@ornexus/neocortex 4.60.73 → 4.60.75

package/packages/client/dist/resolvers/remote-resolver.js

@@ -1,233 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-import { ResolverMode, NoOpCache, } from '../types/index.js';
-import { CLIENT_VERSION } from '../version.js';
-// ── Constants ────────────────────────────────────────────────────────────
-const DEFAULT_TIMEOUT_MS = 30_000;
-const DEFAULT_RETRY_COUNT = 3;
-const BACKOFF_BASE_MS = 1_000;
-const BACKOFF_MAX_MS = 10_000;
-// ── Error Types ──────────────────────────────────────────────────────────
-export class RemoteResolverError extends Error {
-    statusCode;
-    endpoint;
-    constructor(message, statusCode, endpoint) {
-        super(message);
-        this.statusCode = statusCode;
-        this.endpoint = endpoint;
-        this.name = 'RemoteResolverError';
-    }
-}
-// ── RemoteResolver Implementation ───────────────────────────────────────
-export class RemoteResolver {
-    mode = ResolverMode.REMOTE;
-    serverUrl;
-    licenseKey;
-    timeout;
-    retryCount;
-    /**
-     * Persistent cache -- used for registry metadata only, never protected
-     * step/skill/standard content.
-     */
-    cache;
-    licenseClient;
-    constructor(options) {
-        this.serverUrl = options.serverUrl.replace(/\/+$/, '');
-        this.licenseKey = options.licenseKey;
-        this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
-        this.retryCount = options.retryCount ?? DEFAULT_RETRY_COUNT;
-        this.cache = options.cacheProvider ?? new NoOpCache();
-        this.licenseClient = options.licenseClient ?? null;
-    }
-    async resolveStep(stepId, _context) {
-        return this.fetchWithRetry({
-            method: 'GET',
-            path: `/api/v1/steps/${encodeURIComponent(stepId)}`,
-        });
-    }
-    async resolveSkill(skillId, _context) {
-        return this.fetchWithRetry({
-            method: 'GET',
-            path: `/api/v1/skills/${encodeURIComponent(skillId)}`,
-        });
-    }
-    async resolveStandard(standardId) {
-        return this.fetchWithRetry({
-            method: 'GET',
-            path: `/api/v1/standards/${encodeURIComponent(standardId)}`,
-        });
-    }
-    async resolveRegistry() {
-        // Registry is NOT asset content -- it's tokenized metadata (P70.02).
-        // Persistent cache is acceptable here.
-        const cacheKey = 'registry';
-        return this.fetchWithCacheFallback(cacheKey, {
-            method: 'GET',
-            path: '/api/v1/registry',
-        });
-    }
-    async assemblePrompt(stepId, context) {
-        // assemblePrompt is not cached because it depends on dynamic context
-        return this.fetchWithRetry({
-            method: 'POST',
-            path: '/api/v1/prompts/assemble',
-            body: {
-                stepId,
-                context,
-            },
-        });
-    }
-    async isAvailable() {
-        try {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), 5_000);
-            const response = await fetch(`${this.serverUrl}/api/v1/health`, {
-                method: 'GET',
-                headers: await this.buildHeaders(),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            return response.ok;
-        }
-        catch {
-            return false;
-        }
-    }
-    async dispose() {
-        await this.cache.clear();
-    }
-    // ── Private Methods ─────────────────────────────────────────────────
-    /**
-     * Build authorization headers for API requests.
-     * When a LicenseClient is available, uses JWT token from it.
-     * Story 31.04: NEVER sends raw license key as Bearer token.
-     * If JWT is unavailable, omits Authorization header entirely.
-     * Server will return 401, which fetchWithRetry handles via forceRefresh.
-     */
-    async buildHeaders() {
-        const headers = {
-            'Content-Type': 'application/json',
-            'X-Client-Version': CLIENT_VERSION,
-        };
-        if (this.licenseClient) {
-            const jwt = await this.licenseClient.getToken();
-            if (jwt) {
-                headers['Authorization'] = `Bearer ${jwt}`;
-            }
-            // No JWT available: omit Authorization header entirely
-            // Server will return 401, which fetchWithRetry handles via forceRefresh
-        }
-        return headers;
-    }
-    /**
-     * Execute HTTP request with retry and exponential backoff.
-     * Handles 401 specially: if a licenseClient is available, attempts
-     * forceRefresh() and retries once with the new token.
