@kontextmind/kxm 0.7.40 → 0.7.44

package/plugins/kxm/src/{vnext-permission.ts → permission.ts}

@@ -4,26 +4,26 @@ import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { dirname, join, resolve, sep } from "node:path";
 import {
-  VnextConfigError,
-  loadVnextProject,
+  KxmConfigError,
+  loadKxmProject,
   parseRestrictedYaml,
-  vnextCanonicalJson,
-  vnextPortablePath,
-  vnextResourceIdentifier,
+  kxmCanonicalJson,
+  kxmPortablePath,
+  kxmResourceIdentifier,
   type JsonObject,
   type JsonValue,
-  type VnextConfigIssue,
-  type VnextConfigOptions,
-  type VnextProjectBundle,
-  type VnextResource,
-  type VnextResourceKind,
-} from "./vnext-config.ts";
+  type KxmConfigIssue,
+  type KxmConfigOptions,
+  type KxmProjectBundle,
+  type KxmResource,
+  type KxmResourceKind,
+} from "./project-config.ts";
 
 /* ------------------------------------------------------------------ *
  * Structured authority projections
  * ------------------------------------------------------------------ */
 
-export type VnextPermissionField =
+export type KxmPermissionField =
   | "repository-access"
   | "tools"
   | "secrets"
@@ -41,17 +41,17 @@ export type VnextPermissionField =
   | "gate"
   | "delivery";
 
-export type VnextPermissionDirection = "expansion" | "narrowing" | "neutral";
+export type KxmPermissionDirection = "expansion" | "narrowing" | "neutral";
 
-export interface VnextAuthorityEntry {
+export interface KxmAuthorityEntry {
   /** Resource-relative pointer, e.g. /repositories/api or /steps/3/tools/preset. */
   path: string;
-  field: VnextPermissionField;
+  field: KxmPermissionField;
   /** Canonical JSON of the comparable value (never secret material). */
   value: string;
 }
 
-const PROSE_FIELDS: Readonly<Record<VnextResourceKind, ReadonlySet<string>>> = {
+const PROSE_FIELDS: Readonly<Record<KxmResourceKind, ReadonlySet<string>>> = {
   project: new Set(["name", "description"]),
   repository: new Set(["description"]),
   agent: new Set(["purpose", "instructions"]),
@@ -66,7 +66,7 @@ const NETWORK_RANK: Readonly<Record<string, number>> = { none: 0, "provider-only
 const UNTRACKED_RANK: Readonly<Record<string, number>> = { "tracked-only": 0, ask: 1, bounded: 2 };
 
 function canonical(value: JsonValue | undefined): string {
-  return vnextCanonicalJson(value === undefined ? null : value);
+  return kxmCanonicalJson(value === undefined ? null : value);
 }
 
 function asObject(value: JsonValue | undefined): JsonObject | undefined {
@@ -101,9 +101,9 @@ function secretGrantKeys(grants: JsonValue[]): Map<number, string> {
 }
 
 /** Extract the authority-bearing fields of one resource as comparable entries. */
-export function vnextAuthorityEntries(resource: { kind: VnextResourceKind; id?: string; value: JsonObject }): VnextAuthorityEntry[] {
-  const entries: VnextAuthorityEntry[] = [];
-  const push = (path: string, field: VnextPermissionField, value: JsonValue | undefined): void => {
+export function kxmAuthorityEntries(resource: { kind: KxmResourceKind; id?: string; value: JsonObject }): KxmAuthorityEntry[] {
+  const entries: KxmAuthorityEntry[] = [];
+  const push = (path: string, field: KxmPermissionField, value: JsonValue | undefined): void => {
     entries.push({ path, field, value: canonical(value) });
   };
   const value = resource.value;
@@ -252,7 +252,7 @@ export function vnextAuthorityEntries(resource: { kind: VnextResourceKind; id?:
 }
 
 /** Prose/non-authority fields, surfaced separately so reviewers see them as neutral. */
-export function vnextProseEntries(resource: { kind: VnextResourceKind; value: JsonObject }): Map<string, string> {
+export function kxmProseEntries(resource: { kind: KxmResourceKind; value: JsonObject }): Map<string, string> {
   const entries = new Map<string, string>();
   for (const field of PROSE_FIELDS[resource.kind]) {
     if (resource.value[field] !== undefined) entries.set(`/${field}`, canonical(resource.value[field]));
@@ -273,24 +273,24 @@ export function vnextProseEntries(resource: { kind: VnextResourceKind; value: Js
  * Diff
  * ------------------------------------------------------------------ */
 
-export interface VnextPermissionChange {
+export interface KxmPermissionChange {
   resource: string;
   path: string;
-  field: VnextPermissionField;
-  direction: VnextPermissionDirection;
+  field: KxmPermissionField;
+  direction: KxmPermissionDirection;
   summary: string;
   baseValueSha256?: string;
   candidateValueSha256?: string;
 }
 
-export interface VnextPermissionDiff {
+export interface KxmPermissionDiff {
   schema: "kxm.permission-diff.v1";
   baseRevision: string;
   candidateRevision: string;
-  changes: VnextPermissionChange[];
-  expansions: VnextPermissionChange[];
-  narrowings: VnextPermissionChange[];
-  neutralChanges: VnextPermissionChange[];
+  changes: KxmPermissionChange[];
+  expansions: KxmPermissionChange[];
+  narrowings: KxmPermissionChange[];
+  neutralChanges: KxmPermissionChange[];
   requiresReview: boolean;
 }
 
@@ -298,7 +298,7 @@ function valueHash(canonicalValue: string): string {
   return `sha256:${createHash("sha256").update(canonicalValue, "utf8").digest("hex")}`;
 }
 
-function rankDirection(rank: Readonly<Record<string, number>>, baseValue: string, candidateValue: string): VnextPermissionDirection {
+function rankDirection(rank: Readonly<Record<string, number>>, baseValue: string, candidateValue: string): KxmPermissionDirection {
   const base = JSON.parse(baseValue) as unknown;
   const candidate = JSON.parse(candidateValue) as unknown;
   const baseRank = typeof base === "string" && base in rank ? rank[base] as number : undefined;
@@ -310,7 +310,7 @@ function rankDirection(rank: Readonly<Record<string, number>>, baseValue: string
 }
 
 /** Direction for a numeric bound: raising limits is expansion. */
-function numericBoundDirection(baseValue: string, candidateValue: string): VnextPermissionDirection {
+function numericBoundDirection(baseValue: string, candidateValue: string): KxmPermissionDirection {
   const base = JSON.parse(baseValue) as unknown;
   const candidate = JSON.parse(candidateValue) as unknown;
   if (typeof base !== "number" || typeof candidate !== "number") return "expansion";
@@ -319,7 +319,7 @@ function numericBoundDirection(baseValue: string, candidateValue: string): Vnext
   return "neutral";
 }
 
-function budgetDirection(baseValue: string, candidateValue: string): VnextPermissionDirection {
+function budgetDirection(baseValue: string, candidateValue: string): KxmPermissionDirection {
   const base = asObject(JSON.parse(baseValue) as JsonValue);
   const candidate = asObject(JSON.parse(candidateValue) as JsonValue);
   if (!base || !candidate) return "expansion";
@@ -335,7 +335,7 @@ function budgetDirection(baseValue: string, candidateValue: string): VnextPermis
   return sawNarrowing ? "narrowing" : "neutral";
 }
 
-function quorumDirection(baseValue: string, candidateValue: string): VnextPermissionDirection {
+function quorumDirection(baseValue: string, candidateValue: string): KxmPermissionDirection {
   const base = asObject(JSON.parse(baseValue) as JsonValue);
   const candidate = asObject(JSON.parse(candidateValue) as JsonValue);
   if (!base || !candidate) return "expansion";
@@ -376,7 +376,7 @@ function quorumDirection(baseValue: string, candidateValue: string): VnextPermis
   };
   // Residual fail-closed check runs BEFORE any narrowing return: unknown or
   // future fields always expand, even alongside an ordered narrowing.
-  if (vnextCanonicalJson(residualOf(baseValue)) !== vnextCanonicalJson(residualOf(candidateValue))) return "expansion";
+  if (kxmCanonicalJson(residualOf(baseValue)) !== kxmCanonicalJson(residualOf(candidateValue))) return "expansion";
   const basePolicy = asObject(base.producerPolicy as JsonValue | undefined);
   const candidatePolicy = asObject(candidate.producerPolicy as JsonValue | undefined);
   if (!basePolicy && !candidatePolicy) return sawNarrowing ? "narrowing" : "neutral";
@@ -404,7 +404,7 @@ function quorumDirection(baseValue: string, candidateValue: string): VnextPermis
   return sawNarrowing ? "narrowing" : "neutral";
 }
 
