@ornexus/neocortex 4.60.73 → 4.60.75

package/packages/client/dist/commands/refresh-memory.js

@@ -1,156 +1,3 @@
-import { createHash } from 'node:crypto';
-import { lstatSync, readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { getProjectMemoryTarget, isProjectMemoryTargetId, listProjectMemoryTargets } from '../memory/shared-project-memory-types.js';
-import { writeProjectMemoryTargetFiles } from '../memory/project-memory-writer.js';
-function parseCsv(value) {
-    return (value ?? '').split(',').map((entry) => entry.trim()).filter(Boolean);
-}
-export function parseRefreshMemoryArgs(args) {
-    let projectRoot = process.cwd();
-    let dryRun = false;
-    let verify = false;
-    const requestedTargets = [];
-    const memoryNotes = [];
-    for (let index = 0; index < args.length; index++) {
-        const arg = args[index];
-        if (arg === '--dry-run' || arg === '--preview') {
-            dryRun = true;
-        }
-        else if (arg === '--verify') {
-            verify = true;
-            dryRun = true;
-        }
-        else if (arg === '--project-root') {
-            projectRoot = args[++index] ?? projectRoot;
-        }
-        else if (arg.startsWith('--project-root=')) {
-            projectRoot = arg.slice('--project-root='.length);
-        }
-        else if (arg === '--target' || arg === '--targets') {
-            requestedTargets.push(...parseCsv(args[++index]));
-        }
-        else if (arg.startsWith('--target=')) {
-            requestedTargets.push(...parseCsv(arg.slice('--target='.length)));
-        }
-        else if (arg.startsWith('--targets=')) {
-            requestedTargets.push(...parseCsv(arg.slice('--targets='.length)));
-        }
-        else if (arg === '--note' || arg === '--memory-note' || arg === '--change') {
-            const note = args[++index];
-            if (note)
-                memoryNotes.push(note);
-        }
-        else if (arg.startsWith('--note=')) {
-            memoryNotes.push(arg.slice('--note='.length));
-        }
-        else if (arg.startsWith('--memory-note=')) {
-            memoryNotes.push(arg.slice('--memory-note='.length));
-        }
-        else if (arg.startsWith('--change=')) {
-            memoryNotes.push(arg.slice('--change='.length));
-        }
-    }
-    if (verify && (requestedTargets.length > 0 || memoryNotes.length > 0)) {
-        throw new Error('Project memory verification requires all targets and no update notes.');
-    }
-    const targetIds = requestedTargets.length > 0
-        ? requestedTargets.map((target) => {
-            if (!isProjectMemoryTargetId(target))
-                throw new Error(`Unknown project-memory target: ${target}`);
-            return target;
-        })
-        : ['canonical', ...listProjectMemoryTargets().map((target) => target.targetId)];
-    return { projectRoot: resolve(projectRoot), targetIds: Array.from(new Set(targetIds)), dryRun, verify, memoryNotes };
-}
-export function refreshProjectMemoryTargets(options) {
-    return options.targetIds.map((targetId) => writeProjectMemoryTargetFiles({
-        projectRoot: options.projectRoot,
-        targetId,
-        dryRun: options.dryRun,
-        memoryNotes: options.memoryNotes ?? [],
-        backupDirectory: options.backupDirectory,
-    }));
-}
-/** Root-only, read-only physical check; this is not independent stage QA or server authority. */
-export function verifyProjectMemoryTargets(options) {
-    if (!options.verify || !options.dryRun || options.memoryNotes?.length
-        || options.targetIds.join(',') !== ['canonical', ...listProjectMemoryTargets().map((target) => target.targetId)].join(',')) {
-        throw new Error('Project memory verification requires the complete read-only target set.');
-    }
-    const canonicalPath = join(options.projectRoot, 'NEOCORTEX.md');
-    let entry;
-    try {
-        entry = lstatSync(canonicalPath);
-    }
-    catch {
-        throw new Error('Canonical project memory is missing or unsafe.');
-    }
-    if (!entry.isFile() || entry.isSymbolicLink())
-        throw new Error('Canonical project memory must be a regular file.');
-    const canonical = readFileSync(canonicalPath, 'utf8');
-    const start = '<!-- NEOCORTEX-MEMORY-START -->';
-    const end = '<!-- NEOCORTEX-MEMORY-END -->';
-    const budget = getProjectMemoryTarget('canonical').budget;
-    if (canonical.split(start).length !== 2 || canonical.split(end).length !== 2
-        || canonical.indexOf(start) >= canonical.indexOf(end)
-        || Buffer.byteLength(canonical, 'utf8') > budget.maxBytes
-        || canonical.split('\n').length > budget.maxLines) {
-        throw new Error('Canonical project memory markers or budget are invalid.');
-    }
-    const files = refreshProjectMemoryTargets(options).flatMap((result) => result.files);
-    if (files.some((file) => file.changed || file.mode === 'compatibility-materialized-fallback'
-        || file.fallbackReason || file.remediationDebt)) {
-        throw new Error('Project memory verification found stale or fallback targets.');
-    }
-    let projection;
-    try {
-        projection = [...new Set(files.map((file) => file.relativeFile))].sort()
-            .map((relativeFile) => {
-            const bytes = readFileSync(join(options.projectRoot, relativeFile));
-            const mode = files.find((file) => file.relativeFile === relativeFile).mode;
-            return `${relativeFile}:${mode}:${createHash('sha256').update(bytes).digest('hex')}`;
-        });
-        if (readFileSync(canonicalPath, 'utf8') !== canonical
-            || refreshProjectMemoryTargets(options).some((result) => result.changed)) {
-            throw new Error('project-memory-verification-race');
-        }
-    }
-    catch {
-        throw new Error('Project memory changed during verification.');
