@tangle-network/agent-app 0.60.215 → 0.60.216

package/dist/{chunk-KDPTXXOQ.js → chunk-J3N6RNMH.js}

@@ -1,3 +1,7 @@
+import {
+  LAUNCH_BUDGETS
+} from "./chunk-LRYY3OX7.js";
+
 // src/signoff/worker-defaults.ts
 import { spawnSync } from "child_process";
 import { existsSync } from "fs";
@@ -6,10 +10,13 @@ import { basename, dirname, join } from "path";
 var WORKER_DEFAULTS_STEP = "worker defaults";
 var WORKER_COMPATIBILITY_DATE_FLOOR = "2026-09-01";
 var WRANGLER_CONFIG_NAME = /^wrangler[.-]?[\w.-]*\.(toml|json|jsonc)$/;
-function trackedWorkerConfigs(repoRoot) {
-  const listed = spawnSync("git", ["ls-files", "-z"], { cwd: repoRoot, encoding: "utf8" });
+function trackedFiles(repoRoot) {
+  const listed = spawnSync("git", ["ls-files", "-z"], { cwd: repoRoot, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
   if (listed.status !== 0) throw new Error(`signoff: git ls-files failed in ${repoRoot}: ${listed.stderr}`);
-  return listed.stdout.split("\0").filter((path) => path !== "" && WRANGLER_CONFIG_NAME.test(basename(path))).sort();
+  return listed.stdout.split("\0").filter((path) => path !== "");
+}
+function trackedWorkerConfigs(repoRoot) {
+  return trackedFiles(repoRoot).filter((path) => WRANGLER_CONFIG_NAME.test(basename(path))).sort();
 }
 function problemsFor(config) {
   const problems = [];
@@ -98,10 +105,351 @@ function formatWorkerDefaults(result) {
 }
 
 // src/signoff/config.ts
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { join as join2, resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join3, resolve } from "path";
 import { pathToFileURL } from "url";
 import { z } from "zod";
+
+// src/signoff/app-defaults.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync2, mkdtempSync, readFileSync, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { join as join2, posix } from "path";
+var APP_DEFAULTS_STEP = "agent-app defaults";
+var EXEMPTIBLE_DEFAULTS = ["turn-trace", "first-text", "prewarm", "placement", "limit-alarms"];
+var AGENT_APP_OUTCOME_FLOORS = [
+  { id: "turn-trace", label: "turn trace", since: "0.60.199" },
+  { id: "first-text", label: "first text", since: "0.60.203" }
+];
+var SOURCE_EXTENSIONS = /\.(?:[cm]?[jt]sx?)$/;
+var NOT_SOURCE = /(?:^|\/)(?:node_modules|dist|build|\.wrangler|tests?|__tests__|e2e|scripts|proof|journeys?|evals?|docs|examples|stories|\.storybook)\/|\.(?:test|spec|stories|e2e|bench)\.[cm]?[jt]sx?$|\.d\.ts$/;
+var MAX_SOURCE_BYTES = 400 * 1024;
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function findAppPackages(repoRoot, tracked) {
+  const packages = [];
+  for (const path of tracked) {
+    if (posix.basename(path) !== "package.json" || /(?:^|\/)node_modules\//.test(path)) continue;
+    const pkg = readJson(join2(repoRoot, path));
+    if (!pkg || pkg.name === "@tangle-network/agent-app") continue;
+    const spec = pkg.dependencies?.["@tangle-network/agent-app"] ?? pkg.devDependencies?.["@tangle-network/agent-app"] ?? pkg.peerDependencies?.["@tangle-network/agent-app"];
+    if (spec === void 0) continue;
+    packages.push({ name: pkg.name ?? posix.dirname(path), dir: posix.dirname(path), spec });
+  }
+  return packages;
+}
+function underDir(path, dir) {
+  return dir === "." || path === dir || path.startsWith(`${dir}/`);
+}
+function withoutComments(text) {
+  return text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(?<!:)\/\/.*$/gm, "");
+}
+function readSources(repoRoot, tracked, dir, others) {
+  const files = [];
+  for (const path of tracked) {
+    if (!underDir(path, dir) || !SOURCE_EXTENSIONS.test(path) || NOT_SOURCE.test(path)) continue;
+    if (others.some((other) => other !== dir && other !== "." && underDir(path, other) && underDir(other, dir))) continue;
+    const abs = join2(repoRoot, path);
+    try {
+      if (statSync(abs).size > MAX_SOURCE_BYTES) continue;
+      files.push({ path, text: withoutComments(readFileSync(abs, "utf8")) });
+    } catch {
+    }
+  }
+  return files;
+}
+function versionTuple(spec) {
+  const match = /(\d+)\.(\d+)\.(\d+)/.exec(spec);
+  if (!match || /^(?:workspace|file|link|portal|git|github|http|catalog):/.test(spec)) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function atLeast(have, floor) {
+  const want = versionTuple(floor);
+  for (let index = 0; index < 3; index += 1) {
+    if (have[index] !== want[index]) return have[index] > want[index];
+  }
+  return true;
+}
+function filesMatching(sources, pattern) {
+  return sources.filter((file) => pattern.test(file.text));
+}
+function callArguments(text, openIndex) {
+  let depth = 0;
+  for (let index = openIndex; index < Math.min(text.length, openIndex + 1200); index += 1) {
+    const char = text[index];
+    if (char === "(") depth += 1;
+    else if (char === ")" && --depth === 0) return text.slice(openIndex, index + 1);
+  }
+  return text.slice(openIndex, openIndex + 1200);
+}
+function sinkCalls(sources) {
+  const calls = [];
+  for (const file of sources) {
+    for (const match of file.text.matchAll(/createIntelligenceTurnTraceSink\s*\(/g)) {
+      const args = callArguments(file.text, match.index + match[0].length - 1);
