@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/config.js

@@ -1,2 +1,223 @@
-import{existsSync as y,mkdirSync as w,readFileSync as O,renameSync as C,unlinkSync as M,writeFileSync as T}from"node:fs";import{homedir as R}from"node:os";import{dirname as _,join as k}from"node:path";import{SUBAGENT_APPROVAL_MANAGED_DEFAULT as h,SUBAGENT_APPROVAL_EVIDENCE as F,SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION as c,createSubagentApprovalAuditEvent as l,isSubagentApprovalMode as d,resolveSubagentApprovalPolicy as E}from"./policy/subagent-approval-policy.js";import{setSecureDirPermissions as V,setSecureFilePermissions as b}from"./config/secure-config.js";const u="subagentApprovalPolicy",g="subagentApprovalPolicyAudit",x=25,N=new Set(["managed-default-materialized","user-override-updated","user-override-reset"]),D=new Set(["managed-default","user-override"]),L=new Set(["child","session","global","inherited","none"]),I=new Set(["requested-mode-honored","host-policy-reduced","host-capability-unvalidated","host-capability-unsupported","platform-target-unknown"]),U=new Set(["none","root-inline","shell-loop"]),j=new Set(["claude-code","opencode","codex","gemini","vscode","github-copilot-cli","kimi","cursor","antigravity","openclaw","grok","runner","unknown"]);class i extends Error{reasonCode;constructor(e,t){super(t),this.reasonCode=e,this.name="ApprovalPolicyConfigError"}}function P(r){return r.configFilePath??k(R(),".neocortex","config.json")}function p(r){const e=P(r);if(!y(e))return{};try{const t=JSON.parse(O(e,"utf8").replace(/^\uFEFF/,""));if(!t||typeof t!="object"||Array.isArray(t))throw new Error("Config root must be an object");return t}catch(t){throw t instanceof i?t:new i("approval-config-invalid","Neocortex config is not valid JSON; approval policy was not changed.")}}function f(r){const e=r[u];if(e===void 0)return;if(!e||typeof e!="object"||Array.isArray(e))throw new i("approval-config-invalid","Stored subagent approval policy is invalid.");const t=e;if(t.schemaVersion!==c)throw new i("approval-policy-schema-unsupported","Stored subagent approval policy schema is not supported.");if(t.userOverride!==void 0&&!d(t.userOverride))throw new i("approval-policy-mode-invalid","Stored subagent approval mode is invalid.");return t}function s(r,e){const t=f(r);return E({userOverride:t?.userOverride,hostPolicy:e.hostPolicy,platformTarget:e.platformTarget})}function v(r,e){const t=Array.isArray(r[g])?r[g].map(q).filter(n=>n!==null):[];r[g]=[...t,e].slice(-x)}function q(r){if(!r||typeof r!="object"||Array.isArray(r))return null;const e=r;if(e.evidence!==F||e.schemaVersion!==c||!N.has(String(e.event))||!d(e.requestedMode)||!d(e.effectiveMode)||!D.has(String(e.source))||!j.has(String(e.platformTarget))||!L.has(String(e.scope))||!I.has(String(e.effectiveReason))||typeof e.occurredAt!="string"||!Number.isFinite(Date.parse(e.occurredAt)))return null;const t=E({userOverride:e.requestedMode,platformTarget:String(e.platformTarget)}),n=U.has(String(e.fallbackMode))?e.fallbackMode:t.fallbackMode,o=e.fallbackReasonCode===null||typeof e.fallbackReasonCode=="string"?e.fallbackReasonCode:t.fallbackReasonCode;return l(e.event,{schemaVersion:c,requestedMode:e.requestedMode,effectiveMode:e.effectiveMode,source:e.source,platformTarget:e.platformTarget,scope:e.scope,effectiveReason:e.effectiveReason,fallbackMode:n,fallbackReasonCode:o},e.occurredAt)}function A(r,e){const t=P(e),n=_(t),o=`${t}.tmp`;w(n,{recursive:!0}),V(n);try{T(o,`${JSON.stringify(r,null,2)}
-`,"utf8"),b(o),C(o,t),b(t)}catch(a){try{y(o)&&M(o)}catch{}throw a}}function S(r){return(r.now?.()??new Date).toISOString()}function K(r={}){return{resolution:s(p(r),r)}}function $(r={}){const e=p(r);if(f(e))return{resolution:s(e,r)};const n=S(r);e[u]={schemaVersion:c,managedDefault:h,updatedAt:n};const o=s(e,r),a=l("managed-default-materialized",o,n);return v(e,a),A(e,r),{resolution:o,auditEvent:a}}function H(r,e={}){if(!d(r))throw new i("approval-policy-mode-invalid","Requested subagent approval mode is invalid.");const t=p(e),n=f(t),o=S(e);t[u]={...n??{},schemaVersion:c,managedDefault:h,userOverride:r,updatedAt:o};const a=s(t,e),m=l("user-override-updated",a,o);return v(t,m),A(t,e),{resolution:a,auditEvent:m}}function X(r={}){const e=p(r);f(e),delete e[u];const t=S(r),n=s(e,r),o=l("user-override-reset",n,t);return v(e,o),A(e,r),{resolution:n,auditEvent:o}}export{i as ApprovalPolicyConfigError,$ as ensureManagedSubagentApprovalPolicy,K as getSubagentApprovalPolicy,X as resetSubagentApprovalMode,H as setSubagentApprovalMode};
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { SUBAGENT_APPROVAL_MANAGED_DEFAULT, SUBAGENT_APPROVAL_EVIDENCE, SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION, createSubagentApprovalAuditEvent, isSubagentApprovalMode, resolveSubagentApprovalPolicy, } from './policy/subagent-approval-policy.js';
+import { setSecureDirPermissions, setSecureFilePermissions, } from './config/secure-config.js';
+const POLICY_KEY = 'subagentApprovalPolicy';
+const AUDIT_KEY = 'subagentApprovalPolicyAudit';
+const MAX_AUDIT_EVENTS = 25;
+const AUDIT_EVENTS = new Set([
+    'managed-default-materialized',
+    'user-override-updated',
+    'user-override-reset',
+]);
+const APPROVAL_SOURCES = new Set(['managed-default', 'user-override']);
+const APPROVAL_SCOPES = new Set([
+    'child',
+    'session',
+    'global',
+    'inherited',
+    'none',
+]);
+const EFFECTIVE_REASONS = new Set([
+    'requested-mode-honored',
+    'host-policy-reduced',
+    'host-capability-unvalidated',
+    'host-capability-unsupported',
+    'platform-target-unknown',
+]);
+const FALLBACK_MODES = new Set(['none', 'root-inline', 'shell-loop']);
+const PLATFORM_TARGETS = new Set([
+    'claude-code',
+    'opencode',
+    'codex',
+    'gemini',
+    'vscode',
+    'github-copilot-cli',
+    'kimi',
+    'cursor',
+    'antigravity',
+    'openclaw',
+    'grok',
+    'runner',
+    'unknown',
+]);
+export class ApprovalPolicyConfigError extends Error {
+    reasonCode;
+    constructor(reasonCode, message) {
+        super(message);
+        this.reasonCode = reasonCode;
+        this.name = 'ApprovalPolicyConfigError';
+    }
+}
+function configFilePath(options) {
+    return options.configFilePath ?? join(homedir(), '.neocortex', 'config.json');
+}
+function readConfig(options) {
+    const path = configFilePath(options);
+    if (!existsSync(path))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('Config root must be an object');
+        }
+        return parsed;
+    }
+    catch (error) {
+        if (error instanceof ApprovalPolicyConfigError)
+            throw error;
+        throw new ApprovalPolicyConfigError('approval-config-invalid', 'Neocortex config is not valid JSON; approval policy was not changed.');
+    }
+}
+function readStoredPolicy(config) {
+    const value = config[POLICY_KEY];
+    if (value === undefined)
+        return undefined;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new ApprovalPolicyConfigError('approval-config-invalid', 'Stored subagent approval policy is invalid.');
+    }
+    const policy = value;
+    if (policy.schemaVersion !== SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION) {
+        throw new ApprovalPolicyConfigError('approval-policy-schema-unsupported', 'Stored subagent approval policy schema is not supported.');
+    }
+    if (policy.userOverride !== undefined &&
+        !isSubagentApprovalMode(policy.userOverride)) {
+        throw new ApprovalPolicyConfigError('approval-policy-mode-invalid', 'Stored subagent approval mode is invalid.');
+    }
+    return policy;
+}
+function resolveFromConfig(config, options) {
+    const policy = readStoredPolicy(config);
+    return resolveSubagentApprovalPolicy({
+        userOverride: policy?.userOverride,
+        hostPolicy: options.hostPolicy,
+        platformTarget: options.platformTarget,
+    });
+}
+function appendAudit(config, event) {
+    const existing = Array.isArray(config[AUDIT_KEY])
+        ? config[AUDIT_KEY]
+            .map(normalizeStoredAuditEvent)
+            .filter((entry) => entry !== null)
+        : [];
+    config[AUDIT_KEY] = [...existing, event].slice(-MAX_AUDIT_EVENTS);
+}
+function normalizeStoredAuditEvent(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const entry = value;
+    if (entry.evidence !== SUBAGENT_APPROVAL_EVIDENCE ||
+        entry.schemaVersion !== SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION ||
+        !AUDIT_EVENTS.has(String(entry.event)) ||
+        !isSubagentApprovalMode(entry.requestedMode) ||
+        !isSubagentApprovalMode(entry.effectiveMode) ||
+        !APPROVAL_SOURCES.has(String(entry.source)) ||
+        !PLATFORM_TARGETS.has(String(entry.platformTarget)) ||
+        !APPROVAL_SCOPES.has(String(entry.scope)) ||
+        !EFFECTIVE_REASONS.has(String(entry.effectiveReason)) ||
+        typeof entry.occurredAt !== 'string' ||
+        !Number.isFinite(Date.parse(entry.occurredAt))) {
+        return null;
+    }
+    const derivedFallback = resolveSubagentApprovalPolicy({
+        userOverride: entry.requestedMode,
+        platformTarget: String(entry.platformTarget),
+    });
+    const fallbackMode = FALLBACK_MODES.has(String(entry.fallbackMode))
+        ? entry.fallbackMode
+        : derivedFallback.fallbackMode;
+    const fallbackReasonCode = entry.fallbackReasonCode === null ||
+        typeof entry.fallbackReasonCode === 'string'
+        ? entry.fallbackReasonCode
+        : derivedFallback.fallbackReasonCode;
+    return createSubagentApprovalAuditEvent(entry.event, {
+        schemaVersion: SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION,
+        requestedMode: entry.requestedMode,
+        effectiveMode: entry.effectiveMode,
+        source: entry.source,
+        platformTarget: entry.platformTarget,
+        scope: entry.scope,
+        effectiveReason: entry.effectiveReason,
+        fallbackMode,
+        fallbackReasonCode,
+    }, entry.occurredAt);
+}
+function writeConfig(config, options) {
+    const path = configFilePath(options);
+    const dir = dirname(path);
+    const temporaryPath = `${path}.tmp`;
+    mkdirSync(dir, { recursive: true });
+    setSecureDirPermissions(dir);
+    try {
+        writeFileSync(temporaryPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+        setSecureFilePermissions(temporaryPath);
+        renameSync(temporaryPath, path);
+        setSecureFilePermissions(path);
+    }
+    catch (error) {
+        try {
+            if (existsSync(temporaryPath))
+                unlinkSync(temporaryPath);
+        }
+        catch {
+            // Best-effort cleanup; preserve the original write failure.
+        }
+        throw error;
+    }
+}
+function occurredAt(options) {
+    return (options.now?.() ?? new Date()).toISOString();
+}
+export function getSubagentApprovalPolicy(options = {}) {
+    return { resolution: resolveFromConfig(readConfig(options), options) };
+}
+export function ensureManagedSubagentApprovalPolicy(options = {}) {
+    const config = readConfig(options);
+    const existing = readStoredPolicy(config);
+    if (existing) {
+        return { resolution: resolveFromConfig(config, options) };
+    }
+    const at = occurredAt(options);
+    config[POLICY_KEY] = {
+        schemaVersion: SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION,
+        managedDefault: SUBAGENT_APPROVAL_MANAGED_DEFAULT,
+        updatedAt: at,
+    };
+    const resolution = resolveFromConfig(config, options);
+    const auditEvent = createSubagentApprovalAuditEvent('managed-default-materialized', resolution, at);
+    appendAudit(config, auditEvent);
+    writeConfig(config, options);
+    return { resolution, auditEvent };
+}
+export function setSubagentApprovalMode(mode, options = {}) {
+    if (!isSubagentApprovalMode(mode)) {
+        throw new ApprovalPolicyConfigError('approval-policy-mode-invalid', 'Requested subagent approval mode is invalid.');
+    }
+    const config = readConfig(options);
+    const existing = readStoredPolicy(config);
+    const at = occurredAt(options);
+    config[POLICY_KEY] = {
+        ...(existing ?? {}),
+        schemaVersion: SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION,
+        managedDefault: SUBAGENT_APPROVAL_MANAGED_DEFAULT,
+        userOverride: mode,
+        updatedAt: at,
+    };
+    const resolution = resolveFromConfig(config, options);
+    const auditEvent = createSubagentApprovalAuditEvent('user-override-updated', resolution, at);
+    appendAudit(config, auditEvent);
+    writeConfig(config, options);
+    return { resolution, auditEvent };
+}
+export function resetSubagentApprovalMode(options = {}) {
+    const config = readConfig(options);
+    readStoredPolicy(config);
+    delete config[POLICY_KEY];
+    const at = occurredAt(options);
+    const resolution = resolveFromConfig(config, options);
+    const auditEvent = createSubagentApprovalAuditEvent('user-override-reset', resolution, at);
+    appendAudit(config, auditEvent);
+    writeConfig(config, options);
+    return { resolution, auditEvent };
+}

package/packages/client/dist/constants.js

@@ -1 +1,25 @@
-const t="https://api.neocortex.sh";export{t as DEFAULT_SERVER_URL};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * Production server URL.
+ *
+ * Single Source of Truth for the default Neocortex IP Protection Server URL.
+ * All client-side code MUST import this constant instead of hardcoding the URL.
+ *
+ * Shell scripts (install.sh, install.ps1) cannot import from TypeScript,
+ * so they maintain a hardcoded copy with a comment referencing this file.
+ *
+ * Epic 70 - Story 70.03
+ * Epic P46 - Story P46.01: migrated legacy API host to api.neocortex.sh
+ */
+export const DEFAULT_SERVER_URL = 'https://api.neocortex.sh';

package/packages/client/dist/context/context-collector.js

@@ -1,2 +1,222 @@
-import{readFile as i}from"node:fs/promises";import{join as p}from"node:path";import{sanitizeObject as l}from"./context-sanitizer.js";const f=/^---\n([\s\S]*?)\n---/;function m(s){const e=s.match(f);if(!e)return{};const t={};for(const n of e[1].split(`
-`)){const c=n.indexOf(":");if(c===-1)continue;const a=n.slice(0,c).trim().replace(/^['"]|['"]$/g,""),r=n.slice(c+1).trim().replace(/^['"]|['"]$/g,"");t[a]=r}return t}function g(s){const e=[],t=/\*\*AC\d+:?\s*([^*]+)\*\*/g;let n;for(;(n=t.exec(s))!==null;)e.push(n[1].trim());return e}const S={react:"React",next:"Next.js",vue:"Vue",nuxt:"Nuxt",angular:"Angular",svelte:"Svelte",express:"Express",fastify:"Fastify",nest:"NestJS",koa:"Koa",hapi:"Hapi"};function w(s){const e=[];for(const[t,n]of Object.entries(S))t in s&&e.push(n);return e}function y(s){const e=new Set;return e.add("JavaScript"),("typescript"in s||Object.keys(s).some(t=>t.includes("ts-")))&&e.add("TypeScript"),[...e]}async function O(s){const{projectRoot:e,storyFilePath:t,storyId:n,stepId:c,platformTarget:a}=s,r=await h(e,n),u=await C(e),o=await I(t),d={storyId:n,stepId:c,epicId:o.epicId||r.epicId||"",storyTitle:o.title,currentStatus:r.status,stepsCompleted:r.stepsCompleted,branchName:r.branchName,platformTarget:a||x(),codebaseMetadata:u,storyMetadata:o};return l(d,e)}async function h(s,e){try{const t=p(s,".neocortex","state.json"),n=await i(t,"utf-8"),a=JSON.parse(n).stories?.[e];return{status:a?.status||"unknown",stepsCompleted:a?.steps_completed||[],branchName:a?.branch_name||"",epicId:a?.epic_id||""}}catch{return{status:"unknown",stepsCompleted:[],branchName:"",epicId:""}}}async function C(s){try{const e=p(s,"package.json"),t=await i(e,"utf-8"),n=JSON.parse(t),c={...n.dependencies||{},...n.devDependencies||{}};return{projectName:n.name||"unknown",languages:y(c),frameworks:w(c),dependencies:n.dependencies||{},nodeVersion:process.version}}catch{return{projectName:"unknown",languages:["JavaScript"],frameworks:[],dependencies:{},nodeVersion:process.version}}}async function I(s){try{const e=await i(s,"utf-8"),t=m(e),n=g(e);let c=[];const a=t.dependencies;if(a)try{c=JSON.parse(a.replace(/'/g,'"'))}catch{c=a.split(",").map(r=>r.trim().replace(/[[\]"']/g,""))}return{id:t.id||"",epicId:t.epic_id||"",title:t.title||"",status:t.status||t.currentStatus||"",dependencies:c,acceptanceCriteria:n}}catch{return{id:"",epicId:"",title:"",status:"",dependencies:[],acceptanceCriteria:[]}}}function x(){return process.env.CLAUDE_CODE||process.env.CLAUDE_AGENT?"claude-code":process.env.CURSOR_SESSION_ID?"cursor":process.env.VSCODE_PID?"vscode":process.env.GEMINI_CLI?"gemini":"unknown"}export{O as collectContext};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Context Collector
+ *
+ * Collects pipeline context from state.json, package.json, and story files.
+ * Sanitizes all sensitive data before returning the context.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { sanitizeObject } from './context-sanitizer.js';
+// ── Frontmatter extraction (reused from local-resolver) ──────────────────
+const FRONTMATTER_REGEX = /^---\n([\s\S]*?)\n---/;
+function extractFrontmatter(content) {
+    const match = content.match(FRONTMATTER_REGEX);
+    if (!match)
+        return {};
+    const result = {};
+    for (const line of match[1].split('\n')) {
+        const colonIndex = line.indexOf(':');
+        if (colonIndex === -1)
+            continue;
+        const key = line.slice(0, colonIndex).trim().replace(/^['"]|['"]$/g, '');
+        const value = line.slice(colonIndex + 1).trim().replace(/^['"]|['"]$/g, '');
+        result[key] = value;
+    }
+    return result;
+}
+// ── Acceptance Criteria Extraction ───────────────────────────────────────
+function extractAcceptanceCriteria(content) {
+    const criteria = [];
+    const acPattern = /\*\*AC\d+:?\s*([^*]+)\*\*/g;
+    let match;
+    while ((match = acPattern.exec(content)) !== null) {
+        criteria.push(match[1].trim());
+    }
+    return criteria;
+}
+// ── Framework Detection ──────────────────────────────────────────────────
+const FRAMEWORK_INDICATORS = {
+    react: 'React',
+    next: 'Next.js',
+    vue: 'Vue',
+    nuxt: 'Nuxt',
+    angular: 'Angular',
+    svelte: 'Svelte',
+    express: 'Express',
+    fastify: 'Fastify',
+    nest: 'NestJS',
+    koa: 'Koa',
+    hapi: 'Hapi',
+};
+function detectFrameworks(deps) {
+    const frameworks = [];
+    for (const [dep, name] of Object.entries(FRAMEWORK_INDICATORS)) {
+        if (dep in deps) {
+            frameworks.push(name);
+        }
+    }
+    return frameworks;
+}
+// ── Language Detection ───────────────────────────────────────────────────
+function detectLanguages(deps) {
+    const languages = new Set();
+    languages.add('JavaScript'); // Always present in Node.js projects
+    if ('typescript' in deps || Object.keys(deps).some((d) => d.includes('ts-'))) {
+        languages.add('TypeScript');
+    }
+    return [...languages];
+}
+/**
+ * Collect complete pipeline context.
+ *
+ * Reads state.json, package.json, and story file to build
+ * a sanitized PipelineContext for the remote server.
+ */
+export async function collectContext(options) {
+    const { projectRoot, storyFilePath, storyId, stepId, platformTarget } = options;
+    // Collect state context
+    const stateContext = await collectStateContext(projectRoot, storyId);
+    // Collect codebase metadata
+    const codebaseMetadata = await collectCodebaseMetadata(projectRoot);
+    // Collect story metadata
+    const storyMetadata = await collectStoryMetadata(storyFilePath);
+    // Build context
+    const context = {
+        storyId,
+        stepId,
+        epicId: storyMetadata.epicId || stateContext.epicId || '',
+        storyTitle: storyMetadata.title,
+        currentStatus: stateContext.status,
+        stepsCompleted: stateContext.stepsCompleted,
+        branchName: stateContext.branchName,
+        platformTarget: platformTarget || detectPlatform(),
+        codebaseMetadata,
+        storyMetadata,
+    };
+    // Sanitize before returning
+    return sanitizeObject(context, projectRoot);
+}
+/**
+ * Collect state context from state.json.
+ */
+async function collectStateContext(projectRoot, storyId) {
+    try {
+        const statePath = join(projectRoot, '.neocortex', 'state.json');
+        const raw = await readFile(statePath, 'utf-8');
+        const state = JSON.parse(raw);
+        const story = state.stories?.[storyId];
+        return {
+            status: story?.status || 'unknown',
+            stepsCompleted: story?.steps_completed || [],
+            branchName: story?.branch_name || '',
+            epicId: story?.epic_id || '',
+        };
+    }
+    catch {
+        return {
+            status: 'unknown',
+            stepsCompleted: [],
+            branchName: '',
+            epicId: '',
+        };
+    }
+}
+/**
+ * Collect codebase metadata from package.json.
+ */
+async function collectCodebaseMetadata(projectRoot) {
+    try {
+        const pkgPath = join(projectRoot, 'package.json');
+        const raw = await readFile(pkgPath, 'utf-8');
+        const pkg = JSON.parse(raw);
+        const allDeps = {
+            ...(pkg.dependencies || {}),
+            ...(pkg.devDependencies || {}),
+        };
+        return {
+            projectName: pkg.name || 'unknown',
+            languages: detectLanguages(allDeps),
+            frameworks: detectFrameworks(allDeps),
+            dependencies: pkg.dependencies || {},
+            nodeVersion: process.version,
+        };
+    }
+    catch {
+        return {
+            projectName: 'unknown',
+            languages: ['JavaScript'],
+            frameworks: [],
+            dependencies: {},
+            nodeVersion: process.version,
+        };
+    }
+}
+/**
+ * Collect story metadata from the story file.
+ */
+async function collectStoryMetadata(storyFilePath) {
+    try {
+        const raw = await readFile(storyFilePath, 'utf-8');
+        const fm = extractFrontmatter(raw);
+        const acs = extractAcceptanceCriteria(raw);
+        // Parse dependencies array from frontmatter
+        let deps = [];
+        const depsStr = fm['dependencies'];
+        if (depsStr) {
+            try {
+                deps = JSON.parse(depsStr.replace(/'/g, '"'));
+            }
+            catch {
+                deps = depsStr.split(',').map((d) => d.trim().replace(/[[\]"']/g, ''));
+            }
+        }
+        return {
+            id: fm['id'] || '',
+            epicId: fm['epic_id'] || '',
+            title: fm['title'] || '',
+            status: fm['status'] || fm['currentStatus'] || '',
+            dependencies: deps,
+            acceptanceCriteria: acs,
+        };
+    }
+    catch {
+        return {
+            id: '',
+            epicId: '',
+            title: '',
+            status: '',
+            dependencies: [],
+            acceptanceCriteria: [],
+        };
+    }
+}
+/**
+ * Detect the platform target from environment.
+ */
+function detectPlatform() {
+    if (process.env['CLAUDE_CODE'] || process.env['CLAUDE_AGENT']) {
+        return 'claude-code';
+    }
+    if (process.env['CURSOR_SESSION_ID']) {
+        return 'cursor';
+    }
+    if (process.env['VSCODE_PID']) {
+        return 'vscode';
+    }
+    if (process.env['GEMINI_CLI']) {
+        return 'gemini';
+    }
+    return 'unknown';
+}

package/packages/client/dist/context/context-sanitizer.js

@@ -1 +1,145 @@
-import{homedir as o}from"node:os";const f=[/token/i,/key/i,/secret/i,/password/i,/credential/i,/auth/i,/github_pat_/i,/npm_token/i,/api_key/i],l=[/github_pat_[A-Za-z0-9_]{36,}/g,/ghp_[A-Za-z0-9]{36,}/g,/gho_[A-Za-z0-9]{36,}/g,/sk-[A-Za-z0-9]{32,}/g,/Bearer\s+[A-Za-z0-9._\-]+/g,/-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END/g],s=1e3;function p(e,n){let t=e;if(n){const i=n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");t=t.replace(new RegExp(i,"g"),".")}const r=o();if(r){const i=r.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");t=t.replace(new RegExp(i,"g"),"~")}return t}function g(e){let n=e;for(const t of l)n=n.replace(t,"[REDACTED]");return n}function E(e){return e.length<=s?e:`${e.slice(0,s)}...[truncated, ${e.length} chars total]`}function a(e){return f.some(n=>n.test(e))}function c(e,n){let t=p(e,n);return t=g(t),t=E(t),t}function _(e,n){const t={};for(const[r,i]of Object.entries(e))a(r)||(t[r]=c(i,n));return t}function u(e,n){if(e==null)return e;if(typeof e=="string")return c(e,n);if(Array.isArray(e))return e.map(t=>u(t,n));if(typeof e=="object"){const t={};for(const[r,i]of Object.entries(e))a(r)&&typeof i=="string"?t[r]="[REDACTED]":t[r]=u(i,n);return t}return e}export{u as sanitizeObject,_ as sanitizeRecord,c as sanitizeValue};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Context Sanitizer
+ *
+ * Removes sensitive data from pipeline context before sending
+ * to the remote server. Strips absolute paths, tokens, credentials,
+ * and other sensitive information.
+ */
+import { homedir } from 'node:os';
+// ── Sensitive Patterns ───────────────────────────────────────────────────
+/** Environment variable name patterns that indicate sensitive values */
+const SENSITIVE_ENV_PATTERNS = [
+    /token/i,
+    /key/i,
+    /secret/i,
+    /password/i,
+    /credential/i,
+    /auth/i,
+    /github_pat_/i,
+    /npm_token/i,
+    /api_key/i,
+];
+/** Regex patterns for sensitive values in strings */
+const SENSITIVE_VALUE_PATTERNS = [
+    /github_pat_[A-Za-z0-9_]{36,}/g,
+    /ghp_[A-Za-z0-9]{36,}/g,
+    /gho_[A-Za-z0-9]{36,}/g,
+    /sk-[A-Za-z0-9]{32,}/g,
+    /Bearer\s+[A-Za-z0-9._\-]+/g,
+    /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END/g,
+];
+/** Maximum allowed string length before truncation */
+const MAX_VALUE_LENGTH = 1000;
+// ── Sanitization Functions ───────────────────────────────────────────────
+/**
+ * Replace absolute paths with relative ones.
+ *
+ * Converts paths like /Users/john/projects/neocortex/src/file.ts
+ * to ./src/file.ts based on the project root.
+ */
+function sanitizePaths(value, projectRoot) {
+    let result = value;
+    // Replace project root path with ./
+    if (projectRoot) {
+        const escapedRoot = projectRoot.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        result = result.replace(new RegExp(escapedRoot, 'g'), '.');
+    }
+    // Replace home directory with ~
+    const home = homedir();
+    if (home) {
+        const escapedHome = home.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        result = result.replace(new RegExp(escapedHome, 'g'), '~');
+    }
+    return result;
+}
+/**
+ * Remove sensitive tokens and credentials from a string.
+ */
+function sanitizeTokens(value) {
+    let result = value;
+    for (const pattern of SENSITIVE_VALUE_PATTERNS) {
+        result = result.replace(pattern, '[REDACTED]');
+    }
+    return result;
+}
+/**
+ * Truncate a string value if it exceeds the maximum length.
+ */
+function truncateValue(value) {
+    if (value.length <= MAX_VALUE_LENGTH) {
+        return value;
+    }
+    return `${value.slice(0, MAX_VALUE_LENGTH)}...[truncated, ${value.length} chars total]`;
+}
+/**
+ * Check if an environment variable name indicates a sensitive value.
+ */
+function isSensitiveKey(key) {
+    return SENSITIVE_ENV_PATTERNS.some((pattern) => pattern.test(key));
+}
+// ── Public API ───────────────────────────────────────────────────────────
+/**
+ * Sanitize a single string value.
+ *
+ * Applies path sanitization, token removal, and truncation.
+ */
+export function sanitizeValue(value, projectRoot) {
+    let result = sanitizePaths(value, projectRoot);
+    result = sanitizeTokens(result);
+    result = truncateValue(result);
+    return result;
+}
+/**
+ * Sanitize a record of key-value pairs.
+ *
+ * Removes entries with sensitive keys and sanitizes remaining values.
+ */
+export function sanitizeRecord(record, projectRoot) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(record)) {
+        if (isSensitiveKey(key)) {
+            continue; // Drop sensitive keys entirely
+        }
+        sanitized[key] = sanitizeValue(value, projectRoot);
+    }
+    return sanitized;
+}
+/**
+ * Deep sanitize an object, processing all string values recursively.
+ */
+export function sanitizeObject(obj, projectRoot) {
+    if (obj === null || obj === undefined) {
+        return obj;
+    }
+    if (typeof obj === 'string') {
+        return sanitizeValue(obj, projectRoot);
+    }
+    if (Array.isArray(obj)) {
+        return obj.map((item) => sanitizeObject(item, projectRoot));
+    }
+    if (typeof obj === 'object') {
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            if (isSensitiveKey(key) && typeof value === 'string') {
+                result[key] = '[REDACTED]';
+            }
+            else {
+                result[key] = sanitizeObject(value, projectRoot);
+            }
+        }
+        return result;
+    }
+    return obj;
+}