@ornexus/neocortex 4.60.64 → 4.60.66

package/packages/client/dist/private-execution/root-memory-writer.js

@@ -1 +1 @@
-import{execFileSync as z}from"node:child_process";import{createHash as N}from"node:crypto";import{lstatSync as y,readFileSync as E,readlinkSync as D,realpathSync as v}from"node:fs";import{join as O,resolve as l}from"node:path";import{rootProjectMemoryPaths as j}from"../../../shared/dist/yoloop/root-memory-effect.js";import{parseRefreshMemoryArgs as x,refreshProjectMemoryTargets as M,verifyProjectMemoryTargets as J}from"../commands/refresh-memory.js";import{assertProjectMemoryPaths as w}from"../memory/project-memory-path-scope.js";import{classifyProjectMemoryUpdate as P}from"../memory/project-memory-writer.js";const d=r=>N("sha256").update(r).digest("hex"),h=new WeakMap,n=()=>{throw new Error("private-root-memory-writer-unverified")};function c(r,...e){return z("git",e,{cwd:r,encoding:"utf8",stdio:["ignore","pipe","ignore"],env:Object.fromEntries(Object.entries(process.env).filter(([i])=>!i.startsWith("GIT_"))),timeout:3e4,maxBuffer:2*1024*1024})}function m(r,e){if(!j().includes(e))return n();w(r,[e]);const i=O(r,e);let o;try{o=y(i)}catch(a){return a.code==="ENOENT"?{kind:"absent",sha256:null}:n()}if(o.uid!==process.getuid?.()||o.nlink!==1||(o.mode&18)!==0&&!o.isSymbolicLink())return n();if(o.isSymbolicLink()){const a=D(i);return l(r,e,"..",a)!==O(l(r),"NEOCORTEX.md")?n():{kind:"symlink",sha256:d(a),linkTarget:a}}return!o.isFile()||o.size>512*1024?n():{kind:"regular",sha256:d(E(i))}}function G(r){const e=l(r.snapshotRoot),i=l(r.backupDirectory),o=y(e),a=y(i);if(!o.isDirectory()||o.uid!==process.getuid?.()||(o.mode&63)!==0||v(e)!==e||!a.isDirectory()||a.isSymbolicLink()||a.uid!==process.getuid?.()||(a.mode&63)!==0||v(i)!==i||i===e||i.startsWith(e+"/")||!/^[a-f0-9]{40,64}$/.test(r.expectedSnapshotSha)||!Array.isArray(r.notes)||r.notes.length<1||r.notes.length>8||r.notes.some(t=>typeof t!="string"||Buffer.byteLength(t)<1||Buffer.byteLength(t)>512)||c(e,"rev-parse","HEAD").trim()!==r.expectedSnapshotSha||c(e,"status","--porcelain=v1","--untracked-files=all").length!==0)return n();for(const t of r.notes)P(t);const f=j(),g=new Map(f.map(t=>[t,m(e,t)])),S=x(["--project-root",e,...r.notes.flatMap(t=>["--note",t])]);if(M({...S,dryRun:!0}).some(t=>t.files.some(s=>s.fallbackReason||s.remediationDebt||s.mode==="compatibility-materialized-fallback"||!f.includes(s.relativeFile))))return n();for(const[t,s]of g)if(JSON.stringify(m(e,t))!==JSON.stringify(s))return n();if(M({...S,backupDirectory:i}).some(t=>t.files.some(s=>s.fallbackReason||s.remediationDebt||s.mode==="compatibility-materialized-fallback"||!f.includes(s.relativeFile))))return n();const R=J(x(["--project-root",e,"--verify"])),u=c(e,"status","--porcelain=v1","-z","--untracked-files=all").split("\0").filter(Boolean).map(t=>t.slice(3));if(u.some(t=>!f.includes(t))||c(e,"rev-parse","HEAD").trim()!==r.expectedSnapshotSha)return n();const p=f.flatMap(t=>{const s=g.get(t),k=m(e,t);return JSON.stringify(s)===JSON.stringify(k)?[]:[Object.freeze({path:t,before:Object.freeze(s),after:Object.freeze(k)})]});if(p.some(t=>!u.includes(t.path))||u.some(t=>!p.some(s=>s.path===t)))return n();const b=Object.freeze(Object.create(null));return h.set(b,Object.freeze({snapshotRoot:e,sourceSnapshotSha:r.expectedSnapshotSha,notesSha256:d(JSON.stringify(r.notes)),files:Object.freeze(p),verification:Object.freeze(R)})),b}function U(r){return h.get(r)}function X(r){const e=h.get(r);if(!e||c(e.snapshotRoot,"rev-parse","HEAD").trim()!==e.sourceSnapshotSha)return n();const i=c(e.snapshotRoot,"status","--porcelain=v1","-z","--untracked-files=all").split("\0").filter(Boolean).map(o=>o.slice(3)).sort();return JSON.stringify(i)!==JSON.stringify(e.files.map(o=>o.path).sort())||e.files.some(o=>JSON.stringify(m(e.snapshotRoot,o.path))!==JSON.stringify(o.after))?n():e}export{G as executeRootMemoryWriter,U as projectRootMemoryWriterExecution,m as rootMemoryFileState,X as verifyRootMemoryWriterExecution};
+import{execFileSync as z}from"node:child_process";import{createHash as N}from"node:crypto";import{lstatSync as y,readFileSync as E,readlinkSync as D,realpathSync as v}from"node:fs";import{join as O,resolve as l}from"node:path";import{rootProjectMemoryPaths as j}from"./shared-root-memory-types.js";import{parseRefreshMemoryArgs as x,refreshProjectMemoryTargets as M,verifyProjectMemoryTargets as J}from"../commands/refresh-memory.js";import{assertProjectMemoryPaths as w}from"../memory/project-memory-path-scope.js";import{classifyProjectMemoryUpdate as P}from"../memory/project-memory-writer.js";const d=r=>N("sha256").update(r).digest("hex"),h=new WeakMap,n=()=>{throw new Error("private-root-memory-writer-unverified")};function c(r,...e){return z("git",e,{cwd:r,encoding:"utf8",stdio:["ignore","pipe","ignore"],env:Object.fromEntries(Object.entries(process.env).filter(([i])=>!i.startsWith("GIT_"))),timeout:3e4,maxBuffer:2*1024*1024})}function m(r,e){if(!j().includes(e))return n();w(r,[e]);const i=O(r,e);let o;try{o=y(i)}catch(a){return a.code==="ENOENT"?{kind:"absent",sha256:null}:n()}if(o.uid!==process.getuid?.()||o.nlink!==1||(o.mode&18)!==0&&!o.isSymbolicLink())return n();if(o.isSymbolicLink()){const a=D(i);return l(r,e,"..",a)!==O(l(r),"NEOCORTEX.md")?n():{kind:"symlink",sha256:d(a),linkTarget:a}}return!o.isFile()||o.size>512*1024?n():{kind:"regular",sha256:d(E(i))}}function G(r){const e=l(r.snapshotRoot),i=l(r.backupDirectory),o=y(e),a=y(i);if(!o.isDirectory()||o.uid!==process.getuid?.()||(o.mode&63)!==0||v(e)!==e||!a.isDirectory()||a.isSymbolicLink()||a.uid!==process.getuid?.()||(a.mode&63)!==0||v(i)!==i||i===e||i.startsWith(e+"/")||!/^[a-f0-9]{40,64}$/.test(r.expectedSnapshotSha)||!Array.isArray(r.notes)||r.notes.length<1||r.notes.length>8||r.notes.some(t=>typeof t!="string"||Buffer.byteLength(t)<1||Buffer.byteLength(t)>512)||c(e,"rev-parse","HEAD").trim()!==r.expectedSnapshotSha||c(e,"status","--porcelain=v1","--untracked-files=all").length!==0)return n();for(const t of r.notes)P(t);const f=j(),g=new Map(f.map(t=>[t,m(e,t)])),S=x(["--project-root",e,...r.notes.flatMap(t=>["--note",t])]);if(M({...S,dryRun:!0}).some(t=>t.files.some(s=>s.fallbackReason||s.remediationDebt||s.mode==="compatibility-materialized-fallback"||!f.includes(s.relativeFile))))return n();for(const[t,s]of g)if(JSON.stringify(m(e,t))!==JSON.stringify(s))return n();if(M({...S,backupDirectory:i}).some(t=>t.files.some(s=>s.fallbackReason||s.remediationDebt||s.mode==="compatibility-materialized-fallback"||!f.includes(s.relativeFile))))return n();const R=J(x(["--project-root",e,"--verify"])),u=c(e,"status","--porcelain=v1","-z","--untracked-files=all").split("\0").filter(Boolean).map(t=>t.slice(3));if(u.some(t=>!f.includes(t))||c(e,"rev-parse","HEAD").trim()!==r.expectedSnapshotSha)return n();const p=f.flatMap(t=>{const s=g.get(t),k=m(e,t);return JSON.stringify(s)===JSON.stringify(k)?[]:[Object.freeze({path:t,before:Object.freeze(s),after:Object.freeze(k)})]});if(p.some(t=>!u.includes(t.path))||u.some(t=>!p.some(s=>s.path===t)))return n();const b=Object.freeze(Object.create(null));return h.set(b,Object.freeze({snapshotRoot:e,sourceSnapshotSha:r.expectedSnapshotSha,notesSha256:d(JSON.stringify(r.notes)),files:Object.freeze(p),verification:Object.freeze(R)})),b}function U(r){return h.get(r)}function X(r){const e=h.get(r);if(!e||c(e.snapshotRoot,"rev-parse","HEAD").trim()!==e.sourceSnapshotSha)return n();const i=c(e.snapshotRoot,"status","--porcelain=v1","-z","--untracked-files=all").split("\0").filter(Boolean).map(o=>o.slice(3)).sort();return JSON.stringify(i)!==JSON.stringify(e.files.map(o=>o.path).sort())||e.files.some(o=>JSON.stringify(m(e.snapshotRoot,o.path))!==JSON.stringify(o.after))?n():e}export{G as executeRootMemoryWriter,U as projectRootMemoryWriterExecution,m as rootMemoryFileState,X as verifyRootMemoryWriterExecution};

package/packages/client/dist/private-execution/shared-private-admission-types.d.ts

@@ -0,0 +1,34 @@
+export interface PrivateYoloSkippedPredecessor {
+    readonly stepId: 'step-a8ce5c64';
+    readonly featureFlagId: 'property-testing';
+    readonly enabled: boolean;
+    readonly tier: 'free' | 'pro' | 'enterprise';
+    readonly publicSafe: true;
+}
+export interface PrivateQaTierSkippedPredecessor {
+    readonly stepId: 'step-b2fe7cb5';
+    readonly featureGate: 'validate-tests';
+    readonly reason: 'subscription-tier';
+    readonly tier: 'free';
+    readonly publicSafe: true;
+}
+export type PrivateQaSkippedPredecessor = PrivateYoloSkippedPredecessor | PrivateQaTierSkippedPredecessor;
+export interface PrivateQaStructuralAdmission {
+    readonly schemaVersion: 1;
+    readonly kind: 'server-private-qa-structural-admission';
+    readonly stepId: 'step-8721319d';
+    readonly generationId: string;
+    readonly graphRevision: string;
+    readonly topologyGenerationId: string;
+    readonly tier: 'free' | 'pro' | 'enterprise';
+    readonly checks: {
+        readonly classifiedAssetDelivery: true;
+        readonly licensedCommandAdmission: true;
+        readonly registeredStatusMapping: true;
+        readonly prerequisiteStateAdmitted: true;
+    };
+    readonly publicSafe: true;
+}
+export declare function isPrivateYoloSkippedPredecessors(value: unknown): value is readonly PrivateYoloSkippedPredecessor[];
+export declare function isPrivateQaSkippedPredecessors(value: unknown): value is readonly PrivateQaSkippedPredecessor[];
+export declare function isPrivateQaStructuralAdmission(value: unknown): value is PrivateQaStructuralAdmission;

