@nexus-ai-nexoralabs/cli 0.1.0

package/dist/config/index.js

@@ -0,0 +1,65 @@
+import { Logger } from '../common/logger.js';
+import { resolveProductionPaths } from './productionPaths.js';
+export { resolveProductionPaths, getBaseUserDataDir } from './productionPaths.js';
+/** Current configuration schema version. Bump when AppConfig gains breaking new fields. */
+export const CONFIG_VERSION = 1;
+export class ConfigService {
+    config;
+    logger = new Logger('ConfigService');
+    constructor(env = process.env) {
+        this.config = this.parseAndValidate(env);
+        this.logger.info('Configuration successfully loaded', {
+            environment: this.config.environment,
+            port: this.config.port,
+            databasePath: this.config.databasePath,
+            workspaceRoot: this.config.workspaceRoot,
+            logLevel: this.config.logLevel,
+        });
+    }
+    parseAndValidate(env) {
+        const rawPort = env.PORT || '3000';
+        const port = parseInt(rawPort, 10);
+        if (isNaN(port) || port < 0 || port > 65535) {
+            throw new Error(`Invalid PORT configuration value: "${rawPort}". Must be integer between 0 and 65535.`);
+        }
+        const rawEnv = env.NODE_ENV || 'development';
+        if (!['development', 'production', 'test'].includes(rawEnv)) {
+            throw new Error(`Invalid NODE_ENV configuration value: "${rawEnv}". Allowed: development, production, test.`);
+        }
+        const rawLogLevel = (env.LOG_LEVEL || 'info').toLowerCase();
+        if (!['debug', 'info', 'warn', 'error'].includes(rawLogLevel)) {
+            throw new Error(`Invalid LOG_LEVEL configuration value: "${rawLogLevel}". Allowed: debug, info, warn, error.`);
+        }
+        const resolvedPaths = resolveProductionPaths(env);
+        const ollamaHost = env.OLLAMA_HOST || 'http://127.0.0.1:11434';
+        const databasePath = resolvedPaths.databasePath;
+        const workspaceRoot = resolvedPaths.workspaceRoot;
+        // Optional model pins — no error if absent; ModelRouter handles missing gracefully
+        const primaryModel = env.PRIMARY_MODEL?.trim() || undefined;
+        const fallbackModel = env.FALLBACK_MODEL?.trim() || undefined;
+        const envProvider = env.NEXUS_INFERENCE_PROVIDER || env.NEXUS_PROVIDER;
+        const nexusInferenceProvider = ['embedded', 'ollama', 'auto'].includes(envProvider)
+            ? envProvider
+            : undefined;
+        return Object.freeze({
+            port,
+            environment: rawEnv,
+            ollamaHost,
+            databasePath,
+            workspaceRoot,
+            logLevel: rawLogLevel,
+            primaryModel,
+            fallbackModel,
+            nexusInferenceProvider,
+            configVersion: CONFIG_VERSION,
+        });
+    }
+    getConfig() {
+        return this.config;
+    }
+}
+export function loadConfig(env) {
+    const service = new ConfigService(env);
+    return service.getConfig();
+}
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAY,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAGlF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAmBhC,MAAM,OAAO,aAAa;IAChB,MAAM,CAAY;IAClB,MAAM,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC;IAE7C,YAAY,MAA0C,OAAO,CAAC,GAAG;QAC/D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACpD,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,GAAuC;QAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;QACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,yCAAyC,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;QAC7C,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,4CAA4C,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,2CAA2C,WAAW,uCAAuC,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,IAAI,wBAAwB,CAAC;QAC/D,MAAM,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;QAChD,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;QAElD,mFAAmF;QACnF,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC5D,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAE9D,MAAM,WAAW,GAAG,GAAG,CAAC,wBAAwB,IAAI,GAAG,CAAC,cAAc,CAAC;QACvE,MAAM,sBAAsB,GAA+C,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAqB,CAAC;YACvI,CAAC,CAAE,WAA8C;YACjD,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,WAAW,EAAE,MAAkC;YAC/C,UAAU;YACV,YAAY;YACZ,aAAa;YACb,QAAQ,EAAE,WAAuB;YACjC,YAAY;YACZ,aAAa;YACb,sBAAsB;YACtB,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,GAAwC;IACjE,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,SAAS,EAAE,CAAC;AAC7B,CAAC"}