-     */
-    async fetchWithRetry(options) {
-        let lastError;
-        let authRetried = false;
-        for (let attempt = 0; attempt <= this.retryCount; attempt++) {
-            try {
-                const controller = new AbortController();
-                const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-                const url = `${this.serverUrl}${options.path}`;
-                const fetchOptions = {
-                    method: options.method,
-                    headers: await this.buildHeaders(),
-                    signal: controller.signal,
-                };
-                if (options.body) {
-                    fetchOptions.body = JSON.stringify(options.body);
-                }
-                const response = await fetch(url, fetchOptions);
-                clearTimeout(timeoutId);
-                if (!response.ok) {
-                    // 401: attempt token refresh once if licenseClient is available
-                    if (response.status === 401 && !authRetried && this.licenseClient) {
-                        authRetried = true;
-                        const newToken = await this.licenseClient.forceRefresh();
-                        if (newToken) {
-                            // Retry immediately with the new token (don't count as a normal retry)
-                            attempt--; // offset the loop increment so this doesn't consume a retry
-                            continue;
-                        }
-                        // forceRefresh failed - throw immediately
-                        throw new RemoteResolverError(`API error: ${response.status}`, response.status);
-                    }
-                    // Don't retry on 4xx client errors (except 429 rate limit)
-                    if (response.status >= 400 && response.status < 500 && response.status !== 429) {
-                        throw new RemoteResolverError(`API error: ${response.status}`, response.status);
-                    }
-                    // Retry on 5xx server errors and 429 rate limit
-                    throw new RemoteResolverError(`Server error: ${response.status}`, response.status);
-                }
-                return (await response.json());
-            }
-            catch (error) {
-                // Transport and parser exceptions can contain a URL, response fragment
-                // or adapter-specific diagnostics. They are not safe CLI output.
-                lastError = error instanceof RemoteResolverError
-                    ? error : new RemoteResolverError('Request failed');
-                // Don't retry on non-retryable errors (4xx except 429)
-                if (error instanceof RemoteResolverError && error.statusCode && error.statusCode >= 400 && error.statusCode < 500 && error.statusCode !== 429) {
-                    throw error;
-                }
-                // Apply backoff before next retry (except on last attempt)
-                if (attempt < this.retryCount) {
-                    const backoff = Math.min(BACKOFF_BASE_MS * Math.pow(2, attempt), BACKOFF_MAX_MS);
-                    // Add jitter (0-25% of backoff)
-                    const jitter = Math.random() * backoff * 0.25;
-                    await this.sleep(backoff + jitter);
-                }
-            }
-        }
-        throw lastError ?? new RemoteResolverError('All retry attempts failed');
-    }
-    /**
-     * Fetch with persistent cache fallback: try HTTP first, fall back to cache
-     * on failure. On successful HTTP response, update the cache.
-     *
-     * P70.06: ONLY the registry uses this path. Asset content (step/skill/
-     * standard) is fetched live and never touches disk or a fallback cache.
-     */
-    async fetchWithCacheFallback(cacheKey, options) {
-        try {
-            const result = await this.fetchWithRetry(options);
-            // Update cache with fresh data (fire-and-forget)
-            this.cache.set(cacheKey, JSON.stringify(result)).catch(() => {
-                // Cache write failures are non-critical
-            });
-            return result;
-        }
-        catch (error) {
-            // Try cache fallback
-            const cached = await this.cache.get(cacheKey);
-            if (cached !== null) {
-                try {
-                    return JSON.parse(cached);
-                }
-                catch {
-                    // Invalid cache data, rethrow original error
-                }
-            }
-            throw error;
-        }
-    }
-    /**
-     * Sleep for the specified duration.
-     */
-    sleep(ms) {
-        return new Promise((resolve) => setTimeout(resolve, ms));
-    }
-}
