@ornexus/neocortex 4.60.18 → 4.60.19

package/docs/install/installer-diagnostics.md

@@ -9,6 +9,58 @@ reason codes and bounded metadata only. Do not attach raw npm lifecycle logs,
 third-party onboarding output, private local paths, tokens, license keys or
 customer data to support issues.
 
+## Codex local activation diagnostics
+
+Codex Neocortex invocations require trusted local access to the activation state
+under `~/.neocortex`. When the client detects that a Codex profile or sandbox
+cannot access or use that local state, it reports public error code
+`CODEX_AUTH_SANDBOX` instead of asking the user to paste activation material into
+a prompt or repository file.
+
+Safe operator response:
+
+1. Retry from `codex --profile neocortex-local`, Codex App **Full Access** /
+   trusted-local mode, or a local terminal with the same activated user account.
+2. Share only the bounded error code, reason code and public path label such as
+   `~/.neocortex`, `~/.neocortex/config.json` or `~/.neocortex/cache`.
+3. Do not share raw auth logs, absolute home paths, machine fingerprints,
+   activation values, license keys, API keys, JWTs or private URLs.
+
+Codex auth outcomes:
+
+| Code / reason | Symptom summary | Safe next action |
+| --- | --- | --- |
+| `CODEX_AUTH_SANDBOX` | Codex cannot access or use existing local Neocortex activation. | Switch to the explicit local profile/Full Access/trusted-local mode or run from the local terminal; do not paste credentials into prompts. |
+| `codex-config-inaccessible` | `~/.neocortex` or `~/.neocortex/config.json` is present but blocked by the Codex sandbox/profile. | Grant trusted local access or use the installed `neocortex-local` profile. |
+| `codex-config-unreadable` | Config exists but cannot be parsed/read safely by this Codex runtime. | Retry from trusted local mode and attach only the bounded reason code if support is needed. |
+| `codex-cache-unreadable` | Config has auth material but the local auth cache is blocked or unreadable. | Grant trusted local cache access or run from the local terminal. |
+| `codex-auth-network-denied` | Activation metadata is present but Codex cannot complete auth/API access. | Allow outbound Neocortex auth/API network access in the trusted local session. |
+| `codex-config-missing` / `NOT_CONFIGURED` | No activation exists in the selected environment. | Activate that environment intentionally from a trusted shell, or switch back to the already activated local profile. |
+
+Release smoke for this path is documented in
+`docs/verification/P203-codex-local-activation-smoke.md` and must remain
+credential-free.
+
+## Managed wrapper preservation
+
+Install and activation refreshes replace only packaged Neocortex wrapper bodies.
+When an existing managed Markdown wrapper and its packaged replacement both use
+leading YAML frontmatter, the installed frontmatter is retained byte-for-byte.
+Tier/version patching may subsequently update its managed `description` field,
+but unknown host fields and ordering remain untouched. Files outside the explicit
+Neocortex stub allowlist, including user-defined agents and MCP configuration,
+are never selected by this refresh path.
+
+The bounded diagnostic summary is `frontmatter-preserved`; it does not include
+frontmatter contents, absolute paths or configuration values. If a packaged file
+or existing destination has no valid leading YAML envelope, the managed packaged
+stub is installed normally rather than guessing from Markdown body separators.
+
+For payload-selection, target-normalization and metadata-frontmatter reason codes,
+safe examples and release smoke, see
+`docs/arquitetura-software/frontmatter-target-diagnostics.md` and
+`docs/deploy/P204-frontmatter-release-checklist.md`.
+
 ## Optional tool diagnostics
 
 Default npm lifecycle installs do not run CodeRabbit or similar third-party

package/install.ps1

@@ -17,7 +17,7 @@ param(
     [string]$ServerUrl = ('https://{0}.{1}.{2}' -f 'api','neocortex','sh')
 )
 
-$VERSION = "4.60.18"
+$VERSION = "4.60.19"
 
 # =============================================================================
 # CONFIGURACOES

package/install.sh

@@ -4,7 +4,7 @@
 # Development Orchestrator
 
 # Versao do instalador
-VERSION="4.60.18"
+VERSION="4.60.19"
 
 # Flags
 MIGRATION_DETECTED=false

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ornexus/neocortex",
-  "version": "4.60.18",
-  "description": "Neocortex v4.60.18 - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code",
+  "version": "4.60.19",
+  "description": "Neocortex v4.60.19 - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code",
   "keywords": [
     "claude",
     "claude-code",
@@ -60,6 +60,13 @@
     "docs/install/installer-diagnostics.md",
     "postinstall.js",
     "packages/client/dist/",
+    "packages/shared/dist/nx-invoke-signature.js",
+    "packages/shared/dist/command-registry-contract.js",
+    "packages/shared/dist/strict-readonly.js",
+    "packages/shared/dist/invocation/",
+    "packages/shared/dist/generated/command-registry.generated.js",
+    "packages/shared/dist/generated/invocation-schema.generated.js",
+    "packages/shared/dist/yoloop/wave-decision-receipt.js",
     "!packages/client/dist/**/*.js.map",
     "!packages/client/dist/**/*.d.ts.map",
     "targets-stubs/",
@@ -67,14 +74,20 @@
   ],
   "scripts": {
     "test": "node scripts/test-root.mjs",
-    "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs",
+    "build": "npm run build -w packages/shared && npm run build -w packages/client && node scripts/strip-source-map-comments.js && node scripts/minify-client-dist.mjs && node scripts/verify-compiled-invoke-signature.cjs",
     "build:clean": "rm -rf packages/shared/dist packages/client/dist && npm run build",
     "build:client": "npm run build -w packages/client",
     "build:shared": "npm run build -w packages/shared",
+    "command-registry:generate": "npm run build:shared && node scripts/generate-command-registry.mjs",
+    "command-registry:check": "npm run build:shared && node scripts/generate-command-registry.mjs --check",
+    "command-registry:migrate-project": "node scripts/migrate-command-registry-project-id.mjs",
+    "command-registry:migrate-claim-scope": "node scripts/migrate-epic-claim-scope.mjs",
+    "test:p205-registry": "vitest run tests/p205-registry",
     "postinstall": "node postinstall.js",
     "sync": "node sync-version.js",
     "validate": "node scripts/validate-pre-publish.js",
     "validate:pre-publish": "node scripts/validate-pre-publish.js",
+    "validate:client-artifacts": "node scripts/validate-client-artifacts.mjs",
     "validate:bash": "bash scripts/validate-pre-publish.sh",
     "admin:dev": "cd admin && npm run dev",
     "admin:build": "cd admin && npm run build",
@@ -86,10 +99,18 @@
     "storybook": "storybook dev -p 6006",
     "storybook:build": "storybook build --output-dir storybook-static",
     "storybook:smoke": "node scripts/storybook-smoke-a11y-check.js",
+    "remotion:studio": "remotion studio remotion/index.ts --public-dir=landing/public",
+    "remotion:typecheck": "tsc --noEmit -p remotion/tsconfig.json",
+    "remotion:render:release": "node scripts/render-release-reel.mjs video",
+    "remotion:still:release": "node scripts/render-release-reel.mjs still",
+    "remotion:still:release:safe-zone": "node scripts/render-release-reel.mjs safe-zone",
+    "remotion:render:release:all": "node scripts/render-release-reel.mjs all",
+    "skill:sync:release-story": "node scripts/sync-remotion-release-story-skill.mjs",
+    "skill:validate:release-story": "node scripts/sync-remotion-release-story-skill.mjs --check && node scripts/validate-remotion-release-story.mjs",
     "test:e2e": "bash scripts/e2e-smoke-test.sh",
     "test:tier3-stubs": "bash scripts/test-tier3-stubs.sh",
     "sbom": "bash scripts/generate-sbom.sh",
-    "prepublishOnly": "npm run build && npm --prefix packages/server run build -- --noEmit && node scripts/validate-pre-publish.js && node sync-version.js && npm run sbom && node -e \"const p=require('./package.json');const fs=require('fs');p.description='Neocortex v'+p.version+' - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code';fs.writeFileSync('./package.json',JSON.stringify(p,null,2)+'\\n');console.log('Publishing Neocortex v'+p.version+'...')\"",
+    "prepublishOnly": "npm run build && npm --prefix packages/server run build -- --noEmit && node sync-version.js && npm run sbom && node scripts/validate-pre-publish.js && node -e \"const p=require('./package.json');const fs=require('fs');p.description='Neocortex v'+p.version+' - Orquestrador de Desenvolvimento de Epics & Stories para Claude Code';fs.writeFileSync('./package.json',JSON.stringify(p,null,2)+'\\n');console.log('Publishing Neocortex v'+p.version+'...')\"",
     "version": "npm run sync && echo 'Nova versao:' && cat package.json | grep version"
   },
   "engines": {
@@ -120,6 +141,7 @@
   },
   "devDependencies": {
     "@cyclonedx/cyclonedx-npm": "^2.0.0",
+    "@remotion/cli": "4.0.499",
     "@storybook/addon-a11y": "^10.4.6",
     "@storybook/addon-docs": "^10.4.6",
     "@storybook/react-vite": "^10.4.6",
@@ -127,6 +149,7 @@
     "@types/react-dom": "^19.2.3",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
+    "remotion": "4.0.499",
     "storybook": "^10.4.6",
     "typescript": "^5.9.3",
     "vite": "^7.3.5"

