@smartergpt/lexrunner 1.5.1 → 1.5.2

package/CHANGELOG.md

@@ -6,6 +6,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 ## [Unreleased]
 
+## [1.5.2] - 2026-08-28
+
+### Changed
+
+- **Exact Lex runtime identity** - Bind the direct runtime dependency and reproducible lock to the
+  reviewed public `@smartergpt/lex@4.0.3` release instead of allowing install-time selection across
+  the Lex 4 line.
+- **Current ecosystem dogfood baseline** - Exercise Lex 4.0.3, Lex-MCP 4.0.3, AXF 2.1.1, and
+  LexSona 2.0.2 by default while retaining explicit version overrides.
+- **Native Windows dogfood launch** - Invoke npm and installed package bins through the active Node
+  runtime so the exact ecosystem harness does not depend on platform shell shims.
+- **Contained disposable native binding** - Forbid lifecycle scripts during the credentialed
+  ecosystem install, then copy one exact identity-checked native SQLite binding from LexRunner's
+  gated dependency tree for the public-surface smoke; reject and hash non-registry lock resolutions.
+
 ## [1.5.1] - 2026-08-23
 
 ### Fixed

package/README.md

@@ -115,11 +115,12 @@ The checked-in package version is the single source for `lexrunner --version` an
 
 <!-- BEGIN GENERATED PACKAGE VERSION -->
 
-Current repository package version: **1.5.1**. npm availability and dist-tags are separate
+Current repository package version: **1.5.2**. npm availability and dist-tags are separate
 release evidence; inspect the registry rather than inferring publication from source metadata.
 <!-- END GENERATED PACKAGE VERSION -->
 
-See the [1.5.1 release notes](docs/releases/1.5.1.md), the
+See the [1.5.2 release notes](docs/releases/1.5.2.md), the
+[1.5.1 release correction](docs/releases/1.5.1.md), the
 [1.4.1 canonical CLI release](docs/releases/1.4.1.md), the
 [1.4.0 native-host boundary release](docs/releases/1.4.0.md), the
 [1.3.0 dogfood release](docs/releases/1.3.0.md), the

package/dist/cli.cjs

@@ -116,6 +116,10 @@ var init_error_codes = __esm({
     POLICY_ERROR_CODES = {
       /** No policy file found in any search path */
       POLICY_NOT_FOUND: "POLICY_NOT_FOUND",
+      /** A policy output already exists and overwrite was not explicit */
+      POLICY_ALREADY_EXISTS: "POLICY_ALREADY_EXISTS",
+      /** A constrained policy source directory resolves outside the repository */
+      POLICY_SOURCE_DIR_OUTSIDE_ROOT: "POLICY_SOURCE_DIR_OUTSIDE_ROOT",
       /** Policy file exists but has invalid JSON */
       POLICY_PARSE_ERROR: "POLICY_PARSE_ERROR",
       /** Policy file fails schema validation */
@@ -3018,7 +3022,10 @@ var init_capabilities = __esm({
       check: Object.freeze([]),
       timeline: Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_READ]),
       "frames:export": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_READ]),
-      "frames:import": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_WRITE]),
+      "frames:import": Object.freeze([
+        RUNTIME_OPERATION_CAPABILITIES.FRAME_READ,
+        RUNTIME_OPERATION_CAPABILITIES.FRAME_WRITE
+      ]),
       "db:vacuum": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_ADMIN]),
       "db:backup": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_ADMIN]),
       "db:repair": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_ADMIN]),
@@ -3029,6 +3036,7 @@ var init_capabilities = __esm({
       "db:encrypt": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_ADMIN]),
       "db:stats": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_READ]),
       "policy:check": Object.freeze([]),
+      "policy:generate": Object.freeze([]),
       "policy:add-module": Object.freeze([]),
       "instructions:init": Object.freeze([]),
       "instructions:generate": Object.freeze([]),
@@ -8202,7 +8210,7 @@ var init_behavioral_store = __esm({
 });
 