-    }
-    return {
-        schemaVersion: 'ProjectMemoryVerification/1',
-        canonicalSha256: createHash('sha256').update(canonical).digest('hex'),
-        projectionSha256: createHash('sha256').update(projection.join('\n')).digest('hex'),
-        fileCount: projection.length,
-        publicSafe: true,
-    };
-}
-export async function refreshMemoryCliHandler(args) {
-    try {
-        const options = parseRefreshMemoryArgs(args);
-        if (options.verify) {
-            const verification = verifyProjectMemoryTargets(options);
-            console.log(`Project memory verified: files=${verification.fileCount} canonical_sha256=${verification.canonicalSha256} projection_sha256=${verification.projectionSha256}`);
-            return 0;
-        }
-        const results = refreshProjectMemoryTargets(options);
-        const rows = results.flatMap((result) => result.files.map((file) => [
-            file.changed ? (options.dryRun ? 'would-change' : 'changed') : 'unchanged',
-            file.mode,
-            file.relativeFile,
-            file.fallbackReason ? `warning=${file.fallbackReason}` : undefined,
-            file.remediationDebt ? `debt=${file.remediationDebt}` : undefined,
-            file.reasonCodes && file.reasonCodes.length > 0 ? `reasons=${file.reasonCodes.join(',')}` : undefined,
-        ].filter(Boolean).join('  ')));
-        console.log(`${options.dryRun ? 'Project memory preview' : 'Project memory refreshed'}: ${options.projectRoot}`);
-        for (const row of rows)
-            console.log(row);
-        return 0;
-    }
-    catch (error) {
-        console.error(error instanceof Error ? error.message : String(error));
-        return 1;
-    }
-}
+import{createHash as m}from"node:crypto";import{lstatSync as w,readFileSync as f}from"node:fs";import{join as u,resolve as R}from"node:path";import{getProjectMemoryTarget as b,isProjectMemoryTargetId as E,listProjectMemoryTargets as g}from"../memory/shared-project-memory-types.js";import{writeProjectMemoryTargetFiles as v}from"../memory/project-memory-writer.js";function h(r){return(r??"").split(",").map(t=>t.trim()).filter(Boolean)}function M(r){let t=process.cwd(),c=!1,i=!1;const a=[],o=[];for(let s=0;s<r.length;s++){const e=r[s];if(e==="--dry-run"||e==="--preview")c=!0;else if(e==="--verify")i=!0,c=!0;else if(e==="--project-root")t=r[++s]??t;else if(e.startsWith("--project-root="))t=e.slice(15);else if(e==="--target"||e==="--targets")a.push(...h(r[++s]));else if(e.startsWith("--target="))a.push(...h(e.slice(9)));else if(e.startsWith("--targets="))a.push(...h(e.slice(10)));else if(e==="--note"||e==="--memory-note"||e==="--change"){const n=r[++s];n&&o.push(n)}else e.startsWith("--note=")?o.push(e.slice(7)):e.startsWith("--memory-note=")?o.push(e.slice(14)):e.startsWith("--change=")&&o.push(e.slice(9))}if(i&&(a.length>0||o.length>0))throw new Error("Project memory verification requires all targets and no update notes.");const l=a.length>0?a.map(s=>{if(!E(s))throw new Error(`Unknown project-memory target: ${s}`);return s}):["canonical",...g().map(s=>s.targetId)];return{projectRoot:R(t),targetIds:Array.from(new Set(l)),dryRun:c,verify:i,memoryNotes:o}}function d(r){return r.targetIds.map(t=>v({projectRoot:r.projectRoot,targetId:t,dryRun:r.dryRun,memoryNotes:r.memoryNotes??[],backupDirectory:r.backupDirectory}))}function P(r){if(!r.verify||!r.dryRun||r.memoryNotes?.length||r.targetIds.join(",")!==["canonical",...g().map(n=>n.targetId)].join(","))throw new Error("Project memory verification requires the complete read-only target set.");const t=u(r.projectRoot,"NEOCORTEX.md");let c;try{c=w(t)}catch{throw new Error("Canonical project memory is missing or unsafe.")}if(!c.isFile()||c.isSymbolicLink())throw new Error("Canonical project memory must be a regular file.");const i=f(t,"utf8"),a="<!-- NEOCORTEX-MEMORY-START -->",o="<!-- NEOCORTEX-MEMORY-END -->",l=b("canonical").budget;if(i.split(a).length!==2||i.split(o).length!==2||i.indexOf(a)>=i.indexOf(o)||Buffer.byteLength(i,"utf8")>l.maxBytes||i.split(`
+`).length>l.maxLines)throw new Error("Canonical project memory markers or budget are invalid.");const s=d(r).flatMap(n=>n.files);if(s.some(n=>n.changed||n.mode==="compatibility-materialized-fallback"||n.fallbackReason||n.remediationDebt))throw new Error("Project memory verification found stale or fallback targets.");let e;try{if(e=[...new Set(s.map(n=>n.relativeFile))].sort().map(n=>{const y=f(u(r.projectRoot,n)),p=s.find(j=>j.relativeFile===n).mode;return`${n}:${p}:${m("sha256").update(y).digest("hex")}`}),f(t,"utf8")!==i||d(r).some(n=>n.changed))throw new Error("project-memory-verification-race")}catch{throw new Error("Project memory changed during verification.")}return{schemaVersion:"ProjectMemoryVerification/1",canonicalSha256:m("sha256").update(i).digest("hex"),projectionSha256:m("sha256").update(e.join(`
+`)).digest("hex"),fileCount:e.length,publicSafe:!0}}async function k(r){try{const t=M(r);if(t.verify){const a=P(t);return console.log(`Project memory verified: files=${a.fileCount} canonical_sha256=${a.canonicalSha256} projection_sha256=${a.projectionSha256}`),0}const i=d(t).flatMap(a=>a.files.map(o=>[o.changed?t.dryRun?"would-change":"changed":"unchanged",o.mode,o.relativeFile,o.fallbackReason?`warning=${o.fallbackReason}`:void 0,o.remediationDebt?`debt=${o.remediationDebt}`:void 0,o.reasonCodes&&o.reasonCodes.length>0?`reasons=${o.reasonCodes.join(",")}`:void 0].filter(Boolean).join("  ")));console.log(`${t.dryRun?"Project memory preview":"Project memory refreshed"}: ${t.projectRoot}`);for(const a of i)console.log(a);return 0}catch(t){return console.error(t instanceof Error?t.message:String(t)),1}}export{M as parseRefreshMemoryArgs,k as refreshMemoryCliHandler,d as refreshProjectMemoryTargets,P as verifyProjectMemoryTargets};

