@ornexus/neocortex 4.60.64 → 4.60.66

package/targets-stubs/deepseek-harness/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: neocortex
+description: Route explicit Neocortex *commands through the public thin client in DeepSeek Harness.
+user-invocable: true
+disable-model-invocation: false
+---
+
+# Neocortex in DeepSeek Harness
+
+Use this Skill when the user explicitly asks for Neocortex or sends a Neocortex
+command beginning with `*`. This is a public thin-client adapter. The Neocortex
+server supplies orchestration instructions; this Skill supplies no workflow steps.
+
+## Invoke
+
+Invocation payload boundary: first select only the explicit user-intended Neocortex command and arguments after the trigger; then preserve that selected payload verbatim when calling `neocortex-client invoke --args`.
+
+Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.
+
+Select only the user-authored Neocortex command and its arguments. Preserve that
+selected payload verbatim, including the leading `*`. Exclude conversation
+history, page content, platform metadata, logs, secrets and assistant notes.
+
+From the user's intended project workspace, run the thin client with that
+payload as one argument:
+
+```bash
+neocortex-client invoke \
+  --args '{SELECTED_USER_PAYLOAD_VERBATIM}' \
+  --project-root "$(git rev-parse --show-toplevel 2>/dev/null || pwd -P)" \
+  --format plain
+```
+
+The quoted placeholder is illustrative: use safe shell quoting for the actual
+payload. Never construct a shell command by interpolating untrusted text without
+shell quoting. If the command exits unsuccessfully, report its sanitized public
+error and resolve only supported, reversible local issues before retrying.
+
+Follow the returned stdout instructions exactly. Do not treat a `*` trigger as a
+DeepSeek Harness command, a local plugin action or an MCP tool name. Do not
+invent missing Neocortex steps or publish protected prompt bodies.
+
+For an explicitly supplied oversized synthetic story that cannot fit in a shell
+argument, use exactly one supported large-input mode (`--stdin` or
+`--args-file`) instead of `--args`. Never use those modes for ambient context.
+
+## Yoloop ownership
+
+Keep outer `*yoloop` state and re-invocation in the root Harness agent. Read
+the returned completion, abort, next-story and execution-plan metadata before
+continuing. Run only the story work authorized by the server. Do not infer a
+parallel wave or child delegation from Harness capability alone. Unless a
+current server directive and host binding explicitly authorize a child, execute
+inline. A child story result is not epic completion.
+
+When the response includes Git reconciliation or terminal Git directives,
+follow those public directives and their exact origin, SHA and receipt gates.
+Never infer a branch, force-push, clean ambiguous work or manufacture receipts.
+
+## Memory
+
+`NEOCORTEX.md` in the project is canonical shared project memory. Use the
+server's `*update-memory` flow for durable updates rather than copying private
+instructions into this Skill.

package/targets-stubs/gemini-cli/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex v4.60.64 | OrNexus Team"
+description: "🧠 Neocortex v4.60.66 | OrNexus Team"
 kind: local
 tools:
   # File operations (Gemini CLI built-ins)
@@ -62,7 +62,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.64                           │
+│      ###  ########      v4.60.66                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/opencode/neocortex-root.md

@@ -58,7 +58,7 @@ explicit server opt-in rather than a local assumption.
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.64                           │
+│      ###  ########      v4.60.66                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/vscode/neocortex.agent.md

@@ -1,6 +1,6 @@
 ---
 name: "neocortex"
-description: "Neocortex v4.60.64 | OrNexus Team"
+description: "Neocortex v4.60.66 | OrNexus Team"
 tools:
   # Read / Edit (built-in tool sets)
   - read
@@ -68,7 +68,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.64                           │
+│      ###  ########      v4.60.66                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/packages/client/dist/commands/shared-architecture-non-ui-contract.d.ts

