@mmerterden/multi-agent-pipeline 20.28.0 → 20.30.0

package/pipeline/scripts/cost-analyze.mjs

@@ -50,7 +50,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSy
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { costUsd } from "./_cost.mjs";
+import { modelRateLookup, priceUsage as priceRecord } from "./_cost.mjs";
 import { readJsonl } from "./_jsonl.mjs";
 import { runMain } from "../lib/fatal.mjs";
 import { messages, outputLanguage } from "../lib/user-facing.mjs";
@@ -167,58 +167,7 @@ const asNumber = (v, fallback) => {
 
 const TABLE = JSON.parse(readFileSync(join(HERE, "cost-table.json"), "utf-8"));
 
-/**
- * Wire ID -> rate. Transcripts carry the wire value ("claude-opus-5-5"); the
- * price table is keyed by rung, so each rung's `modelId` and `copilotModelId`
- * map to its rate, `legacy` adds previous-generation IDs at their own rates,
- * and `models` overrides the rung rate for a dispatched ID whose model is not
- * the rung's (Copilot CLI's older models bill at their own rate). Matching on
- * the ID rather than the rung name keeps a generation move a data edit, which
- * is the contract cost-table.json states for itself.
- */
-const RATE_BY_MODEL_ID = new Map([
-  ...Object.entries(TABLE.legacy || {}),
-  ...Object.values(TABLE.prices || {}).flatMap((p) =>
-    [p.modelId, p.copilotModelId].filter(Boolean).map((id) => [id, p]),
-  ),
-  ...Object.entries(TABLE.models || {}),
-]);
-const IDS_LONGEST_FIRST = [...RATE_BY_MODEL_ID.keys()].sort((a, b) => b.length - a.length);
-
-function rateFor(modelId) {
-  if (!modelId) return null;
-  const exact = RATE_BY_MODEL_ID.get(modelId);
-  if (exact) return exact;
-  // A dated snapshot id (a known id, a hyphen, a release date) prices as that
-  // id; the longest known id wins, so a current id is never read as a shorter
-  // legacy one. Written as a shape rather than as a literal, because
-  // smoke-model-fallback.sh reads every model id in this tree and requires it
-  // to exist in cost-table.json. An id nobody knows prices as nothing and is
-  // COUNTED as unpriced rather than folded in at zero.
-  const id = IDS_LONGEST_FIRST.find(
-    (known) => modelId.startsWith(`${known}-`) || modelId.startsWith(`${known}[`),
-  );
-  return id ? RATE_BY_MODEL_ID.get(id) : null;
-}
-
-/**
- * Cache WRITES are not a discount, they are a surcharge: Anthropic prices a
- * 1h cache write above fresh input. cost-table.json carries cacheReadPerMtok
- * only, so the write rate is derived here at the published 1.25x of input and
- * labelled as derived - an unpriced component silently dropped would make
- * every long-context session look cheap, which is the direction that hurts.
- */
-const CACHE_WRITE_MULTIPLIER = 1.25;
-
-function priceRecord(rate, u) {
-  const fresh = Number(u.input_tokens || 0);
-  const out = Number(u.output_tokens || 0);
-  const cacheRead = Number(u.cache_read_input_tokens || 0);
-  const cacheWrite = Number(u.cache_creation_input_tokens || 0);
-  const base = costUsd(rate, fresh, out, cacheRead);
-  if (base === null) return null;
-  return base + (cacheWrite / 1_000_000) * (rate.inPerMtok || 0) * CACHE_WRITE_MULTIPLIER;
-}
+const rateFor = modelRateLookup(TABLE);
 
