@memnexus-ai/mx-agent-cli 0.1.208 → 0.1.210

package/dist/lib/startup-shipper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-shipper.d.ts","sourceRoot":"","sources":["../../src/lib/startup-shipper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAcH;oEACoE;AACpE,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY7D;AAwCD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnF;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCjG"}

package/dist/lib/startup-shipper.js

@@ -0,0 +1,177 @@
+/**
+ * startup-shipper.ts — ships StartupReports to the central observability
+ * service (platform v2.58 Phase 2, #4350).
+ *
+ * Durability model mirrors the local JSONL from Phase 1: every report is first
+ * written to a spool dir (~/.mx-agent/logs/startup/spool/<uuid>.json), then a
+ * best-effort POST deletes it on success. A failed or token-less POST leaves the
+ * file spooled; the Stop-hook `mx-agent sync` flushes the backlog on the next
+ * session end.
+ *
+ * Discipline (identical to startup-report.ts): NOTHING here throws. Shipping is
+ * additive telemetry — it must never block, slow, or fail a session start. Every
+ * filesystem and network call is wrapped; the worst outcome of any failure is a
+ * report that stays spooled for a later retry.
+ *
+ *  - spoolReport(json)     — write one report to the spool. Drops files older
+ *                            than 14 days at write time (bounded disk/staleness).
+ *  - flushSpool(cfg)       — POST every spooled report, deleting each on 2xx.
+ *                            Enforces a 50-file cap (drops oldest beyond it) and
+ *                            skips entirely when no token is configured.
+ *  - postSpoolFile(p, cfg) — POST one spool file with a 3 s timeout.
+ */
+import { mkdirSync, writeFileSync, readdirSync, statSync, unlinkSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { randomUUID } from 'crypto';
+/** Drop spooled files older than this at write time (bounded disk / staleness). */
+const MAX_SPOOL_AGE_MS = 14 * 24 * 60 * 60 * 1000; // 14 days
+/** Flush keeps at most this many files; the oldest beyond it are dropped. */
+const MAX_SPOOL_FILES = 50;
+/** Per-POST timeout — a single ship attempt must never stall longer than this. */
+const POST_TIMEOUT_MS = 3000;
+/** Absolute path to the spool directory. Computed at call time so tests that
+ *  repoint $HOME observe the change (matches startup-report.ts). */
+export function spoolDir() {
+    return join(homedir(), '.mx-agent', 'logs', 'startup', 'spool');
+}
+/**
+ * Write a report JSON string to the spool. Never throws. Returns the file path,
+ * or null if the write could not be performed (e.g. a read-only spool dir).
+ * Drops files older than 14 days first.
+ */
+export function spoolReport(reportJson) {
+    try {
+        const dir = spoolDir();
+        mkdirSync(dir, { recursive: true });
+        dropAgedFiles(dir);
+        const path = join(dir, `${randomUUID()}.json`);
+        writeFileSync(path, reportJson);
+        return path;
+    }
+    catch {
+        // Spooling is best-effort — a failure here is silently tolerated.
+        return null;
+    }
+}
+/** Remove spool files whose mtime is older than the age cap. Never throws. */
+function dropAgedFiles(dir) {
+    try {
+        const now = Date.now();
+        for (const f of readdirSync(dir)) {
+            if (!f.endsWith('.json'))
+                continue;
+            const p = join(dir, f);
+            try {
+                if (now - statSync(p).mtimeMs > MAX_SPOOL_AGE_MS)
+                    unlinkSync(p);
+            }
+            catch {
+                /* individual file error — skip it */
+            }
+        }
+    }
+    catch {
+        /* dir unreadable / absent — nothing to age out */
+    }
+}
+/** List spool files (basenames), oldest-first by mtime. Never throws. */
+function listSpoolFilesOldestFirst(dir) {
+    let names;
+    try {
+        names = readdirSync(dir).filter((f) => f.endsWith('.json'));
+    }
+    catch {
+        return [];
+    }
+    return names
+        .map((f) => {
+        try {
+            return { f, m: statSync(join(dir, f)).mtimeMs };
+        }
+        catch {
+            return { f, m: 0 };
+        }
+    })
+        .sort((a, b) => a.m - b.m)
+        .map((x) => x.f);
+}
+/**
+ * POST one spool file to the observability service. Returns true and deletes the
+ * file on a 2xx response. Any non-2xx, network error, or timeout returns false
+ * and leaves the file spooled. Never throws.
+ */
+export async function postSpoolFile(path, cfg) {
+    if (!cfg.apiToken)
+        return false; // no token → cannot ship
+    let body;
+    try {
+        body = readFileSync(path, 'utf-8');
+    }
+    catch {
+        return false; // file vanished (concurrent flush) — nothing to do
+    }
+    try {
+        const res = await fetch(`${cfg.apiUrl}/v1/startup-reports`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${cfg.apiToken}`,
+            },
+            body,
+            signal: AbortSignal.timeout(POST_TIMEOUT_MS),
+        });
+        if (res.ok) {
+            try {
+                unlinkSync(path);
+            }
+            catch {
+                /* already removed — fine */
+            }
+            return true;
+        }
+        return false; // 4xx/5xx — leave spooled for a later retry
+    }
+    catch {
+        return false; // network / timeout / abort — leave spooled
+    }
+}
+/**
+ * Flush the spool: POST every spooled report, deleting each on success.
+ *
+ * Enforces the 50-file cap first (drops the oldest beyond it, with a dim note if
+ * a logger is provided). If no token is configured the whole flush is skipped —
+ * files stay spooled so a later run with a token can retry. Never throws.
+ */
+export async function flushSpool(cfg) {
+    const dir = spoolDir();
+    let files = listSpoolFilesOldestFirst(dir);
+    // 50-file cap: drop the oldest beyond the cap so disk stays bounded.
+    if (files.length > MAX_SPOOL_FILES) {
+        const drop = files.slice(0, files.length - MAX_SPOOL_FILES);
+        for (const f of drop) {
+            try {
+                unlinkSync(join(dir, f));
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        if (cfg.log) {
+            cfg.log(`startup-report spool exceeded ${MAX_SPOOL_FILES} files — dropped ${drop.length} oldest`);
+        }
+        files = files.slice(files.length - MAX_SPOOL_FILES);
+    }
+    // No token → cannot ship anything. Leave the backlog for a later sync.
+    if (!cfg.apiToken) {
+        return { shipped: 0, remaining: files.length };
+    }
+    let shipped = 0;
+    for (const f of files) {
+        if (await postSpoolFile(join(dir, f), cfg))
+            shipped++;
+    }
+    const remaining = listSpoolFilesOldestFirst(dir).length;
+    return { shipped, remaining };
+}
+//# sourceMappingURL=startup-shipper.js.map