package/packages/client/dist/private-execution/shared-private-admission-types.js

@@ -0,0 +1 @@
+const i="step-a8ce5c64",o="step-b2fe7cb5",n="step-8721319d";function a(t){return Array.isArray(t)&&t.length<=1&&t.every(e=>{if(!e||typeof e!="object"||Array.isArray(e))return!1;const r=e;return Object.keys(r).sort().join("|")===["stepId","featureFlagId","enabled","tier","publicSafe"].sort().join("|")&&r.stepId===i&&r.featureFlagId==="property-testing"&&typeof r.enabled=="boolean"&&["free","pro","enterprise"].includes(String(r.tier))&&(r.enabled===!1||r.tier==="free")&&r.publicSafe===!0})}function p(t){if(!Array.isArray(t)||t.length>2)return!1;const e=[];for(const r of t){if(a([r])){e.push(r.stepId);continue}if(!r||typeof r!="object"||Array.isArray(r))return!1;const s=r;if(Object.keys(s).sort().join("|")!==["stepId","featureGate","reason","tier","publicSafe"].sort().join("|")||s.stepId!==o||s.featureGate!=="validate-tests"||s.reason!=="subscription-tier"||s.tier!=="free"||s.publicSafe!==!0)return!1;e.push(s.stepId)}return new Set(e).size===e.length&&(t.length<2||e[0]===i&&e[1]===o&&t[0].tier==="free")}function c(t){if(!t||typeof t!="object"||Array.isArray(t))return!1;const e=t,r=e.checks;return Object.keys(e).sort().join("|")===["schemaVersion","kind","stepId","generationId","graphRevision","topologyGenerationId","tier","checks","publicSafe"].sort().join("|")&&e.schemaVersion===1&&e.kind==="server-private-qa-structural-admission"&&e.stepId===n&&typeof e.generationId=="string"&&/^sha256:[a-f0-9]{64}$/.test(e.generationId)&&typeof e.graphRevision=="string"&&/^[a-f0-9]{64}$/.test(e.graphRevision)&&typeof e.topologyGenerationId=="string"&&/^sha256:[a-f0-9]{64}$/.test(e.topologyGenerationId)&&["free","pro","enterprise"].includes(String(e.tier))&&e.publicSafe===!0&&!!r&&typeof r=="object"&&!Array.isArray(r)&&Object.keys(r).sort().join("|")===["classifiedAssetDelivery","licensedCommandAdmission","registeredStatusMapping","prerequisiteStateAdmitted"].sort().join("|")&&Object.values(r).every(s=>s===!0)}export{p as isPrivateQaSkippedPredecessors,c as isPrivateQaStructuralAdmission,a as isPrivateYoloSkippedPredecessors};

package/packages/client/dist/private-execution/shared-project-validation.d.ts

@@ -0,0 +1,17 @@
+/** Standalone-client shadow of bounded project validation declarations. */
+export declare const PROJECT_VALIDATION_KINDS: readonly ["unit", "integration", "contract", "bdd-example", "e2e"];
+export type ProjectValidationKind = typeof PROJECT_VALIDATION_KINDS[number];
+export interface ProjectValidationSource {
+    readonly path: string;
+    readonly content: string;
+}
+export interface ProjectValidationDeclaration {
+    readonly kind: ProjectValidationKind;
+    readonly command: string;
+    readonly sourcePaths: readonly string[];
+}
+export declare function readProjectValidationCommands(storyId: string, sources: readonly ProjectValidationSource[]): {
+    declared: boolean;
+    invalid: boolean;
+    commands: readonly ProjectValidationDeclaration[];
+};

package/packages/client/dist/private-execution/shared-project-validation.js

@@ -0,0 +1 @@
+const P=["unit","integration","contract","bdd-example","e2e"];function x(p,a){const o=new Map;let c=!1,t=!1;const h=new Set(["story","spec","tasks"].map(e=>`docs/stories/${p}.${e}.md`));if(a.length>3||new Set(a.map(e=>e.path)).size!==a.length)return{declared:!0,invalid:!0,commands:[]};for(const e of a){if(!h.has(e.path)||Buffer.byteLength(e.content)>131072){t=!0,c=!0;continue}let n=!1,d=!1,m=0,r=0;for(const g of e.content.split(/\r?\n/)){const i=g.trim();if(/^(?:```|~~~)/.test(i)){d=!d;continue}if(d)continue;if(/^##\s+/.test(i)){n&&r===0&&(t=!0),n=i==="## Validation Commands",n&&(c=!0,m++,r=0,m>1&&(t=!0));continue}if(!n||!i)continue;const l=/^- (unit|integration|contract|bdd-example|e2e): `([^`]{1,220})`$/.exec(i);if(!l){t=!0;continue}const f=l[1],s=l[2];if(!/^[A-Za-z0-9_./-]+(?: [A-Za-z0-9_./:@%+=,-]+)*$/.test(s)||/(?:token|password|license_key|secret|credential)=|(?:https?|ssh):\/\/|@[^ /]+\.[A-Za-z]/i.test(s)||s.split(" ").some(w=>w.split("/").includes(".."))){t=!0;continue}r++;const u=o.get(f);if(u&&u.command!==s||u?.sourcePaths.includes(e.path)){t=!0;continue}o.set(f,{kind:f,command:s,sourcePaths:[...u?.sourcePaths??[],e.path]})}n&&r===0&&(t=!0)}return c&&!o.has("unit")&&(t=!0),{declared:c,invalid:t,commands:[...o.values()]}}export{P as PROJECT_VALIDATION_KINDS,x as readProjectValidationCommands};

package/packages/client/dist/private-execution/shared-root-memory-types.d.ts

@@ -0,0 +1,37 @@
+/** Standalone-client shadow of the public root-memory effect contract. */
+import { getProjectMemoryTarget, listProjectMemoryTargets } from '../memory/shared-project-memory-types.js';
+export { getProjectMemoryTarget, listProjectMemoryTargets };
+export interface RootMemoryFileState {
+    readonly kind: 'absent' | 'regular' | 'symlink';
+    readonly sha256: string | null;
+    readonly linkTarget?: string;
+}
+export interface RootMemoryFileEffect {
+    readonly path: string;
+    readonly before: RootMemoryFileState;
+    readonly after: RootMemoryFileState;
+}
+export interface RootProjectMemoryEffect {
+    readonly schemaVersion: 'RootProjectMemoryEffect/1';
+    readonly producer: 'root-project-memory';
+    readonly storyId: string;
+    readonly epicId: string;
+    readonly executionBranch: string;
+    readonly sourceHeadSha: string;
+    readonly sourceSnapshotSha: string;
+    readonly memorySnapshotSha: string;
+    readonly graphRevision: string;
+    readonly childClaimRevision: string;
+    readonly setupSessionId: string;
+    readonly rootQaReceiptId: string;
+    readonly proposalSha256: string;
+    readonly canonicalSha256: string;
+    readonly projectionSha256: string;
+    readonly projectionFileCount: number;
+    readonly files: readonly RootMemoryFileEffect[];
+    readonly recordedAt: string;
+    readonly publicSafe: true;
+}
+export declare function canonicalRootMemoryEffectJson(effect: RootProjectMemoryEffect): string;
+export declare function rootProjectMemoryPaths(): readonly string[];
+export declare function isRootProjectMemoryEffect(value: unknown): value is RootProjectMemoryEffect;

package/packages/client/dist/private-execution/shared-root-memory-types.js

@@ -0,0 +1 @@
+import{getProjectMemoryTarget as u,listProjectMemoryTargets as l}from"../memory/shared-project-memory-types.js";function S(n){const s=e=>Array.isArray(e)?e.map(s):e!==null&&typeof e=="object"?Object.fromEntries(Object.keys(e).sort().map(i=>[i,s(e[i])])):e;return JSON.stringify(s(n))}function y(){return[...new Set(["NEOCORTEX.md",...l().flatMap(n=>[n.primaryFile,...n.secondaryFiles.filter(s=>s.scope==="project").map(s=>s.path)])])].sort()}function g(n){const s=t=>t!==null&&typeof t=="object"&&!Array.isArray(t)?t:void 0,e=s(n),i=["schemaVersion","producer","storyId","epicId","executionBranch","sourceHeadSha","sourceSnapshotSha","memorySnapshotSha","graphRevision","childClaimRevision","setupSessionId","rootQaReceiptId","proposalSha256","canonicalSha256","projectionSha256","projectionFileCount","files","recordedAt","publicSafe"];if(!e||Object.keys(e).sort().join("|")!==i.sort().join("|")||e.schemaVersion!=="RootProjectMemoryEffect/1"||e.producer!=="root-project-memory"||e.publicSafe!==!0||typeof e.storyId!="string"||!/^P[1-9][0-9]*\.[0-9]+$/.test(e.storyId)||e.epicId!==e.storyId.split(".")[0]||e.executionBranch!==`epic/${e.epicId}`||["sourceHeadSha","sourceSnapshotSha","memorySnapshotSha"].some(t=>typeof e[t]!="string"||!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(e[t]))||["graphRevision","childClaimRevision","rootQaReceiptId","proposalSha256","canonicalSha256","projectionSha256"].some(t=>typeof e[t]!="string"||!/^[a-f0-9]{64}$/.test(e[t]))||typeof e.setupSessionId!="string"||!/^setup-[a-f0-9]{64}$/.test(e.setupSessionId)||typeof e.recordedAt!="string"||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(e.recordedAt)||!Number.isFinite(Date.parse(e.recordedAt))||new Date(e.recordedAt).toISOString()!==e.recordedAt||!Number.isSafeInteger(e.projectionFileCount)||e.projectionFileCount<1||e.projectionFileCount>128||!Array.isArray(e.files)||e.files.length>128)return!1;const d=new Set(y()),a=new Set,c=(t,o,p)=>{const r=s(t);if(!r||!["absent","regular","symlink"].includes(String(r.kind))||Object.keys(r).sort().join("|")!==["kind","sha256",...r.kind==="symlink"?["linkTarget"]:[]].sort().join("|"))return!1;if(r.kind==="absent")return!p&&r.sha256===null;if(typeof r.sha256!="string"||!/^[a-f0-9]{64}$/.test(r.sha256)||o==="NEOCORTEX.md"&&r.kind!=="regular")return!1;const f="../".repeat(o.split("/").length-1)+"NEOCORTEX.md";return r.kind!=="symlink"||typeof r.linkTarget=="string"&&r.linkTarget.length<=1024&&(p?r.linkTarget===f:r.linkTarget.split("/").filter(h=>h!==".").join("/")===f)};return e.files.every(t=>{const o=s(t);return!o||Object.keys(o).sort().join("|")!=="after|before|path"||typeof o.path!="string"||!d.has(o.path)||a.has(o.path)||!c(o.before,o.path,!1)||!c(o.after,o.path,!0)?!1:(a.add(o.path),!0)})}export{S as canonicalRootMemoryEffectJson,u as getProjectMemoryTarget,g as isRootProjectMemoryEffect,l as listProjectMemoryTargets,y as rootProjectMemoryPaths};

