === 0) {
+        findings.push(`${lane}: bundle is empty — a lane must name at least one skill.`);
+        return;
+    }
+    for (const name of new Set(members)) {
+        // 1. RESOLUTION
+        if (!fs.existsSync(skill_path(name))) {
+            findings.push(
+                `${lane}: bundle member \`${name}\` has no ` +
+                    `\`src/skills/${name}/SKILL.md\` — the verb would resolve to nothing.`,
+            );
+            continue;
+        }
+        // 2. PACK REACH
+        if (!bundle.pack_agnostic) continue;
+        const packs = packs_of(name);
+        if (packs === null) {
+            findings.push(
+                `${lane}: bundle member \`${name}\` declares no \`packs:\` — ` +
+                    'a pack-agnostic lane cannot verify it ships everywhere.',
+            );
+            continue;
+        }
+        const offenders = packs.filter((p) => !STACK_NEUTRAL_PACKS.has(p));
+        if (offenders.length > 0) {
+            findings.push(
+                `${lane}: lane is \`pack_agnostic\` but member \`${name}\` ships only in ` +
+                    `[${offenders.join(', ')}] — a consumer without that pack gets nothing. ` +
+                    'This is the `plain → blade-ui` defect class.',
+            );
+        }
+    }
+}
+
+function main(): number {
+    const lanes = Object.keys(STACK_BUNDLES).sort();
+    if (lanes.length === 0) {
+        process.stderr.write('lint-ui-stack-bundles: STACK_BUNDLES is empty — nothing to check.\n');
+        return 1;
+    }
+    for (const lane of lanes) {
+        check_lane(lane, STACK_BUNDLES[lane] as StackBundle);
+    }
+
+    // A lane usable as a fallback must be pack-agnostic, else the fallback
+    // itself is the thing that fails for an unpredictable consumer.
+    const plain = STACK_BUNDLES['plain'];
+    if (plain === undefined) {
+        findings.push('plain: missing — it is the documented DEFAULT_DIRECTIVE lane.');
+    } else if (!plain.pack_agnostic) {
+        findings.push(
+            'plain: the fallback lane must be `pack_agnostic` — every unrecognised ' +
+                'project lands here and its packs are unknown.',
+        );
+    }
+
+    if (findings.length > 0) {
+        for (const f of findings) {
+            process.stdout.write(`lint-ui-stack-bundles: ${f}\n`);
+        }
+        process.stderr.write(
+            `lint-ui-stack-bundles: ${findings.length} finding(s) across ${lanes.length} lane(s).\n`,
+        );
+        return 1;
+    }
+    if (!QUIET) {
+        process.stdout.write(
+            `lint-ui-stack-bundles: ${lanes.length} lane(s) clean — every bundle member ` +
+                'resolves, and every pack-agnostic lane stays stack-neutral.\n',
+        );
+    }
+    return 0;
+}
+
+process.exit(main());

package/src/scripts/mcp_server/tools.ts

@@ -97,10 +97,10 @@ export type ToolSideEffect = 'ro' | 'fs-write' | 'shell';
  * each `tools/call`. `handler` is an async function that receives the
  * validated arguments + the resolved `consumer_root` path.
  *
- * Mirrors the Python frozen dataclass `BuiltinTool` (field order
- * preserved). `side_effect` is a TS-only addition (Phase 3 of
- * road-to-credible-install) — the Python original predates the generated
- * catalog and had no analogous field.
+ * Shape is pinned by `consumer_tool_catalog.json`: `build_mcp_catalog` derives
+ * the catalog from `ALLOWLIST` here, and `build_mcp_catalog --strict` fails CI
+ * on any drift (`.github/workflows/tests.yml`). `side_effect` is consumed by that
+ * generator, so adding or reordering a field means regenerating the catalog.
  */
 export interface BuiltinTool {
     readonly name: string;