sprag-cli 3.70.0 → 3.72.0

package/src/doc2md.cjs

@@ -28,6 +28,7 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const { spawn, spawnSync } = require('node:child_process');
 const ledger = require('./doc2md-ledger.cjs');
+const { envVar } = require('./env.cjs');
 
 // Formats where the original is of no use to the model. Images are absent
 // deliberately: markitdown returns nothing for them, and OCR misread resource
@@ -247,7 +248,7 @@ const IS_WINDOWS = process.platform === 'win32';
  */
 function interpreterCandidates() {
   const out = [];
-  if (process.env.CTS_DOC2MD_PYTHON) out.push({ bin: process.env.CTS_DOC2MD_PYTHON, args: [] });
+  if (envVar('DOC2MD_PYTHON')) out.push({ bin: envVar('DOC2MD_PYTHON'), args: [] });
   // The tool's own venv, created by `doc2md install-converter`. First because
   // it is the only one this tool controls: telling people to `pip install`
   // into the system interpreter is how a token-saving CLI ends up owning a
@@ -477,7 +478,7 @@ function convert(filePath, { converter = CONVERTER, python: pythonOverride = nul
     // The .fig parser is an npm install of a few hundred KB, fast enough to
     // wait for inline the first time a Figma file turns up.
     if (!result.ok && result.reason === 'no-figparser'
-        && process.env.CTS_DOC2MD_NO_AUTOINSTALL !== '1') {
+        && envVar('DOC2MD_NO_AUTOINSTALL') !== '1') {
       fig2md.installFigParser(userDataDir());
       result = spawnFigConvert(fig2md, filePath);
     }
@@ -565,7 +566,7 @@ function convert(filePath, { converter = CONVERTER, python: pythonOverride = nul
  * Returns true when a converter is ready to use right now.
  */
 function ensureConverterInstalled({ waitMs = 15_000 } = {}) {
-  if (process.env.CTS_DOC2MD_NO_AUTOINSTALL === '1') return false;
+  if (envVar('DOC2MD_NO_AUTOINSTALL') === '1') return false;
   if (findInterpreter()) return true;
 
   const lock = path.join(userDataDir(), 'doc2md-install.lock');

package/src/env.cjs

@@ -0,0 +1,7 @@
+'use strict';
+// CommonJS twin of src/env.js. Keep the two identical in behaviour;
+// test/env.test.js pins them together.
+function envVar(name, env = process.env) {
+  return env['SPRAG_' + name] ?? env['CTS_' + name];
+}
+module.exports = { envVar };

package/src/env.js

@@ -0,0 +1,19 @@
+/**
+ * Reads a SPRAG_ environment variable, falling back to its legacy CTS_ name.
+ *
+ * The package used to be called claude-token-saver and its variables carried a
+ * CTS_ prefix. Users still have those set in shells, CI and Claude Code managed
+ * settings, so every read takes the SPRAG_ name first and the CTS_ name second.
+ * Pass the suffix: envVar('NO_TEAM_SYNC') answers env.SPRAG_NO_TEAM_SYNC ??
+ * env.CTS_NO_TEAM_SYNC.
+ *
+ * src/env.cjs is the CommonJS twin for the .cjs files; test/env.test.js pins
+ * the two together.
+ *
+ * @param {string} name the variable name without its prefix
+ * @param {Record<string, string | undefined>} [env]
+ * @returns {string | undefined}
+ */
+export function envVar(name, env = process.env) {
+  return env['SPRAG_' + name] ?? env['CTS_' + name];
+}

package/src/first-run-note.js

@@ -5,10 +5,11 @@
  * ONCE per note key and then never again: the shown-at timestamp is persisted
  * next to the other state files and checked before anything is printed.
  *
- * Opt out entirely with CTS_NO_NOTE=1 (also honoured by anything that pipes
+ * Opt out entirely with SPRAG_NO_NOTE=1 (also honoured by anything that pipes
  * our output somewhere it does not belong).
  */
 
