@neuralis/brain-core 0.3.2 → 0.4.0

package/skills/create-package/scripts/{check-package.sh → check-package.mjs}

@@ -1,59 +1,74 @@
-#!/usr/bin/env bash
-#
-# create-package/check-package.sh — static pre-flight for a package directory.
-#
-# It catches only what fails SILENTLY — a frontmatter key nobody parses, a
-# `files[]` whitelist that ships an empty tarball, a `$schema` that loads and
-# then breaks every call, an unreachable widget, a UI entry whose stylesheet
-# never loads, compiled output one directory from where the loader looks. What
-# the loader itself reports BY NAME at install (id charset, reserved ids,
-# uriPolicies, workflow templates, most manifest validation) is NOT repeated
-# here — install and read the load status.
-#
-# ONE class here is authoring-only by construction: what a package UI entry may
-# reference. The kernel validator receives the manifest OBJECT — no package root,
-# no filesystem — so it can never inspect a file's CONTENT, and the platform
-# blocks nothing at runtime. The rules INVERT with the surface's declared
-# `assetMode`: a SELF-CONTAINED entry (the default) must inline everything, since
-# its subresource request leaves an opaque origin with no session cookie and is
-# not served; a "bundle" entry has its siblings served, and must keep every
-# reference inside the two roots that lane serves. This script is where both are
-# enforced, before either becomes a blank surface.
-#
-# Findings here are AUTHORING findings. They never set a package's load status —
-# that belongs to the contribution validator, and a new ERROR there would
-# retroactively flip already-installed packages to `error`.
-#
-# MODE comes from disk. `package.json`#neuralis or `neuralis.package.json` =
-# manifest mode. NO manifest = markdown mode (the source-package / bare-skill
-# layout): it checks package recognition, the markdown categories and their
-# frontmatter, SKIPS every manifest-dependent check and PRINTS the skip — so
-# nothing here ever reads as verified when it was not.
-#
-# CANNOT CHECK  anything needing a running platform (did it load, does a handler
-#   work, does a feature id exist). Nor your trust tier — trust is assigned by
-#   where the package came FROM, never declared in a manifest, so nothing here
-#   reads `access.trust` as a grant. Load proof, after install:
-#     bash "${SKILL_DIR}/scripts/verify-loaded.sh" <package-id>
-#
-# USAGE  bash check-package.sh <package-root>
-# EXIT   0 = no errors (warnings may print) · 1 = ERRORs · 2 = usage / no node
-# https://docs.neuralisapp.com/package-system/directory-contract
-# https://docs.neuralisapp.com/package-system/source-packages
+//
+// create-package/check-package.mjs — static pre-flight for a package directory.
+//
+// It catches only what fails SILENTLY — a frontmatter key nobody parses, a
+// `files[]` whitelist that ships an empty tarball, a `$schema` that loads and
+// then breaks every call, an unreachable widget, a UI entry whose stylesheet
+// never loads, compiled output one directory from where the loader looks. What
+// the loader itself reports BY NAME at install (id charset, reserved ids,
+// uriPolicies, workflow templates, most manifest validation) is NOT repeated
+// here — install and read the load status.
+//
+// ONE class here is authoring-only by construction: what a package UI entry may
+// reference. The kernel validator receives the manifest OBJECT — no package root,
+// no filesystem — so it can never inspect a file's CONTENT, and the platform
+// blocks nothing at runtime. The rules INVERT with the surface's declared
+// `assetMode`: a SELF-CONTAINED entry (the default) must inline everything, since
+// its subresource request leaves an opaque origin with no session cookie and is
+// not served; a "bundle" entry has its siblings served, and must keep every
+// reference inside the two roots that lane serves. This script is where both are
+// enforced, before either becomes a blank surface.
+//
+// Findings here are AUTHORING findings. They never set a package's load status —
+// that belongs to the contribution validator, and a new ERROR there would
+// retroactively flip already-installed packages to `error`.
+//
+// MODE comes from disk. `package.json`#neuralis or `neuralis.package.json` =
+// manifest mode. NO manifest = markdown mode (the source-package / bare-skill
+// layout): it checks package recognition, the markdown categories and their
+// frontmatter, SKIPS every manifest-dependent check and PRINTS the skip — so
+// nothing here ever reads as verified when it was not.
+//
+// CANNOT CHECK  anything needing a running platform (did it load, does a handler
+//   work, does a feature id exist). Nor your trust tier — trust is assigned by
+//   where the package came FROM, never declared in a manifest, so nothing here
+//   reads `access.trust` as a grant. Load proof, after install:
+//     node "${SKILL_DIR}/scripts/verify-loaded.mjs" <package-id>
+//
+// USAGE  node check-package.mjs <package-root>
+// EXIT   0 = no errors (warnings may print) · 1 = ERRORs · 2 = usage
+// https://docs.neuralisapp.com/package-system/directory-contract
+// https://docs.neuralisapp.com/package-system/source-packages
 