 // node_modules/@smartergpt/lex/dist/memory/frames/types.js
-var import_zod10, FrameSpendMetadata, ModuleAttribution, TurnCostComponent, TurnCostWeights, TurnCost, FrameStatusSnapshot, CapabilityTier2, TaskComplexity, Frame;
+var import_zod10, FrameSpendMetadata, CallerProvenance, ModuleAttribution, TurnCostComponent, TurnCostWeights, TurnCost, FrameStatusSnapshot, CapabilityTier2, TaskComplexity, Frame;
 var init_types4 = __esm({
   "node_modules/@smartergpt/lex/dist/memory/frames/types.js"() {
     "use strict";
@@ -8211,6 +8219,7 @@ var init_types4 = __esm({
       prompts: import_zod10.z.number().optional(),
       tokens_estimated: import_zod10.z.number().optional()
     });
+    CallerProvenance = import_zod10.z.record(import_zod10.z.string(), import_zod10.z.json());
     ModuleAttribution = import_zod10.z.object({
       mode: import_zod10.z.enum(["explicit", "inferred", "fallback"]),
       confidence: import_zod10.z.enum(["high", "medium", "low"]),
@@ -8241,7 +8250,8 @@ var init_types4 = __esm({
       next_action: import_zod10.z.string(),
       blockers: import_zod10.z.array(import_zod10.z.string()).optional(),
       merge_blockers: import_zod10.z.array(import_zod10.z.string()).optional(),
-      tests_failing: import_zod10.z.array(import_zod10.z.string()).optional()
+      tests_failing: import_zod10.z.array(import_zod10.z.string()).optional(),
+      provenance: CallerProvenance.optional()
     });
     CapabilityTier2 = import_zod10.z.enum(["senior", "mid", "junior"]);
     TaskComplexity = import_zod10.z.object({
@@ -8269,7 +8279,7 @@ var init_types4 = __esm({
       status_snapshot: FrameStatusSnapshot,
       keywords: import_zod10.z.array(import_zod10.z.string()).optional(),
       atlas_frame_id: import_zod10.z.string().optional(),
-      // Link to Atlas Frame (spatial neighborhood)
+      // Legacy Policy Neighborhood snapshot reference
       feature_flags: import_zod10.z.array(import_zod10.z.string()).optional(),
       permissions: import_zod10.z.array(import_zod10.z.string()).optional(),
       module_attribution: ModuleAttribution.optional(),
@@ -13800,7 +13810,7 @@ var init_migrations = __esm({
 });
 
 // node_modules/@smartergpt/lex/dist/memory/store/postgres/scoped-frame-store.js
-var import_node_crypto14;
+var import_node_crypto14, FRAME_STORE_PROTECTED_RELATIONS;
 var init_scoped_frame_store3 = __esm({
   "node_modules/@smartergpt/lex/dist/memory/store/postgres/scoped-frame-store.js"() {
     "use strict";
@@ -13813,6 +13823,13 @@ var init_scoped_frame_store3 = __esm({
     init_search_utils();
     init_durable_frame_metadata();
     init_migrations();
+    FRAME_STORE_PROTECTED_RELATIONS = Object.freeze([
+      "frames",
+      "lex_frame_store_migrations",
+      "lex_frame_store_unowned_frames_v1",
+      "lex_frame_store_recovery_operations",
+      "lex_frame_store_recovery_assignments"
+    ]);
   }
 });
 
@@ -25923,7 +25940,7 @@ var import_config3 = require("dotenv/config");
 // package.json
 var package_default = {
   name: "@smartergpt/lexrunner",
-  version: "1.5.1",
+  version: "1.5.2",
   type: "module",
   engines: {
     node: ">=24"
@@ -26054,7 +26071,7 @@ var package_default = {
     "@modelcontextprotocol/sdk": "^1.18.2",
     "@octokit/auth-token": "^6.0.0",
     "@octokit/rest": "^22.0.0",
-    "@smartergpt/lex": "^4.0.0",
+    "@smartergpt/lex": "4.0.3",
     "@types/babel__traverse": "^7.28.0",
     ajv: "^8.20.0",
     "better-sqlite3-multiple-ciphers": "^12.6.2",

package/dist/cli.d.ts

@@ -1251,8 +1251,8 @@ type ArtifactType = keyof typeof ARTIFACT_TYPES;
 declare const ListArtifactsInputSchema: z.ZodObject<{
     runId: z.ZodString;
     type: z.ZodOptional<z.ZodEnum<{
-        failure: "failure";
         gate: "gate";
+        failure: "failure";
         log: "log";
         decision: "decision";
         report: "report";
@@ -1270,8 +1270,8 @@ declare const ListArtifactsOutputSchema: z.ZodObject<{
     artifacts: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
         type: z.ZodEnum<{
-            failure: "failure";
             gate: "gate";
+            failure: "failure";
             log: "log";
             decision: "decision";
             report: "report";
@@ -2064,6 +2064,7 @@ declare const WorkItem_v1: z.ZodObject<{
 }, z.core.$strict>;
 type WorkItem_v1 = z.infer<typeof WorkItem_v1>;
 declare const RunStatus: z.ZodEnum<{
+    created: "created";
     blocked: "blocked";
     completed: "completed";
     planning: "planning";
@@ -2072,7 +2073,6 @@ declare const RunStatus: z.ZodEnum<{
     failed: "failed";
     paused: "paused";
     cancelled: "cancelled";
-    created: "created";
     executing: "executing";
     delivering: "delivering";
     awaiting_human: "awaiting_human";
@@ -2099,6 +2099,7 @@ declare const Run_v1: z.ZodObject<{
         release: z.ZodBoolean;
     }, z.core.$strict>;
     status: z.ZodEnum<{
+        created: "created";
         blocked: "blocked";
         completed: "completed";
         planning: "planning";
@@ -2107,7 +2108,6 @@ declare const Run_v1: z.ZodObject<{
         failed: "failed";
         paused: "paused";
         cancelled: "cancelled";
-        created: "created";
         executing: "executing";
         delivering: "delivering";
         awaiting_human: "awaiting_human";
@@ -7129,9 +7129,9 @@ declare const AxfExternalAwaitResult_v1: z.ZodObject<{
             name: z.ZodString;
             appSlug: z.ZodNullable<z.ZodString>;
             state: z.ZodEnum<{
+                error: "error";
                 success: "success";
                 failure: "failure";
-                error: "error";
                 completed: "completed";
                 pending: "pending";
                 missing: "missing";
@@ -7226,9 +7226,9 @@ declare const AttemptAwaitableTerminalResult_v1: z.ZodObject<{
                 name: z.ZodString;
                 appSlug: z.ZodNullable<z.ZodString>;
                 state: z.ZodEnum<{
+                    error: "error";
                     success: "success";
                     failure: "failure";
-                    error: "error";
                     completed: "completed";
                     pending: "pending";
                     missing: "missing";
@@ -7367,9 +7367,9 @@ declare const AttemptAwaitableRecord_v1: z.ZodObject<{
                     name: z.ZodString;
                     appSlug: z.ZodNullable<z.ZodString>;
                     state: z.ZodEnum<{
+                        error: "error";
                         success: "success";
                         failure: "failure";
-                        error: "error";
                         completed: "completed";
                         pending: "pending";
                         missing: "missing";
@@ -7473,9 +7473,9 @@ declare const AttemptAwaitableCompletion_v1: z.ZodObject<{
                     name: z.ZodString;
                     appSlug: z.ZodNullable<z.ZodString>;
                     state: z.ZodEnum<{
+                        error: "error";
                         success: "success";
                         failure: "failure";
-                        error: "error";
                         completed: "completed";
                         pending: "pending";
                         missing: "missing";