+import{ResolverMode as u,NoOpCache as d}from"../types/index.js";import{CLIENT_VERSION as m}from"../version.js";const y=3e4,f=3,p=1e3,C=1e4;class i extends Error{statusCode;endpoint;constructor(t,e,r){super(t),this.statusCode=e,this.endpoint=r,this.name="RemoteResolverError"}}class v{mode=u.REMOTE;serverUrl;licenseKey;timeout;retryCount;cache;licenseClient;constructor(t){this.serverUrl=t.serverUrl.replace(/\/+$/,""),this.licenseKey=t.licenseKey,this.timeout=t.timeout??y,this.retryCount=t.retryCount??f,this.cache=t.cacheProvider??new d,this.licenseClient=t.licenseClient??null}async resolveStep(t,e){return this.fetchWithRetry({method:"GET",path:`/api/v1/steps/${encodeURIComponent(t)}`})}async resolveSkill(t,e){return this.fetchWithRetry({method:"GET",path:`/api/v1/skills/${encodeURIComponent(t)}`})}async resolveStandard(t){return this.fetchWithRetry({method:"GET",path:`/api/v1/standards/${encodeURIComponent(t)}`})}async resolveRegistry(){return this.fetchWithCacheFallback("registry",{method:"GET",path:"/api/v1/registry"})}async assemblePrompt(t,e){return this.fetchWithRetry({method:"POST",path:"/api/v1/prompts/assemble",body:{stepId:t,context:e}})}async isAvailable(){try{const t=new AbortController,e=setTimeout(()=>t.abort(),5e3),r=await fetch(`${this.serverUrl}/api/v1/health`,{method:"GET",headers:await this.buildHeaders(),signal:t.signal});return clearTimeout(e),r.ok}catch{return!1}}async dispose(){await this.cache.clear()}async buildHeaders(){const t={"Content-Type":"application/json","X-Client-Version":m};if(this.licenseClient){const e=await this.licenseClient.getToken();e&&(t.Authorization=`Bearer ${e}`)}return t}async fetchWithRetry(t){let e,r=!1;for(let a=0;a<=this.retryCount;a++)try{const o=new AbortController,n=setTimeout(()=>o.abort(),this.timeout),c=`${this.serverUrl}${t.path}`,h={method:t.method,headers:await this.buildHeaders(),signal:o.signal};t.body&&(h.body=JSON.stringify(t.body));const s=await fetch(c,h);if(clearTimeout(n),!s.ok){if(s.status===401&&!r&&this.licenseClient){if(r=!0,await this.licenseClient.forceRefresh()){a--;continue}throw new i(`API error: ${s.status}`,s.status)}throw s.status>=400&&s.status<500&&s.status!==429?new i(`API error: ${s.status}`,s.status):new i(`Server error: ${s.status}`,s.status)}return await s.json()}catch(o){if(e=o instanceof i?o:new i("Request failed"),o instanceof i&&o.statusCode&&o.statusCode>=400&&o.statusCode<500&&o.statusCode!==429)throw o;if(a<this.retryCount){const n=Math.min(p*Math.pow(2,a),C),c=Math.random()*n*.25;await this.sleep(n+c)}}throw e??new i("All retry attempts failed")}async fetchWithCacheFallback(t,e){try{const r=await this.fetchWithRetry(e);return this.cache.set(t,JSON.stringify(r)).catch(()=>{}),r}catch(r){const a=await this.cache.get(t);if(a!==null)try{return JSON.parse(a)}catch{}throw r}}sleep(t){return new Promise(e=>setTimeout(e,t))}}export{v as RemoteResolver,i as RemoteResolverError};

package/packages/client/dist/runner/binary.js

@@ -1,404 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * P181.02 -- shared trusted neocortex-runner binary resolution.
- */
-import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
-import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep, win32 } from 'node:path';
-export const RUNNER_BINARY_REASON_CODES = Object.freeze({
-    OK: 'continuity-ok',
-    MISSING: 'runner-binary-missing',
-    AMBIGUOUS: 'runner-binary-ambiguous',
-    NON_EXECUTABLE: 'runner-binary-non-executable',
-    VERSION_MISMATCHED: 'runner-binary-version-mismatched',
-    UNTRUSTED: 'runner-binary-untrusted',
-});
-export const HEADLESS_RUNTIME_BINARY_REASON_CODES = Object.freeze({
-    OK: 'continuity-ok',
-    UNAVAILABLE: 'headless-adapter-unavailable',
-    UNTRUSTED: 'headless-runtime-untrusted',
-});
-const ACCEPTED_PACKAGE_NAMES = new Set(['@ornexus/neocortex', '@neocortex/client']);
-const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
-export function resolveTrustedRunnerBinary(options = {}) {
-    const startDir = resolveStartDirectory(options);
-    if (!startDir)
-        return failure(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner binary resolution did not receive a usable start path.');
-    const packageInfo = findNearestAcceptedPackage(startDir);
-    if (!packageInfo)
-        return failure(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner binary was not inside an accepted Neocortex package.');
-    const { packageRoot, pkg } = packageInfo;
-    const packageName = typeof pkg.name === 'string' ? pkg.name : undefined;
-    const packageVersion = typeof pkg.version === 'string' ? pkg.version : undefined;
-    const provenance = inferProvenance(packageRoot, packageName);
-    if (!packageName || !ACCEPTED_PACKAGE_NAMES.has(packageName)) {
-        return failure(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner package identity was not accepted.', { packageName, packageVersion, packageRoot, provenance });
-    }
-    if (!packageVersion || !VERSION_PATTERN.test(packageVersion)) {
-        return failure(RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED, 'Runner package version was missing or invalid.', { packageName, packageVersion, packageRoot, provenance });
-    }
-    const expectedRelativePath = expectedRunnerBinRelativePath(pkg, packageName);
-    if (!expectedRelativePath) {
-        return failure(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner package did not declare an accepted runner bin target.', { packageName, packageVersion, packageRoot, provenance });
-    }
-    const expectedPath = resolvePackageRelative(packageRoot, expectedRelativePath);
-    const executablePath = safeRealpath(expectedPath);
