@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/runner/headless/opencode-adapter.js

@@ -1,2 +1,145 @@
-import{checkTrustedHeadlessRuntimeBinary as _}from"../binary.js";import{HEADLESS_REASON_CODES as s,adapterAvailabilityFailure as m,adapterAvailabilitySuccess as R,createRejectedExecutionResult as p,createUnavailableExecutionResult as I,hashPublicValue as f,normalizeHeadlessCommandResult as E,redaction as A,runHeadlessCommand as v,validateHeadlessAdapterExecutionInput as b}from"./types.js";import{governedPreflightFailureResult as h,preflightManagedHeadlessProfile as y,withGovernedHeadlessEvidence as c}from"./managed-profile.js";const r="opencode",d="opencode",S="neocortex",T=2e3,C=2e3,P=/(https?:\/\/\S+|(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|authorization\s*:|password\s*=|token\s*=|api[_-]?key\s*=|license[_-]?key\s*=|raw[_-]?(?:logs?)\s*[:=]|transcript|stack\s*trace|stderr:|stdout:|system prompt|workflow body|step body|PROTECTED_|PRIVATE_INTERNALS|CUSTOMER_PII|\bPII\b|VENDOR_CORPUS|\bPRIVATE\b)/i,O=/\b(?:Claude\s+Code|claude-code|@anthropic-ai\/claude-code)\b/i,k=/\bv?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z][0-9A-Za-z.-]*)?\b/;function w(){return{id:r,displayName:"OpenCode Headless Adapter",async checkAvailability(n={}){return N(r,d,n,{realpathBasenamePolicy:"opencode-npm-native"})},buildInvocation(n){const e=b(n,r);return e.ok?{ok:!0,invocation:{adapterId:r,commandName:d,args:V(e.prompt,e.input.modelId),promptHash:e.promptHash,...e.input.modelId?{modelId:e.input.modelId}:{},timeoutMs:e.input.timeoutMs??600*1e3,publicSafe:!0},publicSafe:!0}:e},async execute(n,e={}){const t=b(n,r);if(!t.ok)return p(r,r,t);const a=y(r,e);if(!a.ok)return h(r,t.input,a);if(e.signal?.aborted)return c(E(r,t.input,{exitCode:null,signal:"SIGTERM",timedOut:!1,cancelled:!0,durationMs:0,stdout:"",stderr:"",stdoutBytes:0,stderrBytes:0}));const i=await this.checkAvailability(e);if(!i.ok)return c(I(r,t.input,i));const o=this.buildInvocation(t.input);if(!o.ok)return p(r,r,o);const u=await(e.commandRunner??v)(i.executablePath??d,o.invocation.args,{cwd:e.cwd,env:e.env,timeoutMs:o.invocation.timeoutMs,maxOutputBytes:e.maxOutputBytes,signal:e.signal,...t.input.receipt?.jobId?{localConsole:{projectRoot:e.cwd,jobId:t.input.receipt.jobId,attemptId:t.input.receipt.attemptId,executionId:t.input.receipt.executionId,publicSafe:!0}}:{}});return c(E(r,t.input,u))}}}async function N(n,e,t,a={}){const i=_({commandName:e,env:t.env,platform:t.platform,commandLocator:t.commandLocator,realpathBasenamePolicy:a.realpathBasenamePolicy});if(!i.ok)return m(n,e,i.reasonCode===s.ADAPTER_UNAVAILABLE?s.ADAPTER_UNAVAILABLE:s.RUNTIME_UNTRUSTED,i.publicSummary,i.redactionSummary);const l=await(t.versionRunner??t.commandRunner??v)(i.executablePath,["--version"],{env:t.env,timeoutMs:5e3,maxOutputBytes:2e3}),u=g(l,a.versionEvidence??"generic-public");return u.ok?R(n,e,D(e,a.versionEvidence),{executablePath:i.executablePath,versionText:u.versionText}):m(n,e,s.ADAPTER_UNAVAILABLE,u.publicSummary,u.redactionSummary)}function g(n,e){const t=x(`${n.stdout}
-${n.stderr}`.trim()),a=t?[A("runtimeVersion","raw_log",f(t))]:[A("runtimeVersion","missing","value-denied")];return n.timedOut||n.exitCode!==0||t.length===0||t.length>T||n.stdoutBytes+n.stderrBytes>C||P.test(t)?{ok:!1,publicSummary:"Headless runtime version check did not return a bounded public result.",redactionSummary:a}:e==="claude-code"&&(!O.test(t)||!k.test(t))?{ok:!1,publicSummary:"Headless runtime version check did not return bounded Claude Code product/version evidence.",redactionSummary:a}:{ok:!0,versionText:t}}function x(n){return n.replace(/\s+/g," ").trim()}function D(n,e){return e==="claude-code"?`Trusted ${n} runtime is available with bounded Claude Code version evidence.`:`Trusted ${n} runtime is available.`}function V(n,e){const t=["run","--standalone","--agent",S,"--auto"];return e&&t.push("--model",e),t.push("--",n),t}export{N as checkRuntimeAvailability,w as createOpenCodeHeadlessAdapter};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * P190.04 -- trusted OpenCode headless adapter interface.