package/dist/lib/startup-shipper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-shipper.js","sourceRoot":"","sources":["../../src/lib/startup-shipper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAC7D,6EAA6E;AAC7E,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,kFAAkF;AAClF,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;oEACoE;AACpE,MAAM,UAAU,QAAQ;IACtB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,gBAAgB;oBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,GAAe;IAC/D,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,yBAAyB;IAC1D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,mDAAmD;IACnE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,qBAAqB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,GAAG,CAAC,QAAQ,EAAE;aACxC;YACD,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,4CAA4C;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,4CAA4C;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAe;IAC9C,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAE3C,qEAAqE;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,GAAG,CAAC,GAAG,CAAC,iCAAiC,eAAe,oBAAoB,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC;QACpG,CAAC;QACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IACtD,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memnexus-ai/mx-agent-cli",
-  "version": "0.1.208",
+  "version": "0.1.210",
   "description": "CLI for creating and managing AI agent teams",
   "type": "module",
   "bin": {

package/scripts/generate-claude.mjs

@@ -68,7 +68,7 @@ import {
   renameSync, rmSync, unlinkSync, writeFileSync,
 } from 'fs';
 import { homedir, tmpdir } from 'os';
-import { dirname, join, relative, resolve, sep } from 'path';
+import { basename, dirname, join, relative, resolve, sep } from 'path';
 import { pathToFileURL } from 'url';
 import { spawnSync } from 'child_process';
 import { createHash } from 'crypto';
@@ -189,6 +189,46 @@ function pruneExtras(destDir, expected) {
   }
 }
 