+      const direct = /\bproject\s*:\s*['"`]([^'"`]+)['"`]/.exec(args);
+      const named = /\bproject\s*:\s*([A-Za-z_$][\w$]*)\s*[,}\n]/.exec(args) ?? /\bproject\b\s*[,}]/.exec(args);
+      const identifier = named?.[1] ?? (named ? "project" : void 0);
+      const constant = identifier ? new RegExp(`(?:const|let)\\s+${identifier}\\s*(?::\\s*string\\s*)?=\\s*['"\`]([^'"\`]+)['"\`]`).exec(file.text) : null;
+      calls.push({ file: file.path, args, project: direct?.[1] ?? constant?.[1] ?? null });
+    }
+  }
+  return calls;
+}
+function pinRow(pin, spec) {
+  const tuple = pin === null ? null : versionTuple(pin);
+  if (pin === null || tuple === null) {
+    return { id: "pin", label: "agent-app pin", status: "unknown", detail: `"${spec}" is not a plain version; the floors cannot be compared` };
+  }
+  const below = AGENT_APP_OUTCOME_FLOORS.filter((floor) => !atLeast(tuple, floor.since));
+  const floors = AGENT_APP_OUTCOME_FLOORS.map((floor) => `${floor.label} ${floor.since}`).join(", ");
+  return below.length === 0 ? { id: "pin", label: "agent-app pin", status: "ok", detail: `${pin} (floors: ${floors})` } : { id: "pin", label: "agent-app pin", status: "gap", detail: `${pin} is below the ${below.map((floor) => `${floor.label} floor ${floor.since}`).join(" and the ")}` };
+}
+function withExemption(row, id, exemptions, optedOut) {
+  const reason = exemptions[id];
+  if (optedOut !== null) {
+    return reason ? { row: { ...row, status: "exempt", detail: `${optedOut}; exempt: ${reason}` }, finding: null } : { row: { ...row, status: "opted-out", detail: optedOut }, finding: `${row.label}: ${optedOut}, with no reason in signoff.config.mjs agentApp.exemptions.${id}` };
+  }
+  if (row.status !== "ok" && row.status !== "na" && reason) {
+    return { row: { ...row, status: "exempt", detail: `${row.detail}; exempt: ${reason}` }, finding: null };
+  }
+  return { row, finding: null };
+}
+function turnTraceRow(sources, calls, exports) {
+  const optOut = filesMatching(sources, /\bturnTrace\s*:\s*false\b/)[0];
+  if (optOut) return { row: { id: "turn-trace", label: "turn trace", status: "gap", detail: "" }, optedOut: `turnTrace: false in ${optOut.path}`, wired: false };
+  const customSink = filesMatching(sources, /\bturnTrace\s*:\s*\{/);
+  if (calls.length === 0 && customSink.length === 0) {
+    return { row: { id: "turn-trace", label: "turn trace", status: "gap", detail: "no turn trace sink; createChatTurnRoutes gets no turnTrace" }, optedOut: null, wired: false };
+  }
+  const project = calls.find((call) => call.project)?.project ?? null;
+  const last = project === null ? void 0 : exports?.get(project);
+  const where = calls[0]?.file ?? customSink[0]?.path ?? "";
+  const wired = `sink wired in ${where}${project ? ` (${project})` : ""}`;
+  if (last) {
+    return { row: { id: "turn-trace", label: "turn trace", status: "ok", detail: `${wired}; last export accepted ${new Date(last.at).toISOString().slice(0, 16)}Z` }, optedOut: null, wired: true };
+  }
+  if (last === null) {
+    return { row: { id: "turn-trace", label: "turn trace", status: "gap", detail: `${wired}; Intelligence holds no turn from the last 30 days for this key` }, optedOut: null, wired: true };
+  }
+  const routerKey = calls.find((call) => /\bapiKey\s*:[^,}]*\bTANGLE_API_KEY\b/.test(call.args));
+  if (routerKey) {
+    return { row: { id: "turn-trace", label: "turn trace", status: "unknown", detail: `${wired} with TANGLE_API_KEY; the ingest refused it for Legal (#468): run with --probe, or drop apiKey so the sink reads the Sandbox product key` }, optedOut: null, wired: true };
+  }
+  return { row: { id: "turn-trace", label: "turn trace", status: "ok", detail: `${wired}; last export not checked` }, optedOut: null, wired: true };
+}
+function firstTextRow(pin, sources, traceWired, calls, exports) {
+  const floor = AGENT_APP_OUTCOME_FLOORS.find((entry) => entry.id === "first-text")?.since ?? "";
+  const tuple = pin === null ? null : versionTuple(pin);
+  const marks = filesMatching(sources, /\.markFirstText\s*\(/).length > 0;
+  const routes = filesMatching(sources, /\bcreateChatTurnRoutes\s*[(<]/).length > 0;
+  if (!traceWired) return { id: "first-text", label: "first text", status: "gap", detail: "needs the turn trace" };
+  if (tuple !== null && !atLeast(tuple, floor)) return { id: "first-text", label: "first text", status: "gap", detail: `agent-app ${pin} does not mark first text; ${floor} does` };
+  if (!routes && !marks) return { id: "first-text", label: "first text", status: "gap", detail: "the turn owner does not call trace.markFirstText() and the app does not use createChatTurnRoutes" };
+  const project = calls.find((call) => call.project)?.project ?? null;
+  const last = project === null ? void 0 : exports?.get(project);
+  const observed = last?.firstTextMs === void 0 ? "" : `; last turn first_text_ms ${Math.round(last.firstTextMs)}`;
+  if (last && last.firstTextMs === void 0) return { id: "first-text", label: "first text", status: "gap", detail: "the last exported turn has no tangle.turn.first_text_ms" };