+import { envVar } from './env.js';
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { userDataDir } from './paths.js';
@@ -53,7 +54,7 @@ export function markNoteShown(key, now = Date.now()) {
 /** True only the first time this key is asked about. Best-effort — a
  *  read-only state dir just means the note repeats, never that we crash. */
 export function shouldShowOnce(key, { now = Date.now() } = {}) {
-  if (process.env.CTS_NO_NOTE === '1') return false;
+  if (envVar('NO_NOTE') === '1') return false;
   if (load()[key]) return false;
   try {
     markShown(key, now);

package/src/harness.js

@@ -11,7 +11,6 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from 'no
 import { join, resolve, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { createRequire } from 'node:module';
-import { fileURLToPath } from 'node:url';
 import {
   HARNESS_SECTIONS,
   HARNESS_BLOCK_BEGIN,
@@ -28,6 +27,7 @@ import { ruleHealthWarningForStatusline, modelRatchetPathFor, renderModelRatchet
 import { compactWindowWarningForStatusline } from './compact-window.js';
 import { userLanguage } from './config.js';
 import { codexUserDir } from './agent.js';
+import { ratchetPresetEntries } from './presets-source.js';
 
 const require = createRequire(import.meta.url);
 function readHarnessState() {
@@ -441,19 +441,9 @@ export async function harnessPull({ root = findProjectRoot(), scope = 'global',
  * turns a rule the user already answered into a new one.
  */
 export function presetRuleEntries() {
-  try {
-    // fileURLToPath, not `.pathname`: the latter yields `/D:/repo/src` on
-    // Windows, where the read fails and the catch below turns a missing
-    // file into an empty rule set without ever saying so.
-    const path = join(dirname(fileURLToPath(import.meta.url)), '..', 'presets', 'ratchet-rules.json');
-    const data = JSON.parse(readFileSync(path, 'utf8'));
-    return (Array.isArray(data.rules) ? data.rules : [])
-      .filter((r) => r && typeof r.ko === 'string' && r.ko.trim())
-      .map((r) => ({ ko: r.ko.trim(), en: (r.en || r.ko).trim(),
-        ...(Array.isArray(r.agents) ? { agents: r.agents.filter((a) => typeof a === 'string') } : {}) }));
-  } catch {
-    return [];
-  }
+  // The published bundle when it verifies, else presets/ratchet-rules.json
+  // (presets-source.js). Each entry carries its stable id.
+  return ratchetPresetEntries();
 }
 
 /** Preset rule text in the user's configured language. */

package/src/hook.cjs

@@ -13,11 +13,12 @@
 'use strict';
 
 // CJS twin of src/debug.js \u2014 hook failures must stay silent for the session
-// but be visible under CTS_DEBUG=1, otherwise a broken path is
+// but be visible under SPRAG_DEBUG=1, otherwise a broken path is
 // indistinguishable from "nothing to do".
-var CTS_DEBUG = !!process.env.CTS_DEBUG;
+// Standalone hook (no requires), so the SPRAG_ -> CTS_ fallback is inline.
+var DEBUG_ON = !!(process.env.SPRAG_DEBUG ?? process.env.CTS_DEBUG);
 function dbg(scope, err) {
-  if (!CTS_DEBUG) return;
+  if (!DEBUG_ON) return;
   process.stderr.write('[cts:' + scope + '] ' + ((err && err.stack) || String(err)) + '\n');
 }
 

