@ornexus/neocortex 4.60.73 → 4.60.74

package/packages/client/dist/config.js

@@ -1,223 +1,2 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { SUBAGENT_APPROVAL_MANAGED_DEFAULT, SUBAGENT_APPROVAL_EVIDENCE, SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION, createSubagentApprovalAuditEvent, isSubagentApprovalMode, resolveSubagentApprovalPolicy, } from './policy/subagent-approval-policy.js';
-import { setSecureDirPermissions, setSecureFilePermissions, } from './config/secure-config.js';
-const POLICY_KEY = 'subagentApprovalPolicy';
-const AUDIT_KEY = 'subagentApprovalPolicyAudit';
-const MAX_AUDIT_EVENTS = 25;
-const AUDIT_EVENTS = new Set([
-    'managed-default-materialized',
-    'user-override-updated',
-    'user-override-reset',
-]);
-const APPROVAL_SOURCES = new Set(['managed-default', 'user-override']);
-const APPROVAL_SCOPES = new Set([
-    'child',
-    'session',
-    'global',
-    'inherited',
-    'none',
-]);
-const EFFECTIVE_REASONS = new Set([
-    'requested-mode-honored',
-    'host-policy-reduced',
-    'host-capability-unvalidated',
-    'host-capability-unsupported',
-    'platform-target-unknown',
-]);
-const FALLBACK_MODES = new Set(['none', 'root-inline', 'shell-loop']);
-const PLATFORM_TARGETS = new Set([
-    'claude-code',
-    'opencode',
-    'codex',
-    'gemini',
-    'vscode',
-    'github-copilot-cli',
-    'kimi',
-    'cursor',
-    'antigravity',
-    'openclaw',
-    'grok',
-    'runner',
-    'unknown',
-]);
-export class ApprovalPolicyConfigError extends Error {
-    reasonCode;
-    constructor(reasonCode, message) {
-        super(message);
-        this.reasonCode = reasonCode;
-        this.name = 'ApprovalPolicyConfigError';
-    }
-}
-function configFilePath(options) {
-    return options.configFilePath ?? join(homedir(), '.neocortex', 'config.json');
-}
-function readConfig(options) {
-    const path = configFilePath(options);
-    if (!existsSync(path))
-        return {};
-    try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-            throw new Error('Config root must be an object');
-        }
-        return parsed;
-    }
-    catch (error) {
-        if (error instanceof ApprovalPolicyConfigError)
-            throw error;
-        throw new ApprovalPolicyConfigError('approval-config-invalid', 'Neocortex config is not valid JSON; approval policy was not changed.');
-    }
-}
-function readStoredPolicy(config) {
-    const value = config[POLICY_KEY];
-    if (value === undefined)
-        return undefined;
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        throw new ApprovalPolicyConfigError('approval-config-invalid', 'Stored subagent approval policy is invalid.');
-    }
-    const policy = value;
-    if (policy.schemaVersion !== SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION) {
-        throw new ApprovalPolicyConfigError('approval-policy-schema-unsupported', 'Stored subagent approval policy schema is not supported.');
-    }
-    if (policy.userOverride !== undefined &&
-        !isSubagentApprovalMode(policy.userOverride)) {
-        throw new ApprovalPolicyConfigError('approval-policy-mode-invalid', 'Stored subagent approval mode is invalid.');
-    }
-    return policy;
-}
-function resolveFromConfig(config, options) {
-    const policy = readStoredPolicy(config);
-    return resolveSubagentApprovalPolicy({
-        userOverride: policy?.userOverride,
-        hostPolicy: options.hostPolicy,
-        platformTarget: options.platformTarget,
-    });
-}
-function appendAudit(config, event) {
-    const existing = Array.isArray(config[AUDIT_KEY])
-        ? config[AUDIT_KEY]
-            .map(normalizeStoredAuditEvent)
-            .filter((entry) => entry !== null)
-        : [];
-    config[AUDIT_KEY] = [...existing, event].slice(-MAX_AUDIT_EVENTS);
-}
-function normalizeStoredAuditEvent(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return null;
-    const entry = value;
-    if (entry.evidence !== SUBAGENT_APPROVAL_EVIDENCE ||
-        entry.schemaVersion !== SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION ||
-        !AUDIT_EVENTS.has(String(entry.event)) ||
-        !isSubagentApprovalMode(entry.requestedMode) ||
-        !isSubagentApprovalMode(entry.effectiveMode) ||
-        !APPROVAL_SOURCES.has(String(entry.source)) ||
-        !PLATFORM_TARGETS.has(String(entry.platformTarget)) ||
-        !APPROVAL_SCOPES.has(String(entry.scope)) ||
-        !EFFECTIVE_REASONS.has(String(entry.effectiveReason)) ||
-        typeof entry.occurredAt !== 'string' ||
-        !Number.isFinite(Date.parse(entry.occurredAt))) {
-        return null;
-    }
-    const derivedFallback = resolveSubagentApprovalPolicy({
-        userOverride: entry.requestedMode,
-        platformTarget: String(entry.platformTarget),
-    });
-    const fallbackMode = FALLBACK_MODES.has(String(entry.fallbackMode))
-        ? entry.fallbackMode
-        : derivedFallback.fallbackMode;
-    const fallbackReasonCode = entry.fallbackReasonCode === null ||
-        typeof entry.fallbackReasonCode === 'string'
-        ? entry.fallbackReasonCode
-        : derivedFallback.fallbackReasonCode;
-    return createSubagentApprovalAuditEvent(entry.event, {
-        schemaVersion: SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION,
-        requestedMode: entry.requestedMode,
-        effectiveMode: entry.effectiveMode,
-        source: entry.source,
-        platformTarget: entry.platformTarget,
-        scope: entry.scope,
-        effectiveReason: entry.effectiveReason,
-        fallbackMode,
-        fallbackReasonCode,
-    }, entry.occurredAt);
-}
-function writeConfig(config, options) {
-    const path = configFilePath(options);
-    const dir = dirname(path);
-    const temporaryPath = `${path}.tmp`;
-    mkdirSync(dir, { recursive: true });
-    setSecureDirPermissions(dir);
-    try {
-        writeFileSync(temporaryPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
-        setSecureFilePermissions(temporaryPath);
-        renameSync(temporaryPath, path);
-        setSecureFilePermissions(path);
-    }
-    catch (error) {
-        try {
-            if (existsSync(temporaryPath))
-                unlinkSync(temporaryPath);
-        }
-        catch {
-            // Best-effort cleanup; preserve the original write failure.
-        }
-        throw error;
-    }
-}
-function occurredAt(options) {
-    return (options.now?.() ?? new Date()).toISOString();
-}
-export function getSubagentApprovalPolicy(options = {}) {
-    return { resolution: resolveFromConfig(readConfig(options), options) };
-}
-export function ensureManagedSubagentApprovalPolicy(options = {}) {
-    const config = readConfig(options);
-    const existing = readStoredPolicy(config);
-    if (existing) {
-        return { resolution: resolveFromConfig(config, options) };
-    }
-    const at = occurredAt(options);
-    config[POLICY_KEY] = {
-        schemaVersion: SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION,
-        managedDefault: SUBAGENT_APPROVAL_MANAGED_DEFAULT,
-        updatedAt: at,
-    };
-    const resolution = resolveFromConfig(config, options);
-    const auditEvent = createSubagentApprovalAuditEvent('managed-default-materialized', resolution, at);
-    appendAudit(config, auditEvent);
-    writeConfig(config, options);
-    return { resolution, auditEvent };
-}
-export function setSubagentApprovalMode(mode, options = {}) {
-    if (!isSubagentApprovalMode(mode)) {
-        throw new ApprovalPolicyConfigError('approval-policy-mode-invalid', 'Requested subagent approval mode is invalid.');
-    }
-    const config = readConfig(options);
-    const existing = readStoredPolicy(config);
-    const at = occurredAt(options);
-    config[POLICY_KEY] = {
-        ...(existing ?? {}),
-        schemaVersion: SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION,
-        managedDefault: SUBAGENT_APPROVAL_MANAGED_DEFAULT,
-        userOverride: mode,
-        updatedAt: at,
-    };
-    const resolution = resolveFromConfig(config, options);
-    const auditEvent = createSubagentApprovalAuditEvent('user-override-updated', resolution, at);
-    appendAudit(config, auditEvent);
-    writeConfig(config, options);
-    return { resolution, auditEvent };
-}
-export function resetSubagentApprovalMode(options = {}) {
-    const config = readConfig(options);
-    readStoredPolicy(config);
-    delete config[POLICY_KEY];
-    const at = occurredAt(options);
-    const resolution = resolveFromConfig(config, options);
-    const auditEvent = createSubagentApprovalAuditEvent('user-override-reset', resolution, at);
-    appendAudit(config, auditEvent);
-    writeConfig(config, options);
-    return { resolution, auditEvent };
-}
+import{existsSync as y,mkdirSync as w,readFileSync as O,renameSync as C,unlinkSync as M,writeFileSync as T}from"node:fs";import{homedir as R}from"node:os";import{dirname as _,join as k}from"node:path";import{SUBAGENT_APPROVAL_MANAGED_DEFAULT as h,SUBAGENT_APPROVAL_EVIDENCE as F,SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION as c,createSubagentApprovalAuditEvent as l,isSubagentApprovalMode as d,resolveSubagentApprovalPolicy as E}from"./policy/subagent-approval-policy.js";import{setSecureDirPermissions as V,setSecureFilePermissions as b}from"./config/secure-config.js";const u="subagentApprovalPolicy",g="subagentApprovalPolicyAudit",x=25,N=new Set(["managed-default-materialized","user-override-updated","user-override-reset"]),D=new Set(["managed-default","user-override"]),L=new Set(["child","session","global","inherited","none"]),I=new Set(["requested-mode-honored","host-policy-reduced","host-capability-unvalidated","host-capability-unsupported","platform-target-unknown"]),U=new Set(["none","root-inline","shell-loop"]),j=new Set(["claude-code","opencode","codex","gemini","vscode","github-copilot-cli","kimi","cursor","antigravity","openclaw","grok","runner","unknown"]);class i extends Error{reasonCode;constructor(e,t){super(t),this.reasonCode=e,this.name="ApprovalPolicyConfigError"}}function P(r){return r.configFilePath??k(R(),".neocortex","config.json")}function p(r){const e=P(r);if(!y(e))return{};try{const t=JSON.parse(O(e,"utf8").replace(/^\uFEFF/,""));if(!t||typeof t!="object"||Array.isArray(t))throw new Error("Config root must be an object");return t}catch(t){throw t instanceof i?t:new i("approval-config-invalid","Neocortex config is not valid JSON; approval policy was not changed.")}}function f(r){const e=r[u];if(e===void 0)return;if(!e||typeof e!="object"||Array.isArray(e))throw new i("approval-config-invalid","Stored subagent approval policy is invalid.");const t=e;if(t.schemaVersion!==c)throw new i("approval-policy-schema-unsupported","Stored subagent approval policy schema is not supported.");if(t.userOverride!==void 0&&!d(t.userOverride))throw new i("approval-policy-mode-invalid","Stored subagent approval mode is invalid.");return t}function s(r,e){const t=f(r);return E({userOverride:t?.userOverride,hostPolicy:e.hostPolicy,platformTarget:e.platformTarget})}function v(r,e){const t=Array.isArray(r[g])?r[g].map(q).filter(n=>n!==null):[];r[g]=[...t,e].slice(-x)}function q(r){if(!r||typeof r!="object"||Array.isArray(r))return null;const e=r;if(e.evidence!==F||e.schemaVersion!==c||!N.has(String(e.event))||!d(e.requestedMode)||!d(e.effectiveMode)||!D.has(String(e.source))||!j.has(String(e.platformTarget))||!L.has(String(e.scope))||!I.has(String(e.effectiveReason))||typeof e.occurredAt!="string"||!Number.isFinite(Date.parse(e.occurredAt)))return null;const t=E({userOverride:e.requestedMode,platformTarget:String(e.platformTarget)}),n=U.has(String(e.fallbackMode))?e.fallbackMode:t.fallbackMode,o=e.fallbackReasonCode===null||typeof e.fallbackReasonCode=="string"?e.fallbackReasonCode:t.fallbackReasonCode;return l(e.event,{schemaVersion:c,requestedMode:e.requestedMode,effectiveMode:e.effectiveMode,source:e.source,platformTarget:e.platformTarget,scope:e.scope,effectiveReason:e.effectiveReason,fallbackMode:n,fallbackReasonCode:o},e.occurredAt)}function A(r,e){const t=P(e),n=_(t),o=`${t}.tmp`;w(n,{recursive:!0}),V(n);try{T(o,`${JSON.stringify(r,null,2)}
+`,"utf8"),b(o),C(o,t),b(t)}catch(a){try{y(o)&&M(o)}catch{}throw a}}function S(r){return(r.now?.()??new Date).toISOString()}function K(r={}){return{resolution:s(p(r),r)}}function $(r={}){const e=p(r);if(f(e))return{resolution:s(e,r)};const n=S(r);e[u]={schemaVersion:c,managedDefault:h,updatedAt:n};const o=s(e,r),a=l("managed-default-materialized",o,n);return v(e,a),A(e,r),{resolution:o,auditEvent:a}}function H(r,e={}){if(!d(r))throw new i("approval-policy-mode-invalid","Requested subagent approval mode is invalid.");const t=p(e),n=f(t),o=S(e);t[u]={...n??{},schemaVersion:c,managedDefault:h,userOverride:r,updatedAt:o};const a=s(t,e),m=l("user-override-updated",a,o);return v(t,m),A(t,e),{resolution:a,auditEvent:m}}function X(r={}){const e=p(r);f(e),delete e[u];const t=S(r),n=s(e,r),o=l("user-override-reset",n,t);return v(e,o),A(e,r),{resolution:n,auditEvent:o}}export{i as ApprovalPolicyConfigError,$ as ensureManagedSubagentApprovalPolicy,K as getSubagentApprovalPolicy,X as resetSubagentApprovalMode,H as setSubagentApprovalMode};

package/packages/client/dist/constants.js

@@ -1,25 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * Production server URL.
- *
- * Single Source of Truth for the default Neocortex IP Protection Server URL.
- * All client-side code MUST import this constant instead of hardcoding the URL.
- *
- * Shell scripts (install.sh, install.ps1) cannot import from TypeScript,
- * so they maintain a hardcoded copy with a comment referencing this file.
- *
- * Epic 70 - Story 70.03
- * Epic P46 - Story P46.01: migrated legacy API host to api.neocortex.sh
- */
-export const DEFAULT_SERVER_URL = 'https://api.neocortex.sh';
+const t="https://api.neocortex.sh";export{t as DEFAULT_SERVER_URL};

package/packages/client/dist/context/context-collector.js

@@ -1,222 +1,2 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - Context Collector
- *
- * Collects pipeline context from state.json, package.json, and story files.
- * Sanitizes all sensitive data before returning the context.
- */
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { sanitizeObject } from './context-sanitizer.js';
-// ── Frontmatter extraction (reused from local-resolver) ──────────────────
-const FRONTMATTER_REGEX = /^---\n([\s\S]*?)\n---/;
-function extractFrontmatter(content) {
-    const match = content.match(FRONTMATTER_REGEX);
-    if (!match)
-        return {};
-    const result = {};
-    for (const line of match[1].split('\n')) {
-        const colonIndex = line.indexOf(':');
-        if (colonIndex === -1)
-            continue;
-        const key = line.slice(0, colonIndex).trim().replace(/^['"]|['"]$/g, '');
-        const value = line.slice(colonIndex + 1).trim().replace(/^['"]|['"]$/g, '');
-        result[key] = value;
-    }
-    return result;
-}
-// ── Acceptance Criteria Extraction ───────────────────────────────────────
-function extractAcceptanceCriteria(content) {
-    const criteria = [];
-    const acPattern = /\*\*AC\d+:?\s*([^*]+)\*\*/g;
-    let match;
-    while ((match = acPattern.exec(content)) !== null) {
-        criteria.push(match[1].trim());
-    }
-    return criteria;
-}
-// ── Framework Detection ──────────────────────────────────────────────────
-const FRAMEWORK_INDICATORS = {
-    react: 'React',
-    next: 'Next.js',
-    vue: 'Vue',
-    nuxt: 'Nuxt',
-    angular: 'Angular',
-    svelte: 'Svelte',
-    express: 'Express',
-    fastify: 'Fastify',
-    nest: 'NestJS',
-    koa: 'Koa',
-    hapi: 'Hapi',
-};
-function detectFrameworks(deps) {
-    const frameworks = [];
-    for (const [dep, name] of Object.entries(FRAMEWORK_INDICATORS)) {
-        if (dep in deps) {
-            frameworks.push(name);
-        }
-    }
-    return frameworks;
-}
-// ── Language Detection ───────────────────────────────────────────────────
-function detectLanguages(deps) {
-    const languages = new Set();
-    languages.add('JavaScript'); // Always present in Node.js projects
-    if ('typescript' in deps || Object.keys(deps).some((d) => d.includes('ts-'))) {
-        languages.add('TypeScript');
-    }
-    return [...languages];
-}
-/**
- * Collect complete pipeline context.
- *
- * Reads state.json, package.json, and story file to build
- * a sanitized PipelineContext for the remote server.
- */
-export async function collectContext(options) {
-    const { projectRoot, storyFilePath, storyId, stepId, platformTarget } = options;
-    // Collect state context
-    const stateContext = await collectStateContext(projectRoot, storyId);
-    // Collect codebase metadata
-    const codebaseMetadata = await collectCodebaseMetadata(projectRoot);
-    // Collect story metadata
-    const storyMetadata = await collectStoryMetadata(storyFilePath);
-    // Build context
-    const context = {
-        storyId,
-        stepId,
-        epicId: storyMetadata.epicId || stateContext.epicId || '',
-        storyTitle: storyMetadata.title,
-        currentStatus: stateContext.status,
-        stepsCompleted: stateContext.stepsCompleted,
-        branchName: stateContext.branchName,
-        platformTarget: platformTarget || detectPlatform(),
-        codebaseMetadata,
-        storyMetadata,
-    };
-    // Sanitize before returning
-    return sanitizeObject(context, projectRoot);
-}
-/**
- * Collect state context from state.json.
- */
-async function collectStateContext(projectRoot, storyId) {
-    try {
-        const statePath = join(projectRoot, '.neocortex', 'state.json');
-        const raw = await readFile(statePath, 'utf-8');
-        const state = JSON.parse(raw);
-        const story = state.stories?.[storyId];
-        return {
-            status: story?.status || 'unknown',
-            stepsCompleted: story?.steps_completed || [],
-            branchName: story?.branch_name || '',
-            epicId: story?.epic_id || '',
-        };
-    }
-    catch {
-        return {
-            status: 'unknown',
-            stepsCompleted: [],
-            branchName: '',
-            epicId: '',
-        };
-    }
-}
-/**
- * Collect codebase metadata from package.json.
- */
-async function collectCodebaseMetadata(projectRoot) {
-    try {
-        const pkgPath = join(projectRoot, 'package.json');
-        const raw = await readFile(pkgPath, 'utf-8');
-        const pkg = JSON.parse(raw);
-        const allDeps = {
-            ...(pkg.dependencies || {}),
-            ...(pkg.devDependencies || {}),
-        };
-        return {
-            projectName: pkg.name || 'unknown',
-            languages: detectLanguages(allDeps),
-            frameworks: detectFrameworks(allDeps),
-            dependencies: pkg.dependencies || {},
-            nodeVersion: process.version,
-        };
-    }
-    catch {
-        return {
-            projectName: 'unknown',
-            languages: ['JavaScript'],
-            frameworks: [],
-            dependencies: {},
-            nodeVersion: process.version,
-        };
-    }
-}
-/**
- * Collect story metadata from the story file.
- */
-async function collectStoryMetadata(storyFilePath) {
-    try {
-        const raw = await readFile(storyFilePath, 'utf-8');
-        const fm = extractFrontmatter(raw);
-        const acs = extractAcceptanceCriteria(raw);
-        // Parse dependencies array from frontmatter
-        let deps = [];
-        const depsStr = fm['dependencies'];
-        if (depsStr) {
-            try {
-                deps = JSON.parse(depsStr.replace(/'/g, '"'));
-            }
-            catch {
-                deps = depsStr.split(',').map((d) => d.trim().replace(/[[\]"']/g, ''));
-            }
-        }
-        return {
-            id: fm['id'] || '',
-            epicId: fm['epic_id'] || '',
-            title: fm['title'] || '',
-            status: fm['status'] || fm['currentStatus'] || '',
-            dependencies: deps,
-            acceptanceCriteria: acs,
-        };
-    }
-    catch {
-        return {
-            id: '',
-            epicId: '',
-            title: '',
-            status: '',
-            dependencies: [],
-            acceptanceCriteria: [],
-        };
-    }
-}
-/**
- * Detect the platform target from environment.
- */
-function detectPlatform() {
-    if (process.env['CLAUDE_CODE'] || process.env['CLAUDE_AGENT']) {
-        return 'claude-code';
-    }
-    if (process.env['CURSOR_SESSION_ID']) {
-        return 'cursor';
-    }
-    if (process.env['VSCODE_PID']) {
-        return 'vscode';
-    }
-    if (process.env['GEMINI_CLI']) {
-        return 'gemini';
-    }
-    return 'unknown';
-}
+import{readFile as i}from"node:fs/promises";import{join as p}from"node:path";import{sanitizeObject as l}from"./context-sanitizer.js";const f=/^---\n([\s\S]*?)\n---/;function m(s){const e=s.match(f);if(!e)return{};const t={};for(const n of e[1].split(`
+`)){const c=n.indexOf(":");if(c===-1)continue;const a=n.slice(0,c).trim().replace(/^['"]|['"]$/g,""),r=n.slice(c+1).trim().replace(/^['"]|['"]$/g,"");t[a]=r}return t}function g(s){const e=[],t=/\*\*AC\d+:?\s*([^*]+)\*\*/g;let n;for(;(n=t.exec(s))!==null;)e.push(n[1].trim());return e}const S={react:"React",next:"Next.js",vue:"Vue",nuxt:"Nuxt",angular:"Angular",svelte:"Svelte",express:"Express",fastify:"Fastify",nest:"NestJS",koa:"Koa",hapi:"Hapi"};function w(s){const e=[];for(const[t,n]of Object.entries(S))t in s&&e.push(n);return e}function y(s){const e=new Set;return e.add("JavaScript"),("typescript"in s||Object.keys(s).some(t=>t.includes("ts-")))&&e.add("TypeScript"),[...e]}async function O(s){const{projectRoot:e,storyFilePath:t,storyId:n,stepId:c,platformTarget:a}=s,r=await h(e,n),u=await C(e),o=await I(t),d={storyId:n,stepId:c,epicId:o.epicId||r.epicId||"",storyTitle:o.title,currentStatus:r.status,stepsCompleted:r.stepsCompleted,branchName:r.branchName,platformTarget:a||x(),codebaseMetadata:u,storyMetadata:o};return l(d,e)}async function h(s,e){try{const t=p(s,".neocortex","state.json"),n=await i(t,"utf-8"),a=JSON.parse(n).stories?.