package/packages/client/dist/agent/refresh-stubs.d.ts

@@ -33,6 +33,13 @@ export declare const SELECTED_PAYLOAD_BOUNDARY_SNIPPET = "Invocation payload bou
 export declare const SELECTED_PAYLOAD_EXCLUSION_SNIPPET = "Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.";
 export declare const SELECTED_PAYLOAD_LARGE_INPUT_SNIPPET = "`--args` remains the default input path; `--stdin` and `--args-file` are limited to oversized explicit user payloads";
 export declare function containsSelectedPayloadBoundary(content: string): boolean;
+/**
+ * Refresh a managed Markdown body without replacing host-owned frontmatter.
+ * Preservation is intentionally limited to files whose packaged source also
+ * declares YAML frontmatter, avoiding accidental treatment of body separators
+ * in plain wrappers such as Codex AGENTS.md.
+ */
+export declare function preserveInstalledMarkdownFrontmatter(sourceContent: string, installedContent: string | undefined): string;
 /**
  * P148.05: STUB_TARGETS shape exported for drift tests
  * (`refresh-stubs.test.ts` AC4, `p148-stub-topology.test.ts` AC5).

package/packages/client/dist/agent/refresh-stubs.js

@@ -1,2 +1,2 @@
-import{readFileSync as f,writeFileSync as y,existsSync as u,mkdirSync as A,renameSync as b,unlinkSync as $}from"node:fs";import{join as t,dirname as I,relative as L}from"node:path";import{homedir as n}from"node:os";import{createRequire as j}from"node:module";import{fileURLToPath as w}from"node:url";import{setSecureFilePermissions as h}from"../config/secure-config.js";const C=60,O=25,B=j(import.meta.url);function U(o){try{const e=JSON.parse(f(t(o,".neocortex","config.json"),"utf8"));if(e.tier==="free")return"Free";if(e.tier==="pro")return"Pro";if(e.tier==="enterprise")return"Enterprise"}catch{}}function te(o,e){try{const r=f(o,"utf-8"),i=r,c=T(r,e);c!==i&&y(o,c,"utf-8")}catch{}}function T(o,e){try{let r=o.replace(/🧠 Neocortex v[\d.]+/g,`\u{1F9E0} Neocortex v${e}`);return r=r.replace(/# Neocortex v[\d.]+/g,`# Neocortex v${e}`),r=r.replace(/^(│      ###  ########      v)[\d.]+(\s*│)$/gm,()=>{const i=`v${e}`,c=C-O-i.length;return`\u2502      ###  ########      ${i}${" ".repeat(Math.max(0,c))}\u2502`}),r=r.replace(/version: '[\d.]+'/g,`version: '${e}'`),r}catch{return o}}const Y="Invocation payload boundary: first select only the explicit user-intended Neocortex command and arguments after the trigger; then preserve that selected payload verbatim when calling `neocortex-client invoke --args`.",G="Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.",re="`--args` remains the default input path; `--stdin` and `--args-file` are limited to oversized explicit user payloads";function oe(o){const e=o.replace(/\s+/g," ").trim();return e.includes(Y)&&e.includes(G)}const M=[{destDir:t(n(),".claude","agents","neocortex"),sourceDir:"claude-code",files:["neocortex.md","neocortex.agent.yaml","neocortex-root.md","neocortex-root.agent.yaml"]},{destDir:t(n(),".gemini","agents"),sourceDir:"gemini-cli",files:["agent.md"]},{destDir:t(n(),".cursor","agents"),sourceDir:"cursor",files:["agent.md"]},{destDir:t(n(),".kimi-code","agents"),sourceDir:"kimi",files:["neocortex.md"]},{destDir:t(n(),".opencode","agents"),sourceDir:"opencode",files:["neocortex.md","neocortex-root.md"]},{destDir:t(n(),".codex"),sourceDir:"codex",files:["AGENTS.md"]},{destDir:t(n(),".codex","agents"),sourceDir:"codex",files:["neocortex.toml"]},{destDir:t(n(),".copilot","agents"),sourceDir:"vscode",files:["neocortex.agent.md"]},{destDir:t(n(),".agent","skills","neocortex"),sourceDir:"antigravity",files:["skill/SKILL.md"]},{destDir:t(n(),".gemini","config","agents"),sourceDir:"antigravity",files:["neocortex.md"]}];function V(){try{const o=w(import.meta.url);let e=I(o);for(let r=0;r<10;r++){try{if(JSON.parse(f(t(e,"package.json"),"utf-8")).name==="@ornexus/neocortex")return e}catch{}e=I(e)}}catch{}return null}function W(o){try{const e=t(o,".version");if(u(e))return f(e,"utf-8").trim()||null}catch{}return null}function q(o,e){const r=`${o}.tmp-${process.pid}`;try{y(r,e,"utf8"),h(r),b(r,o),h(o)}catch(i){try{u(r)&&$(r)}catch{}throw i}}function ne(o,e){try{const r=e?.forceCreate??!1,i=e?.targetFilter,c=e?.dryRun??!1,D=n(),a=e?.homeDir??D,v=e?.packageRoot??V();if(!v)return 0;const p=t(v,"targets-stubs");if(!u(p))return 0;const E=t(p,"lib","managed-config-merge.js");if(!u(E))return 0;const N=B(E),S=t(a,".neocortex","managed-config-manifest.json"),_=U(a);try{N.applyPolicy({configFile:t(a,".neocortex","config.json"),manifestFile:S,baseDir:a,dryRun:c})}catch{}let m=0;for(const s of M)try{const l=e?.homeDir?t(a,L(D,s.destDir)):s.destDir;if(i&&s.sourceDir!==i)continue;if(!u(l)){if(r&&!c)A(l,{recursive:!0});else if(!(r&&c))continue}if(W(l)===o)continue;const P=t(p,s.sourceDir);if(!u(P))continue;let g=!1;for(const d of s.files){const k=t(P,d),R=t(l,d);if(u(k)){let x=f(k,"utf8");(d.endsWith(".md")||d.endsWith(".yaml")||d.endsWith(".yml"))&&(x=T(x,o));const F=L(a,R).split("\\").join("/");N.applyProfileBytes({id:`profile-${s.sourceDir}-${F}`,content:x,destination:R,manifestFile:S,baseDir:a,dryRun:c,allowLegacyAdoption:!0,tierLabel:_}).action!=="failed"&&(g=!0)}}if(g&&!c){const d=t(l,".version");q(d,o+`
-`),m++}else g&&m++}catch{}if(m>0)try{const s=t(a,".neocortex");A(s,{recursive:!0});const l=t(s,".update-check");y(l,"",{flag:"w"}),h(l)}catch{}return m}catch{return 0}}export{Y as SELECTED_PAYLOAD_BOUNDARY_SNIPPET,G as SELECTED_PAYLOAD_EXCLUSION_SNIPPET,re as SELECTED_PAYLOAD_LARGE_INPUT_SNIPPET,M as STUB_TARGETS,oe as containsSelectedPayloadBoundary,V as findPackageRoot,T as patchVersionInContent,te as patchVersionInFile,ne as refreshStubs};