-set -euo pipefail
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
-  sed -n '2,35p' "$0" | sed 's/^#\{0,1\} \{0,1\}//'; exit 0
-fi
-[ "$#" -eq 1 ] || { echo "usage: bash check-package.sh <package-root>" >&2; exit 2; }
-[ -d "$1" ] || { echo "ERROR  $1 is not a directory — pass the package ROOT folder" >&2; exit 2; }
-command -v node >/dev/null 2>&1 || { echo "ERROR  node not on PATH (this parses JSON with node, not jq)" >&2; exit 2; }
-
-node - "$1" "$(dirname "$0")" <<'NODE_CHECK'
-'use strict';
-const fs = require('fs'), path = require('path');
-const ROOT = process.argv[2], SCRIPT_DIR = process.argv[3], F = [];
+// `require.resolve(spec, { paths: [from] })` walks node_modules up from each
+// root, exactly as the CommonJS loader does — the platform modules below are
+// found from the package, the cwd or this script's own install.
+const require = createRequire(import.meta.url);
+const SELF = fileURLToPath(import.meta.url);
+const SCRIPT_DIR = path.dirname(SELF);
+const argv = process.argv.slice(2);
+if (argv[0] === '-h' || argv[0] === '--help') {
+  const head = fs.readFileSync(SELF, 'utf8').split('\n');
+  const end = head.findIndex((l) => !l.startsWith('//'));
+  process.stdout.write(`${head.slice(1, end).map((l) => l.replace(/^\/\/ ?/, '')).join('\n')}\n`);
+  process.exit(0);
+}
+if (argv.length !== 1) {
+  process.stderr.write('usage: node check-package.mjs <package-root>\n');
+  process.exit(2);
+}
+let isDirectory = false;
+try { isDirectory = fs.statSync(argv[0]).isDirectory(); } catch { isDirectory = false; }
+if (!isDirectory) {
+  process.stderr.write(`ERROR  ${argv[0]} is not a directory — pass the package ROOT folder\n`);
+  process.exit(2);
+}
+const ROOT = argv[0], F = [];
 const rel = (p) => path.relative(ROOT, p) || '.';
 const err = (f, m) => F.push({ lvl: 'ERROR', f, m });
 const warn = (f, m) => F.push({ lvl: 'WARN', f, m });
@@ -63,7 +78,7 @@ const json = (p) => JSON.parse(fs.readFileSync(p, 'utf8'));
 const at = (...p) => path.join(ROOT, ...p);
 
 const SKIP = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', 'scripts', 'references', 'assets']);
-const DOTS = new Set(['.claude', '.agents', '.cursor', '.codex', '.gemini', '.windsurf', '.github', '.opencode', '.kilo', '.roo']);
+const DOTS = new Set(['.claude', '.agents', '.cursor', '.codex', '.gemini', '.windsurf', '.devin', '.github', '.opencode', '.kilo', '.roo']);
 const CATS = ['skills', 'instructions', 'rules', 'agents', 'docs', 'commands'];
 
 function walk(d, out = [], depth = 0) {
@@ -214,7 +229,7 @@ if (man) {
 
   // tools — the silent traps only.
   const D7 = 'http://json-schema.org/draft-07/schema#';
-  const IDENT = /^(user|project|agent|conversation|request|toolUse)Id$|^(role|priority|grantedFeatures|spendLimits|dailyLimits|llmRateLimitRpm|agentAccess|agentOwnership|session)$/;
+  const IDENT = /^(user|project|agent|conversation|request|toolUse|delegateRun)Id$|^(delegateMode|role|priority|rolePriorities|grantedFeatures|spendLimits|dailyLimits|llmRateLimitRpm|agentAccess|agentOwnership|displayName|session)$/;
   const toolCardTypes = [];
   for (const n of dir(at('tools')) ? fs.readdirSync(at('tools')).filter((x) => x.endsWith('.json')) : []) {
     const f = `tools/${n}`;
@@ -276,7 +291,7 @@ if (man) {
   }
 
