@neuroverseos/governance 0.4.3 → 0.5.1

package/dist/{demo-6OQYWRR6.js → demo-N5K4VXJW.js}

@@ -6,7 +6,7 @@ import {
   handleListPresets,
   handleReasonRequest,
   writeTempWorld
-} from "./chunk-AV7XJJWK.js";
+} from "./chunk-TZBERHFM.js";
 import {
   adaptationFromVerdict,
   detectBehavioralPatterns,
@@ -15,12 +15,12 @@ import {
 import {
   resolveWorldPath
 } from "./chunk-AKW5YVCE.js";
-import "./chunk-ZAF6JH23.js";
 import {
   DEFAULT_BUNDLED_WORLD,
   loadBundledWorld,
   loadWorld
-} from "./chunk-I4RTIMLX.js";
+} from "./chunk-EQUAWNXW.js";
+import "./chunk-ZAF6JH23.js";
 import "./chunk-QLPTHTVB.js";
 import {
   __require

package/dist/{derive-7Y7YWVLU.js → derive-5LOMN7GO.js}

@@ -2,15 +2,15 @@ import {
   DeriveInputError,
   DeriveProviderError,
   deriveWorld
-} from "./chunk-FHXXD2TI.js";
+} from "./chunk-QZ666FCV.js";
 import {
   DERIVE_EXIT_CODES
 } from "./chunk-FMSTRBBS.js";
-import "./chunk-INWQHLPS.js";
 import "./chunk-OT6PXH54.js";
+import "./chunk-INWQHLPS.js";
 import "./chunk-7P3S7MAY.js";
-import "./chunk-YPCVY4GS.js";
 import "./chunk-3NZMMSOW.js";
+import "./chunk-YPCVY4GS.js";
 import "./chunk-QWGCMQQD.js";
 
 // src/cli/derive.ts
@@ -121,7 +121,7 @@ Normalization: ${n.fixCount} fix(es) applied
       process.stderr.write(`
 Bootstrapping to ${args.bootstrapDir}...
 `);
-      const { main: bootstrapMain } = await import("./bootstrap-2OW5ZLBL.js");
+      const { main: bootstrapMain } = await import("./bootstrap-IP5QMC3Q.js");
       await bootstrapMain([
         "--input",
         result.outputPath,

package/dist/{equity-penalties-NVBAB5WL.js → equity-penalties-PYCJ3Q4U.js}

@@ -1,6 +1,3 @@
-import {
-  verdictToAuditEvent
-} from "./chunk-2VAWP6FI.js";
 import {
   applyConsequence,
   applyReward,
@@ -10,11 +7,14 @@ import {
   tickAgentStates
 } from "./chunk-D2UCV5AK.js";
 import {
-  evaluateGuard
-} from "./chunk-ZAF6JH23.js";
+  verdictToAuditEvent
+} from "./chunk-2VAWP6FI.js";
 import {
   loadWorld
-} from "./chunk-I4RTIMLX.js";
+} from "./chunk-EQUAWNXW.js";
+import {
+  evaluateGuard
+} from "./chunk-ZAF6JH23.js";
 import "./chunk-QLPTHTVB.js";
 import "./chunk-QWGCMQQD.js";
 

package/dist/{explain-HDFN4ION.js → explain-42TVC3QD.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-ZJTDUCC2.js";
 import {
   loadWorld
-} from "./chunk-I4RTIMLX.js";
+} from "./chunk-EQUAWNXW.js";
 import "./chunk-QWGCMQQD.js";
 
 // src/cli/explain.ts

package/dist/{guard-6KSCWT2W.js → guard-TPYDFG6V.js}

@@ -6,16 +6,20 @@ import {
   evaluateGuardWithAI
 } from "./chunk-6CV4XG3J.js";
 import "./chunk-INWQHLPS.js";
+import {
+  FileAuditLogger,
+  verdictToAuditEvent
+} from "./chunk-2VAWP6FI.js";
 import {
   describeActiveWorld,
   resolveWorldPath
 } from "./chunk-AKW5YVCE.js";
+import {
+  loadWorld
+} from "./chunk-EQUAWNXW.js";
 import {
   evaluateGuard
 } from "./chunk-ZAF6JH23.js";
-import {
-  loadWorld
-} from "./chunk-I4RTIMLX.js";
 import "./chunk-QLPTHTVB.js";
 import "./chunk-QWGCMQQD.js";
 
