@smartergpt/lexrunner 1.2.1 → 1.3.0

package/dist/{commandValidator-VHBB2H3K.js → commandValidator-LVEMJTZP.js}

@@ -1,6 +1,6 @@
 import {
   securityCommandBlockedError
-} from "./chunk-L7YDEIPO.js";
+} from "./chunk-26SCN2LJ.js";
 import "./chunk-V3BU2VDU.js";
 
 // src/security/commandValidator.ts

package/dist/errors/index.cjs

@@ -384,15 +384,23 @@ function gitOperationError(ctx) {
 }
 function planValidationError(ctx) {
   const nextActions = ["Review the plan file for schema violations"];
+  const errorCount = ctx.errorCount ?? ctx.errors.length;
   if (ctx.planPath) {
     nextActions.push(`Plan file: ${ctx.planPath}`);
   }
-  nextActions.push(`Errors: ${ctx.errors.join("; ")}`);
+  if (ctx.errors.length > 0) {
+    nextActions.push(`Errors: ${ctx.errors.join("; ")}`);
+  }
+  if (ctx.errorsTruncated) {
+    nextActions.push(
+      `Only the first ${ctx.errors.length} of ${errorCount} validation errors are included`
+    );
+  }
   return createAXError(
     ErrorCodes.PLAN_VALIDATION_FAILED,
-    `Plan validation failed with ${ctx.errors.length} error(s)`,
+    `Plan validation failed with ${errorCount} error(s)`,
     nextActions,
-    { ...ctx }
+    { ...ctx, errorCount, errorsTruncated: ctx.errorsTruncated ?? false }
   );
 }
 function toAXError(error, code = ErrorCodes.INTERNAL_ERROR, nextActions) {
@@ -739,6 +747,12 @@ var ErrorCodes = {
   PLAN_VALIDATION_FAILED: "PLAN_VALIDATION_FAILED",
   /** Plan file not found */
   PLAN_NOT_FOUND: "PLAN_NOT_FOUND",
+  /** Explicit plan reference is empty, overlong, or otherwise invalid */
+  PLAN_REFERENCE_INVALID: "PLAN_REFERENCE_INVALID",
+  /** Plan reference exists but cannot be read as a bounded regular file */
+  PLAN_UNREADABLE: "PLAN_UNREADABLE",
+  /** Plan exceeds the bounded integration artifact limits */
+  PLAN_ARTIFACT_LIMIT_EXCEEDED: "PLAN_ARTIFACT_LIMIT_EXCEEDED",
   /** Cycle detected in plan item dependencies */
   PLAN_CYCLE_DETECTED: "PLAN_CYCLE_DETECTED",
   /** Referenced dependency not found in plan */