   // --- cards + the surface asset contract ------------------------------------
-  // TWO renderers exist: `direct` (first-party compiled React, registered by the
+  // TWO renderers exist: `direct` (native compiled React, registered by the
   // package's OWN host entrypoint) and `iframe` (every sandboxed path). An
   // asset-backed iframe entry lives under its own canonical
   // `app/surfaces/{kind}/{surfaceId}/` root — widget `{surfaceId}` is its `type`,
@@ -477,14 +492,14 @@ if (man) {
       return;
     }
     if (renderer === 'direct') {
-      warn(MF, `${L} renderer "direct" renders only under an ASSIGNED first-party tier — a dropped package must use "iframe"`);
+      warn(MF, `${L} renderer "direct" renders only under an ASSIGNED native tier — a dropped package must use "iframe"`);
       return;
     }
     if (renderer !== 'iframe') return;
     const url = typeof render.url === 'string' ? render.url.trim() : '';
     if (!url) { err(MF, `${L} renderer "iframe" with no "url" — nothing to load`); return; }
     if (isAbsUrl(url)) {
-      warn(MF, `${L} absolute iframe url "${url}" loads only under an ASSIGNED trusted/first-party tier — the tier comes from where the package was installed FROM, never from access.trust; an untrusted package's absolute surface is dropped from the snapshot fail-closed`);
+      warn(MF, `${L} absolute iframe url "${url}" loads only under an ASSIGNED trusted/native tier — the tier comes from where the package was installed FROM, never from access.trust; an untrusted package's absolute surface is dropped from the snapshot fail-closed`);
       if (declaredMode === 'bundle') {
         warn(MF, `${label}: "assetMode":"bundle" is IGNORED on an absolute url — the platform serves bundle subresources only for an entry under the surface's own asset root.`);
       }
@@ -661,8 +676,8 @@ if (man) {
   if (rt.skillScripts !== undefined && rt.skillScripts !== 'none') need.push(`runtime.skillScripts "${rt.skillScripts}" (validation fails below trusted — declare "none" or omit)`);
   if (pm.exec === true || pm.net === 'full' || pm.fs === 'full') need.push('runtime.permissions exec / net:"full" / fs:"full" (rejected outright when untrusted)');
   if (need.length) warn(MF, `${need.join(' · ')} — ${TIER}`);
-  if (rt.type === 'node') warn(MF, `runtime.type "node" runs IN-PROCESS and needs an ASSIGNED first-party tier — elsewhere it loads PARTIAL ("untrusted-node") and every handler errors. Use "wasm"`);
-  if (rt.type === 'mcp') warn(MF, `runtime.type "mcp" spawns a subprocess as the HOST USER and needs an ASSIGNED first-party tier — elsewhere it loads PARTIAL ("untrusted-mcp"), nothing spawns and every handler errors. "wasm" is the only code runtime below first-party. Use "wasm"`);
+  if (rt.type === 'node') warn(MF, `runtime.type "node" runs IN-PROCESS and needs an ASSIGNED native tier — elsewhere it loads PARTIAL ("untrusted-node") and every handler errors. Use "wasm"`);
+  if (rt.type === 'mcp') warn(MF, `runtime.type "mcp" spawns a subprocess as the HOST USER and needs an ASSIGNED native tier — elsewhere it loads PARTIAL ("untrusted-mcp"), nothing spawns and every handler errors. "wasm" is the only code runtime below native. Use "wasm"`);
   if (rt.type === 'mcp' && !(rt.entry && rt.entry.command)) warn(MF, 'runtime.type "mcp" without runtime.entry.command — nothing spawns, so it loads PARTIAL ("runtime-unavailable")');
 
   // compiled output — the loader looks ONLY under dist/src/**.
@@ -689,7 +704,6 @@ const e = F.filter((x) => x.lvl === 'ERROR').length;
 const sk = F.filter((x) => x.lvl === 'SKIP').length;
 out.write(`\n${e} error(s), ${F.length - e - sk} warning(s)${sk ? `, ${sk} check(s) SKIPPED` : ''} — ${path.basename(ROOT)}\n`);
 if (e === 0) out.write(MODE === 'manifest'
-  ? 'Static checks pass — that proves NOTHING about loading. Install, then verify-loaded.sh.\n'
-  : 'Static checks pass for what markdown can carry — that proves NOTHING about discovery.\nThe files must be indexed by a sync first, then: verify-loaded.sh "<slug>://<path>?project=<p>&scope=…".\n');
+  ? 'Static checks pass — that proves NOTHING about loading. Install, then verify-loaded.mjs.\n'
+  : 'Static checks pass for what markdown can carry — that proves NOTHING about discovery.\nThe files must be indexed by a sync first, then: verify-loaded.mjs "<slug>://<path>?project=<p>&scope=…".\n');
 process.exit(e > 0 ? 1 : 0);
-NODE_CHECK