package/src/preset-sign.js

@@ -0,0 +1,106 @@
+/**
+ * preset-sign — the signature on a centrally published preset bundle.
+ *
+ * The superuser edits presets in the /ops console and signs each published
+ * bundle in the browser with an ECDSA P-256 key (WebCrypto, SHA-256). The CLI
+ * applies a remote bundle only when that signature verifies against a public key
+ * listed here, so a compromised server or a man in the middle cannot push
+ * ratchet text or agent prompts into every session: the worst it can do is
+ * withhold updates, and then the presets bundled in the npm package are used.
+ *
+ * The signing input is canonical JSON of the six bundle fields that carry
+ * meaning (format, version, min_cli, ratchet_rules, model_rules, agents): keys
+ * sorted recursively, no whitespace. site/assets/preset-sign.js is the browser
+ * copy of canonicalJson(); test/preset-sign.test.js signs with that copy and
+ * verifies with this one, so the two cannot drift apart.
+ *
+ * Verification here is synchronous (node:crypto with IEEE P1363 signatures,
+ * the encoding WebCrypto produces), because the presets are read on the
+ * session-start path by functions that are synchronous today. It takes well
+ * under a millisecond.
+ */
+
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+
+/**
+ * Public keys allowed to sign preset bundles: [{ kid, jwk }].
+ *
+ * EMPTY until the superuser creates the signing key in the /ops console
+ * (sprag.io/ops/#presets → Signing key → Create). After that, paste the public
+ * JWK shown there as one entry, with `kid` set to the fingerprint the console
+ * shows next to it, e.g.
+ *
+ *   { kid: '0123456789abcdef', jwk: { kty: 'EC', crv: 'P-256', x: '…', y: '…' } }
+ *
+ * While this list is empty every remote bundle is rejected and the bundled
+ * presets are used; `sprag presets status` says so. Rotating the key means
+ * adding the new entry, releasing, then publishing with the new key; remove the
+ * old entry one release later.
+ */
+export const PRESET_SIGNING_KEYS = [];
+
+export const PRESET_BUNDLE_FORMAT = 1;
+export const PRESET_MAX_BYTES = 200 * 1024;
+
+/** JSON with object keys sorted at every depth and no whitespace. */
+export function canonicalJson(value) {
+  if (value === null || typeof value !== 'object') {
+    if (typeof value === 'number' && !Number.isFinite(value)) return 'null';
+    return value === undefined ? 'null' : JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return '[' + value.map((v) => (v === undefined || typeof v === 'function' ? 'null' : canonicalJson(v))).join(',') + ']';
+  }
+  const keys = Object.keys(value).filter((k) => value[k] !== undefined && typeof value[k] !== 'function').sort();
+  return '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalJson(value[k])).join(',') + '}';
+}
+
+/** The exact bytes that are signed. Fields outside the six are not covered. */
+export function signingInput(bundle) {
+  const b = bundle || {};
+  return canonicalJson({
+    format: b.format ?? null,
+    version: b.version ?? null,
+    min_cli: b.min_cli ?? null,
+    ratchet_rules: b.ratchet_rules ?? null,
+    model_rules: b.model_rules ?? null,
+    agents: b.agents ?? null,
+  });
+}
+
+/** sha256 of the canonical public JWK (kty, crv, x, y only), first 16 hex. */
+export function jwkFingerprint(jwk) {
+  const pub = { crv: jwk?.crv, kty: jwk?.kty, x: jwk?.x, y: jwk?.y };
+  return createHash('sha256').update(canonicalJson(pub)).digest('hex').slice(0, 16);
+}
+
+function b64urlDecode(s) {
+  if (typeof s !== 'string' || !/^[A-Za-z0-9_-]+={0,2}$/.test(s)) return null;
+  return Buffer.from(s.replace(/=+$/, '').replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+}
+
+/**
+ * Check a bundle's signature. Returns { ok: true, kid } or
+ * { ok: false, reason } where reason is one of
+ *   'unsigned'     the bundle carries no signature (version 1 is seeded unsigned)
+ *   'no-keys'      this CLI has no signing key yet (PRESET_SIGNING_KEYS is empty)
+ *   'unknown-kid'  signed by a key this CLI does not list
+ *   'bad-sig'      the signature does not match the content
+ */
+export function verifyBundleSignature(bundle, keys = PRESET_SIGNING_KEYS) {
+  const sig = bundle && bundle.sig;
+  if (!sig || typeof sig !== 'object' || !sig.value) return { ok: false, reason: 'unsigned' };
+  if (!Array.isArray(keys) || keys.length === 0) return { ok: false, reason: 'no-keys' };
+  if (sig.alg !== 'ES256') return { ok: false, reason: 'bad-sig' };
+  const entry = keys.find((k) => k && k.kid === sig.kid);
+  if (!entry) return { ok: false, reason: 'unknown-kid' };
+  const raw = b64urlDecode(sig.value);
+  if (!raw || raw.length !== 64) return { ok: false, reason: 'bad-sig' };
+  try {
+    const key = createPublicKey({ key: { kty: 'EC', crv: 'P-256', x: entry.jwk.x, y: entry.jwk.y }, format: 'jwk' });
+    const ok = cryptoVerify('sha256', Buffer.from(signingInput(bundle), 'utf8'), { key, dsaEncoding: 'ieee-p1363' }, raw);
+    return ok ? { ok: true, kid: entry.kid } : { ok: false, reason: 'bad-sig' };
+  } catch {
+    return { ok: false, reason: 'bad-sig' };
+  }
+}