@@ -1,19 +0,0 @@
-/** Public architecture stage projection required by the standalone client. */
-export declare const ARCHITECTURE_PUBLIC_STAGE_COMMANDS: readonly ["arch-prd", "arch-architecture", "arch-fitness-functions", "arch-api-contracts", "generate-pacts", "arch-api-integrations", "arch-database", "arch-security", "arch-design-system", "arch-ux-design", "arch-performance", "arch-testing", "arch-infrastructure", "arch-review", "update-memory"];
-export declare const NON_UI_ARCHITECTURE_STAGE_COMMANDS: readonly ["arch-prd", "arch-architecture", "arch-fitness-functions", "arch-api-contracts", "generate-pacts", "arch-api-integrations", "arch-database", "arch-security", "arch-performance", "arch-testing", "arch-infrastructure", "arch-review", "update-memory"];
-export interface ArchitectureNonUiScopeReceipt {
-    readonly schemaVersion: 1;
-    readonly kind: 'ArchitectureNonUiScope/1';
-    readonly licenseHash: string;
-    readonly projectHash: string;
-    readonly targetEpicId: string;
-    readonly graphRevision: string;
-    readonly rootInputSha256: string;
-    readonly accountingId: string;
-    readonly applicability: 'non-ui';
-    readonly excludedStageCommands: readonly string[];
-    readonly macSha256: string;
-    readonly publicSafe: true;
-}
-/** Public syntax only. Authenticity is checked by the server. */
-export declare function parseArchitectureNonUiScopeReceipt(value: unknown): ArchitectureNonUiScopeReceipt | undefined;

package/packages/client/dist/commands/shared-architecture-non-ui-contract.js

@@ -1 +0,0 @@
-const i=Object.freeze(["arch-prd","arch-architecture","arch-fitness-functions","arch-api-contracts","generate-pacts","arch-api-integrations","arch-database","arch-security","arch-design-system","arch-ux-design","arch-performance","arch-testing","arch-infrastructure","arch-review","update-memory"]),s=Object.freeze(["arch-prd","arch-architecture","arch-fitness-functions","arch-api-contracts","generate-pacts","arch-api-integrations","arch-database","arch-security","arch-performance","arch-testing","arch-infrastructure","arch-review","update-memory"]),a=Object.freeze(["arch-design-system","arch-ux-design"]);function o(r){if(!r||typeof r!="object"||Array.isArray(r))return;const e=r,c=["schemaVersion","kind","licenseHash","projectHash","targetEpicId","graphRevision","rootInputSha256","accountingId","applicability","excludedStageCommands","macSha256","publicSafe"];if(!(Object.keys(e).sort().join(",")!==c.sort().join(",")||e.schemaVersion!==1||e.kind!=="ArchitectureNonUiScope/1"||e.publicSafe!==!0||e.applicability!=="non-ui"||typeof e.targetEpicId!="string"||!/^P[1-9][0-9]{0,11}$/.test(e.targetEpicId)||typeof e.accountingId!="string"||!/^arch-accounting-[a-f0-9]{32}$/.test(e.accountingId)||!["licenseHash","projectHash","graphRevision","rootInputSha256","macSha256"].every(t=>typeof e[t]=="string"&&/^[a-f0-9]{64}$/.test(e[t])))&&!(!Array.isArray(e.excludedStageCommands)||e.excludedStageCommands.length!==a.length||!e.excludedStageCommands.every((t,n)=>t===a[n])))return Object.freeze({...e,excludedStageCommands:Object.freeze([...a])})}export{i as ARCHITECTURE_PUBLIC_STAGE_COMMANDS,s as NON_UI_ARCHITECTURE_STAGE_COMMANDS,o as parseArchitectureNonUiScopeReceipt};

package/packages/shared/dist/invocation/packed-invoke.d.ts

@@ -1,12 +0,0 @@
-export declare const PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES: number;
-interface PackedInvokeEnvelope {
-    readonly schemaVersion: 'PackedInvokeEnvelope/1';
-    readonly compression: 'gzip';
-    readonly uncompressedBytes: number;
-    readonly sha256: string;
-    readonly payload: string;
-}
-/** Keep the signed HTTP body below 256 KiB without changing the invoke JSON. */
-export declare function packInvokeEnvelope(body: Record<string, unknown>): PackedInvokeEnvelope;
-export declare function unpackInvokeEnvelope(value: unknown): Record<string, unknown>;
-export {};

