@ornexus/neocortex 4.60.68 → 4.60.70

package/packages/client/dist/agent/update-description.js

@@ -1,251 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - Agent Description Updater (Multi-Platform)
- *
- * Updates the installed agent description across ALL supported platforms
- * with dynamic values: version, tier, and branding.
- *
- * Patches THREE surfaces per file (when present):
- *   1. YAML frontmatter `description: "..."` or Markdown H1 `# ...`
- *   2. ASCII banner version line:  `│      ###  ########      vX.X.X ...│`
- *   3. ASCII banner tier line:     `│ ##   ###  ######  ##    OrNexus Team (Tier) ...│`
- *
- * Supported platforms (home-level):
- *   - Claude Code:  ~/.claude/agents/neocortex/neocortex.md  (YAML frontmatter)
- *   - Gemini CLI:   ~/.gemini/agents/agent.md                (YAML frontmatter)
- *
- * Supported platforms (project-level, discovered via git root):
- *   - Cursor:       <root>/.cursor/agents/neocortex.md       (YAML frontmatter)
- *   - VSCode:       <root>/.github/agents/neocortex.md       (YAML frontmatter)
- *   - Codex:        <root>/AGENTS.md                         (Markdown H1)
- *   - Antigravity:  <root>/.agent/skills/neocortex/SKILL.md  (YAML frontmatter)
- *
- * Called after:
- *   - License activation (activate.ts)
- *   - Install (install.sh via sed fallback for all platforms)
- *
- * Format: 🧠 Neocortex vX.X.X (Tier) | OrNexus Team
- */
-import { readFileSync, writeFileSync, existsSync } from 'node:fs';
-import { execSync } from 'node:child_process';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-// ── Constants ─────────────────────────────────────────────────────────────
-const CONFIG_FILE = join(homedir(), '.neocortex', 'config.json');
-const TIER_LABELS = {
-    free: 'Free',
-    pro: 'Pro',
-    enterprise: 'Enterprise',
-};
-/**
- * Banner frame geometry.
- * Frame is 62 chars wide: │ + 60 inner chars + │
- * Both dynamic lines have a 25-char inner prefix (after the leading │).
- */
-const BANNER_INNER_WIDTH = 60;
-const BANNER_PREFIX_INNER = 25; // chars after leading │, before dynamic content
-// YAML frontmatter: description: "..."
-const YAML_DESCRIPTION_PATTERN = /^description:\s*".*"$/m;
-// Markdown H1: # 🧠 Neocortex vX.X.X (Tier) | OrNexus Team
-// Also matches legacy format: # 🧠 Neocortex vX.X.X - Development Orchestrator | OrNexus Team (Tier)
-const H1_DESCRIPTION_PATTERN = /^# 🧠 Neocortex v[\d.]+(?:\s*\([^)]+\)\s*\| OrNexus Team|\s*-\s*Development Orchestrator \| OrNexus Team \([^)]+\))$/m;
-// Banner version line: │      ###  ########      vX.X.X<spaces>│
-const BANNER_VERSION_PATTERN = /^│      ###  ########      v[\d.]+\s*│$/m;
-// Banner tier line: │ ##   ###  ######  ##    OrNexus Team (<Tier>)<spaces>│
-const BANNER_TIER_PATTERN = /^│ ##   ###  ######  ##    OrNexus Team \([^)]*\)\s*│$/m;
-/**
- * All known home-directory agent files, grouped by description format.
- */
-const HOME_AGENT_FILES = [
-    // Claude Code (home-level)
-    { path: join(homedir(), '.claude', 'agents', 'neocortex', 'neocortex.md'), type: 'yaml' },
-    // Gemini CLI (home-level)
-    { path: join(homedir(), '.gemini', 'agents', 'agent.md'), type: 'yaml' },
-];
-/**
- * Known project-level agent file paths (relative to project root).
- * These are patched after license activation so the tier reflects reality.
- */
-const PROJECT_AGENT_FILES = [
-    // Cursor
-    { relativePath: join('.cursor', 'agents', 'neocortex.md'), type: 'yaml' },
-    // VSCode / GitHub Copilot
-    { relativePath: join('.github', 'agents', 'neocortex.md'), type: 'yaml' },
-    // Codex
-    { relativePath: 'AGENTS.md', type: 'h1' },
-    // Antigravity
-    { relativePath: join('.agent', 'skills', 'neocortex', 'SKILL.md'), type: 'yaml' },
-];
-// ── Project Root Discovery ────────────────────────────────────────────────
-/**
- * Discover the git project root, or null if not in a git repo.