+ */
+import { checkTrustedHeadlessRuntimeBinary } from '../binary.js';
+import { HEADLESS_REASON_CODES, adapterAvailabilityFailure, adapterAvailabilitySuccess, createRejectedExecutionResult, createUnavailableExecutionResult, hashPublicValue, normalizeHeadlessCommandResult, redaction, runHeadlessCommand, validateHeadlessAdapterExecutionInput, } from './types.js';
+import { governedPreflightFailureResult, preflightManagedHeadlessProfile, withGovernedHeadlessEvidence, } from './managed-profile.js';
+const OPENCODE_ADAPTER_ID = 'opencode';
+const OPENCODE_COMMAND = 'opencode';
+const OPENCODE_AGENT_PROFILE = 'neocortex';
+const VERSION_EVIDENCE_MAX_CHARS = 2_000;
+const VERSION_EVIDENCE_MAX_BYTES = 2_000;
+const UNSAFE_VERSION_EVIDENCE_PATTERN = /(https?:\/\/\S+|(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|authorization\s*:|password\s*=|token\s*=|api[_-]?key\s*=|license[_-]?key\s*=|raw[_-]?(?:logs?)\s*[:=]|transcript|stack\s*trace|stderr:|stdout:|system prompt|workflow body|step body|PROTECTED_|PRIVATE_INTERNALS|CUSTOMER_PII|\bPII\b|VENDOR_CORPUS|\bPRIVATE\b)/i;
+const CLAUDE_CODE_PRODUCT_PATTERN = /\b(?:Claude\s+Code|claude-code|@anthropic-ai\/claude-code)\b/i;
+const VERSION_SEMVER_PATTERN = /\bv?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z][0-9A-Za-z.-]*)?\b/;
+export function createOpenCodeHeadlessAdapter() {
+    return {
+        id: OPENCODE_ADAPTER_ID,
+        displayName: 'OpenCode Headless Adapter',
+        async checkAvailability(options = {}) {
+            return checkRuntimeAvailability(OPENCODE_ADAPTER_ID, OPENCODE_COMMAND, options, {
+                realpathBasenamePolicy: 'opencode-npm-native',
+            });
+        },
+        buildInvocation(input) {
+            const validation = validateHeadlessAdapterExecutionInput(input, OPENCODE_ADAPTER_ID);
+            if (!validation.ok)
+                return validation;
+            return {
+                ok: true,
+                invocation: {
+                    adapterId: OPENCODE_ADAPTER_ID,
+                    commandName: OPENCODE_COMMAND,
+                    args: buildOpenCodeArgs(validation.prompt, validation.input.modelId),
+                    promptHash: validation.promptHash,
+                    ...(validation.input.modelId ? { modelId: validation.input.modelId } : {}),
+                    timeoutMs: validation.input.timeoutMs ?? 10 * 60 * 1000,
+                    publicSafe: true,
+                },
+                publicSafe: true,
+            };
+        },
+        async execute(input, options = {}) {
+            const validation = validateHeadlessAdapterExecutionInput(input, OPENCODE_ADAPTER_ID);
+            if (!validation.ok)
+                return createRejectedExecutionResult(OPENCODE_ADAPTER_ID, OPENCODE_ADAPTER_ID, validation);
+            const preflight = preflightManagedHeadlessProfile(OPENCODE_ADAPTER_ID, options);
+            if (!preflight.ok)
+                return governedPreflightFailureResult(OPENCODE_ADAPTER_ID, validation.input, preflight);
+            if (options.signal?.aborted) {
+                return withGovernedHeadlessEvidence(normalizeHeadlessCommandResult(OPENCODE_ADAPTER_ID, validation.input, {
+                    exitCode: null, signal: 'SIGTERM', timedOut: false, cancelled: true, durationMs: 0,
+                    stdout: '', stderr: '', stdoutBytes: 0, stderrBytes: 0,
+                }));
+            }
+            const availability = await this.checkAvailability(options);
+            if (!availability.ok)
+                return withGovernedHeadlessEvidence(createUnavailableExecutionResult(OPENCODE_ADAPTER_ID, validation.input, availability));
+            const invocation = this.buildInvocation(validation.input);
+            if (!invocation.ok)
+                return createRejectedExecutionResult(OPENCODE_ADAPTER_ID, OPENCODE_ADAPTER_ID, invocation);
+            const runner = options.commandRunner ?? runHeadlessCommand;
+            const result = await runner(availability.executablePath ?? OPENCODE_COMMAND, invocation.invocation.args, {
+                cwd: options.cwd,
+                env: options.env,