+import{readFileSync as f,writeFileSync as y,existsSync as u,mkdirSync as k,renameSync as w,unlinkSync as j}from"node:fs";import{join as o,dirname as I,relative as L}from"node:path";import{homedir as i}from"node:os";import{createRequire as O}from"node:module";import{fileURLToPath as B}from"node:url";import{setSecureFilePermissions as D}from"../config/secure-config.js";const M=60,U=25,Y=O(import.meta.url);function C(t){try{const e=JSON.parse(f(o(t,".neocortex","config.json"),"utf8"));if(e.tier==="free")return"Free";if(e.tier==="pro")return"Pro";if(e.tier==="enterprise")return"Enterprise"}catch{}}function ne(t,e){try{const r=f(t,"utf-8"),n=r,c=T(r,e);c!==n&&y(t,c,"utf-8")}catch{}}function T(t,e){try{let r=t.replace(/🧠 Neocortex v[\d.]+/g,`\u{1F9E0} Neocortex v${e}`);return r=r.replace(/# Neocortex v[\d.]+/g,`# Neocortex v${e}`),r=r.replace(/^(│      ###  ########      v)[\d.]+(\s*│)$/gm,()=>{const n=`v${e}`,c=M-U-n.length;return`\u2502      ###  ########      ${n}${" ".repeat(Math.max(0,c))}\u2502`}),r=r.replace(/version: '[\d.]+'/g,`version: '${e}'`),r}catch{return t}}const G="Invocation payload boundary: first select only the explicit user-intended Neocortex command and arguments after the trigger; then preserve that selected payload verbatim when calling `neocortex-client invoke --args`.",W="Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.",ie="`--args` remains the default input path; `--stdin` and `--args-file` are limited to oversized explicit user payloads";function ce(t){const e=t.replace(/\s+/g," ").trim();return e.includes(G)&&e.includes(W)}const F=/^(---(?:\r\n|\n)[\s\S]*?(?:\r\n|\n)---)(?=\r\n|\n|$)/;function V(t,e){if(e===void 0)return t;const r=t.match(F)?.[1],n=e.match(F)?.[1];return!r||!n?t:`${n}${t.slice(r.length)}`}const q=[{destDir:o(i(),".claude","agents","neocortex"),sourceDir:"claude-code",files:["neocortex.md","neocortex.agent.yaml","neocortex-root.md","neocortex-root.agent.yaml"]},{destDir:o(i(),".gemini","agents"),sourceDir:"gemini-cli",files:["agent.md"]},{destDir:o(i(),".cursor","agents"),sourceDir:"cursor",files:["agent.md"]},{destDir:o(i(),".kimi-code","agents"),sourceDir:"kimi",files:["neocortex.md"]},{destDir:o(i(),".opencode","agents"),sourceDir:"opencode",files:["neocortex.md","neocortex-root.md"]},{destDir:o(i(),".codex"),sourceDir:"codex",files:["AGENTS.md"]},{destDir:o(i(),".codex","agents"),sourceDir:"codex",files:["neocortex.toml"]},{destDir:o(i(),".copilot","agents"),sourceDir:"vscode",files:["neocortex.agent.md"]},{destDir:o(i(),".agent","skills","neocortex"),sourceDir:"antigravity",files:["skill/SKILL.md"]},{destDir:o(i(),".gemini","config","agents"),sourceDir:"antigravity",files:["neocortex.md"]}];function H(){try{const t=B(import.meta.url);let e=I(t);for(let r=0;r<10;r++){try{if(JSON.parse(f(o(e,"package.json"),"utf-8")).name==="@ornexus/neocortex")return e}catch{}e=I(e)}}catch{}return null}function J(t){try{const e=o(t,".version");if(u(e))return f(e,"utf-8").trim()||null}catch{}return null}function X(t,e){const r=`${t}.tmp-${process.pid}`;try{y(r,e,"utf8"),D(r),w(r,t),D(t)}catch(n){try{u(r)&&j(r)}catch{}throw n}}function se(t,e){try{const r=e?.forceCreate??!1,n=e?.targetFilter,c=e?.dryRun??!1,v=i(),a=e?.homeDir??v,E=e?.packageRoot??H();if(!E)return 0;const h=o(E,"targets-stubs");if(!u(h))return 0;const N=o(h,"lib","managed-config-merge.js");if(!u(N))return 0;const S=Y(N),A=o(a,".neocortex","managed-config-manifest.json"),_=C(a);try{S.applyPolicy({configFile:o(a,".neocortex","config.json"),manifestFile:A,baseDir:a,dryRun:c})}catch{}let p=0;for(const s of q)try{const l=e?.homeDir?o(a,L(v,s.destDir)):s.destDir;if(n&&s.sourceDir!==n)continue;if(!u(l)){if(r&&!c)k(l,{recursive:!0});else if(!(r&&c))continue}if(J(l)===t)continue;const P=o(h,s.sourceDir);if(!u(P))continue;let x=!1;for(const d of s.files){const R=o(P,d),g=o(l,d);if(u(R)){let m=f(R,"utf8");if(d.endsWith(".md")){const b=u(g)?f(g,"utf8"):void 0;m=V(m,b)}(d.endsWith(".md")||d.endsWith(".yaml")||d.endsWith(".yml"))&&(m=T(m,t));const $=L(a,g).split("\\").join("/");S.applyProfileBytes({id:`profile-${s.sourceDir}-${$}`,content:m,destination:g,manifestFile:A,baseDir:a,dryRun:c,allowLegacyAdoption:!0,tierLabel:_}).action!=="failed"&&(x=!0)}}if(x&&!c){const d=o(l,".version");X(d,t+`
+`),p++}else x&&p++}catch{}if(p>0)try{const s=o(a,".neocortex");k(s,{recursive:!0});const l=o(s,".update-check");y(l,"",{flag:"w"}),D(l)}catch{}return p}catch{return 0}}export{G as SELECTED_PAYLOAD_BOUNDARY_SNIPPET,W as SELECTED_PAYLOAD_EXCLUSION_SNIPPET,ie as SELECTED_PAYLOAD_LARGE_INPUT_SNIPPET,q as STUB_TARGETS,ce as containsSelectedPayloadBoundary,H as findPackageRoot,T as patchVersionInContent,ne as patchVersionInFile,V as preserveInstalledMarkdownFrontmatter,se as refreshStubs};

package/packages/client/dist/cache/encrypted-cache.d.ts

@@ -16,10 +16,13 @@ export interface EncryptedCacheOptions {
     cacheDir: string;
     /** Passphrase for encryption (typically the license key) */
     passphrase: string;
+    /** Read entries without cleanup, creation, overwrite or deletion. */
+    strictReadOnly?: boolean;
 }
 export declare class EncryptedCache implements CacheProvider {
     private readonly cacheDir;
     private readonly passphrase;
+    private readonly strictReadOnly;
     private initPromise;
     constructor(options: EncryptedCacheOptions);
     get(key: string): Promise<string | null>;

