looply-cli 0.0.0-stage → 0.3.0

package/dist/config.js

@@ -0,0 +1,763 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigError = exports.DEFAULTS = exports.PUBLISH_POLICIES = void 0;
+exports.mayPublish = mayPublish;
+exports.parseConfig = parseConfig;
+exports.configWarnings = configWarnings;
+const yaml_1 = require("yaml");
+const core_1 = require("@looply/core");
+const agent_exec_1 = require("./agent-exec");
+const model_routing_1 = require("./model-routing");
+const integration_1 = require("./integration");
+exports.PUBLISH_POLICIES = ['never', 'on-approval', 'manual'];
+/**
+ * May Looply itself publish, under this policy?
+ *
+ * ONE PREDICATE, so that no caller has to remember that `manual` means "not
+ * Looply". Two call sites reasoning about the enum separately is how one of
+ * them eventually treats an unfamiliar value as permission.
+ */
+function mayPublish(policy) {
+    return policy === 'on-approval';
+}
+exports.DEFAULTS = {
+    run: { minHours: 4, maxRounds: 400, cooldownS: 5, carryIntoCheckouts: [], maxConcurrentRuns: 1, perRoundSafety: false, surfaces: false, integration: false, brain: false },
+    machine: {
+        maxWorkspaces: 1,
+        maxAgentsInFlight: 1,
+        coordinator: false,
+        provisionWorkspaces: false,
+        preemption: false,
+        reapProvisioned: false,
+        idleCheckoutMinutes: 60,
+        integrate: false,
+    },
+    publish: { policy: 'never' },
+    rails: { exemptions: 'ask', prodEnvFiles: ['.env'] },
+    queue: { topupThreshold: 5, topupSize: 10, maxSameShape: 3 },
+    proof: { enabled: true, onPartial: 'ask', askWindowMin: 20 },
+    notify: { channel: 'sms', everyMin: 30 },
+    agent: agent_exec_1.DEFAULT_AGENT,
+};
+class ConfigError extends Error {
+    key;
+    constructor(key, message) {
+        super(`config: ${key} — ${message}`);
+        this.key = key;
+        this.name = 'ConfigError';
+    }
+}
+exports.ConfigError = ConfigError;
+const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+function str(o, key, path, fallback) {
+    const v = o[key];
+    if (v === undefined) {
+        if (fallback !== undefined)
+            return fallback;
+        throw new ConfigError(`${path}.${key}`, 'is required');
+    }
+    if (typeof v !== 'string' || !v.trim())
+        throw new ConfigError(`${path}.${key}`, 'must be a non-empty string');
+    return v;
+}
+function num(o, key, path, fallback, min = 0) {
+    const v = o[key];
+    if (v === undefined)
+        return fallback;
+    if (typeof v !== 'number' || !Number.isFinite(v))
+        throw new ConfigError(`${path}.${key}`, 'must be a number');
+    if (v < min)
+        throw new ConfigError(`${path}.${key}`, `must be >= ${min}`);
+    return v;
+}
+function bool(o, key, path, fallback) {
+    const v = o[key];
+    if (v === undefined)
+        return fallback;
+    if (typeof v !== 'boolean')
+        throw new ConfigError(`${path}.${key}`, 'must be true or false');
+    return v;
+}
+function strList(o, key, path, fallback = []) {
+    const v = o[key];
+    if (v === undefined)
+        return fallback;
+    if (!Array.isArray(v) || v.some((x) => typeof x !== 'string')) {
+        throw new ConfigError(`${path}.${key}`, 'must be a list of strings');
+    }
+    return v;
+}
+/**
+ * `agent.models` and `agent.effort`, or nothing at all.
+ *
+ * ⚠️ REFUSED HERE, NOT AT ROUND ONE. A model id with a space in it, a role
+ * nobody has, or a Fable model named for an agent: each is the kind of mistake
+ * that should stop a run before it starts, not after the first model call has
+ * been paid for — the same reasoning `provider` is checked on. The rule itself
+ * lives in `model-routing.ts` so `looply doctor` can name the same key.
+ */
+function roleModelsOf(agent) {
+    const out = {};
+    const raw = agent['models'];
+    if (raw !== undefined) {
+        if (!isObj(raw))
+            throw new ConfigError('agent.models', 'must be a map of role to model id');
+        const models = {};
+        for (const [key, value] of Object.entries(raw)) {
+            if (typeof value !== 'string')
+                throw new ConfigError(`agent.models.${key}`, 'must be a model id');
+            models[key] = value;
+        }
+        const verdict = (0, model_routing_1.checkRoleModels)(models);
+        if (!verdict.ok)
+            throw new ConfigError(verdict.key, verdict.because);
+        out.models = models;
+    }
+    if (agent['effort'] !== undefined) {
+        out.effort = oneOf(agent, 'effort', 'agent', model_routing_1.EFFORT_LEVELS, 'high');
+    }
+    return out;
+}
+function oneOf(o, key, path, allowed, fallback) {
+    const v = o[key];
+    if (v === undefined)
+        return fallback;
+    if (typeof v !== 'string' || !allowed.includes(v)) {
+        throw new ConfigError(`${path}.${key}`, `must be one of ${allowed.join(' | ')}`);
+    }
+    return v;
+}
+/**
+ * Read the human decisions, refusing anything malformed rather than guessing.