package/packages/client/dist/private-execution/ux-source-validation.js

@@ -1 +1 @@
-import{parse as H}from"@babel/parser";import{lstatSync as q,readFileSync as G}from"node:fs";import{join as U,posix as V}from"node:path";const Q=1024*1024,ee=1e5,P=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;function p(){throw new Error("private-execution-ux-source-unverified")}function o(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function k(e,r){const t=q(U(e,r));(!t.isFile()||t.isSymbolicLink()||t.size<1||t.size>Q)&&p();const s=new TextDecoder("utf-8",{fatal:!0}).decode(G(U(e,r)));return(!s.trim()||s.includes("\0"))&&p(),s}function w(e,r){const t=H(k(e,r),{sourceType:"module",plugins:["typescript","jsx"],errorRecovery:!1});let s=0;const i=[t];for(;i.length>0;){const f=i.pop();if(o(f)){++s>ee&&p();for(const[n,l]of Object.entries(f))n==="loc"||n==="tokens"||n==="comments"||n==="errors"||(Array.isArray(l)?i.push(...l):o(l)&&i.push(l))}}return t}function S(e){const r=e.program;return(!o(r)||!Array.isArray(r.body))&&p(),r.body.filter(o)}function m(e,r){if(!o(e)||e.type!=="ObjectExpression"||!Array.isArray(e.properties))return;const t=e.properties.filter(s=>o(s)&&s.type==="ObjectProperty"&&s.computed!==!0&&o(s.key)&&(s.key.name===r||s.key.value===r));return t.length===1&&o(t[0])?t[0].value:void 0}function E(e){return o(e)&&e.type==="StringLiteral"&&typeof e.value=="string"?e.value:void 0}function u(e){return o(e)&&e.type==="Identifier"&&typeof e.name=="string"?e.name:void 0}function A(e){return e.type==="VariableDeclaration"&&Array.isArray(e.declarations)?e.declarations.filter(o):[]}function b(e){let r=e;for(let t=0;t<4&&o(r)&&["TSAsExpression","TSSatisfiesExpression","TSTypeAssertion","ParenthesizedExpression"].includes(String(r.type));t++)r=r.expression;return r}function te(e,r){const t=e.flatMap(A).filter(s=>u(s.id)===r);return t.length===1?b(t[0].init):void 0}function K(e,r){for(const t of e){if(t.type!=="ExportNamedDeclaration"||!o(t.declaration))continue;const s=t.declaration;if(s.type==="FunctionDeclaration"&&o(s.id)&&s.id.name===r)return s;const i=A(s).find(f=>o(f.id)&&f.id.name===r);if(i)return b(i.init)}}function g(e,r){const t=[],s=[e];for(;s.length>0;){const i=s.pop();if(o(i)){i.type===r&&t.push(i);for(const[f,n]of Object.entries(i))f==="loc"||f==="comments"||(Array.isArray(n)?s.push(...n):o(n)&&s.push(n))}}return t}function z(e){return e.screenId.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,64)}function R(e){return e.split(/[^A-Za-z0-9]+/).filter(Boolean).map(r=>`${r.charAt(0).toUpperCase()}${r.slice(1).toLowerCase()}`).join("")}function Z(e,r,t){const s=[];for(const i of e){if(i.type!=="ImportDeclaration"||i.importKind==="type"||!o(i.source)||typeof i.source.value!="string"||!i.source.value.startsWith("./")&&!i.source.value.startsWith("../"))continue;const f=V.normalize(V.join(V.dirname(r),i.source.value));if(!(f!==t.screenViewPath&&f!==t.screenViewPath.replace(/\.tsx$/,"")))for(const n of Array.isArray(i.specifiers)?i.specifiers:[])o(n)&&n.type==="ImportSpecifier"&&o(n.imported)&&n.imported.name===t.screenViewExport&&n.importKind!=="type"&&o(n.local)&&typeof n.local.name=="string"&&s.push(n.local.name)}return s.length!==1&&p(),s[0]}function re(e,r){return g(e,"JSXOpeningElement").some(t=>o(t.name)&&t.name.name===r)}function j(e,r,t){const s=e.filter(i=>i.type==="ImportDeclaration"&&o(i.source)&&i.source.value===r).flatMap(i=>Array.isArray(i.specifiers)?i.specifiers:[]).filter(i=>o(i)&&i.type==="ImportSpecifier"&&o(i.imported)&&i.imported.name===t&&o(i.local)&&typeof i.local.name=="string").map(i=>i.local);return s.length===1?s[0].name:void 0}function Y(e,r,t){return o(e)&&e.type==="CallExpression"&&o(e.callee)&&e.callee.type==="MemberExpression"&&e.callee.computed!==!0&&u(e.callee.object)===r&&u(e.callee.property)===t}function ne(e,r){const t=j(r,"storybook/test","within"),s=j(r,"storybook/test","userEvent"),i=j(r,"storybook/test","expect");if(!t||!s||!i||!Array.isArray(e.params)||!o(e.params[0])||e.params[0].type!=="ObjectPattern"||!Array.isArray(e.params[0].properties)||!e.params[0].properties.some(a=>o(a)&&o(a.key)&&a.key.name==="canvasElement"&&o(a.value)&&a.value.name==="canvasElement"))return!1;const f=g(e.body,"VariableDeclarator"),n=f.filter(a=>o(a.init)&&a.init.type==="CallExpression"&&u(a.init.callee)===t&&Array.isArray(a.init.arguments)&&a.init.arguments.length===1&&u(a.init.arguments[0])==="canvasElement").map(a=>u(a.id)).filter(a=>!!a),l=f.filter(a=>n.some(O=>Y(a.init,O,"getByRole")&&Array.isArray(a.init.arguments)&&E(a.init.arguments[0])==="button"&&typeof E(m(a.init.arguments[1],"name"))=="string"&&!!E(m(a.init.arguments[1],"name"))?.trim())).map(a=>u(a.id)).filter(a=>!!a);if(l.length===0)return!1;const d=g(e.body,"AwaitExpression").map(a=>a.argument),x=d.some(a=>Y(a,s,"tab")&&Array.isArray(a.arguments)&&a.arguments.length===0),h=d.some(a=>o(a)&&a.type==="CallExpression"&&o(a.callee)&&a.callee.type==="MemberExpression"&&u(a.callee.property)==="toHaveFocus"&&o(a.callee.object)&&a.callee.object.type==="CallExpression"&&u(a.callee.object.callee)===i&&Array.isArray(a.callee.object.arguments)&&l.includes(u(a.callee.object.arguments[0])??""));return x&&h}function se(e,r){const t=b(e);if(o(t)&&["ArrowFunctionExpression","FunctionExpression"].includes(String(t.type)))return t;const s=u(t);if(!s||!o(t))return;const i=r.flatMap(d=>A(d).filter(x=>u(x.id)===s).map(x=>({kind:d.kind,declaration:x})));if(i.length!==1||i[0].kind!=="const")return;const f=i[0].declaration;if(typeof f.start!="number"||typeof t.start!="number"||f.start>=t.start)return;const n={body:r};if(g(n,"AssignmentExpression").some(d=>u(b(d.left))===s)||g(n,"UpdateExpression").some(d=>u(b(d.argument))===s))return;const l=b(f.init);return o(l)&&["ArrowFunctionExpression","FunctionExpression"].includes(String(l.type))?l:void 0}function oe(e,r,t){const s=`src/screens/${z(r)}/${z(r)}`,i=w(e,r.screenViewPath),f=K(S(i),r.screenViewExport);(!f||g(f,"JSXElement").length+g(f,"JSXFragment").length===0)&&p();const n=w(e,r.appRoutePath),l=Z(S(n),r.appRoutePath,r);re(n,l)||p();const d=`${s}.stories.tsx`,x=w(e,d),h=S(x),a=t==="storybook-react-vite"?"@storybook/react-vite":"@storybook/nextjs-vite";(!j(h,a,"Meta")||!j(h,a,"StoryObj"))&&p();const O=Z(h,d,r),D=h.filter(c=>c.type==="ExportDefaultDeclaration");D.length!==1&&p();const v=b(D[0].declaration),C=u(v)?te(h,u(v)):v;(u(m(C,"component"))!==O||E(m(C,"title"))!==`Screens/${r.screenId}`)&&p();const M=new Set;for(const c of r.states)for(const y of r.viewports){const J=`${R(c)}${R(y)}`;M.add(J);const I=K(h,J);if((!o(I)||I.type!=="ObjectExpression"||E(m(m(I,"args"),"state"))!==c||E(m(m(m(I,"parameters"),"viewport"),"defaultViewport"))!==y)&&p(),r.critical&&(c==="success"||c==="recovery")){const L=se(m(I,"play"),h);(!L||!ne(L,h))&&p()}}const F=h.filter(c=>c.type==="ExportNamedDeclaration");F.some(c=>!o(c.declaration)||A(c.declaration).length!==1||Array.isArray(c.specifiers)&&c.specifiers.length>0)&&p();const T=F.flatMap(c=>A(c.declaration)).map(c=>u(c.id)).filter(c=>!!c);(T.length!==M.size||T.some(c=>!M.has(c)))&&p();const W=w(e,`${s}.fixtures.ts`);S(W).filter(c=>c.type==="ExportNamedDeclaration").flatMap(c=>o(c.declaration)?A(c.declaration):[]).some(c=>{const y=m(c.init,"synthetic");return o(y)&&y.type==="BooleanLiteral"&&y.value===!0&&m(c.init,"data")!==void 0})||p();const X=w(e,`${s}.handlers.ts`),_=S(X);(!_.some(c=>c.type==="ImportDeclaration"&&o(c.source)&&c.source.value==="msw"&&Array.isArray(c.specifiers)&&c.specifiers.some(y=>o(y)&&o(y.imported)&&y.imported.name==="http"))||!_.some(c=>c.type==="ExportNamedDeclaration"&&o(c.declaration)&&A(c.declaration).some(y=>o(y.init)&&y.init.type==="ArrayExpression"&&Array.isArray(y.init.elements)&&y.init.elements.length>0))||!g(X,"CallExpression").some(c=>o(c.callee)&&c.callee.type==="MemberExpression"&&o(c.callee.object)&&c.callee.object.name==="http"))&&p();const N=k(e,`${s}.mdx`),B=new RegExp(`import\\s+\\*\\s+as\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"]\\./${z(r)}\\.stories(?:\\.tsx)?['"];?\\r?\\n(?:[ \\t]*\\r?\\n)+`).exec(N);(!/import\s+\{\s*Meta\s*\}\s+from\s+['"]@storybook\/addon-docs\/blocks['"]/.test(N)||!B||!N.includes(`<Meta of={${B[1]}} />`))&&p()}function $(e){return Array.isArray(e)?`[${e.map($).join(",")}]`:e&&typeof e=="object"?`{${Object.entries(e).sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>`${JSON.stringify(r)}:${$(t)}`).join(",")}}`:JSON.stringify(e)??"null"}function ie(e){const r=$(e);let t=2166136261;for(let s=0;s<r.length;s++)t^=r.charCodeAt(s),t=Math.imul(t,16777619);return`uxm-${(t>>>0).toString(16).padStart(8,"0")}`}function ae(e,r){let t;try{t=JSON.parse(k(e,"docs/architecture/ux-coverage-manifest.json"))}catch{p()}(!o(t)||t.schemaVersion!==1||t.manifestId!=="P201-UX-MANIFEST-01"||!Array.isArray(t.entries)||typeof t.fingerprint!="string"||Object.keys(t).sort().join(",")!=="entries,fingerprint,manifestId,schemaVersion")&&p(),t.fingerprint!==ie(t.entries)&&p();const s=new Map;for(const n of r.screens)for(const l of n.states)for(const d of n.viewports)s.set(`Screens/${n.screenId}/${l}/${d}`,{screen:n,state:l,viewport:d});t.entries.length!==s.size&&p();const i=new Set;let f="";for(const n of t.entries){(!o(n)||typeof n.storyId!="string"||i.has(n.storyId))&&p(),f&&f.localeCompare(n.storyId)>=0&&p(),f=n.storyId,Object.keys(n).sort().join(",")!=="approvalEvidenceIds,fixtureId,handlerIds,journeyIds,screenId,screenViewPath,state,storyId,viewport"&&p(),i.add(n.storyId);const l=s.get(n.storyId);(!l||n.screenId!==l.screen.screenId||n.state!==l.state||n.viewport!==l.viewport||n.screenViewPath!==l.screen.screenViewPath||!Array.isArray(n.approvalEvidenceIds)||$([...n.approvalEvidenceIds].sort())!==$([...l.screen.approvalEvidenceIds].sort())||!Array.isArray(n.journeyIds)||n.journeyIds.length<1||n.journeyIds.some(d=>typeof d!="string"||!P.test(d))||new Set(n.journeyIds).size!==n.journeyIds.length||typeof n.fixtureId!="string"||!P.test(n.fixtureId)||!Array.isArray(n.handlerIds)||n.handlerIds.length<1||n.handlerIds.some(d=>typeof d!="string"||!P.test(d))||new Set(n.handlerIds).size!==n.handlerIds.length)&&p()}}function de(e,r){try{for(const[t,s]of[["docs/architecture/ux-design.md","P201-UX-STORYBOOK-01"],["docs/architecture/storybook-ux-contract.md","P201-UX-STORYBOOK-01"]])k(e,t).includes(s)||p();for(const t of r.screens)oe(e,t,r.adapterId);ae(e,r)}catch{p()}}export{de as validateUxCandidateSource};