package/dist/errors/index.d.ts

@@ -1,5 +1,5 @@
 export { AXError, AXErrorException, AXErrorSchema, createAXError, isAXError, isAXErrorException, wrapAsAXError } from '@smartergpt/lex/errors';
-export { C as CycleDetectedContext, G as GateFailureContext, a as GitHubErrorContext, b as GitOperationContext, c as GovernanceContext, M as MCPErrorContext, d as MergeConflictContext, P as PlanValidationContext, R as RunNotFoundContext, S as SecurityAuthContext, e as SecurityCommandBlockedContext, f as SecurityComplianceViolationContext, g as SecuritySarifParseErrorContext, h as SecurityScanFailedContext, i as SecuritySecretDetectedContext, j as SecuritySecretNotFoundContext, k as SecurityUnauthorizedContext, T as ToolBudgetExceededContext, U as UnknownDependencyContext, W as WeaveLockConflictContext, l as WeavePreflightFailedContext, n as WeaveStateInvalidContext, o as WithGovernance, p as configInvalidError, q as cycleDetectedError, r as gateFailedError, s as gitOperationError, t as githubApiError, m as mcpToolError, u as mergeConflictError, v as planNotFoundError, w as planValidationError, x as profileNotFoundError, y as runNotFoundError, z as securityAuthFailedError, A as securityCommandBlockedError, B as securityComplianceViolationError, D as securitySarifParseError, E as securityScanFailedError, F as securitySecretDetectedError, H as securitySecretNotFoundError, I as securityUnauthorizedError, J as throwAXError, K as toAXError, L as toolBudgetExceededError, N as unknownDependencyError, O as weaveLockConflictError, Q as weavePreflightFailedError, V as weaveStateInvalidError, X as writeProtectionError } from '../adapters-DciX_uRh.js';
+export { C as CycleDetectedContext, G as GateFailureContext, a as GitHubErrorContext, b as GitOperationContext, c as GovernanceContext, M as MCPErrorContext, d as MergeConflictContext, P as PlanValidationContext, R as RunNotFoundContext, S as SecurityAuthContext, e as SecurityCommandBlockedContext, f as SecurityComplianceViolationContext, g as SecuritySarifParseErrorContext, h as SecurityScanFailedContext, i as SecuritySecretDetectedContext, j as SecuritySecretNotFoundContext, k as SecurityUnauthorizedContext, T as ToolBudgetExceededContext, U as UnknownDependencyContext, W as WeaveLockConflictContext, l as WeavePreflightFailedContext, n as WeaveStateInvalidContext, o as WithGovernance, p as configInvalidError, q as cycleDetectedError, r as gateFailedError, s as gitOperationError, t as githubApiError, m as mcpToolError, u as mergeConflictError, v as planNotFoundError, w as planValidationError, x as profileNotFoundError, y as runNotFoundError, z as securityAuthFailedError, A as securityCommandBlockedError, B as securityComplianceViolationError, D as securitySarifParseError, E as securityScanFailedError, F as securitySecretDetectedError, H as securitySecretNotFoundError, I as securityUnauthorizedError, J as throwAXError, K as toAXError, L as toolBudgetExceededError, N as unknownDependencyError, O as weaveLockConflictError, Q as weavePreflightFailedError, V as weaveStateInvalidError, X as writeProtectionError } from '../adapters-r7_TjMwo.js';
 import 'zod';
 
 /**
@@ -47,6 +47,12 @@ declare const ErrorCodes: {
     readonly PLAN_VALIDATION_FAILED: "PLAN_VALIDATION_FAILED";
     /** Plan file not found */
     readonly PLAN_NOT_FOUND: "PLAN_NOT_FOUND";
+    /** Explicit plan reference is empty, overlong, or otherwise invalid */
+    readonly PLAN_REFERENCE_INVALID: "PLAN_REFERENCE_INVALID";
+    /** Plan reference exists but cannot be read as a bounded regular file */
+    readonly PLAN_UNREADABLE: "PLAN_UNREADABLE";
+    /** Plan exceeds the bounded integration artifact limits */
+    readonly PLAN_ARTIFACT_LIMIT_EXCEEDED: "PLAN_ARTIFACT_LIMIT_EXCEEDED";
     /** Cycle detected in plan item dependencies */
     readonly PLAN_CYCLE_DETECTED: "PLAN_CYCLE_DETECTED";
     /** Referenced dependency not found in plan */

package/dist/errors/index.js

@@ -33,7 +33,7 @@ import {
   weaveStateInvalidError,
   wrapAsAXError,
   writeProtectionError
-} from "../chunk-L7YDEIPO.js";
+} from "../chunk-26SCN2LJ.js";
 import "../chunk-V3BU2VDU.js";
 export {
   AXErrorException,

package/dist/{planReview-LQM6AUBE.js → planReview-UUMCGZJ6.js}

@@ -1,7 +1,7 @@
 import {
   computeMergeOrder
-} from "./chunk-6TB2UCBZ.js";
-import "./chunk-L7YDEIPO.js";
+} from "./chunk-VAGHAQT2.js";
+import "./chunk-26SCN2LJ.js";
 import "./chunk-AXOAVRTU.js";
 import "./chunk-V3BU2VDU.js";
 