package/packages/client/dist/commands/shared-architecture-non-ui.js

@@ -1,24 +1 @@
-export const ARCHITECTURE_PUBLIC_COMMANDS = Object.freeze([
-    'arch-prd', 'arch-architecture', 'arch-fitness-functions', 'arch-api-contracts', 'generate-pacts',
-    'arch-api-integrations', 'arch-database', 'arch-security', 'arch-design-system', 'arch-ux-design',
-    'arch-performance', 'arch-testing', 'arch-infrastructure', 'arch-review', 'update-memory',
-]);
-export const ARCHITECTURE_NON_UI_COMMANDS = Object.freeze(ARCHITECTURE_PUBLIC_COMMANDS
-    .filter(command => command !== 'arch-design-system' && command !== 'arch-ux-design'));
-const EXCLUDED = Object.freeze(['arch-design-system', 'arch-ux-design']);
-export function parseArchitectureNonUiScopeReceipt(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return undefined;
-    const receipt = value;
-    if (Object.keys(receipt).sort().join(',') !== ['schemaVersion', 'kind', 'licenseHash', 'projectHash', 'targetEpicId',
-        'graphRevision', 'rootInputSha256', 'accountingId', 'applicability', 'excludedStageCommands', 'macSha256', 'publicSafe'].sort().join(',')
-        || receipt.schemaVersion !== 1 || receipt.kind !== 'ArchitectureNonUiScope/1' || receipt.publicSafe !== true
-        || receipt.applicability !== 'non-ui' || typeof receipt.targetEpicId !== 'string'
-        || !/^P[1-9][0-9]{0,11}$/.test(receipt.targetEpicId) || typeof receipt.accountingId !== 'string'
-        || !/^arch-accounting-[a-f0-9]{32}$/.test(receipt.accountingId)
-        || !['licenseHash', 'projectHash', 'graphRevision', 'rootInputSha256', 'macSha256'].every(key => typeof receipt[key] === 'string' && /^[a-f0-9]{64}$/.test(receipt[key]))
-        || !Array.isArray(receipt.excludedStageCommands) || receipt.excludedStageCommands.length !== EXCLUDED.length
-        || !receipt.excludedStageCommands.every((command, index) => command === EXCLUDED[index]))
-        return undefined;
-    return Object.freeze({ ...receipt, excludedStageCommands: EXCLUDED });
-}
+const i=Object.freeze(["arch-prd","arch-architecture","arch-fitness-functions","arch-api-contracts","generate-pacts","arch-api-integrations","arch-database","arch-security","arch-design-system","arch-ux-design","arch-performance","arch-testing","arch-infrastructure","arch-review","update-memory"]),n=Object.freeze(i.filter(t=>t!=="arch-design-system"&&t!=="arch-ux-design")),c=Object.freeze(["arch-design-system","arch-ux-design"]);function s(t){if(!t||typeof t!="object"||Array.isArray(t))return;const e=t;if(!(Object.keys(e).sort().join(",")!==["schemaVersion","kind","licenseHash","projectHash","targetEpicId","graphRevision","rootInputSha256","accountingId","applicability","excludedStageCommands","macSha256","publicSafe"].sort().join(",")||e.schemaVersion!==1||e.kind!=="ArchitectureNonUiScope/1"||e.publicSafe!==!0||e.applicability!=="non-ui"||typeof e.targetEpicId!="string"||!/^P[1-9][0-9]{0,11}$/.test(e.targetEpicId)||typeof e.accountingId!="string"||!/^arch-accounting-[a-f0-9]{32}$/.test(e.accountingId)||!["licenseHash","projectHash","graphRevision","rootInputSha256","macSha256"].every(r=>typeof e[r]=="string"&&/^[a-f0-9]{64}$/.test(e[r]))||!Array.isArray(e.excludedStageCommands)||e.excludedStageCommands.length!==c.length||!e.excludedStageCommands.every((r,a)=>r===c[a])))return Object.freeze({...e,excludedStageCommands:c})}export{n as ARCHITECTURE_NON_UI_COMMANDS,i as ARCHITECTURE_PUBLIC_COMMANDS,s as parseArchitectureNonUiScopeReceipt};

