@ornexus/neocortex 4.60.68 → 4.60.69

package/packages/client/dist/runner/binary.js

@@ -1,404 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * P181.02 -- shared trusted neocortex-runner binary resolution.
- */
-import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
-import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep, win32 } from 'node:path';
-export const RUNNER_BINARY_REASON_CODES = Object.freeze({
-    OK: 'continuity-ok',
-    MISSING: 'runner-binary-missing',
-    AMBIGUOUS: 'runner-binary-ambiguous',
-    NON_EXECUTABLE: 'runner-binary-non-executable',
-    VERSION_MISMATCHED: 'runner-binary-version-mismatched',
-    UNTRUSTED: 'runner-binary-untrusted',
-});
-export const HEADLESS_RUNTIME_BINARY_REASON_CODES = Object.freeze({
-    OK: 'continuity-ok',
-    UNAVAILABLE: 'headless-adapter-unavailable',
-    UNTRUSTED: 'headless-runtime-untrusted',
-});
-const ACCEPTED_PACKAGE_NAMES = new Set(['@ornexus/neocortex', '@neocortex/client']);
-const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
-export function resolveTrustedRunnerBinary(options = {}) {
-    const startDir = resolveStartDirectory(options);
-    if (!startDir)
-        return failure(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner binary resolution did not receive a usable start path.');
-    const packageInfo = findNearestAcceptedPackage(startDir);
-    if (!packageInfo)
-        return failure(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner binary was not inside an accepted Neocortex package.');
-    const { packageRoot, pkg } = packageInfo;
-    const packageName = typeof pkg.name === 'string' ? pkg.name : undefined;
-    const packageVersion = typeof pkg.version === 'string' ? pkg.version : undefined;
-    const provenance = inferProvenance(packageRoot, packageName);
-    if (!packageName || !ACCEPTED_PACKAGE_NAMES.has(packageName)) {
-        return failure(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner package identity was not accepted.', { packageName, packageVersion, packageRoot, provenance });
-    }
-    if (!packageVersion || !VERSION_PATTERN.test(packageVersion)) {
-        return failure(RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED, 'Runner package version was missing or invalid.', { packageName, packageVersion, packageRoot, provenance });
-    }
-    const expectedRelativePath = expectedRunnerBinRelativePath(pkg, packageName);
-    if (!expectedRelativePath) {
-        return failure(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner package did not declare an accepted runner bin target.', { packageName, packageVersion, packageRoot, provenance });
-    }
-    const expectedPath = resolvePackageRelative(packageRoot, expectedRelativePath);
-    const executablePath = safeRealpath(expectedPath);
-    if (!executablePath || !existsSync(executablePath)) {
-        return failure(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner package bin target was not present.', { packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    const executableCheck = checkExecutableFile(executablePath, options.platform, options.requireExecutable);
-    if (executableCheck) {
-        return failure(executableCheck, reasonSummary(executableCheck), { packageName, packageVersion, packageRoot, executablePath, expectedRelativePath, provenance });
-    }
-    const versionMismatch = packageVersionMismatch(packageRoot, packageName, packageVersion);
-    if (versionMismatch) {
-        return failure(RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED, 'Runner package version did not match the development workspace root.', { packageName, packageVersion, packageRoot, executablePath, expectedRelativePath, provenance });
-    }
-    return {
-        ok: true,
-        trusted: true,
-        command: executablePath,
-        args: [],
-        executablePath,
-        packageName,
-        packageVersion,
-        packageRoot,
-        expectedRelativePath,
-        provenance,
-        reasonCodes: [RUNNER_BINARY_REASON_CODES.OK],
