@roomi-fields/grillhouse 0.0.0-stage → 0.23.1

package/scripts/verrou-de-fichier.mjs

@@ -0,0 +1,130 @@
+// The lock of a file shared between processes: the file `<verrou>` stands while someone holds it.
+// Taken by the integration (`.git/integration.lock`, `.git/file-integration.lock`) and by the
+// register (`registre.jsonl.verrou`).
+//
+// - A lock is created whole and exclusively: its mark (the owner's process number, then a token
+//   unique to the taking) is written to a private file that is linked to `<verrou>`; the link
+//   fails while the lock stands. A lock is never seen empty.
+// - Two judgements of an abandoned lock. By default the owner's process number: a lock whose
+//   process is gone is taken over. With `perime` (ms), the lock's age: a lock last written more
+//   than `perime` ms ago is taken over whatever process it names, for owners that do not share
+//   process numbers (a role agent runs under bwrap --unshare-pid; outside its envelope its
+//   number means nothing).
+// - A takeover moves the lock aside by renaming it (one taker wins), judges what it moved, and
+//   deletes it only if it is the abandoned one; a fresh lock moved by mistake is put back.
+// - A release removes the lock only when it still holds the mark of the taking being released.
+// - The owner is the taking process by default; `pid` names another, for a lock that outlives its
+//   taker (the supervisor's, taken by the session start for the session's own process,
+//   scripts/superviseur.mjs).
+import { randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  linkSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { vivant } from './vitest-config/base-de-passe.mjs';
+
+/** Blocks the process for `ms` milliseconds. */
+export const attendreUnPeu = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+// The marks of the locks this process holds, by lock path.
+const marques = new Map();
+
+function lire(f) {
+  try {
+    return readFileSync(f, 'utf8').trim();
+  } catch {
+    return null;
+  }
+}
+
+// Whether the lock file `f` is abandoned: by its age with `perime`, else by its owner's process.
+function abandonne(f, perime) {
+  if (perime !== null) {
+    try {
+      return Date.now() - statSync(f).mtimeMs > perime;
+    } catch {
+      return false;
+    }
+  }
+  const contenu = lire(f);
+  const pid = contenu === null ? null : /^(\d+)(?::|$)/.exec(contenu)?.[1];
+  return pid !== null && pid !== undefined && !vivant(Number(pid));
+}
+
+// Creates `verrou` holding `marque` in one step; false while it stands.
+function creer(verrou, marque) {
+  const prive = `${verrou}.${marque.replace(':', '-')}`;
+  writeFileSync(prive, marque, { flag: 'wx' });
+  try {
+    linkSync(prive, verrou);
+    return true;
+  } catch (e) {
+    if (e.code !== 'EEXIST') throw e;
+    return false;
+  } finally {
+    rmSync(prive, { force: true });
+  }
+}
+
+// Removes the abandoned lock `verrou`. It is moved aside first, so only one taker moves it; what
+// was moved is judged again, and a lock that turns out fresh is put back.
+function reprendre(verrou, perime) {
+  const ecarte = `${verrou}.${process.pid}-${randomUUID()}.reprise`;
+  try {
+    renameSync(verrou, ecarte);
+  } catch {
+    return;
+  }
+  if (abandonne(ecarte, perime)) {
+    rmSync(ecarte, { force: true });
+    return;
+  }
+  try {
+    linkSync(ecarte, verrou);
+  } catch {
+    // another taker already holds a new lock: the one moved aside is lost with its owner's release
+  }
+  rmSync(ecarte, { force: true });
+}
+
+/**
+ * Takes the lock file `verrou`. Returns true once taken; with `attendre` false, returns false
+ * while another holds it.
+ * @param {string} verrou the lock file
+ * @param {{ attendre: boolean, perime?: number | null, pid?: number }} options `perime` (ms)
+ *   judges an abandoned lock by its age instead of its owner's process; `pid` names the owner,
+ *   the taking process by default
+ * @returns {boolean} whether the lock is taken
+ */
+export function prendreVerrou(verrou, { attendre, perime = null, pid = process.pid }) {
+  const marque = `${pid}:${randomUUID()}`;
+  for (;;) {
+    if (creer(verrou, marque)) {
+      marques.set(verrou, marque);
+      return true;
+    }
+    if (abandonne(verrou, perime)) {
+      reprendre(verrou, perime);
+      continue;
+    }
+    if (!attendre) return false;
+    attendreUnPeu(perime === null ? 200 : 20);
+  }
+}
+
+/**
+ * Releases the lock this process took on `verrou`; a lock another holds now stays.