-function snapshotDirection(baseValue: string, candidateValue: string): VnextPermissionDirection {
+function snapshotDirection(baseValue: string, candidateValue: string): KxmPermissionDirection {
   const base = asObject(JSON.parse(baseValue) as JsonValue);
   const candidate = asObject(JSON.parse(candidateValue) as JsonValue);
   if (!base || !candidate) return "expansion";
@@ -426,16 +426,16 @@ function snapshotDirection(baseValue: string, candidateValue: string): VnextPerm
   // Residual fail-closed check: unknown future snapshot keys expand.
   const CLASSIFIED_SNAPSHOT = new Set(["untracked", "maxUntrackedFileBytes", "maxUntrackedTotalBytes", "dirtySubmodules"]);
   const residualOf = (snapshot: JsonObject): JsonValue => Object.fromEntries(Object.entries(snapshot).filter(([key]) => !CLASSIFIED_SNAPSHOT.has(key)));
-  if (vnextCanonicalJson(residualOf(baseSnapshot)) !== vnextCanonicalJson(residualOf(candidateSnapshot))) return "expansion";
+  if (kxmCanonicalJson(residualOf(baseSnapshot)) !== kxmCanonicalJson(residualOf(candidateSnapshot))) return "expansion";
   return bounds === "narrowing" || untracked === "narrowing" ? "narrowing" : "neutral";
 }
 
 function classifyChange(
-  field: VnextPermissionField,
+  field: KxmPermissionField,
   baseValue: string | undefined,
   candidateValue: string | undefined,
   context?: { fallbackRank?: number; baseFallbackRank?: number },
-): VnextPermissionDirection {
+): KxmPermissionDirection {
   if (baseValue === candidateValue) return "neutral";
   if (baseValue === undefined || candidateValue === undefined) {
     if (candidateValue === undefined) {
@@ -489,7 +489,7 @@ function classifyChange(
         // review-required expansion; then order by required (default true).
         const { required: _b, ...baseRest } = base;
         const { required: _c, ...candidateRest } = candidate;
-        if (vnextCanonicalJson(baseRest as JsonValue) !== vnextCanonicalJson(candidateRest as JsonValue)) return "expansion";
+        if (kxmCanonicalJson(baseRest as JsonValue) !== kxmCanonicalJson(candidateRest as JsonValue)) return "expansion";
         const baseRequired = (base.required ?? true) === true;
         const candidateRequired = (candidate.required ?? true) === true;
         if (baseRequired && !candidateRequired) return "narrowing";
@@ -506,14 +506,14 @@ function classifyChange(
   }
 }
 
-function summarize(resource: string, path: string, field: VnextPermissionField, direction: VnextPermissionDirection, baseValue: string | undefined, candidateValue: string | undefined): string {
+function summarize(resource: string, path: string, field: KxmPermissionField, direction: KxmPermissionDirection, baseValue: string | undefined, candidateValue: string | undefined): string {
   const verb = baseValue === undefined ? "added" : candidateValue === undefined ? "removed" : "changed";
   return `${resource} ${path} ${field} ${verb} (${direction})`;
 }
 
 /** Diff two complete bundles into a deterministic, classified permission report. */
-export function computeVnextPermissionDiff(base: VnextProjectBundle, candidate: VnextProjectBundle): VnextPermissionDiff {
-  const changes: VnextPermissionChange[] = [];
+export function computeKxmPermissionDiff(base: KxmProjectBundle, candidate: KxmProjectBundle): KxmPermissionDiff {
+  const changes: KxmPermissionChange[] = [];
   const baseByPath = new Map(base.resources.map((resource) => [resource.logicalPath, resource]));
   const candidateByPath = new Map(candidate.resources.map((resource) => [resource.logicalPath, resource]));
 
