@smartergpt/lexrunner 1.2.1 → 1.4.0

package/dist/{planReview-LQM6AUBE.js → planReview-UUMCGZJ6.js}

@@ -1,7 +1,7 @@
 import {
   computeMergeOrder
-} from "./chunk-6TB2UCBZ.js";
-import "./chunk-L7YDEIPO.js";
+} from "./chunk-VAGHAQT2.js";
+import "./chunk-26SCN2LJ.js";
 import "./chunk-AXOAVRTU.js";
 import "./chunk-V3BU2VDU.js";
 

package/dist/{planViewer-57DTN5YT.js → planViewer-TRSQVMH4.js}

@@ -7,8 +7,8 @@ import {
 import "./chunk-6A4IE3TI.js";
 import {
   computeMergeOrder
-} from "./chunk-6TB2UCBZ.js";
-import "./chunk-L7YDEIPO.js";
+} from "./chunk-VAGHAQT2.js";
+import "./chunk-26SCN2LJ.js";
 import "./chunk-AXOAVRTU.js";
 import "./chunk-V3BU2VDU.js";
 

package/dist/sdk/index.d.ts

@@ -62,8 +62,8 @@ type GateStatus = z.infer<typeof GateStatus>;
  * Merge status
  */
 declare const MergeStatus: z.ZodEnum<{
-    error: "error";
     success: "success";
+    error: "error";
     conflict: "conflict";
 }>;
 type MergeStatus = z.infer<typeof MergeStatus>;
@@ -71,8 +71,8 @@ type MergeStatus = z.infer<typeof MergeStatus>;
  * Audit profile
  */
 declare const AuditProfile: z.ZodEnum<{
-    basic: "basic";
     debug: "debug";
+    basic: "basic";
     standard: "standard";
     compliance: "compliance";
 }>;
@@ -167,8 +167,8 @@ type MergeDryRunStartedPayload = z.infer<typeof MergeDryRunStartedPayload>;
 declare const MergeDryRunFinishedPayload: z.ZodObject<{
     item: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
     status: z.ZodEnum<{
-        error: "error";
         success: "success";
+        error: "error";
         conflict: "conflict";
     }>;
     conflicts: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -188,8 +188,8 @@ type MergeConflictDetectedPayload = z.infer<typeof MergeConflictDetectedPayload>
 declare const MergeFinishedPayload: z.ZodObject<{
     item: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
     status: z.ZodEnum<{
-        error: "error";
         success: "success";
+        error: "error";
         conflict: "conflict";
     }>;
     commit: z.ZodOptional<z.ZodString>;
@@ -595,8 +595,8 @@ declare const MergeDryRunFinishedEvent: z.ZodObject<{
     payload: z.ZodObject<{
         item: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
         status: z.ZodEnum<{
-            error: "error";
             success: "success";
+            error: "error";
             conflict: "conflict";
         }>;
         conflicts: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -718,8 +718,8 @@ declare const MergeFinishedEvent: z.ZodObject<{
     payload: z.ZodObject<{
         item: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
         status: z.ZodEnum<{
-            error: "error";
             success: "success";
+            error: "error";
             conflict: "conflict";
         }>;
         commit: z.ZodOptional<z.ZodString>;

package/dist/{security-BKLPEVOC.js → security-OE4VLUFK.js}

@@ -1,6 +1,6 @@
 import {
   securitySecretNotFoundError
-} from "./chunk-L7YDEIPO.js";
+} from "./chunk-26SCN2LJ.js";
 import "./chunk-V3BU2VDU.js";
 
