@ornexus/neocortex 4.60.73 → 4.60.75

package/packages/client/dist/agent/update-description.js

@@ -1,251 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - Agent Description Updater (Multi-Platform)
- *
- * Updates the installed agent description across ALL supported platforms
- * with dynamic values: version, tier, and branding.
- *
- * Patches THREE surfaces per file (when present):
- *   1. YAML frontmatter `description: "..."` or Markdown H1 `# ...`
- *   2. ASCII banner version line:  `│      ###  ########      vX.X.X ...│`
- *   3. ASCII banner tier line:     `│ ##   ###  ######  ##    OrNexus Team (Tier) ...│`
- *
- * Supported platforms (home-level):
- *   - Claude Code:  ~/.claude/agents/neocortex/neocortex.md  (YAML frontmatter)
- *   - Gemini CLI:   ~/.gemini/agents/agent.md                (YAML frontmatter)
- *
- * Supported platforms (project-level, discovered via git root):
- *   - Cursor:       <root>/.cursor/agents/neocortex.md       (YAML frontmatter)
- *   - VSCode:       <root>/.github/agents/neocortex.md       (YAML frontmatter)
- *   - Codex:        <root>/AGENTS.md                         (Markdown H1)
- *   - Antigravity:  <root>/.agent/skills/neocortex/SKILL.md  (YAML frontmatter)
- *
- * Called after:
- *   - License activation (activate.ts)
- *   - Install (install.sh via sed fallback for all platforms)
- *
- * Format: 🧠 Neocortex vX.X.X (Tier) | OrNexus Team
- */
-import { readFileSync, writeFileSync, existsSync } from 'node:fs';
-import { execSync } from 'node:child_process';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-// ── Constants ─────────────────────────────────────────────────────────────
-const CONFIG_FILE = join(homedir(), '.neocortex', 'config.json');
-const TIER_LABELS = {
-    free: 'Free',
-    pro: 'Pro',
-    enterprise: 'Enterprise',
-};
-/**
- * Banner frame geometry.
- * Frame is 62 chars wide: │ + 60 inner chars + │
- * Both dynamic lines have a 25-char inner prefix (after the leading │).
- */
-const BANNER_INNER_WIDTH = 60;
-const BANNER_PREFIX_INNER = 25; // chars after leading │, before dynamic content
-// YAML frontmatter: description: "..."
-const YAML_DESCRIPTION_PATTERN = /^description:\s*".*"$/m;
-// Markdown H1: # 🧠 Neocortex vX.X.X (Tier) | OrNexus Team
-// Also matches legacy format: # 🧠 Neocortex vX.X.X - Development Orchestrator | OrNexus Team (Tier)
-const H1_DESCRIPTION_PATTERN = /^# 🧠 Neocortex v[\d.]+(?:\s*\([^)]+\)\s*\| OrNexus Team|\s*-\s*Development Orchestrator \| OrNexus Team \([^)]+\))$/m;
-// Banner version line: │      ###  ########      vX.X.X<spaces>│
-const BANNER_VERSION_PATTERN = /^│      ###  ########      v[\d.]+\s*│$/m;
-// Banner tier line: │ ##   ###  ######  ##    OrNexus Team (<Tier>)<spaces>│
-const BANNER_TIER_PATTERN = /^│ ##   ###  ######  ##    OrNexus Team \([^)]*\)\s*│$/m;
-/**
- * All known home-directory agent files, grouped by description format.
- */
-const HOME_AGENT_FILES = [
-    // Claude Code (home-level)
-    { path: join(homedir(), '.claude', 'agents', 'neocortex', 'neocortex.md'), type: 'yaml' },
-    // Gemini CLI (home-level)
-    { path: join(homedir(), '.gemini', 'agents', 'agent.md'), type: 'yaml' },
-];
-/**
- * Known project-level agent file paths (relative to project root).
- * These are patched after license activation so the tier reflects reality.
- */
-const PROJECT_AGENT_FILES = [
-    // Cursor
-    { relativePath: join('.cursor', 'agents', 'neocortex.md'), type: 'yaml' },
-    // VSCode / GitHub Copilot
-    { relativePath: join('.github', 'agents', 'neocortex.md'), type: 'yaml' },
-    // Codex
-    { relativePath: 'AGENTS.md', type: 'h1' },
-    // Antigravity
-    { relativePath: join('.agent', 'skills', 'neocortex', 'SKILL.md'), type: 'yaml' },
-];
-// ── Project Root Discovery ────────────────────────────────────────────────
-/**
- * Discover the git project root, or null if not in a git repo.
- * Never throws -- returns null on any failure.
- */
-function discoverProjectRoot() {
-    try {
-        const root = execSync('git rev-parse --show-toplevel', {
-            encoding: 'utf-8',
-            timeout: 5000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        return root || null;
-    }
-    catch {
-        return null;
-    }
-}
-// ── Banner Helpers ────────────────────────────────────────────────────────
-/**
- * Build a right-padded banner line.