 // --- the series --------------------------------------------------------------
 

package/pipeline/scripts/cost-table.json

@@ -1,6 +1,7 @@
 {
   "_readme": "Per-model unit prices in USD per million tokens. Source: Anthropic public pricing (Claude-family rows verified 2026-10-14 against the current model table; the gpt-* rows remain approximate). Update when Anthropic publishes new tiers. Rung names (fable / opus / sonnet / haiku) are the pipeline's stable identifiers and `modelId` is the wire value they currently resolve to - dispatch reads the rung, so a generation move is a `modelId` edit here plus the phase specs, never a rename of the rungs. `copilotModelId`, where present, is the name Copilot CLI dispatches for the rung: one of the dotted IDs `copilot help config` lists (Copilot rejects any other as not available), the newest of the rung's family there. A rung without one (fable) is not offered on Copilot CLI, where its personas take the opus rung. smoke-model-fallback.sh checks the IDs against `copilot help config` when the CLI is installed. `provider` says which layer a rung belongs to: an `anthropic` rung is reachable from every call site; `free-chain` (the `free` rung) only from bulk-read and delegate, where the multi-agent-toolkit's verified free-model chain answers and the caller's default takes over when it escalates; any other provider from no call site. model-dispatch.sh enforces this. Unknown models render USD as ' - ' and emit a footnote  -  never block PR-body generation. cacheReadPerMtok is the discounted rate for prompt-cache hits, published per model and well below inPerMtok; the renderer prices a phase's tokens_cached at this rate when the tracker records it, so resume/cache reuse is visible in the ledger.",
   "schemaVersion": "1.1.0",
+  "verifiedAt": "2026-10-14",
   "_legacyReadme": "`legacy` prices previous-generation wire IDs a transcript may still name, keyed by the exact ID (a dated snapshot of one prices as it). Dispatch never reads it; cost-analyze consults it after the current `modelId` values and the `models` map. Official Anthropic prices per million tokens.",
   "legacy": {
     "claude-fable-5": { "inPerMtok": 10.0, "outPerMtok": 50.0, "cacheReadPerMtok": 1.0 },

package/pipeline/scripts/doctor.mjs

@@ -61,6 +61,7 @@ import {
 } from "../lib/unattended-settings-location.mjs";
 import { prefsHosts, profileGaps } from "../lib/unattended-profile-check.mjs";
 import { xcodeSkillsStatus } from "../lib/xcode-plugin.mjs";
+import { hookReport } from "../lib/hook-registration.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const HOME = homedir();
@@ -94,6 +95,7 @@ const CHECK_IDS = [
   "prefs-valid",
   "identity",
   "hook-coverage",
+  "hook-reachability",
   "credential-mapping",
   "credential-liveness",
   "store-reference",
@@ -515,6 +517,57 @@ function checkHookCoverage() {
   ok("hook-coverage");
 }
 
+// hook-coverage asks whether each template command appears in settings.json
+// at all. This asks what Claude Code will actually run: per event, a matcher
+// that covers the template's tool names, the script present under
+// ~/.claude/scripts, no disableAllHooks; and which preferences do nothing
+// because their hook is missing (lib/hook-registration.mjs).
+function checkHookReachability() {
+  const tpl = join(CLAUDE, "templates", "claude-hooks.json");
+  if (!existsSync(tpl)) {
+    skip("hook-reachability", "no hooks template installed to compare against");
+    return;
+  }
+  const r = hookReport({ templatePath: tpl, home: HOME });
+  if (r.error) {
+    skip("hook-reachability", r.error);
+    return;
+  }
+  if (r.ok) {
+    ok("hook-reachability");
+    return;
+  }
+  const parts = [];
+  if (r.disabled) parts.push(r.disabled);
+  else if (r.missing.length) {
+    const names = [
+      ...new Set(
+        r.missing.map(
+          (m) => `${m.script || m.command} on ${m.event}${m.matcher ? ` ${m.matcher}` : ""}`,
+        ),
+      ),
+    ];
+    parts.push(
+      `${r.missing.length} template hook(s) Claude Code will not run: ${names.slice(0, 4).join(", ")}${names.length > 4 ? ` and ${names.length - 4} more` : ""}`,
+    );
+  }
+  if (r.inert.length) {
+    parts.push(
+      `inert preference(s): ${r.inert.map((i) => `${i.pref} (needs ${i.script})`).join(", ")}`,
+    );
+  }
+  report(
+    "hook-reachability",
+    "WARN",
+    parts.join("; "),
+    `merge ${tpl} into ${join(CLAUDE, "settings.json")} (or run ${hostCommand("setup", HERE)})`,
+    [
+      ...r.missing.map((m) => `${m.event} ${m.matcher || "-"} ${m.command}: ${m.why}`),
+      ...r.inert.map((i) => `prefs.global.${i.pref} -> ${i.script}`),
+    ],
+  );
+}
+
 function credentialInventory() {
   const inv = join(CLAUDE, "lib", "credential-inventory.sh");
   if (!existsSync(inv)) return null;
@@ -1403,6 +1456,7 @@ function main() {
   checkPrefsValid();
   checkIdentity();
   checkHookCoverage();
+  checkHookReachability();
   checkCredentials(credentialInventory());
   checkStoreReference();
   checkEmbeddedCredentials();

package/pipeline/scripts/evidence-gate.mjs

@@ -75,7 +75,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
-import { gateContext } from "./gate-ledger.mjs";
+import { ATTENDED_RECORDED, gateContext } from "./gate-ledger.mjs";
 
 const LEDGER = fileURLToPath(new URL("./gate-ledger.mjs", import.meta.url));
 