+ *
+ * An absent block is an empty list — a project that has recorded no decisions
+ * is the ordinary case, not an error. A malformed ENTRY is dropped rather than
+ * failing the whole config: a person editing YAML by hand should not lose their
+ * ability to run because one entry is half-written, and the entries that are
+ * well-formed still mean what they say.
+ */
+function parseDecisions(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const entry of raw) {
+        if (!isObj(entry))
+            continue;
+        const subject = entry['subject'];
+        const decision = entry['decision'];
+        if (typeof subject !== 'string' || typeof decision !== 'string')
+            continue;
+        if (subject.trim() === '' || decision.trim() === '')
+            continue;
+        out.push({ subject: subject.trim(), decision: decision.trim() });
+    }
+    return out;
+}
+function parseGates(raw) {
+    if (raw === undefined)
+        throw new ConfigError('gates', 'is required — a run with no checks proves nothing');
+    if (!Array.isArray(raw) || raw.length === 0) {
+        throw new ConfigError('gates', 'must be a non-empty list');
+    }
+    const seen = new Set();
+    return raw.map((entry, i) => {
+        const path = `gates[${i}]`;
+        if (!isObj(entry))
+            throw new ConfigError(path, 'must be an object');
+        const name = str(entry, 'name', path);
+        if (seen.has(name))
+            throw new ConfigError(path, `duplicate step name ${JSON.stringify(name)}`);
+        seen.add(name);
+        const step = { name, run: str(entry, 'run', path) };
+        const timeoutS = num(entry, 'timeout_s', path, 0, 1);
+        if (timeoutS)
+            step.timeoutS = timeoutS;
+        if (entry['when'] !== undefined)
+            step.when = str(entry, 'when', path);
+        if (bool(entry, 'required', path, false))
+            step.required = true;
+        return step;
+    });
+}
+const PREDICATE_KEYS = ['equals', 'one_of', 'at_least', 'known'];
+/**
+ * `machine.programme.acceptance` and its probes.
+ *
+ * Every refusal names the exact key, the same way the limits block does.
+ */
+function parseAcceptance(raw, probesRaw) {
+    const A = 'machine.programme.acceptance';
+    const PR = 'machine.programme.acceptance_probes';
+    const probes = [];
+    if (probesRaw !== undefined) {
+        if (!Array.isArray(probesRaw))
+            throw new ConfigError(PR, 'must be a list of { fact, run }');
+        probesRaw.forEach((entry, i) => {
+            if (!isObj(entry))
+                throw new ConfigError(`${PR}[${i}]`, 'must be { fact, run }');
+            const fact = entry['fact'];
+            const run = entry['run'];
+            if (typeof fact !== 'string' || !(0, core_1.isAcceptanceFact)(fact) || !fact.startsWith('probe.')) {
+                throw new ConfigError(`${PR}[${i}].fact`, 'must be a probe fact named probe.<lower-case-name>');
+            }
+            if (typeof run !== 'string' || run.trim() === '') {
+                throw new ConfigError(`${PR}[${i}].run`, 'is required — a probe with no command reads nothing');
+            }
+            if (probes.some((p) => p.fact === fact))
+                throw new ConfigError(`${PR}[${i}].fact`, `is declared twice: ${fact}`);
+            probes.push({ fact, run: run.trim() });
+        });
+    }
+    if (raw === undefined) {
+        if (probes.length > 0) {
+            throw new ConfigError(`${PR}[0].fact`, `reads ${probes[0]?.fact} and nothing requires it — declare it under acceptance, or remove the probe`);
+        }
+        return {};
+    }
+    if (!isObj(raw))
+        throw new ConfigError(A, 'must be a block of fact -> predicate');
+    const acceptance = {};
+    for (const fact of Object.keys(raw).sort()) {
+        if (!(0, core_1.isAcceptanceFact)(fact)) {
+            throw new ConfigError(`${A}.${fact}`, `is not a verification-environment fact (${core_1.ACCEPTANCE_FACTS.join(', ')}, or probe.<name>)`);
+        }
+        const spec = raw[fact];
+        if (!isObj(spec))
+            throw new ConfigError(`${A}.${fact}`, `must be one of { ${PREDICATE_KEYS.join(' | ')} }`);
+        const given = PREDICATE_KEYS.filter((k) => spec[k] !== undefined);
+        if (given.length !== 1) {
+            throw new ConfigError(`${A}.${fact}`, `needs exactly one of ${PREDICATE_KEYS.join(', ')} — found ${given.length === 0 ? 'none' : given.join(' and ')}`);
+        }
+        const key = given[0];
+        if (key === 'known') {
+            if (spec['known'] !== true)