- * Prefix is the fixed art portion INCLUDING the leading │ (26 chars).
- * Content is the dynamic text. Padding fills to inner width, then closing │.
- *
- * Total: │(1) + prefixInner(25) + content + pad + │(1) = 62 chars.
- */
-function buildBannerLine(prefix, content) {
-    const padLen = BANNER_INNER_WIDTH - BANNER_PREFIX_INNER - content.length;
-    const padding = padLen > 0 ? ' '.repeat(padLen) : '';
-    return `${prefix}${content}${padding}\u2502`; // \u2502 = │
-}
-/**
- * Build the banner version line with correct padding.
- */
-export function buildBannerVersionLine(version) {
-    return buildBannerLine('\u2502      ###  ########      ', `v${version}`);
-}
-/**
- * Build the banner tier line with correct padding.
- */
-export function buildBannerTierLine(tier) {
-    const label = TIER_LABELS[tier.toLowerCase()] ?? 'Free';
-    return buildBannerLine('\u2502 ##   ###  ######  ##    ', `OrNexus Team (${label})`);
-}
-// ── Public API ────────────────────────────────────────────────────────────
-/**
- * Build the dynamic description string (without quotes/prefix).
- */
-export function buildDescription(version, tier) {
-    const label = TIER_LABELS[tier.toLowerCase()] ?? 'Free';
-    return `\u{1F9E0} Neocortex v${version} (${label}) | OrNexus Team`;
-}
-/**
- * Read the current tier from ~/.neocortex/config.json.
- * Returns 'free' if config doesn't exist or tier is missing.
- */
-export function readTierFromConfig() {
-    try {
-        if (existsSync(CONFIG_FILE)) {
-            const raw = readFileSync(CONFIG_FILE, 'utf-8');
-            const config = JSON.parse(raw);
-            return config.tier ?? 'free';
-        }
-    }
-    catch {
-        // Config missing or corrupted
-    }
-    return 'free';
-}
-/**
- * Patch ASCII banner lines (version + tier) in file content.
- * Returns the patched content, or the original if no banner found.
- */
-function patchBannerLines(content, version, tier) {
-    let patched = content;
-    // Patch version line
-    if (BANNER_VERSION_PATTERN.test(patched)) {
-        patched = patched.replace(BANNER_VERSION_PATTERN, buildBannerVersionLine(version));
-    }
-    // Patch tier line
-    if (BANNER_TIER_PATTERN.test(patched)) {
-        patched = patched.replace(BANNER_TIER_PATTERN, buildBannerTierLine(tier));
-    }
-    return patched;
-}
-/**
- * Update a single file's description and banner.
- * Supports YAML frontmatter, H1 header, and ASCII banner lines.
- *
- * Never throws -- description update is non-critical.
- */
-function updateFile(filePath, type, description, version, tier) {
-    try {
-        if (!existsSync(filePath)) {
-            return false;
-        }
-        let content = readFileSync(filePath, 'utf-8');
-        const original = content;
-        // 1. Patch description (YAML frontmatter or H1 header)
-        if (type === 'yaml') {
-            if (YAML_DESCRIPTION_PATTERN.test(content)) {
-                content = content.replace(YAML_DESCRIPTION_PATTERN, `description: "${description}"`);
-            }
-        }
-        else {
-            if (H1_DESCRIPTION_PATTERN.test(content)) {
-                content = content.replace(H1_DESCRIPTION_PATTERN, `# ${description}`);
-            }
-        }
-        // 2. Patch ASCII banner lines (version + tier) if present
-        content = patchBannerLines(content, version, tier);
-        if (content === original) {
-            return false; // Already up to date
-        }
-        writeFileSync(filePath, content, 'utf-8');
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Update agent descriptions across ALL known platform files:
- *   1. Home-level files (Claude Code, Gemini CLI)
- *   2. Project-level files (Cursor, VSCode, Codex, Antigravity) -- discovered via git root
- *
- * Never throws -- description update is non-critical.
- * Returns count of files updated.
- */
-export function updateAgentDescription(version, tier) {
-    const resolvedTier = tier ?? readTierFromConfig();
-    const description = buildDescription(version, resolvedTier);
-    let updated = 0;
-    // 1. Home-level files (existing behavior)
-    for (const { path, type } of HOME_AGENT_FILES) {
-        if (updateFile(path, type, description, version, resolvedTier)) {
-            updated++;
-        }
-    }
-    // 2. Project-level files (discover git root, then check known paths)
-    const projectRoot = discoverProjectRoot();
-    if (projectRoot) {
-        for (const { relativePath, type } of PROJECT_AGENT_FILES) {
-            const fullPath = join(projectRoot, relativePath);
-            if (updateFile(fullPath, type, description, version, resolvedTier)) {
-                updated++;
-            }
-        }
-    }
-    return updated;
-}
-/**
- * Update agent description for a specific file path (used by install scripts
- * for project-level files where paths are dynamic).