@@ -203,15 +203,19 @@ function parseArgs(argv) {
 // the bytes are gone. The verdict is short today; the verdict is also the only
 // thing a caller reads, so losing half of it is the one failure that matters.
 let verdictExtra = {};
-// Only while the quality gates are active (lib/unattended.mjs, gatesActive):
-// one synchronous append, so the verdict and its ledger entry
+// While the quality gates are active (lib/unattended.mjs, gatesActive), and
+// for the build and test claims of an attended run: one synchronous append, so the verdict and its ledger entry
 // cannot come apart. A ledger problem is reported and never changes the verdict.
 let ledgerClaim = null;
 let ledgerState = null;
 function ledger(verdict, reason, extra) {
   if (!ledgerClaim) return;
   const ctx = gateContext({ statePath: ledgerState });
-  if (!ctx.active) return;
+  // Attended, only the build and test claims are recorded (marked attended):
+  // the attended commit check reads them. Without a run state there is
+  // nothing to record into.
+  if (!ctx.active && !(ctx.statePath && ATTENDED_RECORDED.has(`evidence-gate/${ledgerClaim}`)))
+    return;
   const detail = { reason, ...(extra.summary ? { summary: extra.summary } : {}) };
   if (verdictExtra.stack) detail.stack = verdictExtra.stack;
   const argv = [LEDGER, "append", "--gate", `evidence-gate/${ledgerClaim}`, "--verdict", verdict];

package/pipeline/scripts/gate-ledger.mjs

@@ -15,7 +15,8 @@
  *
  * Entries are written while the quality gates are active (lib/unattended.mjs,
  * gatesActive): MULTI_AGENT_UNATTENDED=1, or a run in autopilot mode. A run
- * that is neither writes nothing and state.gates[] stays absent. The commit
+ * that is neither writes only the gates in ATTENDED_RECORDED, each entry marked
+ * `attended: true`, and checkCommit never counts those. The commit
  * hook's REQUIREMENT is narrower: it applies only with the variable set, since
  * it is security enforcement and a terminal autopilot run has a person at it.
  *
@@ -32,6 +33,9 @@
  *   gate-ledger.mjs append --gate <id> --verdict pass|fail|not-applicable
  *                  [--detail '<json>'] [--state <path>] [--repo <dir>]
  *   gate-ledger.mjs check  [--state <path>] [--repo <dir>] [--sha <sha>] [--json]
+ *   gate-ledger.mjs evidence [--state <path>] [--repo <dir>] [--sha <sha>] [--json]
+ *     the attended commit check: build/test evidence for HEAD, per
+ *     prefs.global.attendedCommitGate.mode (exit 0 fine, 1 warn, 4 block)
  *   gate-ledger.mjs park   --outcome awaiting-answer|verification-failed
  *                  [--waiting-for <step>] [--gate <id>] [--reason <text>] [--state <path>]
  *
@@ -49,12 +53,21 @@
  */
 
 import { spawnSync } from "node:child_process";
-import { existsSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import { basename, dirname } from "node:path";
 
 import { decisionEntry, withDecision } from "../lib/decisions.mjs";
 import { invokedDirectly } from "../lib/invoked-directly.mjs";
 import { readRegularFile, readRegularJson } from "../lib/regular-file.mjs";
+import { globalPref } from "../lib/prefs-value.mjs";
+import { modeEntry } from "../lib/run-completion.mjs";
 import { attendedVerdict, gatesActive } from "../lib/unattended.mjs";
 import { listRuns, resolveRunFile } from "./_run-paths.mjs";
 import { acquireLock, releaseLock, stillOurs } from "./write-state.mjs";
@@ -80,6 +93,41 @@ export const MANDATORY_AT_COMMIT = [
   "plan-coverage",
 ];
 