+                timeoutMs: invocation.invocation.timeoutMs,
+                maxOutputBytes: options.maxOutputBytes,
+                signal: options.signal,
+                ...(validation.input.receipt?.jobId ? { localConsole: { projectRoot: options.cwd, jobId: validation.input.receipt.jobId, attemptId: validation.input.receipt.attemptId, executionId: validation.input.receipt.executionId, publicSafe: true } } : {}),
+            });
+            return withGovernedHeadlessEvidence(normalizeHeadlessCommandResult(OPENCODE_ADAPTER_ID, validation.input, result));
+        },
+    };
+}
+export async function checkRuntimeAvailability(adapterId, commandName, options, policy = {}) {
+    const trust = checkTrustedHeadlessRuntimeBinary({
+        commandName,
+        env: options.env,
+        platform: options.platform,
+        commandLocator: options.commandLocator,
+        realpathBasenamePolicy: policy.realpathBasenamePolicy,
+    });
+    if (!trust.ok) {
+        return adapterAvailabilityFailure(adapterId, commandName, trust.reasonCode === HEADLESS_REASON_CODES.ADAPTER_UNAVAILABLE
+            ? HEADLESS_REASON_CODES.ADAPTER_UNAVAILABLE
+            : HEADLESS_REASON_CODES.RUNTIME_UNTRUSTED, trust.publicSummary, trust.redactionSummary);
+    }
+    const runner = options.versionRunner ?? options.commandRunner ?? runHeadlessCommand;
+    const version = await runner(trust.executablePath, ['--version'], {
+        env: options.env,
+        timeoutMs: 5_000,
+        maxOutputBytes: 2_000,
+    });
+    const evidence = validateRuntimeVersionEvidence(version, policy.versionEvidence ?? 'generic-public');
+    if (!evidence.ok) {
+        return adapterAvailabilityFailure(adapterId, commandName, HEADLESS_REASON_CODES.ADAPTER_UNAVAILABLE, evidence.publicSummary, evidence.redactionSummary);
+    }
+    return adapterAvailabilitySuccess(adapterId, commandName, trustedAvailabilitySummary(commandName, policy.versionEvidence), {
+        executablePath: trust.executablePath,
+        versionText: evidence.versionText,
+    });
+}
+function validateRuntimeVersionEvidence(version, requirement) {
+    const versionText = normalizeVersionEvidenceText(`${version.stdout}\n${version.stderr}`.trim());
+    const redactionSummary = versionText
+        ? [redaction('runtimeVersion', 'raw_log', hashPublicValue(versionText))]
+        : [redaction('runtimeVersion', 'missing', 'value-denied')];
+    if (version.timedOut
+        || version.exitCode !== 0
+        || versionText.length === 0
+        || versionText.length > VERSION_EVIDENCE_MAX_CHARS
+        || version.stdoutBytes + version.stderrBytes > VERSION_EVIDENCE_MAX_BYTES
+        || UNSAFE_VERSION_EVIDENCE_PATTERN.test(versionText)) {
+        return {
+            ok: false,
+            publicSummary: 'Headless runtime version check did not return a bounded public result.',
+            redactionSummary,
+        };
+    }
+    if (requirement === 'claude-code' && (!CLAUDE_CODE_PRODUCT_PATTERN.test(versionText) || !VERSION_SEMVER_PATTERN.test(versionText))) {
+        return {
+            ok: false,
+            publicSummary: 'Headless runtime version check did not return bounded Claude Code product/version evidence.',
+            redactionSummary,
+        };
+    }
+    return { ok: true, versionText };
+}
+function normalizeVersionEvidenceText(value) {
+    return value.replace(/\s+/g, ' ').trim();
+}
+function trustedAvailabilitySummary(commandName, requirement) {
+    if (requirement === 'claude-code')
+        return `Trusted ${commandName} runtime is available with bounded Claude Code version evidence.`;
+    return `Trusted ${commandName} runtime is available.`;
+}
+function buildOpenCodeArgs(prompt, modelId) {
+    const args = ['run', '--standalone', '--agent', OPENCODE_AGENT_PROFILE, '--auto'];
+    if (modelId)
+        args.push('--model', modelId);
+    args.push('--', prompt);
+    return args;
+}

package/packages/client/dist/runner/headless/prepared-story-bundle.js

@@ -1 +1,43 @@