@@ -25,6 +29,7 @@ function parseArgs(argv) {
   let trace = false;
   let level;
   let aiClassify = false;
+  let logPath;
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "--world" && i + 1 < argv.length) {
@@ -33,6 +38,8 @@ function parseArgs(argv) {
       trace = true;
     } else if (arg === "--ai-classify") {
       aiClassify = true;
+    } else if (arg === "--log" && i + 1 < argv.length) {
+      logPath = argv[++i];
     } else if (arg === "--level" && i + 1 < argv.length) {
       const val = argv[++i];
       if (val === "basic" || val === "standard" || val === "strict") {
@@ -42,7 +49,7 @@ function parseArgs(argv) {
       }
     }
   }
-  return { worldPath, trace, level, aiClassify };
+  return { worldPath, trace, level, aiClassify, logPath };
 }
 async function main(argv = process.argv.slice(2)) {
   try {
@@ -102,6 +109,11 @@ async function main(argv = process.argv.slice(2)) {
       const options = { trace: args.trace, level: args.level };
       verdict = evaluateGuard(event, world, options);
     }
+    if (args.logPath) {
+      const logger = new FileAuditLogger(args.logPath, { flushIntervalMs: 0 });
+      logger.log(verdictToAuditEvent(event, verdict));
+      await logger.flush();
+    }
     process.stdout.write(JSON.stringify(verdict, null, 2) + "\n");
     const exitCode = GUARD_EXIT_CODES[verdict.status];
     process.exit(exitCode);

package/dist/{improve-2PWGGO5B.js → improve-HLZGJ54Z.js}

@@ -4,12 +4,12 @@ import {
 import {
   improveWorld,
   renderImproveText
-} from "./chunk-DA5MHFRR.js";
-import "./chunk-CYDMUJVZ.js";
+} from "./chunk-NTHXZAW4.js";
 import "./chunk-7P3S7MAY.js";
+import "./chunk-CYDMUJVZ.js";
 import {
   loadWorld
-} from "./chunk-I4RTIMLX.js";
+} from "./chunk-EQUAWNXW.js";
 import "./chunk-QWGCMQQD.js";
 
 // src/cli/improve.ts

package/dist/index.cjs

@@ -2833,7 +2833,9 @@ function emptyFlow() {
 async function defaultToolExecutor(name, args) {
   return `Tool "${name}" executed successfully with args: ${JSON.stringify(args)}`;
 }
-var SessionManager = class {
+var SessionManager = class _SessionManager {
+  /** Maximum unique agent IDs tracked before eviction. Prevents unbounded memory growth. */
+  static MAX_AGENTS = 1e4;
   config;
   state;
   engineOptions;
@@ -2897,6 +2899,16 @@ var SessionManager = class {
       if (verdict.status === "REWARD" && verdict.reward) {
         agentState = applyReward(agentState, verdict.reward, verdict.ruleId ?? "unknown");
       }
+      if (this.state.agentStates.size >= _SessionManager.MAX_AGENTS && !this.state.agentStates.has(event.roleId)) {
+        const oldest = this.state.agentStates.keys().next().value;
+        if (oldest !== void 0) {
+          this.state.agentStates.delete(oldest);
+        }
+        process.stderr.write(
+          `[neuroverse] Warning: agent state map at capacity (${_SessionManager.MAX_AGENTS}), evicted oldest entry
+`
+        );
+      }
       this.state.agentStates.set(event.roleId, agentState);
     }
     this.config.onVerdict?.(verdict, event);
@@ -3007,11 +3019,17 @@ async function runPipeMode(config) {
     process.stderr.write(`[neuroverse] Plan: ${state.plan.plan_id} (${state.plan.objective})
 `);
   }
+  const MAX_BUFFER_SIZE = 1e6;
   return new Promise((resolve3, reject) => {
     let buffer = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       buffer += chunk;
+      if (buffer.length > MAX_BUFFER_SIZE) {
+        process.stderr.write("[neuroverse] Warning: pipe buffer exceeded 1MB, resetting\n");
+        buffer = "";
+        return;
+      }
       const lines = buffer.split("\n");
       buffer = lines.pop() ?? "";
       for (const line of lines) {

