@ornexus/neocortex 4.60.56 → 4.60.58
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/sbom.cdx.json +23 -23
- package/install.ps1 +1 -1
- package/install.sh +1 -1
- package/package.json +2 -2
- package/packages/client/dist/commands/invoke.d.ts +1 -1
- package/packages/client/dist/commands/invoke.js +54 -54
- package/packages/client/dist/private-execution/delivery.d.ts +22 -4
- package/packages/client/dist/private-execution/delivery.js +2 -2
- package/packages/client/dist/private-execution/isolated-admission.d.ts +9 -1
- package/packages/client/dist/private-execution/isolated-admission.js +2 -2
- package/packages/client/dist/private-execution/isolated-workspace.d.ts +2 -1
- package/packages/client/dist/private-execution/isolated-workspace.js +1 -1
- package/packages/client/dist/private-execution/root-checkpoint.js +1 -1
- package/targets-stubs/antigravity/gemini.md +1 -1
- package/targets-stubs/antigravity/skill/SKILL.md +1 -1
- package/targets-stubs/claude-code/neocortex-root.agent.yaml +1 -1
- package/targets-stubs/claude-code/neocortex-root.md +2 -2
- package/targets-stubs/claude-code/neocortex.agent.yaml +1 -1
- package/targets-stubs/claude-code/neocortex.md +2 -2
- package/targets-stubs/codex/AGENTS.md +1 -1
- package/targets-stubs/cursor/agent.md +2 -2
- package/targets-stubs/gemini-cli/agent.md +2 -2
- package/targets-stubs/opencode/neocortex-root.md +1 -1
- package/targets-stubs/vscode/neocortex.agent.md +2 -2
|
@@ -42,7 +42,21 @@ export interface PrivateExecutionPublicStepBindingV2 {
|
|
|
42
42
|
readonly hostKind: 'codex-cli';
|
|
43
43
|
readonly hostVersion: string;
|
|
44
44
|
}
|
|
45
|
-
export
|
|
45
|
+
export interface PrivateExecutionPublicEpicClaimBindingV3 {
|
|
46
|
+
readonly schemaVersion: 3;
|
|
47
|
+
readonly authorityKind: 'epic-claim';
|
|
48
|
+
readonly projectId: string;
|
|
49
|
+
readonly commandId: 'create-epic';
|
|
50
|
+
readonly stepId: string;
|
|
51
|
+
readonly claimId: string;
|
|
52
|
+
readonly epicId: string;
|
|
53
|
+
readonly stateSnapshotSha256: string;
|
|
54
|
+
readonly generationId: string;
|
|
55
|
+
readonly inputSha256: string;
|
|
56
|
+
readonly hostKind: 'codex-cli';
|
|
57
|
+
readonly hostVersion: string;
|
|
58
|
+
}
|
|
59
|
+
export type PrivateExecutionPublicBinding = PrivateExecutionPublicBindingV1 | PrivateExecutionPublicStepBindingV2 | PrivateExecutionPublicEpicClaimBindingV3;
|
|
46
60
|
export interface PrivateExecutionDescriptorV1 {
|
|
47
61
|
readonly schemaVersion: 1;
|
|
48
62
|
readonly leaseId: string;
|
|
@@ -57,9 +71,13 @@ export interface PrivateExecutionDescriptorV2 extends Omit<PrivateExecutionDescr
|
|
|
57
71
|
readonly schemaVersion: 2;
|
|
58
72
|
readonly binding: PrivateExecutionPublicStepBindingV2;
|
|
59
73
|
}
|
|
60
|
-
export
|
|
74
|
+
export interface PrivateExecutionDescriptorV3 extends Omit<PrivateExecutionDescriptorV1, 'schemaVersion' | 'binding'> {
|
|
75
|
+
readonly schemaVersion: 3;
|
|
76
|
+
readonly binding: PrivateExecutionPublicEpicClaimBindingV3;
|
|
77
|
+
}
|
|
78
|
+
export type PrivateExecutionDescriptor = PrivateExecutionDescriptorV1 | PrivateExecutionDescriptorV2 | PrivateExecutionDescriptorV3;
|
|
61
79
|
export declare function privateExecutionStateSnapshotSha256(stateSnapshot: unknown): string;
|
|
62
|
-
export declare function parsePrivateExecutionDescriptor(value: unknown, expected?:
|
|
80
|
+
export declare function parsePrivateExecutionDescriptor(value: unknown, expected?: Readonly<Record<string, unknown>>): PrivateExecutionDescriptor;
|
|
63
81
|
export declare function verifyPrivateExecutionMaterial(descriptor: PrivateExecutionDescriptor, material: unknown, nowMs?: number): string;
|
|
64
82
|
export interface PrivateExecutionDeliveryResponseV1 {
|
|
65
83
|
readonly schemaVersion: 1;
|
|
@@ -69,6 +87,6 @@ export interface PrivateExecutionDeliveryResponseV1 {
|
|
|
69
87
|
* The transport implementation must keep request and response bodies in memory.
|
|
70
88
|
* No retry is safe after a one-time lease may have been consumed.