package/skills/create-package/scripts/{verify-loaded.sh → verify-loaded.mjs}

@@ -1,84 +1,94 @@
-#!/usr/bin/env bash
-#
-# create-package/verify-loaded.sh — runtime proof that a package actually loaded.
-#
-# "It built clean" is not "it loaded". A package can compile, install, appear on
-# disk, and still register NOTHING — one bad tool schema aborts the whole load,
-# a missing build makes it declarative-only, an untrusted node runtime leaves
-# every handler returning an error. This script asks the platform, and reports
-# only what the platform said.
-#
-# WHAT IT CHECKS
-#   Reads the agent-core package diagnostics and overview surfaces as YOU through
-#   `neuralis request` (the session ticket inside an activated skill, your
-#   `neuralis login` on your own machine), and reports one of:
-#     loaded   — registered and operational
-#     partial  — declarative contributions registered, no code runtime; prints
-#                the reason (build-missing | runtime-unavailable |
-#                untrusted-node | untrusted-mcp)
-#     error    — validation or init crash; prints the recorded message
-#     missing  — installed but never reached the loader (manifest read failed)
-#     absent   — the platform does not list it for you at all; the verdict then
-#                prints every installed AND source package id it DOES list, so
-#                you can find the right one without guessing
-#   On a clean load it also prints the surface the platform registered FOR YOU:
-#   tools, skills, instructions, rules, agents, docs, commands, workflows,
-#   connectors, hooks, policies, app surfaces, team members, active file count.
-#   The `connectors` row counts DECLARATIONS the loader accepted from the
-#   manifest — not live outbound instances. An outbound (mcp/openapi/http)
-#   connector is registered into ONE tenant, and into NO tenant at all when the
-#   package is neither first-party nor owned by a resolvable project, so this
-#   count can be non-zero while the connector exists nowhere.
-#   A source package (markdown discovered in an indexed source) has no loader
-#   status at all — it is reported separately, with its recognition reason.
-#
-# WHAT IT CANNOT CHECK
-#   That a surface WORKS. A loaded package with a broken handler still says
-#   `loaded`. Run the tool, open the widget, call the route — as the LEAST
-#   privileged role that is supposed to have access, because feature-gated
-#   contributions are hidden, so testing as the owner hides every gate bug.
-#   It also cannot see what your identity may not see: these surfaces are
-#   scoped, so `absent` can mean "correctly hidden from you", not "broken".
-#   For a source package `absent` also covers "the files exist on disk but no
-#   sync has indexed them yet" — discovery reads the index, never the live tree.
-#   For the static half run, before you install:
-#     bash "${SKILL_DIR}/scripts/check-package.sh" <package-root>
-#
-# USAGE   bash verify-loaded.sh <package-id> [--raw]
-#           <package-id>  the manifest id, e.g. "@acme/reports" or "reports".
-#                         A drop or source package: its instance URI, quoted.
-#           --raw         dump both untouched JSON responses before the verdict,
-#                         so you can self-diagnose if the shape ever drifts.
-# EXIT    0 = loaded
-#         1 = partial (reason printed)
-#         2 = absent — not listed for this caller
-#         3 = error / missing (recorded message printed)
-#         4 = could not reach the diagnostics surface (no `neuralis` CLI or login, no
-#             network, HTTP failure, or the caller lacks the `core.observe`
-#             feature). NOTHING is claimed about the package in this state.
-#
-# This script never accepts, prints or persists a token.
-#
-# Testing reference: https://docs.neuralisapp.com/package-system/testing
+//
+// create-package/verify-loaded.mjs — runtime proof that a package actually loaded.
+//
+// "It built clean" is not "it loaded". A package can compile, install, appear on
+// disk, and still register NOTHING — one bad tool schema aborts the whole load,
+// a missing build makes it declarative-only, an untrusted node runtime leaves
+// every handler returning an error. This script asks the platform, and reports
+// only what the platform said.
+//
+// WHAT IT CHECKS
+//   Reads the agent-core package diagnostics and overview surfaces as YOU through
+//   `neuralis request` (the session ticket inside an activated skill, your
+//   `neuralis login` on your own machine), and reports one of:
+//     loaded   — registered and operational
+//     partial  — declarative contributions registered, no code runtime; prints
+//                the reason (build-missing | runtime-unavailable |
+//                untrusted-node | untrusted-mcp)
+//     error    — validation or init crash; prints the recorded message
+//     missing  — installed but never reached the loader (manifest read failed)
+//     absent   — the platform does not list it for you at all; the verdict then
+//                prints every installed AND source package id it DOES list, so
+//                you can find the right one without guessing
+//   On a clean load it also prints the surface the platform registered FOR YOU:
+//   tools, skills, instructions, rules, agents, docs, commands, workflows,
+//   connectors, hooks, policies, app surfaces, team members, active file count.
+//   The `connectors` row counts DECLARATIONS the loader accepted from the
+//   manifest — not live outbound instances. An outbound (mcp/openapi/http)
+//   connector is registered into ONE tenant, and into NO tenant at all when the
+//   package is neither native nor owned by a resolvable project, so this
+//   count can be non-zero while the connector exists nowhere.
+//   A source package (markdown discovered in an indexed source) has no loader
+//   status at all — it is reported separately, with its recognition reason.
+//
+// WHAT IT CANNOT CHECK
+//   That a surface WORKS. A loaded package with a broken handler still says
+//   `loaded`. Run the tool, open the widget, call the route — as the LEAST
+//   privileged role that is supposed to have access, because feature-gated
+//   contributions are hidden, so testing as the owner hides every gate bug.
+//   It also cannot see what your identity may not see: these surfaces are
+//   scoped, so `absent` can mean "correctly hidden from you", not "broken".
+//   For a source package `absent` also covers "the files exist on disk but no
+//   sync has indexed them yet" — discovery reads the index, never the live tree.
+//   For the static half run, before you install:
+//     node "${SKILL_DIR}/scripts/check-package.mjs" <package-root>
+//
+// USAGE   node verify-loaded.mjs <package-id> [--raw]
+//           <package-id>  the manifest id, e.g. "@acme/reports" or "reports".
+//                         A drop or source package: its instance URI, quoted.
+//           --raw         dump both untouched JSON responses before the verdict,
+//                         so you can self-diagnose if the shape ever drifts.
+// EXIT    0 = loaded
+//         1 = partial (reason printed)
+//         2 = absent — not listed for this caller
+//         3 = error / missing (recorded message printed)
+//         4 = could not reach the diagnostics surface (no `neuralis` CLI or login, no
+//             network, HTTP failure, or the caller lacks the `core.observe`
+//             feature). NOTHING is claimed about the package in this state.
+//
+// The CLI runs as `node <NEURALIS_CLI_ENTRY> request …` — the entry every
+// Neuralis runner exports — and never through a shell. With the variable
+// absent, Linux and macOS start `neuralis` from PATH; Windows stops by name.
+//
+// This script never accepts, prints or persists a token.
+//
+// Testing reference: https://docs.neuralisapp.com/package-system/testing
 