package/dist/index.d.cts

@@ -479,6 +479,8 @@ interface SessionState {
     agentStates: Map<string, AgentBehaviorState>;
 }
 declare class SessionManager {
+    /** Maximum unique agent IDs tracked before eviction. Prevents unbounded memory growth. */
+    private static readonly MAX_AGENTS;
     private config;
     private state;
     private engineOptions;

package/dist/index.d.ts

@@ -479,6 +479,8 @@ interface SessionState {
     agentStates: Map<string, AgentBehaviorState>;
 }
 declare class SessionManager {
+    /** Maximum unique agent IDs tracked before eviction. Prevents unbounded memory growth. */
+    private static readonly MAX_AGENTS;
     private config;
     private state;
     private engineOptions;

package/dist/index.js

@@ -3,15 +3,6 @@ import {
   generateImpactReportFromFile,
   renderImpactReport
 } from "./chunk-OQU65525.js";
-import {
-  CompositeAuditLogger,
-  ConsoleAuditLogger,
-  FileAuditLogger,
-  createGovernanceEngine,
-  readAuditLog,
-  summarizeAuditEvents,
-  verdictToAuditEvent
-} from "./chunk-2VAWP6FI.js";
 import {
   BOOTSTRAP_EXIT_CODES
 } from "./chunk-4NGDRRQH.js";
@@ -33,7 +24,7 @@ import {
   handleListPresets,
   handleReasonRequest,
   writeTempWorld
-} from "./chunk-AV7XJJWK.js";
+} from "./chunk-TZBERHFM.js";
 import {
   adaptationFromVerdict,
   classifyAdaptation,
@@ -46,18 +37,18 @@ import {
   addRule,
   classifyIntent,
   parseGuardDescription
-} from "./chunk-FS2UUJJO.js";
+} from "./chunk-XPMZB46F.js";
 import {
   deriveWorld,
   extractWorldMarkdown,
   normalizeWorldMarkdown
-} from "./chunk-FHXXD2TI.js";
+} from "./chunk-QZ666FCV.js";
 import {
   CONFIGURE_AI_EXIT_CODES,
   DERIVE_EXIT_CODES
 } from "./chunk-FMSTRBBS.js";
-import "./chunk-INWQHLPS.js";
 import "./chunk-OT6PXH54.js";
+import "./chunk-INWQHLPS.js";
 import {
   explainWorld,
   renderExplainText
@@ -65,7 +56,13 @@ import {
 import {
   improveWorld,
   renderImproveText
-} from "./chunk-DA5MHFRR.js";
+} from "./chunk-NTHXZAW4.js";
+import {
+  validateWorld
+} from "./chunk-7P3S7MAY.js";
+import {
+  parseWorldMarkdown
+} from "./chunk-3NZMMSOW.js";
 import {
   renderSimulateText,
   simulateWorld
@@ -74,7 +71,7 @@ import {
   SessionManager,
   runInteractiveMode,
   runPipeMode
-} from "./chunk-ZEIT2QLM.js";
+} from "./chunk-EK77AJAH.js";
 import {
   applyConsequence,
   applyReward,
@@ -90,14 +87,20 @@ import {
 } from "./chunk-A5W4GNQO.js";
 import {
   McpGovernanceServer
-} from "./chunk-J2IZBHXJ.js";
-import {
-  validateWorld
-} from "./chunk-7P3S7MAY.js";
+} from "./chunk-LAKUB76X.js";
 import {
   PLAN_EXIT_CODES,
   parsePlanMarkdown
 } from "./chunk-6CZSKEY5.js";
+import {
+  CompositeAuditLogger,
+  ConsoleAuditLogger,
+  FileAuditLogger,
+  createGovernanceEngine,
+  readAuditLog,
+  summarizeAuditEvents,
+  verdictToAuditEvent
+} from "./chunk-2VAWP6FI.js";
 import {
   describeActiveWorld,
   getActiveWorldName,
@@ -108,9 +111,6 @@ import {
 import {
   emitWorldDefinition
 } from "./chunk-YPCVY4GS.js";
-import {
-  parseWorldMarkdown
-} from "./chunk-3NZMMSOW.js";
 import {
   GitHubGovernanceBlockedError,
   GitHubGovernor,
@@ -121,17 +121,17 @@ import {
   createGitHubWebhookHandlerFromWorld,
   formatForActions,
   formatPRComment
-} from "./chunk-3S5AD4AB.js";
+} from "./chunk-FGOSKQDE.js";
 import "./chunk-5U2MQO5P.js";
+import {
+  loadWorld,
+  loadWorldFromDirectory
+} from "./chunk-EQUAWNXW.js";
 import {
   evaluateGuard,
   eventToAllowlistKey,
   verdictToEvent
 } from "./chunk-ZAF6JH23.js";
-import {
-  loadWorld,
-  loadWorldFromDirectory
-} from "./chunk-I4RTIMLX.js";
 import {
   advancePlan,
   buildPlanCheck,