+import{parse as H}from"@babel/parser";import{lstatSync as q,readFileSync as G}from"node:fs";import{join as K,posix as V}from"node:path";const Q=1024*1024,ee=1e5,z=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;function p(){throw new Error("private-execution-ux-source-unverified")}function o(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function j(e,t){const r=q(K(e,t));(!r.isFile()||r.isSymbolicLink()||r.size<1||r.size>Q)&&p();const s=new TextDecoder("utf-8",{fatal:!0}).decode(G(K(e,t)));return(!s.trim()||s.includes("\0"))&&p(),s}function I(e,t){const r=H(j(e,t),{sourceType:"module",plugins:["typescript","jsx"],errorRecovery:!1});let s=0;const i=[r];for(;i.length>0;){const l=i.pop();if(o(l)){++s>ee&&p();for(const[n,f]of Object.entries(l))n==="loc"||n==="tokens"||n==="comments"||n==="errors"||(Array.isArray(f)?i.push(...f):o(f)&&i.push(f))}}return r}function E(e){const t=e.program;return(!o(t)||!Array.isArray(t.body))&&p(),t.body.filter(o)}function m(e,t){if(!o(e)||e.type!=="ObjectExpression"||!Array.isArray(e.properties))return;const r=e.properties.filter(s=>o(s)&&s.type==="ObjectProperty"&&s.computed!==!0&&o(s.key)&&(s.key.name===t||s.key.value===t));return r.length===1&&o(r[0])?r[0].value:void 0}function g(e){return o(e)&&e.type==="StringLiteral"&&typeof e.value=="string"?e.value:void 0}function y(e){return o(e)&&e.type==="Identifier"&&typeof e.name=="string"?e.name:void 0}function x(e){return e.type==="VariableDeclaration"&&Array.isArray(e.declarations)?e.declarations.filter(o):[]}function D(e){let t=e;for(let r=0;r<4&&o(t)&&["TSAsExpression","TSSatisfiesExpression","TSTypeAssertion","ParenthesizedExpression"].includes(String(t.type));r++)t=t.expression;return t}function te(e,t){const r=e.flatMap(x).filter(s=>y(s.id)===t);return r.length===1?D(r[0].init):void 0}function R(e,t){for(const r of e){if(r.type!=="ExportNamedDeclaration"||!o(r.declaration))continue;const s=r.declaration;if(s.type==="FunctionDeclaration"&&o(s.id)&&s.id.name===t)return s;const i=x(s).find(l=>o(l.id)&&l.id.name===t);if(i)return D(i.init)}}function A(e,t){const r=[],s=[e];for(;s.length>0;){const i=s.pop();if(o(i)){i.type===t&&r.push(i);for(const[l,n]of Object.entries(i))l==="loc"||l==="comments"||(Array.isArray(n)?s.push(...n):o(n)&&s.push(n))}}return r}function P(e){return e.screenId.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,64)}function U(e){return e.split(/[^A-Za-z0-9]+/).filter(Boolean).map(t=>`${t.charAt(0).toUpperCase()}${t.slice(1).toLowerCase()}`).join("")}function Z(e,t,r){const s=[];for(const i of e){if(i.type!=="ImportDeclaration"||i.importKind==="type"||!o(i.source)||typeof i.source.value!="string"||!i.source.value.startsWith("./")&&!i.source.value.startsWith("../"))continue;const l=V.normalize(V.join(V.dirname(t),i.source.value));if(!(l!==r.screenViewPath&&l!==r.screenViewPath.replace(/\.tsx$/,"")))for(const n of Array.isArray(i.specifiers)?i.specifiers:[])o(n)&&n.type==="ImportSpecifier"&&o(n.imported)&&n.imported.name===r.screenViewExport&&n.importKind!=="type"&&o(n.local)&&typeof n.local.name=="string"&&s.push(n.local.name)}return s.length!==1&&p(),s[0]}function re(e,t){return A(e,"JSXOpeningElement").some(r=>o(r.name)&&r.name.name===t)}function w(e,t,r){const s=e.filter(i=>i.type==="ImportDeclaration"&&o(i.source)&&i.source.value===t).flatMap(i=>Array.isArray(i.specifiers)?i.specifiers:[]).filter(i=>o(i)&&i.type==="ImportSpecifier"&&o(i.imported)&&i.imported.name===r&&o(i.local)&&typeof i.local.name=="string").map(i=>i.local);return s.length===1?s[0].name:void 0}function Y(e,t,r){return o(e)&&e.type==="CallExpression"&&o(e.callee)&&e.callee.type==="MemberExpression"&&e.callee.computed!==!0&&y(e.callee.object)===t&&y(e.callee.property)===r}function ne(e,t){const r=w(t,"storybook/test","within"),s=w(t,"storybook/test","userEvent"),i=w(t,"storybook/test","expect");if(!r||!s||!i||!Array.isArray(e.params)||!o(e.params[0])||e.params[0].type!=="ObjectPattern"||!Array.isArray(e.params[0].properties)||!e.params[0].properties.some(a=>o(a)&&o(a.key)&&a.key.name==="canvasElement"&&o(a.value)&&a.value.name==="canvasElement"))return!1;const l=A(e.body,"VariableDeclarator"),n=l.filter(a=>o(a.init)&&a.init.type==="CallExpression"&&y(a.init.callee)===r&&Array.isArray(a.init.arguments)&&a.init.arguments.length===1&&y(a.init.arguments[0])==="canvasElement").map(a=>y(a.id)).filter(a=>!!a),f=l.filter(a=>n.some(k=>Y(a.init,k,"getByRole")&&Array.isArray(a.init.arguments)&&g(a.init.arguments[0])==="button"&&typeof g(m(a.init.arguments[1],"name"))=="string"&&!!g(m(a.init.arguments[1],"name"))?.trim())).map(a=>y(a.id)).filter(a=>!!a);if(f.length===0)return!1;const u=A(e.body,"AwaitExpression").map(a=>a.argument),$=u.some(a=>Y(a,s,"tab")&&Array.isArray(a.arguments)&&a.arguments.length===0),h=u.some(a=>o(a)&&a.type==="CallExpression"&&o(a.callee)&&a.callee.type==="MemberExpression"&&y(a.callee.property)==="toHaveFocus"&&o(a.callee.object)&&a.callee.object.type==="CallExpression"&&y(a.callee.object.callee)===i&&Array.isArray(a.callee.object.arguments)&&f.includes(y(a.callee.object.arguments[0])??""));return $&&h}function se(e,t,r){const s=`src/screens/${P(t)}/${P(t)}`,i=I(e,t.screenViewPath),l=R(E(i),t.screenViewExport);(!l||A(l,"JSXElement").length+A(l,"JSXFragment").length===0)&&p();const n=I(e,t.appRoutePath),f=Z(E(n),t.appRoutePath,t);re(n,f)||p();const u=`${s}.stories.tsx`,$=I(e,u),h=E($),a=r==="storybook-react-vite"?"@storybook/react-vite":"@storybook/nextjs-vite";(!w(h,a,"Meta")||!w(h,a,"StoryObj"))&&p();const k=Z(h,u,t),C=h.filter(c=>c.type==="ExportDefaultDeclaration");C.length!==1&&p();const O=D(C[0].declaration),T=y(O)?te(h,y(O)):O;(y(m(T,"component"))!==k||g(m(T,"title"))!==`Screens/${t.screenId}`)&&p();const v=new Set;for(const c of t.states)for(const d of t.viewports){const L=`${U(c)}${U(d)}`;v.add(L);const b=R(h,L);if((!o(b)||b.type!=="ObjectExpression"||g(m(m(b,"args"),"state"))!==c||g(m(m(m(b,"parameters"),"viewport"),"defaultViewport"))!==d)&&p(),t.critical&&(c==="success"||c==="recovery")){const N=m(b,"play");(!o(N)||!["ArrowFunctionExpression","FunctionExpression"].includes(String(N.type))||!ne(N,h))&&p()}}const F=h.filter(c=>c.type==="ExportNamedDeclaration");F.some(c=>!o(c.declaration)||x(c.declaration).length!==1||Array.isArray(c.specifiers)&&c.specifiers.length>0)&&p();const X=F.flatMap(c=>x(c.declaration)).map(c=>y(c.id)).filter(c=>!!c);(X.length!==v.size||X.some(c=>!v.has(c)))&&p();const W=I(e,`${s}.fixtures.ts`);E(W).filter(c=>c.type==="ExportNamedDeclaration").flatMap(c=>o(c.declaration)?x(c.declaration):[]).some(c=>{const d=m(c.init,"synthetic");return o(d)&&d.type==="BooleanLiteral"&&d.value===!0&&m(c.init,"data")!==void 0})||p();const _=I(e,`${s}.handlers.ts`),B=E(_);(!B.some(c=>c.type==="ImportDeclaration"&&o(c.source)&&c.source.value==="msw"&&Array.isArray(c.specifiers)&&c.specifiers.some(d=>o(d)&&o(d.imported)&&d.imported.name==="http"))||!B.some(c=>c.type==="ExportNamedDeclaration"&&o(c.declaration)&&x(c.declaration).some(d=>o(d.init)&&d.init.type==="ArrayExpression"&&Array.isArray(d.init.elements)&&d.init.elements.length>0))||!A(_,"CallExpression").some(c=>o(c.callee)&&c.callee.type==="MemberExpression"&&o(c.callee.object)&&c.callee.object.name==="http"))&&p();const M=j(e,`${s}.mdx`),J=new RegExp(`import\\s+\\*\\s+as\\s+([A-Za-z_$][\\w$]*)\\s+from\\s+['"]\\./${P(t)}\\.stories(?:\\.tsx)?['"];?\\r?\\n(?:[ \\t]*\\r?\\n)+`).exec(M);(!/import\s+\{\s*Meta\s*\}\s+from\s+['"]@storybook\/addon-docs\/blocks['"]/.test(M)||!J||!M.includes(`<Meta of={${J[1]}} />`))&&p()}function S(e){return Array.isArray(e)?`[${e.map(S).join(",")}]`:e&&typeof e=="object"?`{${Object.entries(e).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${S(r)}`).join(",")}}`:JSON.stringify(e)??"null"}function oe(e){const t=S(e);let r=2166136261;for(let s=0;s<t.length;s++)r^=t.charCodeAt(s),r=Math.imul(r,16777619);return`uxm-${(r>>>0).toString(16).padStart(8,"0")}`}function ie(e,t){let r;try{r=JSON.parse(j(e,"docs/architecture/ux-coverage-manifest.json"))}catch{p()}(!o(r)||r.schemaVersion!==1||r.manifestId!=="P201-UX-MANIFEST-01"||!Array.isArray(r.entries)||typeof r.fingerprint!="string"||Object.keys(r).sort().join(",")!=="entries,fingerprint,manifestId,schemaVersion"||r.fingerprint!==oe(r.entries))&&p();const s=new Map;for(const n of t.screens)for(const f of n.states)for(const u of n.viewports)s.set(`Screens/${n.screenId}/${f}/${u}`,{screen:n,state:f,viewport:u});r.entries.length!==s.size&&p();const i=new Set;let l="";for(const n of r.entries){(!o(n)||typeof n.storyId!="string"||i.has(n.storyId))&&p(),l&&l.localeCompare(n.storyId)>=0&&p(),l=n.storyId,Object.keys(n).sort().join(",")!=="approvalEvidenceIds,fixtureId,handlerIds,journeyIds,screenId,screenViewPath,state,storyId,viewport"&&p(),i.add(n.storyId);const f=s.get(n.storyId);(!f||n.screenId!==f.screen.screenId||n.state!==f.state||n.viewport!==f.viewport||n.screenViewPath!==f.screen.screenViewPath||!Array.isArray(n.approvalEvidenceIds)||S([...n.approvalEvidenceIds].sort())!==S([...f.screen.approvalEvidenceIds].sort())||!Array.isArray(n.journeyIds)||n.journeyIds.length<1||n.journeyIds.some(u=>typeof u!="string"||!z.test(u))||new Set(n.journeyIds).size!==n.journeyIds.length||typeof n.fixtureId!="string"||!z.test(n.fixtureId)||!Array.isArray(n.handlerIds)||n.handlerIds.length<1||n.handlerIds.some(u=>typeof u!="string"||!z.test(u))||new Set(n.handlerIds).size!==n.handlerIds.length)&&p()}}function fe(e,t){try{for(const[r,s]of[["docs/architecture/ux-design.md","P201-UX-STORYBOOK-01"],["docs/architecture/storybook-ux-contract.md","P201-UX-STORYBOOK-01"]])j(e,r).includes(s)||p();for(const r of t.screens)se(e,r,t.adapterId);ie(e,t)}catch{p()}}export{fe as validateUxCandidateSource};