package/src/preset-sync.js

@@ -0,0 +1,133 @@
+/**
+ * preset-sync — fetch the centrally published preset bundle.
+ *
+ * Read-only and anonymous: two RPC calls to the same Supabase project the team
+ * layer uses, with the public anon key and no member key, so the request is all
+ * that leaves the machine. `presets_version()` is polled first because it is a
+ * few bytes; `presets_published()` is fetched only when the version moved.
+ *
+ * Cadence: at most once every 24 hours, from a detached child spawned on the
+ * SessionStart path (the same pattern as the update check and the team sync),
+ * so a session never waits on the network. The attempt is stamped before the
+ * spawn, so an offline machine does not spawn a doomed child every session.
+ *
+ * A fetched bundle is stored only when this CLI would apply it (see
+ * presets-source.js evaluateBundle). A rejected one is recorded with its reason
+ * so `sprag presets status` can say why the bundled presets are still in use.
+ *
+ * Opt out with SPRAG_NO_PRESET_SYNC=1 or SPRAG_NO_UPDATE_CHECK=1.
+ */
+
+import * as childProcess from 'node:child_process';
+import { userDataDir } from './paths.js';
+import { writeStateFile } from './state-file.js';
+import { debug } from './debug.js';
+import {
+  cliVersion, evaluateBundle, presetSyncDisabled, readRemoteCache, remoteCachePath, resetPresetSourceMemo,
+} from './presets-source.js';
+import { PRESET_SIGNING_KEYS } from './preset-sign.js';
+import { CLI_ENTRY, detachedChildEnv, isDetachedChild } from './cli-entry.js';
+
+export const PRESET_SYNC_INTERVAL_MS = 24 * 60 * 60 * 1000;
+
+function writeCache(cache, dir) {
+  writeStateFile(remoteCachePath(dir), JSON.stringify(cache, null, 2) + '\n');
+  resetPresetSourceMemo();
+}
+
+/** Due when the last attempt (success or not) is 24 hours old, or there was none. */
+export function presetSyncDue(cache, now = Date.now()) {
+  const at = Number(cache && cache.checkedAt);
+  return !Number.isFinite(at) || at <= 0 || now - at >= PRESET_SYNC_INTERVAL_MS || now < at;
+}
+
+export function nextPresetCheckAt(cache) {
+  const at = Number(cache && cache.checkedAt);
+  return Number.isFinite(at) && at > 0 ? at + PRESET_SYNC_INTERVAL_MS : null;
+}
+
+/**
+ * Called on session start. Never awaits the network. Returns true when a child
+ * was spawned.
+ */
+export function spawnPresetSyncIfDue({
+  env = process.env, now = Date.now(), dir = userDataDir(),
+  spawn = childProcess.spawn, cliPath = CLI_ENTRY, execPath = process.execPath,
+} = {}) {
+  if (isDetachedChild(env) || presetSyncDisabled(env)) return false;
+  const cache = readRemoteCache(dir);
+  if (!presetSyncDue(cache, now)) return false;
+  try {
+    writeCache({ ...cache, checkedAt: now }, dir);
+  } catch (e) {
+    debug('preset-sync:stamp', e);
+    return false;
+  }
+  try {
+    spawn(execPath, [cliPath, 'presets', 'sync', '--background'],
+      { detached: true, stdio: 'ignore', windowsHide: true, env: detachedChildEnv(env) }).unref();
+    return true;
+  } catch (e) {
+    debug('preset-sync:spawn', e);
+    return false;
+  }
+}
+
+/**
+ * Fetch now. Returns { status, version?, reason? } where status is
+ *   'disabled' | 'none' (nothing published) | 'current' (cached version is the
+ *   published one) | 'updated' | 'rejected' | 'error'
+ * `force` refetches the bundle even when the version did not move.
+ */
+export async function syncPresets({
+  env = process.env, now = Date.now(), dir = userDataDir(), fetch, force = false,
+  version = cliVersion(), keys = PRESET_SIGNING_KEYS,
+} = {}) {
+  if (presetSyncDisabled(env)) return { status: 'disabled' };
+  const { rpc, teamApiUrl, teamAnonKey } = await import('./team-sync.js');
+  const call = (fn) => rpc(fn, {}, { fetch, url: teamApiUrl(env), key: teamAnonKey(env) });
+  const cache = readRemoteCache(dir);
+  const base = { ...cache, checkedAt: now };
+  // The cached bundle counts only while it still verifies: after a key rotation
+  // the same version has to be fetched again rather than skipped as current.
+  const cachedOk = cache.bundle && evaluateBundle(cache.bundle, { version, keys }).ok;
+  const have = cachedOk ? cache.bundle.version : 0;
+  try {
+    const head = await call('presets_version');
+    if (!head || !Number.isInteger(head.version)) {
+      writeCache({ ...base, lastError: null }, dir);
+      return { status: 'none' };
+    }
+    if (!force && head.version === have) {
+      writeCache({ ...base, lastError: null }, dir);
+      return { status: 'current', version: have };
+    }
+    if (!force && cache.rejected && cache.rejected.version === head.version && cache.rejected.cli === version
+        && cache.rejected.keys === keys.length) {
+      writeCache({ ...base, lastError: null }, dir);
+      return { status: 'rejected', version: head.version, reason: cache.rejected.reason };
+    }
+    const bundle = await call('presets_published');
+    if (!bundle) {
+      writeCache({ ...base, lastError: null }, dir);
+      return { status: 'none' };
+    }
+    if (Number.isInteger(bundle.version) && bundle.version < have) {
+      const rejected = { version: bundle.version, reason: 'older', at: now, cli: version, keys: keys.length };
+      writeCache({ ...base, rejected, lastError: null }, dir);
+      return { status: 'rejected', version: bundle.version, reason: 'older' };
+    }
+    const ev = evaluateBundle(bundle, { version, keys });
+    if (!ev.ok) {
+      const rejected = { version: Number.isInteger(bundle.version) ? bundle.version : null, reason: ev.reason, at: now, cli: version, keys: keys.length };
+      writeCache({ ...base, rejected, lastError: null }, dir);
+      return { status: 'rejected', version: rejected.version, reason: ev.reason };
+    }
+    writeCache({ checkedAt: now, fetchedAt: now, version: bundle.version, bundle, rejected: null, lastError: null }, dir);
+    return { status: 'updated', version: bundle.version };
+  } catch (e) {
+    debug('preset-sync', e);
+    writeCache({ ...base, lastError: { message: String(e && e.message || e).slice(0, 200), at: now } }, dir);
+    return { status: 'error', reason: String(e && e.message || e) };
+  }
+}