-import{createHash as u}from"node:crypto";import{validateYoloopPreparationBundle as h}from"../../../../shared/dist/yoloop/wave-decision-receipt.js";function f(e){const r=[],s=Array.isArray(e.phases)?e.phases.filter(a):[],i=a(e.budgets)?e.budgets:{};(e.version!==2||!c(e.graphRevision))&&r.push("phased-plan-invalid"),i.maxWriteConcurrency!==1&&r.push("writer-concurrency-invalid");for(const t of s)(!Number.isInteger(t.maxConcurrency)||Number(t.maxConcurrency)<1)&&r.push("phase-concurrency-invalid"),(t.mutatesEpicCheckout===!0||t.mutatesEpicWorktree===!0)&&(t.maxConcurrency!==1||!["epic-writer-lease","commit-range"].includes(String(t.isolation)))&&r.push("mutating-phase-not-serialized");["read-only-analysis","isolated-build-test","patch-preparation","single-writer-integration","story-checkpoint-review"].some(t=>!s.some(n=>n.kind===t))&&r.push("phase-missing");const o=Array.isArray(e.decisionReceiptIds)?e.decisionReceiptIds:[];(o.length===0||o.some(t=>!c(t)))&&r.push("decision-receipt-invalid");const d=Math.max(1,...s.filter(t=>t.mutatesEpicCheckout!==!0&&t.mutatesEpicWorktree!==!0).map(t=>Number(t.maxConcurrency)||1));return{ok:r.length===0,preparationConcurrency:d,childExecutionConcurrency:1,reasonCodes:[...new Set(r)].sort()}}function g(e){const r=[...h(e.bundle,e.expected)];return e.bundle.claimRevision!==e.expected.claimRevision&&r.push("bundle-claims-stale"),l(e.bundle.authorizedWriteSet,e.expected.authorizedWriteSet??[])||r.push("bundle-write-set-stale"),u("sha256").update(e.payload).digest("hex")!==e.bundle.bundleDigest&&r.push("bundle-payload-digest-mismatch"),(!e.writerLease||e.writerLease.ownerStoryId!==e.bundle.storyId||e.writerLease.expiresAt<=e.expected.nowIso)&&r.push("bundle-writer-lease-missing"),[...new Set(r)].sort()}function a(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function c(e){return typeof e=="string"&&/^[a-f0-9]{40,64}$/.test(e)}function l(e,r){return e.length===r.length&&e.every((s,i)=>s===r[i])}export{g as admitPreparedStoryBundle,f as validatePhasedYoloopPlan};
+/** P208.05 -- client enforcement for phased plans and branchless bundles. */
+import { createHash } from 'node:crypto';
+import { validateYoloopPreparationBundle } from '../../../../shared/dist/yoloop/wave-decision-receipt.js';
+export function validatePhasedYoloopPlan(plan) {
+    const errors = [];
+    const phases = Array.isArray(plan.phases) ? plan.phases.filter(isRecord) : [];
+    const budgets = isRecord(plan.budgets) ? plan.budgets : {};
+    if (plan.version !== 2 || !isHash(plan.graphRevision))
+        errors.push('phased-plan-invalid');
+    if (budgets.maxWriteConcurrency !== 1)
+        errors.push('writer-concurrency-invalid');
+    for (const phase of phases) {
+        if (!Number.isInteger(phase.maxConcurrency) || Number(phase.maxConcurrency) < 1)
+            errors.push('phase-concurrency-invalid');
+        const mutatesEpicCheckout = phase.mutatesEpicCheckout === true || phase.mutatesEpicWorktree === true;
+        if (mutatesEpicCheckout && (phase.maxConcurrency !== 1 || !['epic-writer-lease', 'commit-range'].includes(String(phase.isolation))))
+            errors.push('mutating-phase-not-serialized');
+    }
+    const required = ['read-only-analysis', 'isolated-build-test', 'patch-preparation', 'single-writer-integration', 'story-checkpoint-review'];
+    if (required.some((kind) => !phases.some((phase) => phase.kind === kind)))
+        errors.push('phase-missing');
+    const receiptIds = Array.isArray(plan.decisionReceiptIds) ? plan.decisionReceiptIds : [];
+    if (receiptIds.length === 0 || receiptIds.some((id) => !isHash(id)))
+        errors.push('decision-receipt-invalid');
+    const preparationConcurrency = Math.max(1, ...phases.filter((phase) => phase.mutatesEpicCheckout !== true && phase.mutatesEpicWorktree !== true).map((phase) => Number(phase.maxConcurrency) || 1));
+    return { ok: errors.length === 0, preparationConcurrency, childExecutionConcurrency: 1, reasonCodes: [...new Set(errors)].sort() };
+}
+export function admitPreparedStoryBundle(input) {
+    const errors = [...validateYoloopPreparationBundle(input.bundle, input.expected)];
+    if (input.bundle.claimRevision !== input.expected.claimRevision)
+        errors.push('bundle-claims-stale');
+    if (!sameStrings(input.bundle.authorizedWriteSet, input.expected.authorizedWriteSet ?? []))