+// ── ORPHAN-SIBLING SWEEP (KI-GENERATOR-SWAP-SIBLINGS-UNGUARDED) ───────────────
+//
+// A crash mid-generation can only ever leave a `.claude.staging-*` sibling
+// behind, and a failed prev-cleanup can leave a `.claude.prev-*` sibling — stale
+// settings.json + hooks copies at an unguarded path (same-UID residual, not an
+// escalation). Sweep any such orphan siblings of destRoot at generation ENTRY,
+// before a new staging dir is created, so debris never accumulates across runs.
+//
+// Single-writer assumption: generation is serialized per worktree by the leader
+// lock, so any staging/prev sibling present at entry is orphaned from a prior
+// crashed run, never an in-flight concurrent generation. Best-effort per entry
+// (an un-removable orphan never blocks generation). FAILS SAFE on a symlink
+// sibling: unlink the LINK itself, never rmSync THROUGH it (a crafted link could
+// otherwise delete outside the parent).
+
+/**
+ * Remove stale `.claude.staging-*` / `.claude.prev-*` siblings of `destRoot`.
+ * @param destRoot absolute path to the `.claude/` dir about to be generated
+ * @returns names of the siblings that were swept (for observability/tests)
+ */
+export function sweepOrphanSiblings(destRoot) {
+  const dest = resolve(destRoot);
+  const parent = dirname(dest);
+  const base = basename(dest);
+  const stagingPrefix = `${base}.staging-`;
+  const prevPrefix = `${base}.prev-`;
+  const swept = [];
+  for (const ent of listDir(parent)) {
+    if (!ent.name.startsWith(stagingPrefix) && !ent.name.startsWith(prevPrefix)) continue;
+    const p = join(parent, ent.name);
+    if (ent.isSymbolicLink()) {
+      // Never follow/delete THROUGH a link — remove only the link entry itself.
+      try { unlinkSync(p); swept.push(ent.name); } catch { /* best-effort */ }
+      continue;
+    }
+    try { rmSync(p, { recursive: true, force: true }); swept.push(ent.name); } catch { /* best-effort */ }
+  }
+  return swept;
+}
+
 // ── GENERATE-TO-STAGING + ATOMIC SWAP (Phase 4 prereq; Red Team finding 1) ────
 //
 // Generation writes the WHOLE tree into a staging dir (a sibling of destRoot so
@@ -488,6 +528,10 @@ export function generateClaudeConfig(opts) {
   // reach the write phase); the existing dest is guarded separately at swap time.
   const parent = dirname(destRoot);
   mkdirSync(parent, { recursive: true });
+  // Sweep stale staging/prev siblings from a prior crashed run BEFORE creating a
+  // fresh staging dir (KI-GENERATOR-SWAP-SIBLINGS-UNGUARDED). The just-created
+  // staging dir below cannot be a sweep target: it does not exist yet.
+  sweepOrphanSiblings(destRoot);
   const staging = mkdtempSync(join(parent, '.claude.staging-'));
 
