@mnemom/mnemom 0.17.33 → 0.17.34-next.2

package/dist/vendor/shared/durable-contract/secret-scope.js

@@ -0,0 +1,76 @@
+// GENERATED from shared/durable-contract/src/secret-scope.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * The secret scope (BACKBONE line 69; C04-P01; wave-0 fix ruling 2), frozen as data so every lane
+ * greps the same list: which secrets, in which encodings, may appear on which surfaces. None may
+ * appear on any surface, with one allowance: the executor key in EXECUTOR_STATE_FILE (mode 0600).
+ * The owner's own files in `excluded_paths` are outside the scan. Paths are HOME-relative.
+ */
+import { EXECUTOR_STATE_FILE } from "./paths.js";
+export const SECRET_KINDS = [
+    "owner_jwt",
+    "owner_refresh_token",
+    /** The owner's mnm_ API key (canaries). */
+    "owner_api_key",
+    /** Every mnm_ds_ lease key. */
+    "lease_key",
+    "executor_key",
+    "enroll_poll_secret",
+];
+export const SECRET_ENCODINGS = [
+    "raw",
+    "base64",
+    "base64url",
+    "hex",
+    "percent",
+    "json_escaped",
+];
+/** Where no secret may appear. */
+export const SECRET_SURFACES = [
+    /** Files written by the daemon, proxy, host install and enroll: state, lock, plist, logs, any ~/.mnemom file. */
+    "host_files",
+    /** env of the daemon, proxy and seat process tree. */
+    "process_env",
+    /** argv of the daemon, proxy and seat process tree. */
+    "process_argv",
+    "tmux_global_env",
+    "tmux_session_env",
+    "tmux_scrollback",
+    "tmpdir_files",
+    "seat_transcripts",
+    "durable_spans",
+    "durable_logs",
+];
+export const SECRET_SCOPE = Object.freeze({
+    secrets: SECRET_KINDS,
+    encodings: SECRET_ENCODINGS,
+    surfaces: SECRET_SURFACES,
+    allow: Object.freeze([
+        Object.freeze({ secret: "executor_key", path: EXECUTOR_STATE_FILE }),
+    ]),
+    excluded_paths: Object.freeze([".mnemom/auth.json", ".mnemom/launcher.toml"]),
+});
+const toHex = (b) => [...b].map((x) => x.toString(16).padStart(2, "0")).join("");
+function toBase64(b) {
+    let bin = "";
+    for (const x of b)
+        bin += String.fromCharCode(x);
+    return btoa(bin);
+}
+/**
+ * Every encoded form of one secret value the scan greps for, keyed by encoding (UTF-8 bytes;
+ * base64 and base64url without padding variants, so a padded copy still matches as a substring).
+ */
+export function secretEncodings(value) {
+    if (value.length === 0)
+        throw new RangeError("an empty secret matches everything");
+    const bytes = new TextEncoder().encode(value);
+    const b64 = toBase64(bytes).replace(/=+$/, "");
+    return {
+        raw: value,
+        base64: b64,
+        base64url: b64.replace(/\+/g, "-").replace(/\//g, "_"),
+        hex: toHex(bytes),
+        percent: encodeURIComponent(value),
+        json_escaped: JSON.stringify(value).slice(1, -1),
+    };
+}

package/dist/vendor/shared/durable-contract/session-id.d.ts

@@ -0,0 +1,21 @@
+/**
+ * deriveSessionId: the conversation-scoped arm of gateway/src/index.ts deriveSessionId, ported for
+ * agent_sessions.aip_session_id (stored once at create, C01-R23; returned verbatim by the resolver,
+ * C06-R26): `${agentHash}-c<first 32 hex of sha256(agentHash|cid)>`.
+ *
+ * Caller bytes are hashed, never used raw: session ids are interpolated into PostgREST filters.
+ * The durable arm is always conversation-scoped, so a blank conversation id (which would fall back
+ * to the gateway's hour bucket) is refused here instead of silently bucketing.