package/packages/client/dist/cache/encrypted-cache.js

@@ -1 +1 @@
-import{mkdir as n,writeFile as o,readFile as p,rm as s,readdir as m}from"node:fs/promises";import{join as a}from"node:path";import{createHash as u}from"node:crypto";import{encrypt as l,decrypt as f}from"./crypto-utils.js";import{setSecureFilePermissions as d}from"../config/secure-config.js";import{hasProtectedCachePayloadMarker as y}from"./protected-pi-boundary.js";const c=".enc";class F{cacheDir;passphrase;initPromise=null;constructor(t){this.cacheDir=t.cacheDir,this.passphrase=t.passphrase}async get(t){try{const r=this.keyToPath(t),e=await p(r,"utf8"),i=f(e,this.passphrase);return i.expired?(s(r,{force:!0}).catch(()=>{}),null):i.plaintext}catch{return null}}async set(t,r,e){try{if(y(r))return;await this.ensureDir();const i=this.keyToPath(t),h=l(r,this.passphrase,e);await o(i,h,"utf8"),d(i)}catch{}}async clear(){try{const r=(await m(this.cacheDir).catch(()=>[])).filter(e=>e.endsWith(c)).map(e=>s(a(this.cacheDir,e),{force:!0}).catch(()=>{}));await Promise.all(r)}catch{}}keyToPath(t){const r=u("sha256").update(t).digest("hex");return a(this.cacheDir,`${r}${c}`)}ensureDir(){return this.initPromise||(this.initPromise=n(this.cacheDir,{recursive:!0}).then(()=>{}).catch(t=>{throw this.initPromise=null,t})),this.initPromise}}export{F as EncryptedCache};
+import{mkdir as n,writeFile as o,readFile as l,rm as s,readdir as u}from"node:fs/promises";import{join as a}from"node:path";import{createHash as m}from"node:crypto";import{encrypt as p,decrypt as d}from"./crypto-utils.js";import{setSecureFilePermissions as f}from"../config/secure-config.js";import{hasProtectedCachePayloadMarker as y}from"./protected-pi-boundary.js";const c=".enc";class x{cacheDir;passphrase;strictReadOnly;initPromise=null;constructor(t){this.cacheDir=t.cacheDir,this.passphrase=t.passphrase,this.strictReadOnly=t.strictReadOnly??!1}async get(t){try{const r=this.keyToPath(t),e=await l(r,"utf8"),i=d(e,this.passphrase);return i.expired?(this.strictReadOnly||await s(r,{force:!0}).catch(()=>{}),null):i.plaintext}catch{return null}}async set(t,r,e){if(!this.strictReadOnly)try{if(y(r))return;await this.ensureDir();const i=this.keyToPath(t),h=p(r,this.passphrase,e);await o(i,h,"utf8"),f(i)}catch{}}async clear(){if(!this.strictReadOnly)try{const r=(await u(this.cacheDir).catch(()=>[])).filter(e=>e.endsWith(c)).map(e=>s(a(this.cacheDir,e),{force:!0}).catch(()=>{}));await Promise.all(r)}catch{}}keyToPath(t){const r=m("sha256").update(t).digest("hex");return a(this.cacheDir,`${r}${c}`)}ensureDir(){return this.initPromise||(this.initPromise=n(this.cacheDir,{recursive:!0}).then(()=>{}).catch(t=>{throw this.initPromise=null,t})),this.initPromise}}export{x as EncryptedCache};

package/packages/client/dist/checkpoint/checkpoint-client-reader.js

@@ -1,2 +1,2 @@
-import{promises as c}from"node:fs";import f from"node:path";import{MAX_SNAPSHOT_SIZE_BYTES as d}from"./shared-checkpoint-types.js";const u=".neocortex/checkpoint-pending.json",p=1e4,a=["FASE_1","FASE_2","FASE_3","FASE_4"];function l(o){if(o===null||typeof o!="object")return{valid:!1,errors:["payload must be object"]};const e=o,t=[];return(typeof e.storyId!="string"||e.storyId.length===0)&&t.push("storyId must be non-empty string"),(typeof e.turn!="number"||!Number.isFinite(e.turn)||e.turn<0)&&t.push("turn must be non-negative finite number"),(!Array.isArray(e.filesModified)||!e.filesModified.every(n=>typeof n=="string"))&&t.push("filesModified must be string[]"),(!Array.isArray(e.testsModified)||!e.testsModified.every(n=>typeof n=="string"))&&t.push("testsModified must be string[]"),(typeof e.currentPhase!="string"||!a.includes(e.currentPhase))&&t.push(`currentPhase must be one of ${a.join("|")}`),typeof e.snapshotMd!="string"&&t.push("snapshotMd must be string"),{valid:t.length===0,errors:Object.freeze(t)}}async function y(o){const e=f.join(o,u);let t;try{t=await c.readFile(e,"utf-8")}catch(r){if(r.code==="ENOENT")return;console.warn(`[Neocortex] checkpoint read failed: ${r instanceof Error?r.message:String(r)}`);return}c.unlink(e).catch(r=>{console.warn(`[Neocortex] checkpoint unlink failed: ${r instanceof Error?r.message:String(r)}`)});const n=t.replace(/^/,"").replace(/\r\n/g,`
-`);if(n.length>d+p){console.warn(`[Neocortex] checkpoint oversized (${n.length} bytes), skipping`);return}let s;try{s=JSON.parse(n)}catch(r){console.warn(`[Neocortex] checkpoint malformed JSON: ${r instanceof Error?r.message:String(r)}`);return}const i=l(s);if(!i.valid){console.warn(`[Neocortex] checkpoint schema invalid: ${i.errors.join("; ")}`);return}return s}export{u as CHECKPOINT_PENDING_PATH,y as readAndConsumeCheckpoint,l as validateSnapshot};
+import{promises as a}from"node:fs";import f from"node:path";import{MAX_SNAPSHOT_SIZE_BYTES as u}from"./shared-checkpoint-types.js";const d=".neocortex/checkpoint-pending.json",p=1e4,c=["FASE_1","FASE_2","FASE_3","FASE_4"];function l(o){if(o===null||typeof o!="object")return{valid:!1,errors:["payload must be object"]};const e=o,n=[];return(typeof e.storyId!="string"||e.storyId.length===0)&&n.push("storyId must be non-empty string"),(typeof e.turn!="number"||!Number.isFinite(e.turn)||e.turn<0)&&n.push("turn must be non-negative finite number"),(!Array.isArray(e.filesModified)||!e.filesModified.every(t=>typeof t=="string"))&&n.push("filesModified must be string[]"),(!Array.isArray(e.testsModified)||!e.testsModified.every(t=>typeof t=="string"))&&n.push("testsModified must be string[]"),(typeof e.currentPhase!="string"||!c.includes(e.currentPhase))&&n.push(`currentPhase must be one of ${c.join("|")}`),typeof e.snapshotMd!="string"&&n.push("snapshotMd must be string"),{valid:n.length===0,errors:Object.freeze(n)}}async function y(o){const e=f.join(o,d);let n;try{n=await a.readFile(e,"utf-8")}catch(r){if(r.code==="ENOENT")return;console.warn(`[Neocortex] checkpoint read failed: ${r instanceof Error?r.message:String(r)}`);return}try{await a.unlink(e)}catch(r){console.warn(`[Neocortex] checkpoint unlink failed: ${r instanceof Error?r.message:String(r)}`)}const t=n.replace(/^/,"").replace(/\r\n/g,`
+`);if(t.length>u+p){console.warn(`[Neocortex] checkpoint oversized (${t.length} bytes), skipping`);return}let i;try{i=JSON.parse(t)}catch(r){console.warn(`[Neocortex] checkpoint malformed JSON: ${r instanceof Error?r.message:String(r)}`);return}const s=l(i);if(!s.valid){console.warn(`[Neocortex] checkpoint schema invalid: ${s.errors.join("; ")}`);return}return i}export{d as CHECKPOINT_PENDING_PATH,y as readAndConsumeCheckpoint,l as validateSnapshot};

package/packages/client/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{readFileSync as p}from"node:fs";import{fileURLToPath as u}from"node:url";import{dirname as l,join as m}from"node:path";function g(){try{const a=u(import.meta.url);let e=l(a);for(let r=0;r<5;r++){try{const o=JSON.parse(p(m(e,"package.json"),"utf-8"));if(o.name==="@ornexus/neocortex"||o.name==="@neocortex/client")return o.version??"0.0.0"}catch{}e=l(e)}}catch{}return"0.0.0"}const d=`
+import{getClientVersion as d}from"./version.js";const l=`
 neocortex-client - Neocortex Client CLI
 