-set -euo pipefail
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
 
-RAW=0
-PKG_ID=""
-for arg in "$@"; do
-  case "$arg" in
-    --raw) RAW=1 ;;
-    -h|--help) sed -n '2,60p' "$0" | sed 's/^#\{0,1\} \{0,1\}//'; exit 0 ;;
-    -*) echo "unknown flag: $arg" >&2; exit 4 ;;
-    *) if [ -z "$PKG_ID" ]; then PKG_ID="$arg"; else echo "unexpected argument: $arg" >&2; exit 4; fi ;;
-  esac
-done
-
-manual_fallback() {
-  case "$PKG_ID" in
-    *://*)
-      cat >&2 <<'SRCFALLBACK'
+const SELF = fileURLToPath(import.meta.url);
+let RAW = false;
+let pkgId = '';
+for (const arg of process.argv.slice(2)) {
+  if (arg === '--raw') RAW = true;
+  else if (arg === '-h' || arg === '--help') {
+    const head = readFileSync(SELF, 'utf8').split('\n');
+    const end = head.findIndex((l) => !l.startsWith('//'));
+    process.stdout.write(`${head.slice(1, end).map((l) => l.replace(/^\/\/ ?/, '')).join('\n')}\n`);
+    process.exit(0);
+  } else if (arg.startsWith('-')) {
+    process.stderr.write(`unknown flag: ${arg}\n`);
+    process.exit(4);
+  } else if (!pkgId) pkgId = arg;
+  else {
+    process.stderr.write(`unexpected argument: ${arg}\n`);
+    process.exit(4);
+  }
+}
 
+const SOURCE_FALLBACK = `
 Cannot verify programmatically. Do NOT record this package as working.
 