+        errors.push('bundle-write-set-stale');
+    const digest = createHash('sha256').update(input.payload).digest('hex');
+    if (digest !== input.bundle.bundleDigest)
+        errors.push('bundle-payload-digest-mismatch');
+    if (!input.writerLease || input.writerLease.ownerStoryId !== input.bundle.storyId || input.writerLease.expiresAt <= input.expected.nowIso)
+        errors.push('bundle-writer-lease-missing');
+    return [...new Set(errors)].sort();
+}
+function isRecord(value) { return Boolean(value) && typeof value === 'object' && !Array.isArray(value); }
+function isHash(value) { return typeof value === 'string' && /^[a-f0-9]{40,64}$/.test(value); }
+function sameStrings(left, right) { return left.length === right.length && left.every((value, index) => value === right[index]); }

package/packages/client/dist/runner/headless/resolver.js

@@ -1 +1,231 @@
-import{existsSync as h,readFileSync as T,statSync as _}from"node:fs";import{homedir as k}from"node:os";import{isAbsolute as I,join as S,resolve as R}from"node:path";import{HEADLESS_REASON_CODES as o,boundPublicSummary as D,isHeadlessAdapterId as b,isSafeHeadlessModelId as U,redaction as c}from"./types.js";const N=Object.freeze({runtimeId:"opencode",source:"fallback",publicSafe:!0}),E=".neocortex/headless-runtime.json",A=8*1024,C=new Set(["runtimeId","modelId","source","reasonCode","publicSafe"]),g=/(raw|prompt|private|secret|token|password|authorization|api[_-]?key|license|argv|args|executable|binary|shell|cwd|command|path|url|vendor|stdout|stderr|transcript|workflow|step|customer|pii)/i;function P(e={}){const t=e.registry??O,u=L(e),r=[],d=[];for(const i of u){if(i.value===void 0)continue;const a=M(i,t);if(!a.ok)return a.resolution;d.push(...a.candidate.redactions),r.push(a.candidate)}const n=r.find(i=>i.runtimeId),s=r.find(i=>i.modelId);if(!n?.runtimeId)return{ok:!1,runtimeSource:"unresolved",reasonCode:o.RUNTIME_UNRESOLVED,reasonCodes:[o.RUNTIME_UNRESOLVED],publicSummary:"Headless runtime could not be resolved from explicit, origin, default or fallback sources.",redactionSummary:d,publicSafe:!0};const l=w(n.source);return{ok:!0,runtimeId:n.runtimeId,...s?.modelId?{modelId:s.modelId}:{},runtimeSource:n.source,...s?.source?{modelSource:s.source}:{},reasonCode:l,reasonCodes:[l],publicSummary:`Resolved headless runtime from ${n.source} source.`,redactionSummary:d,publicSafe:!0}}function G(e={}){const t=e.maxBytes??A,u=x(e);for(const r of u)if(h(r.path))try{const d=_(r.path);if(!d.isFile()||d.size>t)return p("Default headless runtime config was not a bounded file.","defaultConfig","unbounded_file");const n=JSON.parse(T(r.path,"utf8")),s=H(n);return s?{ok:!0,defaults:{...s,source:"default",publicSafe:!0},source:r.kind,reasonCodes:[o.RUNTIME_DEFAULT],publicSummary:`Loaded ${r.kind} headless runtime defaults.`,publicSafe:!0}:p("Default headless runtime config did not contain a public object.","defaultConfig","unsafe_key")}catch{return p("Default headless runtime config could not be parsed safely.","defaultConfig","unsafe_key")}return{ok:!0,defaults:void 0,reasonCodes:[],publicSummary:"No headless runtime defaults were found; resolver will continue without guessing.",publicSafe:!0}}function L(e){const t=[{source:"explicit",value:e.explicit},{source:"origin",value:e.origin}];for(const u of v(e))t.push({source:"default",value:u});return e.projectDefault!==void 0&&t.push({source:"default",value:e.projectDefault}),e.userDefault!==void 0&&t.push({source:"default",value:e.userDefault}),e.fallback!==!1&&t.push({source:"fallback",value:e.fallback??N}),t}function v(e){return e.defaults===void 0?[]:Array.isArray(e.defaults)?e.defaults:[e.defaults]}function M(e,t){const u=F(e.value);if(u===void 0)return{ok:!0,candidate:{source:e.source,redactions:[]}};if(!m(u))return f(o.RUNTIME_UNTRUSTED,"Headless runtime hint must be a public object.",e.source,[c("runtime","unsafe_key","value-denied")]);const r=[];for(const a of Object.keys(u))(!C.has(a)||g.test(a))&&r.push(c(`runtime.${a}`,"unsafe_key","key-denied"));u.publicSafe!==!0&&r.push(c("runtime.publicSafe","unsafe_key","value-denied")),(typeof u.source=="string"?u.source:e.source)!==e.source&&r.push(c("runtime.source","unsafe_key","value-denied"));const n=typeof u.runtimeId=="string"?u.runtimeId:void 0,s=typeof u.modelId=="string"?u.modelId:void 0;let l;if(n!==void 0){if(!j(n)||!b(n)||!t.hasAdapter(n))return r.push(c("runtime.runtimeId","unsafe_key","value-denied")),f(o.RUNTIME_UNTRUSTED,"Headless runtime was not trusted or allowlisted.",e.source,r);l=n}let i;if(s!==void 0){if(!U(s))return r.push(c("runtime.modelId","unsafe_key","value-denied")),f(o.MODEL_REJECTED,"Headless model id failed bounded public-safety validation.",e.source,r);i=s}return r.length>0?f(o.RUNTIME_UNTRUSTED,"Headless runtime hint failed public-safety validation.",e.source,r):{ok:!0,candidate:{source:e.source,...l?{runtimeId:l}:{},...i?{modelId:i}:{},redactions:[]}}}function F(e){return m(e)&&e.ok===!0&&"defaults"in e?e.defaults:e}function f(e,t,u,r){return{ok:!1,resolution:{ok:!1,runtimeSource:"unresolved",reasonCode:e,reasonCodes:[e],publicSummary:D(`${t} Source=${u}.`),redactionSummary:r,publicSafe:!0}}}function w(e){switch(e){case"explicit":return o.RUNTIME_EXPLICIT;case"origin":return o.RUNTIME_ORIGIN;case"default":return o.RUNTIME_DEFAULT;case"fallback":return o.RUNTIME_FALLBACK}}function x(e){const t=[],u=y(e.projectRoot);u&&t.push({kind:"project",path:S(u,E)});const r=y(e.homeDir??k());return r&&t.push({kind:"user",path:S(r,E)}),t}function y(e){if(!e||/[\r\n\0]/.test(e))return;const t=I(e)?e:R(e);return I(t)?t:void 0}function H(e){if(!m(e))return;const t=m(e.headless)?e.headless:e;return{...typeof t.runtimeId=="string"?{runtimeId:t.runtimeId}:{},...typeof t.modelId=="string"?{modelId:t.modelId}:{},publicSafe:!0}}function p(e,t,u){return{ok:!1,reasonCode:o.RUNTIME_UNTRUSTED,reasonCodes:[o.RUNTIME_UNTRUSTED],publicSummary:e,redactionSummary:[c(t,u,"value-denied")],publicSafe:!0}}function j(e){return/^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$/.test(e)&&!/[\/\s;&|`$<>]/.test(e)}function m(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}const O=Object.freeze({hasAdapter(e){return b(e)}});export{G as loadHeadlessRuntimeDefaults,P as resolveHeadlessRuntime};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * P190.04 -- deterministic headless runtime/model resolver.
+ */
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { HEADLESS_REASON_CODES, boundPublicSummary, isHeadlessAdapterId, isSafeHeadlessModelId, redaction, } from './types.js';
+const DEFAULT_FALLBACK_HINT = Object.freeze({
+    runtimeId: 'opencode',
+    source: 'fallback',
+    publicSafe: true,
+});
+const DEFAULT_CONFIG_RELATIVE_PATH = '.neocortex/headless-runtime.json';
+const DEFAULT_CONFIG_MAX_BYTES = 8 * 1024;
+const RUNTIME_HINT_ALLOWED_KEYS = new Set(['runtimeId', 'modelId', 'source', 'reasonCode', 'publicSafe']);
+const UNSAFE_HINT_KEY_PATTERN = /(raw|prompt|private|secret|token|password|authorization|api[_-]?key|license|argv|args|executable|binary|shell|cwd|command|path|url|vendor|stdout|stderr|transcript|workflow|step|customer|pii)/i;
+export function resolveHeadlessRuntime(input = {}) {
+    const registry = input.registry ?? DEFAULT_REGISTRY_LIKE;
+    const candidates = buildCandidateList(input);
+    const normalized = [];
+    const redactions = [];
+    for (const candidate of candidates) {
+        if (candidate.value === undefined)
+            continue;
+        const result = normalizeCandidate(candidate, registry);
+        if (!result.ok)
+            return result.resolution;
+        redactions.push(...result.candidate.redactions);
+        normalized.push(result.candidate);
+    }
+    const runtimeCandidate = normalized.find((candidate) => candidate.runtimeId);
+    const modelCandidate = normalized.find((candidate) => candidate.modelId);
+    if (!runtimeCandidate?.runtimeId) {
+        return {
+            ok: false,
+            runtimeSource: 'unresolved',
+            reasonCode: HEADLESS_REASON_CODES.RUNTIME_UNRESOLVED,
+            reasonCodes: [HEADLESS_REASON_CODES.RUNTIME_UNRESOLVED],
+            publicSummary: 'Headless runtime could not be resolved from explicit, origin, default or fallback sources.',
+            redactionSummary: redactions,
+            publicSafe: true,
+        };
+    }
+    const reasonCode = sourceReasonCode(runtimeCandidate.source);
+    return {
+        ok: true,
+        runtimeId: runtimeCandidate.runtimeId,
+        ...(modelCandidate?.modelId ? { modelId: modelCandidate.modelId } : {}),
+        runtimeSource: runtimeCandidate.source,
+        ...(modelCandidate?.source ? { modelSource: modelCandidate.source } : {}),
+        reasonCode,
+        reasonCodes: [reasonCode],
+        publicSummary: `Resolved headless runtime from ${runtimeCandidate.source} source.`,
+        redactionSummary: redactions,
+        publicSafe: true,
+    };
+}
+export function loadHeadlessRuntimeDefaults(options = {}) {
+    const maxBytes = options.maxBytes ?? DEFAULT_CONFIG_MAX_BYTES;
+    const candidates = boundedDefaultPaths(options);
+    for (const candidate of candidates) {
+        if (!existsSync(candidate.path))
+            continue;
+        try {
+            const stat = statSync(candidate.path);
+            if (!stat.isFile() || stat.size > maxBytes) {
+                return defaultsFailure('Default headless runtime config was not a bounded file.', 'defaultConfig', 'unbounded_file');
+            }
+            const parsed = JSON.parse(readFileSync(candidate.path, 'utf8'));
+            const defaults = extractDefaults(parsed);
+            if (!defaults)
+                return defaultsFailure('Default headless runtime config did not contain a public object.', 'defaultConfig', 'unsafe_key');
+            return {
+                ok: true,
+                defaults: { ...defaults, source: 'default', publicSafe: true },
+                source: candidate.kind,
+                reasonCodes: [HEADLESS_REASON_CODES.RUNTIME_DEFAULT],
+                publicSummary: `Loaded ${candidate.kind} headless runtime defaults.`,
+                publicSafe: true,
+            };
+        }
+        catch {
+            return defaultsFailure('Default headless runtime config could not be parsed safely.', 'defaultConfig', 'unsafe_key');
+        }
+    }
+    return {
+        ok: true,
+        defaults: undefined,
+        reasonCodes: [],
+        publicSummary: 'No headless runtime defaults were found; resolver will continue without guessing.',
+        publicSafe: true,
+    };
+}
+function buildCandidateList(input) {
+    const candidates = [
+        { source: 'explicit', value: input.explicit },
+        { source: 'origin', value: input.origin },
+    ];
+    for (const value of normalizeDefaults(input))
+        candidates.push({ source: 'default', value });
+    if (input.projectDefault !== undefined)
+        candidates.push({ source: 'default', value: input.projectDefault });
+    if (input.userDefault !== undefined)
+        candidates.push({ source: 'default', value: input.userDefault });
+    if (input.fallback !== false)
+        candidates.push({ source: 'fallback', value: input.fallback ?? DEFAULT_FALLBACK_HINT });
+    return candidates;
+}
+function normalizeDefaults(input) {
+    if (input.defaults === undefined)
+        return [];
+    return Array.isArray(input.defaults) ? input.defaults : [input.defaults];
+}
+function normalizeCandidate(candidate, registry) {
+    const value = unwrapDefaultLookup(candidate.value);
+    if (value === undefined)
+        return { ok: true, candidate: { source: candidate.source, redactions: [] } };
+    if (!isRecord(value)) {
+        return candidateFailure(HEADLESS_REASON_CODES.RUNTIME_UNTRUSTED, 'Headless runtime hint must be a public object.', candidate.source, [redaction('runtime', 'unsafe_key', 'value-denied')]);
+    }
+    const redactions = [];
+    for (const key of Object.keys(value)) {
+        if (!RUNTIME_HINT_ALLOWED_KEYS.has(key) || UNSAFE_HINT_KEY_PATTERN.test(key)) {
+            redactions.push(redaction(`runtime.${key}`, 'unsafe_key', 'key-denied'));
+        }
+    }
+    if (value.publicSafe !== true)
+        redactions.push(redaction('runtime.publicSafe', 'unsafe_key', 'value-denied'));
+    const source = typeof value.source === 'string' ? value.source : candidate.source;
+    if (source !== candidate.source)
+        redactions.push(redaction('runtime.source', 'unsafe_key', 'value-denied'));