+                throw new ConfigError(`${A}.${fact}.known`, 'must be true — it means "any value, but it must be readable"');
+            acceptance[fact] = { kind: 'known' };
+        }
+        else if (key === 'equals') {
+            const v = spec['equals'];
+            if (typeof v !== 'string' || v.trim() === '')
+                throw new ConfigError(`${A}.${fact}.equals`, 'must be a non-empty string');
+            acceptance[fact] = { kind: 'equals', value: v.trim() };
+        }
+        else if (key === 'one_of') {
+            const v = spec['one_of'];
+            if (!Array.isArray(v) || v.length === 0 || v.some((x) => typeof x !== 'string' || x.trim() === '')) {
+                throw new ConfigError(`${A}.${fact}.one_of`, 'must be a non-empty list of non-empty strings');
+            }
+            acceptance[fact] = { kind: 'one-of', values: v.map((x) => x.trim()) };
+        }
+        else {
+            const v = spec['at_least'];
+            if (typeof v !== 'string' || !/[0-9]/.test(v)) {
+                throw new ConfigError(`${A}.${fact}.at_least`, 'must be a string containing a version, e.g. node@20.11.0 — the compare is dotted-numeric');
+            }
+            acceptance[fact] = { kind: 'at-least', version: v.trim() };
+        }
+    }
+    /**
+     * 🔴 THE PAIRING, BOTH WAYS. Checked after both halves parse, so the message
+     * names the fact rather than the first structural problem it met.
+     */
+    for (const fact of Object.keys(acceptance)) {
+        if (fact.startsWith('probe.') && !probes.some((p) => p.fact === fact)) {
+            throw new ConfigError(`${A}.${fact}`, `requires ${fact} and nothing reads it — add a probe under acceptance_probes, or remove the requirement`);
+        }
+    }
+    for (const p of probes) {
+        if (acceptance[p.fact] === undefined) {
+            throw new ConfigError(`${PR}`, `reads ${p.fact} and nothing requires it — declare it under acceptance, or remove the probe`);
+        }
+    }
+    return {
+        ...(Object.keys(acceptance).length === 0 ? {} : { acceptance }),
+        ...(probes.length === 0 ? {} : { acceptanceProbes: probes }),
+    };
+}
+const PROGRAMME_LIMIT_KEYS = ['max_workspaces', 'max_agents_in_flight', 'starts_per_grant', 'window_minutes', 'integration_ref'];
+/**
+ * `machine.programme` as a block: `{ on: true, limits: { … } }`. Refused whole
+ * when `on` is not true, a limit is missing or out of range, the ref is not the
+ * lane's, or a key is not part of it — each refusal names the exact key.
+ * Absent, or a boolean, is not a block (slice 1 or nothing).
+ */
+function parseProgrammeBlock(raw) {
+    if (raw === undefined || typeof raw === 'boolean')
+        return null;
+    if (!isObj(raw))
+        throw new ConfigError('machine.programme', 'must be true, false, or a block { on, limits }');
+    const extra = Object.keys(raw).filter((k) => k !== 'on' && k !== 'limits' && k !== 'acceptance' && k !== 'acceptance_probes');
+    if (extra.length > 0) {
+        throw new ConfigError(`machine.programme.${extra.sort()[0]}`, 'is not part of programme mode (on, limits, acceptance, acceptance_probes)');
+    }
+    if (raw['on'] !== true) {
+        throw new ConfigError('machine.programme.on', 'must be true — a block declares programme mode on; leave the block out to keep manual defaults');
+    }
+    if (!isObj(raw['limits'])) {
+        throw new ConfigError('machine.programme.limits', `is required — programme mode needs its limits declared (${PROGRAMME_LIMIT_KEYS.join(', ')})`);
+    }
+    const limits = raw['limits'];
+    const P = 'machine.programme.limits';
+    for (const key of PROGRAMME_LIMIT_KEYS) {
+        if (limits[key] === undefined)
+            throw new ConfigError(`${P}.${key}`, 'is required — programme mode needs every limit declared');
+    }
+    const stray = Object.keys(limits).filter((k) => !PROGRAMME_LIMIT_KEYS.includes(k));
+    if (stray.length > 0)
+        throw new ConfigError(`${P}.${stray.sort()[0]}`, `is not a programme limit (${PROGRAMME_LIMIT_KEYS.join(', ')})`);
+    const startsPerGrant = num(limits, 'starts_per_grant', P, 1, 1);
+    if (startsPerGrant > core_1.MAX_AUTONOMOUS_STARTS)
+        throw new ConfigError(`${P}.starts_per_grant`, `must be <= ${core_1.MAX_AUTONOMOUS_STARTS}`);
+    const integrationRef = str(limits, 'integration_ref', P);
+    if (integrationRef !== integration_1.INTEGRATION_BRANCH) {
+        throw new ConfigError(`${P}.integration_ref`, `must be ${integration_1.INTEGRATION_BRANCH} — the lane integrates there and takes no other ref yet`);
+    }
+    return {
+        limits: {
+            maxWorkspaces: num(limits, 'max_workspaces', P, 1, 1),