+/**
+ * Gates whose verdict is recorded in an attended run too, marked
+ * `attended: true`. `plan-coverage` is what lib/run-completion.mjs reads
+ * before a run may write `status: complete`. One locked append per verdict;
+ * every other gate writes nothing while the gates are off.
+ */
+export const ATTENDED_RECORDED = new Set([
+  "plan-coverage",
+  "evidence-gate/build",
+  "evidence-gate/test",
+]);
+
+/** What an attended commit is checked for (pre-commit-check.sh, `evidence`). */
+export const ATTENDED_COMMIT_EVIDENCE = ["evidence-gate/build", "evidence-gate/test"];
+
+/** prefs.global.attendedCommitGate.mode values; `warn` is the default. */
+export const ATTENDED_COMMIT_MODES = ["off", "warn", "block"];
+
+/**
+ * The build/test evidence an attended commit on `sha` lacks: every gate in
+ * ATTENDED_COMMIT_EVIDENCE whose latest entry for that sha, attended or not,
+ * is missing or not passing.
+ *
+ * @param {object} state
+ * @param {string} sha
+ * @returns {string[]}
+ */
+export function attendedEvidenceGaps(state, sha) {
+  const latest = latestByGate(state?.gates, sha);
+  return ATTENDED_COMMIT_EVIDENCE.filter((g) => {
+    const e = latest.get(g);
+    return !e || !PASSING.has(e.verdict);
+  });
+}
+
 const QUESTION_ID = /^[a-z][a-z0-9-]*$/;
 const OPTION_ID = /^[a-z0-9][a-z0-9+_-]*$/;
 const QUESTION_KEYS = ["id", "stepId", "text", "kind", "options"];
@@ -201,6 +249,59 @@ export function resolveStatePath({ statePath = null, repo = null, env = process.
   }
 }
 