package/packages/client/dist/commands/story-checkpoint.js

@@ -1,171 +1 @@
-import { readFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import { acceptDirectYoloSetupCheckpoint, beginDirectYoloStoryCommit, finalizeDirectYoloStoryCheckpoint, issueDirectYoloSetupLeaseHandoff, prepareDirectYoloSetup, recoverLegacyDirectYoloStoryCheckpoint, } from '../git/direct-yolo-checkpoint.js';
-import { applyDirectYoloC01Retry, inspectDirectYoloC01Retry } from '../git/direct-yolo-c01-retry.js';
-export function parseStoryCheckpointArgs(args) {
-    const action = args[0];
-    if (action !== 'setup' && action !== 'accept-setup' && action !== 'handoff' && action !== 'begin' && action !== 'finalize' && action !== 'recover' && action !== 'retry-c01') {
-        throw new Error('story-checkpoint-action-invalid');
-    }
-    let storyId = '';
-    let projectRoot = process.cwd();
-    let commitSha;
-    let remote = 'origin';
-    let push = false;
-    let format = 'plain';
-    let setupHandoffSessionId;
-    let setupHandoffTokenFile;
-    let expectedHeadSha;
-    let apply = false;
-    for (let index = 1; index < args.length; index++) {
-        const arg = args[index];
-        const next = () => args[++index] ?? '';
-        if (arg === '--story')
-            storyId = next();
-        else if (arg.startsWith('--story='))
-            storyId = arg.slice('--story='.length);
-        else if (arg === '--project-root')
-            projectRoot = next() || projectRoot;
-        else if (arg.startsWith('--project-root='))
-            projectRoot = arg.slice('--project-root='.length);
-        else if (arg === '--commit')
-            commitSha = next();
-        else if (arg.startsWith('--commit='))
-            commitSha = arg.slice('--commit='.length);
-        else if (arg === '--remote')
-            remote = next();
-        else if (arg.startsWith('--remote='))
-            remote = arg.slice('--remote='.length);
-        else if (arg === '--push' || arg === '--require-remote')
-            push = true;
-        else if (arg === '--setup-handoff-session')
-            setupHandoffSessionId = next();
-        else if (arg.startsWith('--setup-handoff-session='))
-            setupHandoffSessionId = arg.slice('--setup-handoff-session='.length);
-        else if (arg === '--setup-handoff-token-file')
-            setupHandoffTokenFile = next();
-        else if (arg.startsWith('--setup-handoff-token-file='))
-            setupHandoffTokenFile = arg.slice('--setup-handoff-token-file='.length);
-        else if (arg === '--expected-head')
-            expectedHeadSha = next();
-        else if (arg.startsWith('--expected-head='))
-            expectedHeadSha = arg.slice('--expected-head='.length);
-        else if (arg === '--apply')
-            apply = true;
-        else if (arg === '--format') {
-            const value = next();
-            if (value !== 'json' && value !== 'plain')
-                throw new Error('story-checkpoint-format-invalid');
-            format = value;
-        }
-        else if (arg.startsWith('--format=')) {
-            const value = arg.slice('--format='.length);
-            if (value !== 'json' && value !== 'plain')
-                throw new Error('story-checkpoint-format-invalid');
-            format = value;
-        }
-        else {
-            throw new Error('story-checkpoint-argument-invalid');
-        }
-    }
-    if (!storyId)
-        throw new Error('story-checkpoint-story-required');
-    if (action === 'recover' && !commitSha)
-        throw new Error('story-checkpoint-commit-required');
-    if (action === 'recover' && !push)
-        throw new Error('story-checkpoint-remote-proof-required');
-    if (action === 'finalize' && !push)
-        throw new Error('story-checkpoint-push-required');
-    if (action === 'begin' && (commitSha || push || remote !== 'origin'))
-        throw new Error('story-checkpoint-option-invalid');
-    if ((action === 'setup' || action === 'accept-setup' || action === 'handoff') && (commitSha || push || remote !== 'origin')) {
-        throw new Error('story-checkpoint-option-invalid');
-    }
-    if (action === 'finalize' && commitSha)