+            maxAgentsInFlight: num(limits, 'max_agents_in_flight', P, 1, 1),
+            startsPerGrant,
+            windowMinutes: num(limits, 'window_minutes', P, 1, 1),
+            integrationRef,
+        },
+        ...parseAcceptance(raw['acceptance'], raw['acceptance_probes']),
+    };
+}
+/** A knob the umbrella declares: set there only; a copy beside the block must agree. */
+function declaredOr(o, key, declared, fallback) {
+    if (declared === undefined)
+        return num(o, key, 'machine', fallback, 1);
+    if (o[key] !== undefined && o[key] !== declared) {
+        throw new ConfigError(`machine.${key}`, 'is declared in machine.programme.limits — set it there only');
+    }
+    return declared;
+}
+function parseConfig(text) {
+    let raw;
+    try {
+        raw = (0, yaml_1.parse)(text);
+    }
+    catch (e) {
+        throw new ConfigError('<root>', `is not valid YAML: ${e.message}`);
+    }
+    if (!isObj(raw))
+        throw new ConfigError('<root>', 'must be a mapping');
+    const project = isObj(raw['project']) ? raw['project'] : undefined;
+    if (!project)
+        throw new ConfigError('project', 'is required');
+    const run = isObj(raw['run']) ? raw['run'] : {};
+    const rails = isObj(raw['rails']) ? raw['rails'] : {};
+    const machine = isObj(raw['machine']) ? raw['machine'] : {};
+    const scope = isObj(raw['scope']) ? raw['scope'] : {};
+    const queue = isObj(raw['queue']) ? raw['queue'] : {};
+    const proof = isObj(raw['proof']) ? raw['proof'] : {};
+    const notify = isObj(raw['notify']) ? raw['notify'] : {};
+    const publish = isObj(raw['publish']) ? raw['publish'] : {};
+    const agent = isObj(raw['agent']) ? raw['agent'] : {};
+    const server = isObj(raw['server']) ? raw['server'] : undefined;
+    const repos = Array.isArray(raw['repos']) ? raw['repos'] : undefined;
+    const sessions = isObj(raw['sessions']) ? raw['sessions'] : undefined;
+    const crossRepoNeeds = Array.isArray(raw['cross_repo_needs']) ? raw['cross_repo_needs'] : undefined;
+    // M6-10: the umbrella, read first — while it is on, every face defaults to on and the limits feed their knobs.
+    const umbrella = parseProgrammeBlock(machine['programme']);
+    const under = umbrella !== null;
+    const cfg = {
+        project: { name: str(project, 'name', 'project') },
+        run: {
+            minHours: num(run, 'min_hours', 'run', exports.DEFAULTS.run.minHours, 0),
+            maxRounds: num(run, 'max_rounds', 'run', exports.DEFAULTS.run.maxRounds, 1),
+            cooldownS: num(run, 'cooldown_s', 'run', exports.DEFAULTS.run.cooldownS, 0),
+            carryIntoCheckouts: strList(run, 'carry_into_checkouts', 'run'),
+            maxConcurrentRuns: num(run, 'max_concurrent_runs', 'run', exports.DEFAULTS.run.maxConcurrentRuns, 1),
+            perRoundSafety: bool(run, 'per_round_safety', 'run', false),
+            surfaces: bool(run, 'surfaces', 'run', false),
+            integration: bool(run, 'integration', 'run', under),
+            brain: bool(run, 'brain', 'run', under),
+        },
+        machine: {
+            maxWorkspaces: declaredOr(machine, 'max_workspaces', umbrella?.limits.maxWorkspaces, exports.DEFAULTS.machine.maxWorkspaces),
+            maxAgentsInFlight: declaredOr(machine, 'max_agents_in_flight', umbrella?.limits.maxAgentsInFlight, exports.DEFAULTS.machine.maxAgentsInFlight),
+            coordinator: bool(machine, 'coordinator', 'machine', under ? true : exports.DEFAULTS.machine.coordinator),
+            provisionWorkspaces: bool(machine, 'provision_workspaces', 'machine', under),
+            preemption: bool(machine, 'preemption', 'machine', under),
+            reapProvisioned: bool(machine, 'reap_provisioned', 'machine', under),
+            idleCheckoutMinutes: num(machine, 'idle_checkout_minutes', 'machine', 60, 0),
+            integrate: bool(machine, 'integrate', 'machine', under),
+            programme: under ? true : bool(machine, 'programme', 'machine', false),
+            ...(umbrella === null ? {} : { programmeMode: umbrella }),
+            /**
+             * ⚠️ ALL OR NOTHING, AND ONLY WHEN THE BLOCK IS PRESENT. A half-specified
+             * envelope is worse than none: three ceilings written and one defaulted
+             * to something the person never chose is a limit they did not agree to,
+             * on a mechanism whose whole job is to stop the machine. The numbers that
+             * ARE defaulted here are defaulted only once somebody has written the
+             * block, which is the moment they have asked to be bounded.