 // src/security/secrets.ts

package/mcp-server.mjs

@@ -45,15 +45,27 @@ try {
 }
 
 const attemptLifecycleHandlers = core.createAttemptLifecycleHandlers();
+const containmentPreflightHandler = core.createAgentWorkContainmentPreflightHandler();
+const projectionLifecycleHandlers = core.createNativeWslProjectionLifecycleHandlers();
 const attemptWorkerHandlers = core.createAttemptWorkerHandlers();
 const attemptReceiptHandlers = core.createAttemptReceiptHandlers();
 const attemptVerificationHandlers = core.createAttemptVerificationHandlers();
 
 function sharedServiceError(error, tool, fallbackCode) {
   if (error && typeof error === "object" && typeof error.code === "string") {
+    const planArtifactContext =
+      error.name === "PlanArtifactServiceError"
+        ? {
+            operation: "resolve plan artifact",
+            details: error.source ? { source: error.source } : undefined,
+          }
+        : {};
     return new Error(
       core.canonicalJSONStringify(
-        core.mcpToolError(error.code, error.message || "Shared service failed", { tool })
+        core.mcpToolError(error.code, error.message || "Shared service failed", {
+          tool,
+          ...planArtifactContext,
+        })
       )
     );
   }
@@ -68,6 +80,43 @@ function sharedServiceError(error, tool, fallbackCode) {
 
 // MCP Tool implementations
 const tools = {
+  preflight_attempt_containment: {
+    description:
+      "Read physical-containment capability before constructing an agent-work Attempt packet",
+    inputSchema: core.AgentWorkContainmentPreflightRequestJsonSchema,
+    call: async (args) => canonicalToolResult(await containmentPreflightHandler.preflight(args)),
+  },
+
+  prepare_native_wsl_projection: {
+    description: "Prepare or exactly reuse an identity-anchored native WSL projection",
+    inputSchema: core.NativeWslProjectionPrepareRequestJsonSchema,
+    call: async (args) =>
+      mutationToolCall("prepare a native WSL projection", () =>
+        projectionLifecycleHandlers.prepare(args)
+      ),
+  },
+
+  get_native_wsl_projection_status: {
+    description: "Read bounded native WSL projection status without creating state",
+    inputSchema: core.NativeWslProjectionStatusRequestJsonSchema,
+    call: async (args) => canonicalToolResult(await projectionLifecycleHandlers.status(args)),
+  },
+
+  cleanup_native_wsl_projection: {
+    description: "Remove exact idle native WSL projection and quarantine state",
+    inputSchema: core.NativeWslProjectionCleanupRequestJsonSchema,
+    call: async (args) =>
+      mutationToolCall("clean up a native WSL projection", () =>
+        projectionLifecycleHandlers.cleanup(args)
+      ),
+  },
+
+  inspect_native_wsl_projection_quarantine: {
+    description: "Inspect privacy-bounded native WSL projection quarantine state",
+    inputSchema: core.NativeWslProjectionQuarantineRequestJsonSchema,
+    call: async (args) => canonicalToolResult(await projectionLifecycleHandlers.quarantine(args)),
+  },
+
   verify_attempt: {
     description: "Run packet-declared engine verification for one fenced Attempt",
     inputSchema: core.AttemptVerificationRunRequestJsonSchema,
@@ -389,6 +438,11 @@ const tools = {
     inputSchema: {
       type: "object",
       properties: {
+        planFile: {
+          type: "string",
+          description:
+            "Explicit plan.json path (default: repository plan.json, then profile runner fallback)",
+        },
         onlyItem: {
           type: "string",
           description: "Run gates for specific item only",
@@ -405,31 +459,25 @@ const tools = {
     },
     call: async (args) => {
       try {
-        // Resolve profile directory
-        const { resolveProfile } = await import("./dist/cli.js");
-        const resolved = resolveProfile(config.profileDir, process.cwd());
-
-        // Load plan
-        const planPath = resolve(resolved.path, "runner", "plan.json");
-        if (!existsSync(planPath)) {
-          throw new Error("No plan found. Run plan.create first.");
-        }
-
-        const { loadPlan, GateExecutionService } = await import("./dist/cli.js");
-        const planContent = readFileSync(planPath, "utf-8");
-        const plan = loadPlan(planContent);
+        const artifact = new core.PlanArtifactService().resolve({
+          planFile: args.planFile,
+          workingDir: process.cwd(),
+          profileDir: config.profileDir,
+        });
 