-        publicSummary: `Resolved trusted ${provenance} runner for ${packageName}.`,
-        publicSafe: true,
-    };
-}
-export function checkRunnerBinaryTrust(executablePath, options = {}) {
-    const absoluteExecutable = safeAbsolutePath(executablePath);
-    if (!absoluteExecutable)
-        return untrusted(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner executable path was missing.');
-    const resolvedExecutable = safeRealpath(absoluteExecutable);
-    if (!resolvedExecutable || !existsSync(resolvedExecutable)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner executable was not present.', { executablePath: absoluteExecutable });
-    }
-    const packageInfo = findNearestAcceptedPackage(dirname(resolvedExecutable));
-    if (!packageInfo) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner executable was not inside an accepted Neocortex package.', { executablePath: resolvedExecutable });
-    }
-    const { packageRoot, pkg } = packageInfo;
-    const packageName = typeof pkg.name === 'string' ? pkg.name : undefined;
-    const packageVersion = typeof pkg.version === 'string' ? pkg.version : undefined;
-    const provenance = inferProvenance(packageRoot, packageName);
-    if (!packageName || !ACCEPTED_PACKAGE_NAMES.has(packageName)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner package identity was not accepted.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, provenance });
-    }
-    if (!packageVersion || !VERSION_PATTERN.test(packageVersion)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED, 'Runner package version was missing or invalid.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, provenance });
-    }
-    const expectedRelativePath = expectedRunnerBinRelativePath(pkg, packageName);
-    if (!expectedRelativePath) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner package did not declare an accepted runner bin target.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, provenance });
-    }
-    const expectedPath = safeRealpath(resolvePackageRelative(packageRoot, expectedRelativePath));
-    if (!expectedPath || !existsSync(expectedPath)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner package bin target was not present.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    if (expectedPath !== resolvedExecutable) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner executable did not match the package-declared bin target.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    const executableCheck = checkExecutableFile(resolvedExecutable, options.platform, options.requireExecutable);
-    if (executableCheck) {
-        return untrusted(executableCheck, reasonSummary(executableCheck), { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    if (packageVersionMismatch(packageRoot, packageName, packageVersion)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED, 'Runner package version did not match the development workspace root.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    return {
-        trusted: true,
-        packageName,
-        packageVersion,
-        packageRoot,
-        executablePath: resolvedExecutable,
-        expectedRelativePath,
-        provenance,
-        reasonCodes: [RUNNER_BINARY_REASON_CODES.OK],
-        publicSummary: `Trusted ${provenance} runner for ${packageName}.`,
-        publicSafe: true,
-    };
-}
-export function runnerTrustRelativePath(packageRoot, executablePath) {
-    if (looksWindowsPath(packageRoot) || looksWindowsPath(executablePath)) {
-        return win32.relative(packageRoot, executablePath).split('\\').join('/');
-    }
-    return relative(packageRoot, executablePath).split('\\').join('/');
-}
-export function checkTrustedHeadlessRuntimeBinary(options) {
-    const commandName = options.commandName;
-    const realpathBasenamePolicy = options.realpathBasenamePolicy ?? 'strict';
-    if (!isSafeCommandName(commandName)) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNTRUSTED, 'Headless runtime command name was not allowlisted by adapter code.', commandName, 'commandName', 'unsafe_key');