- * Never throws -- returns null on any failure.
- */
-function discoverProjectRoot() {
-    try {
-        const root = execSync('git rev-parse --show-toplevel', {
-            encoding: 'utf-8',
-            timeout: 5000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        return root || null;
-    }
-    catch {
-        return null;
-    }
-}
-// ── Banner Helpers ────────────────────────────────────────────────────────
-/**
- * Build a right-padded banner line.
- * Prefix is the fixed art portion INCLUDING the leading │ (26 chars).
- * Content is the dynamic text. Padding fills to inner width, then closing │.
- *
- * Total: │(1) + prefixInner(25) + content + pad + │(1) = 62 chars.
- */
-function buildBannerLine(prefix, content) {
-    const padLen = BANNER_INNER_WIDTH - BANNER_PREFIX_INNER - content.length;
-    const padding = padLen > 0 ? ' '.repeat(padLen) : '';
-    return `${prefix}${content}${padding}\u2502`; // \u2502 = │
-}
-/**
- * Build the banner version line with correct padding.
- */
-export function buildBannerVersionLine(version) {
-    return buildBannerLine('\u2502      ###  ########      ', `v${version}`);
-}
-/**
- * Build the banner tier line with correct padding.
- */
-export function buildBannerTierLine(tier) {
-    const label = TIER_LABELS[tier.toLowerCase()] ?? 'Free';
-    return buildBannerLine('\u2502 ##   ###  ######  ##    ', `OrNexus Team (${label})`);
-}
-// ── Public API ────────────────────────────────────────────────────────────
-/**
- * Build the dynamic description string (without quotes/prefix).
- */
-export function buildDescription(version, tier) {
-    const label = TIER_LABELS[tier.toLowerCase()] ?? 'Free';
-    return `\u{1F9E0} Neocortex v${version} (${label}) | OrNexus Team`;
-}
-/**
- * Read the current tier from ~/.neocortex/config.json.
- * Returns 'free' if config doesn't exist or tier is missing.
- */
-export function readTierFromConfig() {
-    try {
-        if (existsSync(CONFIG_FILE)) {
-            const raw = readFileSync(CONFIG_FILE, 'utf-8');
-            const config = JSON.parse(raw);
-            return config.tier ?? 'free';
-        }
-    }
-    catch {
-        // Config missing or corrupted
-    }
-    return 'free';
-}
-/**
- * Patch ASCII banner lines (version + tier) in file content.
- * Returns the patched content, or the original if no banner found.
- */
-function patchBannerLines(content, version, tier) {
-    let patched = content;
-    // Patch version line
-    if (BANNER_VERSION_PATTERN.test(patched)) {
-        patched = patched.replace(BANNER_VERSION_PATTERN, buildBannerVersionLine(version));
-    }
-    // Patch tier line
-    if (BANNER_TIER_PATTERN.test(patched)) {
-        patched = patched.replace(BANNER_TIER_PATTERN, buildBannerTierLine(tier));
-    }
-    return patched;
-}
-/**
- * Update a single file's description and banner.
- * Supports YAML frontmatter, H1 header, and ASCII banner lines.
- *
- * Never throws -- description update is non-critical.
- */
-function updateFile(filePath, type, description, version, tier) {
-    try {
-        if (!existsSync(filePath)) {
-            return false;
-        }
-        let content = readFileSync(filePath, 'utf-8');
-        const original = content;
-        // 1. Patch description (YAML frontmatter or H1 header)
-        if (type === 'yaml') {
-            if (YAML_DESCRIPTION_PATTERN.test(content)) {
-                content = content.replace(YAML_DESCRIPTION_PATTERN, `description: "${description}"`);
-            }
-        }
-        else {
-            if (H1_DESCRIPTION_PATTERN.test(content)) {
-                content = content.replace(H1_DESCRIPTION_PATTERN, `# ${description}`);
-            }
-        }
-        // 2. Patch ASCII banner lines (version + tier) if present
-        content = patchBannerLines(content, version, tier);
-        if (content === original) {
-            return false; // Already up to date
-        }
-        writeFileSync(filePath, content, 'utf-8');
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Update agent descriptions across ALL known platform files:
- *   1. Home-level files (Claude Code, Gemini CLI)
- *   2. Project-level files (Cursor, VSCode, Codex, Antigravity) -- discovered via git root
- *
- * Never throws -- description update is non-critical.