+ * conversation_id is trimmed exactly as the gateway trims the header (String.prototype.trim).
+ */
+export declare const SESSION_ID_HASH_HEX_CHARS = 32;
+export declare function deriveSessionId(agentHash: string, conversationId: string): Promise<string>;
+/**
+ * Golden vectors, computed independently with node:crypto (see __tests__/session-id.test.ts) and
+ * pinned here. Keyed on (agents.agent_hash at create, conversation_id).
+ */
+export declare const SESSION_ID_VECTORS: readonly {
+    agent_hash: string;
+    conversation_id: string;
+    aip_session_id: string;
+}[];

package/dist/vendor/shared/durable-contract/session-id.js

@@ -0,0 +1,58 @@
+// GENERATED from shared/durable-contract/src/session-id.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * deriveSessionId: the conversation-scoped arm of gateway/src/index.ts deriveSessionId, ported for
+ * agent_sessions.aip_session_id (stored once at create, C01-R23; returned verbatim by the resolver,
+ * C06-R26): `${agentHash}-c<first 32 hex of sha256(agentHash|cid)>`.
+ *
+ * Caller bytes are hashed, never used raw: session ids are interpolated into PostgREST filters.
+ * The durable arm is always conversation-scoped, so a blank conversation id (which would fall back
+ * to the gateway's hour bucket) is refused here instead of silently bucketing.
+ * conversation_id is trimmed exactly as the gateway trims the header (String.prototype.trim).
+ */
+import { sha256Hex } from "./canonical.js";
+export const SESSION_ID_HASH_HEX_CHARS = 32;
+export async function deriveSessionId(agentHash, conversationId) {
+    if (typeof agentHash !== "string" || agentHash.length === 0)
+        throw new RangeError("agentHash is required");
+    const cid = typeof conversationId === "string" ? conversationId.trim() : "";
+    if (cid.length === 0)
+        throw new RangeError("conversation id is blank: the durable arm never hour-buckets");
+    const digest = await sha256Hex(`${agentHash}|${cid}`);
+    return `${agentHash}-c${digest.slice(0, SESSION_ID_HASH_HEX_CHARS)}`;
+}
+/**
+ * Golden vectors, computed independently with node:crypto (see __tests__/session-id.test.ts) and
+ * pinned here. Keyed on (agents.agent_hash at create, conversation_id).
+ */
+export const SESSION_ID_VECTORS = [
+    {
+        agent_hash: "smolt-0a1b2c3d",
+        conversation_id: "6f1c9a2e-3b4d-4e5f-8a9b-0c1d2e3f4a5b",
+        aip_session_id: "smolt-0a1b2c3d-c491fc4d06c067b7baa0083400cdcb97d",
+    },
+    {
+        agent_hash: "smolt-0a1b2c3d",
+        conversation_id: "6f1c9a2e-3b4d-4e5f-8a9b-0c1d2e3f4a5c",
+        aip_session_id: "smolt-0a1b2c3d-cb2b4ab1e1da376e82b4059635d4f74d6",
+    },
+    {
+        agent_hash: "smolt-ffffffff",
+        conversation_id: "00000000-0000-4000-8000-000000000000",
+        aip_session_id: "smolt-ffffffff-c645a4fdd38c8d94d2fbcace132e5aa3d",
+    },
+    {
+        agent_hash: "smolt-12345678",
+        conversation_id: "  6f1c9a2e-3b4d-4e5f-8a9b-0c1d2e3f4a5b\n",
+        aip_session_id: "smolt-12345678-c9e54f7096bc5b7d8f4b7c02ee5d8cc7e",
+    },
+    {
+        agent_hash: "smolt-12345678",
+        conversation_id: "\u00a0conv-\u00e9-\u2713\ufeff",
+        aip_session_id: "smolt-12345678-c5401c9673d20a9788cb8750950cb5d2d",
+    },
+    {
+        agent_hash: "smolt-deadbeef",
+        conversation_id: "a|b",
+        aip_session_id: "smolt-deadbeef-ccec66b82e597a4ac96a596b3c67e0696",
+    },
+];

package/dist/vendor/shared/durable-contract/spec.d.ts

@@ -0,0 +1,162 @@
+/**
+ * The closed launch-spec schema, the canonical spec hash, the seat argv allowlist and the C4
+ * builder input table (C14-R01..R05, R13; C02-R26; BACKBONE C4, amendments 31, 43; final F01, F09).