|
|
71
89
|
*/
|
|
72
|
-
export declare function consumePrivateExecutionDelivery(rawDescriptor: unknown, expected:
|
|
90
|
+
export declare function consumePrivateExecutionDelivery(rawDescriptor: unknown, expected: Readonly<Record<string, unknown>>, postOnce: (body: {
|
|
73
91
|
readonly leaseId: string;
|
|
74
92
|
} & PrivateExecutionPublicBinding) => Promise<unknown>, nowMs?: number): Promise<string>;
|
|
@@ -1,3 +1,3 @@
|
|
|
1
|
-
import{createHash as
|
|
1
|
+
import{createHash as m}from"node:crypto";const g=`# Neocortex private execution pending
|
|
2
2
|
|
|
3
|
-
The authorized Codex CLI executor must consume the one-time delivery and produce a physical receipt.`;function
|
|
3
|
+
The authorized Codex CLI executor must consume the one-time delivery and produce a physical receipt.`;function l(r){if(!r||typeof r!="object"||Array.isArray(r))return!1;const o=r,t=o.metadata;if(Object.keys(o).sort().join(",")!=="instructions,metadata"||o.instructions!==g||!t||typeof t!="object"||Array.isArray(t))return!1;const e=t,s=e.privateExecution;let i;try{i=u(s)}catch{return!1}if(i.schemaVersion===2)return Object.keys(e).sort().join(",")===["mode","storyId","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&(e.mode==="step"&&e.resolvedTrigger==="research"&&i.binding.commandId==="research"||e.mode==="pipeline"&&e.resolvedTrigger==="exec"&&i.binding.commandId==="exec")&&e.storyId===i.binding.storyId&&e.stepId===i.binding.stepId;if(i.schemaVersion===3){const y=e.epicClaim,d=y&&typeof y=="object"&&!Array.isArray(y)?y:void 0;return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution","epicClaim"].sort().join(",")&&e.mode==="create-epic"&&e.resolvedTrigger==="create-epic"&&e.stepId===i.binding.stepId&&i.binding.commandId==="create-epic"&&!!d&&Object.keys(d).sort().join(",")===["schemaVersion","claimId","epicId","outcome","publicSafe"].sort().join(",")&&d.schemaVersion===1&&d.outcome==="reserved"&&d.publicSafe===!0&&d.claimId===i.binding.claimId&&d.epicId===i.binding.epicId}const a=e.privateExecutionRootAction,c=["mode","storyId","stepId","resolvedTrigger","gitLifecycleGraphAuthority","privateExecution",...a===void 0?[]:["privateExecutionRootAction"]],h=e.gitLifecycleGraphAuthority,p=h&&typeof h=="object"&&!Array.isArray(h)?h:void 0,n=a&&typeof a=="object"&&!Array.isArray(a)?a:void 0;return Object.keys(e).sort().join(",")===c.sort().join(",")&&e.mode==="yolo"&&e.resolvedTrigger==="yolo"&&typeof e.storyId=="string"&&typeof e.stepId=="string"&&!!p&&p.storyId===e.storyId&&p.graphRevision===i.binding.graphRevision&&i.binding.commandId==="yolo"&&i.binding.stepId===e.stepId&&(a===void 0||!!n&&Object.keys(n).sort().join(",")===["schemaVersion","action","storyId","executionBranch","graphRevision","publicSafe",...n.action==="checkpoint-epic-story"?["stepId"]:[]].sort().join(",")&&n.schemaVersion===1&&(n.action==="prepare-epic-checkout"||n.action==="checkpoint-epic-story")&&(n.action!=="checkpoint-epic-story"||n.stepId===e.stepId)&&n.publicSafe===!0&&n.storyId===e.storyId&&n.storyId===p.storyId&&n.executionBranch===p.executionBranch&&n.graphRevision===p.graphRevision)}function b(r){return m("sha256").update("private-step-state-v1\0").update(JSON.stringify(r)).digest("hex")}function u(r,o){if(!r||typeof r!="object"||Array.isArray(r))throw new Error("private-execution-descriptor-invalid");const t=r,e=t.binding,s=t.schemaVersion===2||t.schemaVersion===3,i=s?["schemaVersion","authorityKind","projectId","commandId","stepId",...t.schemaVersion===3?["claimId","epicId"]:["storyId"],"stateSnapshotSha256","generationId","inputSha256","hostKind","hostVersion"]:["commandId","generationId","graphRevision","hostKind","hostVersion","inputSha256","projectId","stepId"];if(Object.keys(t).sort().join(",")!==["schemaVersion","leaseId","materialSha256","byteLength","expiresAt","delivery","publicSafe","binding"].sort().join(",")||t.schemaVersion!==1&&!s||t.delivery!=="private-one-time"||t.publicSafe!==!0||typeof t.leaseId!