package/dist/keygen-BSZH3NM2.js

@@ -0,0 +1,77 @@
+import "./chunk-QWGCMQQD.js";
+
+// src/cli/keygen.ts
+import { generateKeyPairSync } from "crypto";
+import { writeFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var USAGE = `
+neuroverse keygen \u2014 Generate Ed25519 signing keypair
+
+Usage:
+  neuroverse keygen [--output <dir>] [--name <name>]
+
+Options:
+  --output <dir>   Key directory (default: ~/.neuroverse/keys/)
+  --name <name>    Key name (default: neuroverse)
+  --force          Overwrite existing keys
+
+Examples:
+  neuroverse keygen
+  neuroverse keygen --name production --output ./keys/
+`.trim();
+function parseArgs(argv) {
+  let output = join(homedir(), ".neuroverse", "keys");
+  let name = "neuroverse";
+  let force = false;
+  let help = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if ((arg === "--output" || arg === "-o") && argv[i + 1]) {
+      output = argv[++i];
+    } else if ((arg === "--name" || arg === "-n") && argv[i + 1]) {
+      name = argv[++i];
+    } else if (arg === "--force") {
+      force = true;
+    } else if (arg === "--help" || arg === "-h") {
+      help = true;
+    }
+  }
+  return { output, name, force, help };
+}
+async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    process.stdout.write(USAGE + "\n");
+    return;
+  }
+  const pubPath = join(args.output, `${args.name}.pub`);
+  const keyPath = join(args.output, `${args.name}.key`);
+  if (!args.force && (existsSync(pubPath) || existsSync(keyPath))) {
+    process.stderr.write(`Keys already exist at ${args.output}/${args.name}.*
+`);
+    process.stderr.write("Use --force to overwrite.\n");
+    process.exit(1);
+  }
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
+    publicKeyEncoding: { type: "spki", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" }
+  });
+  mkdirSync(args.output, { recursive: true });
+  writeFileSync(pubPath, publicKey, "utf-8");
+  writeFileSync(keyPath, privateKey, { encoding: "utf-8", mode: 384 });
+  process.stdout.write(`Keypair generated:
+`);
+  process.stdout.write(`  Public:  ${pubPath}
+`);
+  process.stdout.write(`  Private: ${keyPath}
+`);
+  process.stdout.write(`
+Share the .pub file with anyone who needs to verify your worlds.
+`);
+  process.stdout.write(`Keep the .key file secret.
+`);
+}
+export {
+  main
+};

package/dist/{lens-MHMUDCMQ.js → lens-NFGZHD76.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BQZMOEML.js";
 import {
   loadWorld
-} from "./chunk-I4RTIMLX.js";
+} from "./chunk-EQUAWNXW.js";
 import "./chunk-QWGCMQQD.js";
 