+             */
+            ...(isObj(machine['envelope'])
+                ? {
+                    envelope: (() => {
+                        const env = machine['envelope'];
+                        const windowMinutes = num(env, 'window_minutes', 'machine.envelope', 60, 1);
+                        const wallMinutes = num(env, 'max_wall_clock_minutes', 'machine.envelope', 8 * 60, 1);
+                        const maxUsd = env['max_usd'];
+                        return {
+                            maxConcurrentRuns: num(env, 'max_concurrent_runs', 'machine.envelope', 1, 1),
+                            maxStartsPerWindow: num(env, 'max_starts_per_window', 'machine.envelope', 20, 1),
+                            windowMs: windowMinutes * 60_000,
+                            maxWallClockMs: wallMinutes * 60_000,
+                            ...(maxUsd === undefined
+                                ? {}
+                                : {
+                                    maxUsd: num(env, 'max_usd', 'machine.envelope', 0, 0),
+                                    /**
+                                     * 🔴 ABSENT MEANS ABSENT. IT USED TO MEAN ZERO,
+                                     * WHICH MEANT THE CEILING DID NOTHING.
+                                     *
+                                     * MEASURED: `max_usd: 25` with no estimate, sixteen
+                                     * starts — SIXTEEN ADMITTED. Each reservation held $0,
+                                     * so every start re-read a machine that intended to
+                                     * spend nothing and every one of them passed. The
+                                     * warning below has always said such a project would
+                                     * refuse; the parser quietly disagreed with it.
+                                     *
+                                     * Undefined makes an unpriced start unmeasurable, which
+                                     * `withinEnvelope` refuses — the behaviour the warning
+                                     * describes, and the one a person who wrote a dollar
+                                     * ceiling asked for.
+                                     */
+                                    ...(env['estimate_usd_per_start'] === undefined
+                                        ? {}
+                                        : {
+                                            estimateUsdPerStart: num(env, 'estimate_usd_per_start', 'machine.envelope', 0, 0),
+                                        }),
+                                }),
+                        };
+                    })(),
+                }
+                : {}),
+        },
+        gates: parseGates(raw['gates']),
+        decisions: parseDecisions(raw['decisions']),
+        rails: {
+            forbiddenPaths: strList(rails, 'forbidden_paths', 'rails'),
+            prodPatterns: strList(rails, 'prod_patterns', 'rails'),
+            prodEnvFiles: strList(rails, 'prod_env_files', 'rails', exports.DEFAULTS.rails.prodEnvFiles),
+            exemptions: oneOf(rails, 'exemptions', 'rails', ['ask', 'never'], exports.DEFAULTS.rails.exemptions),
+        },
+        scope: {
+            free: strList(scope, 'free', 'scope'),
+            additive: strList(scope, 'additive', 'scope'),
+            // The presence of the BLOCK, not of either list: `scope: {}` is a
+            // declaration, and so is one naming only `additive`.
+            declared: isObj(raw['scope']),
+        },
+        queue: {
+            topupThreshold: num(queue, 'topup_threshold', 'queue', exports.DEFAULTS.queue.topupThreshold, 0),
+            topupSize: num(queue, 'topup_size', 'queue', exports.DEFAULTS.queue.topupSize, 1),
+            maxSameShape: num(queue, 'max_same_shape', 'queue', exports.DEFAULTS.queue.maxSameShape, 1),
+        },
+        proof: {
+            enabled: bool(proof, 'enabled', 'proof', exports.DEFAULTS.proof.enabled),
+            onPartial: oneOf(proof, 'on_partial', 'proof', ['ask', 'keep', 'discard'], exports.DEFAULTS.proof.onPartial),
+            /**
+             * 🔴 HOW LONG A ROUND WAITS FOR THE ANSWER, and it is the same number
+             * written on the question's deadline. §6.C asks to *"keep independent
+             * work moving"*; a round is the loop's only thread, so waiting IS the
+             * cost. A minimum of one minute rather than zero: a window of zero is a
+             * question asked and abandoned in the same breath.
+             */
+            askWindowMin: num(proof, 'ask_window_min', 'proof', exports.DEFAULTS.proof.askWindowMin, 1),
+        },
+        notify: {
+            channel: str(notify, 'channel', 'notify', exports.DEFAULTS.notify.channel),
+            everyMin: num(notify, 'every_min', 'notify', exports.DEFAULTS.notify.everyMin, 0),
+        },
+        // ABSENT MEANS `never`. A config that says nothing about publishing has not
+        // granted anything, and a value this build does not recognise throws like
+        // every other enum here — which is stricter than defaulting, because the
+        // run refuses to start at all rather than starting with a guess.