package/packages/client/dist/runner/binary.d.ts

@@ -77,7 +77,7 @@ export interface HeadlessRuntimeBinaryCheckOptions {
     readonly commandLocator?: (commandName: string, env?: NodeJS.ProcessEnv) => string | undefined;
     readonly realpathBasenamePolicy?: HeadlessRuntimeRealpathBasenamePolicy;
 }
-export type HeadlessRuntimeRealpathBasenamePolicy = 'strict' | 'claude-code-versioned';
+export type HeadlessRuntimeRealpathBasenamePolicy = 'strict' | 'claude-code-versioned' | 'opencode-npm-native';
 export type HeadlessRuntimeBinaryCheckResult = {
     readonly ok: true;
     readonly trusted: true;

package/packages/client/dist/runner/binary.js

@@ -1 +1 @@
-import{existsSync as g,readFileSync as j,realpathSync as z,statSync as M}from"node:fs";import{basename as P,delimiter as K,dirname as p,isAbsolute as k,join as B,relative as X,resolve as E,sep as F,win32 as Z}from"node:path";const o=Object.freeze({OK:"continuity-ok",MISSING:"runner-binary-missing",AMBIGUOUS:"runner-binary-ambiguous",NON_EXECUTABLE:"runner-binary-non-executable",VERSION_MISMATCHED:"runner-binary-version-mismatched",UNTRUSTED:"runner-binary-untrusted"}),m=Object.freeze({OK:"continuity-ok",UNAVAILABLE:"headless-adapter-unavailable",UNTRUSTED:"headless-runtime-untrusted"}),y=new Set(["@ornexus/neocortex","@neocortex/client"]),v=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function re(e={}){const t=J(e);if(!t)return b(o.MISSING,"Runner binary resolution did not receive a usable start path.");const r=w(t);if(!r)return b(o.AMBIGUOUS,"Runner binary was not inside an accepted Neocortex package.");const{packageRoot:n,pkg:c}=r,a=typeof c.name=="string"?c.name:void 0,i=typeof c.version=="string"?c.version:void 0,u=G(n,a);if(!a||!y.has(a))return b(o.AMBIGUOUS,"Runner package identity was not accepted.",{packageName:a,packageVersion:i,packageRoot:n,provenance:u});if(!i||!v.test(i))return b(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{packageName:a,packageVersion:i,packageRoot:n,provenance:u});const s=_(c,a);if(!s)return b(o.MISSING,"Runner package did not declare an accepted runner bin target.",{packageName:a,packageVersion:i,packageRoot:n,provenance:u});const d=D(n,s),l=R(d);if(!l||!g(l))return b(o.MISSING,"Runner package bin target was not present.",{packageName:a,packageVersion:i,packageRoot:n,expectedRelativePath:s,provenance:u});const S=A(l,e.platform,e.requireExecutable);return S?b(S,N(S),{packageName:a,packageVersion:i,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:u}):V(n,a,i)?b(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{packageName:a,packageVersion:i,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:u}):{ok:!0,trusted:!0,command:l,args:[],executablePath:l,packageName:a,packageVersion:i,packageRoot:n,expectedRelativePath:s,provenance:u,reasonCodes:[o.OK],publicSummary:`Resolved trusted ${u} runner for ${a}.`,publicSafe:!0}}function ae(e,t={}){const r=I(e);if(!r)return f(o.MISSING,"Runner executable path was missing.");const n=R(r);if(!n||!g(n))return f(o.MISSING,"Runner executable was not present.",{executablePath:r});const c=w(p(n));if(!c)return f(o.AMBIGUOUS,"Runner executable was not inside an accepted Neocortex package.",{executablePath:n});const{packageRoot:a,pkg:i}=c,u=typeof i.name=="string"?i.name:void 0,s=typeof i.version=="string"?i.version:void 0,d=G(a,u);if(!u||!y.has(u))return f(o.AMBIGUOUS,"Runner package identity was not accepted.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,provenance:d});if(!s||!v.test(s))return f(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,provenance:d});const l=_(i,u);if(!l)return f(o.MISSING,"Runner package did not declare an accepted runner bin target.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,provenance:d});const S=R(D(a,l));if(!S||!g(S))return f(o.MISSING,"Runner package bin target was not present.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});if(S!==n)return f(o.AMBIGUOUS,"Runner executable did not match the package-declared bin target.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});const x=A(n,t.platform,t.requireExecutable);return x?f(x,N(x),{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):V(a,u,s)?f(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):{trusted:!0,packageName:u,packageVersion:s,packageRoot:a,executablePath:n,expectedRelativePath:l,provenance:d,reasonCodes:[o.OK],publicSummary:`Trusted ${d} runner for ${u}.`,publicSafe:!0}}function ce(e,t){return H(e)||H(t)?Z.relative(e,t).split("\\").join("/"):X(e,t).split("\\").join("/")}function oe(e){const t=e.commandName,r=e.realpathBasenamePolicy??"strict";if(!U(t))return h(m.UNTRUSTED,"Headless runtime command name was not allowlisted by adapter code.",t,"commandName","unsafe_key");const c=(e.commandLocator??q)(t,e.env);if(!c)return h(m.UNAVAILABLE,"Headless runtime command was not found on PATH.",t,"runtimeBinary","missing");if(!$(c,t,e.platform))return h(m.UNTRUSTED,"Headless runtime executable path did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const a=R(c);if(!a||!g(a))return h(m.UNAVAILABLE,"Headless runtime executable was not present.",t,"runtimeBinary","missing");if(!Q(a,t,e.platform,r))return h(m.UNTRUSTED,"Headless runtime executable realpath did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const i=A(a,e.platform,e.requireExecutable??!0);if(i)return h(i===o.NON_EXECUTABLE||i===o.MISSING?m.UNAVAILABLE:m.UNTRUSTED,N(i),t,"runtimeBinary",i);const u={ok:!0,trusted:!0,commandName:t,reasonCodes:[m.OK],publicSummary:`Trusted headless runtime command ${t} is available.`,redactionSummary:[],publicSafe:!0};return Object.defineProperty(u,"executablePath",{value:a,enumerable:!1,configurable:!1}),u}function q(e,t=process.env){if(!U(e))return;const r=t.PATH??"",n=process.platform==="win32"?(t.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean):[""];for(const c of r.split(K))if(!(!c||/[\r\n\0]/.test(c)))for(const a of n){const i=E(c,`${e}${a}`);if(g(i))return i}}function J(e){if(e.packageRoot)return I(e.packageRoot);const t=I(e.from??process.argv[1]);if(!t)return null;const r=R(t);if(r)try{return M(r).isDirectory()?r:p(r)}catch{return p(r)}return p(t)}function I(e){if(!e||/[\r\n\0]/.test(e))return null;const t=k(e)?e:E(e);return k(t)?t:null}function R(e){try{return z(e)}catch{return null}}function w(e){let t=e;for(let r=0;r<10;r++){const n=C(B(t,"package.json"));if(n&&typeof n.name=="string"&&y.has(n.name))return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function O(e){let t=e;for(let r=0;r<10;r++){const n=C(B(t,"package.json"));if(n?.name==="@ornexus/neocortex")return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function C(e){try{return JSON.parse(j(e,"utf8"))}catch{return null}}function _(e,t){const r=W(e.bin)?e.bin["neocortex-runner"]:void 0;if(typeof r!="string"||r.length===0)return null;const n=Y(r);return t==="@ornexus/neocortex"&&n!=="packages/client/dist/runner-cli.js"||t==="@neocortex/client"&&n!=="dist/runner-cli.js"?null:n}function Y(e){return e.replace(/\\/g,"/").replace(/^\.\//,"").replace(/^\/+/,"")}function D(e,t){return E(e,...t.split("/").filter(Boolean))}function G(e,t){return t==="@ornexus/neocortex"?"published-root-package":t!=="@neocortex/client"?"published-client-package":O(p(e))?"development-workspace":"published-client-package"}function V(e,t,r){if(t!=="@neocortex/client")return!1;const n=O(p(e));return!!(n&&n.pkg.version!==r)}function A(e,t=process.platform,r=!0){try{const n=M(e);return n.isFile()?r&&t!=="win32"&&(n.mode&73)===0?o.NON_EXECUTABLE:null:o.AMBIGUOUS}catch{return o.MISSING}}function b(e,t,r={}){const n=L(r);return{ok:!1,trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:T(t),publicSafe:!0,...n}}function f(e,t,r={}){const n=L(r);return{trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:T(t),publicSafe:!0,...n}}function L(e){return{...e.packageName?{packageName:e.packageName}:{},...e.packageVersion?{packageVersion:e.packageVersion}:{},...e.expectedRelativePath?{expectedRelativePath:e.expectedRelativePath}:{},...e.provenance?{provenance:e.provenance}:{}}}function N(e){switch(e){case o.MISSING:return"Runner package bin target was not present.";case o.AMBIGUOUS:return"Runner binary candidate was ambiguous.";case o.NON_EXECUTABLE:return"Runner package bin target was not executable.";case o.VERSION_MISMATCHED:return"Runner package version did not match the development workspace root.";default:return"Runner binary trust check failed."}}function T(e){return e.length<=180?e:`${e.slice(0,180)}\u2026[TRUNCATED:${e.length-180}]`}function H(e){return/^[A-Za-z]:[\\/]/.test(e)||e.includes("\\")||F==="\\"}function W(e){return!!(e&&typeof e=="object"&&!Array.isArray(e))}function U(e){return/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(e)&&!/[\\/\s;&|`$<>\r\n\0]/.test(e)}function $(e,t,r=process.platform){if(!e||/[\r\n\0]/.test(e)||!k(e))return!1;const n=P(e).toLowerCase(),c=t.toLowerCase();return r==="win32"?n===c||[".exe",".cmd",".bat",".com"].some(a=>n===`${c}${a}`):n===c}function Q(e,t,r=process.platform,n="strict"){return $(e,t,r)?!0:n!=="claude-code-versioned"||t!=="claude"||!e||/[\r\n\0]/.test(e)||!k(e)?!1:ee(P(e),r)}function ee(e,t=process.platform){const r=e.toLowerCase(),n=t==="win32"?r.replace(/\.(?:exe|cmd|bat|com)$/i,""):r;return/^(?:(?:claude|claude-code)[._-])?v?\d+\.\d+\.\d+(?:[-+][0-9a-z][0-9a-z.-]*)?(?:\.(?:js|mjs|cjs))?$/.test(n)}function h(e,t,r,n,c){return{ok:!1,trusted:!1,...r&&U(r)?{commandName:r}:{},reasonCode:e,reasonCodes:[e],publicSummary:T(t),redactionSummary:[{field:n,reason:c,evidence:"value-denied",publicSafe:!0}],publicSafe:!0}}export{m as HEADLESS_RUNTIME_BINARY_REASON_CODES,o as RUNNER_BINARY_REASON_CODES,ae as checkRunnerBinaryTrust,oe as checkTrustedHeadlessRuntimeBinary,q as defaultHeadlessRuntimeCommandLocator,re as resolveTrustedRunnerBinary,ce as runnerTrustRelativePath};
+import{existsSync as g,readFileSync as j,realpathSync as z,statSync as P}from"node:fs";import{basename as E,delimiter as K,dirname as p,isAbsolute as R,join as B,relative as X,resolve as y,sep as F,win32 as Z}from"node:path";const o=Object.freeze({OK:"continuity-ok",MISSING:"runner-binary-missing",AMBIGUOUS:"runner-binary-ambiguous",NON_EXECUTABLE:"runner-binary-non-executable",VERSION_MISMATCHED:"runner-binary-version-mismatched",UNTRUSTED:"runner-binary-untrusted"}),m=Object.freeze({OK:"continuity-ok",UNAVAILABLE:"headless-adapter-unavailable",UNTRUSTED:"headless-runtime-untrusted"}),I=new Set(["@ornexus/neocortex","@neocortex/client"]),w=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function re(e={}){const t=J(e);if(!t)return b(o.MISSING,"Runner binary resolution did not receive a usable start path.");const r=v(t);if(!r)return b(o.AMBIGUOUS,"Runner binary was not inside an accepted Neocortex package.");const{packageRoot:n,pkg:c}=r,a=typeof c.name=="string"?c.name:void 0,u=typeof c.version=="string"?c.version:void 0,i=G(n,a);if(!a||!I.has(a))return b(o.AMBIGUOUS,"Runner package identity was not accepted.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});if(!u||!w.test(u))return b(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});const s=_(c,a);if(!s)return b(o.MISSING,"Runner package did not declare an accepted runner bin target.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});const d=D(n,s),l=x(d);if(!l||!g(l))return b(o.MISSING,"Runner package bin target was not present.",{packageName:a,packageVersion:u,packageRoot:n,expectedRelativePath:s,provenance:i});const S=N(l,e.platform,e.requireExecutable);return S?b(S,T(S),{packageName:a,packageVersion:u,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:i}):L(n,a,u)?b(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{packageName:a,packageVersion:u,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:i}):{ok:!0,trusted:!0,command:l,args:[],executablePath:l,packageName:a,packageVersion:u,packageRoot:n,expectedRelativePath:s,provenance:i,reasonCodes:[o.OK],publicSummary:`Resolved trusted ${i} runner for ${a}.`,publicSafe:!0}}function ae(e,t={}){const r=A(e);if(!r)return f(o.MISSING,"Runner executable path was missing.");const n=x(r);if(!n||!g(n))return f(o.MISSING,"Runner executable was not present.",{executablePath:r});const c=v(p(n));if(!c)return f(o.AMBIGUOUS,"Runner executable was not inside an accepted Neocortex package.",{executablePath:n});const{packageRoot:a,pkg:u}=c,i=typeof u.name=="string"?u.name:void 0,s=typeof u.version=="string"?u.version:void 0,d=G(a,i);if(!i||!I.has(i))return f(o.AMBIGUOUS,"Runner package identity was not accepted.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});if(!s||!w.test(s))return f(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});const l=_(u,i);if(!l)return f(o.MISSING,"Runner package did not declare an accepted runner bin target.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});const S=x(D(a,l));if(!S||!g(S))return f(o.MISSING,"Runner package bin target was not present.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});if(S!==n)return f(o.AMBIGUOUS,"Runner executable did not match the package-declared bin target.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});const k=N(n,t.platform,t.requireExecutable);return k?f(k,T(k),{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):L(a,i,s)?f(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):{trusted:!0,packageName:i,packageVersion:s,packageRoot:a,executablePath:n,expectedRelativePath:l,provenance:d,reasonCodes:[o.OK],publicSummary:`Trusted ${d} runner for ${i}.`,publicSafe:!0}}function ce(e,t){return H(e)||H(t)?Z.relative(e,t).split("\\").join("/"):X(e,t).split("\\").join("/")}function oe(e){const t=e.commandName,r=e.realpathBasenamePolicy??"strict";if(!M(t))return h(m.UNTRUSTED,"Headless runtime command name was not allowlisted by adapter code.",t,"commandName","unsafe_key");const c=(e.commandLocator??q)(t,e.env);if(!c)return h(m.UNAVAILABLE,"Headless runtime command was not found on PATH.",t,"runtimeBinary","missing");if(!$(c,t,e.platform))return h(m.UNTRUSTED,"Headless runtime executable path did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const a=x(c);if(!a||!g(a))return h(m.UNAVAILABLE,"Headless runtime executable was not present.",t,"runtimeBinary","missing");if(!Q(a,t,e.platform,r))return h(m.UNTRUSTED,"Headless runtime executable realpath did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const u=N(a,e.platform,e.requireExecutable??!0);if(u)return h(u===o.NON_EXECUTABLE||u===o.MISSING?m.UNAVAILABLE:m.UNTRUSTED,T(u),t,"runtimeBinary",u);const i={ok:!0,trusted:!0,commandName:t,reasonCodes:[m.OK],publicSummary:`Trusted headless runtime command ${t} is available.`,redactionSummary:[],publicSafe:!0};return Object.defineProperty(i,"executablePath",{value:a,enumerable:!1,configurable:!1}),i}function q(e,t=process.env){if(!M(e))return;const r=t.PATH??"",n=process.platform==="win32"?(t.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean):[""];for(const c of r.split(K))if(!(!c||/[\r\n\0]/.test(c)))for(const a of n){const u=y(c,`${e}${a}`);if(g(u))return u}}function J(e){if(e.packageRoot)return A(e.packageRoot);const t=A(e.from??process.argv[1]);if(!t)return null;const r=x(t);if(r)try{return P(r).isDirectory()?r:p(r)}catch{return p(r)}return p(t)}function A(e){if(!e||/[\r\n\0]/.test(e))return null;const t=R(e)?e:y(e);return R(t)?t:null}function x(e){try{return z(e)}catch{return null}}function v(e){let t=e;for(let r=0;r<10;r++){const n=O(B(t,"package.json"));if(n&&typeof n.name=="string"&&I.has(n.name))return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function C(e){let t=e;for(let r=0;r<10;r++){const n=O(B(t,"package.json"));if(n?.name==="@ornexus/neocortex")return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function O(e){try{return JSON.parse(j(e,"utf8"))}catch{return null}}function _(e,t){const r=W(e.bin)?e.bin["neocortex-runner"]:void 0;if(typeof r!="string"||r.length===0)return null;const n=Y(r);return t==="@ornexus/neocortex"&&n!=="packages/client/dist/runner-cli.js"||t==="@neocortex/client"&&n!=="dist/runner-cli.js"?null:n}function Y(e){return e.replace(/\\/g,"/").replace(/^\.\//,"").replace(/^\/+/,"")}function D(e,t){return y(e,...t.split("/").filter(Boolean))}function G(e,t){return t==="@ornexus/neocortex"?"published-root-package":t!=="@neocortex/client"?"published-client-package":C(p(e))?"development-workspace":"published-client-package"}function L(e,t,r){if(t!=="@neocortex/client")return!1;const n=C(p(e));return!!(n&&n.pkg.version!==r)}function N(e,t=process.platform,r=!0){try{const n=P(e);return n.isFile()?r&&t!=="win32"&&(n.mode&73)===0?o.NON_EXECUTABLE:null:o.AMBIGUOUS}catch{return o.MISSING}}function b(e,t,r={}){const n=V(r);return{ok:!1,trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:U(t),publicSafe:!0,...n}}function f(e,t,r={}){const n=V(r);return{trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:U(t),publicSafe:!0,...n}}function V(e){return{...e.packageName?{packageName:e.packageName}:{},...e.packageVersion?{packageVersion:e.packageVersion}:{},...e.expectedRelativePath?{expectedRelativePath:e.expectedRelativePath}:{},...e.provenance?{provenance:e.provenance}:{}}}function T(e){switch(e){case o.MISSING:return"Runner package bin target was not present.";case o.AMBIGUOUS:return"Runner binary candidate was ambiguous.";case o.NON_EXECUTABLE:return"Runner package bin target was not executable.";case o.VERSION_MISMATCHED:return"Runner package version did not match the development workspace root.";default:return"Runner binary trust check failed."}}function U(e){return e.length<=180?e:`${e.slice(0,180)}\u2026[TRUNCATED:${e.length-180}]`}function H(e){return/^[A-Za-z]:[\\/]/.test(e)||e.includes("\\")||F==="\\"}function W(e){return!!(e&&typeof e=="object"&&!Array.isArray(e))}function M(e){return/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(e)&&!/[\\/\s;&|`$<>\r\n\0]/.test(e)}function $(e,t,r=process.platform){if(!e||/[\r\n\0]/.test(e)||!R(e))return!1;const n=E(e).toLowerCase(),c=t.toLowerCase();return r==="win32"?n===c||[".exe",".cmd",".bat",".com"].some(a=>n===`${c}${a}`):n===c}function Q(e,t,r=process.platform,n="strict"){return $(e,t,r)?!0:n==="opencode-npm-native"&&t==="opencode"?!e||/[\r\n\0]/.test(e)||!R(e)?!1:E(e).toLowerCase()==="opencode.exe":n!=="claude-code-versioned"||t!=="claude"||!e||/[\r\n\0]/.test(e)||!R(e)?!1:ee(E(e),r)}function ee(e,t=process.platform){const r=e.toLowerCase(),n=t==="win32"?r.replace(/\.(?:exe|cmd|bat|com)$/i,""):r;return/^(?:(?:claude|claude-code)[._-])?v?\d+\.\d+\.\d+(?:[-+][0-9a-z][0-9a-z.-]*)?(?:\.(?:js|mjs|cjs))?$/.test(n)}function h(e,t,r,n,c){return{ok:!1,trusted:!1,...r&&M(r)?{commandName:r}:{},reasonCode:e,reasonCodes:[e],publicSummary:U(t),redactionSummary:[{field:n,reason:c,evidence:"value-denied",publicSafe:!0}],publicSafe:!0}}export{m as HEADLESS_RUNTIME_BINARY_REASON_CODES,o as RUNNER_BINARY_REASON_CODES,ae as checkRunnerBinaryTrust,oe as checkTrustedHeadlessRuntimeBinary,q as defaultHeadlessRuntimeCommandLocator,re as resolveTrustedRunnerBinary,ce as runnerTrustRelativePath};