-    }
-    const locator = options.commandLocator ?? defaultHeadlessRuntimeCommandLocator;
-    const candidate = locator(commandName, options.env);
-    if (!candidate) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNAVAILABLE, 'Headless runtime command was not found on PATH.', commandName, 'runtimeBinary', 'missing');
-    }
-    if (!isSafeRuntimeExecutableCandidate(candidate, commandName, options.platform)) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNTRUSTED, 'Headless runtime executable path did not match adapter-owned command constraints.', commandName, 'runtimeBinary', 'executable_path');
-    }
-    const resolvedExecutable = safeRealpath(candidate);
-    if (!resolvedExecutable || !existsSync(resolvedExecutable)) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNAVAILABLE, 'Headless runtime executable was not present.', commandName, 'runtimeBinary', 'missing');
-    }
-    if (!isTrustedRuntimeRealpathBasename(resolvedExecutable, commandName, options.platform, realpathBasenamePolicy)) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNTRUSTED, 'Headless runtime executable realpath did not match adapter-owned command constraints.', commandName, 'runtimeBinary', 'executable_path');
-    }
-    const executableCheck = checkExecutableFile(resolvedExecutable, options.platform, options.requireExecutable ?? true);
-    if (executableCheck) {
-        return headlessRuntimeBinaryFailure(executableCheck === RUNNER_BINARY_REASON_CODES.NON_EXECUTABLE || executableCheck === RUNNER_BINARY_REASON_CODES.MISSING
-            ? HEADLESS_RUNTIME_BINARY_REASON_CODES.UNAVAILABLE
-            : HEADLESS_RUNTIME_BINARY_REASON_CODES.UNTRUSTED, reasonSummary(executableCheck), commandName, 'runtimeBinary', executableCheck);
-    }
-    const result = {
-        ok: true,
-        trusted: true,
-        commandName,
-        reasonCodes: [HEADLESS_RUNTIME_BINARY_REASON_CODES.OK],
-        publicSummary: `Trusted headless runtime command ${commandName} is available.`,
-        redactionSummary: [],
-        publicSafe: true,
-    };
-    Object.defineProperty(result, 'executablePath', {
-        value: resolvedExecutable,
-        enumerable: false,
-        configurable: false,
-    });
-    return result;
-}
-export function defaultHeadlessRuntimeCommandLocator(commandName, env = process.env) {
-    if (!isSafeCommandName(commandName))
-        return undefined;
-    const pathValue = env.PATH ?? '';
-    const pathExt = process.platform === 'win32'
-        ? (env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM').split(';').filter(Boolean)
-        : [''];
-    for (const entry of pathValue.split(delimiter)) {
-        if (!entry || /[\r\n\0]/.test(entry))
-            continue;
-        for (const ext of pathExt) {
-            const candidate = resolve(entry, `${commandName}${ext}`);
-            if (existsSync(candidate))
-                return candidate;
-        }
-    }
-    return undefined;
-}
-function resolveStartDirectory(options) {
-    if (options.packageRoot)
-        return safeAbsolutePath(options.packageRoot);
-    const from = safeAbsolutePath(options.from ?? process.argv[1]);
-    if (!from)
-        return null;
-    const real = safeRealpath(from);
-    if (real) {
-        try {
-            const stat = statSync(real);
-            return stat.isDirectory() ? real : dirname(real);
-        }
-        catch {
-            return dirname(real);
-        }
-    }
-    return dirname(from);
-}
-function safeAbsolutePath(value) {
-    if (!value || /[\r\n\0]/.test(value))
-        return null;
-    const resolved = isAbsolute(value) ? value : resolve(value);
-    return isAbsolute(resolved) ? resolved : null;
-}
-function safeRealpath(path) {
-    try {
-        return realpathSync(path);
-    }
-    catch {
-        return null;
-    }
-}
-function findNearestAcceptedPackage(startDir) {
-    let current = startDir;
-    for (let depth = 0; depth < 10; depth++) {
-        const pkg = readPackageJson(join(current, 'package.json'));