-        throw new Error('story-checkpoint-option-invalid');
-    if ((setupHandoffSessionId === undefined) !== (setupHandoffTokenFile === undefined)) {
-        throw new Error('story-checkpoint-setup-handoff-incomplete');
-    }
-    if (action !== 'begin' && (setupHandoffSessionId || setupHandoffTokenFile)) {
-        throw new Error('story-checkpoint-option-invalid');
-    }
-    if (action !== 'retry-c01' && (expectedHeadSha || apply))
-        throw new Error('story-checkpoint-option-invalid');
-    if (action === 'retry-c01' && (commitSha || push || remote !== 'origin'
-        || apply && !/^[a-f0-9]{40,64}$/.test(expectedHeadSha ?? '')))
-        throw new Error('story-checkpoint-option-invalid');
-    return {
-        action, storyId, projectRoot: resolve(projectRoot), commitSha, remote, push, format,
-        ...(expectedHeadSha ? { expectedHeadSha } : {}), ...(apply ? { apply } : {}),
-        ...(setupHandoffSessionId ? { setupHandoffSessionId } : {}),
-        ...(setupHandoffTokenFile ? { setupHandoffTokenFile: resolve(setupHandoffTokenFile) } : {}),
-    };
-}
-export async function storyCheckpointCliHandler(args) {
-    let options;
-    try {
-        options = parseStoryCheckpointArgs(args);
-    }
-    catch (error) {
-        console.error(error instanceof Error ? error.message : 'story-checkpoint-arguments-invalid');
-        return 1;
-    }
-    if (options.action === 'retry-c01') {
-        try {
-            const result = options.apply
-                ? await applyDirectYoloC01Retry(options.projectRoot, options.storyId, options.expectedHeadSha)
-                : await inspectDirectYoloC01Retry(options.projectRoot, options.storyId);
-            console.log(options.format === 'json' ? JSON.stringify(result, null, 2)
-                : `story-checkpoint retry-c01: ${options.apply ? 'committed' : 'eligible'}`);
-            return 0;
-        }
-        catch (error) {
-            console.error(error instanceof Error ? error.message : 'direct-yolo-retry-unverified');
-            return 1;
-        }
-    }
-    let setupLeaseHandoff;
-    if (options.setupHandoffSessionId && options.setupHandoffTokenFile) {
-        try {
-            setupLeaseHandoff = {
-                sessionId: options.setupHandoffSessionId,
-                token: (await readFile(options.setupHandoffTokenFile, 'utf8')).trim(),
-            };
-        }
-        catch {
-            console.error('story-checkpoint-setup-handoff-read-failed');
-            return 1;
-        }
-    }
-    const result = options.action === 'setup'
-        ? await prepareDirectYoloSetup(options)
-        : options.action === 'accept-setup'
-            ? await acceptDirectYoloSetupCheckpoint(options)
-            : options.action === 'handoff'
-                ? await issueDirectYoloSetupLeaseHandoff(options)
-                : options.action === 'begin'
-                    ? await beginDirectYoloStoryCommit({ ...options, ...(setupLeaseHandoff ? { setupLeaseHandoff } : {}) })
-                    : options.action === 'finalize'
-                        ? await finalizeDirectYoloStoryCheckpoint(options)
-                        : await recoverLegacyDirectYoloStoryCheckpoint({
-                            ...options,
-                            commitSha: options.commitSha,
-                        });
-    if (options.format === 'json') {
-        console.log(JSON.stringify({ action: options.action, ...result }, null, 2));
-    }
-    else if (result.ok) {
-        console.log(`story-checkpoint ${options.action}: ok`);
-        if (options.action === 'begin' && 'trailers' in result.value) {
-            for (const trailer of result.value.trailers)
-                console.log(trailer);
-        }
-        else if ('headSha' in result.value) {
-            console.log(`head=${result.value.headSha}`);
-        }
-    }
-    else {
-        console.error(`story-checkpoint ${options.action}: ${result.reasonCode}`);
-    }
-    return result.ok ? 0 : 1;
-}