-    if (!executablePath || !existsSync(executablePath)) {
-        return failure(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner package bin target was not present.', { packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    const executableCheck = checkExecutableFile(executablePath, options.platform, options.requireExecutable);
-    if (executableCheck) {
-        return failure(executableCheck, reasonSummary(executableCheck), { packageName, packageVersion, packageRoot, executablePath, expectedRelativePath, provenance });
-    }
-    const versionMismatch = packageVersionMismatch(packageRoot, packageName, packageVersion);
-    if (versionMismatch) {
-        return failure(RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED, 'Runner package version did not match the development workspace root.', { packageName, packageVersion, packageRoot, executablePath, expectedRelativePath, provenance });
-    }
-    return {
-        ok: true,
-        trusted: true,
-        command: executablePath,
-        args: [],
-        executablePath,
-        packageName,
-        packageVersion,
-        packageRoot,
-        expectedRelativePath,
-        provenance,
-        reasonCodes: [RUNNER_BINARY_REASON_CODES.OK],
-        publicSummary: `Resolved trusted ${provenance} runner for ${packageName}.`,
-        publicSafe: true,
-    };
-}
-export function checkRunnerBinaryTrust(executablePath, options = {}) {
-    const absoluteExecutable = safeAbsolutePath(executablePath);
-    if (!absoluteExecutable)
-        return untrusted(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner executable path was missing.');
-    const resolvedExecutable = safeRealpath(absoluteExecutable);
-    if (!resolvedExecutable || !existsSync(resolvedExecutable)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner executable was not present.', { executablePath: absoluteExecutable });
-    }
-    const packageInfo = findNearestAcceptedPackage(dirname(resolvedExecutable));
-    if (!packageInfo) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner executable was not inside an accepted Neocortex package.', { executablePath: resolvedExecutable });
-    }
-    const { packageRoot, pkg } = packageInfo;
-    const packageName = typeof pkg.name === 'string' ? pkg.name : undefined;
-    const packageVersion = typeof pkg.version === 'string' ? pkg.version : undefined;
-    const provenance = inferProvenance(packageRoot, packageName);
-    if (!packageName || !ACCEPTED_PACKAGE_NAMES.has(packageName)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner package identity was not accepted.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, provenance });
-    }
-    if (!packageVersion || !VERSION_PATTERN.test(packageVersion)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED, 'Runner package version was missing or invalid.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, provenance });
-    }
-    const expectedRelativePath = expectedRunnerBinRelativePath(pkg, packageName);
-    if (!expectedRelativePath) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner package did not declare an accepted runner bin target.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, provenance });
-    }
-    const expectedPath = safeRealpath(resolvePackageRelative(packageRoot, expectedRelativePath));
-    if (!expectedPath || !existsSync(expectedPath)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.MISSING, 'Runner package bin target was not present.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    if (expectedPath !== resolvedExecutable) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.AMBIGUOUS, 'Runner executable did not match the package-declared bin target.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    const executableCheck = checkExecutableFile(resolvedExecutable, options.platform, options.requireExecutable);
-    if (executableCheck) {
-        return untrusted(executableCheck, reasonSummary(executableCheck), { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    if (packageVersionMismatch(packageRoot, packageName, packageVersion)) {
-        return untrusted(RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED, 'Runner package version did not match the development workspace root.', { executablePath: resolvedExecutable, packageName, packageVersion, packageRoot, expectedRelativePath, provenance });
-    }
-    return {
-        trusted: true,
-        packageName,
-        packageVersion,
-        packageRoot,
-        executablePath: resolvedExecutable,
-        expectedRelativePath,
-        provenance,
-        reasonCodes: [RUNNER_BINARY_REASON_CODES.OK],
-        publicSummary: `Trusted ${provenance} runner for ${packageName}.`,
-        publicSafe: true,
-    };
-}
-export function runnerTrustRelativePath(packageRoot, executablePath) {
-    if (looksWindowsPath(packageRoot) || looksWindowsPath(executablePath)) {
-        return win32.relative(packageRoot, executablePath).split('\\').join('/');
-    }
-    return relative(packageRoot, executablePath).split('\\').join('/');
-}
-export function checkTrustedHeadlessRuntimeBinary(options) {
-    const commandName = options.commandName;