package/src/presets-source.js

@@ -0,0 +1,209 @@
+/**
+ * presets-source — which presets this machine uses: the centrally published
+ * bundle or the copy shipped in the npm package.
+ *
+ * The superuser publishes ratchet presets, model-routing presets and the
+ * delegation agent definitions from the /ops console as one signed bundle.
+ * preset-sync.js fetches it (read-only, at most daily, in a detached child) into
+ * <userDataDir>/presets-remote.json. Everything that reads presets comes through
+ * here, so a newer bundle takes effect at the next session start after a fetch.
+ *
+ * The remote bundle wins only while it is valid, checked again on every read:
+ * its signature verifies against a key in PRESET_SIGNING_KEYS, its format is
+ * one this CLI understands, its min_cli is not newer than this CLI, its shape is
+ * right and it is at most 200 KB. Anything else falls back to the bundled
+ * presets in presets/*.json, which have the same shape. So a blocked network, a
+ * server outage or a tampered response leaves the machine exactly where a fresh
+ * install of this version would be.
+ *
+ * SPRAG_NO_PRESET_SYNC=1 (or SPRAG_NO_UPDATE_CHECK=1) turns the remote source
+ * off entirely: no fetch, and a cached bundle is ignored.
+ */
+
+import { readFileSync, statSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { envVar } from './env.js';
+import { userDataDir } from './paths.js';
+import {
+  PRESET_BUNDLE_FORMAT, PRESET_MAX_BYTES, PRESET_SIGNING_KEYS, verifyBundleSignature,
+} from './preset-sign.js';
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+
+export function cliVersion() {
+  try { return require('../package.json').version; } catch { return '0.0.0'; }
+}
+
+export function presetSyncDisabled(env = process.env) {
+  return envVar('NO_PRESET_SYNC', env) === '1' || envVar('NO_UPDATE_CHECK', env) === '1';
+}
+
+export function remoteCachePath(dir = userDataDir()) { return join(dir, 'presets-remote.json'); }
+
+/** -1, 0 or 1. Pre-release suffixes are ignored; unparsable versions compare as 0.0.0. */
+export function compareVersions(a, b) {
+  const p = (v) => (String(v || '').trim().match(/^v?(\d+)\.(\d+)\.(\d+)/) || [0, 0, 0, 0]).slice(1, 4).map(Number);
+  const x = p(a), y = p(b);
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i] ? 1 : -1;
+  return 0;
+}
+
+const ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const MODEL_RE = /^[A-Za-z0-9._-]{1,80}$/;
+const LINE_RE = /^[^\r\n]{1,600}$/;
+const TOOL_RE = /^[A-Za-z0-9_*().: -]{1,80}$/;
+const EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max'];
+const TIERS = ['T1', 'T2', 'T1H'];
+const str = (v) => typeof v === 'string' && v.trim() !== '';
+
+function uniq(list, key) {
+  const seen = new Set();
+  for (const x of list) { if (seen.has(x[key])) return false; seen.add(x[key]); }
+  return true;
+}
+
+/**
+ * Shape check for a bundle. Returns null when valid, else a short reason code.
+ * Rejected here rather than when rendering: an agent name with a slash would be
+ * a path outside ~/.claude/agents, and a newline in a frontmatter field would
+ * let the description write its own `tools:` line.
+ */
+export function bundleShapeError(b) {
+  if (!b || typeof b !== 'object' || Array.isArray(b)) return 'shape';