+  return { id: "first-text", label: "first text", status: "ok", detail: `${routes ? "createChatTurnRoutes marks it" : "the turn owner marks it"}${observed}` };
+}
+function prewarmRow(sources) {
+  const usesBox = filesMatching(sources, /@tangle-network\/agent-app\/sandbox|\bensureWorkspaceSandbox\b/).length > 0;
+  if (!usesBox) return { id: "prewarm", label: "prewarm route", status: "na", detail: "the app opens no workspace box" };
+  const shared = filesMatching(sources, /\bcreateWorkspacePrewarmRoute\b/)[0];
+  if (shared) return { id: "prewarm", label: "prewarm route", status: "ok", detail: `shared route in ${shared.path}` };
+  const local = sources.find((file) => /prewarm/i.test(file.path) || /['"`/]prewarm['"`/]/.test(file.text));
+  return local ? { id: "prewarm", label: "prewarm route", status: "gap", detail: `local copy in ${local.path}; mount createWorkspacePrewarmRoute` } : { id: "prewarm", label: "prewarm route", status: "gap", detail: "no prewarm route; the first send waits for the box" };
+}
+function placementRow(configs) {
+  const pinned = configs.find((file) => /^\s*\[placement\]\s*$[\s\S]{0,300}?^\s*(?:region|host|hostname)\s*=/m.test(file.text) || /"placement"\s*:\s*\{[^}]*"(?:region|host|hostname)"/.test(file.text));
+  if (pinned) return { id: "placement", label: "placement", status: "ok", detail: `pinned in ${pinned.path}` };
+  if (configs.length === 0) return { id: "placement", label: "placement", status: "na", detail: "no Wrangler config" };
+  const smart = configs.some((file) => /^\s*\[placement\]/m.test(file.text) || /"placement"/.test(file.text));
+  return {
+    id: "placement",
+    label: "placement",
+    status: "gap",
+    detail: smart ? "a [placement] without a region or host is smart placement, which does not pin; unmeasured against the D1 primary" : "no [placement]; unmeasured against the D1 primary. Pin it beside D1 or declare an exemption with the reason"
+  };
+}
+function limitAlarmsRow(sources) {
+  const wired = filesMatching(sources, /\bwithD1LimitAlarms\s*\(/);
+  const copies = filesMatching(sources, /\bcreateLimitAlarms\s*\(/);
+  const product = filesMatching(sources, /\bcreateProductLimitAlarms\s*\(/);
+  if (wired.length === 0) {
+    return {
+      id: "limit-alarms",
+      label: "limit alarms",
+      status: "gap",
+      detail: copies.length + product.length > 0 ? `alarms are built in ${(copies[0] ?? product[0])?.path} but nothing wraps the D1 binding with withD1LimitAlarms in the server` : "no limit alarms"
+    };
+  }
+  if (copies.length > 0) {
+    return { id: "limit-alarms", label: "limit alarms", status: "gap", detail: `wired in ${wired[0]?.path}; ${copies[0]?.path} keeps a local copy of the budgets: use createProductLimitAlarms with overrides` };
+  }
+  return { id: "limit-alarms", label: "limit alarms", status: "ok", detail: `wired in ${wired[0]?.path}` };
+}
+function parseWranglerUpload(output) {
+  const clean = output.replace(/\u001b\[[0-9;]*m/g, "");
+  const match = /Total Upload:\s*([\d.]+)\s*KiB\s*\/\s*gzip:\s*([\d.]+)\s*KiB/.exec(clean);
+  return match ? { rawKiB: Number(match[1]), gzipKiB: Number(match[2]) } : null;
+}
+function wranglerBinary(repoRoot, dir) {
+  for (const base of [join2(repoRoot, dir), repoRoot]) {
+    const bin = join2(base, "node_modules", ".bin", "wrangler");
+    if (existsSync2(bin)) return bin;
+  }
+  return null;
+}
+function bundleRow(repoRoot, dir, configs, measure) {
+  const label = "Worker upload";
+  if (configs.length === 0) return { id: "worker-bundle", label, status: "na", detail: "no Wrangler config" };
+  if (!measure) return { id: "worker-bundle", label, status: "unknown", detail: "not measured" };
+  const bin = wranglerBinary(repoRoot, dir);
+  if (!bin) return { id: "worker-bundle", label, status: "unknown", detail: "wrangler is not installed; install, build, then measure" };
+  const outDir = mkdtempSync(join2(tmpdir(), "agent-app-upload-"));
+  try {
+    const run = spawnSync2(bin, ["deploy", "--dry-run", "--env=", "--outdir", outDir], {
+      cwd: join2(repoRoot, dir),
+      encoding: "utf8",
+      timeout: 5 * 6e4,
+      maxBuffer: 20 * 1024 * 1024,
+      env: { ...process.env, CI: "1", WRANGLER_SEND_METRICS: "false", NO_COLOR: "1" }
+    });
+    const upload = parseWranglerUpload(`${run.stdout}
+${run.stderr}`);
+    if (!upload) {
+      const reason = `${run.stderr}${run.stdout}`.split("\n").map((line) => line.trim()).find((line) => /error|not found|no such/i.test(line)) ?? `wrangler exited ${run.status}`;
+      return { id: "worker-bundle", label, status: "unknown", detail: `unmeasured (build first): ${reason.slice(0, 160)}` };
+    }
+    const limit = LAUNCH_BUDGETS.workerUploadGzipKiB;
+    const share = upload.gzipKiB / limit;
+    return {
+      id: "worker-bundle",
+      label,
+      status: share >= LAUNCH_BUDGETS.alarmRatio ? "gap" : "ok",
+      detail: `${Math.round(upload.gzipKiB)} KiB gzip of ${limit} KiB (${Math.round(share * 100)}%); ${Math.round(upload.rawKiB)} KiB raw of ${LAUNCH_BUDGETS.workerUploadRawKiB} KiB`
+    };
+  } finally {
+    rmSync(outDir, { recursive: true, force: true });
+  }
+}
+function toolCountRow() {