-        if (pkg && typeof pkg.name === 'string' && ACCEPTED_PACKAGE_NAMES.has(pkg.name)) {
-            return { packageRoot: current, pkg };
-        }
-        const parent = dirname(current);
-        if (parent === current)
-            break;
-        current = parent;
-    }
-    return null;
-}
-function findRootPackage(startDir) {
-    let current = startDir;
-    for (let depth = 0; depth < 10; depth++) {
-        const pkg = readPackageJson(join(current, 'package.json'));
-        if (pkg?.name === '@ornexus/neocortex')
-            return { packageRoot: current, pkg };
-        const parent = dirname(current);
-        if (parent === current)
-            break;
-        current = parent;
-    }
-    return null;
-}
-function readPackageJson(path) {
-    try {
-        return JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-function expectedRunnerBinRelativePath(pkg, packageName) {
-    const bin = isRecord(pkg.bin) ? pkg.bin['neocortex-runner'] : undefined;
-    if (typeof bin !== 'string' || bin.length === 0)
-        return null;
-    const normalized = normalizePackageRelativePath(bin);
-    if (packageName === '@ornexus/neocortex' && normalized !== 'packages/client/dist/runner-cli.js')
-        return null;
-    if (packageName === '@neocortex/client' && normalized !== 'dist/runner-cli.js')
-        return null;
-    return normalized;
-}
-function normalizePackageRelativePath(value) {
-    return value.replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '');
-}
-function resolvePackageRelative(packageRoot, normalizedRelativePath) {
-    return resolve(packageRoot, ...normalizedRelativePath.split('/').filter(Boolean));
-}
-function inferProvenance(packageRoot, packageName) {
-    if (packageName === '@ornexus/neocortex')
-        return 'published-root-package';
-    if (packageName !== '@neocortex/client')
-        return 'published-client-package';
-    const rootInfo = findRootPackage(dirname(packageRoot));
-    return rootInfo ? 'development-workspace' : 'published-client-package';
-}
-function packageVersionMismatch(packageRoot, packageName, packageVersion) {
-    if (packageName !== '@neocortex/client')
-        return false;
-    const rootInfo = findRootPackage(dirname(packageRoot));
-    return Boolean(rootInfo && rootInfo.pkg.version !== packageVersion);
-}
-function checkExecutableFile(executablePath, platform = process.platform, requireExecutable = true) {
-    try {
-        const stat = statSync(executablePath);
-        if (!stat.isFile())
-            return RUNNER_BINARY_REASON_CODES.AMBIGUOUS;
-        if (requireExecutable && platform !== 'win32' && (stat.mode & 0o111) === 0)
-            return RUNNER_BINARY_REASON_CODES.NON_EXECUTABLE;
-        return null;
-    }
-    catch {
-        return RUNNER_BINARY_REASON_CODES.MISSING;
-    }
-}
-function failure(reasonCode, publicSummary, details = {}) {
-    const safeDetails = publicFailureDetails(details);
-    return {
-        ok: false,
-        trusted: false,
-        reasonCode,
-        reasonCodes: [reasonCode],
-        publicSummary: boundPublicSummary(publicSummary),
-        publicSafe: true,
-        ...safeDetails,
-    };
-}
-function untrusted(reasonCode, publicSummary, details = {}) {
-    const safeDetails = publicFailureDetails(details);
-    return {
-        trusted: false,
-        reasonCode,
-        reasonCodes: [reasonCode],
-        publicSummary: boundPublicSummary(publicSummary),
-        publicSafe: true,
-        ...safeDetails,
-    };
-}
-function publicFailureDetails(details) {
-    return {
-        ...(details.packageName ? { packageName: details.packageName } : {}),
-        ...(details.packageVersion ? { packageVersion: details.packageVersion } : {}),
-        ...(details.expectedRelativePath ? { expectedRelativePath: details.expectedRelativePath } : {}),
-        ...(details.provenance ? { provenance: details.provenance } : {}),
-    };
-}
-function reasonSummary(reasonCode) {
-    switch (reasonCode) {
-        case RUNNER_BINARY_REASON_CODES.MISSING:
-            return 'Runner package bin target was not present.';