+  let bytes;
+  try { bytes = Buffer.byteLength(JSON.stringify(b), 'utf8'); } catch { return 'shape'; }
+  if (bytes > PRESET_MAX_BYTES) return 'too-large';
+  if (!Number.isInteger(b.format) || b.format < 1) return 'shape';
+  if (b.format > PRESET_BUNDLE_FORMAT) return 'format';
+  if (!Number.isInteger(b.version) || b.version < 1) return 'shape';
+  if (b.min_cli != null && typeof b.min_cli !== 'string') return 'shape';
+  const { ratchet_rules: rr, model_rules: mr, agents: ag } = b;
+  if (!Array.isArray(rr) || !Array.isArray(mr) || !Array.isArray(ag)) return 'shape';
+  for (const r of rr) {
+    if (!r || !ID_RE.test(r.id) || !str(r.ko) || !str(r.en)) return 'shape';
+    if (r.agents != null && (!Array.isArray(r.agents) || r.agents.some((a) => a !== 'claude' && a !== 'codex'))) return 'shape';
+  }
+  for (const m of mr) {
+    if (!m || !ID_RE.test(m.id) || !TIERS.includes(m.tier) || !ID_RE.test(m.category)) return 'shape';
+    if (!str(m.label) || !str(m.labelEn) || !str(m.agent) || !LINE_RE.test(m.agent)) return 'shape';
+    if (m.budget != null && (typeof m.budget !== 'object' || Array.isArray(m.budget))) return 'shape';
+  }
+  for (const a of ag) {
+    if (!a || !NAME_RE.test(a.name) || !MODEL_RE.test(a.model) || !EFFORTS.includes(a.effort)) return 'shape';
+    if (!Array.isArray(a.tools) || a.tools.length === 0 || a.tools.some((t) => typeof t !== 'string' || !TOOL_RE.test(t))) return 'shape';
+    if (!a.description || !LINE_RE.test(a.description.en || '') || (a.description.ko != null && !LINE_RE.test(a.description.ko))) return 'shape';
+    if (!a.body || !str(a.body.en)) return 'shape';
+  }
+  if (!uniq(rr, 'id') || !uniq(mr, 'id') || !uniq(ag, 'name')) return 'shape';
+  return null;
+}
+
+/**
+ * Whether this CLI may apply a bundle. { ok, reason?, kid? } with reason one of
+ * shape, too-large, format, min-cli, no-keys, unsigned, unknown-kid, bad-sig.
+ * No keys is checked before the signature: it is the more basic answer.
+ */
+export function evaluateBundle(b, { version = cliVersion(), keys = PRESET_SIGNING_KEYS } = {}) {
+  const shape = bundleShapeError(b);
+  if (shape) return { ok: false, reason: shape };
+  if (!Array.isArray(keys) || keys.length === 0) return { ok: false, reason: 'no-keys' };
+  if (b.min_cli && compareVersions(b.min_cli, version) > 0) return { ok: false, reason: 'min-cli' };
+  const sig = verifyBundleSignature(b, keys);
+  return sig.ok ? { ok: true, kid: sig.kid } : { ok: false, reason: sig.reason };
+}
+
+export function readRemoteCache(dir = userDataDir()) {
+  try {
+    const c = JSON.parse(readFileSync(remoteCachePath(dir), 'utf8'));
+    return c && typeof c === 'object' && !Array.isArray(c) ? c : {};
+  } catch {
+    return {};
+  }
+}
+
+// One evaluation per cache-file revision: the session-start path reads the
+// presets several times (seed offer, preset file, agents, route-scan).
+let memo = null;
+export function resetPresetSourceMemo() { memo = null; }
+
+function activeRemote({ env = process.env, dir = userDataDir(), keys = PRESET_SIGNING_KEYS, version = cliVersion() } = {}) {
+  if (presetSyncDisabled(env)) return { bundle: null, reason: 'disabled', cache: {} };