package/packages/client/dist/runner/headless/opencode-adapter.js

@@ -1,2 +1,2 @@
-import{checkTrustedHeadlessRuntimeBinary as _}from"../binary.js";import{HEADLESS_REASON_CODES as s,adapterAvailabilityFailure as m,adapterAvailabilitySuccess as R,createRejectedExecutionResult as E,createUnavailableExecutionResult as I,hashPublicValue as f,normalizeHeadlessCommandResult as p,redaction as A,runHeadlessCommand as v,validateHeadlessAdapterExecutionInput as b}from"./types.js";import{governedPreflightFailureResult as h,preflightManagedHeadlessProfile as y,withGovernedHeadlessEvidence as c}from"./managed-profile.js";const r="opencode",d="opencode",S="neocortex",T=2e3,C=2e3,O=/(https?:\/\/\S+|(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|authorization\s*:|password\s*=|token\s*=|api[_-]?key\s*=|license[_-]?key\s*=|raw[_-]?(?:logs?)\s*[:=]|transcript|stack\s*trace|stderr:|stdout:|system prompt|workflow body|step body|PROTECTED_|PRIVATE_INTERNALS|CUSTOMER_PII|\bPII\b|VENDOR_CORPUS|\bPRIVATE\b)/i,P=/\b(?:Claude\s+Code|claude-code|@anthropic-ai\/claude-code)\b/i,k=/\bv?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z][0-9A-Za-z.-]*)?\b/;function w(){return{id:r,displayName:"OpenCode Headless Adapter",async checkAvailability(n={}){return N(r,d,n)},buildInvocation(n){const e=b(n,r);return e.ok?{ok:!0,invocation:{adapterId:r,commandName:d,args:V(e.prompt,e.input.modelId),promptHash:e.promptHash,...e.input.modelId?{modelId:e.input.modelId}:{},timeoutMs:e.input.timeoutMs??600*1e3,publicSafe:!0},publicSafe:!0}:e},async execute(n,e={}){const t=b(n,r);if(!t.ok)return E(r,r,t);const a=y(r,e);if(!a.ok)return h(r,t.input,a);if(e.signal?.aborted)return c(p(r,t.input,{exitCode:null,signal:"SIGTERM",timedOut:!1,cancelled:!0,durationMs:0,stdout:"",stderr:"",stdoutBytes:0,stderrBytes:0}));const i=await this.checkAvailability(e);if(!i.ok)return c(I(r,t.input,i));const o=this.buildInvocation(t.input);if(!o.ok)return E(r,r,o);const u=await(e.commandRunner??v)(i.executablePath??d,o.invocation.args,{cwd:e.cwd,env:e.env,timeoutMs:o.invocation.timeoutMs,maxOutputBytes:e.maxOutputBytes,signal:e.signal,...t.input.receipt?.jobId?{localConsole:{projectRoot:e.cwd,jobId:t.input.receipt.jobId,attemptId:t.input.receipt.attemptId,executionId:t.input.receipt.executionId,publicSafe:!0}}:{}});return c(p(r,t.input,u))}}}async function N(n,e,t,a={}){const i=_({commandName:e,env:t.env,platform:t.platform,commandLocator:t.commandLocator,realpathBasenamePolicy:a.realpathBasenamePolicy});if(!i.ok)return m(n,e,i.reasonCode===s.ADAPTER_UNAVAILABLE?s.ADAPTER_UNAVAILABLE:s.RUNTIME_UNTRUSTED,i.publicSummary,i.redactionSummary);const l=await(t.versionRunner??t.commandRunner??v)(i.executablePath,["--version"],{env:t.env,timeoutMs:5e3,maxOutputBytes:2e3}),u=g(l,a.versionEvidence??"generic-public");return u.ok?R(n,e,D(e,a.versionEvidence),{executablePath:i.executablePath,versionText:u.versionText}):m(n,e,s.ADAPTER_UNAVAILABLE,u.publicSummary,u.redactionSummary)}function g(n,e){const t=x(`${n.stdout}
-${n.stderr}`.trim()),a=t?[A("runtimeVersion","raw_log",f(t))]:[A("runtimeVersion","missing","value-denied")];return n.timedOut||n.exitCode!==0||t.length===0||t.length>T||n.stdoutBytes+n.stderrBytes>C||O.test(t)?{ok:!1,publicSummary:"Headless runtime version check did not return a bounded public result.",redactionSummary:a}:e==="claude-code"&&(!P.test(t)||!k.test(t))?{ok:!1,publicSummary:"Headless runtime version check did not return bounded Claude Code product/version evidence.",redactionSummary:a}:{ok:!0,versionText:t}}function x(n){return n.replace(/\s+/g," ").trim()}function D(n,e){return e==="claude-code"?`Trusted ${n} runtime is available with bounded Claude Code version evidence.`:`Trusted ${n} runtime is available.`}function V(n,e){const t=["run","--agent",S,"--auto"];return e&&t.push("--model",e),t.push("--",n),t}export{N as checkRuntimeAvailability,w as createOpenCodeHeadlessAdapter};
+import{checkTrustedHeadlessRuntimeBinary as _}from"../binary.js";import{HEADLESS_REASON_CODES as s,adapterAvailabilityFailure as m,adapterAvailabilitySuccess as R,createRejectedExecutionResult as p,createUnavailableExecutionResult as I,hashPublicValue as f,normalizeHeadlessCommandResult as E,redaction as A,runHeadlessCommand as v,validateHeadlessAdapterExecutionInput as b}from"./types.js";import{governedPreflightFailureResult as h,preflightManagedHeadlessProfile as y,withGovernedHeadlessEvidence as c}from"./managed-profile.js";const r="opencode",d="opencode",S="neocortex",T=2e3,C=2e3,P=/(https?:\/\/\S+|(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|authorization\s*:|password\s*=|token\s*=|api[_-]?key\s*=|license[_-]?key\s*=|raw[_-]?(?:logs?)\s*[:=]|transcript|stack\s*trace|stderr:|stdout:|system prompt|workflow body|step body|PROTECTED_|PRIVATE_INTERNALS|CUSTOMER_PII|\bPII\b|VENDOR_CORPUS|\bPRIVATE\b)/i,O=/\b(?:Claude\s+Code|claude-code|@anthropic-ai\/claude-code)\b/i,k=/\bv?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z][0-9A-Za-z.-]*)?\b/;function w(){return{id:r,displayName:"OpenCode Headless Adapter",async checkAvailability(n={}){return N(r,d,n,{realpathBasenamePolicy:"opencode-npm-native"})},buildInvocation(n){const e=b(n,r);return e.ok?{ok:!0,invocation:{adapterId:r,commandName:d,args:V(e.prompt,e.input.modelId),promptHash:e.promptHash,...e.input.modelId?{modelId:e.input.modelId}:{},timeoutMs:e.input.timeoutMs??600*1e3,publicSafe:!0},publicSafe:!0}:e},async execute(n,e={}){const t=b(n,r);if(!t.ok)return p(r,r,t);const a=y(r,e);if(!a.ok)return h(r,t.input,a);if(e.signal?.aborted)return c(E(r,t.input,{exitCode:null,signal:"SIGTERM",timedOut:!1,cancelled:!0,durationMs:0,stdout:"",stderr:"",stdoutBytes:0,stderrBytes:0}));const i=await this.checkAvailability(e);if(!i.ok)return c(I(r,t.input,i));const o=this.buildInvocation(t.input);if(!o.ok)return p(r,r,o);const u=await(e.commandRunner??v)(i.executablePath??d,o.invocation.args,{cwd:e.cwd,env:e.env,timeoutMs:o.invocation.timeoutMs,maxOutputBytes:e.maxOutputBytes,signal:e.signal,...t.input.receipt?.jobId?{localConsole:{projectRoot:e.cwd,jobId:t.input.receipt.jobId,attemptId:t.input.receipt.attemptId,executionId:t.input.receipt.executionId,publicSafe:!0}}:{}});return c(E(r,t.input,u))}}}async function N(n,e,t,a={}){const i=_({commandName:e,env:t.env,platform:t.platform,commandLocator:t.commandLocator,realpathBasenamePolicy:a.realpathBasenamePolicy});if(!i.ok)return m(n,e,i.reasonCode===s.ADAPTER_UNAVAILABLE?s.ADAPTER_UNAVAILABLE:s.RUNTIME_UNTRUSTED,i.publicSummary,i.redactionSummary);const l=await(t.versionRunner??t.commandRunner??v)(i.executablePath,["--version"],{env:t.env,timeoutMs:5e3,maxOutputBytes:2e3}),u=g(l,a.versionEvidence??"generic-public");return u.ok?R(n,e,D(e,a.versionEvidence),{executablePath:i.executablePath,versionText:u.versionText}):m(n,e,s.ADAPTER_UNAVAILABLE,u.publicSummary,u.redactionSummary)}function g(n,e){const t=x(`${n.stdout}
+${n.stderr}`.trim()),a=t?[A("runtimeVersion","raw_log",f(t))]:[A("runtimeVersion","missing","value-denied")];return n.timedOut||n.exitCode!==0||t.length===0||t.length>T||n.stdoutBytes+n.stderrBytes>C||P.test(t)?{ok:!1,publicSummary:"Headless runtime version check did not return a bounded public result.",redactionSummary:a}:e==="claude-code"&&(!O.test(t)||!k.test(t))?{ok:!1,publicSummary:"Headless runtime version check did not return bounded Claude Code product/version evidence.",redactionSummary:a}:{ok:!0,versionText:t}}function x(n){return n.replace(/\s+/g," ").trim()}function D(n,e){return e==="claude-code"?`Trusted ${n} runtime is available with bounded Claude Code version evidence.`:`Trusted ${n} runtime is available.`}function V(n,e){const t=["run","--standalone","--agent",S,"--auto"];return e&&t.push("--model",e),t.push("--",n),t}export{N as checkRuntimeAvailability,w as createOpenCodeHeadlessAdapter};