+ *
+ * Frozen choices (C14-R01 asks S1 before the oracle):
+ *  - argv level compared: the claude-level execve argv;
+ *  - token order: canonical multiset of (flag, value) pairs (canonicalArgvPairs); exact bytes only
+ *    for verified spec vs actual execve;
+ *  - `--name` is NOT allowlisted (dropped and named);
+ *  - the yolo-default bypass flag counts as dropped and is named (C14-R12).
+ */
+import { PLUGIN_HASH_RECIPE_VERSION } from "./constants.js";
+export declare const SPEC_VERSION = 1;
+export declare const PLUGIN_TOKEN = "bundled-mnemom";
+export declare const EFFORT_VALUES: readonly ["low", "medium", "high", "xhigh", "max"];
+export declare const MODEL_RE: RegExp;
+/** The committed, goal-elided launch spec. No remote-control field, no path or hash for the plugin. */
+export interface LaunchSpec {
+    v: 1;
+    /** The registered worktree root (realpath equal to `git rev-parse --show-toplevel`). */
+    cwd: string;
+    plugin: typeof PLUGIN_TOKEN;
+    trim_mcp: boolean;
+    model?: string;
+    effort?: (typeof EFFORT_VALUES)[number];
+}
+export declare const LAUNCH_SPEC_KEYS: readonly ["v", "cwd", "plugin", "trim_mcp", "model", "effort"];
+/** Validate against the closed schema (additionalProperties false). Returns the spec or null. */
+export declare function parseLaunchSpec(raw: unknown): LaunchSpec | null;
+/** Whether a raw spec (or lock body) carries a remote-control field or flag: checked BEFORE schema validation (422 remote_control). */
+export declare function hasRemoteControl(raw: unknown): boolean;
+/** The canonical spec hash: sha256 hex of canonicalJson(spec) over the full spec (F09 re-lock compare). */
+export declare function specHash(spec: LaunchSpec): Promise<string>;
+/** User flags a seat may carry (from the spec), each with its value arity. */
+export declare const SEAT_USER_FLAGS: {
+    readonly "--model": 1;
+    readonly "--effort": 1;
+    readonly "--trim-mcp": 0;
+};
+/** Flags only the daemon adds. */
+export declare const SEAT_DAEMON_FLAGS: readonly ["--plugin-dir", "--mcp-config", "--strict-mcp-config", "--settings", "--setting-sources", "--resume"];
+/** Canonical multiset form of an argv (after argv[0]): sorted "flag\u0000value" pairs, `--f=v` split. */
+export declare function canonicalArgvPairs(argv: readonly string[]): string[];
+/** The one entry every dropped positional of a passthrough adds together; positional text is never echoed. */
+export declare const DROPPED_POSITIONALS_ENTRY: (n: number) => string;
+/**
+ * The 'flags dropped:' list for a claude passthrough (ruling 15; C14-R02, R03, R12), classified left
+ * to right the way claude would. Before claude's own `--`, a '-'-leading token other than '-' is a
+ * flag: an allowlisted one is kept (an arity-1 flag with its value, inline or the next non-flag
+ * token; with no such value it is dropped and named and does not consume the next token), any other
+ * is dropped and named verbatim (single-dash multi-letter tokens whole, `--f=v` as `--f`). Every
+ * other token, and every token after claude's `--`, is a positional. Names come first-seen,
+ * deduplicated, then one DROPPED_POSITIONALS_ENTRY when any positional was dropped. The `--`
+ * separator itself is never named. renderAdoptNote and renderNonTtyLocked take the result unchanged.