+  const file = remoteCachePath(dir);
+  let sig;
+  try { const s = statSync(file); sig = `${file}|${s.mtimeMs}|${s.size}|${keys.length}|${version}`; } catch { return { bundle: null, reason: 'no-cache', cache: {} }; }
+  if (memo && memo.sig === sig && memo.keys === keys) return memo.value;
+  const cache = readRemoteCache(dir);
+  let value;
+  if (!cache.bundle) value = { bundle: null, reason: 'no-cache', cache };
+  else {
+    const ev = evaluateBundle(cache.bundle, { version, keys });
+    value = ev.ok ? { bundle: cache.bundle, kid: ev.kid, cache } : { bundle: null, reason: ev.reason, cache };
+  }
+  memo = { sig, keys, value };
+  return value;
+}
+
+/** { kind: 'remote'|'bundled', version, fetchedAt, kid?, reason? } */
+export function presetSource(opts = {}) {
+  const r = activeRemote(opts);
+  if (r.bundle) return { kind: 'remote', version: r.bundle.version, fetchedAt: r.cache.fetchedAt || null, kid: r.kid };
+  return { kind: 'bundled', version: null, fetchedAt: r.cache.fetchedAt || null, reason: r.reason };
+}
+
+function readBundled(name) {
+  try { return JSON.parse(readFileSync(join(packageRoot, 'presets', name), 'utf8')); } catch { return null; }
+}
+
+const derivedId = (ko) => `fix-${createHash('sha1').update(ko).digest('hex').slice(0, 6)}`;
+
+function normaliseRatchet(list) {
+  return (Array.isArray(list) ? list : [])
+    .filter((r) => r && typeof r.ko === 'string' && r.ko.trim())
+    .map((r) => ({
+      // Explicit ids are stable across rewording. A rule without one (an older
+      // file) gets the id the Korean text always produced.
+      id: typeof r.id === 'string' && r.id ? r.id : derivedId(r.ko.trim()),
+      ko: r.ko.trim(), en: (r.en || r.ko).trim(),
+      ...(Array.isArray(r.agents) ? { agents: r.agents.filter((a) => typeof a === 'string') } : {}),
+    }));
+}
+
+/** Ratchet presets: [{ id, ko, en, agents? }] */
+export function ratchetPresetEntries(opts = {}) {
+  const r = activeRemote(opts);
+  if (r.bundle) return normaliseRatchet(r.bundle.ratchet_rules);
+  return normaliseRatchet(readBundled('ratchet-rules.json')?.rules);
+}
+
+/** Model-routing presets, the objects of presets/model-rules.json `presets`. */
+export function modelPresets(opts = {}) {
+  const r = activeRemote(opts);
+  if (r.bundle) return r.bundle.model_rules.map((p) => ({ ...p }));
+  const data = readBundled('model-rules.json');
+  return Array.isArray(data?.presets) ? data.presets : [];
+}
+
+/** Delegation agents: [{ name, model, effort, tools[], description{ko,en}, body{ko,en} }] */
+export function agentDefinitions(opts = {}) {
+  const r = activeRemote(opts);
+  if (r.bundle) return r.bundle.agents.map((a) => ({ ...a }));
+  const data = readBundled('agents.json');
+  return Array.isArray(data?.agents) ? data.agents : [];
+}
+
+/** The bundle the bundled files make: the shape the server seeds as version 1. */
+export function bundledBundle({ version = 1, minCli = null } = {}) {
+  return {
+    format: PRESET_BUNDLE_FORMAT,
+    version,
+    min_cli: minCli,
+    ratchet_rules: normaliseRatchet(readBundled('ratchet-rules.json')?.rules),
+    model_rules: readBundled('model-rules.json')?.presets || [],
+    agents: readBundled('agents.json')?.agents || [],
+  };
+}