="string"||!/^px_[a-f0-9]{48}$/.test(t.leaseId)||typeof t.materialSha256!="string"||!/^[a-f0-9]{64}$/.test(t.materialSha256)||!Number.isSafeInteger(t.byteLength)||t.byteLength<1||t.byteLength>256*1024||typeof t.expiresAt!="string"||!Number.isFinite(Date.parse(t.expiresAt))||!e||Object.keys(e).sort().join(",")!==i.sort().join(",")||Object.entries(e).some(([a,c])=>a!=="schemaVersion"&&(typeof c!="string"||c.length<1||c.length>256))||!/^[a-f0-9]{64}$/.test(String(e.inputSha256))||e.hostKind!=="codex-cli"||s&&!/^[a-f0-9]{64}$/.test(String(e.stateSnapshotSha256))||t.schemaVersion===2&&(e.schemaVersion!==2||e.authorityKind!=="state-snapshot"||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(String(e.storyId)))||t.schemaVersion===3&&(e.schemaVersion!==3||e.authorityKind!=="epic-claim"||e.commandId!=="create-epic"||!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(String(e.claimId))||!/^P[1-9][0-9]*$/.test(String(e.epicId)))||o&&Object.entries(o).some(([a,c])=>e[a]!==c))throw new Error("private-execution-descriptor-invalid");return t}function I(r,o,t=Date.now()){if(typeof o!="string"||t>=Date.parse(r.expiresAt)||Buffer.byteLength(o,"utf8")!==r.byteLength||m("sha256").update(o,"utf8").digest("hex")!==r.materialSha256)throw new Error("private-execution-material-invalid");return o}async function x(r,o,t,e=Date.now()){const s=u(r,o);if(e>=Date.parse(s.expiresAt))throw new Error("private-execution-material-expired");const i=await t({leaseId:s.leaseId,...s.binding});if(!i||typeof i!="object"||Array.isArray(i)||Object.keys(i).sort().join(",")!=="material,schemaVersion"||i.schemaVersion!==1)throw new Error("private-execution-delivery-invalid");return I(s,i.material,Math.max(e,Date.now()))}export{g as PRIVATE_EXECUTION_PUBLIC_INSTRUCTION_V1,x as consumePrivateExecutionDelivery,l as isPrivateExecutionPublicEnvelope,u as parsePrivateExecutionDescriptor,b as privateExecutionStateSnapshotSha256,I as verifyPrivateExecutionMaterial};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type
|
|
1
|
+
import { type PrivateYoloIsolatedWorkspaceV1 } from './isolated-workspace.js';
|
|
2
2
|
export interface PrivateYoloIsolatedAdmissionV1 {
|
|
3
3
|
readonly schemaVersion: 1;
|
|
4
4
|
readonly outcome: 'admitted-unverified';
|
|
@@ -11,3 +11,11 @@ export interface PrivateYoloIsolatedAdmissionV1 {
|
|
|
11
11
|
export declare function verifyPrivateYoloSnapshotBoundary(workspace: PrivateYoloIsolatedWorkspaceV1, frozenPaths: readonly string[], snapshotSha: string): void;
|
|
12
12
|
/** Bind one-shot admission to the physically verified C01 claim and graph. */
|
|
13
13
|
export declare function admitPrivateYoloFrozenWorkspace(workspace: PrivateYoloIsolatedWorkspaceV1, storyId: string, graphRevision: string, snapshotSha?: string): Promise<PrivateYoloIsolatedAdmissionV1>;
|
|
14
|
+
/**
|
|
15
|
+
* Admit only a generated epic whose physical artifacts agree with the reserved
|
|
16
|
+
* epic ID. The claim is still unverified: this checks structure and write scope,
|
|
17
|
+
* not the quality of the agent's planning or story acceptance criteria.
|
|
18
|
+
*/
|
|
19
|
+
export declare function admitPrivateEpicClaimWorkspace(workspace: PrivateYoloIsolatedWorkspaceV1, claimId: string, epicId: string, logicalFingerprint: string, pendingSidecarSha256: string): PrivateYoloIsolatedAdmissionV1;
|
|
20
|
+
/** Admit a state-bound step without granting the agent direct source writes. */
|
|
21
|
+
export declare function admitPrivateStateBoundStepWorkspace(workspace: PrivateYoloIsolatedWorkspaceV1, storyId: string): PrivateYoloIsolatedAdmissionV1;
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import{execFileSync as
|
|
2
|
-
`)])));if(
|
|
1
|
+