   try {

package/dist/__tests__/config-mirror-integrity.test.d.ts

@@ -1,32 +0,0 @@
-/**
- * Mirror-drift guard for the agent-config → .claude config bundle.
- *
- * The repo keeps two copies of certain hook/skill/agent files:
- *   - mx-agent-system/agent-config/*  — the source of truth that ships in the
- *     CLI's synced bundle (what `mx-agent` writes into new worktrees).
- *   - .claude/*                        — the copy that actually runs in this
- *     repo's own worktrees.
- *
- * These were hand-synced three separate times on 2026-07-02 (issue #3728,
- * known-issues v68 / KI-HOOK-MIRROR-DRIFT-CHECK). When they drift, a worktree
- * silently runs stale hook or skill logic. This test asserts byte-identity of
- * the known mirror pairs so drift fails locally before it ships.
- *
- * ── PHASE 4 RETIREMENT (config-single-source migration #4304) ────────────────
- * This entire file — both the MIRROR_PAIRS byte-identity suite and the
- * `settings.json permissions parity` suite — is a TWO-COPY drift gate. It exists
- * only because `.claude/` is still COMMITTED alongside `agent-config/`. Phase 4
- * gitignores `.claude/`, deleting the second committed copy; at that point there
- * is nothing to compare and these assertions become vacuous (every pair SKIPs on
- * the `existsSync(claudeAbs)` guard once `.claude/` is untracked, and the parity
- * suite short-circuits on `bothPresent`).
- *
- * DELETE this file in the Phase 4 PR. Its guarantee is replaced by the
- * generation-correctness gate in `config-generation-gate.test.ts` (Phase 3),
- * which proves the single remaining source generates correct, stable output —
- * see that file's header for the kept-vs-added rationale. Until Phase 4 lands,
- * KEEP these assertions: they are the live guard against a PR editing one side of
- * the mirror while `.claude/` is still tracked.
- */
-export {};
-//# sourceMappingURL=config-mirror-integrity.test.d.ts.map

package/dist/__tests__/config-mirror-integrity.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-mirror-integrity.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/config-mirror-integrity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}