-    const realpathBasenamePolicy = options.realpathBasenamePolicy ?? 'strict';
-    if (!isSafeCommandName(commandName)) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNTRUSTED, 'Headless runtime command name was not allowlisted by adapter code.', commandName, 'commandName', 'unsafe_key');
-    }
-    const locator = options.commandLocator ?? defaultHeadlessRuntimeCommandLocator;
-    const candidate = locator(commandName, options.env);
-    if (!candidate) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNAVAILABLE, 'Headless runtime command was not found on PATH.', commandName, 'runtimeBinary', 'missing');
-    }
-    if (!isSafeRuntimeExecutableCandidate(candidate, commandName, options.platform)) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNTRUSTED, 'Headless runtime executable path did not match adapter-owned command constraints.', commandName, 'runtimeBinary', 'executable_path');
-    }
-    const resolvedExecutable = safeRealpath(candidate);
-    if (!resolvedExecutable || !existsSync(resolvedExecutable)) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNAVAILABLE, 'Headless runtime executable was not present.', commandName, 'runtimeBinary', 'missing');
-    }
-    if (!isTrustedRuntimeRealpathBasename(resolvedExecutable, commandName, options.platform, realpathBasenamePolicy)) {
-        return headlessRuntimeBinaryFailure(HEADLESS_RUNTIME_BINARY_REASON_CODES.UNTRUSTED, 'Headless runtime executable realpath did not match adapter-owned command constraints.', commandName, 'runtimeBinary', 'executable_path');
-    }
-    const executableCheck = checkExecutableFile(resolvedExecutable, options.platform, options.requireExecutable ?? true);
-    if (executableCheck) {
-        return headlessRuntimeBinaryFailure(executableCheck === RUNNER_BINARY_REASON_CODES.NON_EXECUTABLE || executableCheck === RUNNER_BINARY_REASON_CODES.MISSING
-            ? HEADLESS_RUNTIME_BINARY_REASON_CODES.UNAVAILABLE
-            : HEADLESS_RUNTIME_BINARY_REASON_CODES.UNTRUSTED, reasonSummary(executableCheck), commandName, 'runtimeBinary', executableCheck);
-    }
-    const result = {
-        ok: true,
-        trusted: true,
-        commandName,
-        reasonCodes: [HEADLESS_RUNTIME_BINARY_REASON_CODES.OK],
-        publicSummary: `Trusted headless runtime command ${commandName} is available.`,
-        redactionSummary: [],
-        publicSafe: true,
-    };
-    Object.defineProperty(result, 'executablePath', {
-        value: resolvedExecutable,
-        enumerable: false,
-        configurable: false,
-    });
-    return result;
-}
-export function defaultHeadlessRuntimeCommandLocator(commandName, env = process.env) {
-    if (!isSafeCommandName(commandName))
-        return undefined;
-    const pathValue = env.PATH ?? '';
-    const pathExt = process.platform === 'win32'
-        ? (env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM').split(';').filter(Boolean)
-        : [''];
-    for (const entry of pathValue.split(delimiter)) {
-        if (!entry || /[\r\n\0]/.test(entry))
-            continue;
-        for (const ext of pathExt) {
-            const candidate = resolve(entry, `${commandName}${ext}`);
-            if (existsSync(candidate))
-                return candidate;
-        }
-    }
-    return undefined;
-}
-function resolveStartDirectory(options) {
-    if (options.packageRoot)
-        return safeAbsolutePath(options.packageRoot);
-    const from = safeAbsolutePath(options.from ?? process.argv[1]);
-    if (!from)
-        return null;
-    const real = safeRealpath(from);
-    if (real) {
-        try {
-            const stat = statSync(real);
-            return stat.isDirectory() ? real : dirname(real);
-        }
-        catch {
-            return dirname(real);
-        }
-    }
-    return dirname(from);
-}
-function safeAbsolutePath(value) {
-    if (!value || /[\r\n\0]/.test(value))
-        return null;
-    const resolved = isAbsolute(value) ? value : resolve(value);
-    return isAbsolute(resolved) ? resolved : null;
-}
-function safeRealpath(path) {
-    try {
-        return realpathSync(path);
-    }
-    catch {
-        return null;
-    }
-}
-function findNearestAcceptedPackage(startDir) {
-    let current = startDir;
-    for (let depth = 0; depth < 10; depth++) {
-        const pkg = readPackageJson(join(current, 'package.json'));
-        if (pkg && typeof pkg.name === 'string' && ACCEPTED_PACKAGE_NAMES.has(pkg.name)) {
-            return { packageRoot: current, pkg };
-        }
-        const parent = dirname(current);
-        if (parent === current)
-            break;
-        current = parent;
-    }
-    return null;
-}
-function findRootPackage(startDir) {
-    let current = startDir;
-    for (let depth = 0; depth < 10; depth++) {
-        const pkg = readPackageJson(join(current, 'package.json'));
-        if (pkg?.name === '@ornexus/neocortex')
-            return { packageRoot: current, pkg };
-        const parent = dirname(current);
-        if (parent === current)
-            break;
-        current = parent;
-    }
-    return null;
-}
-function readPackageJson(path) {
-    try {