+        publish: {
+            policy: oneOf(publish, 'policy', 'publish', exports.PUBLISH_POLICIES, exports.DEFAULTS.publish.policy),
+        },
+        agent: {
+            command: str(agent, 'command', 'agent', exports.DEFAULTS.agent.command),
+            // Deliberately allowed to be empty: an agent with no such flag should be
+            // startable without inventing one for it.
+            outputFormatFlag: agent['output_format_flag'] === ''
+                ? ''
+                : str(agent, 'output_format_flag', 'agent', exports.DEFAULTS.agent.outputFormatFlag),
+            /**
+             * An absolute path to the built-in provider's executable, for an
+             * installation that is not beside node. Absent means "find the package",
+             * which is the ordinary case. Validated at launch, not here: this
+             * function parses a file and must not touch the filesystem.
+             */
+            ...(typeof agent['executable'] === 'string' && agent['executable'] !== ''
+                ? { executable: str(agent, 'executable', 'agent', '') }
+                : {}),
+            // Where a configured agent's runtime lives, for containment to grant.
+            // Absent for the built-in provider, which finds its own package.
+            runtime: strList(agent, 'runtime', 'agent'),
+            // Names only. The value comes from the daemon's environment, so a key
+            // never has to be written into a config file to reach the agent.
+            env: strList(agent, 'env', 'agent'),
+            /**
+             * The arguments that turn a CONFIGURED provider's own tools off.
+             *
+             * 🔴 REQUIRED FOR A CONFIGURED PROVIDER, AND THE TRANSPORT REFUSES
+             * WITHOUT IT. The built-in provider is mediated by flags looply knows;
+             * for anything else looply cannot guess, and a guessed flag that silently
+             * does nothing reads exactly like one that works. Empty here means the
+             * launch is refused rather than run unmediated.
+             */
+            noHostTools: strList(agent, 'no_host_tools', 'agent'),
+            /**
+             * Which model each role runs, and how hard. Built-in provider only; see
+             * `model-routing.ts` for the rule that keeps a Fable model on the brain.
+             * Absent keys are absent from the spec, so a file that says nothing
+             * produces the invocation it always did.
+             */
+            ...roleModelsOf(agent),
+            /**
+             * WHICH AGENT KEYS THE FILE ACTUALLY CONTAINED.
+             *
+             * 🔴 WITHOUT THIS, A PRESET COULD NEVER WIN. `resolveProvider` treated a
+             * present `command` as "the person wrote one" — but `command` always has
+             * a value, because THIS function defaults it to Claude's. So the
+             * truthiness test was true for every project on earth, the preset's
+             * command was overridden every time, and somebody who wrote
+             * `provider: codex` got Claude while being shown a warning about codex
+             * that reads as confirmation.
+             *
+             * ⚠️ THE KEYS, NOT THE VALUES. "Absent" and "written, and equal to the
+             * default" are different statements and only one of them should lose to
+             * a preset. A person who explicitly writes Claude's command line beside
+             * `provider: codex` is saying something, even if it is a mistake, and it
+             * is not this function's place to discard it silently.
+             */
+            declared: Object.keys(agent).filter((k) => agent[k] !== undefined),
+        },
+    };
+    // ⚠️ VALIDATED HERE, NOT AT ROUND 1. A misspelled provider name is the kind
+    // of mistake that should stop a run before it starts, not after the first
+    // model call has been spent finding out.
+    const providerName = agent['provider'];
+    if (providerName !== undefined && providerName !== '') {
+        cfg.provider = str(agent, 'provider', 'agent');
+    }
+    const id = project['id'];
+    if (id !== undefined)
+        cfg.project.id = str(project, 'id', 'project');
+    const to = notify['to'];
+    if (to !== undefined)
+        cfg.notify.to = str(notify, 'to', 'notify');
+    if (server) {
+        cfg.server = { url: str(server, 'url', 'server') };
+        if (server['machine_token_file'] !== undefined) {
+            cfg.server.machineTokenFile = str(server, 'machine_token_file', 'server');
+        }
+    }
+    /**
+     * Validated strictly at load, like everything else here: a cross-repo mistake
+     * found at hour three of a run has already cost the night.
+     */
+    if (repos !== undefined) {
+        const seen = new Set();
+        cfg.repos = repos.map((entry, i) => {
+            const at = `repos[${i}]`;
+            if (!isObj(entry))
+                throw new ConfigError(at, 'must be an object with id and path');
+            const id = str(entry, 'id', at);
+            if (!/^[A-Za-z0-9._-]+$/.test(id)) {
+                throw new ConfigError(`${at}.id`, 'must be letters, digits, dot, dash or underscore - it is an identity, not a path');
+            }
+            if (seen.has(id))
+                throw new ConfigError(`${at}.id`, `${id} is declared twice`);
+            seen.add(id);
+            return { id, path: str(entry, 'path', at) };
+        });
+    }
+    if (sessions !== undefined) {
+        const out = {};
+        if (sessions['repo'] !== undefined)
+            out.repo = str(sessions, 'repo', 'sessions');
+        if (sessions['budget_owner'] !== undefined)
+            out.budgetOwner = str(sessions, 'budget_owner', 'sessions');
+        // ⚠️ The PRESENCE of the key is the grant, so an explicitly empty list is a
+        // grant of nothing rather than no grant at all — the same distinction
+        // `scope.declared` draws two fields up.