package/dist/{planViewer-57DTN5YT.js → planViewer-TRSQVMH4.js}

@@ -7,8 +7,8 @@ import {
 import "./chunk-6A4IE3TI.js";
 import {
   computeMergeOrder
-} from "./chunk-6TB2UCBZ.js";
-import "./chunk-L7YDEIPO.js";
+} from "./chunk-VAGHAQT2.js";
+import "./chunk-26SCN2LJ.js";
 import "./chunk-AXOAVRTU.js";
 import "./chunk-V3BU2VDU.js";
 

package/dist/{security-BKLPEVOC.js → security-OE4VLUFK.js}

@@ -1,6 +1,6 @@
 import {
   securitySecretNotFoundError
-} from "./chunk-L7YDEIPO.js";
+} from "./chunk-26SCN2LJ.js";
 import "./chunk-V3BU2VDU.js";
 
 // src/security/secrets.ts

package/mcp-server.mjs

@@ -45,15 +45,27 @@ try {
 }
 
 const attemptLifecycleHandlers = core.createAttemptLifecycleHandlers();
+const containmentPreflightHandler = core.createAgentWorkContainmentPreflightHandler();
+const projectionLifecycleHandlers = core.createNativeWslProjectionLifecycleHandlers();
 const attemptWorkerHandlers = core.createAttemptWorkerHandlers();
 const attemptReceiptHandlers = core.createAttemptReceiptHandlers();
 const attemptVerificationHandlers = core.createAttemptVerificationHandlers();
 
 function sharedServiceError(error, tool, fallbackCode) {
   if (error && typeof error === "object" && typeof error.code === "string") {
+    const planArtifactContext =
+      error.name === "PlanArtifactServiceError"
+        ? {
+            operation: "resolve plan artifact",
+            details: error.source ? { source: error.source } : undefined,
+          }
+        : {};
     return new Error(
       core.canonicalJSONStringify(
-        core.mcpToolError(error.code, error.message || "Shared service failed", { tool })
+        core.mcpToolError(error.code, error.message || "Shared service failed", {
+          tool,
+          ...planArtifactContext,
+        })
       )
     );
   }
@@ -68,6 +80,43 @@ function sharedServiceError(error, tool, fallbackCode) {
 
 // MCP Tool implementations
 const tools = {
+  preflight_attempt_containment: {
+    description:
+      "Read physical-containment capability before constructing an agent-work Attempt packet",
+    inputSchema: core.AgentWorkContainmentPreflightRequestJsonSchema,
+    call: async (args) => canonicalToolResult(await containmentPreflightHandler.preflight(args)),
+  },
+
+  prepare_native_wsl_projection: {
+    description: "Prepare or exactly reuse an identity-anchored native WSL projection",
+    inputSchema: core.NativeWslProjectionPrepareRequestJsonSchema,
+    call: async (args) =>
+      mutationToolCall("prepare a native WSL projection", () =>
+        projectionLifecycleHandlers.prepare(args)
+      ),
+  },
+
+  get_native_wsl_projection_status: {
+    description: "Read bounded native WSL projection status without creating state",
+    inputSchema: core.NativeWslProjectionStatusRequestJsonSchema,
+    call: async (args) => canonicalToolResult(await projectionLifecycleHandlers.status(args)),
+  },
+
+  cleanup_native_wsl_projection: {
+    description: "Remove exact idle native WSL projection and quarantine state",
+    inputSchema: core.NativeWslProjectionCleanupRequestJsonSchema,
+    call: async (args) =>
+      mutationToolCall("clean up a native WSL projection", () =>
+        projectionLifecycleHandlers.cleanup(args)
+      ),
+  },
+
+  inspect_native_wsl_projection_quarantine: {
+    description: "Inspect privacy-bounded native WSL projection quarantine state",
+    inputSchema: core.NativeWslProjectionQuarantineRequestJsonSchema,
+    call: async (args) => canonicalToolResult(await projectionLifecycleHandlers.quarantine(args)),
+  },
+
   verify_attempt: {
     description: "Run packet-declared engine verification for one fenced Attempt",
     inputSchema: core.AttemptVerificationRunRequestJsonSchema,
@@ -389,6 +438,11 @@ const tools = {
     inputSchema: {
       type: "object",
       properties: {
+        planFile: {
+          type: "string",
+          description:
+            "Explicit plan.json path (default: repository plan.json, then profile runner fallback)",
+        },
         onlyItem: {
           type: "string",
           description: "Run gates for specific item only",
@@ -405,31 +459,25 @@ const tools = {
     },
     call: async (args) => {
       try {
-        // Resolve profile directory
-        const { resolveProfile } = await import("./dist/cli.js");
-        const resolved = resolveProfile(config.profileDir, process.cwd());
-
-        // Load plan
-        const planPath = resolve(resolved.path, "runner", "plan.json");
-        if (!existsSync(planPath)) {
-          throw new Error("No plan found. Run plan.create first.");
-        }
-
-        const { loadPlan, GateExecutionService } = await import("./dist/cli.js");
-        const planContent = readFileSync(planPath, "utf-8");
-        const plan = loadPlan(planContent);
+        const artifact = new core.PlanArtifactService().resolve({
+          planFile: args.planFile,
+          workingDir: process.cwd(),
+          profileDir: config.profileDir,
+        });
 