@@ -528,8 +528,8 @@ export function computeVnextPermissionDiff(base: VnextProjectBundle, candidate:
     // Resource added or removed: shape change. Added resources expand
     // authority; removed resources narrow it — except models: removing one
     // can retarget tag-based consumers onto another profile (an expansion).
-    const resource = candidateResource ?? baseResource as VnextResource;
-    const direction: VnextPermissionDirection = candidateResource
+    const resource = candidateResource ?? baseResource as KxmResource;
+    const direction: KxmPermissionDirection = candidateResource
       ? "expansion"
       : ((resource.kind === "model" || resource.kind === "gate-registry") ? "expansion" : "narrowing");
     changes.push({
@@ -560,27 +560,27 @@ export function computeVnextPermissionDiff(base: VnextProjectBundle, candidate:
 }
 
 /** Diff two values of one resource kind (e.g. template baseline vs target). */
-export function computeVnextResourcePermissionDiff(
-  kind: VnextResourceKind,
+export function computeKxmResourcePermissionDiff(
+  kind: KxmResourceKind,
   resourcePath: string,
   baseValue: JsonObject,
   candidateValue: JsonObject,
-): VnextPermissionChange[] {
-  const changes: VnextPermissionChange[] = [];
-  const base: VnextResource = { kind, file: resourcePath, logicalPath: resourcePath, value: baseValue };
-  const candidate: VnextResource = { kind, file: resourcePath, logicalPath: resourcePath, value: candidateValue };
+): KxmPermissionChange[] {
+  const changes: KxmPermissionChange[] = [];
+  const base: KxmResource = { kind, file: resourcePath, logicalPath: resourcePath, value: baseValue };
+  const candidate: KxmResource = { kind, file: resourcePath, logicalPath: resourcePath, value: candidateValue };
   diffResource(resourcePath, base, candidate, changes);
   return changes.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
 }
 
-function diffResource(logicalPath: string, base: VnextResource, candidate: VnextResource, changes: VnextPermissionChange[]): void {
-  const baseEntries = new Map(vnextAuthorityEntries(base).map((entry) => [entry.path, entry]));
-  const candidateEntries = new Map(vnextAuthorityEntries(candidate).map((entry) => [entry.path, entry]));
+function diffResource(logicalPath: string, base: KxmResource, candidate: KxmResource, changes: KxmPermissionChange[]): void {
+  const baseEntries = new Map(kxmAuthorityEntries(base).map((entry) => [entry.path, entry]));
+  const candidateEntries = new Map(kxmAuthorityEntries(candidate).map((entry) => [entry.path, entry]));
   const paths = [...new Set([...baseEntries.keys(), ...candidateEntries.keys()])].sort();
   for (const path of paths) {
     const baseEntry = baseEntries.get(path);
     const candidateEntry = candidateEntries.get(path);
-    const field = (candidateEntry ?? baseEntry as VnextAuthorityEntry).field;
+    const field = (candidateEntry ?? baseEntry as KxmAuthorityEntry).field;
     // For per-repository overrides, the effective fallback is the resource-
     // level defaultRepositoryAccess (the loader's ceiling rule). Removal
     // compares against the candidate's default; addition against the base's.
@@ -609,8 +609,8 @@ function diffResource(logicalPath: string, base: VnextResource, candidate: Vnext
     });
   }
   // Prose changes are surfaced as neutral for reviewer visibility.
-  const baseProse = vnextProseEntries(base);
-  const candidateProse = vnextProseEntries(candidate);
+  const baseProse = kxmProseEntries(base);
+  const candidateProse = kxmProseEntries(candidate);
   for (const path of [...new Set([...baseProse.keys(), ...candidateProse.keys()])].sort()) {
     if (baseProse.get(path) === candidateProse.get(path)) continue;
     changes.push({
@@ -642,7 +642,7 @@ function git(root: string, args: string[]): string {
     maxBuffer: 64 * 1024 * 1024,
   });
   if (result.status !== 0 || result.error) {
-    throw new VnextConfigError([{
+    throw new KxmConfigError([{
       phase: "discovery",
       code: "git_base_unavailable",
       file: args[0] ?? "<git>",
@@ -660,7 +660,7 @@ function gitBuffer(root: string, args: string[]): Buffer {
     maxBuffer: 256 * 1024 * 1024,
   });
   if (result.status !== 0 || result.error) {
-    throw new VnextConfigError([{
+    throw new KxmConfigError([{
       phase: "discovery",
       code: "git_base_unavailable",
       file: args[0] ?? "<git>",
@@ -673,7 +673,7 @@ function gitBuffer(root: string, args: string[]): Buffer {
 /** Resolve a revision to its tree SHA once so a moving ref cannot mix bases. */
 function resolveTreeRevision(root: string, revision: string): string {
   if (!/^[A-Za-z0-9._/^~-]+$/.test(revision) || revision.includes("..") || revision.startsWith("-")) {
-    throw new VnextConfigError([{
+    throw new KxmConfigError([{
       phase: "discovery",
       code: "git_revision_invalid",
       file: revision,
@@ -684,7 +684,7 @@ function resolveTreeRevision(root: string, revision: string): string {
 }
 