- * Returns count of files updated.
- */
-export function updateAgentDescription(version, tier) {
-    const resolvedTier = tier ?? readTierFromConfig();
-    const description = buildDescription(version, resolvedTier);
-    let updated = 0;
-    // 1. Home-level files (existing behavior)
-    for (const { path, type } of HOME_AGENT_FILES) {
-        if (updateFile(path, type, description, version, resolvedTier)) {
-            updated++;
-        }
-    }
-    // 2. Project-level files (discover git root, then check known paths)
-    const projectRoot = discoverProjectRoot();
-    if (projectRoot) {
-        for (const { relativePath, type } of PROJECT_AGENT_FILES) {
-            const fullPath = join(projectRoot, relativePath);
-            if (updateFile(fullPath, type, description, version, resolvedTier)) {
-                updated++;
-            }
-        }
-    }
-    return updated;
-}
-/**
- * Update agent description for a specific file path (used by install scripts
- * for project-level files where paths are dynamic).
- *
- * Never throws -- description update is non-critical.
- */
-export function updateAgentDescriptionAt(filePath, type, version, tier) {
-    const resolvedTier = tier ?? readTierFromConfig();
-    const description = buildDescription(version, resolvedTier);
-    return updateFile(filePath, type, description, version, resolvedTier);
-}
+import{readFileSync as l,writeFileSync as _,existsSync as f}from"node:fs";import{execSync as A}from"node:child_process";import{join as c}from"node:path";import{homedir as p}from"node:os";const m=c(p(),".neocortex","config.json"),d={free:"Free",pro:"Pro",enterprise:"Enterprise"},I=60,L=25,N=/^description:\s*".*"$/m,E=/^# 🧠 Neocortex v[\d.]+(?:\s*\([^)]+\)\s*\| OrNexus Team|\s*-\s*Development Orchestrator \| OrNexus Team \([^)]+\))$/m,T=/^│      ###  ########      v[\d.]+\s*│$/m,x=/^│ ##   ###  ######  ##    OrNexus Team \([^)]*\)\s*│$/m,P=[{path:c(p(),".claude","agents","neocortex","neocortex.md"),type:"yaml"},{path:c(p(),".gemini","agents","agent.md"),type:"yaml"}],F=[{relativePath:c(".cursor","agents","neocortex.md"),type:"yaml"},{relativePath:c(".github","agents","neocortex.md"),type:"yaml"},{relativePath:"AGENTS.md",type:"h1"},{relativePath:c(".agent","skills","neocortex","SKILL.md"),type:"yaml"}];function O(){try{return A("git rev-parse --show-toplevel",{encoding:"utf-8",timeout:5e3,stdio:["pipe","pipe","pipe"]}).trim()||null}catch{return null}}function y(e,o){const t=I-L-o.length,r=t>0?" ".repeat(t):"";return`${e}${o}${r}\u2502`}function S(e){return y("\u2502      ###  ########      ",`v${e}`)}function $(e){const o=d[e.toLowerCase()]??"Free";return y("\u2502 ##   ###  ######  ##    ",`OrNexus Team (${o})`)}function g(e,o){const t=d[o.toLowerCase()]??"Free";return`\u{1F9E0} Neocortex v${e} (${t}) | OrNexus Team`}function R(){try{if(f(m)){const e=l(m,"utf-8");return JSON.parse(e).tier??"free"}}catch{}return"free"}function v(e,o,t){let r=e;return T.test(r)&&(r=r.replace(T,S(o))),x.test(r)&&(r=r.replace(x,$(t))),r}function u(e,o,t,r,i){try{if(!f(e))return!1;let n=l(e,"utf-8");const s=n;return o==="yaml"?N.test(n)&&(n=n.replace(N,`description: "${t}"`)):E.test(n)&&(n=n.replace(E,`# ${t}`)),n=v(n,r,i),n===s?!1:(_(e,n,"utf-8"),!0)}catch{return!1}}function w(e,o){const t=o??R(),r=g(e,t);let i=0;for(const{path:s,type:a}of P)u(s,a,r,e,t)&&i++;const n=O();if(n)for(const{relativePath:s,type:a}of F){const h=c(n,s);u(h,a,r,e,t)&&i++}return i}function j(e,o,t,r){const i=r??R(),n=g(t,i);return u(e,o,n,t,i)}export{$ as buildBannerTierLine,S as buildBannerVersionLine,g as buildDescription,R as readTierFromConfig,w as updateAgentDescription,j as updateAgentDescriptionAt};

package/packages/client/dist/cache/crypto-utils.js

@@ -1,78 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - Crypto Utilities
- *
- * AES-256-GCM encryption/decryption with PBKDF2 key derivation.