+export const TREE_MATCH_MAX_AGE_MS = 6 * 60 * 60 * 1000;
+
+/**
+ * The in-progress run an attended commit in `repo` belongs to, or null.
+ *
+ * Only a run still in progress counts: a finished local-mode run keeps the
+ * project root as its worktree forever and would otherwise judge every later
+ * commit there. Of several, the one bound to the hook's session (`sessionId`
+ * = MULTI_AGENT_SESSION_ID, or `hostSessionId` = the payload's session_id)
+ * wins, then the most recently written. A run matched only by its worktree
+ * counts while its state was written in the last six hours.
+ *
+ * @param {{repo: string, session?: string, env?: Record<string,string|undefined>}} opts
+ * @returns {string|null}
+ */
+export function liveRunFor({ repo, session = "", env = process.env }) {
+  const prevRoot = process.env.LOGS_ROOT;
+  if (env.LOGS_ROOT !== undefined) process.env.LOGS_ROOT = env.LOGS_ROOT;
+  try {
+    const top = toplevel(repo);
+    const want = top ? real(top) : null;
+    const launched = env.MULTI_AGENT_SESSION_ID || "";
+    const hits = [];
+    for (const run of listRuns()) {
+      const p = resolveRunFile(run.taskId, "agent-state.json", run.project);
+      if (!p) continue;
+      const doc = readJson(p);
+      if (!doc || typeof doc !== "object" || doc.status !== "in_progress") continue;
+      const bound =
+        (launched && doc.sessionId === launched) || (session && doc.hostSessionId === session);
+      const onTree =
+        want && typeof doc.worktreePath === "string" && real(doc.worktreePath) === want;
+      if (!bound && !onTree) continue;
+      let t = 0;
+      try {
+        t = statSync(p).mtimeMs;
+      } catch {
+        t = 0;
+      }
+      // A run that crashed keeps status in_progress forever. Matched only by
+      // its worktree, it judges commits there while its state is still being
+      // written; once it has gone quiet the tree is the user's again.
+      if (!bound && Date.now() - t > TREE_MATCH_MAX_AGE_MS) continue;
+      hits.push({ p, bound: bound ? 1 : 0, t });
+    }
+    hits.sort((a, b) => b.bound - a.bound || b.t - a.t);
+    return hits.length ? hits[0].p : null;
+  } finally {
+    if (prevRoot === undefined) delete process.env.LOGS_ROOT;
+    else process.env.LOGS_ROOT = prevRoot;
+  }
+}
+
 /**
  * Do the quality gates run here, and against which state?
  *
@@ -274,9 +375,17 @@ export async function record(
     throw new LedgerError("usage", `verdict must be one of ${VERDICTS.join(", ")}, got ${verdict}`);
   }
   const ctx = gateContext({ statePath, repo, env });
-  if (!ctx.active) return { written: false, reason: attendedVerdict(gate).reason };
+  const attended = !ctx.active;
+  if (attended && !ATTENDED_RECORDED.has(gate)) {
+    return { written: false, reason: attendedVerdict(gate).reason };
+  }
   const path = ctx.statePath;
-  if (!path) return { written: false, reason: "no run state found for this repository" };
+  if (!path) {
+    // Attended with no run to write into is the ordinary case outside the
+    // pipeline, not a ledger problem worth a line on stderr.
+    if (attended) return { written: false, reason: attendedVerdict(gate).reason };
+    return { written: false, reason: "no run state found for this repository" };
+  }
   let shaRepo = repo;
   if (!shaRepo) {
     const wt = ctx.state?.worktreePath;
@@ -288,6 +397,7 @@ export async function record(
     at: new Date().toISOString(),
     sha: headSha(shaRepo),
     detail: detail && typeof detail === "object" ? detail : { value: detail },
+    ...(attended ? { attended: true } : {}),
   };
   await updateState(path, (s) => ({
     ...s,
@@ -403,7 +513,12 @@ export function latestByGate(gates, sha) {
  * @returns {{ok: boolean, missing: string[], failing: object[], sha: string}}
  */
 export function checkCommit(state, sha, { mandatory = MANDATORY_AT_COMMIT } = {}) {
-  const latest = latestByGate(state?.gates, sha);
+  // An entry written while the gates were off says what an attended run
+  // observed; it never stands in for a verdict the unattended contract requires.
+  const gated = (Array.isArray(state?.gates) ? state.gates : []).filter(
+    (e) => !(e && e.attended === true),
+  );
+  const latest = latestByGate(gated, sha);
   const missing = [];
   const failing = [];
   for (const g of mandatory) {
@@ -499,6 +614,47 @@ async function main(argv) {
       );
     return 0;
   }
+  if (mode === "evidence") {
+    // The attended commit check: exit 0 nothing to say (no run, mode off, a
+    // mode that commits nothing, evidence present), 1 warn, 4 block. Never 2
+    // or 3 for a missing run: outside the pipeline a commit is none of this
+    // hook's business.
+    const pref = globalPref("attendedCommitGate.mode", "warn");
+    const gateMode = ATTENDED_COMMIT_MODES.includes(pref) ? pref : "warn";
+    if (gateMode === "off") return 0;
+    let session = "";
+    if (opts["hook-input"] === "-") {
+      try {
+        session = String(JSON.parse(readFileSync(0, "utf8"))?.session_id || "");
+      } catch {
+        session = "";
+      }
+    }
+    const path = opts.state || liveRunFor({ repo, session });
+    if (!path) return 0;
+    const state = readJson(path);
+    if (!state || typeof state !== "object") return 0;
+    if (state.status !== "in_progress") return 0;
+    if (modeEntry(state)?.commits === false) return 0;
+    const sha = opts.sha || headSha(repo);
+    if (!sha) return 0;
+    const missing = attendedEvidenceGaps(state, sha);
+    if (opts.json)
+      writeFileSync(1, `${JSON.stringify({ statePath: path, sha, gateMode, missing })}\n`);
+    if (!missing.length) return 0;
+    const verb = gateMode === "block" ? "BLOCKED" : "warning";
+    writeFileSync(
+      2,
+      `${[
+        `pre-commit-check: ${verb}: the run's gate ledger (${path}) has no passing ${missing.join(" / ")} for HEAD ${sha.slice(0, 12)}.`,
+        "  Run the build and the tests through evidence-gate.mjs (Phase 2 Gate 1) so the commit rests on recorded evidence.",
+        gateMode === "block"
+          ? "  prefs.global.attendedCommitGate.mode is block; set it to warn to commit anyway."
+          : "  The commit goes ahead; prefs.global.attendedCommitGate.mode block refuses it instead.",
+      ].join("\n")}\n`,
+    );
+    return gateMode === "block" ? 4 : 1;
+  }
   if (mode === "park") {
     const path = resolveStatePath({ statePath: opts.state, repo });
     let pendingQuestion;
@@ -523,7 +679,7 @@ async function main(argv) {
     });
     return 0;
   }
-  throw new LedgerError("usage", "mode must be append, check or park");
+  throw new LedgerError("usage", "mode must be append, check, evidence or park");
 }
 