 Usage:
@@ -92,5 +92,5 @@ Invocation payload boundary:
 
 License:
   Licensed under BSL-1.1 (Business Source License 1.1)
-`.trim(),f=new Set(["pm","install","postinstall","preinstall","prepublish","postpublish","preuninstall","postuninstall","preprepare","prepare","postprepare"]);async function h(){const a=process.argv.slice(2),e=a[0];e&&f.has(e.toLowerCase())&&process.exit(0),(!e||e==="--help"||e==="-h")&&(console.log(d),process.exit(0)),(e==="--version"||e==="-v")&&(console.log(g()),process.stderr.write(`Licensed under BSL-1.1 (Business Source License 1.1)
-`),process.exit(0));const r=a.slice(1);switch(e){case"invoke":{const{invokeCliHandler:o}=await import("./commands/invoke.js"),s=await o(r);process.exit(s);break}case"activate":{const{activate:o}=await import("./commands/activate.js");let s,i,c=!1;for(let t=0;t<r.length;t++){const n=r[t];n==="--server-url"?i=r[++t]:n==="--non-interactive"?c=!0:n==="--help"||n==="-h"?(console.log(d),process.exit(0)):n.startsWith("-")||(s=n)}s||(console.error("Error: License key is required."),console.error("Usage: neocortex-client activate <license-key>"),console.error("Example: neocortex-client activate NX-PRO-ABC-123"),process.exit(1));try{const t=await o({licenseKey:s,serverUrl:i,nonInteractive:c});t.success?(console.log(t.message),process.exit(0)):(console.error(t.message),process.exit(1))}catch(t){const n=t instanceof Error?t.message:String(t);console.error(`Activation failed: ${n}`),process.exit(1)}break}case"cache-status":{console.log("Cache status requires an active client session."),console.log("Use this command within a running Neocortex client context."),process.exit(0);break}case"config":{const{configCliHandler:o}=await import("./commands/config.js"),s=await o(r);process.exit(s);break}case"refresh-memory":{const{refreshMemoryCliHandler:o}=await import("./commands/refresh-memory.js"),s=await o(r);process.exit(s);break}case"update":{console.log("To update Neocortex, run:"),console.log("  neocortex update"),console.log(""),console.log("Or manually:"),console.log("  npm install -g @ornexus/neocortex@latest"),process.exit(0);break}default:console.error(`Unknown command: ${e}`),console.error('Run "neocortex-client --help" for usage information.'),process.exit(1)}}h().catch(a=>{console.error(`Fatal error: ${a instanceof Error?a.message:String(a)}`),process.exit(1)});
+`.trim(),p=new Set(["pm","install","postinstall","preinstall","prepublish","postpublish","preuninstall","postuninstall","preprepare","prepare","postprepare"]);async function u(){const a=process.argv.slice(2),t=a[0];t&&p.has(t.toLowerCase())&&process.exit(0),(!t||t==="--help"||t==="-h")&&(console.log(l),process.exit(0)),(t==="--version"||t==="-v")&&(console.log(d()),process.stderr.write(`Licensed under BSL-1.1 (Business Source License 1.1)
+`),process.exit(0));const n=a.slice(1);switch(t){case"invoke":{const{invokeCliHandler:s}=await import("./commands/invoke.js"),o=await s(n);process.exit(o);break}case"activate":{const{activate:s}=await import("./commands/activate.js");let o,i,c=!1;for(let e=0;e<n.length;e++){const r=n[e];r==="--server-url"?i=n[++e]:r==="--non-interactive"?c=!0:r==="--help"||r==="-h"?(console.log(l),process.exit(0)):r.startsWith("-")||(o=r)}o||(console.error("Error: License key is required."),console.error("Usage: neocortex-client activate <license-key>"),console.error("Example: neocortex-client activate NX-PRO-ABC-123"),process.exit(1));try{const e=await s({licenseKey:o,serverUrl:i,nonInteractive:c});e.success?(console.log(e.message),process.exit(0)):(console.error(e.message),process.exit(1))}catch(e){const r=e instanceof Error?e.message:String(e);console.error(`Activation failed: ${r}`),process.exit(1)}break}case"cache-status":{console.log("Cache status requires an active client session."),console.log("Use this command within a running Neocortex client context."),process.exit(0);break}case"config":{const{configCliHandler:s}=await import("./commands/config.js"),o=await s(n);process.exit(o);break}case"refresh-memory":{const{refreshMemoryCliHandler:s}=await import("./commands/refresh-memory.js"),o=await s(n);process.exit(o);break}case"update":{console.log("To update Neocortex, run:"),console.log("  neocortex update"),console.log(""),console.log("Or manually:"),console.log("  npm install -g @ornexus/neocortex@latest"),process.exit(0);break}default:console.error(`Unknown command: ${t}`),console.error('Run "neocortex-client --help" for usage information.'),process.exit(1)}}u().catch(a=>{console.error(`Fatal error: ${a instanceof Error?a.message:String(a)}`),process.exit(1)});