+ */
+export declare function droppedArgvNames(passthrough: readonly string[], allow?: Readonly<Record<string, number>>): string[];
+/** The C4 builder input table (final F01): which argv the one builder reads, per path. */
+export declare const BUILDER_INPUT_TABLE: {
+    readonly running: {
+        readonly when: "a live tracked claude for the conversation on this machine (C02-R26 step-2 discovery)";
+        readonly argv: "the original's argv, read exactly (KERN_PROCARGS2 or the shim log, never ps)";
+        readonly paths: readonly ["sessions adopt", "lock verb", "/mnemom lock"];
+        readonly shape: "as launched (a dropped --remote-control is named)";
+        readonly steps: readonly [1, 2, 3, 4, 5, 6, 7];
+    };
+    readonly idle: {
+        readonly when: "no live claude for the conversation";
+        readonly argv: "the launcher's resolved continue argv at lock time (launcher config, agent defaults, --resume <cc_session_id>), with the registered cwd";
+        readonly paths: readonly ["lock verb", "API lock-route validation", "durable=always continue (C02-R23(e))"];
+        readonly shape: "terminal (resolveRemoteControlShape never called)";
+        readonly steps: readonly [1, 3, 4, 6];
+    };
+};
+export type BuilderSource = keyof typeof BUILDER_INPUT_TABLE;
+/** Which source a path uses given whether a live tracked claude exists. Adopt requires one. */
+export declare function builderSourceFor(path: "adopt" | "lock_verb" | "slash_lock" | "api_lock" | "always_continue", liveClaude: boolean): BuilderSource | null;
+/** Plugin integrity (S1 dir-hash recipe, version 1): sha256 of canonicalJson of the sorted [relpath, sha256] list. */
+export declare function pluginDirHash(files: readonly {
+    path: string;
+    sha256: string;
+}[]): Promise<string>;
+/** The plugin dir inside the published @mnemom/mnemom package. */
+export declare const PLUGIN_DIR = "plugins/mnemom";
+/** The pack-time manifest, beside PLUGIN_DIR (never inside it, so it never hashes itself). */
+export declare const PLUGIN_MANIFEST_PATH = "plugins/integrity-manifest.json";
+/**
+ * The manifest's closed shape (JSON Schema). Two rules a JSON Schema cannot say, enforced by
+ * pluginManifestOk: files is sorted by path in UTF-16 code-unit order (pluginDirHash's comparison)
+ * with no repeated path, and dir_hash = pluginDirHash(files) (checked by verifyPluginManifest).
+ */
+export declare const PLUGIN_MANIFEST_SCHEMA: Readonly<{
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["recipe_version", "plugin_dir", "files", "dir_hash"];
+    readonly properties: {
+        readonly recipe_version: {
+            readonly const: 1;
+        };
+        readonly plugin_dir: {
+            readonly const: "plugins/mnemom";
+        };
+        readonly files: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["path", "sha256"];
+                readonly properties: {
+                    readonly path: {
+                        readonly type: "string";
+                        readonly pattern: "^(?!.*(?:^|/)\\.{1,2}(?:/|$))[^/\\\\\\u0000]+(?:/[^/\\\\\\u0000]+)*$";
+                    };
+                    readonly sha256: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-f]{64}$";
+                    };
+                };
+            };
+        };
+        readonly dir_hash: {
+            readonly type: "string";
+            readonly pattern: "^[0-9a-f]{64}$";
+        };
+    };
+}>;
+export interface PluginManifest {
+    readonly recipe_version: typeof PLUGIN_HASH_RECIPE_VERSION;
+    readonly plugin_dir: typeof PLUGIN_DIR;
+    readonly files: readonly {
+        readonly path: string;
+        readonly sha256: string;
+    }[];
+    readonly dir_hash: string;
+}
+/** One entry of the installed plugin dir as the verifier walks it (directories are not entries). */
+export interface PluginDirEntry {
+    /** POSIX, relative to PLUGIN_DIR. */
+    readonly path: string;
+    /** Lowercase hex sha256 of the bytes; null for a non-regular entry. */
+    readonly sha256: string | null;
+    /** false for a symlink or any other non-regular file. */
+    readonly regular: boolean;
+}
+/** Failure causes, in the order verifyPluginManifest checks them (first match wins). */
+export declare const PLUGIN_MANIFEST_FAILURES: readonly ["missing", "unparseable", "recipe", "dir_hash", "not_regular", "added", "removed", "edited"];
+export type PluginManifestFailure = (typeof PLUGIN_MANIFEST_FAILURES)[number];
+/** True for exactly PLUGIN_MANIFEST_SCHEMA plus sorted, unique paths (dir_hash is not recomputed). */
+export declare function pluginManifestOk(v: unknown): v is PluginManifest;
+/**
+ * Verify the installed plugin dir against its shipped manifest (the daemon's pre-claim check; the
+ * C12/C14 harness and oracle use the same function). `manifestText` is PLUGIN_MANIFEST_PATH's
+ * content (null when the file is absent); `actual` lists every non-directory entry under
+ * PLUGIN_DIR. One cause per failure, first match in PLUGIN_MANIFEST_FAILURES order (ruling
+ * 25.1). A numeric recipe_version other than the frozen one is `recipe`, before the shape check, so
+ * a newer recipe is named as such; a missing or wrong-typed one is `unparseable`.
+ */
+export declare function verifyPluginManifest(manifestText: string | null, actual: readonly PluginDirEntry[]): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    cause: PluginManifestFailure;
+}>;

package/dist/vendor/shared/durable-contract/spec.js

@@ -0,0 +1,286 @@
+// GENERATED from shared/durable-contract/src/spec.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * The closed launch-spec schema, the canonical spec hash, the seat argv allowlist and the C4
+ * builder input table (C14-R01..R05, R13; C02-R26; BACKBONE C4, amendments 31, 43; final F01, F09).
+ *
+ * Frozen choices (C14-R01 asks S1 before the oracle):
+ *  - argv level compared: the claude-level execve argv;
+ *  - token order: canonical multiset of (flag, value) pairs (canonicalArgvPairs); exact bytes only
+ *    for verified spec vs actual execve;
+ *  - `--name` is NOT allowlisted (dropped and named);
+ *  - the yolo-default bypass flag counts as dropped and is named (C14-R12).
+ */
+import { canonicalJson, HEX64_RE, sha256Hex } from "./canonical.js";
+import { PLUGIN_HASH_RECIPE_VERSION } from "./constants.js";
+export const SPEC_VERSION = 1;
+export const PLUGIN_TOKEN = "bundled-mnemom";
+export const EFFORT_VALUES = ["low", "medium", "high", "xhigh", "max"];
+export const MODEL_RE = /^[A-Za-z0-9._[\]-]{1,64}$/;
+export const LAUNCH_SPEC_KEYS = ["v", "cwd", "plugin", "trim_mcp", "model", "effort"];
+const REQUIRED_SPEC_KEYS = ["v", "cwd", "plugin", "trim_mcp"];
+/** Validate against the closed schema (additionalProperties false). Returns the spec or null. */
+export function parseLaunchSpec(raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const r = raw;
+    if (Object.keys(r).some((k) => !LAUNCH_SPEC_KEYS.includes(k)))
+        return null;
+    if (!REQUIRED_SPEC_KEYS.every((k) => k in r))
+        return null;