package/dist/config/productionPaths.d.ts

@@ -0,0 +1,34 @@
+/**
+ * NEXUS AI — Production Path Resolution (P7-E)
+ *
+ * Resolves standard user data, database, log, and workspace paths for Windows
+ * desktop packaging. Separates read-only application installation files from
+ * writable user data directories.
+ *
+ * In Production:
+ *   - User Data Dir:  %APPDATA%\NEXUS AI\
+ *   - Database Path:  %APPDATA%\NEXUS AI\data\nexus.sqlite
+ *   - Log Directory:  %APPDATA%\NEXUS AI\logs\
+ *   - Workspace Root: %USERPROFILE%\NEXUS-Workspace (User configurable)
+ *
+ * In Development / Test:
+ *   - Uses relative fallback paths (e.g. ./data/nexus.sqlite, ./workspace)
+ */
+export interface ResolvedAppPaths {
+    userDataDir: string;
+    databasePath: string;
+    logDir: string;
+    workspaceRoot: string;
+    isProduction: boolean;
+}
+/**
+ * Returns the OS-specific base directory for user data.
+ * Windows: %APPDATA%\NEXUS AI
+ * Fallback: ~/.nexus-ai
+ */
+export declare function getBaseUserDataDir(env?: Record<string, string | undefined>): string;
+/**
+ * Resolves all application paths based on environment and explicitly provided overrides.
+ */
+export declare function resolveProductionPaths(env?: Record<string, string | undefined>): ResolvedAppPaths;
+//# sourceMappingURL=productionPaths.d.ts.map

package/dist/config/productionPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"productionPaths.d.ts","sourceRoot":"","sources":["../../src/config/productionPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAKhG;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,gBAAgB,CA2D9G"}

package/dist/config/productionPaths.js

@@ -0,0 +1,95 @@
+/**
+ * NEXUS AI — Production Path Resolution (P7-E)
+ *
+ * Resolves standard user data, database, log, and workspace paths for Windows
+ * desktop packaging. Separates read-only application installation files from
+ * writable user data directories.
+ *
+ * In Production:
+ *   - User Data Dir:  %APPDATA%\NEXUS AI\
+ *   - Database Path:  %APPDATA%\NEXUS AI\data\nexus.sqlite
+ *   - Log Directory:  %APPDATA%\NEXUS AI\logs\
+ *   - Workspace Root: %USERPROFILE%\NEXUS-Workspace (User configurable)
+ *
+ * In Development / Test:
+ *   - Uses relative fallback paths (e.g. ./data/nexus.sqlite, ./workspace)
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+/**
+ * Returns the OS-specific base directory for user data.
+ * Windows: %APPDATA%\NEXUS AI
+ * Fallback: ~/.nexus-ai
+ */
+export function getBaseUserDataDir(env = process.env) {
+    if (env.APPDATA) {
+        return path.join(env.APPDATA, 'NEXUS AI');
+    }
+    return path.join(os.homedir(), '.nexus-ai');
+}
+/**
+ * Resolves all application paths based on environment and explicitly provided overrides.
+ */
+export function resolveProductionPaths(env = process.env) {
+    const isExplicitNonProd = env.NODE_ENV === 'test' || env.NODE_ENV === 'development' || Boolean(env.VITEST || process.env.VITEST);
+    const isProduction = env.NODE_ENV === 'production' || (!isExplicitNonProd && typeof process !== 'undefined' && process.defaultApp === undefined);
+    const baseDir = getBaseUserDataDir(env);
+    // Database path resolution
+    let databasePath;
+    if (env.DATABASE_PATH) {
+        databasePath = env.DATABASE_PATH;
+    }
+    else if (isProduction) {
+        databasePath = path.join(baseDir, 'data', 'nexus.sqlite');
+    }
+    else {
+        databasePath = './data/nexus.sqlite';
+    }
+    // Log directory resolution
+    let logDir;
+    if (env.LOG_DIR) {
+        logDir = env.LOG_DIR;
+    }
+    else if (isProduction) {
+        logDir = path.join(baseDir, 'logs');
+    }
+    else {
+        logDir = './logs';
+    }
+    // Workspace root resolution
+    let workspaceRoot;
+    if (env.WORKSPACE_ROOT) {
+        workspaceRoot = env.WORKSPACE_ROOT;
+    }
+    else if (isProduction) {
+        workspaceRoot = path.join(os.homedir(), 'NEXUS-Workspace');
+    }
+    else {
+        workspaceRoot = './workspace';
+    }
+    // Ensure directories exist for writable production paths
+    if (isProduction || env.NODE_ENV !== 'test') {
+        try {
+            const dbDir = path.dirname(path.resolve(databasePath));
+            if (!fs.existsSync(dbDir)) {
+                fs.mkdirSync(dbDir, { recursive: true });
+            }
+            const resolvedLogDir = path.resolve(logDir);
+            if (!fs.existsSync(resolvedLogDir)) {
+                fs.mkdirSync(resolvedLogDir, { recursive: true });
+            }
+        }
+        catch {
+            // Non-fatal if filesystem is read-only in specialized test runners
+        }
+    }
+    return {
+        userDataDir: baseDir,
+        databasePath,
+        logDir,
+        workspaceRoot,
+        isProduction,
+    };
+}
+//# sourceMappingURL=productionPaths.js.map