package/packages/client/dist/yolo/invoke-envelope-capability.d.ts

@@ -0,0 +1,16 @@
+import { YOLO_INVOKE_ENVELOPE_CAPABILITY } from '../../../shared/dist/yolo/spec-envelope.js';
+export type YoloInvokeEnvelopeCapabilityReason = 'supported' | 'fetch-unavailable' | 'request-failed' | 'http-rejected' | 'response-too-large' | 'response-invalid' | 'capability-missing';
+export interface YoloInvokeEnvelopeCapabilityProbe {
+    readonly supported: boolean;
+    readonly capability: typeof YOLO_INVOKE_ENVELOPE_CAPABILITY;
+    readonly reason: YoloInvokeEnvelopeCapabilityReason;
+    readonly serverVersion?: string;
+    readonly publicSafe: true;
+}
+type FetchLike = (input: string, init?: RequestInit) => Promise<Pick<Response, 'ok' | 'text'>>;
+/**
+ * Non-mutating, fail-closed compatibility probe for targeted YOLO requests.
+ * Older strict servers must be rejected before local release-gate execution.
+ */
+export declare function probeYoloInvokeEnvelopeCapability(serverUrl: string, fetcher?: FetchLike | undefined): Promise<YoloInvokeEnvelopeCapabilityProbe>;
+export {};

package/packages/client/dist/yolo/invoke-envelope-capability.js

@@ -0,0 +1 @@
+import{YOLO_INVOKE_ENVELOPE_CAPABILITY as u}from"../../../shared/dist/yolo/spec-envelope.js";const y=16*1024,b=/^[0-9]{1,6}\.[0-9]{1,6}\.[0-9]{1,6}(?:-[A-Za-z0-9.-]{1,40})?$/;function e(n,a,t){return Object.freeze({supported:n,capability:u,reason:a,...t&&b.test(t)?{serverVersion:t}:{},publicSafe:!0})}async function h(n,a=globalThis.fetch){if(!a)return e(!1,"fetch-unavailable");const t=new AbortController,l=setTimeout(()=>t.abort(),5e3);l.unref?.();try{const c=await a(`${n.replace(/\/+$/,"")}/api/v1/health`,{method:"GET",headers:{accept:"application/json"},signal:t.signal});if(!c.ok)return e(!1,"http-rejected");const f=await c.text();if(Buffer.byteLength(f,"utf8")>y)return e(!1,"response-too-large");let r;try{r=JSON.parse(f)}catch{return e(!1,"response-invalid")}if(!r||typeof r!="object"||Array.isArray(r))return e(!1,"response-invalid");const i=r,s=i.capabilities,o=typeof i.version=="string"?i.version:void 0;return!Array.isArray(s)||s.some(p=>typeof p!="string"||p.length>80)?e(!1,"response-invalid",o):s.includes(u)?e(!0,"supported",o):e(!1,"capability-missing",o)}catch{return e(!1,"request-failed")}finally{clearTimeout(l)}}export{h as probeYoloInvokeEnvelopeCapability};

package/packages/client/dist/yolo/spec-envelope-collector.d.ts

@@ -10,4 +10,11 @@ export interface CollectYoloSpecEnvelopeOptions {
     /** Public-safe count only; omitted supporting refs never silently imply coverage. */
     readonly onOmittedReferences?: (count: number) => void;
 }
+/** Resolve only an explicit story target. Inline YOLO text intentionally has no match. */
+export declare function extractTargetedYoloStoryId(args: string): string | null;
 export declare function collectYoloSpecEnvelope(options: CollectYoloSpecEnvelopeOptions): YoloSpecEnvelopeV1;
+/**
+ * Reissue a precollected physical snapshot with a fresh bounded transport time.
+ * The caller still performs the final disk/HEAD collection and digest comparison.
+ */
+export declare function refreshPrecollectedYoloSpecEnvelope(envelope: YoloSpecEnvelopeV1, collectedAt?: string): YoloSpecEnvelopeV1;

package/packages/client/dist/yolo/spec-envelope-collector.js

@@ -1,5 +1,5 @@
-import{execFileSync as L}from"node:child_process";import{existsSync as S,readFileSync as T,realpathSync as w,statSync as E}from"node:fs";import{join as f,sep as b}from"node:path";import{createYoloSpecEnvelopeV1 as x,YOLO_SPEC_ARTIFACT_LIMIT_BYTES as C,YOLO_SPEC_MAX_ARTIFACTS as R,YOLO_SPEC_TOTAL_LIMIT_BYTES as g}from"../../../shared/dist/yolo/spec-envelope.js";import{inspectFrontmatterContext as $}from"../../../shared/dist/frontmatter-context-contract.js";const O=["core/templates/specs/feature-spec-template.md","core/templates/specs/architecture-spec-template.md","core/templates/specs/contract-spec-template.md","core/templates/specs/story-spec-template.md","core/templates/specs/traceability-matrix-template.md"],W=/(?:^|[\s([`'";])((?:docs\/(?:stories|epics|specs|architecture|examples)\/|core\/templates\/specs\/)[A-Za-z0-9_./-]+\.(?:md|mdx|feature))(?:$|[\s)\]`'",;])/gm;function I(e){return e.startsWith("core/templates/")?"template":e.startsWith("docs/epics/")?"epic":e.startsWith("docs/stories/")&&e.endsWith(".story.md")?"story":e.endsWith(".rtm.md")?"traceability":e.toLowerCase().includes("adr")?"adr":e.toLowerCase().includes("contract")?"contract":e.toLowerCase().includes("nfr")?"nfr":e.endsWith(".feature")?"bdd":e.toLowerCase().includes("traceability")?"traceability":e.startsWith("docs/examples/")?"example":"spec"}function P(e){return[...new Set([...e.matchAll(W)].map(r=>r[1]).filter(r=>!!r))].sort()}function i(e,r){const c=w(e);let o;try{o=w(f(c,r))}catch{throw new Error("yolo-spec-envelope-required")}if(!o.startsWith(`${c}${b}`))throw new Error("yolo-spec-envelope-path-out-of-scope");if(!E(o).isFile())throw new Error("yolo-spec-envelope-unsafe");if(E(o).size>C)throw new Error("yolo-spec-envelope-too-large");return T(o,"utf8")}function m(e,r){const o=$(e,{context:r==="story"?"story-target":"epic-target",explicitlySelected:!0});if(o.status==="malformed"||o.status==="oversized")throw new Error("yolo-spec-envelope-unsafe");if(o.status==="absent")return e;const a=e.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n/);if(!a)throw new Error("yolo-spec-envelope-unsafe");return`---
-${Object.entries(o.metadata).map(([s,l])=>`${s}: ${JSON.stringify(l)}`).join(`
+import{execFileSync as L}from"node:child_process";import{existsSync as S,readFileSync as $,realpathSync as w,statSync as R}from"node:fs";import{join as f,sep as b}from"node:path";import{createYoloSpecEnvelopeV1 as E,YOLO_SPEC_ARTIFACT_LIMIT_BYTES as O,YOLO_SPEC_MAX_ARTIFACTS as g,YOLO_SPEC_TOTAL_LIMIT_BYTES as I}from"../../../shared/dist/yolo/spec-envelope.js";import{inspectFrontmatterContext as v}from"../../../shared/dist/frontmatter-context-contract.js";const C=["core/templates/specs/feature-spec-template.md","core/templates/specs/architecture-spec-template.md","core/templates/specs/contract-spec-template.md","core/templates/specs/story-spec-template.md","core/templates/specs/traceability-matrix-template.md"],P=/(?:^|[\s([`'";])((?:docs\/(?:stories|epics|specs|architecture|examples)\/|core\/templates\/specs\/)[A-Za-z0-9_./-]+\.(?:md|mdx|feature))(?:$|[\s)\]`'",;])/gm,W=/^[A-Za-z][A-Za-z0-9_-]*(?:\.[A-Za-z0-9_-]+)+$/;function Z(e){const r=[...e.matchAll(/(?:^|\s)@?docs\/stories\/([A-Za-z][A-Za-z0-9_-]*(?:\.[A-Za-z0-9_-]+)+)\.story\.md(?=\s|$)/g)].map(c=>c[1]),s=e.trim().split(/\s+/).slice(1).map(c=>c.replace(/^@/,"")).filter(c=>W.test(c)),o=[...new Set([...r,...s])];return o.length===1?o[0]:null}function A(e){return e.startsWith("core/templates/")?"template":e.startsWith("docs/epics/")?"epic":e.startsWith("docs/stories/")&&e.endsWith(".story.md")?"story":e.endsWith(".rtm.md")?"traceability":e.toLowerCase().includes("adr")?"adr":e.toLowerCase().includes("contract")?"contract":e.toLowerCase().includes("nfr")?"nfr":e.endsWith(".feature")?"bdd":e.toLowerCase().includes("traceability")?"traceability":e.startsWith("docs/examples/")?"example":"spec"}function z(e){return[...new Set([...e.matchAll(P)].map(r=>r[1]).filter(r=>!!r))].sort()}function a(e,r){const s=w(e);let o;try{o=w(f(s,r))}catch{throw new Error("yolo-spec-envelope-required")}if(!o.startsWith(`${s}${b}`))throw new Error("yolo-spec-envelope-path-out-of-scope");if(!R(o).isFile())throw new Error("yolo-spec-envelope-unsafe");if(R(o).size>O)throw new Error("yolo-spec-envelope-too-large");return $(o,"utf8")}function m(e,r){const o=v(e,{context:r==="story"?"story-target":"epic-target",explicitlySelected:!0});if(o.status==="malformed"||o.status==="oversized")throw new Error("yolo-spec-envelope-unsafe");if(o.status==="absent")return e;const c=e.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n/);if(!c)throw new Error("yolo-spec-envelope-unsafe");return`---
+${Object.entries(o.metadata).map(([n,l])=>`${n}: ${JSON.stringify(l)}`).join(`
 `)}
 ---
-${e.slice(a[0].length)}`}function j(e){try{return L("git",["-C",e,"rev-parse","HEAD"],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{throw new Error("yolo-spec-envelope-stale")}}function M(e){const r=`docs/stories/${e.storyId}.story.md`,c=`docs/epics/epic-${e.epicId}.md`,o=e.headSha??j(e.projectRoot),a=m(i(e.projectRoot,r),"story"),u=m(i(e.projectRoot,c),"epic"),s=[{kind:"story",path:r,content:a},{kind:"epic",path:c,content:u}],l=new Set([`docs/stories/${e.storyId}.spec.md`,`docs/stories/${e.storyId}.tasks.md`,`docs/stories/${e.storyId}.rtm.md`]),h=[...new Set([...P(a),...[...l].filter(t=>S(f(e.projectRoot,t)))])].sort(),v=[...h.filter(t=>l.has(t)),...h.filter(t=>!l.has(t))];let p=s.reduce((t,n)=>t+Buffer.byteLength(n.content,"utf8"),0),y=0;for(const t of v){if(t===r||t===c||!S(f(e.projectRoot,t)))continue;if(t.startsWith("docs/stories/")&&t.endsWith(".story.md")||t.startsWith("docs/epics/"))throw new Error("yolo-spec-envelope-target-mismatch");const n=i(e.projectRoot,t),d=Buffer.byteLength(n,"utf8");if(s.length>=R||p+d>g){if(l.has(t))throw new Error("yolo-spec-envelope-too-large");y+=1;continue}s.push({kind:I(t),path:t,content:n}),p+=d}y&&e.onOmittedReferences?.(y);for(const t of O){if(t===r||t===c||h.includes(t)||!S(f(e.projectRoot,t)))continue;const n=i(e.projectRoot,t),d=Buffer.byteLength(n,"utf8");s.length>=R||p+d>g||(s.push({kind:I(t),path:t,content:n}),p+=d)}const _=x({storyId:e.storyId,epicId:e.epicId,targetPath:r,inputSha256:e.inputSha256,headSha:o,collectedAt:e.collectedAt??new Date().toISOString(),artifacts:s}),A=e.headSha??j(e.projectRoot);if(o!==A||m(i(e.projectRoot,r),"story")!==a||m(i(e.projectRoot,c),"epic")!==u||s.some(t=>t.kind!=="story"&&t.kind!=="epic"&&i(e.projectRoot,t.path)!==t.content))throw new Error("yolo-spec-envelope-stale");return _}export{M as collectYoloSpecEnvelope};
+${e.slice(c[0].length)}`}function _(e){try{return L("git",["-C",e,"rev-parse","HEAD"],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{throw new Error("yolo-spec-envelope-stale")}}function H(e){const r=`docs/stories/${e.storyId}.story.md`,s=`docs/epics/epic-${e.epicId}.md`,o=e.headSha??_(e.projectRoot),c=m(a(e.projectRoot,r),"story"),u=m(a(e.projectRoot,s),"epic"),n=[{kind:"story",path:r,content:c},{kind:"epic",path:s,content:u}],l=new Set([`docs/stories/${e.storyId}.spec.md`,`docs/stories/${e.storyId}.tasks.md`,`docs/stories/${e.storyId}.rtm.md`]),h=[...new Set([...z(c),...[...l].filter(t=>S(f(e.projectRoot,t)))])].sort(),T=[...h.filter(t=>l.has(t)),...h.filter(t=>!l.has(t))];let p=n.reduce((t,i)=>t+Buffer.byteLength(i.content,"utf8"),0),y=0;for(const t of T){if(t===r||t===s||!S(f(e.projectRoot,t)))continue;if(t.startsWith("docs/stories/")&&t.endsWith(".story.md")||t.startsWith("docs/epics/"))throw new Error("yolo-spec-envelope-target-mismatch");const i=a(e.projectRoot,t),d=Buffer.byteLength(i,"utf8");if(n.length>=g||p+d>I){if(l.has(t))throw new Error("yolo-spec-envelope-too-large");y+=1;continue}n.push({kind:A(t),path:t,content:i}),p+=d}y&&e.onOmittedReferences?.(y);for(const t of C){if(t===r||t===s||h.includes(t)||!S(f(e.projectRoot,t)))continue;const i=a(e.projectRoot,t),d=Buffer.byteLength(i,"utf8");n.length>=g||p+d>I||(n.push({kind:A(t),path:t,content:i}),p+=d)}const j=E({storyId:e.storyId,epicId:e.epicId,targetPath:r,inputSha256:e.inputSha256,headSha:o,collectedAt:e.collectedAt??new Date().toISOString(),artifacts:n}),x=e.headSha??_(e.projectRoot);if(o!==x||m(a(e.projectRoot,r),"story")!==c||m(a(e.projectRoot,s),"epic")!==u||n.some(t=>t.kind!=="story"&&t.kind!=="epic"&&a(e.projectRoot,t.path)!==t.content))throw new Error("yolo-spec-envelope-stale");return j}function D(e,r=new Date().toISOString()){return E({storyId:e.storyId,epicId:e.epicId,targetPath:e.targetPath,inputSha256:e.inputSha256,headSha:e.sourceRevision.headSha,collectedAt:r,artifacts:e.artifacts.map(({kind:s,path:o,content:c})=>({kind:s,path:o,content:c}))})}export{H as collectYoloSpecEnvelope,Z as extractTargetedYoloStoryId,D as refreshPrecollectedYoloSpecEnvelope};