+    if (r.v !== SPEC_VERSION || r.plugin !== PLUGIN_TOKEN || typeof r.trim_mcp !== "boolean")
+        return null;
+    if (typeof r.cwd !== "string" ||
+        !r.cwd.startsWith("/") ||
+        r.cwd.includes("\n") ||
+        r.cwd.length > 4096)
+        return null;
+    if ("model" in r && (typeof r.model !== "string" || !MODEL_RE.test(r.model)))
+        return null;
+    if ("effort" in r && !EFFORT_VALUES.includes(r.effort))
+        return null;
+    return r;
+}
+/** Whether a raw spec (or lock body) carries a remote-control field or flag: checked BEFORE schema validation (422 remote_control). */
+export function hasRemoteControl(raw) {
+    if (raw === null || typeof raw !== "object")
+        return false;
+    const text = JSON.stringify(raw).toLowerCase();
+    return (text.includes("remote_control") ||
+        text.includes("remote-control") ||
+        text.includes("remotecontrol"));
+}
+/** The canonical spec hash: sha256 hex of canonicalJson(spec) over the full spec (F09 re-lock compare). */
+export async function specHash(spec) {
+    return sha256Hex(canonicalJson(spec));
+}
+/** User flags a seat may carry (from the spec), each with its value arity. */
+export const SEAT_USER_FLAGS = { "--model": 1, "--effort": 1, "--trim-mcp": 0 };
+/** Flags only the daemon adds. */
+export const SEAT_DAEMON_FLAGS = [
+    "--plugin-dir",
+    "--mcp-config",
+    "--strict-mcp-config",
+    "--settings",
+    "--setting-sources",
+    "--resume",
+];
+/** One argv token as both parsers read it: a '-'-leading token is a flag; `--f=v` carries its value inline. */
+function readArgvToken(tok) {
+    if (!tok.startsWith("-"))
+        return { flag: null };
+    const eq = tok.startsWith("--") ? tok.indexOf("=") : -1;
+    return eq > 0 ? { flag: tok.slice(0, eq), inline: tok.slice(eq + 1) } : { flag: tok };
+}
+/** Canonical multiset form of an argv (after argv[0]): sorted "flag\u0000value" pairs, `--f=v` split. */
+export function canonicalArgvPairs(argv) {
+    const out = [];
+    for (let i = 0; i < argv.length; i++) {
+        const tok = argv[i];
+        const { flag, inline } = readArgvToken(tok);
+        if (flag !== null && inline !== undefined) {
+            out.push(`${flag}\u0000${inline}`);
+            continue;
+        }
+        const next = argv[i + 1];
+        if (flag !== null && next !== undefined && readArgvToken(next).flag === null) {
+            out.push(`${tok}\u0000${next}`);
+            i++;
+        }
+        else {
+            out.push(`${tok}\u0000`);
+        }
+    }
+    return out.sort();
+}
+/** The one entry every dropped positional of a passthrough adds together; positional text is never echoed. */
+export const DROPPED_POSITIONALS_ENTRY = (n) => `positional arguments (${n})`;
+/**
+ * The 'flags dropped:' list for a claude passthrough (ruling 15; C14-R02, R03, R12), classified left
+ * to right the way claude would. Before claude's own `--`, a '-'-leading token other than '-' is a
+ * flag: an allowlisted one is kept (an arity-1 flag with its value, inline or the next non-flag
+ * token; with no such value it is dropped and named and does not consume the next token), any other
+ * is dropped and named verbatim (single-dash multi-letter tokens whole, `--f=v` as `--f`). Every
+ * other token, and every token after claude's `--`, is a positional. Names come first-seen,
+ * deduplicated, then one DROPPED_POSITIONALS_ENTRY when any positional was dropped. The `--`
+ * separator itself is never named. renderAdoptNote and renderNonTtyLocked take the result unchanged.