package/dist/config/productionPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"productionPaths.js","sourceRoot":"","sources":["../../src/config/productionPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAUzB;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACtF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA0C,OAAO,CAAC,GAAG;IAC1F,MAAM,iBAAiB,GAAG,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjI,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,iBAAiB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAK,OAA+C,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IAE1L,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAExC,2BAA2B;IAC3B,IAAI,YAAoB,CAAC;IACzB,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,YAAY,GAAG,GAAG,CAAC,aAAa,CAAC;IACnC,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,qBAAqB,CAAC;IACvC,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAc,CAAC;IACnB,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;IACvB,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;IAED,4BAA4B;IAC5B,IAAI,aAAqB,CAAC;IAC1B,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC;IACrC,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,aAAa,CAAC;IAChC,CAAC;IAED,yDAAyD;IACzD,IAAI,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,YAAY;QACZ,MAAM;QACN,aAAa;QACb,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/config/workspaceService.d.ts

@@ -0,0 +1,42 @@
+/**
+ * NEXUS AI — WorkspaceService (P7-C)
+ *
+ * Centralizes workspace lifecycle operations: validation, creation, access checks,
+ * canonical path resolution, and traversal prevention.
+ *
+ * Security invariants:
+ * - NEVER allows path traversal beyond a given base
+ * - NEVER touches secret files
+ * - NEVER calls ToolGateway / PermissionEngine (runs pre-bootstrap)
+ * - Canonical path is the ONLY path ever stored or returned
+ */
+import { LogLevel } from '../common/logger.js';
+export type WorkspaceState = 'WORKSPACE_READY' | 'WORKSPACE_CREATED' | 'WORKSPACE_INVALID' | 'WORKSPACE_UNAVAILABLE' | 'WORKSPACE_NOT_ACCESSIBLE';
+export interface WorkspaceValidationResult {
+    state: WorkspaceState;
+    canonicalPath: string;
+    existed: boolean;
+    readable: boolean;
+    writable: boolean;
+    reason?: string;
+}
+export declare class WorkspaceService {
+    private logger;
+    constructor(logLevel?: LogLevel);
+    /**
+     * Validates an existing workspace path without creating it.
+     * Returns the canonical path and access state.
+     */
+    validateWorkspace(rawPath: string): WorkspaceValidationResult;
+    /**
+     * Validates and, if the workspace does not yet exist, creates it (mkdir -p).
+     * The path is canonicalized BEFORE any filesystem operation.
+     */
+    initializeWorkspace(rawPath: string): WorkspaceValidationResult;
+    private _validate;
+    /** Returns true if the raw path string contains traversal patterns before resolution. */
+    private _containsTraversal;
+    /** Rejects well-known system root paths that should never be used as workspaces. */
+    private _isDangerousSystemPath;
+}
+//# sourceMappingURL=workspaceService.d.ts.map