         // Determine output directory
-        const outDir = args.outDir || resolve(resolved.path, "runner", "gates");
+        const outDir = args.outDir || resolve(dirname(artifact.filePath), "gates");
 
-        const result = (
-          await new GateExecutionService().run({
-            plan,
+        const summary = (
+          await new core.GateExecutionService().run({
+            plan: artifact.plan,
             artifactDir: outDir,
             onlyItem: args.onlyItem,
             onlyGate: args.onlyGate,
+            options: { emitReceipt: false, suppressStdout: true },
           })
         ).summary;
+        const result = { ...summary, planArtifact: artifact.identity };
 
         return {
           content: [
@@ -440,7 +488,9 @@ const tools = {
           ],
         };
       } catch (error) {
-        throw new Error(`Failed to run gates: ${error.message}`);
+        const validationFailure = planValidationToolResult(error);
+        if (validationFailure) return validationFailure;
+        throw sharedServiceError(error, "gates.run", "GATE_EXECUTION_FAILED");
       }
     },
   },
@@ -450,6 +500,11 @@ const tools = {
     inputSchema: {
       type: "object",
       properties: {
+        planFile: {
+          type: "string",
+          description:
+            "Explicit plan.json path (default: repository plan.json, then profile runner fallback)",
+        },
         dryRun: {
           type: "boolean",
           description: "Simulate merge without making changes",
@@ -459,28 +514,21 @@ const tools = {
     },
     call: async (args) => {
       try {
-        // Resolve profile directory
-        const { resolveProfile } = await import("./dist/cli.js");
-        const resolved = resolveProfile(config.profileDir, process.cwd());
-
-        // Load plan
-        const planPath = resolve(resolved.path, "runner", "plan.json");
-        if (!existsSync(planPath)) {
-          throw new Error("No plan found. Run plan.create first.");
-        }
-
-        const { loadPlan, MergeApplicationService } = await import("./dist/cli.js");
-        const planContent = readFileSync(planPath, "utf-8");
-        const plan = loadPlan(planContent);
+        const artifact = new core.PlanArtifactService().resolve({
+          planFile: args.planFile,
+          workingDir: process.cwd(),
+          profileDir: config.profileDir,
+        });
 
-        const result = (
-          await new MergeApplicationService().run({
-            plan,
+        const summary = (
+          await new core.MergeApplicationService().run({
+            plan: artifact.plan,
             workingDir: process.cwd(),
             dryRun: args.dryRun ?? true,
             mutationAuthorized: config.allowMutations,
           })
         ).summary;
+        const result = { ...summary, planArtifact: artifact.identity };
 
         return {
           content: [
@@ -491,6 +539,8 @@ const tools = {
           ],
         };
       } catch (error) {
+        const validationFailure = planValidationToolResult(error);
+        if (validationFailure) return validationFailure;
         if (error?.name === "MergeApplicationServiceError" && typeof error.code === "string") {
           const { mcpToolError } = await import("./dist/errors/index.js");
           throw new Error(
@@ -499,7 +549,7 @@ const tools = {
             )
           );
         }
-        throw new Error(`Failed to apply merge: ${error.message}`);
+        throw sharedServiceError(error, "merge.apply", "MERGE_APPLICATION_FAILED");
       }
     },
   },
@@ -831,24 +881,22 @@ const tools = {
       properties: {
         planFile: {
           type: "string",
-          description: "Path to plan.json file (default: plan.json)",
-          default: "plan.json",
+          description:
+            "Explicit plan.json path (default: repository plan.json, then profile runner fallback)",
         },
       },
     },
     call: async (args) => {
       try {
-        const planFile = args.planFile || "plan.json";
-
-        if (!existsSync(planFile)) {
-          throw new Error(`Plan file not found: ${planFile}`);
-        }
-
-        const { loadPlan, IntegrationStatusQueryService } = await import("./dist/cli.js");
-        const planContent = readFileSync(planFile, "utf-8");
-        const plan = loadPlan(planContent);
-
-        const result = new IntegrationStatusQueryService().run(plan);
+        const artifact = new core.PlanArtifactService().resolve({
+          planFile: args.planFile,
+          workingDir: process.cwd(),
+          profileDir: config.profileDir,
+        });
+        const result = {
+          ...new core.IntegrationStatusQueryService().run(artifact.plan),
+          planArtifact: artifact.identity,
+        };
 