 // src/builder/lens.ts

package/dist/{mcp-server-TNIWZ7B5.js → mcp-server-5XXNG6VC.js}

@@ -1,10 +1,10 @@
 import {
   McpGovernanceServer,
   startMcpServer
-} from "./chunk-J2IZBHXJ.js";
+} from "./chunk-LAKUB76X.js";
 import "./chunk-AKW5YVCE.js";
+import "./chunk-EQUAWNXW.js";
 import "./chunk-ZAF6JH23.js";
-import "./chunk-I4RTIMLX.js";
 import "./chunk-QLPTHTVB.js";
 import "./chunk-QWGCMQQD.js";
 export {

package/dist/migrate-NH5PVMX4.js

@@ -0,0 +1,221 @@
+import "./chunk-QWGCMQQD.js";
+
+// src/cli/migrate.ts
+import { readFileSync, writeFileSync, cpSync, existsSync } from "fs";
+import { join } from "path";
+var USAGE = `
+neuroverse migrate \u2014 World schema version migration
+
+Usage:
+  neuroverse migrate --world <dir> [options]
+
+Options:
+  --world <dir>       World directory to migrate (required)
+  --dry-run           Show what would change without modifying files
+  --backup            Copy original world to <dir>.backup before migrating
+  --target <version>  Target schema version (default: latest)
+  --json              Output migration plan as JSON
+
+Examples:
+  neuroverse migrate --world ./world/ --dry-run
+  neuroverse migrate --world ./world/ --backup
+  neuroverse migrate --world ./world/ --target 1.1.0
+`.trim();
+var MIGRATIONS = [
+  {
+    from: "1.0.0",
+    to: "1.1.0",
+    description: "Add enforcement_level to world.json, normalize metadata fields",
+    apply: (worldPath) => {
+      const changes = [];
+      const worldJsonPath = join(worldPath, "world.json");
+      if (existsSync(worldJsonPath)) {
+        const world = JSON.parse(readFileSync(worldJsonPath, "utf-8"));
+        if (!world.enforcement_level) {
+          world.enforcement_level = "standard";
+          writeFileSync(worldJsonPath, JSON.stringify(world, null, 2) + "\n", "utf-8");
+          changes.push({
+            file: "world.json",
+            action: "modified",
+            description: 'Added enforcement_level: "standard"'
+          });
+        }
+      }
+      const metaPath = join(worldPath, "metadata.json");
+      if (existsSync(metaPath)) {
+        const meta = JSON.parse(readFileSync(metaPath, "utf-8"));
+        let modified = false;
+        if (meta.configurator_version && !meta.authoring_method) {
+          meta.authoring_method = meta.configurator_version;
+          delete meta.configurator_version;
+          modified = true;
+        }
+        if (!meta.schema_version) {
+          meta.schema_version = "1.1.0";
+          modified = true;
+        } else {
+          meta.schema_version = "1.1.0";
+          modified = true;
+        }
+        if (modified) {
+          writeFileSync(metaPath, JSON.stringify(meta, null, 2) + "\n", "utf-8");
+          changes.push({
+            file: "metadata.json",
+            action: "modified",
+            description: "Normalized metadata fields, updated schema_version to 1.1.0"
+          });
+        }
+      }
+      return changes;
+    }
+  }
+];
+var LATEST_VERSION = MIGRATIONS.length > 0 ? MIGRATIONS[MIGRATIONS.length - 1].to : "1.0.0";
+function detectVersion(worldPath) {
+  const metaPath = join(worldPath, "metadata.json");
+  if (existsSync(metaPath)) {
+    try {
+      const meta = JSON.parse(readFileSync(metaPath, "utf-8"));
+      if (meta.schema_version) return meta.schema_version;
+    } catch {
+    }
+  }
+  return "1.0.0";
+}
+function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] ?? 0) < (pb[i] ?? 0)) return -1;
+    if ((pa[i] ?? 0) > (pb[i] ?? 0)) return 1;
+  }
+  return 0;
+}
+function findMigrationPath(from, to) {
+  const path = [];
+  let current = from;
+  while (compareVersions(current, to) < 0) {