+ */
+export function droppedArgvNames(passthrough, allow = SEAT_USER_FLAGS) {
+    const names = [];
+    let positionals = 0;
+    const name = (f) => {
+        if (!names.includes(f))
+            names.push(f);
+    };
+    for (let i = 0; i < passthrough.length; i++) {
+        const tok = passthrough[i];
+        if (tok === "--") {
+            positionals += passthrough.length - i - 1;
+            break;
+        }
+        const { flag, inline } = tok === "-" ? { flag: null } : readArgvToken(tok);
+        if (flag === null) {
+            positionals++;
+            continue;
+        }
+        const arity = Object.prototype.hasOwnProperty.call(allow, flag) ? allow[flag] : undefined;
+        if (arity === undefined) {
+            name(flag);
+            continue;
+        }
+        if (arity === 0 || inline !== undefined)
+            continue;
+        const next = passthrough[i + 1];
+        if (next !== undefined && readArgvToken(next).flag === null)
+            i++;
+        else
+            name(flag);
+    }
+    if (positionals > 0)
+        names.push(DROPPED_POSITIONALS_ENTRY(positionals));
+    return names;
+}
+/** The C4 builder input table (final F01): which argv the one builder reads, per path. */
+export const BUILDER_INPUT_TABLE = {
+    running: {
+        when: "a live tracked claude for the conversation on this machine (C02-R26 step-2 discovery)",
+        argv: "the original's argv, read exactly (KERN_PROCARGS2 or the shim log, never ps)",
+        paths: ["sessions adopt", "lock verb", "/mnemom lock"],
+        shape: "as launched (a dropped --remote-control is named)",
+        steps: [1, 2, 3, 4, 5, 6, 7],
+    },
+    idle: {
+        when: "no live claude for the conversation",
+        argv: "the launcher's resolved continue argv at lock time (launcher config, agent defaults, --resume <cc_session_id>), with the registered cwd",
+        paths: ["lock verb", "API lock-route validation", "durable=always continue (C02-R23(e))"],
+        shape: "terminal (resolveRemoteControlShape never called)",
+        steps: [1, 3, 4, 6],
+    },
+};
+/** Which source a path uses given whether a live tracked claude exists. Adopt requires one. */
+export function builderSourceFor(path, liveClaude) {
+    if (path === "api_lock" || path === "always_continue")
+        return "idle";
+    if (path === "adopt" || path === "slash_lock")
+        return liveClaude ? "running" : null;
+    return liveClaude ? "running" : "idle";
+}
+/** Plugin integrity (S1 dir-hash recipe, version 1): sha256 of canonicalJson of the sorted [relpath, sha256] list. */
+export async function pluginDirHash(files) {
+    const rows = files
+        .map((f) => [f.path, f.sha256])
+        .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+    return sha256Hex(canonicalJson(rows));
+}
+// ---- plugin integrity manifest (wave-0 fix ruling 25; RULINGS-evals U13; C12-R36, C14-R26..R28) --
+/** The plugin dir inside the published @mnemom/mnemom package. */
+export const PLUGIN_DIR = "plugins/mnemom";
+/** The pack-time manifest, beside PLUGIN_DIR (never inside it, so it never hashes itself). */
+export const PLUGIN_MANIFEST_PATH = "plugins/integrity-manifest.json";
+/** A manifest path: POSIX, relative to PLUGIN_DIR, no empty, "." or ".." segment, no backslash. */
+const MANIFEST_FILE_PATH_PATTERN = "^(?!.*(?:^|/)\\.{1,2}(?:/|$))[^/\\\\\\u0000]+(?:/[^/\\\\\\u0000]+)*$";
+const MANIFEST_FILE_PATH_RE = new RegExp(MANIFEST_FILE_PATH_PATTERN);
+/**
+ * The manifest's closed shape (JSON Schema). Two rules a JSON Schema cannot say, enforced by
+ * pluginManifestOk: files is sorted by path in UTF-16 code-unit order (pluginDirHash's comparison)
+ * with no repeated path, and dir_hash = pluginDirHash(files) (checked by verifyPluginManifest).