package/packages/client/dist/commands/activate.js

@@ -1,8 +1,8 @@
-import{existsSync as $,mkdirSync as C,writeFileSync as V,readFileSync as x}from"node:fs";import{join as a,dirname as P}from"node:path";import{homedir as Y}from"node:os";import{fileURLToPath as X}from"node:url";import{LicenseClient as M}from"../license/license-client.js";import{EncryptedCache as S}from"../cache/encrypted-cache.js";import{getMachineFingerprint as E}from"../machine/fingerprint.js";import{updateAgentDescription as N}from"../agent/update-description.js";import{refreshStubs as h}from"../agent/refresh-stubs.js";import{updateAgentYaml as _}from"../agent/update-agent-yaml.js";import{saveSecureConfig as W,setSecureDirPermissions as w}from"../config/secure-config.js";import{DEFAULT_SERVER_URL as J}from"../constants.js";function b(){try{const e=X(import.meta.url);let t=P(e);for(let r=0;r<5;r++){try{const n=JSON.parse(x(a(t,"package.json"),"utf-8"));if(n.name==="@ornexus/neocortex"||n.name==="@neocortex/client")return n.version??"0.0.0"}catch{}t=P(t)}}catch{}return"0.0.0"}const i=a(Y(),".neocortex"),c=a(i,"config.json"),B=/^NX-(F|P|E)-[a-f0-9]+-[a-f0-9]+$/i,G=/^nxk_(?:[a-z]+_)?[a-f0-9]+_[a-f0-9]+$/;function z(e){if(!e||e.trim().length===0)return{valid:!1,error:"License key cannot be empty"};const t=e.trim().toUpperCase();return t.startsWith("NX-")?B.test(t)?{valid:!0}:{valid:!1,error:"Invalid license key format. Expected: NX-{TIER}-{ID} (e.g., NX-PRO-ABC-123)"}:{valid:!1,error:'License key must start with "NX-"'}}function q(e){if(!e||e.trim().length===0)return{valid:!1,error:"API key cannot be empty"};const t=e.trim();return t.startsWith("nxk_")?t.length<20?{valid:!1,error:"API key is too short"}:G.test(t)?{valid:!0}:{valid:!1,error:"Invalid API key format. Expected: nxk_{id}_{check} (e.g., nxk_abc123def456...)"}:{valid:!1,error:'API key must start with "nxk_"'}}function pe(){try{if($(c)){const e=x(c,"utf-8");return JSON.parse(e)}}catch{}return null}function A(e){C(i,{recursive:!0}),w(i);const t=a(i,"cache");if(C(t,{recursive:!0}),w(t),e.licenseKey||e.apiKey)W({serverUrl:e.serverUrl,mode:e.mode,machineId:e.machineId,activatedAt:e.activatedAt,tier:e.tier,licenseKey:e.licenseKey??e.apiKey});else{const r={configVersion:1,...e};V(c,JSON.stringify(r,null,2)+`
-`,"utf-8")}}async function he(e){const{licenseKey:t,serverUrl:r=J}=e;if(!t)return{success:!1,message:["No key provided.","","Get your license key at https://neocortex.sh/portal/login","","Usage:","  neocortex activate YOUR-LICENSE-KEY","  neocortex activate YOUR-API-KEY"].join(`
-`)};const n=t.trim();if(n.startsWith("nxk_")){const o=q(n);if(!o.valid)return{success:!1,message:`Invalid API key: ${o.error}`};const k=n.match(/^nxk_(free|pro|ent)_/),O={free:"free",pro:"pro",ent:"enterprise"},R=k?.[1]?O[k[1]]??"unknown":"unknown",I=E(),l=b();let m;try{const s=await fetch(`${r}/api/v1/license/activate-key`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({api_key:n,machine_id:I,client_version:l})});if(!s.ok)return{success:!1,message:`API key activation failed: ${(await s.json().catch(()=>({}))).message??`HTTP ${s.status}`}`};m=await s.json()}catch{return{success:!1,message:["Failed to connect to IP Protection Server.","","Possible causes:",`  - Server at ${r} is unreachable`,"  - Network connectivity issue","","Workaround: Use --local flag to run in local mode"].join(`
-`)}}const p=m.tier??R,T=a(i,"cache");try{await new S({cacheDir:T,passphrase:n}).set("neocortex:jwt:token",m.token,m.expires_in*1e3)}catch{}const L={serverUrl:r,mode:"remote",machineId:I,activatedAt:new Date().toISOString(),tier:p,apiKey:n};try{A(L)}catch(s){return{success:!1,message:`Failed to save configuration: ${s instanceof Error?s.message:"unknown error"}`}}const Z=h(l,{forceCreate:!0,targetFilter:"claude-code"});return h(l),N(l,p),_(l,p),{success:!0,message:["Neocortex activated successfully.","","Open your preferred platform (Claude Code, Cursor, VS Code, etc.)","and reference the Neocortex agent.","","Use *menu to see available commands or check the Docs in your Dashboard."].join(`
-`),tier:p,serverUrl:r,configPath:c}}const y=z(n);if(!y.valid)return{success:!1,message:`Invalid license key: ${y.error}`};const u=n,v=u.match(/^NX-(F|P|E)-/i),F={F:"free",P:"pro",E:"enterprise"},d=v?.[1]?F[v[1].toUpperCase()]??"unknown":"unknown",K=a(i,"cache"),U=new S({cacheDir:K,passphrase:u}),j=new M({serverUrl:r,licenseKey:u,cacheProvider:U});let g;try{g=await j.activate()}catch{return{success:!1,message:["Failed to connect to IP Protection Server.","","Possible causes:",`  - Server at ${r} is unreachable`,"  - Network connectivity issue","  - Server is still being deployed","","Workaround: Use --local flag to run in local mode"].join(`
+import{existsSync as V,mkdirSync as x,writeFileSync as Y,readFileSync as I}from"node:fs";import{join as o,dirname as C}from"node:path";import{homedir as X}from"node:os";import{fileURLToPath as W}from"node:url";import{LicenseClient as J}from"../license/license-client.js";import{EncryptedCache as P}from"../cache/encrypted-cache.js";import{getMachineFingerprint as S}from"../machine/fingerprint.js";import{updateAgentDescription as E}from"../agent/update-description.js";import{refreshStubs as h}from"../agent/refresh-stubs.js";import{updateAgentYaml as N}from"../agent/update-agent-yaml.js";import{saveSecureConfig as B,setSecureDirPermissions as _}from"../config/secure-config.js";import{DEFAULT_SERVER_URL as G}from"../constants.js";function b(){try{const e=W(import.meta.url);let t=C(e);for(let r=0;r<5;r++){try{const n=JSON.parse(I(o(t,"package.json"),"utf-8"));if(n.name==="@ornexus/neocortex"||n.name==="@neocortex/client")return n.version??"0.0.0"}catch{}t=C(t)}}catch{}return"0.0.0"}const i=o(X(),".neocortex"),c=o(i,"config.json"),z=/^NX-(F|P|E)-[a-f0-9]+-[a-f0-9]+$/i,q=/^nxk_(?:[a-z]+_)?[a-f0-9]+_[a-f0-9]+$/;function H(e){if(!e||e.trim().length===0)return{valid:!1,error:"License key cannot be empty"};const t=e.trim().toUpperCase();return t.startsWith("NX-")?z.test(t)?{valid:!0}:{valid:!1,error:"Invalid license key format. Expected: NX-{TIER}-{ID} (e.g., NX-PRO-ABC-123)"}:{valid:!1,error:'License key must start with "NX-"'}}function Q(e){if(!e||e.trim().length===0)return{valid:!1,error:"API key cannot be empty"};const t=e.trim();return t.startsWith("nxk_")?t.length<20?{valid:!1,error:"API key is too short"}:q.test(t)?{valid:!0}:{valid:!1,error:"Invalid API key format. Expected: nxk_{id}_{check} (e.g., nxk_abc123def456...)"}:{valid:!1,error:'API key must start with "nxk_"'}}function pe(){try{if(V(c)){const e=I(c,"utf-8");return JSON.parse(e)}}catch{}return null}function A(e){x(i,{recursive:!0}),_(i);const t=o(i,"cache");if(x(t,{recursive:!0}),_(t),e.licenseKey||e.apiKey)B({serverUrl:e.serverUrl,mode:e.mode,machineId:e.machineId,activatedAt:e.activatedAt,tier:e.tier,licenseKey:e.licenseKey??e.apiKey});else{const r={configVersion:1,...e};Y(c,JSON.stringify(r,null,2)+`
+`,"utf-8")}}async function he(e){const{licenseKey:t,serverUrl:r=G}=e;if(!t)return{success:!1,message:["No key provided.","","Get your license key at https://neocortex.sh/portal/login","","Usage:","  neocortex activate YOUR-LICENSE-KEY","  neocortex activate YOUR-API-KEY"].join(`
+`)};const n=t.trim();if(n.startsWith("nxk_")){const a=Q(n);if(!a.valid)return{success:!1,message:`Invalid API key: ${a.error}`};const k=n.match(/^nxk_(free|pro|ent)_/),R={free:"free",pro:"pro",ent:"enterprise"},T=k?.[1]?R[k[1]]??"unknown":"unknown",w=S(),l=b();let m;try{const s=await fetch(`${r}/api/v1/license/activate-key`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({api_key:n,machine_id:w,client_version:l})});if(!s.ok)return{success:!1,message:`API key activation failed: ${(await s.json().catch(()=>({}))).message??`HTTP ${s.status}`}`};m=await s.json()}catch{return{success:!1,message:["Failed to connect to IP Protection Server.","","Possible causes:",`  - Server at ${r} is unreachable`,"  - Network connectivity issue","","Workaround: Use --local flag to run in local mode"].join(`
+`)}}const p=m.tier??T,L=o(i,"cache");try{await new P({cacheDir:L,passphrase:n}).set("neocortex:jwt:token",m.token,m.expires_in*1e3)}catch{}const $={serverUrl:r,mode:"remote",machineId:w,activatedAt:new Date().toISOString(),tier:p,apiKey:n};try{A($)}catch(s){return{success:!1,message:`Failed to save configuration: ${s instanceof Error?s.message:"unknown error"}`}}const M=h(l,{forceCreate:!0,targetFilter:"claude-code"})+h(l);return E(l,p),N(l,p),{success:!0,message:["Neocortex activated successfully.","","Open your preferred platform (Claude Code, Cursor, VS Code, etc.)","and reference the Neocortex agent.",...M>0?["","Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files."]:[],"","Use *menu to see available commands or check the Docs in your Dashboard."].join(`
+`),tier:p,serverUrl:r,configPath:c}}const y=H(n);if(!y.valid)return{success:!1,message:`Invalid license key: ${y.error}`};const d=n,v=d.match(/^NX-(F|P|E)-/i),F={F:"free",P:"pro",E:"enterprise"},u=v?.[1]?F[v[1].toUpperCase()]??"unknown":"unknown",K=o(i,"cache"),U=new P({cacheDir:K,passphrase:d}),j=new J({serverUrl:r,licenseKey:d,cacheProvider:U});let g;try{g=await j.activate()}catch{return{success:!1,message:["Failed to connect to IP Protection Server.","","Possible causes:",`  - Server at ${r} is unreachable`,"  - Network connectivity issue","  - Server is still being deployed","","Workaround: Use --local flag to run in local mode"].join(`
 `)}}if(!g)return{success:!1,message:["License activation failed.","","Possible causes:","  - Invalid or expired license key","  - License already activated on another machine","  - Server rejected the activation request","","Check your license key and try again.","Contact support if the problem persists."].join(`
-`)};const D={serverUrl:r,mode:"remote",machineId:E(),activatedAt:new Date().toISOString(),tier:d,licenseKey:u};try{A(D)}catch(o){return{success:!1,message:`Failed to save config to ${c}: ${o instanceof Error?o.message:String(o)}`}}const f=b(),Q=h(f,{forceCreate:!0,targetFilter:"claude-code"});return h(f),N(f,d),_(f,d),{success:!0,message:["Neocortex activated successfully.","","Open your preferred platform (Claude Code, Cursor, VS Code, etc.)","and reference the Neocortex agent.","","Use *menu to see available commands or check the Docs in your Dashboard."].join(`
-`),tier:d,serverUrl:r,configPath:c}}export{he as activate,q as validateApiKeyFormat,z as validateLicenseKeyFormat};
+`)};const D={serverUrl:r,mode:"remote",machineId:S(),activatedAt:new Date().toISOString(),tier:u,licenseKey:d};try{A(D)}catch(a){return{success:!1,message:`Failed to save config to ${c}: ${a instanceof Error?a.message:String(a)}`}}const f=b(),O=h(f,{forceCreate:!0,targetFilter:"claude-code"})+h(f);return E(f,u),N(f,u),{success:!0,message:["Neocortex activated successfully.","","Open your preferred platform (Claude Code, Cursor, VS Code, etc.)","and reference the Neocortex agent.",...O>0?["","Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files."]:[],"","Use *menu to see available commands or check the Docs in your Dashboard."].join(`
+`),tier:u,serverUrl:r,configPath:c}}export{he as activate,Q as validateApiKeyFormat,H as validateLicenseKeyFormat};