[e];return{status:a?.status||"unknown",stepsCompleted:a?.steps_completed||[],branchName:a?.branch_name||"",epicId:a?.epic_id||""}}catch{return{status:"unknown",stepsCompleted:[],branchName:"",epicId:""}}}async function C(s){try{const e=p(s,"package.json"),t=await i(e,"utf-8"),n=JSON.parse(t),c={...n.dependencies||{},...n.devDependencies||{}};return{projectName:n.name||"unknown",languages:y(c),frameworks:w(c),dependencies:n.dependencies||{},nodeVersion:process.version}}catch{return{projectName:"unknown",languages:["JavaScript"],frameworks:[],dependencies:{},nodeVersion:process.version}}}async function I(s){try{const e=await i(s,"utf-8"),t=m(e),n=g(e);let c=[];const a=t.dependencies;if(a)try{c=JSON.parse(a.replace(/'/g,'"'))}catch{c=a.split(",").map(r=>r.trim().replace(/[[\]"']/g,""))}return{id:t.id||"",epicId:t.epic_id||"",title:t.title||"",status:t.status||t.currentStatus||"",dependencies:c,acceptanceCriteria:n}}catch{return{id:"",epicId:"",title:"",status:"",dependencies:[],acceptanceCriteria:[]}}}function x(){return process.env.CLAUDE_CODE||process.env.CLAUDE_AGENT?"claude-code":process.env.CURSOR_SESSION_ID?"cursor":process.env.VSCODE_PID?"vscode":process.env.GEMINI_CLI?"gemini":"unknown"}export{O as collectContext};

package/packages/client/dist/context/context-sanitizer.js

@@ -1,145 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - Context Sanitizer
- *
- * Removes sensitive data from pipeline context before sending
- * to the remote server. Strips absolute paths, tokens, credentials,
- * and other sensitive information.
- */
-import { homedir } from 'node:os';
-// ── Sensitive Patterns ───────────────────────────────────────────────────
-/** Environment variable name patterns that indicate sensitive values */
-const SENSITIVE_ENV_PATTERNS = [
-    /token/i,
-    /key/i,
-    /secret/i,
-    /password/i,
-    /credential/i,
-    /auth/i,
-    /github_pat_/i,
-    /npm_token/i,
-    /api_key/i,
-];
-/** Regex patterns for sensitive values in strings */
-const SENSITIVE_VALUE_PATTERNS = [
-    /github_pat_[A-Za-z0-9_]{36,}/g,
-    /ghp_[A-Za-z0-9]{36,}/g,
-    /gho_[A-Za-z0-9]{36,}/g,
-    /sk-[A-Za-z0-9]{32,}/g,
-    /Bearer\s+[A-Za-z0-9._\-]+/g,
-    /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END/g,
-];
-/** Maximum allowed string length before truncation */
-const MAX_VALUE_LENGTH = 1000;
-// ── Sanitization Functions ───────────────────────────────────────────────
-/**
- * Replace absolute paths with relative ones.
- *
- * Converts paths like /Users/john/projects/neocortex/src/file.ts
- * to ./src/file.ts based on the project root.
- */
-function sanitizePaths(value, projectRoot) {
-    let result = value;
-    // Replace project root path with ./
-    if (projectRoot) {
-        const escapedRoot = projectRoot.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-        result = result.replace(new RegExp(escapedRoot, 'g'), '.');
-    }
-    // Replace home directory with ~
-    const home = homedir();
-    if (home) {
-        const escapedHome = home.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-        result = result.replace(new RegExp(escapedHome, 'g'), '~');
-    }
-    return result;
-}
-/**
- * Remove sensitive tokens and credentials from a string.
- */
-function sanitizeTokens(value) {
-    let result = value;
-    for (const pattern of SENSITIVE_VALUE_PATTERNS) {
-        result = result.replace(pattern, '[REDACTED]');
-    }
-    return result;
-}
-/**
- * Truncate a string value if it exceeds the maximum length.
- */
-function truncateValue(value) {
-    if (value.length <= MAX_VALUE_LENGTH) {
-        return value;
-    }
-    return `${value.slice(0, MAX_VALUE_LENGTH)}...[truncated, ${value.length} chars total]`;
-}
-/**
- * Check if an environment variable name indicates a sensitive value.
- */
-function isSensitiveKey(key) {
-    return SENSITIVE_ENV_PATTERNS.some((pattern) => pattern.test(key));
-}
-// ── Public API ───────────────────────────────────────────────────────────
-/**
- * Sanitize a single string value.
- *
- * Applies path sanitization, token removal, and truncation.
- */
-export function sanitizeValue(value, projectRoot) {
-    let result = sanitizePaths(value, projectRoot);
-    result = sanitizeTokens(result);
-    result = truncateValue(result);
-    return result;
-}
-/**
- * Sanitize a record of key-value pairs.
- *
- * Removes entries with sensitive keys and sanitizes remaining values.
- */
-export function sanitizeRecord(record, projectRoot) {
-    const sanitized = {};
-    for (const [key, value] of Object.entries(record)) {
-        if (isSensitiveKey(key)) {
-            continue; // Drop sensitive keys entirely
-        }
-        sanitized[key] = sanitizeValue(value, projectRoot);
-    }
-    return sanitized;
-}
-/**
- * Deep sanitize an object, processing all string values recursively.
- */
-export function sanitizeObject(obj, projectRoot) {
-    if (obj === null || obj === undefined) {
-        return obj;
-    }
-    if (typeof obj === 'string') {
-        return sanitizeValue(obj, projectRoot);
-    }
-    if (Array.isArray(obj)) {
-        return obj.map((item) => sanitizeObject(item, projectRoot));
-    }
-    if (typeof obj === 'object') {
-        const result = {};
-        for (const [key, value] of Object.entries(obj)) {
-            if (isSensitiveKey(key) && typeof value === 'string') {
-                result[key] = '[REDACTED]';
-            }
-            else {
-                result[key] = sanitizeObject(value, projectRoot);
-            }
-        }
-        return result;
-    }
-    return obj;
-}
+import{homedir as o}from"node:os";const f=[/token/i,/key/i,/secret/i,/password/i,/credential/i,/auth/i,/github_pat_/i,/npm_token/i,/api_key/i],l=[/github_pat_[A-Za-z0-9_]{36,}/g,/ghp_[A-Za-z0-9]{36,}/g,/gho_[A-Za-z0-9]{36,}/g,/sk-[A-Za-z0-9]{32,}/g,/Bearer\s+[A-Za-z0-9._\-]+/g,/-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END/g],s=1e3;function p(e,n){let t=e;if(n){const i=n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");t=t.replace(new RegExp(i,"g"),".")}const r=o();if(r){const i=r.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");t=t.replace(new RegExp(i,"g"),"~")}return t}function g(e){let n=e;for(const t of l)n=n.replace(t,"[REDACTED]");return n}function E(e){return e.length<=s?e:`${e.slice(0,s)}...[truncated, ${e.length} chars total]`}function a(e){return f.some(n=>n.test(e))}function c(e,n){let t=p(e,n);return t=g(t),t=E(t),t}function _(e,n){const t={};for(const[r,i]of Object.entries(e))a(r)||(t[r]=c(i,n));return t}function u(e,n){if(e==null)return e;if(typeof e=="string")return c(e,n);if(Array.isArray(e))return e.map(t=>u(t,n));if(typeof e=="object"){const t={};for(const[r,i]of Object.entries(e))a(r)&&typeof i=="string"?t[r]="[REDACTED]":t[r]=u(i,n);return t}return e}export{u as sanitizeObject,_ as sanitizeRecord,c as sanitizeValue};