package/dist/config/workspaceService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceService.d.ts","sourceRoot":"","sources":["../../src/config/workspaceService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAU,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,uBAAuB,GACvB,0BAA0B,CAAC;AAE/B,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,cAAc,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAS;gBAEX,QAAQ,GAAE,QAAiB;IAIvC;;;OAGG;IACH,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,yBAAyB;IAI7D;;;OAGG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,yBAAyB;IAI/D,OAAO,CAAC,SAAS;IAuKjB,yFAAyF;IACzF,OAAO,CAAC,kBAAkB;IAM1B,oFAAoF;IACpF,OAAO,CAAC,sBAAsB;CAc/B"}

package/dist/config/workspaceService.js

@@ -0,0 +1,218 @@
+/**
+ * NEXUS AI — WorkspaceService (P7-C)
+ *
+ * Centralizes workspace lifecycle operations: validation, creation, access checks,
+ * canonical path resolution, and traversal prevention.
+ *
+ * Security invariants:
+ * - NEVER allows path traversal beyond a given base
+ * - NEVER touches secret files
+ * - NEVER calls ToolGateway / PermissionEngine (runs pre-bootstrap)
+ * - Canonical path is the ONLY path ever stored or returned
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { Logger } from '../common/logger.js';
+export class WorkspaceService {
+    logger;
+    constructor(logLevel = 'info') {
+        this.logger = new Logger('WorkspaceService', logLevel);
+    }
+    /**
+     * Validates an existing workspace path without creating it.
+     * Returns the canonical path and access state.
+     */
+    validateWorkspace(rawPath) {
+        return this._validate(rawPath, false);
+    }
+    /**
+     * Validates and, if the workspace does not yet exist, creates it (mkdir -p).
+     * The path is canonicalized BEFORE any filesystem operation.
+     */
+    initializeWorkspace(rawPath) {
+        return this._validate(rawPath, true);
+    }
+    _validate(rawPath, allowCreate) {
+        if (!rawPath || typeof rawPath !== 'string' || rawPath.trim() === '') {
+            return {
+                state: 'WORKSPACE_INVALID',
+                canonicalPath: '',
+                existed: false,
+                readable: false,
+                writable: false,
+                reason: 'Workspace path is empty or missing.',
+            };
+        }
+        let canonicalPath;
+        try {
+            // Resolve against cwd to make relative paths absolute, then normalize
+            const resolved = path.resolve(rawPath);
+            canonicalPath = resolved;
+        }
+        catch {
+            return {
+                state: 'WORKSPACE_INVALID',
+                canonicalPath: rawPath,
+                existed: false,
+                readable: false,
+                writable: false,
+                reason: `Workspace path could not be resolved: "${rawPath}"`,
+            };
+        }
+        // Reject paths that contain traversal segments after resolution
+        if (this._containsTraversal(rawPath)) {
+            this.logger.warn(`Workspace traversal attempt rejected: "${rawPath}"`);
+            return {
+                state: 'WORKSPACE_INVALID',
+                canonicalPath,
+                existed: false,
+                readable: false,
+                writable: false,
+                reason: `Workspace path contains traversal segments and was rejected for safety.`,
+            };
+        }
+        // Reject obviously dangerous system paths
+        if (this._isDangerousSystemPath(canonicalPath)) {
+            return {
+                state: 'WORKSPACE_INVALID',
+                canonicalPath,
+                existed: false,
+                readable: false,
+                writable: false,
+                reason: `Workspace path points to a protected system directory and cannot be used.`,
+            };
+        }
+        let existed = false;
+        try {
+            existed = fs.existsSync(canonicalPath);
+        }
+        catch {
+            return {
+                state: 'WORKSPACE_UNAVAILABLE',
+                canonicalPath,
+                existed: false,
+                readable: false,
+                writable: false,