package/packages/shared/dist/invocation/packed-invoke.js

@@ -1,58 +0,0 @@
-import { createHash } from 'node:crypto';
-import { gzipSync, gunzipSync } from 'node:zlib';
-export const PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES = 512 * 1024;
-const PACKED_INVOKE_MAX_COMPRESSED_BYTES = 192 * 1024;
-function isRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-/** Keep the signed HTTP body below 256 KiB without changing the invoke JSON. */
-export function packInvokeEnvelope(body) {
-    const raw = Buffer.from(JSON.stringify(body), 'utf8');
-    if (raw.length > PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES)
-        throw new Error('packed-invoke-too-large');
-    const compressed = gzipSync(raw, { level: 6 });
-    if (compressed.length > PACKED_INVOKE_MAX_COMPRESSED_BYTES)
-        throw new Error('packed-invoke-too-large');
-    return {
-        schemaVersion: 'PackedInvokeEnvelope/1',
-        compression: 'gzip',
-        uncompressedBytes: raw.length,
-        sha256: createHash('sha256').update(raw).digest('hex'),
-        payload: compressed.toString('base64'),
-    };
-}
-export function unpackInvokeEnvelope(value) {
-    if (!isRecord(value) || Object.keys(value).sort().join(',') !==
-        'compression,payload,schemaVersion,sha256,uncompressedBytes'
-        || value.schemaVersion !== 'PackedInvokeEnvelope/1' || value.compression !== 'gzip'
-        || !Number.isSafeInteger(value.uncompressedBytes) || value.uncompressedBytes < 1
-        || value.uncompressedBytes > PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES
-        || typeof value.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(value.sha256)
-        || typeof value.payload !== 'string' || value.payload.length > Math.ceil(PACKED_INVOKE_MAX_COMPRESSED_BYTES * 4 / 3) + 4
-        || !/^[A-Za-z0-9+/]+={0,2}$/.test(value.payload))
-        throw new Error('packed-invoke-invalid');
-    const compressed = Buffer.from(value.payload, 'base64');
-    if (compressed.length > PACKED_INVOKE_MAX_COMPRESSED_BYTES
-        || compressed.toString('base64') !== value.payload)
-        throw new Error('packed-invoke-invalid');
-    let raw;
-    try {
-        raw = gunzipSync(compressed, { maxOutputLength: PACKED_INVOKE_MAX_UNCOMPRESSED_BYTES });
-    }
-    catch {
-        throw new Error('packed-invoke-invalid');
-    }
-    if (raw.length !== value.uncompressedBytes
-        || createHash('sha256').update(raw).digest('hex') !== value.sha256)
-        throw new Error('packed-invoke-invalid');
-    let parsed;
-    try {
-        parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(raw));
-    }
-    catch {
-        throw new Error('packed-invoke-invalid');
-    }
-    if (!isRecord(parsed) || parsed.schemaVersion === 'PackedInvokeEnvelope/1')
-        throw new Error('packed-invoke-invalid');
-    return parsed;
-}

package/packages/shared/dist/invocation/packed-invoke.test.d.ts

@@ -1 +0,0 @@
-export {};

package/packages/shared/dist/invocation/packed-invoke.test.js

@@ -1,21 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { packInvokeEnvelope, unpackInvokeEnvelope } from './packed-invoke.js';
-describe('signed invoke transport packing', () => {
-    it('round trips a large structural request within the HTTP body limit', () => {
-        const original = { args: '*yolo @docs/stories/P222.26.story.md', stateSnapshot: {
-                stories: Object.fromEntries(Array.from({ length: 27 }, (_, index) => [
-                    `P222.${index + 1}`, { checkpoint: { qaReceipt: 'verified'.repeat(1300), headSha: String(index) } },
-                ])),
-            } };
-        expect(Buffer.byteLength(JSON.stringify(original))).toBeGreaterThan(262_144);
-        const packed = packInvokeEnvelope(original);
-        expect(Buffer.byteLength(JSON.stringify(packed))).toBeLessThan(262_144);
-        expect(unpackInvokeEnvelope(packed)).toEqual(original);
-    });
-    it('rejects modified bytes, extra fields, and excess expansion', () => {
-        const packed = packInvokeEnvelope({ args: '*status' });
-        expect(() => unpackInvokeEnvelope({ ...packed, sha256: '0'.repeat(64) })).toThrow('packed-invoke-invalid');
-        expect(() => unpackInvokeEnvelope({ ...packed, injected: true })).toThrow('packed-invoke-invalid');
-        expect(() => packInvokeEnvelope({ data: 'x'.repeat(512 * 1024) })).toThrow('packed-invoke-too-large');
-    });
-});