+  return { id: "tool-count", label: "tool_count p50", status: "unknown", detail: "unmeasured; no ceiling until a measured link to first text exists" };
+}
+function checkAppDefaults(repoRoot, options = {}) {
+  const tracked = trackedFiles(repoRoot);
+  const packages = findAppPackages(repoRoot, tracked);
+  const owned = /* @__PURE__ */ new Map();
+  for (const path of trackedWorkerConfigs(repoRoot)) {
+    const owner = packages.filter((pkg) => underDir(path, pkg.dir)).sort((x, y) => y.dir.length - x.dir.length)[0];
+    if (owner) owned.set(owner.dir, [...owned.get(owner.dir) ?? [], path]);
+  }
+  const deployed = packages.filter((pkg) => owned.has(pkg.dir));
+  const apps = [];
+  const findings = [];
+  for (const pkg of deployed.length > 0 ? deployed : packages) {
+    const sources = readSources(repoRoot, tracked, pkg.dir, packages.map((other) => other.dir));
+    const configs = (owned.get(pkg.dir) ?? []).map((path) => ({ path, text: readFileSync(join2(repoRoot, path), "utf8") }));
+    const exemptions = options.exemptions ?? {};
+    const pin = versionTuple(pkg.spec) ? /(\d+\.\d+\.\d+)/.exec(pkg.spec)?.[1] ?? null : null;
+    const calls = sinkCalls(sources);
+    const trace = turnTraceRow(sources, calls, options.exports);
+    const traceWired = trace.wired;
+    const reports = [
+      { row: pinRow(pin, pkg.spec), id: null, optedOut: null },
+      { row: trace.row, id: "turn-trace", optedOut: trace.optedOut },
+      { row: firstTextRow(pin, sources, traceWired, calls, options.exports), id: "first-text", optedOut: null },
+      { row: prewarmRow(sources), id: "prewarm", optedOut: null },
+      { row: placementRow(configs), id: "placement", optedOut: null },
+      { row: toolCountRow(), id: null, optedOut: null },
+      { row: limitAlarmsRow(sources), id: "limit-alarms", optedOut: null },
+      { row: bundleRow(repoRoot, pkg.dir, configs, options.measureBundle ?? true), id: null, optedOut: null }
+    ];
+    const rows = [];
+    const appFindings = [];
+    for (const entry of reports) {
+      if (entry.id === null) {
+        rows.push(entry.row);
+        continue;
+      }
+      const resolved = withExemption(entry.row, entry.id, exemptions, entry.optedOut);
+      rows.push(resolved.row);
+      if (resolved.finding) appFindings.push(resolved.finding);
+    }
+    const traceResolved = rows.find((row) => row.id === "turn-trace");
+    if (trace.optedOut && traceResolved) {
+      const at = rows.findIndex((row) => row.id === "first-text");
+      rows[at] = { id: "first-text", label: "first text", status: traceResolved.status, detail: "the turn trace is turned off" };
+    }
+    apps.push({ app: pkg.name, dir: pkg.dir, pin, rows, findings: appFindings });
+    findings.push(...appFindings.map((finding) => `${pkg.name}: ${finding}`));
+  }
+  return { apps, findings };
+}
+var STATUS_MARK = {
+  ok: "ok     ",
+  gap: "GAP    ",
+  unknown: "?      ",
+  exempt: "exempt ",
+  "opted-out": "FAIL   ",
+  na: "n/a    "
+};
+function formatAppDefaults(result) {
+  if (result.apps.length === 0) return "no agent app in this checkout; nothing to report\n";
+  const lines = [];
+  for (const app of result.apps) {
+    lines.push(`${app.app}${app.dir === "." ? "" : ` (${app.dir})`}`);
+    for (const row of app.rows) lines.push(`  ${STATUS_MARK[row.status]}${row.label.padEnd(15)} ${row.detail}`);
+  }
+  for (const finding of result.findings) lines.push(`FAIL ${finding}`);
+  if (result.findings.length > 0) lines.push("Defaults and how to opt out with a reason: https://github.com/tangle-network/agent-app/blob/main/docs/app-defaults.md");
+  return `${lines.join("\n")}
+`;
+}
+async function readLastTurnExport(project, options) {
+  const base = (options.baseUrl ?? "https://intelligence.tangle.tools").replace(/\/+$/, "");
+  const get = async (path) => {
+    const response = await (options.fetchImpl ?? fetch)(`${base}${path}`, {
+      headers: { authorization: `Bearer ${options.apiKey}` },
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!response.ok) throw new Error(`Intelligence answered HTTP ${response.status} for ${path.split("?")[0]}`);
+    return response.json();
+  };
+  const listing = await get(`/v1/traces?limit=1&q=agent_app.turn&attr=${encodeURIComponent(`tangle.project:${project}`)}`);
+  const newest = listing.items?.[0];
+  if (!newest) return null;
+  const spans = await get(`/v1/traces/${newest.traceId}/spans`);
+  const firstTextMs = Number(spans.items?.find((span) => span.name === "agent_app.turn")?.attributes?.["tangle.turn.first_text_ms"]);
+  return {
+    at: Number(BigInt(newest.startUnixNano) / 1000000n),
+    traceId: newest.traceId,
+    ...Number.isFinite(firstTextMs) ? { firstTextMs } : {}
+  };
+}
+async function collectLastExports(repoRoot, apiKey) {
+  const tracked = trackedFiles(repoRoot);
+  const projects = /* @__PURE__ */ new Set();
+  for (const pkg of findAppPackages(repoRoot, tracked)) {
+    for (const call of sinkCalls(readSources(repoRoot, tracked, pkg.dir, []))) if (call.project) projects.add(call.project);
+  }
+  const exports = /* @__PURE__ */ new Map();
+  for (const project of projects) {