package/packages/shared/dist/architecture-non-ui-scope.js

@@ -0,0 +1,22 @@
+/** Public syntax only. Authenticity is checked exclusively by the server. */
+const NON_UI_EXCLUDED_STAGE_COMMANDS = Object.freeze([
+    'arch-design-system',
+    'arch-ux-design',
+]);
+export function parseArchitectureNonUiScopeReceipt(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const v = value;
+    if (Object.keys(v).sort().join(',') !== ['schemaVersion', 'kind', 'licenseHash', 'projectHash', 'targetEpicId',
+        'graphRevision', 'rootInputSha256', 'accountingId', 'applicability', 'excludedStageCommands', 'macSha256', 'publicSafe'].sort().join(',')
+        || v.schemaVersion !== 1 || v.kind !== 'ArchitectureNonUiScope/1' || v.publicSafe !== true
+        || v.applicability !== 'non-ui' || typeof v.targetEpicId !== 'string' || !/^P[1-9][0-9]{0,11}$/.test(v.targetEpicId)
+        || typeof v.accountingId !== 'string' || !/^arch-accounting-[a-f0-9]{32}$/.test(v.accountingId)
+        || !['licenseHash', 'projectHash', 'graphRevision', 'rootInputSha256', 'macSha256'].every(k => typeof v[k] === 'string' && /^[a-f0-9]{64}$/.test(v[k])))
+        return undefined;
+    const excluded = NON_UI_EXCLUDED_STAGE_COMMANDS;
+    if (!Array.isArray(v.excludedStageCommands) || v.excludedStageCommands.length !== excluded.length
+        || !v.excludedStageCommands.every((s, i) => s === excluded[i]))
+        return undefined;
+    return Object.freeze({ ...v, excludedStageCommands: Object.freeze([...excluded]) });
+}

package/packages/shared/dist/architecture-public-topology.js

@@ -0,0 +1,11 @@
+/** Public command order only; no step IDs, resolutions, prompts or execution grants. */
+export const ARCHITECTURE_PUBLIC_STAGE_COMMANDS = Object.freeze([
+    'arch-prd', 'arch-architecture', 'arch-fitness-functions', 'arch-api-contracts',
+    'generate-pacts', 'arch-api-integrations', 'arch-database', 'arch-security',
+    'arch-design-system', 'arch-ux-design', 'arch-performance', 'arch-testing',
+    'arch-infrastructure', 'arch-review', 'update-memory',
+]);
+export const ARCHITECTURE_NON_UI_EXCLUDED_COMMANDS = Object.freeze([
+    'arch-design-system', 'arch-ux-design',
+]);
+export const ARCHITECTURE_NON_UI_STAGE_COMMANDS = Object.freeze(ARCHITECTURE_PUBLIC_STAGE_COMMANDS.filter(command => !ARCHITECTURE_NON_UI_EXCLUDED_COMMANDS.some(excluded => excluded === command)));

package/packages/shared/dist/project-validation-commands.js

@@ -4,15 +4,10 @@
 export const PROJECT_VALIDATION_KINDS = ['unit', 'integration', 'contract', 'bdd-example', 'e2e'];
 export function readProjectValidationCommands(storyId, sources) {
     const byKind = new Map();
-    const preparation = [];
-    let preparationOwner;
     let declared = false, invalid = false;
-    const safeCommand = (command) => /^[A-Za-z0-9_./-]+(?: [A-Za-z0-9_./:@%+=,-]+)*$/.test(command)
-        && !/(?:token|password|license_key|secret|credential)=|(?:https?|ssh):\/\/|@[^ /]+\.[A-Za-z]/i.test(command)
-        && !command.split(' ').some(arg => arg.split('/').includes('..'));
     const allowedPaths = new Set(['story', 'spec', 'tasks'].map(suffix => `docs/stories/${storyId}.${suffix}.md`));
     if (sources.length > 3 || new Set(sources.map(source => source.path)).size !== sources.length) {
-        return { declared: true, invalid: true, preparation, commands: [] };
+        return { declared: true, invalid: true, commands: [] };
     }
     for (const source of sources) {
         if (!allowedPaths.has(source.path) || Buffer.byteLength(source.content) > 131072) {
@@ -20,7 +15,7 @@ export function readProjectValidationCommands(storyId, sources) {
             declared = true;
             continue;
         }
-        let active, fenced = false, headings = 0, entries = 0;
+        let active = false, fenced = false, headings = 0, entries = 0;
         for (const raw of source.content.split(/\r?\n/)) {
             const line = raw.trim();
             if (/^(?:```|~~~)/.test(line)) {
@@ -32,37 +27,18 @@ export function readProjectValidationCommands(storyId, sources) {
             if (/^##\s+/.test(line)) {
                 if (active && entries === 0)
                     invalid = true;
-                active = line === '## Validation Commands' ? 'commands'
-                    : line === '## Validation Preparation' ? 'preparation' : undefined;
+                active = line === '## Validation Commands';
                 if (active) {
                     declared = true;
+                    headings++;
                     entries = 0;
-                    if (active === 'commands') {
-                        headings++;
-                        if (headings > 1)
-                            invalid = true;
-                    }
-                    else {
-                        if (preparationOwner !== undefined)
-                            invalid = true;
-                        preparationOwner = source.path;
-                    }
+                    if (headings > 1)
+                        invalid = true;
                 }
                 continue;
             }
             if (!active || !line)
                 continue;
-            if (active === 'preparation') {
-                const match = /^- prepare: `([^`]{1,220})`$/.exec(line);
-                if (!match || !safeCommand(match[1]) || preparation.length >= 8
-                    || preparation.some(item => item.command === match[1])) {
-                    invalid = true;
-                    continue;
-                }
-                entries++;
-                preparation.push({ command: match[1], sourcePath: source.path });
-                continue;
-            }
             const match = /^- (unit|integration|contract|bdd-example|e2e): `([^`]{1,220})`$/.exec(line);
             if (!match) {
                 invalid = true;
@@ -71,7 +47,9 @@ export function readProjectValidationCommands(storyId, sources) {
             const kind = match[1], command = match[2];
             // No shell language, quoted substitutions, inline secrets or private URLs.
             // A command stays a literal argv-shaped string throughout this planner.
-            if (!safeCommand(command)) {
+            if (!/^[A-Za-z0-9_./-]+(?: [A-Za-z0-9_./:@%+=,-]+)*$/.test(command)
+                || /(?:token|password|license_key|secret|credential)=|(?:https?|ssh):\/\/|@[^ /]+\.[A-Za-z]/i.test(command)
+                || command.split(' ').some(arg => arg.split('/').includes('..'))) {
                 invalid = true;
                 continue;
             }
@@ -92,5 +70,5 @@ export function readProjectValidationCommands(storyId, sources) {
     }
     if (declared && !byKind.has('unit'))
         invalid = true;
-    return { declared, invalid, preparation, commands: [...byKind.values()] };
+    return { declared, invalid, commands: [...byKind.values()] };
 }

package/packages/shared/dist/yolo/spec-envelope.js

@@ -6,6 +6,8 @@ export const YOLO_SPEC_TOTAL_LIMIT_BYTES = 128 * 1024;
 export const YOLO_SPEC_MAX_ARTIFACTS = 12;
 export const YOLO_SPEC_MAX_AGE_MS = 120_000;
 export const YOLO_SPEC_FUTURE_SKEW_MS = 30_000;
+/** Public server capability for both mandatory top-level YOLO invoke fields. */
+export const YOLO_INVOKE_ENVELOPE_CAPABILITY = 'yolo-invoke-envelope-v1';
 const HASH = /^[a-f0-9]{64}$/;
 const HEAD = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
 const STORY_ID = /^[A-Za-z0-9]+(?:\.[A-Za-z0-9]+)+$/;

package/targets-stubs/antigravity/gemini.md

@@ -1,4 +1,4 @@
-# 🧠 Neocortex v4.60.64 | OrNexus Team
+# 🧠 Neocortex v4.60.66 | OrNexus Team
 
 This project uses Neocortex, a Development Orchestrator.
 

package/targets-stubs/antigravity/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.64 | OrNexus Team"
+description: "🧠 Neocortex v4.60.66 | OrNexus Team"
 ---
 
 <!--

package/targets-stubs/claude-code/neocortex-root.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex Root Agent'
     title: 'Development Orchestrator (Root)'
     icon: '>'
-    version: '4.60.64'
+    version: '4.60.66'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex-root.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex Root Agent v4.60.64 | OrNexus Team"
+description: "🧠 Neocortex Root Agent v4.60.66 | OrNexus Team"
 model: opus
 color: blue
 tools:
@@ -108,7 +108,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.64                           │
+│      ###  ########      v4.60.66                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/claude-code/neocortex.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex'
     title: 'Development Orchestrator'
     icon: '>'
-    version: '4.60.64'
+    version: '4.60.66'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.64 | OrNexus Team"
+description: "🧠 Neocortex v4.60.66 | OrNexus Team"
 model: opus
 color: blue
 permissionMode: bypassPermissions
@@ -104,7 +104,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.64                           │
+│      ###  ########      v4.60.66                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/codex/AGENTS.md

@@ -28,7 +28,7 @@ Codex built-in commands or actions.
 
 <!-- END: Plugin Conflict Prevention -->
 
-# Neocortex v4.60.64 | OrNexus Team
+# Neocortex v4.60.66 | OrNexus Team
 
 You are a Development Orchestrator. All orchestration logic is delivered by the remote Neocortex server.
 

package/targets-stubs/cursor/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.64 | OrNexus Team"
+description: "🧠 Neocortex v4.60.66 | OrNexus Team"
 model: inherit
 readonly: false
 is_background: false
@@ -64,7 +64,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.64                           │
+│      ###  ########      v4.60.66                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │