@ornexus/neocortex 4.60.74 → 4.60.75

package/dist/release-source.json

@@ -1 +1 @@
-{"schemaVersion":1,"sourceRevision":"65f126bb8239b04a46732ff489af24eeb36e00e1","version":"4.60.74"}
+{"schemaVersion":1,"sourceRevision":"9f33eb8a7a523b63cc8f48f4737610df5cb294f9","version":"4.60.75"}

package/install.ps1

@@ -17,7 +17,7 @@ param(
     [string]$ServerUrl = ('https://{0}.{1}.{2}' -f 'api','neocortex','sh')
 )
 
-$VERSION = "4.60.74"
+$VERSION = "4.60.75"
 
 # =============================================================================
 # CONFIGURACOES

package/install.sh

@@ -4,7 +4,7 @@
 # Development Orchestrator
 
 # Versao do instalador
-VERSION="4.60.74"
+VERSION="4.60.75"
 
 # Flags
 MIGRATION_DETECTED=false

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ornexus/neocortex",
-  "version": "4.60.74",
-  "description": "Neocortex v4.60.74",
+  "version": "4.60.75",
+  "description": "Neocortex v4.60.75",
   "keywords": [
     "claude",
     "claude-code",

package/packages/client/dist/cache/encrypted-cache.d.ts

@@ -18,16 +18,43 @@ export interface EncryptedCacheOptions {
     passphrase: string;
     /** Read entries without cleanup, creation, overwrite or deletion. */
     strictReadOnly?: boolean;
+    /** Bounded test seam for authoritative crash/fault matrices. */
+    authoritativeFaultInjector?: (phase: AuthoritativeWritePhase) => void | Promise<void>;
+    /** Clock used only by the finite authoritative lock. */
+    authoritativeNow?: () => number;
+    /** Owner liveness probe used only after an authoritative lock expires. */
+    authoritativeOwnerAlive?: (pid: number) => boolean;
 }
+export type AuthoritativeWritePhase = 'lock-synced' | 'temp-synced' | 'backup-synced' | 'renamed' | 'directory-synced' | 'readback-verified';
 export declare class EncryptedCache implements CacheProvider {
     private readonly cacheDir;
     private readonly passphrase;
     private readonly strictReadOnly;
+    private readonly authoritativeFaultInjector?;
+    private readonly authoritativeNow;
+    private readonly authoritativeOwnerAlive;
     private initPromise;
     constructor(options: EncryptedCacheOptions);
     get(key: string): Promise<string | null>;
     set(key: string, value: string, ttlMs?: number): Promise<void>;
+    /**
+     * Required private-state read. Unlike ordinary cache reads, corruption and
+     * access failures are explicit and expired content is never cleaned up.
+     */
+    getAuthoritative(key: string): Promise<string | null>;
+    /**
+     * Durable compare-bound replace for private auth generations. This method is
+     * intentionally separate from best-effort cache set(): callers must observe
+     * every lock, persistence, readback and preimage failure.
+     */
+    setAuthoritative(key: string, value: string, options?: {
+        readonly expectedPlaintextSha256?: string | null;
+    }): Promise<void>;
     clear(): Promise<void>;
     private keyToPath;
     private ensureDir;
+    private acquireAuthoritativeLock;
+    private quarantineExpiredAuthoritativeLock;
+    private readAuthoritativePreimage;
+    private injectAuthoritativeFault;
 }

package/packages/client/dist/cache/encrypted-cache.js

@@ -1 +1 @@
-import{mkdir as n,writeFile as o,readFile as l,rm as s,readdir as u}from"node:fs/promises";import{join as a}from"node:path";import{createHash as m}from"node:crypto";import{encrypt as p,decrypt as d}from"./crypto-utils.js";import{setSecureFilePermissions as f}from"../config/secure-config.js";import{hasProtectedCachePayloadMarker as y}from"./protected-pi-boundary.js";const c=".enc";class x{cacheDir;passphrase;strictReadOnly;initPromise=null;constructor(t){this.cacheDir=t.cacheDir,this.passphrase=t.passphrase,this.strictReadOnly=t.strictReadOnly??!1}async get(t){try{const r=this.keyToPath(t),e=await l(r,"utf8"),i=d(e,this.passphrase);return i.expired?(this.strictReadOnly||await s(r,{force:!0}).catch(()=>{}),null):i.plaintext}catch{return null}}async set(t,r,e){if(!this.strictReadOnly)try{if(y(r))return;await this.ensureDir();const i=this.keyToPath(t),h=p(r,this.passphrase,e);await o(i,h,"utf8"),f(i)}catch{}}async clear(){if(!this.strictReadOnly)try{const r=(await u(this.cacheDir).catch(()=>[])).filter(e=>e.endsWith(c)).map(e=>s(a(this.cacheDir,e),{force:!0}).catch(()=>{}));await Promise.all(r)}catch{}}keyToPath(t){const r=m("sha256").update(t).digest("hex");return a(this.cacheDir,`${r}${c}`)}ensureDir(){return this.initPromise||(this.initPromise=n(this.cacheDir,{recursive:!0}).then(()=>{}).catch(t=>{throw this.initPromise=null,t})),this.initPromise}}export{x as EncryptedCache};
+import{mkdir as I,writeFile as L,readFile as c,rm as m,readdir as N,open as v,rename as b,lstat as E}from"node:fs/promises";import{basename as R,join as D}from"node:path";import{createHash as l,randomUUID as F}from"node:crypto";import{hostname as O}from"node:os";import{encrypt as S,decrypt as g}from"./crypto-utils.js";import{setSecureFilePermissions as T}from"../config/secure-config.js";import{hasProtectedCachePayloadMarker as H}from"./protected-pi-boundary.js";const $=".enc";class z{cacheDir;passphrase;strictReadOnly;authoritativeFaultInjector;authoritativeNow;authoritativeOwnerAlive;initPromise=null;constructor(t){this.cacheDir=t.cacheDir,this.passphrase=t.passphrase,this.strictReadOnly=t.strictReadOnly??!1,this.authoritativeFaultInjector=t.authoritativeFaultInjector,this.authoritativeNow=t.authoritativeNow??Date.now,this.authoritativeOwnerAlive=t.authoritativeOwnerAlive??q}async get(t){try{const r=this.keyToPath(t),a=await c(r,"utf8"),i=g(a,this.passphrase);return i.expired?(this.strictReadOnly||await m(r,{force:!0}).catch(()=>{}),null):i.plaintext}catch{return null}}async set(t,r,a){if(!this.strictReadOnly)try{if(H(r))return;await this.ensureDir();const i=this.keyToPath(t),e=S(r,this.passphrase,a);await L(i,e,"utf8"),T(i)}catch{}}async getAuthoritative(t){const r=this.keyToPath(t);try{const a=await E(r);if(!a.isFile()||a.isSymbolicLink())throw new Error("auth-generation-path-unsafe");const i=await c(r,"utf8"),e=g(i,this.passphrase);if(e.expired)throw new Error("auth-generation-corrupt");return e.plaintext}catch(a){if(a?.code==="ENOENT")return null;throw C(a)?a:new Error("auth-generation-unavailable",{cause:a})}}async setAuthoritative(t,r,a={}){if(this.strictReadOnly)throw new Error("auth-generation-unavailable");if(Buffer.byteLength(r,"utf8")>256*1024)throw new Error("auth-generation-capacity");await this.ensureDir();const i=await E(this.cacheDir);if(!i.isDirectory()||i.isSymbolicLink())throw new Error("auth-generation-path-unsafe");const e=this.keyToPath(t),h=`${e}.lock`,u=`${e}.${process.pid}.${F()}.tmp`,f=F();let n,s;try{n=await this.acquireAuthoritativeLock(h,f,l("sha256").update(t).digest("hex"));const x=this.authoritativeNow();if(await n.writeFile(JSON.stringify({schemaVersion:1,ownerPid:process.pid,ownerHost:O(),nonce:f,keyDigest:l("sha256").update(t).digest("hex"),createdAt:new Date(x).toISOString(),expiresAt:new Date(x+6e4).toISOString()})),await n.sync(),await this.injectAuthoritativeFault("lock-synced"),(await N(this.cacheDir)).filter(o=>o.startsWith(`${R(e)}.`)&&o.endsWith(".tmp")).length>0)throw new Error("auth-generation-path-unsafe");try{const o=await E(e);if(!o.isFile()||o.isSymbolicLink())throw new Error("auth-generation-path-unsafe")}catch(o){if(o?.code!=="ENOENT")throw o}const d=await this.readAuthoritativePreimage(e),y=d===null?null:l("sha256").update(d.plaintext).digest("hex");if(a.expectedPlaintextSha256!==void 0&&y!==a.expectedPlaintextSha256)throw new Error("auth-generation-revision-conflict");const j=S(r,this.passphrase);if(s=await v(u,"wx",384),await s.writeFile(j,"utf8"),await s.sync(),await this.injectAuthoritativeFault("temp-synced"),await s.close(),s=void 0,d!==null&&y!==null){const o=`${e}.${y}.bak`;try{const w=await v(o,"wx",384);try{await w.writeFile(d.raw,"utf8"),await w.sync()}finally{await w.close()}}catch(w){if(w?.code!=="EEXIST")throw w;if(await c(o,"utf8")!==d.raw)throw new Error("auth-generation-path-unsafe")}await this.injectAuthoritativeFault("backup-synced")}const k=await this.readAuthoritativePreimage(e);if((k===null?null:l("sha256").update(k.plaintext).digest("hex"))!==y)throw new Error("auth-generation-revision-conflict");await b(u,e),await this.injectAuthoritativeFault("renamed"),T(e);const A=await v(this.cacheDir,"r");try{await A.sync()}finally{await A.close()}await this.injectAuthoritativeFault("directory-synced");const P=g(await c(e,"utf8"),this.passphrase);if(P.expired||P.plaintext!==r)throw new Error("auth-generation-corrupt");await this.injectAuthoritativeFault("readback-verified")}finally{if(s&&await s.close().catch(()=>{}),await m(u,{force:!0}).catch(()=>{}),n){await n.close().catch(()=>{});try{JSON.parse(await c(h,"utf8")).nonce===f&&await m(h,{force:!0})}catch{}}}}async clear(){if(!this.strictReadOnly)try{const r=(await N(this.cacheDir).catch(()=>[])).filter(a=>a.endsWith($)).map(a=>m(D(this.cacheDir,a),{force:!0}).catch(()=>{}));await Promise.all(r)}catch{}}keyToPath(t){const r=l("sha256").update(t).digest("hex");return D(this.cacheDir,`${r}${$}`)}ensureDir(){return this.initPromise||(this.initPromise=I(this.cacheDir,{recursive:!0}).then(()=>{}).catch(t=>{throw this.initPromise=null,t})),this.initPromise}async acquireAuthoritativeLock(t,r,a){for(let i=0;i<2;i+=1)try{return await v(t,"wx",384)}catch(e){if(e?.code!=="EEXIST")throw e;if(i>0)throw new Error("auth-recovery-backpressure");await this.quarantineExpiredAuthoritativeLock(t,r,a)}throw new Error("auth-recovery-backpressure")}async quarantineExpiredAuthoritativeLock(t,r,a){let i;try{i=await c(t,"utf8")}catch(n){if(n?.code==="ENOENT")return;throw new Error("auth-recovery-backpressure",{cause:n})}let e;try{e=JSON.parse(i)}catch(n){throw new Error("auth-generation-path-unsafe",{cause:n})}const h=typeof e.expiresAt=="string"?Date.parse(e.expiresAt):Number.NaN,u=e.ownerPid;if(e.schemaVersion!==1||e.keyDigest!==a||!Number.isSafeInteger(u)||typeof e.ownerHost!="string"||typeof e.nonce!="string"||!Number.isFinite(h))throw new Error("auth-generation-path-unsafe");if(h>this.authoritativeNow()||e.ownerHost!==O()||this.authoritativeOwnerAlive(u))throw new Error("auth-recovery-backpressure");const f=`${t}.stale-${l("sha256").update(i).digest("hex").slice(0,16)}-${r}.bak`;try{await b(t,f)}catch(n){if(n?.code==="ENOENT")return;throw new Error("auth-recovery-backpressure",{cause:n})}}async readAuthoritativePreimage(t){try{const r=await E(t);if(!r.isFile()||r.isSymbolicLink())throw new Error("auth-generation-path-unsafe");const a=await c(t,"utf8"),i=g(a,this.passphrase);if(i.expired)throw new Error("auth-generation-corrupt");return{raw:a,plaintext:i.plaintext}}catch(r){if(r?.code==="ENOENT")return null;throw r}}async injectAuthoritativeFault(t){await this.authoritativeFaultInjector?.(t)}}function q(p){try{return process.kill(p,0),!0}catch(t){return t?.code==="EPERM"}}function C(p){return p instanceof Error&&/^auth-generation-(?:corrupt|path-unsafe|capacity|revision-conflict|unavailable)$/.test(p.message)}export{z as EncryptedCache};