+import{readFile as w}from"node:fs/promises";import{resolve as m}from"node:path";import{acceptDirectYoloSetupCheckpoint as k,beginDirectYoloStoryCommit as g,finalizeDirectYoloStoryCheckpoint as v,issueDirectYoloSetupLeaseHandoff as S,prepareDirectYoloSetup as E,recoverLegacyDirectYoloStoryCheckpoint as H}from"../git/direct-yolo-checkpoint.js";import{applyDirectYoloC01Retry as j,inspectDirectYoloC01Retry as C}from"../git/direct-yolo-c01-retry.js";function x(a){const e=a[0];if(e!=="setup"&&e!=="accept-setup"&&e!=="handoff"&&e!=="begin"&&e!=="finalize"&&e!=="recover"&&e!=="retry-c01")throw new Error("story-checkpoint-action-invalid");let i="",r=process.cwd(),t,l="origin",s=!1,y="plain",f,p,h,d=!1;for(let u=1;u<a.length;u++){const o=a[u],n=()=>a[++u]??"";if(o==="--story")i=n();else if(o.startsWith("--story="))i=o.slice(8);else if(o==="--project-root")r=n()||r;else if(o.startsWith("--project-root="))r=o.slice(15);else if(o==="--commit")t=n();else if(o.startsWith("--commit="))t=o.slice(9);else if(o==="--remote")l=n();else if(o.startsWith("--remote="))l=o.slice(9);else if(o==="--push"||o==="--require-remote")s=!0;else if(o==="--setup-handoff-session")f=n();else if(o.startsWith("--setup-handoff-session="))f=o.slice(24);else if(o==="--setup-handoff-token-file")p=n();else if(o.startsWith("--setup-handoff-token-file="))p=o.slice(27);else if(o==="--expected-head")h=n();else if(o.startsWith("--expected-head="))h=o.slice(16);else if(o==="--apply")d=!0;else if(o==="--format"){const c=n();if(c!=="json"&&c!=="plain")throw new Error("story-checkpoint-format-invalid");y=c}else if(o.startsWith("--format=")){const c=o.slice(9);if(c!=="json"&&c!=="plain")throw new Error("story-checkpoint-format-invalid");y=c}else throw new Error("story-checkpoint-argument-invalid")}if(!i)throw new Error("story-checkpoint-story-required");if(e==="recover"&&!t)throw new Error("story-checkpoint-commit-required");if(e==="recover"&&!s)throw new Error("story-checkpoint-remote-proof-required");if(e==="finalize"&&!s)throw new Error("story-checkpoint-push-required");if(e==="begin"&&(t||s||l!=="origin"))throw new Error("story-checkpoint-option-invalid");if((e==="setup"||e==="accept-setup"||e==="handoff")&&(t||s||l!=="origin"))throw new Error("story-checkpoint-option-invalid");if(e==="finalize"&&t)throw new Error("story-checkpoint-option-invalid");if(f===void 0!=(p===void 0))throw new Error("story-checkpoint-setup-handoff-incomplete");if(e!=="begin"&&(f||p))throw new Error("story-checkpoint-option-invalid");if(e!=="retry-c01"&&(h||d))throw new Error("story-checkpoint-option-invalid");if(e==="retry-c01"&&(t||s||l!=="origin"||d&&!/^[a-f0-9]{40,64}$/.test(h??"")))throw new Error("story-checkpoint-option-invalid");return{action:e,storyId:i,projectRoot:m(r),commitSha:t,remote:l,push:s,format:y,...h?{expectedHeadSha:h}:{},...d?{apply:d}:{},...f?{setupHandoffSessionId:f}:{},...p?{setupHandoffTokenFile:m(p)}:{}}}async function I(a){let e;try{e=x(a)}catch(t){return console.error(t instanceof Error?t.message:"story-checkpoint-arguments-invalid"),1}if(e.action==="retry-c01")try{const t=e.apply?await j(e.projectRoot,e.storyId,e.expectedHeadSha):await C(e.projectRoot,e.storyId);return console.log(e.format==="json"?JSON.stringify(t,null,2):`story-checkpoint retry-c01: ${e.apply?"committed":"eligible"}`),0}catch(t){return console.error(t instanceof Error?t.message:"direct-yolo-retry-unverified"),1}let i;if(e.setupHandoffSessionId&&e.setupHandoffTokenFile)try{i={sessionId:e.setupHandoffSessionId,token:(await w(e.setupHandoffTokenFile,"utf8")).trim()}}catch{return console.error("story-checkpoint-setup-handoff-read-failed"),1}const r=e.action==="setup"?await E(e):e.action==="accept-setup"?await k(e):e.action==="handoff"?await S(e):e.action==="begin"?await g({...e,...i?{setupLeaseHandoff:i}:{}}):e.action==="finalize"?await v(e):await H({...e,commitSha:e.commitSha});if(e.format==="json")console.log(JSON.stringify({action:e.action,...r},null,2));else if(r.ok)if(console.log(`story-checkpoint ${e.action}: ok`),e.action==="begin"&&"trailers"in r.value)for(const t of r.value.trailers)console.log(t);else"headSha"in r.value&&console.log(`head=${r.value.headSha}`);else console.error(`story-checkpoint ${e.action}: ${r.reasonCode}`);return r.ok?0:1}export{x as parseStoryCheckpointArgs,I as storyCheckpointCliHandler};