package/packages/client/dist/commands/config.js

@@ -1 +1 @@
-import{SUBAGENT_APPROVAL_EVIDENCE as d,deriveSubagentHostApprovalPolicy as v}from"../subagent-approval-policy.js";import{detectPlatform as m}from"../adapters/platform-detector.js";import{ApprovalPolicyConfigError as E,getSubagentApprovalPolicy as b,resetSubagentApprovalMode as y,setSubagentApprovalMode as P}from"../config.js";function $(a,r){const t={evidence:d,...a.resolution,auditEvent:a.auditEvent?.event};return r?JSON.stringify(t,null,2):[d,`requested=${t.requestedMode}`,`effective=${t.effectiveMode}`,`source=${t.source}`,`scope=${t.scope}`,`platform=${t.platformTarget}`,`reason=${t.effectiveReason}`,`fallback=${t.fallbackMode}`,`fallbackReason=${t.fallbackReasonCode??"none"}`].join(" ")}async function w(a,r={}){const t=r.stdout??console.log,n=r.stderr??console.error;let s="status",l,i=!1,f=!1;for(let e=0;e<a.length;e+=1){const o=a[e];if(o==="--json")i=!0;else if(o==="--platform-target"){if(l=a[e+1],e+=1,!l)return n("Error: --platform-target requires a value."),1}else if(!f&&(o==="status"||o==="max"||o==="standard"||o==="disabled"||o==="reset"))s=o,f=!0;else return n("Error: expected status, max, standard, disabled, or reset."),1}const p=r.env??process.env,u=m({cwd:r.cwd??process.cwd(),env:p,targetFlag:l}),g=v(u.targetId),c={configFilePath:r.configFilePath,platformTarget:u.targetId,hostPolicy:g,now:r.now};try{const e=s==="status"?b(c):s==="reset"?y(c):P(s,c);return t($(e,i)),0}catch(e){return e instanceof E?(n(`Error: ${e.reasonCode}`),1):(n("Error: approval-policy-update-failed"),1)}}export{w as configCliHandler};
+import{SUBAGENT_APPROVAL_EVIDENCE as d,deriveSubagentHostApprovalPolicy as v}from"../policy/subagent-approval-policy.js";import{detectPlatform as m}from"../adapters/platform-detector.js";import{ApprovalPolicyConfigError as E,getSubagentApprovalPolicy as b,resetSubagentApprovalMode as y,setSubagentApprovalMode as P}from"../config.js";function $(a,r){const t={evidence:d,...a.resolution,auditEvent:a.auditEvent?.event};return r?JSON.stringify(t,null,2):[d,`requested=${t.requestedMode}`,`effective=${t.effectiveMode}`,`source=${t.source}`,`scope=${t.scope}`,`platform=${t.platformTarget}`,`reason=${t.effectiveReason}`,`fallback=${t.fallbackMode}`,`fallbackReason=${t.fallbackReasonCode??"none"}`].join(" ")}async function w(a,r={}){const t=r.stdout??console.log,n=r.stderr??console.error;let s="status",l,i=!1,f=!1;for(let e=0;e<a.length;e+=1){const o=a[e];if(o==="--json")i=!0;else if(o==="--platform-target"){if(l=a[e+1],e+=1,!l)return n("Error: --platform-target requires a value."),1}else if(!f&&(o==="status"||o==="max"||o==="standard"||o==="disabled"||o==="reset"))s=o,f=!0;else return n("Error: expected status, max, standard, disabled, or reset."),1}const p=r.env??process.env,u=m({cwd:r.cwd??process.cwd(),env:p,targetFlag:l}),g=v(u.targetId),c={configFilePath:r.configFilePath,platformTarget:u.targetId,hostPolicy:g,now:r.now};try{const e=s==="status"?b(c):s==="reset"?y(c):P(s,c);return t($(e,i)),0}catch(e){return e instanceof E?(n(`Error: ${e.reasonCode}`),1):(n("Error: approval-policy-update-failed"),1)}}export{w as configCliHandler};