- *
- * Never throws -- description update is non-critical.
- */
-export function updateAgentDescriptionAt(filePath, type, version, tier) {
-    const resolvedTier = tier ?? readTierFromConfig();
-    const description = buildDescription(version, resolvedTier);
-    return updateFile(filePath, type, description, version, resolvedTier);
-}
+import{readFileSync as l,writeFileSync as _,existsSync as f}from"node:fs";import{execSync as A}from"node:child_process";import{join as c}from"node:path";import{homedir as p}from"node:os";const m=c(p(),".neocortex","config.json"),d={free:"Free",pro:"Pro",enterprise:"Enterprise"},I=60,L=25,N=/^description:\s*".*"$/m,E=/^# 🧠 Neocortex v[\d.]+(?:\s*\([^)]+\)\s*\| OrNexus Team|\s*-\s*Development Orchestrator \| OrNexus Team \([^)]+\))$/m,T=/^│      ###  ########      v[\d.]+\s*│$/m,x=/^│ ##   ###  ######  ##    OrNexus Team \([^)]*\)\s*│$/m,P=[{path:c(p(),".claude","agents","neocortex","neocortex.md"),type:"yaml"},{path:c(p(),".gemini","agents","agent.md"),type:"yaml"}],F=[{relativePath:c(".cursor","agents","neocortex.md"),type:"yaml"},{relativePath:c(".github","agents","neocortex.md"),type:"yaml"},{relativePath:"AGENTS.md",type:"h1"},{relativePath:c(".agent","skills","neocortex","SKILL.md"),type:"yaml"}];function O(){try{return A("git rev-parse --show-toplevel",{encoding:"utf-8",timeout:5e3,stdio:["pipe","pipe","pipe"]}).trim()||null}catch{return null}}function y(e,o){const t=I-L-o.length,r=t>0?" ".repeat(t):"";return`${e}${o}${r}\u2502`}function S(e){return y("\u2502      ###  ########      ",`v${e}`)}function $(e){const o=d[e.toLowerCase()]??"Free";return y("\u2502 ##   ###  ######  ##    ",`OrNexus Team (${o})`)}function g(e,o){const t=d[o.toLowerCase()]??"Free";return`\u{1F9E0} Neocortex v${e} (${t}) | OrNexus Team`}function R(){try{if(f(m)){const e=l(m,"utf-8");return JSON.parse(e).tier??"free"}}catch{}return"free"}function v(e,o,t){let r=e;return T.test(r)&&(r=r.replace(T,S(o))),x.test(r)&&(r=r.replace(x,$(t))),r}function u(e,o,t,r,i){try{if(!f(e))return!1;let n=l(e,"utf-8");const s=n;return o==="yaml"?N.test(n)&&(n=n.replace(N,`description: "${t}"`)):E.test(n)&&(n=n.replace(E,`# ${t}`)),n=v(n,r,i),n===s?!1:(_(e,n,"utf-8"),!0)}catch{return!1}}function w(e,o){const t=o??R(),r=g(e,t);let i=0;for(const{path:s,type:a}of P)u(s,a,r,e,t)&&i++;const n=O();if(n)for(const{relativePath:s,type:a}of F){const h=c(n,s);u(h,a,r,e,t)&&i++}return i}function j(e,o,t,r){const i=r??R(),n=g(t,i);return u(e,o,n,t,i)}export{$ as buildBannerTierLine,S as buildBannerVersionLine,g as buildDescription,R as readTierFromConfig,w as updateAgentDescription,j as updateAgentDescriptionAt};

package/packages/client/dist/cache/crypto-utils.js

@@ -1,78 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - Crypto Utilities
- *
- * AES-256-GCM encryption/decryption with PBKDF2 key derivation.
- * Used by EncryptedCache to protect cached assets at rest.