-        return JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-function expectedRunnerBinRelativePath(pkg, packageName) {
-    const bin = isRecord(pkg.bin) ? pkg.bin['neocortex-runner'] : undefined;
-    if (typeof bin !== 'string' || bin.length === 0)
-        return null;
-    const normalized = normalizePackageRelativePath(bin);
-    if (packageName === '@ornexus/neocortex' && normalized !== 'packages/client/dist/runner-cli.js')
-        return null;
-    if (packageName === '@neocortex/client' && normalized !== 'dist/runner-cli.js')
-        return null;
-    return normalized;
-}
-function normalizePackageRelativePath(value) {
-    return value.replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '');
-}
-function resolvePackageRelative(packageRoot, normalizedRelativePath) {
-    return resolve(packageRoot, ...normalizedRelativePath.split('/').filter(Boolean));
-}
-function inferProvenance(packageRoot, packageName) {
-    if (packageName === '@ornexus/neocortex')
-        return 'published-root-package';
-    if (packageName !== '@neocortex/client')
-        return 'published-client-package';
-    const rootInfo = findRootPackage(dirname(packageRoot));
-    return rootInfo ? 'development-workspace' : 'published-client-package';
-}
-function packageVersionMismatch(packageRoot, packageName, packageVersion) {
-    if (packageName !== '@neocortex/client')
-        return false;
-    const rootInfo = findRootPackage(dirname(packageRoot));
-    return Boolean(rootInfo && rootInfo.pkg.version !== packageVersion);
-}
-function checkExecutableFile(executablePath, platform = process.platform, requireExecutable = true) {
-    try {
-        const stat = statSync(executablePath);
-        if (!stat.isFile())
-            return RUNNER_BINARY_REASON_CODES.AMBIGUOUS;
-        if (requireExecutable && platform !== 'win32' && (stat.mode & 0o111) === 0)
-            return RUNNER_BINARY_REASON_CODES.NON_EXECUTABLE;
-        return null;
-    }
-    catch {
-        return RUNNER_BINARY_REASON_CODES.MISSING;
-    }
-}
-function failure(reasonCode, publicSummary, details = {}) {
-    const safeDetails = publicFailureDetails(details);
-    return {
-        ok: false,
-        trusted: false,
-        reasonCode,
-        reasonCodes: [reasonCode],
-        publicSummary: boundPublicSummary(publicSummary),
-        publicSafe: true,
-        ...safeDetails,
-    };
-}
-function untrusted(reasonCode, publicSummary, details = {}) {
-    const safeDetails = publicFailureDetails(details);
-    return {
-        trusted: false,
-        reasonCode,
-        reasonCodes: [reasonCode],
-        publicSummary: boundPublicSummary(publicSummary),
-        publicSafe: true,
-        ...safeDetails,
-    };
-}
-function publicFailureDetails(details) {
-    return {
-        ...(details.packageName ? { packageName: details.packageName } : {}),
-        ...(details.packageVersion ? { packageVersion: details.packageVersion } : {}),
-        ...(details.expectedRelativePath ? { expectedRelativePath: details.expectedRelativePath } : {}),
-        ...(details.provenance ? { provenance: details.provenance } : {}),
-    };
-}
-function reasonSummary(reasonCode) {
-    switch (reasonCode) {
-        case RUNNER_BINARY_REASON_CODES.MISSING:
-            return 'Runner package bin target was not present.';
-        case RUNNER_BINARY_REASON_CODES.AMBIGUOUS:
-            return 'Runner binary candidate was ambiguous.';
-        case RUNNER_BINARY_REASON_CODES.NON_EXECUTABLE:
-            return 'Runner package bin target was not executable.';
-        case RUNNER_BINARY_REASON_CODES.VERSION_MISMATCHED:
-            return 'Runner package version did not match the development workspace root.';
-        default:
-            return 'Runner binary trust check failed.';
-    }
-}
-function boundPublicSummary(value) {
-    return value.length <= 180 ? value : `${value.slice(0, 180)}…[TRUNCATED:${value.length - 180}]`;
-}
-function looksWindowsPath(value) {
-    return /^[A-Za-z]:[\\/]/.test(value) || value.includes('\\') || sep === '\\';
-}
-function isRecord(value) {
-    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
-}
-function isSafeCommandName(value) {
-    return /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(value) && !/[\\/\s;&|`$<>\r\n\0]/.test(value);
-}
-function isSafeRuntimeExecutableCandidate(value, commandName, platform = process.platform) {
-    if (!value || /[\r\n\0]/.test(value) || !isAbsolute(value))
-        return false;
-    const base = basename(value).toLowerCase();
-    const expected = commandName.toLowerCase();
-    if (platform === 'win32') {
-        return base === expected || ['.exe', '.cmd', '.bat', '.com'].some((ext) => base === `${expected}${ext}`);
-    }
-    return base === expected;
-}
-function isTrustedRuntimeRealpathBasename(value, commandName, platform = process.platform, policy = 'strict') {
-    if (isSafeRuntimeExecutableCandidate(value, commandName, platform))
-        return true;
-    if (policy === 'opencode-npm-native' && commandName === 'opencode') {
-        if (!value || /[\r\n\0]/.test(value) || !isAbsolute(value))
-            return false;
-        return basename(value).toLowerCase() === 'opencode.exe';