+ * @param {string} verrou the lock file
+ */
+export function lacherVerrou(verrou) {
+  const marque = marques.get(verrou);
+  marques.delete(verrou);
+  if (marque !== undefined && existsSync(verrou) && lire(verrou) === marque) {
+    rmSync(verrou, { force: true });
+  }
+}

package/scripts/verrou-de-machine.mjs

@@ -0,0 +1,211 @@
+// The lock of the machine for the heavy measure: one heavy measure at a time on the machine,
+// whatever repository it plays in, as GNU make's job server shares its slots between every make of
+// one build, and as Bazel holds a test that declares it wants the whole machine. Taken by every
+// `npm run verifier` (scripts/verifier.mjs: the integration's, the queue's, the night's, a
+// supervisor's) and by the heavy passes of the circuit of a ticket (scripts/circuit.mjs: the proof
+// of the red and the checks), so that a measure gives the result of the code, not that of another
+// measure beside it.
+//
+// - The lock is one file of the user's cache, shared by every repository of the machine:
+//   `${XDG_CACHE_HOME:-~/.cache}/grillhouse/mesure-lourde.lock`; GRILLHOUSE_VERROU_MACHINE names
+//   another file (the base configuration of the tests gives each test file its own,
+//   scripts/vitest-config/machine.setup.mjs). It is taken through scripts/verrou-de-fichier.mjs,
+//   judged by its owner's process: a lock whose process is gone is taken over.
+// - A second measure waits for the end of the first, then plays once it holds the lock. It says
+//   that it waits and whom for (the process that holds the lock, its working directory, its
+//   command, since when) when it begins, then every 30 s, so that a log shows a pass is not
+//   frozen.
+// - The wait is bounded, as `flock -w` and a database's lock timeout: ATTENTE_MACHINE_MS, 60 min,
+//   longer than the longest full pass measured (the frame's, 21 min; a final pass of BPScript
+//   320.3, 35.5 min, a wait for rest of the CPU included); GRILLHOUSE_ATTENTE_MACHINE_MS names
+//   another bound, in ms. The bound reached, the measure stops at « à repasser » (75): another
+//   measure holds the machine, which is neither green nor red, and whoever launched the measure
+//   presents it again later. The stop throws an AttenteDeLaMachine, which names the holder.
+// - A lock held by an ancestor of the waiting process (its parent, its parent's parent…, or the
+//   process itself) is a deadlock: the ancestor waits for its descendant, which waits for the
+//   lock. The wait says so at once and stops, red (1): the descendant lost the mark of the taking
+//   (an environment rebuilt, a test's), a defect to correct and not a load to wait out. It does
+//   not play under the ancestor's lock: make plays such a child at `-j1` because it cannot tell,
+//   but here the lost mark is the defect, and playing would hide it.
+// - Who holds the lock passes it to its children, as make passes its job server in MAKEFLAGS: the
+//   variable GRILLHOUSE_MESURE_TENUE carries the mark of the taking, and a process whose variable
+//   names the mark the lock holds plays under it without taking it again (the final pass of the
+//   circuit, `npm run verifier`, under the circuit's lock).
+// - In the envelope of an agent (GRILLHOUSE_ENVELOPPE set, scripts/enveloppe/composant.mjs) no lock
+//   is taken: the envelope has its own process space, where an owner's number means nothing
+//   outside, and its home shows no cache.
+// - The lock is let go at the end of the measure, whether it succeeds or throws.
+import { mkdirSync, readFileSync, readlinkSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { composantDeLEnveloppe } from './enveloppe/composant.mjs';
+import { attendreUnPeu, lacherVerrou, prendreVerrou } from './verrou-de-fichier.mjs';
+import { A_REPASSER } from './vitest-config/pression.mjs';
+
+const VARIABLE_VERROU = 'GRILLHOUSE_VERROU_MACHINE';
+const VARIABLE_TENUE = 'GRILLHOUSE_MESURE_TENUE';
+const VARIABLE_ATTENTE = 'GRILLHOUSE_ATTENTE_MACHINE_MS';
+
+/** The longest wait for the lock of the machine, in ms, unless GRILLHOUSE_ATTENTE_MACHINE_MS names another. */
+export const ATTENTE_MACHINE_MS = 60 * 60_000;
+// The gap between two lines that say the wait goes on.