+    const next = MIGRATIONS.find((m) => m.from === current);
+    if (!next) break;
+    path.push(next);
+    current = next.to;
+  }
+  return path;
+}
+function parseArgs(argv) {
+  let worldPath = "";
+  let dryRun = false;
+  let backup = false;
+  let target = LATEST_VERSION;
+  let json = false;
+  let help = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--world" && argv[i + 1]) {
+      worldPath = argv[++i];
+    } else if (arg === "--dry-run") {
+      dryRun = true;
+    } else if (arg === "--backup") {
+      backup = true;
+    } else if (arg === "--target" && argv[i + 1]) {
+      target = argv[++i];
+    } else if (arg === "--json") {
+      json = true;
+    } else if (arg === "--help" || arg === "-h") {
+      help = true;
+    }
+  }
+  return { worldPath, dryRun, backup, target, json, help };
+}
+async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    process.stdout.write(USAGE + "\n");
+    return;
+  }
+  if (!args.worldPath) {
+    process.stderr.write("Error: --world <dir> is required.\n");
+    process.exit(1);
+  }
+  const currentVersion = detectVersion(args.worldPath);
+  const targetVersion = args.target;
+  if (compareVersions(currentVersion, targetVersion) >= 0) {
+    const plan2 = {
+      currentVersion,
+      targetVersion,
+      migrations: [],
+      changes: []
+    };
+    if (args.json) {
+      process.stdout.write(JSON.stringify(plan2, null, 2) + "\n");
+    } else {
+      process.stdout.write(`World is already at version ${currentVersion} (target: ${targetVersion})
+`);
+      process.stdout.write("No migrations needed.\n");
+    }
+    return;
+  }
+  const migrationPath = findMigrationPath(currentVersion, targetVersion);
+  if (migrationPath.length === 0) {
+    process.stderr.write(`No migration path from ${currentVersion} to ${targetVersion}
+`);
+    process.exit(1);
+    return;
+  }
+  if (args.dryRun) {
+    const plan2 = {
+      currentVersion,
+      targetVersion,
+      migrations: migrationPath.map((m) => ({ from: m.from, to: m.to, description: m.description })),
+      changes: []
+    };
+    if (args.json) {
+      process.stdout.write(JSON.stringify(plan2, null, 2) + "\n");
+    } else {
+      process.stdout.write(`Migration plan: ${currentVersion} \u2192 ${targetVersion}
+`);
+      process.stdout.write(`Steps: ${migrationPath.length}
+
+`);
+      for (const m of migrationPath) {
+        process.stdout.write(`  ${m.from} \u2192 ${m.to}: ${m.description}
+`);
+      }
+      process.stdout.write("\nRun without --dry-run to apply.\n");
+    }
+    return;
+  }
+  if (args.backup) {
+    const backupPath = args.worldPath + ".backup";
+    cpSync(args.worldPath, backupPath, { recursive: true });
+    process.stdout.write(`Backup created: ${backupPath}
+`);
+  }
+  const allChanges = [];
+  for (const migration of migrationPath) {
+    process.stdout.write(`Applying: ${migration.from} \u2192 ${migration.to} (${migration.description})
+`);
+    const changes = migration.apply(args.worldPath);
+    allChanges.push(...changes);
+    for (const change of changes) {
+      process.stdout.write(`  ${change.action}: ${change.file} \u2014 ${change.description}
+`);
+    }
+  }
+  const plan = {
+    currentVersion,
+    targetVersion,
+    migrations: migrationPath.map((m) => ({ from: m.from, to: m.to, description: m.description })),
+    changes: allChanges
+  };
+  if (args.json) {
+    process.stdout.write(JSON.stringify(plan, null, 2) + "\n");
+  }
+  process.stdout.write(`
+Migration complete: ${currentVersion} \u2192 ${targetVersion} (${allChanges.length} changes)
+`);
+}
+export {
+  LATEST_VERSION,
+  main
+};