 A SOURCE package never passes through the loader, so there is NO load line
@@ -99,12 +109,8 @@ Verify a source package this way instead:
      SKILL.md, a marker dot-dir, or a usable manifest), and inside skills/
      only a file named SKILL.md counts.
 
-SRCFALLBACK
-      return
-      ;;
-  esac
-  cat >&2 <<FALLBACK
-
+`;
+const LOG_FALLBACK = `
 Cannot verify programmatically. Do NOT record this package as working.
 Fall back to the server log — the loader writes one line per package:
 
@@ -121,85 +127,76 @@ Fall back to the server log — the loader writes one line per package:
 Search the platform logs for your package id and read which of those five
 lines names it. No line at all means the loader never saw it: the install
 did not land, or the manifest could not be read.
-FALLBACK
-}
-
-if [ -z "$PKG_ID" ]; then
-  echo "usage: bash verify-loaded.sh <package-id> [--raw]" >&2
-  exit 4
-fi
-if ! command -v neuralis >/dev/null 2>&1; then
-  echo "ERROR  neuralis (the CLI) not found on PATH" >&2
-  manual_fallback
-  exit 4
-fi
-if ! command -v node >/dev/null 2>&1; then
-  echo "ERROR  node not found on PATH — this script parses JSON with node, not jq" >&2
-  manual_fallback
-  exit 4
-fi
-BASE_ROUTE="@neuralis/agent-core/packages"
-
-WORK="$(mktemp -d)"
-trap 'rm -rf "$WORK"' EXIT
+`;
+const manualFallback = () => process.stderr.write(pkgId.includes('://') ? SOURCE_FALLBACK : LOG_FALLBACK);
+const fail = (message) => {
+  process.stderr.write(`${message}\n`);
+  manualFallback();
+  process.exit(4);
+};
 
-# `neuralis request` prints a 2xx body on stdout (exit 0); a non-2xx body goes to
-# stderr with an `HTTP <code>` line (exit 1). No such line = no answer
-# at all (no CLI login, no network) — "000". Its error text stays in request.err.
-fetch() { # fetch <route> <outfile> -> echoes the HTTP status ("000" = no response)
-  local rc=0 code
-  neuralis request GET "$1" >"$2" 2>"$WORK/request.err" || rc=$?
-  if [ "$rc" -eq 0 ]; then echo 200; return; fi
-  code="$(sed -n '/^HTTP [0-9][0-9][0-9]$/{s/^HTTP //p;q;}' "$WORK/request.err")"
-  if [ -n "$code" ]; then awk '!d && /^HTTP [0-9][0-9][0-9]$/ {d=1; next} {print}' "$WORK/request.err" > "$2"; else code="000"; fi
-  echo "$code"
+if (!pkgId) {
+  process.stderr.write('usage: node verify-loaded.mjs <package-id> [--raw]\n');
+  process.exit(4);
 }
+const BASE_ROUTE = '@neuralis/agent-core/packages';
 