- * Used by EncryptedCache to protect cached assets at rest.
- *
- * Security design:
- * - IV: 12 bytes (NIST SP 800-38D recommended for GCM)
- * - Salt: 32 bytes random per entry
- * - Key: PBKDF2 with 100k iterations, SHA-512
- * - expiresAt is inside the encrypted payload (authenticated by GCM tag)
- */
-import { randomBytes, pbkdf2Sync, createCipheriv, createDecipheriv } from 'node:crypto';
-import { assertPublicSafeCachePayload } from './protected-pi-boundary.js';
-// ── Constants ────────────────────────────────────────────────────────────
-const ALGORITHM = 'aes-256-gcm';
-const IV_LENGTH = 12; // NIST SP 800-38D recommended for AES-GCM
-const SALT_LENGTH = 32;
-const KEY_LENGTH = 32;
-const AUTH_TAG_LENGTH = 16;
-const PBKDF2_ITERATIONS = 100_000;
-const PBKDF2_DIGEST = 'sha512';
-// ── Key Derivation ───────────────────────────────────────────────────────
-export function deriveKey(passphrase, salt) {
-    return pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);
-}
-// ── Encrypt ──────────────────────────────────────────────────────────────
-export function encrypt(plaintext, passphrase, ttlMs) {
-    assertPublicSafeCachePayload(plaintext);
-    const iv = randomBytes(IV_LENGTH);
-    const salt = randomBytes(SALT_LENGTH);
-    const key = deriveKey(passphrase, salt);
-    const expiresAt = ttlMs != null ? Date.now() + ttlMs : null;
-    const payload = { plaintext, expiresAt };
-    const payloadJson = JSON.stringify(payload);
-    const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    const encrypted = Buffer.concat([cipher.update(payloadJson, 'utf8'), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    const envelope = {
-        iv: iv.toString('base64'),
-        salt: salt.toString('base64'),
-        tag: tag.toString('base64'),
-        data: encrypted.toString('base64'),
-    };
-    return JSON.stringify(envelope);
-}
-export function decrypt(envelopeJson, passphrase) {
-    const raw = JSON.parse(envelopeJson);
-    if (!raw.iv || !raw.salt || !raw.tag || !raw.data) {
-        throw new Error('Invalid cache envelope: missing required fields');
-    }
-    const iv = Buffer.from(raw.iv, 'base64');
-    const salt = Buffer.from(raw.salt, 'base64');
-    const tag = Buffer.from(raw.tag, 'base64');
-    const data = Buffer.from(raw.data, 'base64');
-    const key = deriveKey(passphrase, salt);
-    const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    decipher.setAuthTag(tag);
-    const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
-    const payload = JSON.parse(decrypted.toString('utf8'));
-    const expired = payload.expiresAt != null && Date.now() > payload.expiresAt;
-    return {
-        plaintext: payload.plaintext,
-        expired,
-    };
-}
+import{randomBytes as d,pbkdf2Sync as h,createCipheriv as S,createDecipheriv as m}from"node:crypto";import{assertPublicSafeCachePayload as v}from"./protected-pi-boundary.js";const l="aes-256-gcm",b=12,A=32,B=32,g=16,N=1e5,x="sha512";function y(e,n){return h(e,n,N,B,x)}function _(e,n,t){v(e);const s=d(b),c=d(A),i=y(n,c),f=t!=null?Date.now()+t:null,a=JSON.stringify({plaintext:e,expiresAt:f}),o=S(l,i,s,{authTagLength:g}),r=Buffer.concat([o.update(a,"utf8"),o.final()]),p=o.getAuthTag(),T={iv:s.toString("base64"),salt:c.toString("base64"),tag:p.toString("base64"),data:r.toString("base64")};return JSON.stringify(T)}function G(e,n){const t=JSON.parse(e);if(!t.iv||!t.salt||!t.tag||!t.data)throw new Error("Invalid cache envelope: missing required fields");const s=Buffer.from(t.iv,"base64"),c=Buffer.from(t.salt,"base64"),i=Buffer.from(t.tag,"base64"),f=Buffer.from(t.data,"base64"),u=y(n,c),a=m(l,u,s,{authTagLength:g});a.setAuthTag(i);const o=Buffer.concat([a.update(f),a.final()]),r=JSON.parse(o.toString("utf8")),p=r.expiresAt!=null&&Date.now()>r.expiresAt;return{plaintext:r.plaintext,expired:p}}export{G as decrypt,y as deriveKey,_ as encrypt};

package/packages/client/dist/cache/encrypted-cache.js

@@ -1,108 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - EncryptedCache
- *
- * Filesystem-backed encrypted cache implementing the CacheProvider interface.