+const RAPPEL_MS = 30_000;
+
+/** The stop of a wait for the lock of the machine: `code` is 75 at the bound, 1 for a deadlock. */
+export class AttenteDeLaMachine extends Error {
+  /**
+   * @param {string} message what stops the wait, the holder named
+   * @param {number} code the exit code the measure ends on
+   */
+  constructor(message, code) {
+    super(message);
+    this.name = 'AttenteDeLaMachine';
+    this.code = code;
+  }
+}
+
+// The lock file of the machine under <env>, beside which a measure out of a ticket names its
+// progress (scripts/avancement.mjs).
+export function verrouDeMachine(env = process.env) {
+  if (env[VARIABLE_VERROU]) return env[VARIABLE_VERROU];
+  const cache = env.XDG_CACHE_HOME || path.join(env.HOME || homedir(), '.cache');
+  return path.join(cache, 'grillhouse', 'mesure-lourde.lock');
+}
+
+const lire = f => {
+  try {
+    return readFileSync(f, 'utf8').trim();
+  } catch {
+    return null;
+  }
+};
+
+// The process number in the lock <verrou>, or null.
+function detenteur(verrou) {
+  const pid = /^(\d+)/.exec(lire(verrou) ?? '')?.[1];
+  return pid ? Number(pid) : null;
+}
+
+const heure = ms => new Date(ms).toTimeString().slice(0, 8);
+const duree = ms =>
+  ms < 120_000 ? `${Math.round(ms / 1000)} s` : `${Math.round(ms / 60_000)} min`;
+
+// Who holds the lock <verrou>: its process, that process's working directory and command when
+// they read (on one line, cut at 200 characters), and since when the lock stands (« le processus 12 (dans /d) : node x, depuis
+// 10:04:31 (3 min) »).
+function qui(verrou) {
+  const pid = detenteur(verrou);
+  if (pid === null) return 'une autre mesure';
+  let ou = '';
+  try {
+    ou = ` (dans ${readlinkSync(`/proc/${pid}/cwd`)})`;
+  } catch {
+    // its directory does not read: the process alone is named
+  }
+  const commande = (lire(`/proc/${pid}/cmdline`) ?? '')
+    .split('\0')
+    .filter(Boolean)
+    .join(' ')
+    .replace(/\s+/g, ' ');
+  const quoi = commande
+    ? ` : ${commande.length > 200 ? `${commande.slice(0, 200)}…` : commande}`
+    : '';
+  let depuis = '';
+  try {
+    const t = statSync(verrou).mtimeMs;
+    depuis = `, depuis ${heure(t)} (${duree(Date.now() - t)})`;
+  } catch {
+    // the lock is gone meanwhile
+  }
+  return `le processus ${pid}${ou}${quoi}${depuis}`;
+}
+
+// The parent of the process <pid>, read in /proc (the field after the state, which follows the
+// command, itself free to hold spaces and parentheses), or null.
+function parent(pid) {
+  const stat = lire(`/proc/${pid}/stat`);
+  const ppid = stat ? Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ')[1]) : NaN;
+  return Number.isInteger(ppid) && ppid > 0 ? ppid : null;
+}
+
+// Whether <pid> is this process or one of its ancestors.
+function ancetre(pid) {
+  for (let p = process.pid; p !== null; p = parent(p)) if (p === pid) return true;
+  return false;
+}
+
+// The bound of the wait under <env>, in ms.
+function borneDe(env) {
+  const n = Number(env[VARIABLE_ATTENTE]);
+  return env[VARIABLE_ATTENTE] && Number.isFinite(n) && n >= 0 ? n : ATTENTE_MACHINE_MS;
+}
+
+// Waits for the lock <verrou>, saying so (`dire`) when it begins and every <rappelMs>; returns the
+// time waited, in ms. Throws an AttenteDeLaMachine at once when an ancestor holds the lock, and at
+// the bound <borneMs>.