+                reason: `Could not determine workspace existence for path: "${canonicalPath}"`,
+            };
+        }
+        if (!existed) {
+            if (!allowCreate) {
+                return {
+                    state: 'WORKSPACE_NOT_ACCESSIBLE',
+                    canonicalPath,
+                    existed: false,
+                    readable: false,
+                    writable: false,
+                    reason: `Workspace directory does not exist: "${canonicalPath}"`,
+                };
+            }
+            // Try to create workspace
+            try {
+                fs.mkdirSync(canonicalPath, { recursive: true });
+                this.logger.info(`Workspace created at: ${canonicalPath}`);
+                return {
+                    state: 'WORKSPACE_CREATED',
+                    canonicalPath,
+                    existed: false,
+                    readable: true,
+                    writable: true,
+                };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return {
+                    state: 'WORKSPACE_NOT_ACCESSIBLE',
+                    canonicalPath,
+                    existed: false,
+                    readable: false,
+                    writable: false,
+                    reason: `Failed to create workspace directory: ${msg}`,
+                };
+            }
+        }
+        // Workspace exists — verify it is a directory
+        try {
+            const stat = fs.statSync(canonicalPath);
+            if (!stat.isDirectory()) {
+                return {
+                    state: 'WORKSPACE_INVALID',
+                    canonicalPath,
+                    existed: true,
+                    readable: false,
+                    writable: false,
+                    reason: `Workspace path exists but is not a directory: "${canonicalPath}"`,
+                };
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return {
+                state: 'WORKSPACE_UNAVAILABLE',
+                canonicalPath,
+                existed: true,
+                readable: false,
+                writable: false,
+                reason: `Could not stat workspace path: ${msg}`,
+            };
+        }
+        // Probe read access
+        let readable = false;
+        try {
+            fs.accessSync(canonicalPath, fs.constants.R_OK);
+            readable = true;
+        }
+        catch {
+            readable = false;
+        }
+        // Probe write access
+        let writable = false;
+        try {
+            fs.accessSync(canonicalPath, fs.constants.W_OK);
+            writable = true;
+        }
+        catch {
+            writable = false;
+        }
+        if (!readable || !writable) {
+            return {
+                state: 'WORKSPACE_NOT_ACCESSIBLE',
+                canonicalPath,
+                existed: true,
+                readable,
+                writable,
+                reason: `Workspace directory is not fully accessible (readable=${readable}, writable=${writable}).`,
+            };
+        }
+        this.logger.info(`Workspace ready at: ${canonicalPath}`);
+        return {
+            state: 'WORKSPACE_READY',
+            canonicalPath,
+            existed: true,
+            readable: true,
+            writable: true,
+        };
+    }
+    /** Returns true if the raw path string contains traversal patterns before resolution. */
+    _containsTraversal(rawPath) {
+        const normalized = rawPath.replace(/\\/g, '/');
+        const parts = normalized.split('/');
+        return parts.some((p) => p === '..');
+    }
+    /** Rejects well-known system root paths that should never be used as workspaces. */
+    _isDangerousSystemPath(canonicalPath) {
+        const dangerous = [
+            'C:\\Windows',
+            'C:\\Windows\\System32',
+            '/etc',
+            '/bin',
+            '/usr',
+            '/sys',
+            '/proc',
+            '/dev',
+        ];
+        const norm = canonicalPath.replace(/\\/g, '/').toLowerCase();
+        return dangerous.some((d) => norm === d.replace(/\\/g, '/').toLowerCase());
+    }
+}
+//# sourceMappingURL=workspaceService.js.map