package/packages/client/dist/commands/invoke.d.ts

@@ -15,8 +15,16 @@ import { type RunnerBootstrapPolicyDecision } from '../continuity/runner-bootstr
 import { type RunnerSchedulerBootstrapOptions, type RunnerSchedulerBootstrapResult } from '../runner/scheduler.js';
 import { type ContinuityProcessingSummaryCursorTarget } from '../continuity/continuity-client-state-store.js';
 import type { ProjectEvidenceEnvelope } from '../evidence/types.js';
+import { type InvokeEffectContext, type StrictReadOnlyInvokeEnvelope } from '../../../shared/dist/strict-readonly.js';
+import { type InvocationAdmissionResultV1 } from '../../../shared/dist/invocation/index.js';
 export declare const INVOKE_PAYLOAD_LIMIT_BYTES: number;
 export declare const INVOKE_PAYLOAD_WARNING_THRESHOLD_BYTES: number;
+export declare function getOrCreatePendingEpicIdempotencyKey(projectRoot: string, args: string): {
+    readonly key: string;
+    readonly fingerprint: string;
+};
+export declare function clearPendingEpicIdempotencyKey(projectRoot: string, fingerprint: string): void;
+export declare function recordPendingEpicReservation(projectRoot: string, fingerprint: string, claimId: string, epicId: string): void;
 interface InitProjectMemoryBootstrapSnapshot {
     readonly canonical: {
         readonly path: 'NEOCORTEX.md';
@@ -56,6 +64,8 @@ export interface InvokeOptions {
     readonly runnerBootstrapper?: InvokeRunnerSchedulerBootstrapper;
     /** Test/integration seam for recursion guard env; CLI callers leave unset. */
     readonly environment?: NodeJS.ProcessEnv;
+    /** P205.05 exact outer transport policy; never inferred from response metadata. */
+    readonly strictReadOnly?: boolean;
 }
 /**
  * Normalize the project root received from wrappers/CLI flags.
@@ -77,6 +87,8 @@ export interface InvokeResult {
     readonly errorCode?: string;
     readonly exitCode: number;
 }
+/** P205.07 client parity guard. Pure and deliberately exported for driver tests. */
+export declare function admitClientInvocation(args: string): InvocationAdmissionResultV1;
 type InvokeWatchFormat = 'plain' | 'json';
 interface InvokeWatchWritable {
     write(chunk: string): unknown;
@@ -95,6 +107,8 @@ export interface InvokeWatchOptions {
     readonly maxIdlePolls?: number;
     readonly maxPolls?: number;
     readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    /** Keep watch polling on the physical read-only SQLite path. */
+    readonly strictReadOnly?: boolean;
 }
 type InvokeWatchTargetResolutionState = 'inactive' | 'pending' | 'resolved' | 'unresolved' | 'malformed' | 'ambiguous' | 'multiple' | 'unsafe' | 'unavailable';
 type InvokeWatchSnapshotStatus = 'not_requested' | 'pending' | 'available' | 'empty' | 'unavailable' | 'unsafe';
@@ -215,6 +229,7 @@ export interface InvokeRunnerAutoBootstrapOptions {
     readonly platformTarget: string;
     readonly environment?: NodeJS.ProcessEnv;
     readonly bootstrapper?: InvokeRunnerSchedulerBootstrapper;
+    readonly effectAuthority?: InvokeEffectContext;
 }
 export declare function sanitizeInvokeCliOutput(instructions: string | undefined, metadata: Record<string, unknown> | undefined): {
     instructions: string;
@@ -230,6 +245,7 @@ export interface InvokeCliParsedOptions {
     readonly commandLevelWatch?: InvokeCommandLevelWatchMetadata;
     readonly serverUrl?: string;
     readonly platformTarget?: string;
+    readonly strictReadOnly: boolean;
 }
 type InvokeCommandLevelWatchCommand = 'goal' | 'loop' | 'jobs';
 type InvokeCommandLevelWatchOperation = 'create' | 'start' | 'resume' | 'run-once' | 'watch';
@@ -351,6 +367,8 @@ export interface StateSummary {
         readonly epics: number;
         readonly storyStatus: Readonly<Record<string, number>>;
         readonly epicStatus: Readonly<Record<string, number>>;
+        readonly epicLifecycle?: Readonly<Record<EpicLifecycleClassification, number>>;
+        readonly activeEpics?: number;
         readonly blockedStories: number;
     };
     readonly active: {
@@ -367,6 +385,7 @@ export interface StateSummary {
     readonly reasonCodes: readonly string[];
     readonly publicSafe: true;
 }
+export type EpicLifecycleClassification = 'active' | 'archived' | 'rolled-back' | 'synthetic' | 'orphan';
 export interface StateSnapshot {
     readonly schema_version?: number;
     readonly config: {
@@ -377,9 +396,15 @@ export interface StateSnapshot {
         readonly user_name?: string;
         readonly worktree_base?: string;
         readonly max_parallel_stories?: number;
+        readonly project_id?: string;
     };
     readonly stories: Record<string, Record<string, unknown>>;
     readonly epics: Record<string, Record<string, unknown>>;
+    /** Append-only public-safe reservations that prevent historical epic ID reuse. */
+    readonly epic_id_ledger?: {
+        readonly schema_version: 1;
+        readonly reserved_ids: readonly string[];
+    };
     readonly current_session?: StateSnapshotCurrentSession;
     /**
      * P141.01 -- request-only scope metadata. Never persisted to state.json.
@@ -425,6 +450,10 @@ export interface StateSnapshot {
     readonly projectEvidence?: ProjectEvidenceEnvelope;
 }
 export declare function shouldCollectProjectEvidenceForInvoke(args: string): boolean;
+interface InvokeResponse {
+    readonly instructions: string;
+    readonly metadata: Record<string, unknown>;
+}
 export interface InvokeArgsRef {
     readonly manifestId: string;
     readonly sha256?: string;
@@ -436,6 +465,11 @@ interface InvokeRequestBodyBase {
     readonly projectRoot: string;
     readonly stateSnapshot: StateSnapshot;
     readonly platformTarget?: string;
+    readonly projectId?: string;
+    readonly idempotencyKey?: string;
+    readonly registryVersion: string;
+    readonly registryChecksum: string;
+    readonly strictReadOnly?: StrictReadOnlyInvokeEnvelope;
 }
 export type InvokeRequestBody = InvokeRequestBodyBase & ({
     readonly args: string;
@@ -503,6 +537,28 @@ export declare function __resetSchemaDriftWarnedForTests(): void;
  */
 export declare function collectStateSnapshot(projectRoot: string): StateSnapshot;
 export declare function createFullStateSnapshotScope(trigger: string, snapshot: Pick<StateSnapshot, 'stories' | 'epics'>): FullStateSnapshotScope;
+interface SendResult {
+    readonly ok: boolean;
+    readonly status: number;
+    readonly data?: InvokeResponse;
+    readonly error?: string;
+    readonly errorBody?: Record<string, unknown>;
+}
+export interface InvokePhysicalRetryOptions {
+    readonly refreshToken?: () => Promise<string | null>;
+    readonly onTokenChanged?: (token: string) => void;
+    readonly sleep?: (milliseconds: number) => Promise<void>;
+    readonly maxAttempts?: number;
+    readonly allowReplayRetry?: boolean;
+}
+export declare function buildSignedInvokeAttempt(path: string, body: Record<string, unknown>, authToken: string, options?: {
+    readonly nowSeconds?: number;
+    readonly nonceBytes?: Uint8Array;
+}): {
+    readonly body: Buffer;
+    readonly headers: Record<string, string>;
+};
+export declare function postMaterializationJson(serverUrl: string, path: string, body: Record<string, unknown>, authToken: string, retryOptions?: InvokePhysicalRetryOptions): Promise<Record<string, unknown>>;
 export declare function computeInvokeRequestBodySizeBytes(body: InvokeRequestBody): number;
 export declare function createInvokePayloadTelemetry(body: InvokeRequestBody, payloadBytes?: number, reasonCodes?: readonly string[], options?: {
     readonly limitBytes?: number;
@@ -517,6 +573,14 @@ export declare function maybeRunInvokeRunnerAutoBootstrap(options: InvokeRunnerA
 export declare function watchContinuityProcessingSummaries(options: InvokeWatchOptions): Promise<InvokeWatchResult>;
 export declare function resolveInvokeCommandLevelWatch(args: string): InvokeCommandLevelWatchResolution;
 export declare function resolveInvokeWatchTarget(metadata: Record<string, unknown> | undefined, args: string): InvokeWatchTarget;
+export declare function sendInvokeRequest(serverUrl: string, body: InvokeRequestBody, authToken: string, retryOptions?: InvokePhysicalRetryOptions): Promise<SendResult>;
+export declare function sendEpicClaimAcknowledgement(serverUrl: string, authToken: string, input: {
+    readonly claimId: string;
+    readonly projectId: string;
+    readonly epicId: string;
+    readonly status: 'materialized' | 'abandoned';
+}, retryOptions?: InvokePhysicalRetryOptions): Promise<boolean>;
+export declare function acknowledgeMaterializedPendingEpicClaims(projectRoot: string, stateSnapshot: StateSnapshot, serverUrl: string, authToken: string, projectId: string | undefined, retryOptions?: InvokePhysicalRetryOptions): Promise<number>;
 /**
  * Execute the invoke command.
  *