+function attendreLaMachine(verrou, { dire, borneMs, rappelMs }) {
+  const debut = Date.now();
+  let dit = null;
+  for (;;) {
+    const pid = detenteur(verrou);
+    if (pid !== null && ancetre(pid))
+      throw new AttenteDeLaMachine(
+        `✗ blocage : le verrou de la mesure lourde (${verrou}) est tenu par un ancêtre de ce processus (${process.pid}), ${qui(verrou)} ; il attend la fin de ce processus, qui attendrait la sienne. L'environnement a perdu la marque de la prise (${VARIABLE_TENUE}) ; un essai nomme son propre verrou (${VARIABLE_VERROU}).`,
+        1
+      );
+    const t = Date.now();
+    if (t - debut >= borneMs)
+      throw new AttenteDeLaMachine(
+        `⏱ attente du verrou de la machine bornée à ${duree(borneMs)} (${VARIABLE_ATTENTE}) : le verrou (${verrou}) est encore tenu par ${qui(verrou)} ; à repasser (code ${A_REPASSER}).`,
+        A_REPASSER
+      );
+    if (dit === null)
+      dire(
+        `⏳ la machine mesure déjà : le verrou de la mesure lourde (${verrou}) est tenu par ${qui(verrou)} ; attente de sa fin, ${duree(borneMs)} au plus.`
+      );
+    else if (t - dit >= rappelMs)
+      dire(
+        `⏳ attente du verrou de la machine depuis ${duree(t - debut)} : il est tenu par ${qui(verrou)}.`
+      );
+    if (dit === null || t - dit >= rappelMs) dit = t;
+    if (prendreVerrou(verrou, { attendre: false })) return Date.now() - debut;
+    attendreUnPeu(Math.max(1, Math.min(200, borneMs - (Date.now() - debut))));
+  }
+}
+
+/**
+ * Runs <mesure> under the lock of the machine and returns what it returns. <mesure> receives the
+ * environment of its children, which carries the lock to them.
+ * @param {(envEnfant: Record<string, string | undefined>) => T} mesure a synchronous measure
+ * @param {{ env?: Record<string, string | undefined>, dire?: (ligne: string) => void,
+ *   borneMs?: number, rappelMs?: number }} options `borneMs`, the bound of the wait
+ *   (GRILLHOUSE_ATTENTE_MACHINE_MS, else ATTENTE_MACHINE_MS); `rappelMs`, the gap between two
+ *   lines that say the wait goes on (30 s)
+ * @returns {T}
+ * @throws {AttenteDeLaMachine} at the bound of the wait (code 75), or at once when an ancestor
+ *   holds the lock (code 1)
+ * @template T
+ */
+export function avecLaMachine(
+  mesure,
+  {
+    env = process.env,
+    dire = l => process.stdout.write(`${l}\n`),
+    borneMs = borneDe(env),
+    rappelMs = RAPPEL_MS,
+  } = {}
+) {
+  if (composantDeLEnveloppe(env)) return mesure(env);
+  const verrou = verrouDeMachine(env);
+  if (env[VARIABLE_TENUE] && lire(verrou) === env[VARIABLE_TENUE]) return mesure(env);
+  mkdirSync(path.dirname(verrou), { recursive: true });
+  if (!prendreVerrou(verrou, { attendre: false })) {
+    const attendu = attendreLaMachine(verrou, { dire, borneMs, rappelMs });
+    dire(`✓ verrou de la machine pris après ${Math.round(attendu / 1000)} s.`);
+  }
+  try {
+    return mesure({ ...env, [VARIABLE_TENUE]: lire(verrou) ?? '' });
+  } finally {
+    lacherVerrou(verrou);
+  }
+}

package/scripts/verrous/commande.mjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+// The lock of the commands of a role that writes (the testwriter, the developpeur): a PreToolUse hook
+// on Bash, which the settings of its session declare (scripts/droits.mjs). It reads the hook's JSON
+// on stdin and refuses, exit code 2 and its reason on stderr, a command whose shell writes a file
+// out of the session's temporary directory: an output redirection (`>`, `>>`, `>|`, `&>`, `1>`…)
+// or `tee`. A file of the repository is written by the tools of writing (Write, Edit), which the
+// role's write lock (verrou.mjs) judges; a rule of Claude Code does not see a redirection, and a
+// session in its envelope runs without the check of writes.