-    }
-    if (policy !== 'claude-code-versioned' || commandName !== 'claude')
-        return false;
-    if (!value || /[\r\n\0]/.test(value) || !isAbsolute(value))
-        return false;
-    return isClaudeCodeVersionedRealpathBasename(basename(value), platform);
-}
-function isClaudeCodeVersionedRealpathBasename(value, platform = process.platform) {
-    const lower = value.toLowerCase();
-    const normalized = platform === 'win32'
-        ? lower.replace(/\.(?:exe|cmd|bat|com)$/i, '')
-        : lower;
-    return /^(?:(?:claude|claude-code)[._-])?v?\d+\.\d+\.\d+(?:[-+][0-9a-z][0-9a-z.-]*)?(?:\.(?:js|mjs|cjs))?$/.test(normalized);
-}
-function headlessRuntimeBinaryFailure(reasonCode, publicSummary, commandName, field, reason) {
-    return {
-        ok: false,
-        trusted: false,
-        ...(commandName && isSafeCommandName(commandName) ? { commandName } : {}),
-        reasonCode,
-        reasonCodes: [reasonCode],
-        publicSummary: boundPublicSummary(publicSummary),
-        redactionSummary: [{ field, reason, evidence: 'value-denied', publicSafe: true }],
-        publicSafe: true,
-    };
-}
+import{existsSync as g,readFileSync as j,realpathSync as z,statSync as P}from"node:fs";import{basename as E,delimiter as K,dirname as p,isAbsolute as R,join as B,relative as X,resolve as y,sep as F,win32 as Z}from"node:path";const o=Object.freeze({OK:"continuity-ok",MISSING:"runner-binary-missing",AMBIGUOUS:"runner-binary-ambiguous",NON_EXECUTABLE:"runner-binary-non-executable",VERSION_MISMATCHED:"runner-binary-version-mismatched",UNTRUSTED:"runner-binary-untrusted"}),m=Object.freeze({OK:"continuity-ok",UNAVAILABLE:"headless-adapter-unavailable",UNTRUSTED:"headless-runtime-untrusted"}),I=new Set(["@ornexus/neocortex","@neocortex/client"]),w=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function re(e={}){const t=J(e);if(!t)return b(o.MISSING,"Runner binary resolution did not receive a usable start path.");const r=v(t);if(!r)return b(o.AMBIGUOUS,"Runner binary was not inside an accepted Neocortex package.");const{packageRoot:n,pkg:c}=r,a=typeof c.name=="string"?c.name:void 0,u=typeof c.version=="string"?c.version:void 0,i=G(n,a);if(!a||!I.has(a))return b(o.AMBIGUOUS,"Runner package identity was not accepted.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});if(!u||!w.test(u))return b(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});const s=_(c,a);if(!s)return b(o.MISSING,"Runner package did not declare an accepted runner bin target.",{packageName:a,packageVersion:u,packageRoot:n,provenance:i});const d=D(n,s),l=x(d);if(!l||!g(l))return b(o.MISSING,"Runner package bin target was not present.",{packageName:a,packageVersion:u,packageRoot:n,expectedRelativePath:s,provenance:i});const S=N(l,e.platform,e.requireExecutable);return S?b(S,T(S),{packageName:a,packageVersion:u,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:i}):L(n,a,u)?b(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{packageName:a,packageVersion:u,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:i}):{ok:!0,trusted:!0,command:l,args:[],executablePath:l,packageName:a,packageVersion:u,packageRoot:n,expectedRelativePath:s,provenance:i,reasonCodes:[o.OK],publicSummary:`Resolved trusted ${i} runner for ${a}.`,publicSafe:!0}}function ae(e,t={}){const r=A(e);if(!r)return f(o.MISSING,"Runner executable path was missing.");const n=x(r);if(!n||!g(n))return f(o.MISSING,"Runner executable was not present.",{executablePath:r});const c=v(p(n));if(!c)return f(o.AMBIGUOUS,"Runner executable was not inside an accepted Neocortex package.",{executablePath:n});const{packageRoot:a,pkg:u}=c,i=typeof u.name=="string"?u.name:void 0,s=typeof u.version=="string"?u.version:void 0,d=G(a,i);if(!i||!I.has(i))return f(o.AMBIGUOUS,"Runner package identity was not accepted.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});if(!s||!w.test(s))return f(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});const l=_(u,i);if(!l)return f(o.MISSING,"Runner package did not declare an accepted runner bin target.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,provenance:d});const S=x(D(a,l));if(!S||!g(S))return f(o.MISSING,"Runner package bin target was not present.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});if(S!==n)return f(o.AMBIGUOUS,"Runner executable did not match the package-declared bin target.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});const k=N(n,t.platform,t.requireExecutable);return k?f(k,T(k),{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):L(a,i,s)?f(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{executablePath:n,packageName:i,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):{trusted:!0,packageName:i,packageVersion:s,packageRoot:a,executablePath:n,expectedRelativePath:l,provenance:d,reasonCodes:[o.OK],publicSummary:`Trusted ${d} runner for ${i}.`,publicSafe:!0}}function ce(e,t){return H(e)||H(t)?Z.relative(e,t).split("\\").join("/"):X(e,t).split("\\").join("/")}function oe(e){const t=e.commandName,r=e.realpathBasenamePolicy??"strict";if(!M(t))return h(m.UNTRUSTED,"Headless runtime command name was not allowlisted by adapter code.",t,"commandName","unsafe_key");const c=(e.commandLocator??q)(t,e.env);if(!c)return h(m.UNAVAILABLE,"Headless runtime command was not found on PATH.",t,"runtimeBinary","missing");if(!