package/dist/config/workspaceService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceService.js","sourceRoot":"","sources":["../../src/config/workspaceService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAY,MAAM,qBAAqB,CAAC;AAkBvD,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAS;IAEvB,YAAY,WAAqB,MAAM;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,OAAe;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAEO,SAAS,CAAC,OAAe,EAAE,WAAoB;QACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrE,OAAO;gBACL,KAAK,EAAE,mBAAmB;gBAC1B,aAAa,EAAE,EAAE;gBACjB,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,qCAAqC;aAC9C,CAAC;QACJ,CAAC;QAED,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvC,aAAa,GAAG,QAAQ,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,KAAK,EAAE,mBAAmB;gBAC1B,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,0CAA0C,OAAO,GAAG;aAC7D,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,IAAI,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,OAAO,GAAG,CAAC,CAAC;YACvE,OAAO;gBACL,KAAK,EAAE,mBAAmB;gBAC1B,aAAa;gBACb,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,yEAAyE;aAClF,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,KAAK,EAAE,mBAAmB;gBAC1B,aAAa;gBACb,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,2EAA2E;aACpF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,aAAa;gBACb,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,sDAAsD,aAAa,GAAG;aAC/E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;oBACL,KAAK,EAAE,0BAA0B;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,wCAAwC,aAAa,GAAG;iBACjE,CAAC;YACJ,CAAC;YAED,0BAA0B;YAC1B,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,aAAa,EAAE,CAAC,CAAC;gBAC3D,OAAO;oBACL,KAAK,EAAE,mBAAmB;oBAC1B,aAAa;oBACb,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,IAAI;iBACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO;oBACL,KAAK,EAAE,0BAA0B;oBACjC,aAAa;oBACb,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,yCAAyC,GAAG,EAAE;iBACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,mBAAmB;oBAC1B,aAAa;oBACb,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,kDAAkD,aAAa,GAAG;iBAC3E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,aAAa;gBACb,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,kCAAkC,GAAG,EAAE;aAChD,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QAED,qBAAqB;QACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,0BAA0B;gBACjC,aAAa;gBACb,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,QAAQ;gBACR,MAAM,EAAE,yDAAyD,QAAQ,cAAc,QAAQ,IAAI;aACpG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,aAAa,EAAE,CAAC,CAAC;QACzD,OAAO;YACL,KAAK,EAAE,iBAAiB;YACxB,aAAa;YACb,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,yFAAyF;IACjF,kBAAkB,CAAC,OAAe;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,oFAAoF;IAC5E,sBAAsB,CAAC,aAAqB;QAClD,MAAM,SAAS,GAAG;YAChB,aAAa;YACb,uBAAuB;YACvB,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;SACP,CAAC;QACF,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/desktop/appWindow.d.ts

@@ -0,0 +1,21 @@
+/**
+ * NEXUS AI — Desktop App Window Manager (P7-E)
+ *
+ * Manages the Electron BrowserWindow lifecycle and security configuration.
+ *
+ * SECURITY INVARIANTS:
+ *  - contextIsolation: true
+ *  - nodeIntegration: false
+ *  - sandbox: true
+ *  - webSecurity: true
+ *  - Navigates ONLY to http://127.0.0.1:${port}
+ *  - Blocks external popups and arbitrary web navigation.
+ */
+import { BrowserWindow } from 'electron';
+export declare class AppWindow {
+    private window;
+    createWindow(port: number): BrowserWindow;
+    getWindow(): BrowserWindow | null;
+    close(): void;
+}
+//# sourceMappingURL=appWindow.d.ts.map

package/dist/desktop/appWindow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appWindow.d.ts","sourceRoot":"","sources":["../../src/desktop/appWindow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAS,MAAM,UAAU,CAAC;AAOhD,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAA8B;IAE5C,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAuDzC,SAAS,IAAI,aAAa,GAAG,IAAI;IAIjC,KAAK,IAAI,IAAI;CAKd"}