         // Determine output directory
-        const outDir = args.outDir || resolve(resolved.path, "runner", "gates");
+        const outDir = args.outDir || resolve(dirname(artifact.filePath), "gates");
 
-        const result = (
-          await new GateExecutionService().run({
-            plan,
+        const summary = (
+          await new core.GateExecutionService().run({
+            plan: artifact.plan,
             artifactDir: outDir,
             onlyItem: args.onlyItem,
             onlyGate: args.onlyGate,
+            options: { emitReceipt: false, suppressStdout: true },
           })
         ).summary;
+        const result = { ...summary, planArtifact: artifact.identity };
 
         return {
           content: [
@@ -440,7 +488,9 @@ const tools = {
           ],
         };
       } catch (error) {
-        throw new Error(`Failed to run gates: ${error.message}`);
+        const validationFailure = planValidationToolResult(error);
+        if (validationFailure) return validationFailure;
+        throw sharedServiceError(error, "gates.run", "GATE_EXECUTION_FAILED");
       }
     },
   },
@@ -450,6 +500,11 @@ const tools = {
     inputSchema: {
       type: "object",
       properties: {
+        planFile: {
+          type: "string",
+          description:
+            "Explicit plan.json path (default: repository plan.json, then profile runner fallback)",
+        },
         dryRun: {
           type: "boolean",
           description: "Simulate merge without making changes",
@@ -459,28 +514,21 @@ const tools = {
     },
     call: async (args) => {
       try {
-        // Resolve profile directory
-        const { resolveProfile } = await import("./dist/cli.js");
-        const resolved = resolveProfile(config.profileDir, process.cwd());
-
-        // Load plan
-        const planPath = resolve(resolved.path, "runner", "plan.json");
-        if (!existsSync(planPath)) {
-          throw new Error("No plan found. Run plan.create first.");
-        }
-
-        const { loadPlan, MergeApplicationService } = await import("./dist/cli.js");
-        const planContent = readFileSync(planPath, "utf-8");
-        const plan = loadPlan(planContent);
+        const artifact = new core.PlanArtifactService().resolve({
+          planFile: args.planFile,
+          workingDir: process.cwd(),
+          profileDir: config.profileDir,
+        });
 