-DIAG_CODE="$(fetch "${BASE_ROUTE}/diagnostics" "$WORK/diag.json")"
-
-if [ "$DIAG_CODE" = "403" ]; then
-  echo "FORBIDDEN  the package diagnostics surface requires the 'core.observe' feature, and your identity does not hold it." >&2
-  echo "           This is a capability you are missing, not a broken package — say so instead of retrying." >&2
-  manual_fallback
-  exit 4
-fi
-if [ "$DIAG_CODE" != "200" ]; then
-  echo "ERROR  GET ${BASE_ROUTE}/diagnostics returned HTTP ${DIAG_CODE}" >&2
-  [ -s "$WORK/request.err" ] && sed 's/^/       /' "$WORK/request.err" >&2
-  [ -s "$WORK/diag.json" ] && head -c 600 "$WORK/diag.json" >&2 && echo >&2
-  manual_fallback
-  exit 4
-fi
-
-OVER_CODE="$(fetch "${BASE_ROUTE}/overview" "$WORK/overview.json")"
-[ "$OVER_CODE" = "200" ] || : > "$WORK/overview.json"
+// `neuralis request` prints a 2xx body on stdout (exit 0); a non-2xx body goes to
+// stderr after an `HTTP <code>` line (exit 1). No such line = no answer at all
+// (no CLI login, no network) — "000"; its error text stays in `err`.
+function fetchRoute(route) {
+  const args = ['request', 'GET', route];
+  const opts = { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 256 * 1024 * 1024 };
+  const entry = process.env.NEURALIS_CLI_ENTRY;
+  if (entry === undefined && process.platform === 'win32') {
+    fail('ERROR  set NEURALIS_CLI_ENTRY to the neuralis CLI entry (…/dist/neuralis.mjs) — on Windows this script starts the CLI through node, never a shell');
+  }
+  try {
+    const body = entry !== undefined ? execFileSync(process.execPath, [entry, ...args], opts) : execFileSync('neuralis', args, opts);
+    return { code: '200', body, err: '' };
+  } catch (e) {
+    if (e.code === 'ENOENT') fail('ERROR  neuralis (the CLI) not found on PATH');
+    const err = typeof e.stderr === 'string' ? e.stderr : '';
+    const lines = err.split('\n');
+    const at = lines.findIndex((l) => /^HTTP [0-9]{3}$/.test(l));
+    if (at < 0) return { code: '000', body: '', err };
+    return { code: lines[at].slice(5), body: lines.slice(at + 1).join('\n'), err };
+  }
+}
 
-if [ "$RAW" = "1" ]; then
-  echo "--- diagnostics (HTTP ${DIAG_CODE}) ---"
-  cat "$WORK/diag.json"; echo
-  echo "--- overview (HTTP ${OVER_CODE}) ---"
-  cat "$WORK/overview.json"; echo
-  echo "--- verdict ---"
-fi
+const diagRes = fetchRoute(`${BASE_ROUTE}/diagnostics`);
+if (diagRes.code === '403') {
+  fail("FORBIDDEN  the package diagnostics surface requires the 'core.observe' feature, and your identity does not hold it.\n"
+    + '           This is a capability you are missing, not a broken package — say so instead of retrying.');
+}
+if (diagRes.code !== '200') {
+  let detail = `ERROR  GET ${BASE_ROUTE}/diagnostics returned HTTP ${diagRes.code}`;
+  if (diagRes.err) detail += `\n${diagRes.err.replace(/\n$/, '').split('\n').map((l) => `       ${l}`).join('\n')}`;
+  if (diagRes.body) detail += `\n${diagRes.body.slice(0, 600)}`;
+  fail(detail);
+}
+const overRes = fetchRoute(`${BASE_ROUTE}/overview`);
+const overCode = overRes.code;
+if (overCode !== '200') overRes.body = '';
 
-set +e
-node - "$PKG_ID" "$WORK/diag.json" "$WORK/overview.json" "$OVER_CODE" <<'NODE_VERIFY'
-'use strict';
-const fs = require('fs');
-const [, , pkgId, diagPath, overPath, overCode] = process.argv;
+if (RAW) {
+  process.stdout.write(`--- diagnostics (HTTP ${diagRes.code}) ---\n${diagRes.body}\n`);
+  process.stdout.write(`--- overview (HTTP ${overCode}) ---\n${overRes.body}\n`);
+  process.stdout.write('--- verdict ---\n');
+}
 
-const readMaybe = (p) => {
-  try { const t = fs.readFileSync(p, 'utf8'); return t.trim() ? JSON.parse(t) : null; }
+const readMaybe = (t) => {
+  try { return t.trim() ? JSON.parse(t) : null; }
   catch { return null; }
 };
 
-const diag = readMaybe(diagPath);
+const diag = readMaybe(diagRes.body);
 if (!diag || !Array.isArray(diag.entries)) {
   process.stderr.write('ERROR  the diagnostics response did not carry an "entries" array — the response shape drifted.\n');
   process.stderr.write('       Re-run with --raw and read the payload before trusting any verdict.\n');
   process.exit(4);
 }
-const over = readMaybe(overPath);
+const over = readMaybe(overRes.body);
 const overPackages = over && Array.isArray(over.packages) ? over.packages : [];
 const overSource = over && Array.isArray(over.sourcePackages) ? over.sourcePackages : [];
 