+//
+// - Allowed targets: the null and standard devices (`/dev/null`, `/dev/stdout`, `/dev/stderr`,
+//   `/dev/fd/…`), a duplication of a descriptor (`2>&1`, `>&2`), and a path under the temporary
+//   directory (`os.tmpdir()`, the envelope's TMPDIR), written plainly or by `$TMPDIR`/`${TMPDIR}`.
+//   A relative path is judged from the command's working directory (the input's `cwd`). A target
+//   that names any other variable or a substitution cannot be judged, and is refused.
+// - What quotes hold, and the body of a here-document, is text: a `>` there redirects nothing.
+// - An input it cannot read, or another tool, passes: a hook never stops the session on its own
+//   failure.
+import { readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const PERIPHERIQUES = /^\/dev\/(null|stdout|stderr|tty|fd\/\d+)$/;
+
+// The targets of the files <commande> writes by the shell, `$TMPDIR` read as <tmp>: each
+// `{ cible, brute }`, `cible` the word once its quotes are read, null when a variable or a
+// substitution keeps it unknown.
+function ecrituresDuShell(commande, tmp = tmpdir()) {
+  const out = [];
+  const n = commande.length;
+  let i = 0;
+  // The here-documents whose bodies start at the next line.
+  let documents = [];
+  // A word from <j>: its text with quotes read, whether it holds an expansion, and where it ends.
+  const mot = j => {
+    let texte = '';
+    let inconnu = false;
+    while (j < n && /\s/.test(commande[j]) && commande[j] !== '\n') j++;
+    while (j < n && !/[\s;&|<>()]/.test(commande[j])) {
+      const c = commande[j];
+      if (c === "'") {
+        const f = commande.indexOf("'", j + 1);
+        texte += commande.slice(j + 1, f < 0 ? n : f);
+        j = f < 0 ? n : f + 1;
+      } else if (c === '"') {
+        let k = j + 1;
+        while (k < n && commande[k] !== '"') {
+          if (commande[k] === '\\') k++;
+          else if (commande[k] === '$' || commande[k] === '`') inconnu = true;
+          texte += commande[k] ?? '';
+          k++;
+        }
+        j = k + 1;
+      } else if (c === '\\') {
+        texte += commande[j + 1] ?? '';
+        j += 2;
+      } else {
+        if (c === '$' || c === '`') inconnu = true;
+        texte += c;
+        j++;
+      }
+    }
+    return { texte, inconnu, fin: j };
+  };
+  const cible = w => {
+    const variable = /^\$(\{TMPDIR\}|TMPDIR)(\/.*)?$/.exec(w.texte);
+    if (variable) return { cible: path.join(tmp, variable[2] ?? ''), brute: w.texte };
+    return { cible: w.inconnu ? null : w.texte, brute: w.texte };
+  };
+  while (i < n) {
+    const c = commande[i];
+    if (c === '\n' && documents.length) {
+      // The bodies of the here-documents opened on the line just ended.
+      let j = i + 1;
+      for (const fin of documents) {
+        while (j < n) {
+          const e = commande.indexOf('\n', j);
+          const ligne = commande.slice(j, e < 0 ? n : e);
+          j = e < 0 ? n : e + 1;
+          if (ligne.replace(/^\t+/, '') === fin) break;
+        }
+      }
+      documents = [];
+      i = j;
+      continue;
+    }
+    if (c === "'") {
+      const f = commande.indexOf("'", i + 1);
+      i = f < 0 ? n : f + 1;
+      continue;
+    }
+    if (c === '"') {
+      let k = i + 1;
+      while (k < n && commande[k] !== '"') k += commande[k] === '\\' ? 2 : 1;
+      i = k + 1;
+      continue;
+    }
+    if (c === '\\') {
+      i += 2;
+      continue;
+    }
+    if (c === '<' && commande[i + 1] === '<' && commande[i + 2] !== '<') {
+      const w = mot(i + (commande[i + 2] === '-' ? 3 : 2));
+      if (w.texte) documents.push(w.texte);
+      i = w.fin;
+      continue;
+    }
+    if (c === '>') {
+      let j = i + 1;
+      if (commande[j] === '>' || commande[j] === '|') j++;
+      // A duplication of a descriptor, `>&2`, writes no file.