package/packages/client/dist/config/host-auth-broker.d.ts

@@ -0,0 +1,31 @@
+import { type HostAuthOperation, type HostAuthReferenceV1 } from './host-auth-reference.js';
+export interface HostAuthPublicResult {
+    readonly status: 'available' | 'unavailable' | 'denied';
+    readonly reasonCode: string;
+    readonly generation?: number;
+    readonly expiresAt?: string;
+}
+export interface HostAuthAdapter {
+    readonly provider: 'codex' | 'opencode';
+    readonly target: string;
+    readonly operations: Readonly<Partial<Record<HostAuthOperation, (reference: HostAuthReferenceV1) => Promise<HostAuthPublicResult>>>>;
+}
+export interface HostAuthBrokerRequest {
+    readonly capability: object;
+    readonly reference: unknown;
+    readonly caller: 'host-runtime';
+    readonly expectedSubjectDigest: string;
+    readonly expectedPolicyDigest: string;
+    readonly expectedDispatchDigest: string;
+    readonly requiredScopes: readonly string[];
+    readonly minimumRevocationEpoch: number;
+}
+export interface HostAuthBroker {
+    execute(request: HostAuthBrokerRequest): Promise<HostAuthPublicResult>;
+}
+export interface HostAuthBrokerHandle {
+    readonly broker: HostAuthBroker;
+    /** Process-local authority. Never serialize or pass this object to a child. */
+    readonly capability: object;
+}
+export declare function createHostAuthBroker(adapter?: HostAuthAdapter): HostAuthBrokerHandle;

package/packages/client/dist/config/host-auth-broker.js

@@ -0,0 +1 @@
+import{timingSafeEqual as f}from"node:crypto";import{parseHostAuthReference as c}from"./host-auth-reference.js";function n(r,a){return!/^[a-f0-9]{64}$/.test(r)||!/^[a-f0-9]{64}$/.test(a)?!1:f(Buffer.from(r,"hex"),Buffer.from(a,"hex"))}function p(r){const a=Object.freeze(Object.create(null)),u=new WeakSet([a]);let o=!1;const d=Object.freeze({async execute(t){if(!t.capability||!u.has(t.capability)||t.caller!=="host-runtime")return{status:"denied",reasonCode:"host-auth-origin-denied"};let e;try{e=c(t.reference)}catch(i){return{status:"denied",reasonCode:i instanceof Error?i.message:"host-auth-reference-invalid"}}if(!n(e.subjectDigest,t.expectedSubjectDigest)||!n(e.policyDigest,t.expectedPolicyDigest)||!n(e.dispatchDigest,t.expectedDispatchDigest))return{status:"denied",reasonCode:"host-auth-reference-invalid"};if(e.revocationEpoch<t.minimumRevocationEpoch)return{status:"denied",reasonCode:"host-auth-reference-revoked"};if(!t.requiredScopes.every(i=>e.scopes.includes(i)))return{status:"denied",reasonCode:"host-auth-scope-denied"};if(!r)return{status:"unavailable",reasonCode:"host-auth-capability-unavailable"};if(r.provider!==e.provider||r.target!==e.target)return{status:"denied",reasonCode:"host-auth-target-denied"};const s=r.operations[e.operation];if(!s)return{status:"denied",reasonCode:"host-auth-operation-denied"};if(o)return{status:"unavailable",reasonCode:"host-auth-capability-unavailable"};o=!0;try{return c(e),e.revocationEpoch<t.minimumRevocationEpoch?{status:"denied",reasonCode:"host-auth-reference-revoked"}:await s(e)}finally{o=!1}}});return Object.freeze({broker:d,capability:a})}export{p as createHostAuthBroker};

package/packages/client/dist/config/host-auth-reference.d.ts

@@ -0,0 +1,32 @@
+export declare const HOST_AUTH_REFERENCE_SCHEMA: "HostAuthReference/1.0";
+export declare const HOST_AUTH_REFERENCE_MAX_BYTES = 4096;
+export declare const HOST_AUTH_REFERENCE_MAX_TTL_MS = 60000;
+export type HostAuthProvider = 'codex' | 'opencode';
+export type HostAuthOperation = 'inspect-session' | 'prepare-license-auth' | 'reconcile-license-auth' | 'authorize-business-replay';
+export interface HostAuthReferenceV1 {
+    readonly schemaVersion: typeof HOST_AUTH_REFERENCE_SCHEMA;
+    readonly referenceId: string;
+    readonly provider: HostAuthProvider;
+    readonly authDomain: 'model-provider';
+    readonly target: string;
+    readonly operation: HostAuthOperation;
+    readonly scopes: readonly string[];
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly revocationEpoch: number;
+    readonly subjectDigest: string;
+    readonly policyDigest: string;
+    readonly dispatchDigest: string;
+}
+export declare class HostAuthReferenceError extends Error {
+    readonly reasonCode: string;
+    constructor(reasonCode: string);
+}
+export declare function parseHostAuthReference(input: unknown, options?: {
+    readonly now?: number;
+    readonly allowExpired?: boolean;
+}): HostAuthReferenceV1;
+export declare function createHostAuthReference(input: Omit<HostAuthReferenceV1, 'schemaVersion' | 'referenceId' | 'issuedAt' | 'expiresAt'> & {
+    readonly ttlMs?: number;
+    readonly now?: number;
+}): HostAuthReferenceV1;