+        if (sessions['scope'] !== undefined)
+            out.scope = strList(sessions, 'scope', 'sessions');
+        cfg.sessions = out;
+    }
+    if (crossRepoNeeds !== undefined) {
+        cfg.crossRepoNeeds = crossRepoNeeds.map((entry, i) => {
+            const at = `cross_repo_needs[${i}]`;
+            if (!isObj(entry))
+                throw new ConfigError(at, 'must be an object with repo and what');
+            // ⚠️ `repo` is NOT checked against `repos:` here. That is
+            // `crossRepoBlockedBy`'s answer — `undeclared` — and making it a load
+            // error instead would refuse a config whose only fault is that the two
+            // lists are being edited in either order.
+            return { repo: str(entry, 'repo', at), what: str(entry, 'what', at) };
+        });
+    }
+    // M6-10: the umbrella's window is the envelope's; declared once, in the limits.
+    if (umbrella !== null && cfg.machine !== undefined) {
+        const windowMs = umbrella.limits.windowMinutes * 60_000;
+        if (cfg.machine.envelope !== undefined) {
+            if (cfg.machine.envelope.windowMs !== windowMs) {
+                throw new ConfigError('machine.envelope.window_minutes', 'is declared in machine.programme.limits — set it there only');
+            }
+        }
+        else {
+            /**
+             * 🔴 THE OWNER'S `max_agents_in_flight` IS THE RUN CEILING OF THE ENVELOPE
+             * LOOPLY WRITES FOR THEM — it used to be a hard-coded 1.
+             *
+             * Nobody declared that 1: the owner declares their limits in the block,
+             * and this envelope exists only because the block implies one. So a
+             * programme declared "2 agents in flight", the coordinator placed two
+             * goals in two checkouts, and the autonomy tick then refused the second
+             * Start on every cadence — "1 run(s) are in flight and the envelope
+             * allows 1 (maxConcurrentRuns)" — while the run that raced past it
+             * refused itself with the same sentence. MEASURED live (LIVE-2). An
+             * envelope the owner writes themselves is theirs and is untouched above.
+             */
+            cfg.machine = {
+                ...cfg.machine,
+                envelope: {
+                    maxConcurrentRuns: umbrella.limits.maxAgentsInFlight,
+                    maxStartsPerWindow: 20,
+                    windowMs,
+                    maxWallClockMs: 8 * 60 * 60_000,
+                },
+            };
+        }
+    }
+    return cfg;
+}
+/**
+ * Warnings that do not block a run but that a user should see before starting one.
+ * Silence here was how the previous harness shipped 166 commits whose trailer
+ * named a check that had never run.
+ */
+function configWarnings(cfg) {
+    const warnings = [];
+    if (!cfg.rails.forbiddenPaths.length) {
+        warnings.push('rails.forbidden_paths is empty — nothing in this repo is off limits');
+    }
+    if (!cfg.gates.some((g) => g.required)) {
+        warnings.push('no gate step is marked required — a green gate proves less than you think');
+    }
+    if (!cfg.proof.enabled) {
+        warnings.push('proof.enabled is false — rounds will commit on a green build alone');
+    }
+    /**
+     * M6-20 / §6.C: WHO CAN BE ASKED, AND WHAT HAPPENS IF NOBODY ANSWERS.
+     *
+     * 🔴 THE ORIGINAL WARNING WAS TRUE FOR A YEAR. `on_partial: ask` was the
+     * default, no CLI code produced a question, and a run answered its own with
+     * `discard` (the audit's F-03). It also said what it was waiting for —
+     * *"Making it really ask is a change to the round protocol and the owner's
+     * decision"* — and `OWNER_CHARTER.md` §6.C is that decision, so a paired
+     * machine now raises a real question and waits `ask_window_min` for it.
+     *
+     * ⚠️ AN UNPAIRED ONE STILL CANNOT, AND THAT IS WHY BOTH HALVES ARE NAMED.
+     * `parseConfig` is pure and cannot read the pairing, so guessing which half
+     * a reader is in would make this warning wrong for somebody.
+     */
+    if (cfg.proof.enabled && cfg.proof.onPartial === 'ask') {
+        warnings.push(`proof.on_partial is "ask": a paired machine raises a question and waits ${cfg.proof.askWindowMin} ` +
+            'minutes for an answer on your phone; an unpaired one has nobody to ask and discards, saying so on ' +
+            'the run\'s feed and on the item. Set it to "keep" or "discard" to decide without being asked');
+    }
+    if (cfg.notify.everyMin === 0) {
+        warnings.push('notify.every_min is 0 — this run will report nothing, including when it finishes');
+    }
+    /**
+     * 🔴 THE ONE BREAKING CHANGE IN THIS PROJECT'S HISTORY, SAID OUT LOUD AT
+     * LAST — IT USED TO ANNOUNCE ITSELF AT ROUND 1 OF AN OVERNIGHT RUN.