package/src/prompt.js

@@ -9,6 +9,7 @@
  * decide-it-for-them behavior untouched.
  */
 
+import { envVar } from './env.js';
 import { createInterface } from 'node:readline';
 
 /**
@@ -19,7 +20,7 @@ import { createInterface } from 'node:readline';
  * checked because build agents deadlock rather than answer.
  */
 export function canPrompt({ env = process.env, stdin = process.stdin, stdout = process.stdout } = {}) {
-  if (env.CTS_NO_INPUT === '1') return false;
+  if (envVar('NO_INPUT', env) === '1') return false;
   if (env.CI && env.CI !== 'false') return false;
   if (env.npm_lifecycle_event === 'postinstall') return false;
   return Boolean(stdin.isTTY && stdout.isTTY);

package/src/route-scan.js

@@ -30,6 +30,7 @@ import { sessionCost } from './claude-price.js';
 import { learnProfileMapping, resetModelAliasCache } from './model-alias.js';
 import { modelRuleBaseText } from './model-rules.js';
 import { readResetMarks, isBeforeReset } from './saved-reset.cjs';
+import { modelPresets as sourceModelPresets } from './presets-source.js';
 
 // ── Tier bands (docs/TIER_CRITERIA.md §3) ────────────────────────────────
 // T2 (haiku): finished in few calls, tiny output, near-zero mutation, no
@@ -162,6 +163,18 @@ const CATEGORIES = [
     kw: [[/\bgit |\bcommit(?:s|ted)?\b|\bpush(?:ed|es)?\b|\bnpm |\bpip3? |빌드해|빌드 돌/i, 2], [/실행|돌려|\brun\b|\bbuild\b|빌드|테스트|설치/i, 1]],
   },
 ];
+// The T2 agent a category's candidates name follows the published model presets
+// when one covers that category (presets-source.js), so renaming an agent in the
+// /ops console renames it in new candidates too. Categories without a preset
+// (translate) keep the name above.
+function t2AgentFor(cat) {
+  try {
+    const p = sourceModelPresets().find((x) => x.tier === 'T2' && x.category === cat.id);
+    if (p && typeof p.agent === 'string' && p.agent) return p.agent;
+  } catch { /* the built-in name below */ }
+  return cat.agent;
+}
+
 // English keywords are matched as whole words. As bare substrings, `pip`
 // claimed "pipeline", `commit` "commitment", `find` "findings" and `status`
 // "statusline", which filed questions about those under run, explore or check.
@@ -635,7 +648,7 @@ export async function runRouteScan({ days = 14 } = {}) {
       category: cat.id,
       label: cat.label,
       labelEn: cat.labelEn,
-      agent: tier === 'T2' ? cat.agent : tier === 'T1H' ? 'opus' : 'sonnet',
+      agent: tier === 'T2' ? t2AgentFor(cat) : tier === 'T1H' ? 'opus' : 'sonnet',
       project: projectDir,
       projectPath: '',
       count: 0,