 /** Load the bundle as of a Git revision by materializing tracked files into a temporary shadow root. */
-export function loadVnextProjectAtRevision(root: string, revision: string, options: VnextConfigOptions = {}): VnextProjectBundle {
+export function loadKxmProjectAtRevision(root: string, revision: string, options: KxmConfigOptions = {}): KxmProjectBundle {
   const tree = resolveTreeRevision(root, revision);
   const listing = gitBuffer(root, ["ls-tree", "-r", "-z", "--name-only", tree]).toString("utf8");
   const paths = listing
@@ -697,7 +697,7 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
     for (const path of paths) {
       const segments = path.split("/");
       if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || /[\\:]/.test(segment))) {
-        throw new VnextConfigError([{
+        throw new KxmConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
           file: path,
@@ -707,7 +707,7 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
       const absolute = join(shadowResolved, ...segments);
       const resolved = resolve(absolute);
       if (!resolved.startsWith(`${shadowResolved}${sep}`)) {
-        throw new VnextConfigError([{
+        throw new KxmConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
           file: path,
@@ -733,16 +733,16 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
     try {
       baseProject = loadBaseProjectDeclarations(baseProjectFile);
     } catch (error) {
-      if (error instanceof VnextConfigError) {
-        throw new VnextConfigError(error.issues.map((entry) => ({ ...entry, message: `base ${revision}: ${entry.message}` })));
+      if (error instanceof KxmConfigError) {
+        throw new KxmConfigError(error.issues.map((entry) => ({ ...entry, message: `base ${revision}: ${entry.message}` })));
       }
       throw error;
     }
     const shadowBindings: Record<string, string> = {};
     for (const member of baseProject) {
       if (member.role !== "member") continue;
-      if (!vnextResourceIdentifier(member.repositoryId)) {
-        throw new VnextConfigError([{
+      if (!kxmResourceIdentifier(member.repositoryId)) {
+        throw new KxmConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
           file: ".kxm/project.yaml",
@@ -750,7 +750,7 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
         }]);
       }
       if (member.pathHint !== undefined && !portableMemberPathHint(member.pathHint)) {
-        throw new VnextConfigError([{
+        throw new KxmConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
           file: ".kxm/project.yaml",
@@ -767,7 +767,7 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
           : undefined;
       if (!memberWorktree || !existsSync(memberWorktree)) {
         if (member.required === false) continue; // optional member absent on this host (loader tolerates it)
-        throw new VnextConfigError([{
+        throw new KxmConfigError([{
           phase: "discovery",
           code: "trust_scope_unsupported",
           file: ".kxm/project.yaml",
@@ -781,7 +781,7 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
         if (gitlink.length > 0) {
           const match = /^160000 commit ([0-9a-f]{40,64})\t/.exec(gitlink);
           if (!match) {
-            throw new VnextConfigError([{
+            throw new KxmConfigError([{
               phase: "discovery",
               code: "trust_scope_unsupported",
               file: ".kxm/project.yaml",
@@ -794,7 +794,7 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
           // the only reviewable base is the member's own HEAD commit.
           pinnedCommit = git(memberWorktree, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]).trim();
         } else {
-          throw new VnextConfigError([{
+          throw new KxmConfigError([{
             phase: "discovery",
             code: "trust_scope_unsupported",
             file: ".kxm/project.yaml",
@@ -807,7 +807,7 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
         pinnedCommit = git(memberWorktree, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]).trim();
       }
       if (!pinnedCommit) {
-        throw new VnextConfigError([{
+        throw new KxmConfigError([{
           phase: "discovery",
           code: "trust_scope_unsupported",
           file: ".kxm/project.yaml",
@@ -819,7 +819,7 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
       const memberPaths = memberListing.split("\u0000").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
       const memberShadowRoot = join(shadowResolved, shadowMembersDir, member.repositoryId);
       if (!resolve(memberShadowRoot).startsWith(`${resolve(shadowResolved, shadowMembersDir)}${sep}`)) {
-        throw new VnextConfigError([{
+        throw new KxmConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
           file: ".kxm/project.yaml",
@@ -829,12 +829,12 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
       for (const path of memberPaths) {
         const segments = path.split("/");
         if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || /[\\:]/.test(segment))) {
-          throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path, message: "member Git tree entry contains a traversal or non-portable segment" }]);
+          throw new KxmConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path, message: "member Git tree entry contains a traversal or non-portable segment" }]);
         }
         const absolute = join(memberShadowRoot, ...segments);
         const resolved = resolve(absolute);
         if (!resolved.startsWith(`${resolve(memberShadowRoot)}${sep}`)) {
-          throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path, message: "member Git tree entry escapes the shadow root" }]);
+          throw new KxmConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path, message: "member Git tree entry escapes the shadow root" }]);
         }
         const content = gitBuffer(memberWorktree, ["cat-file", "blob", `${memberTree}:${path}`]);
         mkdirSync(dirname(absolute), { recursive: true });
@@ -844,10 +844,10 @@ export function loadVnextProjectAtRevision(root: string, revision: string, optio
       shadowBindings[member.repositoryId] = memberShadowRoot;
     }
     try {
-      return loadVnextProject(shadowResolved, { ...options, repositoryBindings: shadowBindings });
+      return loadKxmProject(shadowResolved, { ...options, repositoryBindings: shadowBindings });
     } catch (error) {
-      if (error instanceof VnextConfigError) {
-        throw new VnextConfigError(error.issues.map((entry) => ({ ...entry, message: `base ${revision}: ${entry.message}` })));
+      if (error instanceof KxmConfigError) {
+        throw new KxmConfigError(error.issues.map((entry) => ({ ...entry, message: `base ${revision}: ${entry.message}` })));
       }
       throw error;
     }
@@ -865,7 +865,7 @@ interface BaseProjectMember {
 