package/dist/desktop/appWindow.js

@@ -0,0 +1,77 @@
+/**
+ * NEXUS AI — Desktop App Window Manager (P7-E)
+ *
+ * Manages the Electron BrowserWindow lifecycle and security configuration.
+ *
+ * SECURITY INVARIANTS:
+ *  - contextIsolation: true
+ *  - nodeIntegration: false
+ *  - sandbox: true
+ *  - webSecurity: true
+ *  - Navigates ONLY to http://127.0.0.1:${port}
+ *  - Blocks external popups and arbitrary web navigation.
+ */
+import { BrowserWindow, shell } from 'electron';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+export class AppWindow {
+    window = null;
+    createWindow(port) {
+        const preloadPath = path.join(__dirname, 'preload.js');
+        this.window = new BrowserWindow({
+            width: 1440,
+            height: 900,
+            minWidth: 1280,
+            minHeight: 720,
+            title: 'NEXUS AI Workstation',
+            backgroundColor: '#0b0f19',
+            show: false,
+            autoHideMenuBar: true,
+            webPreferences: {
+                contextIsolation: true,
+                nodeIntegration: false,
+                sandbox: true,
+                webSecurity: true,
+                preload: preloadPath,
+            },
+        });
+        // Show window smoothly when ready-to-show
+        this.window.once('ready-to-show', () => {
+            this.window?.show();
+        });
+        // Load local UI server URL
+        const targetUrl = `http://127.0.0.1:${port}`;
+        this.window.loadURL(targetUrl);
+        // SECURITY GUARD: Lock navigation to local UI server only
+        this.window.webContents.on('will-navigate', (event, navigationUrl) => {
+            const parsed = new URL(navigationUrl);
+            if (parsed.hostname !== '127.0.0.1' && parsed.hostname !== 'localhost') {
+                event.preventDefault();
+                shell.openExternal(navigationUrl);
+            }
+        });
+        // SECURITY GUARD: Handle external link clicks safely in default OS browser
+        this.window.webContents.setWindowOpenHandler(({ url }) => {
+            const parsed = new URL(url);
+            if (parsed.hostname !== '127.0.0.1' && parsed.hostname !== 'localhost') {
+                shell.openExternal(url);
+            }
+            return { action: 'deny' };
+        });
+        this.window.on('closed', () => {
+            this.window = null;
+        });
+        return this.window;
+    }
+    getWindow() {
+        return this.window;
+    }
+    close() {
+        if (this.window && !this.window.isDestroyed()) {
+            this.window.close();
+        }
+    }
+}
+//# sourceMappingURL=appWindow.js.map

package/dist/desktop/appWindow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appWindow.js","sourceRoot":"","sources":["../../src/desktop/appWindow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C,MAAM,OAAO,SAAS;IACZ,MAAM,GAAyB,IAAI,CAAC;IAE5C,YAAY,CAAC,IAAY;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAEvD,IAAI,CAAC,MAAM,GAAG,IAAI,aAAa,CAAC;YAC9B,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,GAAG;YACd,KAAK,EAAE,sBAAsB;YAC7B,eAAe,EAAE,SAAS;YAC1B,IAAI,EAAE,KAAK;YACX,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE;gBACd,gBAAgB,EAAE,IAAI;gBACtB,eAAe,EAAE,KAAK;gBACtB,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,WAAW;aACrB;SACF,CAAC,CAAC;QAEH,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;YACrC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,2BAA2B;QAC3B,MAAM,SAAS,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE/B,0DAA0D;QAC1D,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;YACnE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACvE,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACvE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/desktop/main.d.ts

@@ -0,0 +1,14 @@
+/**
+ * NEXUS AI — Desktop App Main Entry Point (P7-E)
+ *
+ * Electron main process bootstrap.
+ * Owns single-instance enforcement, ApplicationApi core initialization,
+ * local UIServer startup, AppWindow creation, and clean shutdown lifecycle.
+ *
+ * SECURITY INVARIANT:
+ *  - Single Backend Core: Bootstraps ApplicationApi directly. Zero secondary backend.
+ *  - Localhost Binding: UIServer binds strictly to 127.0.0.1.
+ *  - Single Instance Lock: Prevents duplicate database writers or port conflicts.
+ */
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/desktop/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/desktop/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}