package/dist/__tests__/config-mirror-integrity.test.js

@@ -1,248 +0,0 @@
-/**
- * Mirror-drift guard for the agent-config → .claude config bundle.
- *
- * The repo keeps two copies of certain hook/skill/agent files:
- *   - mx-agent-system/agent-config/*  — the source of truth that ships in the
- *     CLI's synced bundle (what `mx-agent` writes into new worktrees).
- *   - .claude/*                        — the copy that actually runs in this
- *     repo's own worktrees.
- *
- * These were hand-synced three separate times on 2026-07-02 (issue #3728,
- * known-issues v68 / KI-HOOK-MIRROR-DRIFT-CHECK). When they drift, a worktree
- * silently runs stale hook or skill logic. This test asserts byte-identity of
- * the known mirror pairs so drift fails locally before it ships.
- *
- * ── PHASE 4 RETIREMENT (config-single-source migration #4304) ────────────────
- * This entire file — both the MIRROR_PAIRS byte-identity suite and the
- * `settings.json permissions parity` suite — is a TWO-COPY drift gate. It exists
- * only because `.claude/` is still COMMITTED alongside `agent-config/`. Phase 4
- * gitignores `.claude/`, deleting the second committed copy; at that point there
- * is nothing to compare and these assertions become vacuous (every pair SKIPs on
- * the `existsSync(claudeAbs)` guard once `.claude/` is untracked, and the parity
- * suite short-circuits on `bothPresent`).
- *
- * DELETE this file in the Phase 4 PR. Its guarantee is replaced by the
- * generation-correctness gate in `config-generation-gate.test.ts` (Phase 3),
- * which proves the single remaining source generates correct, stable output —
- * see that file's header for the kept-vs-added rationale. Until Phase 4 lands,
- * KEEP these assertions: they are the live guard against a PR editing one side of
- * the mirror while `.claude/` is still tracked.
- */
-import { describe, it, expect } from 'vitest';
-import { readFileSync, existsSync } from 'fs';
-import { dirname, join } from 'path';
-import { fileURLToPath } from 'url';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-/**
- * Ascend from this test file to the repo root — identified by the presence of
- * the mx-agent-system/agent-config tree — instead of hard-coding a fixed number
- * of `..` segments. Keeps the test correct if the file is ever relocated.
- */
-function findRepoRoot(start) {
-    let dir = start;
-    for (let i = 0; i < 20; i++) {
-        if (existsSync(join(dir, 'mx-agent-system', 'agent-config')))
-            return dir;
-        const parent = dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    throw new Error(`config-mirror-integrity: could not locate repo root from ${start}`);
-}
-const REPO_ROOT = findRepoRoot(__dirname);
-// [ .claude runtime copy, agent-config source of truth ] — repo-root-relative.
-const MIRROR_PAIRS = [
-    [
-        '.claude/hooks/deploy-verification-reminder.sh',
-        'mx-agent-system/agent-config/hooks/deploy-verification-reminder.sh',
-    ],
-    [
-        '.claude/hooks/deploy-verification-reminder.test.sh',
-        'mx-agent-system/agent-config/hooks/deploy-verification-reminder.test.sh',
-    ],
-    // Shared git guards + push validators (#3912). These were mirror-drifting
-    // silently (git-mutation-guard.sh wasn't even present in the source-of-truth
-    // copy). Enforce byte-identity so a hook fix lands in both places.
-    [
-        '.claude/hooks/git-mutation-guard.sh',
-        'mx-agent-system/agent-config/hooks/git-mutation-guard.sh',
-    ],
-    [
-        '.claude/hooks/git-mutation-guard.test.sh',
-        'mx-agent-system/agent-config/hooks/git-mutation-guard.test.sh',
-    ],
-    [
-        '.claude/hooks/push-matcher.test.sh',
-        'mx-agent-system/agent-config/hooks/push-matcher.test.sh',
-    ],
-    [
-        '.claude/hooks/mx-guard-hook.sh',
-        'mx-agent-system/agent-config/hooks/mx-guard-hook.sh',
-    ],
-    [
-        '.claude/hooks/ci-validate-hook.sh',
-        'mx-agent-system/agent-config/hooks/ci-validate-hook.sh',
-    ],
-    // Package→validate-script routing table extracted from ci-validate-hook.sh
-    // (Platform v2.35, #4017). Shipped default = the MemNexus map; the hook reads
-    // it at push time and fails open if absent. Guard it against mirror drift.
-    [
-        '.claude/hooks/ci-validate-routes.conf',
-        'mx-agent-system/agent-config/hooks/ci-validate-routes.conf',
-    ],
-    [
-        '.claude/hooks/worktree-guard.sh',
-        'mx-agent-system/agent-config/hooks/worktree-guard.sh',
-    ],
-    [
-        '.claude/hooks/worktree-guard.test.sh',
-        'mx-agent-system/agent-config/hooks/worktree-guard.test.sh',
-    ],
-    [
-        '.claude/hooks/workflow-dispatch-guard.sh',
-        'mx-agent-system/agent-config/hooks/workflow-dispatch-guard.sh',
-    ],
-    // Named-memory truncating-write guard (Platform v2.33, #3996). Blocks
-    // full-content `mx memories update|create --name X --content <NEW>` writes
-    // that shrink a shared named memory past a threshold — two real clobber
-    // incidents (2026-07-07 known-issues, 2026-07-09 escalations).
-    [
-        '.claude/hooks/named-memory-write-guard.sh',
-        'mx-agent-system/agent-config/hooks/named-memory-write-guard.sh',
-    ],
-    [
-        '.claude/hooks/named-memory-write-guard.test.sh',
-        'mx-agent-system/agent-config/hooks/named-memory-write-guard.test.sh',
-    ],
-    [
-        '.claude/skills/mx-post-merge-sync/SKILL.md',
-        'mx-agent-system/agent-config/skills/mx-post-merge-sync/SKILL.md',
-    ],
-    [
-        '.claude/agents/git-expert.md',
-        'mx-agent-system/agent-config/agents/git-expert.md',
-    ],
-    // Stop hook that warns when a merged session left its iteration log stale
-    // (Platform v2.35, #4017 — product-slug parameterization). Guard the pair.
-    [
-        '.claude/hooks/iteration-log-check.sh',
-        'mx-agent-system/agent-config/hooks/iteration-log-check.sh',
-    ],
-    [
-        '.claude/hooks/iteration-log-check.test.sh',
-        'mx-agent-system/agent-config/hooks/iteration-log-check.test.sh',
-    ],
-    // Agent/skill instruction files carrying the product-slug named-memory