+      if (commande[j] === '&') {
+        i = j + 1;
+        continue;
+      }
+      const w = mot(j);
+      if (w.texte) out.push(cible(w));
+      i = w.fin;
+      continue;
+    }
+    if (c === '&' && commande[i + 1] === '>') {
+      const w = mot(i + (commande[i + 2] === '>' ? 3 : 2));
+      if (w.texte) out.push(cible(w));
+      i = w.fin;
+      continue;
+    }
+    // `tee` as a command word: each of its operands is a file it writes.
+    if (/[a-z]/.test(c) && (i === 0 || /[\s;&|(]/.test(commande[i - 1]))) {
+      const w = mot(i);
+      if (w.texte === 'tee') {
+        let j = w.fin;
+        for (;;) {
+          const a = mot(j);
+          if (!a.texte) break;
+          if (!a.texte.startsWith('-')) out.push(cible(a));
+          j = a.fin;
+        }
+        i = j;
+      } else {
+        i = Math.max(w.fin, i + 1);
+      }
+      continue;
+    }
+    i++;
+  }
+  return out;
+}
+
+// The reason the command of this hook input is refused, or null when it passes.
+export function refusDeCommande(input, { tmp = tmpdir() } = {}) {
+  if (input?.tool_name !== 'Bash') return null;
+  const commande = String(input.tool_input?.command ?? '');
+  const cwd = input.cwd ?? process.cwd();
+  const interieur = f => {
+    const rel = path.relative(path.resolve(tmp), f);
+    return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
+  };
+  const enTrop = ecrituresDuShell(commande, tmp).filter(({ cible }) => {
+    if (cible === null) return true;
+    if (PERIPHERIQUES.test(cible)) return false;
+    const absolu = path.resolve(cwd, cible);
+    return !interieur(absolu);
+  });
+  if (!enTrop.length) return null;
+  return `Le shell n'écrit pas les fichiers du dépôt (${enTrop.map(e => e.brute).join(', ')}) : un fichier s'écrit par l'outil Write ou Edit, que le verrou de ton rôle juge ; un fichier temporaire va dans ${tmp}.`;
+}
+
+const direct = import.meta.url === pathToFileURL(process.argv[1] ?? '').href;
+if (direct) {
+  let raison = null;
+  try {
+    raison = refusDeCommande(JSON.parse(readFileSync(0, 'utf8')));
+  } catch {
+    // An input it cannot read passes.
+  }
+  if (raison) {
+    process.stderr.write(`${raison}\n`);
+    process.exitCode = 2;
+  }
+}

package/scripts/verrous/ticket-du-sous-agent.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+// The ticket of a role agent: a PreToolUse hook on the Agent tool, which the frame's plugin declares
+// (`grillhouse ticket-du-sous-agent`). It refuses to launch one of the frame's role agents (the
+// plugin's `agents/<role>.md`, `$CLAUDE_PLUGIN_ROOT`; the agent named bare or as
+// `grillhouse:<role>`) whose prompt does not name its ticket by a « TON TICKET : <id> » line, with
+// exit code 2 and its reason on stderr. The board ties each agent, its time and its tokens to that
+// ticket.
+//
+// - Other agents (exploration, documentation) launch freely.
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const TICKET = /TON TICKET\s*:\s*[A-Za-z0-9_.-]+/;
+
+// The refusal for this launch, or null. `isRole(name)` says whether the frame defines that agent.
+export function refusal(input, isRole) {
+  if (input.tool_name !== 'Agent' && input.tool_name !== 'Task') return null;
+  const role = input.tool_input?.subagent_type;
+  if (!role || !isRole(role)) return null;
+  if (TICKET.test(input.tool_input?.prompt ?? '')) return null;
+  return `L'agent ${role} part sans son ticket : sa consigne porte la ligne « TON TICKET : <id> ». Ainsi le tableau rattache l'agent, son temps et ses jetons à son ticket.`;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  const input = JSON.parse(readFileSync(0, 'utf8'));
+  const greffon = process.env.CLAUDE_PLUGIN_ROOT;
+  const r = refusal(
+    input,
+    role =>
+      Boolean(greffon) &&
+      /^(?:grillhouse:)?[A-Za-z0-9_-]+$/.test(role) &&
+      existsSync(path.join(greffon, 'agents', `${role.replace(/^grillhouse:/, '')}.md`))
+  );
+  if (r) {
+    process.stderr.write(`⛔ ${r}\n`);
+    process.exitCode = 2;
+  }
+}