@@ -309,9 +306,9 @@ const counts = () => {
     // an outbound connector is registered into ONE tenant, or into none.
     process.stdout.write('  NOTE: connectors are DECLARATIONS, not live instances. An outbound\n');
     process.stdout.write('        (mcp/openapi/http) connector registers into exactly one tenant — the\n');
-    process.stdout.write('        platform lane for a first-party install, the owning project for a\n');
+    process.stdout.write('        platform lane for a native install, the owning project for a\n');
     process.stdout.write('        drop — and into NO tenant at all when the package is neither\n');
-    process.stdout.write('        first-party nor owned by a resolvable project, which is silent\n');
+    process.stdout.write('        native nor owned by a resolvable project, which is silent\n');
     process.stdout.write('        apart from one server log line. Prove the instance exists with\n');
     process.stdout.write('        neuralis request GET @neuralis/agent-core/connectors; that list is\n');
     process.stdout.write('        the platform lane plus your own project, and nothing else.\n');
@@ -325,8 +322,8 @@ const counts = () => {
 const REASONS = {
   'build-missing': 'the sandbox artifact was never built. Build the package, then reinstall.',
   'runtime-unavailable': 'the declared runtime could not start (a subprocess that failed to spawn, or a code runtime that crashed). Check the entry command and the runtime type.',
-  'untrusted-node': 'the manifest declares the in-process "node" runtime, which requires first-party trust. Declare "wasm" to run code on any other tier.',
-  'untrusted-mcp': 'the manifest declares the "mcp" runtime, which spawns a subprocess as the host user and requires first-party trust, so nothing was spawned. Declare "wasm" — it is the only code runtime available below first-party.',
+  'untrusted-node': 'the manifest declares the in-process "node" runtime, which requires native trust. Declare "wasm" to run code on any other tier.',
+  'untrusted-mcp': 'the manifest declares the "mcp" runtime, which spawns a subprocess as the host user and requires native trust, so nothing was spawned. Declare "wasm" — it is the only code runtime available below native.',
 };
 
 if (status === 'loaded') {
@@ -343,10 +340,11 @@ if (status === 'loaded') {
   process.stdout.write('If a skill of this package still answers "Skill not found" in the conversation\n');
   process.stdout.write('that just enabled, trusted or installed it: those changes apply from the NEXT\n');
   process.stdout.write('stream (a new user message, a workflow run, or a fresh conversation), never\n');
-  process.stdout.write('mid-turn. A delegate spawned after the change sees its <packages> entry,\n');
-  process.stdout.write('injected rules/instructions and agent resolution fresh, but its tool catalog\n');
-  process.stdout.write('and skill activation still use the parent stream\'s gate. Retry from a fresh\n');
-  process.stdout.write('stream before re-diagnosing.\n');
+  process.stdout.write('mid-turn. A FOREGROUND delegate spawned after the change sees its <packages>\n');
+  process.stdout.write('entry, injected rules/instructions and agent resolution fresh, but its tool\n');
+  process.stdout.write('catalog and skill activation still use the parent stream\'s gate; a background\n');
+  process.stdout.write('delegate re-reads all of them at its wake. Retry from a fresh stream before\n');
+  process.stdout.write('re-diagnosing.\n');
   process.exit(0);
 }
 
@@ -369,7 +367,7 @@ if (status === 'error' || status === 'missing') {
   if (entry.sourceRoot) line('sourceRoot', entry.sourceRoot);
   process.stdout.write(status === 'missing'
     ? '\nInstalled but it never reached the loader — the manifest could not be read.\n  Check that package.json exists at the install root, parses, and carries a\n  "neuralis" block with an id.\n'
-    : '\nValidation or init crashed and NOTHING registered. The message above is the\n  loader\'s own; a tool-schema error names the file that aborted the load.\n  Fix it, then run check-package.sh on the package root before reinstalling.\n');
+    : '\nValidation or init crashed and NOTHING registered. The message above is the\n  loader\'s own; a tool-schema error names the file that aborted the load.\n  Fix it, then run check-package.mjs on the package root before reinstalling.\n');
   process.exit(3);
 }
 
@@ -377,7 +375,3 @@ process.stdout.write(`UNKNOWN STATUS  ${pkgId} -> "${status}"\n`);
 process.stdout.write('The status vocabulary is loaded | partial | error | missing. Anything else\n');
 process.stdout.write('means the response shape drifted — re-run with --raw and read the payload.\n');
 process.exit(4);
-NODE_VERIFY
-NODE_STATUS=$?
-set -e
-exit "$NODE_STATUS"