- * Stores assets as AES-256-GCM encrypted files with PBKDF2 key derivation.
- * Cache keys are hashed with SHA-256 to produce safe filenames.
- *
- * PI boundary (P176.05): values may contain public metadata, hashes, counts,
- * sizes, or bounded encrypted data only. Synthetic protected prompt/workflow/
- * step-body markers and explicit protected JSON field names are rejected before
- * disk write. Default TTL is caller-owned and remains [TBD].
- *
- * All public methods are designed to never throw - cache failures are
- * silently handled since caching is a non-critical optimization.
- */
-import { mkdir, writeFile, readFile, rm, readdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { encrypt, decrypt } from './crypto-utils.js';
-import { setSecureFilePermissions } from '../config/secure-config.js';
-import { hasProtectedCachePayloadMarker } from './protected-pi-boundary.js';
-// ── Constants ────────────────────────────────────────────────────────────
-const CACHE_FILE_EXTENSION = '.enc';
-// ── EncryptedCache Implementation ────────────────────────────────────────
-export class EncryptedCache {
-    cacheDir;
-    passphrase;
-    strictReadOnly;
-    initPromise = null;
-    constructor(options) {
-        this.cacheDir = options.cacheDir;
-        this.passphrase = options.passphrase;
-        this.strictReadOnly = options.strictReadOnly ?? false;
-    }
-    async get(key) {
-        try {
-            const filePath = this.keyToPath(key);
-            const raw = await readFile(filePath, 'utf8');
-            const result = decrypt(raw, this.passphrase);
-            if (result.expired) {
-                if (!this.strictReadOnly)
-                    await rm(filePath, { force: true }).catch(() => { });
-                return null;
-            }
-            return result.plaintext;
-        }
-        catch {
-            return null;
-        }
-    }
-    async set(key, value, ttlMs) {
-        if (this.strictReadOnly)
-            return;
-        try {
-            if (hasProtectedCachePayloadMarker(value))
-                return;
-            await this.ensureDir();
-            const filePath = this.keyToPath(key);
-            const encrypted = encrypt(value, this.passphrase, ttlMs);
-            await writeFile(filePath, encrypted, 'utf8');
-            // Story 66.1 AC6: Apply restrictive permissions on .enc files
-            setSecureFilePermissions(filePath);
-        }
-        catch {
-            // Cache write failures are non-critical
-        }
-    }
-    async clear() {
-        if (this.strictReadOnly)
-            return;
-        try {
-            const entries = await readdir(this.cacheDir).catch(() => []);
-            const removals = entries
-                .filter((entry) => entry.endsWith(CACHE_FILE_EXTENSION))
-                .map((entry) => rm(join(this.cacheDir, entry), { force: true }).catch(() => { }));
-            await Promise.all(removals);
-        }
-        catch {
-            // Clear failures are non-critical
-        }
-    }
-    // ── Private Methods ─────────────────────────────────────────────────
-    keyToPath(key) {
-        const hash = createHash('sha256').update(key).digest('hex');
-        return join(this.cacheDir, `${hash}${CACHE_FILE_EXTENSION}`);
-    }
-    ensureDir() {
-        if (!this.initPromise) {