+     *
+     * Phase 6 made `agent.no_host_tools` REQUIRED of any configured provider,
+     * and the refusal lives in the transport: the first model call fails with a
+     * sentence naming the field. Nothing before that said anything — not
+     * `parseConfig`, not `looply doctor`, not `looply doctor --provider`, which
+     * returned PASS on exactly the configuration where every model call is
+     * refused.
+     *
+     * MEASURED by the cycle that found it: a config with no `provider:` line at
+     * all, just `agent: command: mycli exec`, parses clean, warns about nothing,
+     * passes doctor, and is refused at the first model call. That is EVERY
+     * project that ever set `agent.command` — not only the ones using a preset —
+     * and for each of them looply looked healthy right up to the moment it spent
+     * their evening finding out.
+     *
+     * ⚠️ THE REQUIREMENT ITSELF IS RIGHT AND IS NOT SOFTENED HERE. Looply cannot
+     * guess the flag that turns an unknown binary's tools off, and a guessed
+     * flag that silently does nothing reads exactly like one that works. What
+     * changes is WHEN a person is told: at the moment they can still fix it,
+     * rather than after the first model call has been spent.
+     */
+    /**
+     * 🔴 A DOLLAR CEILING WITH NOTHING TO ESTIMATE AGAINST REFUSES EVERY START.
+     *
+     * Not a hypothetical: admission writes its own reservation first, reads the
+     * window back, and an unpriced reservation makes that window unmeasurable —
+     * which `withinEnvelope` refuses on, correctly. So a person who writes
+     * `max_usd` and nothing else gets a machine that never starts anything, with
+     * the only explanation a sentence in a daemon log at 3am.
+     */
+    /**
+     * 🔴 THE CEILINGS THAT DISAGREE — AND THIS SENTENCE IS WHAT THE COORDINATOR
+     * END-TO-END PROOF COST AN HOUR TO LEARN.
+     *
+     * A project set `machine.max_workspaces: 2`; the scheduler correctly placed
+     * two goals in two checkouts; and exactly ONE run ever registered. The second
+     * was refused by `run.max_concurrent_runs`, which defaults to 1, AFTER a
+     * workspace had been cut, a goal placed and a process spawned. Neither number
+     * was wrong and nothing anywhere said they disagreed.
+     *
+     * ⚠️ IT NAMES THE BINDING CEILING RATHER THAN GUESSING AN INTENT. Looply does
+     * not raise anybody's limit for them — that is their decision — it only
+     * refuses to let the disagreement stay invisible.
+     */
+    const trouble = (0, core_1.concurrencyTrouble)({
+        workspaces: cfg.machine?.maxWorkspaces,
+        runs: cfg.run.maxConcurrentRuns,
+        agents: cfg.machine?.maxAgentsInFlight,
+    });
+    if (trouble !== null)
+        warnings.push(trouble);
+    const envelope = cfg.machine?.envelope;
+    if (envelope?.maxUsd !== undefined && !((envelope.estimateUsdPerStart ?? 0) > 0)) {
+        warnings.push('machine.envelope.max_usd is set but estimate_usd_per_start is not — every autonomous start ' +
+            'will be REFUSED, because admission cannot show an unpriced start is under a dollar ceiling. ' +
+            'Set estimate_usd_per_start to what you expect one run to cost');
+    }
+    /**
+     * 🔴 A `provider:` PRESET IS A CONFIGURED COMMAND TOO — AND THIS TEST COULD NOT
+     * SEE ONE, SO `looply doctor` PASSED A PROJECT WHOSE EVERY MODEL CALL REFUSES.
+     *
+     * `agent.command` still holds the DEFAULT at parse time when a preset is
+     * named: `resolveProvider` substitutes the preset's command later, at run
+     * time. So `configured` was false, no warning was pushed, doctor printed none
+     * and exited 0 — and the first model call of the first run was refused by a
+     * message naming the very field doctor had just declined to mention.
+     *
+     * MEASURED: a config of `agent:
+    provider: "codex"` and nothing else —
+     * `looply doctor` exit 0, no mention of `no_host_tools`.
+     */
+    const configured = cfg.agent.command !== exports.DEFAULTS.agent.command ||
+        (cfg.provider !== undefined && cfg.provider !== '');
+    if (configured && (cfg.agent.noHostTools?.length ?? 0) === 0) {
+        warnings.push('agent.no_host_tools is not set, and this project configures its own agent command ' +
+            '(directly, or through a provider preset) — ' +
+            'every model call will be REFUSED until it is. Looply gives a model no host tools and ' +
+            'cannot guess the argument that turns an unknown binary\'s own tools off; set it to those ' +
+            'arguments (for example `no_host_tools: ["--no-tools"]`)');
+    }
+    return warnings;
+}
+//# sourceMappingURL=config.js.map