-        case RUNNER_BINARY_REASON_CODES.AMBIGUOUS:
-            return 'Runner binary candidate was ambiguous.';
-        case RUNNER_BINARY_REASON_CODES.NON_EXECUTABLE:
-            return 'Runner package bin target was not executable.';
-        case RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED:
-            return 'Runner package version did not match the development workspace root.';
-        default:
-            return 'Runner binary trust check failed.';
-    }
-}
-function boundPublicSummary(value) {
-    return value.length <= 180 ? value : `${value.slice(0, 180)}…[TRUNCATED:${value.length - 180}]`;
-}
-function looksWindowsPath(value) {
-    return /^[A-Za-z]:[\\/]/.test(value) || value.includes('\\') || sep === '\\';
-}
-function isRecord(value) {
-    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
-}
-function isSafeCommandName(value) {
-    return /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(value) && !/[\\/\s;&|`$<>\r\n\0]/.test(value);
-}
-function isSafeRuntimeExecutableCandidate(value, commandName, platform = process.platform) {
-    if (!value || /[\r\n\0]/.test(value) || !isAbsolute(value))
-        return false;
-    const base = basename(value).toLowerCase();
-    const expected = commandName.toLowerCase();
-    if (platform === 'win32') {
-        return base === expected || ['.exe', '.cmd', '.bat', '.com'].some((ext) => base === `${expected}${ext}`);
-    }
-    return base === expected;
-}
-function isTrustedRuntimeRealpathBasename(value, commandName, platform = process.platform, policy = 'strict') {
-    if (isSafeRuntimeExecutableCandidate(value, commandName, platform))
-        return true;
-    if (policy === 'opencode-npm-native' && commandName === 'opencode') {
-        if (!value || /[\r\n\0]/.test(value) || !isAbsolute(value))
-            return false;
-        return basename(value).toLowerCase() === 'opencode.exe';
-    }
-    if (policy !== 'claude-code-versioned' || commandName !== 'claude')
-        return false;
-    if (!value || /[\r\n\0]/.test(value) || !isAbsolute(value))
-        return false;
-    return isClaudeCodeVersionedRealpathBasename(basename(value), platform);
-}
-function isClaudeCodeVersionedRealpathBasename(value, platform = process.platform) {
-    const lower = value.toLowerCase();
-    const normalized = platform === 'win32'
-        ? lower.replace(/\.(?:exe|cmd|bat|com)$/i, '')
-        : lower;
-    return /^(?:(?:claude|claude-code)[._-])?v?\d+\.\d+\.\d+(?:[-+][0-9a-z][0-9a-z.-]*)?(?:\.(?:js|mjs|cjs))?$/.test(normalized);
-}
-function headlessRuntimeBinaryFailure(reasonCode, publicSummary, commandName, field, reason) {
-    return {
-        ok: false,
-        trusted: false,
-        ...(commandName && isSafeCommandName(commandName) ? { commandName } : {}),
-        reasonCode,
-        reasonCodes: [reasonCode],
-        publicSummary: boundPublicSummary(publicSummary),
-        redactionSummary: [{ field, reason, evidence: 'value-denied', publicSafe: true }],
-        publicSafe: true,
-    };
-}
+import{existsSync as g,readFileSync as j,realpathSync as z,statSync as P}from"node:fs";import{basename as E,delimiter as K,dirname as p,isAbsolute as R,join as B,relative as X,resolve as y,sep as F,win32 as Z}from"node:path";const o=Object.freeze({OK:"continuity-ok",MISSING:"runner-binary-missing",AMBIGUOUS:"runner-binary-ambiguous",NON_EXECUTABLE:"runner-binary-non-executable",VERSION_MISMATCHED:"runner-binary-version-mismatched",UNTRUSTED:"runner-binary-untrusted"}),m=Object.freeze({OK:"continuity-ok",UNAVAILABLE:"headless-adapter-unavailable",UNTRUSTED:"headless-runtime-untrusted"}),I=new Set(["@ornexus/neocortex","@neocortex/client"]),w=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function re(e={}){const t=J(e);if(!t)return b(o.MISSING,"Runner binary resolution did not receive a usable start path.");const r=v(t);if(!r)return b(o.AMBIGUOUS,"Runner binary was not inside an accepted Neocortex package.");const{packageRoot:n,pkg:c}=r,a=typeof c.name=="string"?c.name:void 0,u=typeof c.version=="string"?c.version:void 0,i=G(n,a);if(!a||!I.has(a))return b(o.AMBIGUOUS,"Runner package identity was not accepted.