+ */
+export const PLUGIN_MANIFEST_SCHEMA = Object.freeze({
+    type: "object",
+    additionalProperties: false,
+    required: ["recipe_version", "plugin_dir", "files", "dir_hash"],
+    properties: {
+        recipe_version: { const: PLUGIN_HASH_RECIPE_VERSION },
+        plugin_dir: { const: PLUGIN_DIR },
+        files: {
+            type: "array",
+            items: {
+                type: "object",
+                additionalProperties: false,
+                required: ["path", "sha256"],
+                properties: {
+                    path: { type: "string", pattern: MANIFEST_FILE_PATH_PATTERN },
+                    sha256: { type: "string", pattern: "^[0-9a-f]{64}$" },
+                },
+            },
+        },
+        dir_hash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+    },
+});
+/** Failure causes, in the order verifyPluginManifest checks them (first match wins). */
+export const PLUGIN_MANIFEST_FAILURES = [
+    "missing",
+    "unparseable",
+    "recipe",
+    "dir_hash",
+    "not_regular",
+    "added",
+    "removed",
+    "edited",
+];
+const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+/** True for exactly PLUGIN_MANIFEST_SCHEMA plus sorted, unique paths (dir_hash is not recomputed). */
+export function pluginManifestOk(v) {
+    if (!isPlainObject(v))
+        return false;
+    const keys = PLUGIN_MANIFEST_SCHEMA.required;
+    if (Object.keys(v).length !== keys.length || keys.some((k) => !(k in v)))
+        return false;
+    if (v.recipe_version !== PLUGIN_HASH_RECIPE_VERSION || v.plugin_dir !== PLUGIN_DIR)
+        return false;
+    if (typeof v.dir_hash !== "string" || !HEX64_RE.test(v.dir_hash))
+        return false;
+    if (!Array.isArray(v.files))
+        return false;
+    let prev = null;
+    for (const f of v.files) {
+        if (!isPlainObject(f) || Object.keys(f).length !== 2)
+            return false;
+        if (typeof f.path !== "string" || !MANIFEST_FILE_PATH_RE.test(f.path))
+            return false;
+        if (typeof f.sha256 !== "string" || !HEX64_RE.test(f.sha256))
+            return false;
+        if (prev !== null && !(prev < f.path))
+            return false;
+        prev = f.path;
+    }
+    return true;
+}
+/**
+ * Verify the installed plugin dir against its shipped manifest (the daemon's pre-claim check; the
+ * C12/C14 harness and oracle use the same function). `manifestText` is PLUGIN_MANIFEST_PATH's
+ * content (null when the file is absent); `actual` lists every non-directory entry under
+ * PLUGIN_DIR. One cause per failure, first match in PLUGIN_MANIFEST_FAILURES order (ruling
+ * 25.1). A numeric recipe_version other than the frozen one is `recipe`, before the shape check, so
+ * a newer recipe is named as such; a missing or wrong-typed one is `unparseable`.
+ */
+export async function verifyPluginManifest(manifestText, actual) {
+    const fail = (cause) => ({ ok: false, cause });
+    if (manifestText === null)
+        return fail("missing");
+    let parsed;
+    try {
+        parsed = JSON.parse(manifestText);
+    }
+    catch {
+        return fail("unparseable");
+    }
+    if (isPlainObject(parsed) &&
+        typeof parsed.recipe_version === "number" &&
+        parsed.recipe_version !== PLUGIN_HASH_RECIPE_VERSION)
+        return fail("recipe");
+    if (!pluginManifestOk(parsed))
+        return fail("unparseable");
+    if ((await pluginDirHash(parsed.files)) !== parsed.dir_hash)
+        return fail("dir_hash");
+    if (actual.some((e) => !e.regular))
+        return fail("not_regular");
+    const listed = new Map(parsed.files.map((f) => [f.path, f.sha256]));
+    const present = new Map(actual.map((e) => [e.path, e.sha256]));
+    if ([...present.keys()].some((p) => !listed.has(p)))
+        return fail("added");
+    if ([...listed.keys()].some((p) => !present.has(p)))
+        return fail("removed");
+    if ([...listed].some(([p, h]) => present.get(p) !== h))
+        return fail("edited");
+    return { ok: true };
+}