-            this.initPromise = mkdir(this.cacheDir, { recursive: true }).then(() => undefined).catch((err) => {
-                this.initPromise = null; // allow retry on next call
-                throw err;
-            });
-        }
-        return this.initPromise;
-    }
-}
+import{mkdir as n,writeFile as o,readFile as l,rm as s,readdir as u}from"node:fs/promises";import{join as a}from"node:path";import{createHash as m}from"node:crypto";import{encrypt as p,decrypt as d}from"./crypto-utils.js";import{setSecureFilePermissions as f}from"../config/secure-config.js";import{hasProtectedCachePayloadMarker as y}from"./protected-pi-boundary.js";const c=".enc";class x{cacheDir;passphrase;strictReadOnly;initPromise=null;constructor(t){this.cacheDir=t.cacheDir,this.passphrase=t.passphrase,this.strictReadOnly=t.strictReadOnly??!1}async get(t){try{const r=this.keyToPath(t),e=await l(r,"utf8"),i=d(e,this.passphrase);return i.expired?(this.strictReadOnly||await s(r,{force:!0}).catch(()=>{}),null):i.plaintext}catch{return null}}async set(t,r,e){if(!this.strictReadOnly)try{if(y(r))return;await this.ensureDir();const i=this.keyToPath(t),h=p(r,this.passphrase,e);await o(i,h,"utf8"),f(i)}catch{}}async clear(){if(!this.strictReadOnly)try{const r=(await u(this.cacheDir).catch(()=>[])).filter(e=>e.endsWith(c)).map(e=>s(a(this.cacheDir,e),{force:!0}).catch(()=>{}));await Promise.all(r)}catch{}}keyToPath(t){const r=m("sha256").update(t).digest("hex");return a(this.cacheDir,`${r}${c}`)}ensureDir(){return this.initPromise||(this.initPromise=n(this.cacheDir,{recursive:!0}).then(()=>{}).catch(t=>{throw this.initPromise=null,t})),this.initPromise}}export{x as EncryptedCache};

package/packages/client/dist/cache/in-memory-asset-cache.js

@@ -1,73 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-import { hasProtectedCachePayloadMarker } from './protected-pi-boundary.js';
-const DEFAULT_MAX_SIZE = 50;
-const DEFAULT_TTL_MS = 5 * 60 * 1000;
-export class InMemoryAssetCache {
-    store = new Map();
-    maxSize;
-    ttlMs;
-    constructor(options = {}) {
-        this.maxSize = options.maxSize ?? DEFAULT_MAX_SIZE;
-        this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-    }
-    /**
-     * Retrieve a value by key. Returns null if missing or expired.
-     * Accessing a key moves it to the end of the LRU ordering.
-     */
-    async get(key) {
-        const entry = this.store.get(key);
-        if (!entry)
-            return null;
-        if (Date.now() >= entry.expiresAt) {
-            this.store.delete(key);
-            return null;
-        }
-        // LRU: move to end (most recently used)
-        this.store.delete(key);
-        this.store.set(key, entry);
-        return entry.value;
-    }
-    /**
-     * Store a value by key. Evicts the least-recently-used entry if the
-     * cache is at capacity.
-     *
-     * @param ttlMs - optional override of the default TTL
-     */
-    async set(key, value, ttlMs) {
-        if (hasProtectedCachePayloadMarker(value))
-            return;
-        const ttl = ttlMs ?? this.ttlMs;
-        const expiresAt = Date.now() + ttl;
-        if (this.store.has(key)) {
-            // Overwrite keeps insertion order fresh -- delete then set.
-            this.store.delete(key);
-        }
-        else if (this.store.size >= this.maxSize) {
-            // LRU eviction: delete oldest entry (first in insertion order).