- *
- * Security design:
- * - IV: 12 bytes (NIST SP 800-38D recommended for GCM)
- * - Salt: 32 bytes random per entry
- * - Key: PBKDF2 with 100k iterations, SHA-512
- * - expiresAt is inside the encrypted payload (authenticated by GCM tag)
- */
-import { randomBytes, pbkdf2Sync, createCipheriv, createDecipheriv } from 'node:crypto';
-import { assertPublicSafeCachePayload } from './protected-pi-boundary.js';
-// ── Constants ────────────────────────────────────────────────────────────
-const ALGORITHM = 'aes-256-gcm';
-const IV_LENGTH = 12; // NIST SP 800-38D recommended for AES-GCM
-const SALT_LENGTH = 32;
-const KEY_LENGTH = 32;
-const AUTH_TAG_LENGTH = 16;
-const PBKDF2_ITERATIONS = 100_000;
-const PBKDF2_DIGEST = 'sha512';
-// ── Key Derivation ───────────────────────────────────────────────────────
-export function deriveKey(passphrase, salt) {
-    return pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);
-}
-// ── Encrypt ──────────────────────────────────────────────────────────────
-export function encrypt(plaintext, passphrase, ttlMs) {
-    assertPublicSafeCachePayload(plaintext);
-    const iv = randomBytes(IV_LENGTH);
-    const salt = randomBytes(SALT_LENGTH);
-    const key = deriveKey(passphrase, salt);
-    const expiresAt = ttlMs != null ? Date.now() + ttlMs : null;
-    const payload = { plaintext, expiresAt };
-    const payloadJson = JSON.stringify(payload);
-    const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    const encrypted = Buffer.concat([cipher.update(payloadJson, 'utf8'), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    const envelope = {
-        iv: iv.toString('base64'),
-        salt: salt.toString('base64'),
-        tag: tag.toString('base64'),
-        data: encrypted.toString('base64'),
-    };
-    return JSON.stringify(envelope);
-}
-export function decrypt(envelopeJson, passphrase) {
-    const raw = JSON.parse(envelopeJson);
-    if (!raw.iv || !raw.salt || !raw.tag || !raw.data) {
-        throw new Error('Invalid cache envelope: missing required fields');
-    }
-    const iv = Buffer.from(raw.iv, 'base64');
-    const salt = Buffer.from(raw.salt, 'base64');
-    const tag = Buffer.from(raw.tag, 'base64');
-    const data = Buffer.from(raw.data, 'base64');
-    const key = deriveKey(passphrase, salt);
-    const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    decipher.setAuthTag(tag);
-    const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
-    const payload = JSON.parse(decrypted.toString('utf8'));
-    const expired = payload.expiresAt != null && Date.now() > payload.expiresAt;
-    return {
-        plaintext: payload.plaintext,
-        expired,
-    };
-}
+import{randomBytes as d,pbkdf2Sync as h,createCipheriv as S,createDecipheriv as m}from"node:crypto";import{assertPublicSafeCachePayload as v}from"./protected-pi-boundary.js";const l="aes-256-gcm",b=12,A=32,B=32,g=16,N=1e5,x="sha512";function y(e,n){return h(e,n,N,B,x)}function _(e,n,t){v(e);const s=d(b),c=d(A),i=y(n,c),f=t!=null?Date.now()+t:null,a=JSON.stringify({plaintext:e,expiresAt:f}),o=S(l,i,s,{authTagLength:g}),r=Buffer.concat([o.update(a,"utf8"),o.final()]),p=o.getAuthTag(),T={iv:s.toString("base64"),salt:c.toString("base64"),tag:p.toString("base64"),data:r.toString("base64")};return JSON.stringify(T)}function G(e,n){const t=JSON.parse(e);if(!t.iv||!t.salt||!t.tag||!t.data)throw new Error("Invalid cache envelope: missing required fields");const s=Buffer.from(t.iv,"base64"),c=Buffer.from(t.salt,"base64"),i=Buffer.from(t.tag,"base64"),f=Buffer.from(t.data,"base64"),u=y(n,c),a=m(l,u,s,{authTagLength:g});a.setAuthTag(i);const o=Buffer.concat([a.update(f),a.final()]),r=JSON.parse(o.toString("utf8")),p=r.expiresAt!=null&&Date.now()>r.expiresAt;return{plaintext:r.plaintext,expired:p}}export{G as decrypt,y as deriveKey,_ as encrypt};

package/packages/client/dist/cache/encrypted-cache.d.ts

@@ -18,16 +18,43 @@ export interface EncryptedCacheOptions {
     passphrase: string;
     /** Read entries without cleanup, creation, overwrite or deletion. */
     strictReadOnly?: boolean;
+    /** Bounded test seam for authoritative crash/fault matrices. */
+    authoritativeFaultInjector?: (phase: AuthoritativeWritePhase) => void | Promise<void>;
+    /** Clock used only by the finite authoritative lock. */
+    authoritativeNow?: () => number;
+    /** Owner liveness probe used only after an authoritative lock expires. */
+    authoritativeOwnerAlive?: (pid: number) => boolean;
 }
+export type AuthoritativeWritePhase = 'lock-synced' | 'temp-synced' | 'backup-synced' | 'renamed' | 'directory-synced' | 'readback-verified';
 export declare class EncryptedCache implements CacheProvider {
     private readonly cacheDir;
     private readonly passphrase;
     private readonly strictReadOnly;
+    private readonly authoritativeFaultInjector?;
+    private readonly authoritativeNow;
+    private readonly authoritativeOwnerAlive;
     private initPromise;
     constructor(options: EncryptedCacheOptions);
     get(key: string): Promise<string | null>;
     set(key: string, value: string, ttlMs?: number): Promise<void>;
+    /**
+     * Required private-state read. Unlike ordinary cache reads, corruption and
+     * access failures are explicit and expired content is never cleaned up.
+     */
+    getAuthoritative(key: string): Promise<string | null>;
+    /**
+     * Durable compare-bound replace for private auth generations. This method is
+     * intentionally separate from best-effort cache set(): callers must observe
+     * every lock, persistence, readback and preimage failure.
+     */
+    setAuthoritative(key: string, value: string, options?: {
+        readonly expectedPlaintextSha256?: string | null;
+    }): Promise<void>;
     clear(): Promise<void>;
     private keyToPath;
     private ensureDir;
+    private acquireAuthoritativeLock;
+    private quarantineExpiredAuthoritativeLock;
+    private readAuthoritativePreimage;
+    private injectAuthoritativeFault;
 }

package/packages/client/dist/cache/encrypted-cache.js

@@ -1,108 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - EncryptedCache
- *
- * Filesystem-backed encrypted cache implementing the CacheProvider interface.
- * Stores assets as AES-256-GCM encrypted files with PBKDF2 key derivation.
- * Cache keys are hashed with SHA-256 to produce safe filenames.
- *
- * PI boundary (P176.05): values may contain public metadata, hashes, counts,
- * sizes, or bounded encrypted data only. Synthetic protected prompt/workflow/
- * step-body markers and explicit protected JSON field names are rejected before
- * disk write. Default TTL is caller-owned and remains [TBD].
- *
- * All public methods are designed to never throw - cache failures are
- * silently handled since caching is a non-critical optimization.
- */
-import { mkdir, writeFile, readFile, rm, readdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { encrypt, decrypt } from './crypto-utils.js';
-import { setSecureFilePermissions } from '../config/secure-config.js';
-import { hasProtectedCachePayloadMarker } from './protected-pi-boundary.js';
-// ── Constants ────────────────────────────────────────────────────────────
-const CACHE_FILE_EXTENSION = '.enc';
-// ── EncryptedCache Implementation ────────────────────────────────────────
-export class EncryptedCache {
-    cacheDir;
-    passphrase;
-    strictReadOnly;
-    initPromise = null;
-    constructor(options) {
-        this.cacheDir = options.cacheDir;
-        this.passphrase = options.passphrase;
-        this.strictReadOnly = options.strictReadOnly ?? false;
-    }
-    async get(key) {
-        try {
-            const filePath = this.keyToPath(key);
-            const raw = await readFile(filePath, 'utf8');
-            const result = decrypt(raw, this.passphrase);
-            if (result.expired) {
-                if (!this.strictReadOnly)
-                    await rm(filePath, { force: true }).catch(() => { });
-                return null;
-            }
-            return result.plaintext;
-        }
-        catch {
-            return null;
-        }
-    }
-    async set(key, value, ttlMs) {
-        if (this.strictReadOnly)
-            return;
-        try {
-            if (hasProtectedCachePayloadMarker(value))
-                return;
-            await this.ensureDir();
-            const filePath = this.keyToPath(key);
-            const encrypted = encrypt(value, this.passphrase, ttlMs);
-            await writeFile(filePath, encrypted, 'utf8');
-            // Story 66.1 AC6: Apply restrictive permissions on .enc files
-            setSecureFilePermissions(filePath);
-        }
-        catch {
-            // Cache write failures are non-critical
-        }
-    }
-    async clear() {
-        if (this.strictReadOnly)
-            return;
-        try {
-            const entries = await readdir(this.cacheDir).catch(() => []);
-            const removals = entries
-                .filter((entry) => entry.endsWith(CACHE_FILE_EXTENSION))
-                .map((entry) => rm(join(this.cacheDir, entry), { force: true }).catch(() => { }));
-            await Promise.all(removals);
-        }
-        catch {
-            // Clear failures are non-critical
-        }
-    }
-    // ── Private Methods ─────────────────────────────────────────────────
-    keyToPath(key) {
-        const hash = createHash('sha256').update(key).digest('hex');
-        return join(this.cacheDir, `${hash}${CACHE_FILE_EXTENSION}`);
-    }
-    ensureDir() {
-        if (!this.initPromise) {
-            this.initPromise = mkdir(this.cacheDir, { recursive: true }).then(() => undefined).catch((err) => {
-                this.initPromise = null; // allow retry on next call
-                throw err;
-            });
-        }
-        return this.initPromise;
-    }
-}
+import{mkdir as I,writeFile as L,readFile as c,rm as m,readdir as N,open as v,rename as b,lstat as E}from"node:fs/promises";import{basename as R,join as D}from"node:path";import{createHash as l,randomUUID as F}from"node:crypto";import{hostname as O}from"node:os";import{encrypt as S,decrypt as g}from"./crypto-utils.js";import{setSecureFilePermissions as T}from"../config/secure-config.js";import{hasProtectedCachePayloadMarker as H}from"./protected-pi-boundary.js";const $=".enc";class z{cacheDir;passphrase;strictReadOnly;authoritativeFaultInjector;authoritativeNow;authoritativeOwnerAlive;initPromise=null;constructor(t){this.cacheDir=t.cacheDir,this.passphrase=t.passphrase,this.strictReadOnly=t.strictReadOnly??!1,this.authoritativeFaultInjector=t.authoritativeFaultInjector,this.authoritativeNow=t.authoritativeNow??Date.now,this.authoritativeOwnerAlive=t.authoritativeOwnerAlive??q}async get(t){try{const r=this.keyToPath(t),a=await c(r,"utf8"),i=g(a,this.passphrase);return i.expired?(this.strictReadOnly||await m(r,{force:!0}).catch(()=>{}),null):i.plaintext}catch{return null}}async set(t,r,a){if(!this.strictReadOnly)try{if(H(r))return;await this.ensureDir();const i=this.keyToPath(t),e=S(r,this.passphrase,a);await L(i,e,"utf8"),T(i)}catch{}}async getAuthoritative(t){const r=this.keyToPath(t);try{const a=await E(r);if(!a.isFile()||a.isSymbolicLink())throw new Error("auth-generation-path-unsafe");const i=await c(r,"utf8"),e=g(i,this.passphrase);if(e.expired)throw new Error("auth-generation-corrupt");return e.plaintext}catch(a){if(a?.code==="ENOENT")return null;throw C(a)?a:new Error("auth-generation-unavailable",{cause:a})}}async setAuthoritative(t,r,a={}){if(this.strictReadOnly)throw new Error("auth-generation-unavailable");if(Buffer.byteLength(r,"utf8")>256*1024)throw new Error("auth-generation-capacity");await this.ensureDir();const i=await E(this.cacheDir);if(!i.isDirectory()||i.isSymbolicLink())throw new Error("auth-generation-path-unsafe");const e=this.keyToPath(t),h=`${e}.lock`,u=`${e}.${process.pid}.${F()}.tmp`,f=F();let n,s;try{n=await this.acquireAuthoritativeLock(h,f,l("sha256").update(t).digest("hex"));const x=this.authoritativeNow();if(await n.writeFile(JSON.stringify({schemaVersion:1,ownerPid:process.pid,ownerHost:O(),nonce:f,keyDigest:l("sha256").update(t).digest("hex"),createdAt:new Date(x).toISOString(),expiresAt:new Date(x+6e4).toISOString()})),await n.sync(),await this.injectAuthoritativeFault("lock-synced"),(await N(this.cacheDir)).filter(o=>o.startsWith(`${R(e)}.`)&&o.endsWith(".tmp")).length>0)throw new Error("auth-generation-path-unsafe");try{const o=await E(e);if(!o.isFile()||o.isSymbolicLink())throw new Error("auth-generation-path-unsafe")}catch(o){if(o?.code!=="ENOENT")throw o}const d=await this.readAuthoritativePreimage(e),y=d===null?null:l("sha256").update(d.plaintext).digest("hex");if(a.expectedPlaintextSha256!==void 0&&y!==a.expectedPlaintextSha256)throw new Error("auth-generation-revision-conflict");const j=S(r,this.passphrase);if(s=await v(u,"wx",384),await s.writeFile(j,"utf8"),await s.sync(),await this.injectAuthoritativeFault("temp-synced"),await s.close(),s=void 0,d!==null&&y!==null){const o=`${e}.${y}.bak`;try{const w=await v(o,"wx",384);try{await w.writeFile(d.raw,"utf8"),await w.sync()}finally{await w.close()}}catch(w){if(w?.code!=="EEXIST")throw w;if(await c(o,"utf8")!==d.raw)throw new Error("auth-generation-path-unsafe")}await this.injectAuthoritativeFault("backup-synced")}const k=await this.readAuthoritativePreimage(e);if((k===null?null:l("sha256").update(k.plaintext).digest("hex"))!==y)throw new Error("auth-generation-revision-conflict");await b(u,e),await this.injectAuthoritativeFault("renamed"),T(e);const A=await v(this.cacheDir,"r");try{await A.sync()}finally{await A.close()}await this.injectAuthoritativeFault("directory-synced");const P=g(await c(e,"utf8"),this.passphrase);if(P.expired||P.plaintext!