+    try {
+      exports.set(project, await readLastTurnExport(project, { apiKey }));
+    } catch {
+    }
+  }
+  return exports;
+}
+
+// src/signoff/config.ts
 var SIGNOFF_CONFIG_FILES = ["signoff.config.mjs", "signoff.config.js"];
 var shuffleSchema = z.object({
   runs: z.number().int().positive().optional(),
@@ -133,7 +481,12 @@ var configSchema = z.object({
   carryFiles: z.array(z.string()).optional(),
   cacheDir: z.string().optional(),
   storeGenerations: z.number().int().positive().optional(),
-  workerConfigs: z.array(z.string().min(1)).optional()
+  workerConfigs: z.array(z.string().min(1)).optional(),
+  agentApp: z.object({
+    exemptions: z.object(
+      Object.fromEntries(EXEMPTIBLE_DEFAULTS.map((id) => [id, z.string().trim().min(8, "say why in a sentence").optional()]))
+    ).strict().optional()
+  }).optional()
 });
 function describeIssues(error, where) {
   const lines = error.issues.map((issue) => `  ${issue.path.join(".") || "(root)"}: ${issue.message}`);
@@ -143,8 +496,10 @@ ${lines.join("\n")}`;
 function parseSignoffConfig(value, where) {
   const result = configSchema.safeParse(value);
   if (!result.success) throw new Error(describeIssues(result.error, where));
-  if (result.data.steps.some((step) => step.name === WORKER_DEFAULTS_STEP)) {
-    throw new Error(`signoff: ${where} declares a step named "${WORKER_DEFAULTS_STEP}", which the gate runs itself`);
+  for (const reserved of [WORKER_DEFAULTS_STEP, APP_DEFAULTS_STEP]) {
+    if (result.data.steps.some((step) => step.name === reserved)) {
+      throw new Error(`signoff: ${where} declares a step named "${reserved}", which the gate runs itself`);
+    }
   }
   return result.data;
 }
@@ -180,18 +535,18 @@ async function loadSignoffConfig(options) {
   const { repoRoot, configPath } = options;
   if (configPath !== void 0) {
     const abs = resolve(repoRoot, configPath);
-    if (!existsSync2(abs)) throw new Error(`signoff: no config at ${abs}`);
+    if (!existsSync3(abs)) throw new Error(`signoff: no config at ${abs}`);
     return { config: await importConfig(abs), origin: { kind: "file", path: abs } };
   }
   for (const candidate of SIGNOFF_CONFIG_FILES) {
-    const abs = join2(repoRoot, candidate);
-    if (existsSync2(abs)) return { config: await importConfig(abs), origin: { kind: "file", path: abs } };
+    const abs = join3(repoRoot, candidate);
+    if (existsSync3(abs)) return { config: await importConfig(abs), origin: { kind: "file", path: abs } };
   }
-  const pkgPath = join2(repoRoot, "package.json");
-  if (!existsSync2(pkgPath)) {
+  const pkgPath = join3(repoRoot, "package.json");
+  if (!existsSync3(pkgPath)) {
     throw new Error(`signoff: ${repoRoot} has no package.json, no signoff.config.mjs, and nothing to derive from.`);
   }
-  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
   if (pkg.signoff !== void 0) {
     return { config: parseSignoffConfig(pkg.signoff, `${pkgPath} "signoff"`), origin: { kind: "package-json", path: pkgPath } };
   }
@@ -206,19 +561,19 @@ async function importConfig(abs) {
 }
 
 // src/signoff/run.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync7 } from "fs";
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync8 } from "fs";
 import { availableParallelism, homedir } from "os";
-import { basename as basename2, join as join7, resolve as resolve3 } from "path";
+import { basename as basename2, join as join8, resolve as resolve3 } from "path";
 
 // src/signoff/node-version.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
 
 // src/signoff/workflow-pin.ts
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
-var WORKFLOW_DIR = join3(".github", "workflows");
+import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
+var WORKFLOW_DIR = join4(".github", "workflows");
 function scalarValue(raw) {
   const withoutComment = raw.replace(/\s+#.*$/, "").trim();
   const quoted = /^(['"])(.*)\1$/.exec(withoutComment);
@@ -268,24 +623,24 @@ function pinsInWorkflow(repoRoot, file, source) {
       pins.push({ file, value, via: "node-version" });
       continue;
     }
-    const target = join3(repoRoot, value);
-    if (!existsSync3(target)) {
+    const target = join4(repoRoot, value);
+    if (!existsSync4(target)) {
       throw new Error(
         `signoff: ${file} reads its Node pin from "${value}" (node-version-file) and that file does not exist. The workflow this gate replaces cannot itself run, so there is nothing to verify against.`
       );
     }
-    const declared = readFileSync2(target, "utf8").split("\n").map((entry) => entry.trim()).find((entry) => entry.length > 0 && !entry.startsWith("#"));
+    const declared = readFileSync3(target, "utf8").split("\n").map((entry) => entry.trim()).find((entry) => entry.length > 0 && !entry.startsWith("#"));
     if (declared !== void 0) pins.push({ file, value: declared, via: `node-version-file ${value}` });
   }
   return pins;
 }
 function scanMergeGateNodePins(repoRoot) {
-  const dir = join3(repoRoot, WORKFLOW_DIR);
-  if (!existsSync3(dir)) return [];
+  const dir = join4(repoRoot, WORKFLOW_DIR);
+  if (!existsSync4(dir)) return [];