package/packages/client/dist/config/host-auth-reference.js

@@ -0,0 +1 @@
+import{randomBytes as l}from"node:crypto";const p="HostAuthReference/1.0",u=4096,E=6e4,f=/^[a-f0-9]{64}$/,y=/^[A-Za-z0-9_-]{16,128}$/,A=/^[a-z0-9][a-z0-9._:-]{0,127}$/,S=/^[a-z][a-z0-9._:-]{0,79}$/,_=new Set(["codex","opencode"]),D=new Set(["inspect-session","prepare-license-auth","reconcile-license-auth","authorize-business-replay"]),d=["schemaVersion","referenceId","provider","authDomain","target","operation","scopes","issuedAt","expiresAt","revocationEpoch","subjectDigest","policyDigest","dispatchDigest"];class v extends Error{reasonCode;constructor(r){super(r),this.reasonCode=r,this.name="HostAuthReferenceError"}}function t(s){throw new v(s)}function w(s,r={}){let o=s;if(typeof s=="string"){Buffer.byteLength(s,"utf8")>u&&t("host-auth-reference-oversized");try{o=JSON.parse(s)}catch{t("host-auth-reference-invalid")}}(!o||typeof o!="object"||Array.isArray(o))&&t("host-auth-reference-invalid");const e=o,a=Object.keys(e);(a.length!==d.length||a.some(c=>!d.includes(c)))&&t("host-auth-reference-invalid"),(e.schemaVersion!==p||e.authDomain!=="model-provider")&&t("host-auth-reference-invalid"),(typeof e.provider!="string"||!_.has(e.provider))&&t("host-auth-reference-invalid"),(typeof e.operation!="string"||!D.has(e.operation))&&t("host-auth-operation-denied"),(typeof e.referenceId!="string"||!y.test(e.referenceId)||typeof e.target!="string"||!A.test(e.target)||typeof e.subjectDigest!="string"||!f.test(e.subjectDigest)||typeof e.policyDigest!="string"||!f.test(e.policyDigest)||typeof e.dispatchDigest!="string"||!f.test(e.dispatchDigest))&&t("host-auth-reference-invalid"),(!Array.isArray(e.scopes)||e.scopes.length===0||e.scopes.length>16||e.scopes.some(c=>typeof c!="string"||!S.test(c))||new Set(e.scopes).size!==e.scopes.length)&&t("host-auth-scope-denied"),(!Number.isSafeInteger(e.revocationEpoch)||e.revocationEpoch<0)&&t("host-auth-reference-invalid");const n=Date.parse(String(e.issuedAt)),i=Date.parse(String(e.expiresAt));(!Number.isFinite(n)||!Number.isFinite(i)||i<=n||i-n>E)&&t("host-auth-reference-invalid");const h=r.now??Date.now();(n>h+3e4||!r.allowExpired&&i<=h)&&t("host-auth-reference-expired");const g=JSON.stringify(e);return Buffer.byteLength(g,"utf8")>u&&t("host-auth-reference-oversized"),Object.freeze({...e,scopes:Object.freeze([...e.scopes])})}function R(s){const r=s.now??Date.now(),o=s.ttlMs??3e4,{now:e,ttlMs:a,...n}=s;return w({schemaVersion:p,referenceId:l(18).toString("base64url"),...n,issuedAt:new Date(r).toISOString(),expiresAt:new Date(r+o).toISOString()},{now:r})}export{u as HOST_AUTH_REFERENCE_MAX_BYTES,E as HOST_AUTH_REFERENCE_MAX_TTL_MS,p as HOST_AUTH_REFERENCE_SCHEMA,v as HostAuthReferenceError,R as createHostAuthReference,w as parseHostAuthReference};

package/packages/client/dist/config/profile-directory.js

@@ -1,13 +1 @@
-import { homedir } from 'node:os';
-import { basename, isAbsolute, join, normalize } from 'node:path';
-/** Explicit isolated profile for local integration runs; the default remains unchanged. */
-export function neocortexProfileDirectory() {
-    const override = process.env.NEOCORTEX_PROFILE_DIR;
-    if (override === undefined)
-        return join(homedir(), '.neocortex');
-    const normalized = normalize(override);
-    if (!isAbsolute(override) || /[\r\n\0]/.test(override) || basename(normalized) !== '.neocortex') {
-        throw new Error('neocortex-profile-dir-invalid');
-    }
-    return normalized;
-}
+import{homedir as o}from"node:os";import{basename as n,isAbsolute as i,join as t,normalize as c}from"node:path";function s(){const r=process.env.NEOCORTEX_PROFILE_DIR;if(r===void 0)return t(o(),".neocortex");const e=c(r);if(!i(r)||/[\r\n\0]/.test(r)||n(e)!==".neocortex")throw new Error("neocortex-profile-dir-invalid");return e}export{s as neocortexProfileDirectory};