$(c,t,e.platform))return h(m.UNTRUSTED,"Headless runtime executable path did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const a=x(c);if(!a||!g(a))return h(m.UNAVAILABLE,"Headless runtime executable was not present.",t,"runtimeBinary","missing");if(!Q(a,t,e.platform,r))return h(m.UNTRUSTED,"Headless runtime executable realpath did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const u=N(a,e.platform,e.requireExecutable??!0);if(u)return h(u===o.NON_EXECUTABLE||u===o.MISSING?m.UNAVAILABLE:m.UNTRUSTED,T(u),t,"runtimeBinary",u);const i={ok:!0,trusted:!0,commandName:t,reasonCodes:[m.OK],publicSummary:`Trusted headless runtime command ${t} is available.`,redactionSummary:[],publicSafe:!0};return Object.defineProperty(i,"executablePath",{value:a,enumerable:!1,configurable:!1}),i}function q(e,t=process.env){if(!M(e))return;const r=t.PATH??"",n=process.platform==="win32"?(t.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean):[""];for(const c of r.split(K))if(!(!c||/[\r\n\0]/.test(c)))for(const a of n){const u=y(c,`${e}${a}`);if(g(u))return u}}function J(e){if(e.packageRoot)return A(e.packageRoot);const t=A(e.from??process.argv[1]);if(!t)return null;const r=x(t);if(r)try{return P(r).isDirectory()?r:p(r)}catch{return p(r)}return p(t)}function A(e){if(!e||/[\r\n\0]/.test(e))return null;const t=R(e)?e:y(e);return R(t)?t:null}function x(e){try{return z(e)}catch{return null}}function v(e){let t=e;for(let r=0;r<10;r++){const n=O(B(t,"package.json"));if(n&&typeof n.name=="string"&&I.has(n.name))return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function C(e){let t=e;for(let r=0;r<10;r++){const n=O(B(t,"package.json"));if(n?.name==="@ornexus/neocortex")return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function O(e){try{return JSON.parse(j(e,"utf8"))}catch{return null}}function _(e,t){const r=W(e.bin)?e.bin["neocortex-runner"]:void 0;if(typeof r!="string"||r.length===0)return null;const n=Y(r);return t==="@ornexus/neocortex"&&n!=="packages/client/dist/runner-cli.js"||t==="@neocortex/client"&&n!=="dist/runner-cli.js"?null:n}function Y(e){return e.replace(/\\/g,"/").replace(/^\.\//,"").replace(/^\/+/,"")}function D(e,t){return y(e,...t.split("/").filter(Boolean))}function G(e,t){return t==="@ornexus/neocortex"?"published-root-package":t!=="@neocortex/client"?"published-client-package":C(p(e))?"development-workspace":"published-client-package"}function L(e,t,r){if(t!=="@neocortex/client")return!1;const n=C(p(e));return!!(n&&n.pkg.version!==r)}function N(e,t=process.platform,r=!0){try{const n=P(e);return n.isFile()?r&&t!=="win32"&&(n.mode&73)===0?o.NON_EXECUTABLE:null:o.AMBIGUOUS}catch{return o.MISSING}}function b(e,t,r={}){const n=V(r);return{ok:!1,trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:U(t),publicSafe:!0,...n}}function f(e,t,r={}){const n=V(r);return{trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:U(t),publicSafe:!0,...n}}function V(e){return{...e.packageName?{packageName:e.packageName}:{},...e.packageVersion?{packageVersion:e.packageVersion}:{},...e.expectedRelativePath?{expectedRelativePath:e.expectedRelativePath}:{},...e.provenance?{provenance:e.provenance}:{}}}function T(e){switch(e){case o.MISSING:return"Runner package bin target was not present.";case o.AMBIGUOUS:return"Runner binary candidate was ambiguous.";case o.NON_EXECUTABLE:return"Runner package bin target was not executable.";case o.VERSION_MISMATCHED:return"Runner package version did not match the development workspace root.";default:return"Runner binary trust check failed."}}function U(e){return e.length<=180?e:`${e.slice(0,180)}\u2026[TRUNCATED:${e.length-180}]`}function H(e){return/^[A-Za-z]:[\\/]/.test(e)||e.includes("\\")||F==="\\"}function W(e){return!!(e&&typeof e=="object"&&!Array.isArray(e))}function M(e){return/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(e)&&!/[\\/\s;&|`$<>\r\n\0]/.test(e)}function $(e,t,r=process.platform){if(!e||/[\r\n\0]/.test(e)||!R(e))return!1;const n=E(e).toLowerCase(),c=t.toLowerCase();return r==="win32"?n===c||[".exe",".cmd",".bat",".com"].some(a=>n===`${c}${a}`):n===c}function Q(e,t,r=process.platform,n="strict"){return $(e,t,r)?!0:n==="opencode-npm-native"&&t==="opencode"?!e||/[\r\n\0]/.test(e)||!R(e)?!1:E(e).toLowerCase()==="opencode.exe":n!=="claude-code-versioned"||t!=="claude"||!e||/[\r\n\0]/.test(e)||!R(e)?!1:ee(E(e),r)}function ee(e,t=process.platform){const r=e.toLowerCase(),n=t==="win32"?r.replace(/\.(?:exe|cmd|bat|com)$/i,""):r;return/^(?:(?:claude|claude-code)[._-])?v?\d+\.\d+\.\d+(?:[-+][0-9a-z][0-9a-z.-]*)?(?:\.(?:js|mjs|cjs))?$/.test(n)}function h(e,t,r,n,c){return{ok:!1,trusted:!1,...r&&M(r)?{commandName:r}:{},reasonCode:e,reasonCodes:[e],publicSummary:U(t),redactionSummary:[{field:n,reason:c,evidence:"value-denied",publicSafe:!0}],publicSafe:!0}}export{m as HEADLESS_RUNTIME_BINARY_REASON_CODES,o as RUNNER_BINARY_REASON_CODES,ae as checkRunnerBinaryTrust,oe as checkTrustedHeadlessRuntimeBinary,q as defaultHeadlessRuntimeCommandLocator,re as resolveTrustedRunnerBinary,ce as runnerTrustRelativePath};