-            const oldestKey = this.store.keys().next().value;
-            if (oldestKey !== undefined) {
-                this.store.delete(oldestKey);
-            }
-        }
-        this.store.set(key, { value, expiresAt });
-    }
-    /** Drop all entries. Safe to call at any time. */
-    async clear() {
-        this.store.clear();
-    }
-    /** Internal: number of live entries (for diagnostics / tests). */
-    size() {
-        return this.store.size;
-    }
-}
+import{hasProtectedCachePayloadMarker as n}from"./protected-pi-boundary.js";const a=50,h=300*1e3;class u{store=new Map;maxSize;ttlMs;constructor(t={}){this.maxSize=t.maxSize??a,this.ttlMs=t.ttlMs??h}async get(t){const e=this.store.get(t);return e?Date.now()>=e.expiresAt?(this.store.delete(t),null):(this.store.delete(t),this.store.set(t,e),e.value):null}async set(t,e,r){if(n(e))return;const i=r??this.ttlMs,o=Date.now()+i;if(this.store.has(t))this.store.delete(t);else if(this.store.size>=this.maxSize){const s=this.store.keys().next().value;s!==void 0&&this.store.delete(s)}this.store.set(t,{value:e,expiresAt:o})}async clear(){this.store.clear()}size(){return this.store.size}}export{u as InMemoryAssetCache};

package/packages/client/dist/cache/index.js

@@ -1,13 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-export { EncryptedCache } from './encrypted-cache.js';
+import{EncryptedCache as c}from"./encrypted-cache.js";export{c as EncryptedCache};

package/packages/client/dist/cache/protected-pi-boundary.js

@@ -1,44 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * Public-safe client cache PI boundary checks.
- */
-/** Public reason code used when a synthetic protected PI marker is detected. */
-export const PROTECTED_CACHE_PAYLOAD_REASON = 'protected-cache-payload-rejected';
-const SYNTHETIC_PROTECTED_MARKER = /P176_SYNTHETIC_PROTECTED_(?:PROMPT|PROMPT_BODY|WORKFLOW|WORKFLOW_GRAPH|STEP_BODY|RAW_LOG|PRIVATE_URL|SECRET|PROPRIETARY_ASSET)/i;
-const PROTECTED_FIELD_NAME = /^(?:promptBody|workflowBody|workflowGraph|stepBody|privateUrl|rawLog|secret|credential|licenseKey|apiKey|internalRouting|serverOnly|proprietary|protected)$/i;
-function hasProtectedField(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    if (Array.isArray(value))
-        return value.some(hasProtectedField);
-    return Object.entries(value).some(([key, child]) => (PROTECTED_FIELD_NAME.test(key) || hasProtectedField(child)));
-}
-/**
- * Returns true only for synthetic protected markers or explicit protected field
- * names. Generic words like "prompt" or "workflow" are intentionally not
- * rejected because cache keys and README-grade metadata may use them safely.
- */
-export function hasProtectedCachePayloadMarker(value) {
-    if (SYNTHETIC_PROTECTED_MARKER.test(value))
-        return true;
-    try {
-        return hasProtectedField(JSON.parse(value));
-    }
-    catch {
-        return false;
-    }
-}
-export class ProtectedCachePayloadError extends Error {
-    code = PROTECTED_CACHE_PAYLOAD_REASON;
-    constructor() {
-        super(PROTECTED_CACHE_PAYLOAD_REASON);
-        this.name = 'ProtectedCachePayloadError';
-    }
-}
-export function assertPublicSafeCachePayload(value) {
-    if (hasProtectedCachePayloadMarker(value)) {
-        throw new ProtectedCachePayloadError();
-    }
-}
+const t="protected-cache-payload-rejected",a=/P176_SYNTHETIC_PROTECTED_(?:PROMPT|PROMPT_BODY|WORKFLOW|WORKFLOW_GRAPH|STEP_BODY|RAW_LOG|PRIVATE_URL|SECRET|PROPRIETARY_ASSET)/i,n=/^(?:promptBody|workflowBody|workflowGraph|stepBody|privateUrl|rawLog|secret|credential|licenseKey|apiKey|internalRouting|serverOnly|proprietary|protected)$/i;function r(e){return!e||typeof e!="object"?!1:Array.isArray(e)?e.some(r):Object.entries(e).some(([o,c])=>n.test(o)||r(c))}function s(e){if(a.test(e))return!0;try{return r(JSON.parse(e))}catch{return!1}}class E extends Error{code=t;constructor(){super(t),this.name="ProtectedCachePayloadError"}}function P(e){if(s(e))throw new E}export{t as PROTECTED_CACHE_PAYLOAD_REASON,E as ProtectedCachePayloadError,P as assertPublicSafeCachePayload,s as hasProtectedCachePayloadMarker};