-    // convention (Platform v2.35, #4017). These had been mirror-unguarded; the
-    // KI-HOOK-MIRROR-DRIFT-CHECK history (three hand-syncs, #3728) justifies
-    // enforcing byte-identity now that they are edited in lockstep.
-    [
-        '.claude/agents/memory-creator.md',
-        'mx-agent-system/agent-config/agents/memory-creator.md',
-    ],
-    [
-        '.claude/agents/status-reporter.md',
-        'mx-agent-system/agent-config/agents/status-reporter.md',
-    ],
-    [
-        '.claude/agents/prior-art-researcher.md',
-        'mx-agent-system/agent-config/agents/prior-art-researcher.md',
-    ],
-    [
-        '.claude/agents/dogfood-auditor.md',
-        'mx-agent-system/agent-config/agents/dogfood-auditor.md',
-    ],
-    [
-        '.claude/skills/mx-session-start/SKILL.md',
-        'mx-agent-system/agent-config/skills/mx-session-start/SKILL.md',
-    ],
-    [
-        '.claude/skills/mx-iteration-close/SKILL.md',
-        'mx-agent-system/agent-config/skills/mx-iteration-close/SKILL.md',
-    ],
-    // Session-start coordination brief hook (PR-D). The .claude runtime copy is
-    // synced by the normal distribution mechanism; until Gate 3 cutover it may be
-    // absent, in which case this pair SKIPS (the loop's existsSync guard). Once
-    // synced it is asserted byte-identical.
-    [
-        '.claude/hooks/coordination-brief.sh',
-        'mx-agent-system/agent-config/hooks/coordination-brief.sh',
-    ],
-    // The co-located hook test suite. Not part of the shipped config surface
-    // (bundled-config excludes *.test.sh), but both dev copies are edited in
-    // lockstep — enforce byte-identity so the slug-validation tests can't drift
-    // (v2.40 QA finding, KI-COORDMT-HOOK-EXPORT-ROBUSTNESS).
-    [
-        '.claude/hooks/coordination-brief.test.sh',
-        'mx-agent-system/agent-config/hooks/coordination-brief.test.sh',
-    ],
-    // NOTE: agent-config/settings.json is intentionally NOT a byte-identity mirror
-    // pair — the worktree .claude/settings.json has its SessionStart/hook wiring
-    // COMPOSED/merged from the source at deploy time (see claude.ts), so the two
-    // are not byte-identical by design. But the SECURITY-SENSITIVE part — the
-    // `permissions` allow/deny/ask lists and the experimental-teams flag — must
-    // never drift, because config-sync/`mx-agent new` ship agent-config's copy
-    // into worktrees verbatim. A prior drift (agent-config/settings.json lagged
-    // active by the "Monitor" allow entry from #4275, and the git-mutation-guard
-    // #4289 hardening) shipped a weakened config to consumer worktrees (#4294).
-    // The `settings.json permissions parity` describe below guards that surface
-    // semantically rather than by byte-identity.
-];
-describe('config mirror integrity', () => {
-    for (const [claudeRel, agentConfigRel] of MIRROR_PAIRS) {
-        const claudeAbs = join(REPO_ROOT, claudeRel);
-        const agentConfigAbs = join(REPO_ROOT, agentConfigRel);
-        // The .claude copy is not present in every checkout (e.g. a package-only
-        // export of the CLI). Skip rather than fail spuriously when it's absent.
-        if (!existsSync(claudeAbs)) {
-            it.skip(`${claudeRel} ↔ ${agentConfigRel} (SKIPPED: ${claudeRel} absent in this checkout)`, () => { });
-            continue;
-        }
-        it(`${claudeRel} is byte-identical to ${agentConfigRel}`, () => {
-            const claudeBytes = readFileSync(claudeAbs);
-            const agentConfigBytes = readFileSync(agentConfigAbs);
-            expect(claudeBytes.equals(agentConfigBytes)).toBe(true);
-        });
-    }
-});
-/**
- * settings.json is composed (SessionStart/hook wiring is merged into the worktree
- * copy at deploy time), so it is not a byte-identity mirror pair above. But its
- * `permissions` block and the experimental-teams flag are shipped verbatim into
- * consumer worktrees by config-sync/`mx-agent new`; drift there ships a weakened
- * security posture. This suite asserts semantic parity of exactly those fields
- * between the active runtime copy and the agent-config source of truth so a
- * regression like #4294 (agent-config lagging the active allow-list) fails
- * locally before it ships.
- */
-describe('settings.json permissions parity', () => {
-    const claudeSettingsAbs = join(REPO_ROOT, '.claude/settings.json');
-    const agentConfigSettingsAbs = join(REPO_ROOT, 'mx-agent-system/agent-config/settings.json');
-    const bothPresent = existsSync(claudeSettingsAbs) && existsSync(agentConfigSettingsAbs);
-    const loadPerms = (abs) => {
-        const parsed = JSON.parse(readFileSync(abs, 'utf-8'));
-        return parsed;
-    };
-    (bothPresent ? it : it.skip)('permissions.allow is identical between active and agent-config', () => {
-        const active = loadPerms(claudeSettingsAbs);
-        const template = loadPerms(agentConfigSettingsAbs);
-        expect(template.permissions?.allow).toEqual(active.permissions?.allow);
-    });
-    (bothPresent ? it : it.skip)('permissions.deny is identical between active and agent-config', () => {
-        const active = loadPerms(claudeSettingsAbs);
-        const template = loadPerms(agentConfigSettingsAbs);
-        expect(template.permissions?.deny).toEqual(active.permissions?.deny);
-    });
-    (bothPresent ? it : it.skip)('permissions.ask is identical between active and agent-config', () => {
-        const active = loadPerms(claudeSettingsAbs);
-        const template = loadPerms(agentConfigSettingsAbs);
-        expect(template.permissions?.ask).toEqual(active.permissions?.ask);
-    });
-    (bothPresent ? it : it.skip)('CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS flag is identical between active and agent-config', () => {
-        const active = loadPerms(claudeSettingsAbs);
-        const template = loadPerms(agentConfigSettingsAbs);
-        expect(template.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS).toEqual(active.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS);
-    });
-});
-//# sourceMappingURL=config-mirror-integrity.test.js.map