==r)throw new Error("auth-generation-corrupt");await this.injectAuthoritativeFault("readback-verified")}finally{if(s&&await s.close().catch(()=>{}),await m(u,{force:!0}).catch(()=>{}),n){await n.close().catch(()=>{});try{JSON.parse(await c(h,"utf8")).nonce===f&&await m(h,{force:!0})}catch{}}}}async clear(){if(!this.strictReadOnly)try{const r=(await N(this.cacheDir).catch(()=>[])).filter(a=>a.endsWith($)).map(a=>m(D(this.cacheDir,a),{force:!0}).catch(()=>{}));await Promise.all(r)}catch{}}keyToPath(t){const r=l("sha256").update(t).digest("hex");return D(this.cacheDir,`${r}${$}`)}ensureDir(){return this.initPromise||(this.initPromise=I(this.cacheDir,{recursive:!0}).then(()=>{}).catch(t=>{throw this.initPromise=null,t})),this.initPromise}async acquireAuthoritativeLock(t,r,a){for(let i=0;i<2;i+=1)try{return await v(t,"wx",384)}catch(e){if(e?.code!=="EEXIST")throw e;if(i>0)throw new Error("auth-recovery-backpressure");await this.quarantineExpiredAuthoritativeLock(t,r,a)}throw new Error("auth-recovery-backpressure")}async quarantineExpiredAuthoritativeLock(t,r,a){let i;try{i=await c(t,"utf8")}catch(n){if(n?.code==="ENOENT")return;throw new Error("auth-recovery-backpressure",{cause:n})}let e;try{e=JSON.parse(i)}catch(n){throw new Error("auth-generation-path-unsafe",{cause:n})}const h=typeof e.expiresAt=="string"?Date.parse(e.expiresAt):Number.NaN,u=e.ownerPid;if(e.schemaVersion!==1||e.keyDigest!==a||!Number.isSafeInteger(u)||typeof e.ownerHost!="string"||typeof e.nonce!="string"||!Number.isFinite(h))throw new Error("auth-generation-path-unsafe");if(h>this.authoritativeNow()||e.ownerHost!==O()||this.authoritativeOwnerAlive(u))throw new Error("auth-recovery-backpressure");const f=`${t}.stale-${l("sha256").update(i).digest("hex").slice(0,16)}-${r}.bak`;try{await b(t,f)}catch(n){if(n?.code==="ENOENT")return;throw new Error("auth-recovery-backpressure",{cause:n})}}async readAuthoritativePreimage(t){try{const r=await E(t);if(!r.isFile()||r.isSymbolicLink())throw new Error("auth-generation-path-unsafe");const a=await c(t,"utf8"),i=g(a,this.passphrase);if(i.expired)throw new Error("auth-generation-corrupt");return{raw:a,plaintext:i.plaintext}}catch(r){if(r?.code==="ENOENT")return null;throw r}}async injectAuthoritativeFault(t){await this.authoritativeFaultInjector?.(t)}}function q(p){try{return process.kill(p,0),!0}catch(t){return t?.code==="EPERM"}}function C(p){return p instanceof Error&&/^auth-generation-(?:corrupt|path-unsafe|capacity|revision-conflict|unavailable)$/.test(p.message)}export{z as EncryptedCache};

package/packages/client/dist/cache/in-memory-asset-cache.js

@@ -1,73 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-import { hasProtectedCachePayloadMarker } from './protected-pi-boundary.js';
-const DEFAULT_MAX_SIZE = 50;
-const DEFAULT_TTL_MS = 5 * 60 * 1000;
-export class InMemoryAssetCache {
-    store = new Map();
-    maxSize;
-    ttlMs;
-    constructor(options = {}) {
-        this.maxSize = options.maxSize ?? DEFAULT_MAX_SIZE;
-        this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-    }
-    /**
-     * Retrieve a value by key. Returns null if missing or expired.
-     * Accessing a key moves it to the end of the LRU ordering.
-     */
-    async get(key) {
-        const entry = this.store.get(key);
-        if (!entry)
-            return null;
-        if (Date.now() >= entry.expiresAt) {
-            this.store.delete(key);
-            return null;
-        }
-        // LRU: move to end (most recently used)
-        this.store.delete(key);
-        this.store.set(key, entry);
-        return entry.value;
-    }
-    /**
-     * Store a value by key. Evicts the least-recently-used entry if the
-     * cache is at capacity.
-     *
-     * @param ttlMs - optional override of the default TTL
-     */
-    async set(key, value, ttlMs) {
-        if (hasProtectedCachePayloadMarker(value))
-            return;
-        const ttl = ttlMs ?? this.ttlMs;
-        const expiresAt = Date.now() + ttl;
-        if (this.store.has(key)) {
-            // Overwrite keeps insertion order fresh -- delete then set.
-            this.store.delete(key);
-        }
-        else if (this.store.size >= this.maxSize) {
-            // LRU eviction: delete oldest entry (first in insertion order).