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});if(!u||!w.test(u))return b(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});const s=_(c,a);if(!s)return b(o.MISSING,"Runner package did not declare an accepted runner bin target.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});const d=D(n,s),l=x(d);if(!l||!g(l))return b(o.MISSING,"Runner package bin target was not present.",{packageName:a,packageVersion:u,packageRoot:n,expectedRelativePath:s,provenance:i});const S=N(l,e.platform,e.requireExecutable);return S?b(S,T(S),{packageName:a,packageVersion:u,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:i}):L(n,a,u)?b(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{packageName:a,packageVersion:u,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:i}):{ok:!0,trusted:!0,command:l,args:[],executablePath:l,packageName:a,packageVersion:u,packageRoot:n,expectedRelativePath:s,provenance:i,reasonCodes:[o.OK],publicSummary:`Resolved trusted ${i} runner for ${a}.`,publicSafe:!0}}function ae(e,t={}){const r=A(e);if(!r)return f(o.MISSING,"Runner executable path was missing.");const n=x(r);if(!n||!g(n))return f(o.MISSING,"Runner executable was not present.",{executablePath:r});const c=v(p(n));if(!c)return f(o.AMBIGUOUS,"Runner executable was not inside an accepted Neocortex package.",{executablePath:n});const{packageRoot:a,pkg:u}=c,i=typeof u.name=="string"?u.name:void 0,s=typeof u.version=="string"?u.version:void 0,d=G(a,i);if(!i||!I.has(i))return f(o.AMBIGUOUS,"Runner package identity was not accepted.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});if(!s||!w.test(s))return f(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});const l=_(u,i);if(!l)return f(o.MISSING,"Runner package did not declare an accepted runner bin target.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});const S=x(D(a,l));if(!S||!g(S))return f(o.MISSING,"Runner package bin target was not present.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});if(S!==n)return f(o.AMBIGUOUS,"Runner executable did not match the package-declared bin target.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});const k=N(n,t.platform,t.requireExecutable);return k?f(k,T(k),{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):L(a,i,s)?f(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):{trusted:!0,packageName:i,packageVersion:s,packageRoot:a,executablePath:n,expectedRelativePath:l,provenance:d,reasonCodes:[o.OK],publicSummary:`Trusted ${d} runner for ${i}.`,publicSafe:!0}}function ce(e,t){return H(e)||H(t)?Z.relative(e,t).split("\\").join("/"):X(e,t).split("\\").join("/")}function oe(e){const t=e.commandName,r=e.realpathBasenamePolicy??"strict";if(!M(t))return h(m.UNTRUSTED,"Headless runtime command name was not allowlisted by adapter code.",t,"commandName","unsafe_key");const c=(e.commandLocator??q)(t,e.env);if(!c)return h(m.UNAVAILABLE,"Headless runtime command was not found on PATH.",t,"runtimeBinary","missing");if(!$(c,t,e.platform))return h(m.UNTRUSTED,"Headless runtime executable path did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const a=x(c);if(!a||!g(a))return h(m.UNAVAILABLE,"Headless runtime executable was not present.",t,"runtimeBinary","missing");if(!Q(a,t,e.platform,r))return h(m.UNTRUSTED,"Headless runtime executable realpath did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const u=N(a,e.platform,e.requireExecutable??!0);if(u)return h(u===o.NON_EXECUTABLE||u===o.MISSING?m.UNAVAILABLE:m.UNTRUSTED,T(u),t,"runtimeBinary",u);const i={ok:!0,trusted:!0,commandName:t,reasonCodes:[m.OK],publicSummary:`Trusted headless runtime command ${t} is available.`,redactionSummary:[],publicSafe:!0};return Object.defineProperty(i,"executablePath",{value:a,enumerable:!1,configurable:!1}),i}function q(e,t=process.env){if(!M(e))return;const r=t.PATH??"",n=process.platform==="win32"?(t.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean):[""];for(const c of r.split(K))if(!