package/packages/client/dist/commands/invoke.d.ts

@@ -10,7 +10,7 @@ import { type YoloSpecEnvelopeV1 } from '../../../shared/dist/yolo/spec-envelope
 import type { YoloChangeEvidence } from '../../../shared/dist/yolo/change-evidence.js';
 import { type ReleaseGateRequestV1 } from '../../../shared/dist/yoloop/release-blocked.js';
 import { type InvokeEffectContext, type StrictReadOnlyInvokeEnvelope } from '../../../shared/dist/strict-readonly.js';
-import { type InvokeInputEvidenceV1, type InvokeInputEnvelopeV2, type InvokeInputSourceV2, type InvocationMalformedInputReasonV1, type InvocationAdmissionResultV1, type ProjectIdentityMigrationRequestV1 } from '../../../shared/dist/invocation/index.js';
+import { type ExplicitIntentRecoveryBindingV1, type ExplicitIntentRecoveryResultV1, type InvokeInputEvidenceV1, type InvokeInputEnvelopeV2, type InvokeInputSourceV2, type InvocationMalformedInputReasonV1, type InvocationAdmissionResultV1, type ProjectIdentityMigrationRequestV1 } from '../../../shared/dist/invocation/index.js';
 import { type CompatibilityOfferV1, type CompatibilityResultV1 } from '../../../shared/dist/compatibility/index.js';
 import { type P205TransientExecutionAuthority } from '../git/git-lifecycle-store.js';
 export declare const INVOKE_PAYLOAD_LIMIT_BYTES: number;
@@ -98,6 +98,8 @@ export declare function projectReleaseBlockedInvokeResult(response: {
 }): InvokeResult | undefined;
 /** P205.07 client parity guard. Pure and deliberately exported for driver tests. */
 export declare function admitClientInvocation(args: string): InvocationAdmissionResultV1;
+/** P224.02 client parity seam; policy remains owned by the shared classifier. */
+export declare function recoverClientInvocation(args: string): ExplicitIntentRecoveryResultV1;
 type InvokeWatchFormat = 'plain' | 'json';
 interface InvokeWatchWritable {
     write(chunk: string): unknown;
@@ -246,6 +248,8 @@ export declare function sanitizeInvokeCliOutput(instructions: string | undefined
     instructions: string;
     metadata: Record<string, unknown> | undefined;
 };
+/** Project only the bounded causal fields admitted by the local Git preflight. */
+export declare function projectYoloChangeEvidenceCliDiagnostic(value: unknown): Record<string, unknown> | undefined;
 type InvokeCliInputSource = InvokeInputSourceV2;
 export interface InvokeCliParsedOptions {
     readonly args: string;
@@ -549,6 +553,8 @@ interface InvokeRequestBodyBase {
     readonly projectIdentityMigration?: ProjectIdentityMigrationRequestV1;
     /** Public-safe proof that the transmitted/materialized args are byte-faithful. */
     readonly inputEvidence: InvokeInputEvidenceV1;
+    /** P224.02 hash-only binding from original explicit input to canonical args. */
+    readonly invocationRecovery?: ExplicitIntentRecoveryBindingV1;
     readonly idempotencyKey?: string;
     readonly registryVersion: string;
     readonly registryChecksum: string;
@@ -625,6 +631,13 @@ export declare function detectStateSchemaDrift(stateData: unknown): SchemaDriftI
  * Exported for tests only; not part of the public API.
  */
 export declare function __resetSchemaDriftWarnedForTests(): void;
+export interface CreateEpicPlanningProjectionDiagnosticV1 {
+    readonly schemaVersion: 'CreateEpicPlanningProjectionDiagnostic/1.0';
+    readonly outcome: 'omitted';
+    readonly reasonCode: 'budget-omitted';
+    readonly byteLengthBucket: '16385-32768' | '32769-plus';
+    readonly publicSafe: true;
+}
 /**
  * Read state.json and construct a sanitized snapshot for the server.
  * Relative paths only - no absolute paths sent to server.
@@ -732,6 +745,30 @@ export declare function sendEpicClaimAcknowledgement(serverUrl: string, authToke
     };
 }, retryOptions?: InvokePhysicalRetryOptions): Promise<boolean>;
 export declare function acknowledgeMaterializedPendingEpicClaims(projectRoot: string, stateSnapshot: StateSnapshot, serverUrl: string, authToken: string, projectId: string | undefined, retryOptions?: InvokePhysicalRetryOptions): Promise<number>;
+export type YoloopInvalidatedSessionRecoveryResultV1 = {
+    readonly outcome: 'applied';
+    readonly payloadHash: string;
+    readonly retryCount: 1;
+    readonly publicSafe: true;
+} | {
+    readonly outcome: 'blocked';
+    readonly reasonCode: string;
+    readonly retryCount: 0;
+    readonly publicSafe: true;
+};
+/**
+ * P224.02 single causal reconciliation. The caller invokes this only for the
+ * exact public pair YOLOOP_SPEC_NOT_READY/yoloop-session-invalidated. It reads
+ * and mutates the private common authority through the P224.01 CAS, then
+ * verifies the durable postimage before authorizing one transport retry.
+ */
+export declare function reconcileInvalidatedYoloopSession(input: {
+    readonly projectRoot: string;
+    readonly snapshot: StateSnapshot;
+    readonly targetEpicId: string;
+    readonly originalInputSha256: string;
+    readonly canonicalInputSha256: string;
+}): Promise<YoloopInvalidatedSessionRecoveryResultV1>;
 /**
  * Execute the invoke command.
  *