   const pins = [];
   const files = readdirSync(dir).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).sort();
   for (const name of files) {
-    const source = readFileSync2(join3(dir, name), "utf8");
+    const source = readFileSync3(join4(dir, name), "utf8");
     if (!triggersOnPullRequest(source)) continue;
     pins.push(...pinsInWorkflow(repoRoot, `${WORKFLOW_DIR}/${name}`, source));
   }
@@ -335,9 +690,9 @@ function resolveNodeRequirement(repoRoot, configured) {
     return { major, declared: configured.trim(), source: "signoff config `nodeVersion`" };
   }
   let fromNvmrc = null;
-  const nvmrc = join4(repoRoot, ".nvmrc");
-  if (existsSync4(nvmrc)) {
-    const raw = readFileSync3(nvmrc, "utf8").trim();
+  const nvmrc = join5(repoRoot, ".nvmrc");
+  if (existsSync5(nvmrc)) {
+    const raw = readFileSync4(nvmrc, "utf8").trim();
     const major = majorOf(raw);
     if (major !== null) fromNvmrc = { major, declared: raw, source: ".nvmrc" };
   }
@@ -361,9 +716,9 @@ function assertNodeVersion(requirement, running = process.version) {
 }
 function assertNodeTypesVersion(repoRoot, requirement) {
   if (!requirement) return;
-  const packagePath = join4(repoRoot, "package.json");
-  if (!existsSync4(packagePath)) return;
-  const manifest = JSON.parse(readFileSync3(packagePath, "utf8"));
+  const packagePath = join5(repoRoot, "package.json");
+  if (!existsSync5(packagePath)) return;
+  const manifest = JSON.parse(readFileSync4(packagePath, "utf8"));
   const declared = manifest.devDependencies?.["@types/node"] ?? manifest.dependencies?.["@types/node"] ?? manifest.optionalDependencies?.["@types/node"];
   if (!declared) return;
   const declaredMajor = /^[~^]?v?(\d+)(?:\.|$)/.exec(declared.trim())?.[1];
@@ -372,11 +727,11 @@ function assertNodeTypesVersion(repoRoot, requirement) {
       `signoff: this repo pins Node ${requirement.declared} but declares @types/node ${declared}. Use the latest @types/node ${requirement.major}.x release.`
     );
   }
-  const installedPath = join4(repoRoot, "node_modules", "@types", "node", "package.json");
-  if (!existsSync4(installedPath)) {
+  const installedPath = join5(repoRoot, "node_modules", "@types", "node", "package.json");
+  if (!existsSync5(installedPath)) {
     throw new Error(`signoff: @types/node is declared but missing after install in ${repoRoot}.`);
   }
-  const installed = JSON.parse(readFileSync3(installedPath, "utf8"));
+  const installed = JSON.parse(readFileSync4(installedPath, "utf8"));
   const installedMajor = majorOf(installed.version ?? "");
   if (installedMajor !== requirement.major) {
     throw new Error(
@@ -660,8 +1015,8 @@ function planAttempts(step, seedBase, overrideRuns) {
 
 // src/signoff/store.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync4, readdirSync as readdirSync2, rmSync, statSync, utimesSync, writeFileSync } from "fs";
-import { join as join5, relative, sep } from "path";
+import { existsSync as existsSync6, mkdirSync, readFileSync as readFileSync5, readdirSync as readdirSync2, rmSync as rmSync2, statSync as statSync2, utimesSync, writeFileSync } from "fs";
+import { join as join6, relative, sep } from "path";
 var MANIFEST_FILES = [
   "pnpm-lock.yaml",
   "pnpm-workspace.yaml",
@@ -677,9 +1032,9 @@ function collectManifests(dir, root, out) {
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (SKIP_DIRS.has(entry.name)) continue;
-      collectManifests(join5(dir, entry.name), root, out);
+      collectManifests(join6(dir, entry.name), root, out);
     } else if (MANIFEST_FILES.includes(entry.name)) {
-      out.push(relative(root, join5(dir, entry.name)).split(sep).join("/"));
+      out.push(relative(root, join6(dir, entry.name)).split(sep).join("/"));
     }
   }
 }
@@ -693,20 +1048,20 @@ function manifestCacheKey(treePath, files) {
   for (const rel of files) {
     hash.update(rel);
     hash.update("\0");
-    hash.update(createHash2("sha256").update(readFileSync4(join5(treePath, rel))).digest("hex"));
+    hash.update(createHash2("sha256").update(readFileSync5(join6(treePath, rel))).digest("hex"));
     hash.update("\n");
   }
   return hash.digest("hex");
 }
 function pruneStores(storesRoot, keep) {
-  if (!existsSync5(storesRoot)) return [];
+  if (!existsSync6(storesRoot)) return [];
   const entries = readdirSync2(storesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const full = join5(storesRoot, entry.name);
-    return { full, mtimeMs: statSync(full).mtimeMs };
+    const full = join6(storesRoot, entry.name);
+    return { full, mtimeMs: statSync2(full).mtimeMs };
   }).sort((a, b) => b.mtimeMs - a.mtimeMs);
   const pruned = [];
   for (const stale of entries.slice(keep)) {
-    rmSync(stale.full, { recursive: true, force: true });
+    rmSync2(stale.full, { recursive: true, force: true });
     pruned.push(stale.full);
   }
   return pruned;
@@ -720,10 +1075,10 @@ function resolveStore(options) {
     );
   }
   const cacheKey = manifestCacheKey(treePath, files);
-  const storesRoot = join5(cacheDir, "stores");
-  const storeDir = join5(storesRoot, cacheKey);
-  const marker = join5(storeDir, ".signoff-store.json");