(!c||/[\r\n\0]/.test(c)))for(const a of n){const u=y(c,`${e}${a}`);if(g(u))return u}}function J(e){if(e.packageRoot)return A(e.packageRoot);const t=A(e.from??process.argv[1]);if(!t)return null;const r=x(t);if(r)try{return P(r).isDirectory()?r:p(r)}catch{return p(r)}return p(t)}function A(e){if(!e||/[\r\n\0]/.test(e))return null;const t=R(e)?e:y(e);return R(t)?t:null}function x(e){try{return z(e)}catch{return null}}function v(e){let t=e;for(let r=0;r<10;r++){const n=O(B(t,"package.json"));if(n&&typeof n.name=="string"&&I.has(n.name))return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function C(e){let t=e;for(let r=0;r<10;r++){const n=O(B(t,"package.json"));if(n?.name==="@ornexus/neocortex")return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function O(e){try{return JSON.parse(j(e,"utf8"))}catch{return null}}function _(e,t){const r=W(e.bin)?e.bin["neocortex-runner"]:void 0;if(typeof r!="string"||r.length===0)return null;const n=Y(r);return t==="@ornexus/neocortex"&&n!=="packages/client/dist/runner-cli.js"||t==="@neocortex/client"&&n!=="dist/runner-cli.js"?null:n}function Y(e){return e.replace(/\\/g,"/").replace(/^\.\//,"").replace(/^\/+/,"")}function D(e,t){return y(e,...t.split("/").filter(Boolean))}function G(e,t){return t==="@ornexus/neocortex"?"published-root-package":t!=="@neocortex/client"?"published-client-package":C(p(e))?"development-workspace":"published-client-package"}function L(e,t,r){if(t!=="@neocortex/client")return!1;const n=C(p(e));return!!(n&&n.pkg.version!==r)}function N(e,t=process.platform,r=!0){try{const n=P(e);return n.isFile()?r&&t!=="win32"&&(n.mode&73)===0?o.NON_EXECUTABLE:null:o.AMBIGUOUS}catch{return o.MISSING}}function b(e,t,r={}){const n=V(r);return{ok:!1,trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:U(t),publicSafe:!0,...n}}function f(e,t,r={}){const n=V(r);return{trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:U(t),publicSafe:!0,...n}}function V(e){return{...e.packageName?{packageName:e.packageName}:{},...e.packageVersion?{packageVersion:e.packageVersion}:{},...e.expectedRelativePath?{expectedRelativePath:e.expectedRelativePath}:{},...e.provenance?{provenance:e.provenance}:{}}}function T(e){switch(e){case o.MISSING:return"Runner package bin target was not present.";case o.AMBIGUOUS:return"Runner binary candidate was ambiguous.";case o.NON_EXECUTABLE:return"Runner package bin target was not executable.";case o.VERSION_MISMATCHED:return"Runner package version did not match the development workspace root.";default:return"Runner binary trust check failed."}}function U(e){return e.length<=180?e:`${e.slice(0,180)}\u2026[TRUNCATED:${e.length-180}]`}function H(e){return/^[A-Za-z]:[\\/]/.test(e)||e.includes("\\")||F==="\\"}function W(e){return!!(e&&typeof e=="object"&&!Array.isArray(e))}function M(e){return/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(e)&&!/[\\/\s;&|`$<>\r\n\0]/.test(e)}function $(e,t,r=process.platform){if(!e||/[\r\n\0]/.test(e)||!R(e))return!1;const n=E(e).toLowerCase(),c=t.toLowerCase();return r==="win32"?n===c||[".exe",".cmd",".bat",".com"].some(a=>n===`${c}${a}`):n===c}function Q(e,t,r=process.platform,n="strict"){return $(e,t,r)?!0:n==="opencode-npm-native"&&t==="opencode"?!e||/[\r\n\0]/.test(e)||!R(e)?!1:E(e).toLowerCase()==="opencode.exe":n!=="claude-code-versioned"||t!=="claude"||!e||/[\r\n\0]/.test(e)||!R(e)?!1:ee(E(e),r)}function ee(e,t=process.platform){const r=e.toLowerCase(),n=t==="win32"?r.replace(/\.(?:exe|cmd|bat|com)$/i,""):r;return/^(?:(?:claude|claude-code)[._-])?v?\d+\.\d+\.\d+(?:[-+][0-9a-z][0-9a-z.-]*)?(?:\.(?:js|mjs|cjs))?$/.test(n)}function h(e,t,r,n,c){return{ok:!1,trusted:!1,...r&&M(r)?{commandName:r}:{},reasonCode:e,reasonCodes:[e],publicSummary:U(t),redactionSummary:[{field:n,reason:c,evidence:"value-denied",publicSafe:!0}],publicSafe:!0}}export{m as HEADLESS_RUNTIME_BINARY_REASON_CODES,o as RUNNER_BINARY_REASON_CODES,ae as checkRunnerBinaryTrust,oe as checkTrustedHeadlessRuntimeBinary,q as defaultHeadlessRuntimeCommandLocator,re as resolveTrustedRunnerBinary,ce as runnerTrustRelativePath};