import{execFileSync as st,spawnSync as X}from"node:child_process";import{createHash as z}from"node:crypto";import{existsSync as nt,lstatSync as l,readFileSync as y,realpathSync as C}from"node:fs";import{isAbsolute as D,join as d,relative as j,sep as Z}from"node:path";import{isDeepStrictEqual as A}from"node:util";import{readPrivateYoloFrozenWriteSet as ct,verifyPrivateYoloCandidateWriteSet as at,verifyPrivateYoloCleanBaseline as ut}from"./clean-baseline.js";import{PRIVATE_EPIC_PENDING_SIDECAR as $}from"./isolated-workspace.js";const R=16*1024*1024,H=1024;function q(){const t={...process.env};for(const e of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete t[e];return t}function w(t,e){return st("git",[...e],{cwd:t,env:q(),stdio:["ignore","pipe","pipe"],timeout:3e4,maxBuffer:R})}function m(t,e){return w(t,e).toString("utf8").trim()}function S(t,e=!1){return w(t,["status","--porcelain=v1","-z","--untracked-files=all",...e?["--ignored=matching"]:[]])}function F(t){return!!t&&!D(t)&&!t.includes("\\")&&!t.includes("\0")&&!t.split("/").some(e=>!e||e==="."||e===".."||e===".git")}function x(t,e){const r=e.split("/");let o=t;for(const i of r.slice(0,-1)){o=d(o,i);try{const s=l(o);if(!s.isDirectory()||s.isSymbolicLink())throw new Error("path-boundary")}catch(s){if(s.code==="ENOENT")return;throw s}}try{const i=l(d(t,e));if(!i.isFile()||i.isSymbolicLink()||i.size>R)throw new Error("path-boundary")}catch(i){if(i.code!=="ENOENT")throw i}}function G(t,e=!1,r=!1){const o=[],i=[];for(const s of t.toString("utf8").split("\0").filter(Boolean)){if(s.length<4||s[2]!==" ")throw new Error("status-invalid");const n=s.slice(0,2),u=s.slice(3);if(!F(u)||n!=="??"&&n!==" M"&&n!==" D"&&!(r&&n==="!!"&&u===$))throw new Error("status-invalid");o.push(u),n==="??"&&i.push(u)}if(!e&&o.length===0||o.length>H||new Set(o).size!==o.length)throw new Error("status-invalid");return{paths:o.sort(),untracked:i.sort()}}function dt(t,e,r,o){const i=w(e,["ls-tree","-z",r,"--",o]).toString("utf8");if(!i)try{return l(d(t,o)),!1}catch(n){return n.code==="ENOENT"}const s=/^([0-7]{6}) blob [a-f0-9]{40,64}\t([^\0]+)\0$/.exec(i);if(!s||s[2]!==o||!["100644","100755"].includes(s[1]))return!1;try{const n=l(d(t,o));return!n.isFile()||n.isSymbolicLink()||n.size>R||!!(n.mode&73)!=(s[1]==="100755")?!1:y(d(t,o)).equals(w(e,["show",`${r}:${o}`]))}catch{return!1}}function M(t,e){try{const r=d(t,$),o=l(d(t,".neocortex")),i=l(r);return o.isDirectory()&&!o.isSymbolicLink()&&o.uid===process.getuid?.()&&(o.mode&18)===0&&i.isFile()&&!i.isSymbolicLink()&&i.uid===process.getuid?.()&&(i.mode&63)===0&&i.size>0&&i.size<=128*1024&&z("sha256").update(y(r)).digest("hex")===e}catch{return!1}}function W(t,e,r,o,i){const s=new Set(o),n=G(S(t),!0,!!i);return(!i||M(t,i))&&n.paths.every(u=>s.has(u)||u===$&&!!i&&M(t,i))&&o.every(u=>dt(t,e,r,u))}function ft(t,e){const r=X("git",["diff","--no-index","--binary","--no-ext-diff","--","/dev/null",e],{cwd:t,env:q(),encoding:"buffer",timeout:3e4,maxBuffer:R});if(r.error||r.status!==1||!Buffer.isBuffer(r.stdout)||r.stdout.byteLength===0)throw new Error("patch-invalid");return r.stdout}function K(t,e,r){const o=X("git",["apply",...r?["--check"]:[],"--binary","-"],{cwd:t,env:q(),input:e,encoding:"buffer",timeout:3e4,maxBuffer:R});if(o.error||o.status!==0)throw new Error("apply-failed")}function lt(t,e,r){const o=d(t,r),i=d(e,r);try{const s=l(o),n=l(i);return s.isFile()&&n.isFile()&&(s.mode&73)===(n.mode&73)&&y(o).equals(y(i))}catch(s){if(s.code!=="ENOENT")return!1;try{return l(o),!1}catch(n){if(n.code!=="ENOENT")return!1}try{return l(i),!1}catch(n){return n.code==="ENOENT"}}}function Tt(t,e,r){try{if(process.platform!=="linux"||t.schemaVersion!==1||!D(t.sourceRoot)||!D(t.workspacePath)||C(t.sourceRoot)!==t.sourceRoot||C(t.workspacePath)!==t.workspacePath||!l(t.workspacePath).isDirectory()||(l(t.workspacePath).mode&63)!==0||j(t.sourceRoot,t.workspacePath)===""||j(t.sourceRoot,t.workspacePath).split(Z)[0]!==".."||!/^[a-f0-9]{40,64}$/.test(t.baseSha)||!/^[a-f0-9]{40,64}$/.test(r)||m(t.sourceRoot,["rev-parse","--show-toplevel"])!==t.sourceRoot||m(t.workspacePath,["rev-parse","--show-toplevel"])!==t.workspacePath||m(t.sourceRoot,["rev-parse","HEAD"])!==t.baseSha||m(t.workspacePath,["rev-parse","HEAD"])!