-        const result = (
-          await new MergeApplicationService().run({
-            plan,
+        const summary = (
+          await new core.MergeApplicationService().run({
+            plan: artifact.plan,
             workingDir: process.cwd(),
             dryRun: args.dryRun ?? true,
             mutationAuthorized: config.allowMutations,
           })
         ).summary;
+        const result = { ...summary, planArtifact: artifact.identity };
 
         return {
           content: [
@@ -491,6 +539,8 @@ const tools = {
           ],
         };
       } catch (error) {
+        const validationFailure = planValidationToolResult(error);
+        if (validationFailure) return validationFailure;
         if (error?.name === "MergeApplicationServiceError" && typeof error.code === "string") {
           const { mcpToolError } = await import("./dist/errors/index.js");
           throw new Error(
@@ -499,7 +549,7 @@ const tools = {
             )
           );
         }
-        throw new Error(`Failed to apply merge: ${error.message}`);
+        throw sharedServiceError(error, "merge.apply", "MERGE_APPLICATION_FAILED");
       }
     },
   },
@@ -831,24 +881,22 @@ const tools = {
       properties: {
         planFile: {
           type: "string",
-          description: "Path to plan.json file (default: plan.json)",
-          default: "plan.json",
+          description:
+            "Explicit plan.json path (default: repository plan.json, then profile runner fallback)",
         },
       },
     },
     call: async (args) => {
       try {
-        const planFile = args.planFile || "plan.json";
-
-        if (!existsSync(planFile)) {
-          throw new Error(`Plan file not found: ${planFile}`);
-        }
-
-        const { loadPlan, IntegrationStatusQueryService } = await import("./dist/cli.js");
-        const planContent = readFileSync(planFile, "utf-8");
-        const plan = loadPlan(planContent);
-
-        const result = new IntegrationStatusQueryService().run(plan);
+        const artifact = new core.PlanArtifactService().resolve({
+          planFile: args.planFile,
+          workingDir: process.cwd(),
+          profileDir: config.profileDir,
+        });
+        const result = {
+          ...new core.IntegrationStatusQueryService().run(artifact.plan),
+          planArtifact: artifact.identity,
+        };
 
         return {
           content: [
@@ -859,7 +907,9 @@ const tools = {
           ],
         };
       } catch (error) {
-        throw new Error(`Failed to get status: ${error.message}`);
+        const validationFailure = planValidationToolResult(error);
+        if (validationFailure) return validationFailure;
+        throw sharedServiceError(error, "status", "INTEGRATION_STATUS_FAILED");
       }
     },
   },
@@ -898,24 +948,22 @@ const tools = {
       properties: {
         planFile: {
           type: "string",
-          description: "Path to plan.json file (default: plan.json)",
-          default: "plan.json",
+          description:
+            "Explicit plan.json path (default: repository plan.json, then profile runner fallback)",
         },
       },
     },
     call: async (args) => {
       try {
-        const planFile = args.planFile || "plan.json";
-
-        if (!existsSync(planFile)) {
-          throw new Error(`Plan file not found: ${planFile}`);
-        }
-
-        const { loadPlan, MergeOrderQueryService } = await import("./dist/cli.js");
-        const planContent = readFileSync(planFile, "utf-8");
-        const plan = loadPlan(planContent);
-
-        const result = new MergeOrderQueryService().run(plan);
+        const artifact = new core.PlanArtifactService().resolve({
+          planFile: args.planFile,
+          workingDir: process.cwd(),
+          profileDir: config.profileDir,
+        });
+        const result = {
+          ...new core.MergeOrderQueryService().run(artifact.plan),
+          planArtifact: artifact.identity,
+        };
 
         return {
           content: [
@@ -926,7 +974,9 @@ const tools = {
           ],
         };
       } catch (error) {
-        throw new Error(`Failed to compute merge order: ${error.message}`);
+        const validationFailure = planValidationToolResult(error);
+        if (validationFailure) return validationFailure;
+        throw sharedServiceError(error, "merge-order", "MERGE_ORDER_FAILED");
       }
     },
   },
@@ -1013,6 +1063,11 @@ function canonicalToolResult(result) {
   };
 }
 
+function planValidationToolResult(error) {
+  const failure = core.asPlanValidationFailure(error);
+  return failure ? canonicalToolResult(failure) : null;
+}
+
 async function mutationToolCall(action, call) {
   if (!config.allowMutations) {
     return canonicalToolResult({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartergpt/lexrunner",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "type": "module",
   "engines": {
     "node": ">=24"