         return {
           content: [
@@ -859,7 +907,9 @@ const tools = {
           ],
         };
       } catch (error) {
-        throw new Error(`Failed to get status: ${error.message}`);
+        const validationFailure = planValidationToolResult(error);
+        if (validationFailure) return validationFailure;
+        throw sharedServiceError(error, "status", "INTEGRATION_STATUS_FAILED");
       }
     },
   },
@@ -898,24 +948,22 @@ const tools = {
       properties: {
         planFile: {
           type: "string",
-          description: "Path to plan.json file (default: plan.json)",
-          default: "plan.json",
+          description:
+            "Explicit plan.json path (default: repository plan.json, then profile runner fallback)",
         },
       },
     },
     call: async (args) => {
       try {
-        const planFile = args.planFile || "plan.json";
-
-        if (!existsSync(planFile)) {
-          throw new Error(`Plan file not found: ${planFile}`);
-        }
-
-        const { loadPlan, MergeOrderQueryService } = await import("./dist/cli.js");
-        const planContent = readFileSync(planFile, "utf-8");
-        const plan = loadPlan(planContent);
-
-        const result = new MergeOrderQueryService().run(plan);
+        const artifact = new core.PlanArtifactService().resolve({
+          planFile: args.planFile,
+          workingDir: process.cwd(),
+          profileDir: config.profileDir,
+        });
+        const result = {
+          ...new core.MergeOrderQueryService().run(artifact.plan),
+          planArtifact: artifact.identity,
+        };
 
         return {
           content: [
@@ -926,7 +974,9 @@ const tools = {
           ],
         };
       } catch (error) {
-        throw new Error(`Failed to compute merge order: ${error.message}`);
+        const validationFailure = planValidationToolResult(error);
+        if (validationFailure) return validationFailure;
+        throw sharedServiceError(error, "merge-order", "MERGE_ORDER_FAILED");
       }
     },
   },
@@ -1013,6 +1063,11 @@ function canonicalToolResult(result) {
   };
 }
 
+function planValidationToolResult(error) {
+  const failure = core.asPlanValidationFailure(error);
+  return failure ? canonicalToolResult(failure) : null;
+}
+
 async function mutationToolCall(action, call) {
   if (!config.allowMutations) {
     return canonicalToolResult({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartergpt/lexrunner",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -93,6 +93,7 @@
     "validate:manifests": "tsx scripts/validate-manifests.ts",
     "validate:build-artifacts": "tsx scripts/validate-build-artifacts.ts",
     "validate:package": "tsx scripts/validate-package-boundary.ts",
+    "check:install-scripts": "node scripts/check-install-script-policy.mjs",
     "test:package": "node scripts/smoke-packed-package.mjs",
     "docs:check": "node scripts/check-doc-links.mjs",
     "docs:surface": "node scripts/render-doc-surfaces.mjs",
@@ -129,7 +130,7 @@
     "@modelcontextprotocol/sdk": "^1.18.2",
     "@octokit/auth-token": "^6.0.0",
     "@octokit/rest": "^22.0.0",
-    "@smartergpt/lex": "^3.0.1",
+    "@smartergpt/lex": "^4.0.0",
     "@types/babel__traverse": "^7.28.0",
     "ajv": "^8.20.0",
     "better-sqlite3-multiple-ciphers": "^12.6.2",
@@ -166,5 +167,10 @@
     "*.{json,md,yaml,yml}": [
       "prettier --check"
     ]
+  },
+  "allowScripts": {
+    "better-sqlite3-multiple-ciphers@12.11.1": true,
+    "esbuild@0.28.1": true,
+    "@smartergpt/lex": false
   }
 }