==r||m(t.sourceRoot,["symbolic-ref","--short","HEAD"])!==t.executionBranch||m(t.workspacePath,["symbolic-ref","--short","HEAD"])!==t.executionBranch||nt(d(t.workspacePath,".git","objects","info","alternates"))||S(t.workspacePath,!0).byteLength!==0||e.length===0||e.length>H||e.some(o=>!F(o))||new Set(e).size!==e.length)throw new Error("boundary-invalid");if(w(t.workspacePath,["merge-base","--is-ancestor",t.baseSha,r]),!W(t.sourceRoot,t.workspacePath,r,e))throw new Error("boundary-raced")}catch{throw new Error("private-execution-isolated-snapshot-unverified")}}function I(t,e,r,o){try{if(process.platform!=="linux"||t.schemaVersion!==1||!D(t.sourceRoot)||!D(t.workspacePath)||C(t.sourceRoot)!==t.sourceRoot||C(t.workspacePath)!==t.workspacePath||!l(t.workspacePath).isDirectory()||(l(t.workspacePath).mode&63)!==0||j(t.sourceRoot,t.workspacePath)===""||j(t.sourceRoot,t.workspacePath).split(Z)[0]!==".."||m(t.sourceRoot,["rev-parse","--show-toplevel"])!==t.sourceRoot||m(t.workspacePath,["rev-parse","--show-toplevel"])!==t.workspacePath||m(t.sourceRoot,["rev-parse","HEAD"])!==t.baseSha||!/^[a-f0-9]{40,64}$/.test(r)||m(t.workspacePath,["rev-parse","HEAD"])!==r||m(t.sourceRoot,["symbolic-ref","--short","HEAD"])!==t.executionBranch||m(t.workspacePath,["symbolic-ref","--short","HEAD"])!==t.executionBranch||e.length===0||e.length>H||e.some(c=>!F(c))||new Set(e).size!==e.length)throw new Error("authority-invalid");if(w(t.workspacePath,["merge-base","--is-ancestor",t.baseSha,r]),!W(t.sourceRoot,t.workspacePath,r,e,o))throw new Error("source-snapshot-mismatch");const i=S(t.workspacePath,!0),s=G(i),n=new Set(e);if(s.paths.some(c=>!n.has(c)))throw new Error("path-unclaimed");for(const c of s.paths)x(t.workspacePath,c),x(t.sourceRoot,c);const E=[w(t.workspacePath,["diff","--binary","--no-ext-diff","--no-textconv","HEAD","--"]),...s.untracked.map(c=>ft(t.workspacePath,c))],f=Buffer.concat(E.map(c=>Buffer.concat([c,Buffer.from(`
|
|
2
|
+
`)])));if(f.byteLength===0||f.byteLength>R||!S(t.workspacePath,!0).equals(i)||!W(t.sourceRoot,t.workspacePath,r,e,o))throw new Error("patch-raced");if(K(t.sourceRoot,f,!0),!S(t.workspacePath,!0).equals(i)||!W(t.sourceRoot,t.workspacePath,r,e,o))throw new Error("patch-raced");if(K(t.sourceRoot,f,!1),G(S(t.sourceRoot),!0,!!o).paths.some(c=>!n.has(c)&&c!==$)||o&&!M(t.sourceRoot,o)||e.some(c=>!lt(t.workspacePath,t.sourceRoot,c))||m(t.sourceRoot,["rev-parse","HEAD"])!==t.baseSha||m(t.sourceRoot,["symbolic-ref","--short","HEAD"])!==t.executionBranch)throw new Error("admission-raced");return Object.freeze({schemaVersion:1,outcome:"admitted-unverified",baseSha:t.baseSha,executionBranch:t.executionBranch,changedPaths:Object.freeze([...s.paths]),patchSha256:z("sha256").update(f).digest("hex")})}catch{throw new Error("private-execution-isolated-admission-unverified")}}async function Bt(t,e,r,o=t.baseSha){try{const i=await ct(t.sourceRoot,e,t.executionBranch,r),s=d(t.workspacePath,".neocortex","state.json"),n=l(s);if(!n.isFile()||n.isSymbolicLink()||n.size>R)throw new Error("candidate-state-invalid");at(y(s,"utf8"),e,i);const u=I(t,i,o);return await ut(t.sourceRoot,e,t.executionBranch,r),u}catch{throw new Error("private-execution-isolated-admission-unverified")}}function Dt(t,e,r,o,i){try{if(!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(e)||!/^P[1-9][0-9]*$/.test(r)||!/^[a-f0-9]{64}$/.test(o)||!/^[a-f0-9]{64}$/.test(i)||!M(t.sourceRoot,i))throw new Error("claim-invalid");const s=JSON.parse(y(d(t.sourceRoot,$),"utf8")),n=s&&typeof s=="object"&&!Array.isArray(s)?s.operations?.[o]:void 0;if(!n||typeof n!="object"||Array.isArray(n)||n.claimId!==e||n.epicId!==r)throw new Error("claim-sidecar-mismatch");const u=G(S(t.workspacePath,!0)),E=`docs/epics/epic-${r}.md`,f=".neocortex/state.json",v=new RegExp(`^docs/stories/${r}\\.[0-9]{2}\\.story\\.md$`),c=u.paths.filter(a=>v.test(a));if(!u.paths.includes(E)||!u.paths.includes(f)||c.length===0||c.length>99||u.paths.some(a=>a!==E&&a!==f&&a!