-            const oldestKey = this.store.keys().next().value;
-            if (oldestKey !== undefined) {
-                this.store.delete(oldestKey);
-            }
-        }
-        this.store.set(key, { value, expiresAt });
-    }
-    /** Drop all entries. Safe to call at any time. */
-    async clear() {
-        this.store.clear();
-    }
-    /** Internal: number of live entries (for diagnostics / tests). */
-    size() {
-        return this.store.size;
-    }
-}
+import{hasProtectedCachePayloadMarker as n}from"./protected-pi-boundary.js";const a=50,h=300*1e3;class u{store=new Map;maxSize;ttlMs;constructor(t={}){this.maxSize=t.maxSize??a,this.ttlMs=t.ttlMs??h}async get(t){const e=this.store.get(t);return e?Date.now()>=e.expiresAt?(this.store.delete(t),null):(this.store.delete(t),this.store.set(t,e),e.value):null}async set(t,e,r){if(n(e))return;const i=r??this.ttlMs,o=Date.now()+i;if(this.store.has(t))this.store.delete(t);else if(this.store.size>=this.maxSize){const s=this.store.keys().next().value;s!==void 0&&this.store.delete(s)}this.store.set(t,{value:e,expiresAt:o})}async clear(){this.store.clear()}size(){return this.store.size}}export{u as InMemoryAssetCache};

package/packages/client/dist/cache/index.js

@@ -1,13 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-export { EncryptedCache } from './encrypted-cache.js';
+import{EncryptedCache as c}from"./encrypted-cache.js";export{c as EncryptedCache};

package/packages/client/dist/cache/protected-pi-boundary.js

@@ -1,44 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * Public-safe client cache PI boundary checks.
- */
-/** Public reason code used when a synthetic protected PI marker is detected. */
-export const PROTECTED_CACHE_PAYLOAD_REASON = 'protected-cache-payload-rejected';
-const SYNTHETIC_PROTECTED_MARKER = /P176_SYNTHETIC_PROTECTED_(?:PROMPT|PROMPT_BODY|WORKFLOW|WORKFLOW_GRAPH|STEP_BODY|RAW_LOG|PRIVATE_URL|SECRET|PROPRIETARY_ASSET)/i;
-const PROTECTED_FIELD_NAME = /^(?:promptBody|workflowBody|workflowGraph|stepBody|privateUrl|rawLog|secret|credential|licenseKey|apiKey|internalRouting|serverOnly|proprietary|protected)$/i;
-function hasProtectedField(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    if (Array.isArray(value))
-        return value.some(hasProtectedField);
-    return Object.entries(value).some(([key, child]) => (PROTECTED_FIELD_NAME.test(key) || hasProtectedField(child)));
-}
-/**
- * Returns true only for synthetic protected markers or explicit protected field
- * names. Generic words like "prompt" or "workflow" are intentionally not
- * rejected because cache keys and README-grade metadata may use them safely.
- */
-export function hasProtectedCachePayloadMarker(value) {
-    if (SYNTHETIC_PROTECTED_MARKER.test(value))
-        return true;
-    try {
-        return hasProtectedField(JSON.parse(value));
-    }
-    catch {
-        return false;
-    }
-}
-export class ProtectedCachePayloadError extends Error {
-    code = PROTECTED_CACHE_PAYLOAD_REASON;
-    constructor() {
-        super(PROTECTED_CACHE_PAYLOAD_REASON);
-        this.name = 'ProtectedCachePayloadError';
-    }
-}
-export function assertPublicSafeCachePayload(value) {
-    if (hasProtectedCachePayloadMarker(value)) {
-        throw new ProtectedCachePayloadError();
-    }
-}
+const t="protected-cache-payload-rejected",a=/P176_SYNTHETIC_PROTECTED_(?:PROMPT|PROMPT_BODY|WORKFLOW|WORKFLOW_GRAPH|STEP_BODY|RAW_LOG|PRIVATE_URL|SECRET|PROPRIETARY_ASSET)/i,n=/^(?:promptBody|workflowBody|workflowGraph|stepBody|privateUrl|rawLog|secret|credential|licenseKey|apiKey|internalRouting|serverOnly|proprietary|protected)$/i;function r(e){return!e||typeof e!="object"?!1:Array.isArray(e)?e.some(r):Object.entries(e).some(([o,c])=>n.test(o)||r(c))}function s(e){if(a.test(e))return!0;try{return r(JSON.parse(e))}catch{return!1}}class E extends Error{code=t;constructor(){super(t),this.name="ProtectedCachePayloadError"}}function P(e){if(s(e))throw new E}export{t as PROTECTED_CACHE_PAYLOAD_REASON,E as ProtectedCachePayloadError,P as assertPublicSafeCachePayload,s as hasProtectedCachePayloadMarker};