 /** Portable member pathHint predicate (mirrors the loader's portable path rules; "." is never a member). */
 function portableMemberPathHint(pathHint: string): boolean {
-  return pathHint !== "." && vnextPortablePath(pathHint);
+  return pathHint !== "." && kxmPortablePath(pathHint);
 }
 
 
@@ -898,7 +898,7 @@ function initShadowGitRoot(directory: string): void {
     windowsHide: true,
   });
   if (result.status !== 0 || result.error) {
-    throw new VnextConfigError([{
+    throw new KxmConfigError([{
       phase: "discovery",
       code: "git_base_unavailable",
       file: directory,
@@ -908,18 +908,18 @@ function initShadowGitRoot(directory: string): void {
 }
 
 /** Diff the working tree against a Git revision. */
-export function diffVnextProjectAgainstRevision(
+export function diffKxmProjectAgainstRevision(
   root: string,
   revision: string,
-  options: VnextConfigOptions = {},
-): VnextPermissionDiff {
-  const base = loadVnextProjectAtRevision(root, revision, options);
-  const candidate = loadVnextProject(root, options);
-  return computeVnextPermissionDiff(base, candidate);
+  options: KxmConfigOptions = {},
+): KxmPermissionDiff {
+  const base = loadKxmProjectAtRevision(root, revision, options);
+  const candidate = loadKxmProject(root, options);
+  return computeKxmPermissionDiff(base, candidate);
 }
 