-  const hit = existsSync5(storeDir) && readdirSync2(storeDir).some((entry) => entry !== ".signoff-store.json");
+  const storesRoot = join6(cacheDir, "stores");
+  const storeDir = join6(storesRoot, cacheKey);
+  const marker = join6(storeDir, ".signoff-store.json");
+  const hit = existsSync6(storeDir) && readdirSync2(storeDir).some((entry) => entry !== ".signoff-store.json");
   mkdirSync(storeDir, { recursive: true });
   writeFileSync(marker, `${JSON.stringify({ cacheKey, keyedOn: files, usedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `);
@@ -733,12 +1088,12 @@ function resolveStore(options) {
 }
 
 // src/signoff/workspace.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute, join as join6, resolve as resolve2 } from "path";
+import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, isAbsolute, join as join7, resolve as resolve2 } from "path";
 function git(args, cwd) {
-  const result = spawnSync2("git", args, { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  const result = spawnSync3("git", args, { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
   if (result.error) throw new Error(`signoff: git ${args.join(" ")} failed to start: ${result.error.message}`);
   if (result.status !== 0) {
     throw new Error(`signoff: git ${args.join(" ")} exited ${result.status}
@@ -759,7 +1114,7 @@ function materializeCleanTree(options) {
   const branch = git(["rev-parse", "--abbrev-ref", "HEAD"], root).trim();
   git(["worktree", "prune"], root);
   mkdirSync2(dirname2(dest), { recursive: true });
-  if (existsSync6(dest)) rmSync2(dest, { recursive: true, force: true });
+  if (existsSync7(dest)) rmSync3(dest, { recursive: true, force: true });
   git(["worktree", "add", "--detach", "--quiet", dest, head], root);
   let diffSha256 = null;
   let untrackedFiles = [];
@@ -767,28 +1122,28 @@ function materializeCleanTree(options) {
     const patch = git(["diff", "HEAD", "--binary", "--no-color", "--no-ext-diff"], root);
     if (patch.length > 0) {
       diffSha256 = createHash3("sha256").update(patch).digest("hex");
-      const patchFile = join6(dirname2(dest), `${dest.split("/").pop() ?? "tree"}.patch`);
+      const patchFile = join7(dirname2(dest), `${dest.split("/").pop() ?? "tree"}.patch`);
       writeFileSync2(patchFile, patch);
       git(["apply", "--binary", "--whitespace=nowarn", patchFile], dest);
-      rmSync2(patchFile, { force: true });
+      rmSync3(patchFile, { force: true });
     }
     untrackedFiles = zsplit(git(["ls-files", "--others", "--exclude-standard", "-z"], root));
     for (const rel of untrackedFiles) {
-      const target = join6(dest, rel);
+      const target = join7(dest, rel);
       mkdirSync2(dirname2(target), { recursive: true });
-      copyFileSync(join6(root, rel), target);
+      copyFileSync(join7(root, rel), target);
     }
   }
   const carried = [];
   for (const rel of carryFiles) {
     if (isAbsolute(rel)) throw new Error(`signoff: carryFiles must be repo-relative; got "${rel}"`);
     const from = resolve2(root, rel);
-    if (!existsSync6(from)) {
+    if (!existsSync7(from)) {
       throw new Error(
         `signoff: carryFiles names "${rel}", which does not exist at ${from}. Remove it from the config or create the file \u2014 installing without it would resolve against a different registry than the one you think you are verifying.`
       );
     }
-    const target = join6(dest, rel);
+    const target = join7(dest, rel);
     mkdirSync2(dirname2(target), { recursive: true });
     copyFileSync(from, target);
     carried.push(rel);
@@ -810,9 +1165,9 @@ function removeCleanTree(tree) {
 }
 
 // src/signoff/run.ts
-var DEFAULT_CACHE_DIR = join7(homedir(), ".cache", "agent-app-signoff");
+var DEFAULT_CACHE_DIR = join8(homedir(), ".cache", "agent-app-signoff");
 function hostFacts(treePath, requirement) {
-  const pm = spawnSync3("pnpm", ["--version"], { cwd: treePath, encoding: "utf8" });
+  const pm = spawnSync4("pnpm", ["--version"], { cwd: treePath, encoding: "utf8" });
   return {
     node: process.version,
     nodePinned: requirement?.declared ?? null,
@@ -854,7 +1209,7 @@ async function runSignoff(options = {}) {
   const repoRoot = repoRootOf(repoDir);
   const source = options.source ?? "working-tree";
   let cacheDir = resolve3(options.cacheDir ?? DEFAULT_CACHE_DIR);
-  const treePath = () => join7(cacheDir, "trees", `${basename2(repoRoot)}-${process.pid}`);
+  const treePath = () => join8(cacheDir, "trees", `${basename2(repoRoot)}-${process.pid}`);
   let tree = null;
   try {
     tree = materializeCleanTree({ repoDir: repoRoot, dest: treePath(), source });
@@ -874,7 +1229,7 @@ async function runSignoff(options = {}) {
     const store = resolveStore({ treePath: tree.path, cacheDir, generations: config.storeGenerations });
     options.onEvent?.({ kind: "store", storeDir: store.storeDir, cacheHit: store.hit, cacheKey: store.cacheKey });
     const installSpec = config.install ?? {};
-    const installCwd = join7(tree.path, installSpec.cwd ?? ".");
+    const installCwd = join8(tree.path, installSpec.cwd ?? ".");
     const installCommand = withStoreDir(