=="NEOCORTEX.md"&&!v.test(a)))throw new Error("artifact-scope-invalid");const g=c.map(a=>a.slice(13,-9)).sort();if(g.some((a,h)=>a!==`${r}.${String(h+1).padStart(2,"0")}`))throw new Error("story-sequence-invalid");for(const a of[E,...c])try{throw l(d(t.sourceRoot,a)),new Error("artifact-already-exists")}catch(h){if(h.code!=="ENOENT")throw h}const N=(a,h)=>{x(t.workspacePath,a);const V=y(d(t.workspacePath,a),"utf8");return Buffer.byteLength(V)>R?null:/^---\r?\n([\s\S]{1,8192}?)\r?\n---(?:\r?\n|$)/.exec(V)?.[1]?.split(/\r?\n/).find(it=>it.startsWith(`${h}:`))?.slice(h.length+1).trim()?.replace(/^(["'])(.*)\1$/,"$2")??null};if(N(E,"id")!==r||c.some((a,h)=>N(a,"id")!==g[h]||N(a,"epic_id")!==r))throw new Error("artifact-id-invalid");x(t.workspacePath,f);const T=JSON.parse(y(d(t.workspacePath,f),"utf8"));if(!T||typeof T!="object"||Array.isArray(T))throw new Error("state-invalid");const b=T,Y=b.epics,L=b.stories,P=Y?.[r],O=b.epic_id_ledger;if(b.schema_version!==1||!P||P.id!==r||P.status!=="memory-updated"||!Array.isArray(P.stories)||P.stories.length!==g.length||P.stories.some((a,h)=>a!==g[h])||!L||g.some(a=>{const h=L[a];return!h||h.id!==a||h.epic_id!==r})||!O||!Array.isArray(O.reserved_ids)||!O.reserved_ids.includes(r))throw new Error("state-claim-mismatch");x(t.sourceRoot,f);const _=JSON.parse(y(d(t.sourceRoot,f),"utf8")),B=_.epics,p=_.stories;if(!B||!p||B[r]!==void 0||g.some(a=>p[a]!==void 0))throw new Error("state-claim-conflict");const{[r]:ht,...Q}=Y,U={...L};for(const a of g)delete U[a];const{epic_id_ledger:mt,last_updated:yt,...k}=_,{epic_id_ledger:Et,last_updated:_t,...tt}=b;if(!A(Q,B)||!A(U,p)||!A({...tt,epics:void 0,stories:void 0},{...k,epics:void 0,stories:void 0}))throw new Error("state-unrelated-drift");const J=_.epic_id_ledger&&typeof _.epic_id_ledger=="object"?_.epic_id_ledger.reserved_ids:void 0,{reserved_ids:vt,...et}=O,rt=_.epic_id_ledger&&typeof _.epic_id_ledger=="object"?_.epic_id_ledger:{schema_version:1},{reserved_ids:gt,...ot}=rt;if(J!==void 0&&(!Array.isArray(J)||J.some(a=>!O.reserved_ids.includes(a)))||!A(et,ot))throw new Error("ledger-drift");return I(t,u.paths,t.baseSha,i)}catch{throw new Error("private-execution-epic-claim-admission-unverified")}}function $t(t,e){try{if(!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(e))throw new Error("story-id-invalid");const r=".neocortex/state.json";x(t.sourceRoot,r),x(t.workspacePath,r);const o=JSON.parse(y(d(t.sourceRoot,r),"utf8")),i=JSON.parse(y(d(t.workspacePath,r),"utf8"));if(!o||typeof o!="object"||Array.isArray(o)||!i||typeof i!="object"||Array.isArray(i))throw new Error("state-invalid");const s=o,n=i,u=s.stories,E=n.stories,f=u?.[e],v=E?.[e],c=f?.files_to_modify;if(s.schema_version!==1||n.schema_version!==1||!u||!E||!f||!v||f.id!==e||v.id!==e||v.epic_id!==f.epic_id||!Array.isArray(c)||c.length===0||c.length>H||c.some(p=>typeof p!="string"||!F(p)||p.length>1024)||new Set(c).size!==c.length||!A(v.files_to_modify,c))throw new Error("write-set-invalid");const{[e]:g,...N}=u,{[e]:T,...b}=E,{stories:Y,last_updated:L,...P}=s,{stories:O,last_updated:_,...B}=n;if(!A(b,N)||!A(B,P))throw new Error("state-unrelated-drift");return I(t,[...c].sort(),t.baseSha)}catch{throw new Error("private-execution-state-step-admission-unverified")}}export{Dt as admitPrivateEpicClaimWorkspace,$t as admitPrivateStateBoundStepWorkspace,Bt as admitPrivateYoloFrozenWorkspace,Tt as verifyPrivateYoloSnapshotBoundary};
|
|
@@ -5,9 +5,10 @@ export interface PrivateYoloIsolatedWorkspaceV1 {
|
|
|
5
5
|
readonly baseSha: string;
|
|
6
6
|
readonly executionBranch: string;
|
|
7
7
|
}
|
|
8
|
+
export declare const PRIVATE_EPIC_PENDING_SIDECAR = ".neocortex/pending-epic-claims.json";
|
|
8
9
|
/**
|
|
9
10
|
* Build a separate object store and index from a clean, committed checkout.
|
|
10
11
|
* The caller must retain the workspace until its bytes are independently
|
|
11
12
|
* admitted into the root; this function never stages, commits, or deletes it.