+    const runtimeText = typeof value.runtimeId === 'string' ? value.runtimeId : undefined;
+    const modelText = typeof value.modelId === 'string' ? value.modelId : undefined;
+    let runtimeId;
+    if (runtimeText !== undefined) {
+        if (!isSafeRuntimeId(runtimeText) || !isHeadlessAdapterId(runtimeText) || !registry.hasAdapter(runtimeText)) {
+            redactions.push(redaction('runtime.runtimeId', 'unsafe_key', 'value-denied'));
+            return candidateFailure(HEADLESS_REASON_CODES.RUNTIME_UNTRUSTED, 'Headless runtime was not trusted or allowlisted.', candidate.source, redactions);
+        }
+        runtimeId = runtimeText;
+    }
+    let modelId;
+    if (modelText !== undefined) {
+        if (!isSafeHeadlessModelId(modelText)) {
+            redactions.push(redaction('runtime.modelId', 'unsafe_key', 'value-denied'));
+            return candidateFailure(HEADLESS_REASON_CODES.MODEL_REJECTED, 'Headless model id failed bounded public-safety validation.', candidate.source, redactions);
+        }
+        modelId = modelText;
+    }
+    if (redactions.length > 0) {
+        return candidateFailure(HEADLESS_REASON_CODES.RUNTIME_UNTRUSTED, 'Headless runtime hint failed public-safety validation.', candidate.source, redactions);
+    }
+    return { ok: true, candidate: { source: candidate.source, ...(runtimeId ? { runtimeId } : {}), ...(modelId ? { modelId } : {}), redactions: [] } };
+}
+function unwrapDefaultLookup(value) {
+    if (isRecord(value) && value.ok === true && 'defaults' in value)
+        return value.defaults;
+    return value;
+}
+function candidateFailure(reasonCode, publicSummary, source, redactions) {
+    return {
+        ok: false,
+        resolution: {
+            ok: false,
+            runtimeSource: 'unresolved',
+            reasonCode,
+            reasonCodes: [reasonCode],
+            publicSummary: boundPublicSummary(`${publicSummary} Source=${source}.`),
+            redactionSummary: redactions,
+            publicSafe: true,
+        },
+    };
+}
+function sourceReasonCode(source) {
+    switch (source) {
+        case 'explicit': return HEADLESS_REASON_CODES.RUNTIME_EXPLICIT;
+        case 'origin': return HEADLESS_REASON_CODES.RUNTIME_ORIGIN;
+        case 'default': return HEADLESS_REASON_CODES.RUNTIME_DEFAULT;
+        case 'fallback': return HEADLESS_REASON_CODES.RUNTIME_FALLBACK;
+    }
+}
+function boundedDefaultPaths(options) {
+    const paths = [];
+    const projectRoot = normalizeAbsoluteDirectory(options.projectRoot);
+    if (projectRoot)
+        paths.push({ kind: 'project', path: join(projectRoot, DEFAULT_CONFIG_RELATIVE_PATH) });
+    const home = normalizeAbsoluteDirectory(options.homeDir ?? homedir());
+    if (home)
+        paths.push({ kind: 'user', path: join(home, DEFAULT_CONFIG_RELATIVE_PATH) });
+    return paths;
+}
+function normalizeAbsoluteDirectory(value) {
+    if (!value || /[\r\n\0]/.test(value))
+        return undefined;
+    const absolute = isAbsolute(value) ? value : resolve(value);
+    return isAbsolute(absolute) ? absolute : undefined;
+}
+function extractDefaults(parsed) {
+    if (!isRecord(parsed))
+        return undefined;
+    const candidate = isRecord(parsed.headless) ? parsed.headless : parsed;
+    return {
+        ...(typeof candidate.runtimeId === 'string' ? { runtimeId: candidate.runtimeId } : {}),
+        ...(typeof candidate.modelId === 'string' ? { modelId: candidate.modelId } : {}),
+        publicSafe: true,
+    };
+}
+function defaultsFailure(publicSummary, field, reason) {
+    return {
+        ok: false,
+        reasonCode: HEADLESS_REASON_CODES.RUNTIME_UNTRUSTED,
+        reasonCodes: [HEADLESS_REASON_CODES.RUNTIME_UNTRUSTED],
+        publicSummary,
+        redactionSummary: [redaction(field, reason, 'value-denied')],
+        publicSafe: true,
+    };
+}
+function isSafeRuntimeId(value) {
+    return /^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$/.test(value) && !/[\/\s;&|`$<>]/.test(value);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+const DEFAULT_REGISTRY_LIKE = Object.freeze({
+    hasAdapter(id) {
+        return isHeadlessAdapterId(id);
+    },
+});