       installSpec.run ?? "pnpm install --frozen-lockfile",
       installSpec.storeDirFlag,
@@ -921,7 +1276,7 @@ async function runSignoff(options = {}) {
         origin,
         host,
         install,
-        steps: [...config.steps.map((step) => step.name), WORKER_DEFAULTS_STEP].map(
+        steps: [...config.steps.map((step) => step.name), WORKER_DEFAULTS_STEP, APP_DEFAULTS_STEP].map(
           (name) => ({
             name,
             status: "skipped",
@@ -951,7 +1306,7 @@ async function runSignoff(options = {}) {
           options.onEvent?.({ kind: "step-start", name: step.name, command: plan.command, seed: plan.seed });
           const result = await runCommand({
             command: plan.command,
-            cwd: join7(treeRoot, step.cwd ?? "."),
+            cwd: join8(treeRoot, step.cwd ?? "."),
             env: buildEnv(sharedEnv, [step.env]),
             timeoutMs: step.timeoutMs,
             signal
@@ -967,7 +1322,8 @@ async function runSignoff(options = {}) {
         return { ok: true, value: attempts };
       }
     });
-    const steps = [...outcomes.map(toStepResult), workerDefaults];
+    const appDefaults = runAppDefaults(tree.path, config, options);
+    const steps = [...outcomes.map(toStepResult), workerDefaults, appDefaults];
     return finish({
       ok: steps.every((step) => step.status === "passed"),
       startedAt,
@@ -984,7 +1340,7 @@ async function runSignoff(options = {}) {
       options
     });
   } finally {
-    if (tree && !options.keepWorkspace && existsSync7(tree.path)) removeCleanTree(tree);
+    if (tree && !options.keepWorkspace && existsSync8(tree.path)) removeCleanTree(tree);
   }
 }
 function runWorkerDefaults(treeRoot, workerConfigs, options) {
@@ -1009,6 +1365,28 @@ function runWorkerDefaults(treeRoot, workerConfigs, options) {
   emitStepEnd(options, WORKER_DEFAULTS_STEP, ok ? "passed" : "failed", attempts);
   return { name: WORKER_DEFAULTS_STEP, status: ok ? "passed" : "failed", attempts, durationMs, startedAtMs: null, finishedAtMs: null };
 }
+function runAppDefaults(treeRoot, config, options) {
+  const command = `agent-app-signoff ${APP_DEFAULTS_STEP}`;
+  options.onEvent?.({ kind: "step-start", name: APP_DEFAULTS_STEP, command, seed: null });
+  const started = Date.now();
+  let output;
+  let ok;
+  try {
+    const result = checkAppDefaults(treeRoot, { exemptions: config.agentApp?.exemptions });
+    output = formatAppDefaults(result);
+    ok = result.findings.length === 0;
+  } catch (error) {
+    output = `${error instanceof Error ? error.stack ?? error.message : String(error)}
+`;
+    ok = false;
+  }
+  const durationMs = Date.now() - started;
+  const attempts = [
+    { command, seed: null, exitCode: ok ? 0 : 1, signal: null, durationMs, timedOut: false, output, outputTruncated: false }
+  ];
+  emitStepEnd(options, APP_DEFAULTS_STEP, ok ? "passed" : "failed", attempts);
+  return { name: APP_DEFAULTS_STEP, status: ok ? "passed" : "failed", attempts, durationMs, startedAtMs: null, finishedAtMs: null };
+}
 function emitStepEnd(options, name, status, attempts) {
   options.onEvent?.({
     kind: "step-end",
@@ -1394,7 +1772,7 @@ function round(value) {
 }
 
 // src/signoff/shell-alignment-cli.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname3, resolve as resolve4 } from "path";
 function shellAlignmentUsage() {
   return [
@@ -1448,7 +1826,7 @@ function parseShellAlignmentArgs(argv) {
         out.storageState = resolve4(take());
         break;
       case "--theme-script":
-        out.themeScript = readFileSync5(resolve4(take()), "utf8");
+        out.themeScript = readFileSync6(resolve4(take()), "utf8");
         break;
       case "--ready":
         out.readySelector = take();
@@ -1787,7 +2165,7 @@ function formatSurfaceLadderReport(report) {
 }
 
 // src/signoff/surface-ladder-cli.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname4, resolve as resolve5 } from "path";
 function surfaceLadderUsage() {
   return [
@@ -1849,7 +2227,7 @@ function parseSurfaceLadderArgs(argv) {
         out.storageState = resolve5(take());
         break;
       case "--theme-script":
-        out.themeScript = readFileSync6(resolve5(take()), "utf8");
+        out.themeScript = readFileSync7(resolve5(take()), "utf8");
         break;
       case "--ready":
         out.readySelector = take();
@@ -1867,7 +2245,7 @@ function parseSurfaceLadderArgs(argv) {
         break;
       }
       case "--inject-css":
-        out.injectCss = readFileSync6(resolve5(take()), "utf8");
+        out.injectCss = readFileSync7(resolve5(take()), "utf8");
         break;
       case "--screenshots":
         out.screenshotDir = resolve5(take());
@@ -2047,6 +2425,9 @@ export {
   WORKER_COMPATIBILITY_DATE_FLOOR,
   checkWorkerDefaults,
   formatWorkerDefaults,
+  checkAppDefaults,
+  formatAppDefaults,
+  collectLastExports,
   loadSignoffConfig,
   runSignoff,
   formatSignoffReport,
@@ -2088,4 +2469,4 @@ export {
   formatWorkspaceSurfaceReport,
   runWorkspaceSurfaceCli
 };
-//# sourceMappingURL=chunk-KDPTXXOQ.js.map
+//# sourceMappingURL=chunk-J3N6RNMH.js.map