package/dist/__tests__/config-mirror-integrity.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-mirror-integrity.test.js","sourceRoot":"","sources":["../../src/__tests__/config-mirror-integrity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,YAAY,GAA6C;IAC7D;QACE,+CAA+C;QAC/C,oEAAoE;KACrE;IACD;QACE,oDAAoD;QACpD,yEAAyE;KAC1E;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,oCAAoC;QACpC,yDAAyD;KAC1D;IACD;QACE,gCAAgC;QAChC,qDAAqD;KACtD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E;QACE,uCAAuC;QACvC,4DAA4D;KAC7D;IACD;QACE,iCAAiC;QACjC,sDAAsD;KACvD;IACD;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD;QACE,gDAAgD;QAChD,qEAAqE;KACtE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD;QACE,8BAA8B;QAC9B,mDAAmD;KACpD;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,gEAAgE;IAChE;QACE,kCAAkC;QAClC,uDAAuD;KACxD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,wCAAwC;QACxC,6DAA6D;KAC9D;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wCAAwC;IACxC;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yDAAyD;IACzD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6CAA6C;CAC9C,CAAC;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,KAAK,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,YAAY,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAEvD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,MAAM,cAAc,cAAc,SAAS,2BAA2B,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QAED,EAAE,CAAC,GAAG,SAAS,yBAAyB,cAAc,EAAE,EAAE,GAAG,EAAE;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACnE,MAAM,sBAAsB,GAAG,IAAI,CACjC,SAAS,EACT,4CAA4C,CAC7C,CAAC;IAEF,MAAM,WAAW,GACf,UAAU,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAGnD,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,gEAAgE,EAChE,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,+DAA+D,EAC/D,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,8DAA8D,EAC9D,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,wFAAwF,EACxF,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAC3D,MAAM,CAAC,oCAAoC,CAC5C,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}