|
|
12
13
|
*/
|
|
13
|
-
export declare function preparePrivateYoloIsolatedWorkspace(projectRoot: string, workspaceParent: string): PrivateYoloIsolatedWorkspaceV1;
|
|
14
|
+
export declare function preparePrivateYoloIsolatedWorkspace(projectRoot: string, workspaceParent: string, allowPendingEpicSidecar?: boolean): PrivateYoloIsolatedWorkspaceV1;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
import{execFileSync as
|
|
1
|
+
import{execFileSync as I}from"node:child_process";import{chmodSync as d,existsSync as _,lstatSync as p,mkdtempSync as D,realpathSync as f}from"node:fs";import{isAbsolute as E,join as l,resolve as h}from"node:path";const m=".neocortex/pending-epic-claims.json";function u(r,n){const c={...process.env};for(const e of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete c[e];return I("git",[...n],{cwd:r,env:c,stdio:["ignore","pipe","pipe"],timeout:3e4,maxBuffer:16*1024*1024})}function a(r,n){return u(r,n).toString("utf8").trim()}function y(r,n,c,e=!1){const i=u(r,["status","--porcelain=v1","-z","--untracked-files=all"]).toString("utf8");let s=!e;if(e)try{const o=p(l(r,".neocortex")),t=p(l(r,m));s=o.isDirectory()&&!o.isSymbolicLink()&&o.uid===process.getuid?.()&&(o.mode&18)===0&&t.isFile()&&!t.isSymbolicLink()&&t.uid===process.getuid?.()&&(t.mode&63)===0&&t.size>0&&t.size<=128*1024}catch{s=!1}return a(r,["rev-parse","HEAD"])===n&&a(r,["symbolic-ref","--quiet","--short","HEAD"])===c&&s&&(i.length===0||e&&i===`?? ${m}\0`)}function R(r,n,c=!1){let e,i;try{if(process.platform!=="linux"||typeof process.getuid!="function"||!E(r)||!E(n))throw new Error("path-invalid");if(e=h(r),i=h(n),f(e)!==e||!p(e).isDirectory()||f(i)!==i||!p(i).isDirectory()||p(i).uid!==process.getuid()||(p(i).mode&18)!==0||a(e,["rev-parse","--show-toplevel"])!==e)throw new Error("path-invalid");const s=a(e,["rev-parse","HEAD"]),o=a(e,["symbolic-ref","--quiet","--short","HEAD"]);if(!/^[a-f0-9]{40,64}$/.test(s)||!o||!y(e,s,o,c))throw new Error("source-dirty");const t=D(l(i,"p222-private-yolo-"));if(d(t,448),u(t,["init","-q"]),u(t,["fetch","-q","--no-tags","--depth=1",e,s]),u(t,["checkout","-q","-b",o,"FETCH_HEAD"]),!y(e,s,o,c)||a(t,["rev-parse","HEAD"])!==s||a(t,["symbolic-ref","--quiet","--short","HEAD"])!==o||u(t,["status","--porcelain=v1","-z","--untracked-files=all"]).byteLength!==0||_(l(t,".git","objects","info","alternates")))throw new Error("physical-mismatch");return Object.freeze({schemaVersion:1,sourceRoot:e,workspacePath:t,baseSha:s,executionBranch:o})}catch{throw new Error("private-execution-isolated-workspace-unverified")}}export{m as PRIVATE_EPIC_PENDING_SIDECAR,R as preparePrivateYoloIsolatedWorkspace};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
import{execFileSync as
|
|
1
|
+
import{execFileSync as f}from"node:child_process";import{createHash as l}from"node:crypto";import{resolve as I}from"node:path";import{beginDirectYoloStoryCommit as v,finalizeDirectYoloStoryCheckpoint as m,issueDirectYoloSetupLeaseHandoff as E}from"../git/direct-yolo-checkpoint.js";import{verifyPrivateYoloCleanBaseline as y}from"./clean-baseline.js";import{stagePrivateYoloIsolatedSessionBundle as g}from"./isolated-session.js";const _="step-5ce2a8c7";function n(a,e){const t={...process.env};for(const i of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete t[i];return f("git",[...e],{cwd:a,env:t,stdio:["ignore","pipe","pipe"],timeout:3e4,maxBuffer:16*1024*1024})}async function b(a,e){const t=I(a);if(e.schemaVersion!==1||e.action!=="checkpoint-epic-story"||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(e.storyId)||!/^[a-f0-9]{64}$/.test(e.graphRevision)||e.stepId!==_||!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/.test(e.executionBranch)||e.executionBranch.includes("..")||e.publicSafe!==!0)throw new Error("private-execution-root-checkpoint-invalid");await y(t,e.storyId,e.executionBranch,e.graphRevision);const i=await g(t,e.storyId,e.graphRevision),c=await E({projectRoot:t,storyId:e.storyId});if(!c.ok||c.value.bundleDigest!==i.bundleSha256)throw new Error("private-execution-root-checkpoint-handoff-denied");const o=await v({projectRoot:t,storyId:e.storyId});if(!o.ok)throw new Error("private-execution-root-checkpoint-begin-denied");if(o.value.graphRevision!==e.graphRevision||o.value.executionBranch!==e.executionBranch)throw new Error("private-execution-root-checkpoint-authority-drift");try{const r=n(t,["rev-parse","HEAD"]).toString("utf8").trim(),h=n(t,["symbolic-ref","--quiet","--short","HEAD"]).toString("utf8").trim(),u=n(t,["diff","--cached","--binary","--full-index"]),d=l("sha256").update(u).digest("hex");if(r!==o.value.baseSha||h!==o.value.executionBranch||d!==o.value.bundleDigest||d!==i.bundleSha256)throw new Error("private-execution-root-checkpoint-bundle-drift");n(t,["commit","-m",`fix(${e.storyId}): checkpoint direct yolo`,...o.value.trailers.flatMap(p=>["-m",p])])}catch(r){throw r instanceof Error&&r.message==="private-execution-root-checkpoint-bundle-drift"?r:new Error("private-execution-root-checkpoint-commit-failed")}const s=await m({projectRoot:t,storyId:e.storyId,push:!0});if(!s.ok)throw new Error("private-execution-root-checkpoint-finalize-denied");return Object.freeze({schemaVersion:1,outcome:"checkpoint-validated",storyId:e.storyId,headSha:s.value.headSha,publicSafe:!0})}export{b as runPrivateYoloRootCheckpoint};
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: neocortex-root
|
|
3
|
-
description: "🧠 Neocortex Root Agent v4.60.