 /** Human-readable report lines for the CLI. */
-export function formatVnextPermissionDiff(diff: VnextPermissionDiff): string {
+export function formatKxmPermissionDiff(diff: KxmPermissionDiff): string {
   const lines: string[] = [];
   lines.push(`permission diff: ${diff.baseRevision.slice(0, 19)}… -> ${diff.candidateRevision.slice(0, 19)}…`);
   if (diff.changes.length === 0) {

package/plugins/kxm/src/{vnext-pi-producer.ts → pi-producer.ts}

@@ -3,16 +3,16 @@ import { join } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import {
   registerTrustedProducer,
-  type VnextProducer,
-  type VnextProducerRequest,
-  type VnextProducerResult,
-} from "./vnext-engine.ts";
+  type KxmProducer,
+  type KxmProducerRequest,
+  type KxmProducerResult,
+} from "./engine.ts";
 import {
   probeHarnessAssignmentAsync,
   type HarnessAssignmentProbeOptions,
   type HarnessInventory,
   type HarnessStatus,
-} from "./vnext-harness.ts";
+} from "./harness.ts";
 import {
   calculateModelCost,
   loadPriceCatalogForEstimate,
@@ -380,7 +380,7 @@ export class PiSession {
   }
 }
 
-export interface VnextPiProducerOptions {
+export interface KxmPiProducerOptions {
   projectRoot?: string | undefined;
   sessionDir?: string | undefined;
   piCommand?: string | undefined;
@@ -394,15 +394,15 @@ export interface VnextPiProducerOptions {
   defaultProvider?: string | undefined;
 }
 
-export interface VnextPiProducer extends VnextProducer {
+export interface KxmPiProducer extends KxmProducer {
   readonly id: "pi";
   readonly sessions: ReadonlyMap<string, PiSession>;
-  produce(request: VnextProducerRequest): Promise<VnextProducerResult>;
+  produce(request: KxmProducerRequest): Promise<KxmProducerResult>;
   close(): Promise<void>;
   closeRun(runId: string): Promise<void>;
 }
 
-export function createVnextPiProducer(options: VnextPiProducerOptions = {}): VnextPiProducer {
+export function createKxmPiProducer(options: KxmPiProducerOptions = {}): KxmPiProducer {
   const sessions = new Map<string, PiSession>();
   const defaultModel = options.defaultModel ?? "xai/grok-4.6";
   const defaultProvider = options.defaultProvider ?? "xai";
@@ -416,7 +416,7 @@ export function createVnextPiProducer(options: VnextPiProducerOptions = {}): Vne
     return { provider: defaultProvider, model: trimmed };
   }
 
-  function resolveModelForRequest(request: VnextProducerRequest): { provider: string; model: string; thinking?: string | undefined } {
+  function resolveModelForRequest(request: KxmProducerRequest): { provider: string; model: string; thinking?: string | undefined } {
     if (request.model) {
       const parsed = parseModelString(request.model);
       return {
@@ -466,7 +466,7 @@ export function createVnextPiProducer(options: VnextPiProducerOptions = {}): Vne
     }
   }
 
-  async function getOrCreateSession(request: VnextProducerRequest, model: string): Promise<PiSession> {
+  async function getOrCreateSession(request: KxmProducerRequest, model: string): Promise<PiSession> {
     const key = formatPiSessionKey({
       runId: request.runId,
       agentId: request.agentId,
@@ -532,13 +532,13 @@ export function createVnextPiProducer(options: VnextPiProducerOptions = {}): Vne
     return session;
   }
 
-  const producer: VnextPiProducer = {
+  const producer: KxmPiProducer = {
     id: "pi",
     get sessions(): ReadonlyMap<string, PiSession> {
       return sessions;
     },
 
-    async produce(request: VnextProducerRequest): Promise<VnextProducerResult> {
+    async produce(request: KxmProducerRequest): Promise<KxmProducerResult> {
       const startTime = Date.now();
       const resolved = resolveModelForRequest(request);