 if (invokedDirectly(import.meta.url)) {
@@ -533,7 +689,7 @@ if (invokedDirectly(import.meta.url)) {
       process.stderr.write(`gate-ledger: ${err.message}\n`);
       if (err.code === "usage") {
         process.stderr.write(
-          "usage: gate-ledger.mjs append|check|park [--gate g] [--verdict v] [--detail json] [--state p] [--repo d] [--sha s] [--json]\n",
+          "usage: gate-ledger.mjs append|check|evidence|park [--gate g] [--verdict v] [--detail json] [--state p] [--repo d] [--sha s] [--json]\n",
         );
         process.exit(2);
       }

package/pipeline/scripts/office-build.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * office-build.mjs - assemble the office panel page from pipeline/office-src.
+ *
+ * The server's CSP allows one nonce'd inline script, one nonce'd inline style
+ * and data: images, so the page has to be a single file. The sources stay
+ * readable as separate files (shell.html, style.css, world.js, app.js,
+ * strings.json) and this script inlines them into
+ * pipeline/office/index.html: the list of sprite names in pipeline/office/assets
+ * (served by contract-server.mjs at /office/assets/), the strings as a JSON
+ * literal, the two code files in order inside one IIFE.
+ *
+ *   node pipeline/scripts/office-build.mjs          write the page
+ *   node pipeline/scripts/office-build.mjs --check  exit 1 when the page on
+ *                                                   disk is not what the
+ *                                                   sources build to
+ */
+
+import { readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const ROOT = join(import.meta.dirname, "..");
+const SRC = join(ROOT, "office-src");
+const OUT = join(ROOT, "office", "index.html");
+const ASSETS = join(ROOT, "office", "assets");
+const PNG_SIGNATURE = "89504e470d0a1a0a";
+
+// The sprite names the page may load from /office/assets/: every PNG beside
+// the page, checked to be one.
+function atlas() {
+  const out = [];
+  for (const name of readdirSync(ASSETS).sort()) {
+    if (!name.endsWith(".png")) continue;
+    const buf = readFileSync(join(ASSETS, name));
+    if (buf.subarray(0, 8).toString("hex") !== PNG_SIGNATURE) {
+      throw new Error(`${name} is not a PNG file`);
+    }
+    out.push(basename(name, ".png"));
+  }
+  return out;
+}
+
+export function build() {
+  const read = (f) => readFileSync(join(SRC, f), "utf8");
+  const strings = JSON.parse(read("strings.json"));
+  const sprites = atlas();
+  const script = [
+    '"use strict";',
+    "(() => {",
+    `const ATLAS = ${JSON.stringify(sprites)};`,
+    `const STRINGS = ${JSON.stringify(strings)};`,
+    'const spriteUrl = (name) => "/office/assets/" + name + ".png";',
+    read("world.js").trim(),
+    read("app.js").trim(),
+    "})();",
+  ].join("\n");
+  const style = read("style.css").trim();
+  // Text that would close the inline element early, or open an HTML comment
+  // inside it, turns source into markup.
+  if (/<\/script|<!--/i.test(script)) throw new Error("the script contains </script or <!--");
+  if (/<\/style/i.test(style)) throw new Error("style.css contains </style");
+  const shell = read("shell.html");
+  for (const marker of ["/*STYLE*/", "/*SCRIPT*/"]) {
+    if (shell.split(marker).length !== 2) throw new Error(`shell.html needs exactly one ${marker}`);
+  }
+  return shell.replace("/*STYLE*/", () => style).replace("/*SCRIPT*/", () => script);
+}
+
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain) {
+  const html = build();
+  if (process.argv.includes("--check")) {
+    let current = "";
+    try {
+      current = readFileSync(OUT, "utf8");
+    } catch {
+      // A missing page is stale by definition.
+    }
+    if (current !== html) {
+      console.error("office/index.html is stale: run node pipeline/scripts/office-build.mjs");
+      process.exit(1);
+    }
+    console.log("office/index.html matches its sources");
+  } else {
+    writeFileSync(OUT, html);
+    console.log(`wrote ${OUT} (${Buffer.byteLength(html)} bytes)`);
+  }
+}