|
|
3
|
+
description: "🧠 Neocortex Root Agent v4.60.58 | OrNexus Team"
|
|
4
4
|
model: opus
|
|
5
5
|
color: blue
|
|
6
6
|
tools:
|
|
@@ -108,7 +108,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
|
|
|
108
108
|
┌────────────────────────────────────────────────────────────┐
|
|
109
109
|
│ │
|
|
110
110
|
│ ####### N E O C O R T E X │
|
|
111
|
-
│ ### ######## v4.60.
|
|
111
|
+
│ ### ######## v4.60.58 │
|
|
112
112
|
│ ######### ##### │
|
|
113
113
|
│ ## ############## Development Orchestrator │
|
|
114
114
|
│ ## ### ###### ## OrNexus Team │
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: neocortex
|
|
3
|
-
description: "🧠 Neocortex v4.60.
|
|
3
|
+
description: "🧠 Neocortex v4.60.58 | OrNexus Team"
|
|
4
4
|
model: opus
|
|
5
5
|
color: blue
|
|
6
6
|
permissionMode: bypassPermissions
|
|
@@ -104,7 +104,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
|
|
|
104
104
|
┌────────────────────────────────────────────────────────────┐
|
|
105
105
|
│ │
|
|
106
106
|
│ ####### N E O C O R T E X │
|
|
107
|
-
│ ### ######## v4.60.
|
|
107
|
+
│ ### ######## v4.60.58 │
|
|
108
108
|
│ ######### ##### │
|
|
109
109
|
│ ## ############## Development Orchestrator │
|
|
110
110
|
│ ## ### ###### ## OrNexus Team │
|
|
@@ -28,7 +28,7 @@ Codex built-in commands or actions.
|
|
|
28
28
|
|
|
29
29
|
<!-- END: Plugin Conflict Prevention -->
|
|
30
30
|
|
|
31
|
-
# Neocortex v4.60.
|
|
31
|
+
# Neocortex v4.60.58 | OrNexus Team
|
|
32
32
|
|
|
33
33
|
You are a Development Orchestrator. All orchestration logic is delivered by the remote Neocortex server.
|
|
34
34
|
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: neocortex
|
|
3
|
-
description: "🧠 Neocortex v4.60.
|
|
3
|
+
description: "🧠 Neocortex v4.60.58 | OrNexus Team"
|
|
4
4
|
model: inherit
|
|
5
5
|
readonly: false
|
|
6
6
|
is_background: false
|
|
@@ -64,7 +64,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
|
|
|
64
64
|
┌────────────────────────────────────────────────────────────┐
|
|
65
65
|
│ │
|
|
66
66
|
│ ####### N E O C O R T E X │
|
|
67
|
-
│ ### ######## v4.60.
|
|
67
|
+
│ ### ######## v4.60.58 │
|
|
68
68
|
│ ######### ##### │
|
|
69
69
|
│ ## ############## Development Orchestrator │
|
|
70
70
|
│ ## ### ###### ## OrNexus Team │
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: neocortex-root
|
|
3
|
-
description: "🧠 Neocortex v4.60.
|
|
3
|
+
description: "🧠 Neocortex v4.60.58 | OrNexus Team"
|
|
4
4
|
kind: local
|
|
5
5
|
tools:
|
|
6
6
|
# File operations (Gemini CLI built-ins)
|
|
@@ -62,7 +62,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
|
|
|
62
62
|
┌────────────────────────────────────────────────────────────┐
|
|
63
63
|
│ │
|
|
64
64
|
│ ####### N E O C O R T E X │
|
|
65
|
-
│ ### ######## v4.60.
|
|
65
|
+
│ ### ######## v4.60.58 │
|
|
66
66
|
│ ######### ##### │
|
|
67
67
|
│ ## ############## Development Orchestrator │
|
|
68
68
|
│ ## ### ###### ## OrNexus Team │
|
|
@@ -58,7 +58,7 @@ explicit server opt-in rather than a local assumption.
|
|
|
58
58
|
┌────────────────────────────────────────────────────────────┐
|
|
59
59
|
│ │
|
|
60
60
|
│ ####### N E O C O R T E X │
|
|
61
|
-
│ ### ######## v4.60.
|
|
61
|
+
│ ### ######## v4.60.58 │
|
|
62
62
|
│ ######### ##### │
|
|
63
63
|
│ ## ############## Development Orchestrator │
|
|
64
64
|
│ ## ### ###### ## OrNexus Team │
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: "neocortex"
|
|
3
|
-
description: "Neocortex v4.60.
|
|
3
|
+
description: "Neocortex v4.60.58 | OrNexus Team"
|
|
4
4
|
tools:
|
|
5
5
|
# Read / Edit (built-in tool sets)
|
|
6
6
|
- read
|
|
@@ -68,7 +68,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
|
|
|
68
68
|
┌────────────────────────────────────────────────────────────┐
|
|
69
69
|
│ │
|
|
70
70
|
│ ####### N E O C O R T E X │
|
|
71
|
-
│ ### ######## v4.60.
|
|
71
|
+
│ ### ######## v4.60.58 │
|
|
72
72
|
│ ######### ##### │
|
|
73
73
|
│ ## ############## Development Orchestrator │
|
|
74
74
|
│ ## ### ###### ## OrNexus Team │
|