package/dist/cli.js

@@ -455,7 +455,7 @@ import "dotenv/config";
 // package.json
 var package_default = {
   name: "@smartergpt/lexrunner",
-  version: "1.5.1",
+  version: "1.5.2",
   type: "module",
   engines: {
     node: ">=24"
@@ -586,7 +586,7 @@ var package_default = {
     "@modelcontextprotocol/sdk": "^1.18.2",
     "@octokit/auth-token": "^6.0.0",
     "@octokit/rest": "^22.0.0",
-    "@smartergpt/lex": "^4.0.0",
+    "@smartergpt/lex": "4.0.3",
     "@types/babel__traverse": "^7.28.0",
     ajv: "^8.20.0",
     "better-sqlite3-multiple-ciphers": "^12.6.2",

package/dist/errors/index.cjs

@@ -133,6 +133,10 @@ var CONFIG_ERROR_CODES = {
 var POLICY_ERROR_CODES = {
   /** No policy file found in any search path */
   POLICY_NOT_FOUND: "POLICY_NOT_FOUND",
+  /** A policy output already exists and overwrite was not explicit */
+  POLICY_ALREADY_EXISTS: "POLICY_ALREADY_EXISTS",
+  /** A constrained policy source directory resolves outside the repository */
+  POLICY_SOURCE_DIR_OUTSIDE_ROOT: "POLICY_SOURCE_DIR_OUTSIDE_ROOT",
   /** Policy file exists but has invalid JSON */
   POLICY_PARSE_ERROR: "POLICY_PARSE_ERROR",
   /** Policy file fails schema validation */

package/dist/frames/index.cjs

@@ -9913,6 +9913,10 @@ var CONFIG_ERROR_CODES = {
 var POLICY_ERROR_CODES = {
   /** No policy file found in any search path */
   POLICY_NOT_FOUND: "POLICY_NOT_FOUND",
+  /** A policy output already exists and overwrite was not explicit */
+  POLICY_ALREADY_EXISTS: "POLICY_ALREADY_EXISTS",
+  /** A constrained policy source directory resolves outside the repository */
+  POLICY_SOURCE_DIR_OUTSIDE_ROOT: "POLICY_SOURCE_DIR_OUTSIDE_ROOT",
   /** Policy file exists but has invalid JSON */
   POLICY_PARSE_ERROR: "POLICY_PARSE_ERROR",
   /** Policy file fails schema validation */
@@ -10436,7 +10440,10 @@ var CLI_CAPABILITIES = Object.freeze({
   check: Object.freeze([]),
   timeline: Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_READ]),
   "frames:export": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_READ]),
-  "frames:import": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_WRITE]),
+  "frames:import": Object.freeze([
+    RUNTIME_OPERATION_CAPABILITIES.FRAME_READ,
+    RUNTIME_OPERATION_CAPABILITIES.FRAME_WRITE
+  ]),
   "db:vacuum": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_ADMIN]),
   "db:backup": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_ADMIN]),
   "db:repair": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_ADMIN]),
@@ -10447,6 +10454,7 @@ var CLI_CAPABILITIES = Object.freeze({
   "db:encrypt": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_ADMIN]),
   "db:stats": Object.freeze([RUNTIME_OPERATION_CAPABILITIES.FRAME_READ]),
   "policy:check": Object.freeze([]),
+  "policy:generate": Object.freeze([]),
   "policy:add-module": Object.freeze([]),
   "instructions:init": Object.freeze([]),
   "instructions:generate": Object.freeze([]),
@@ -10936,6 +10944,7 @@ var FrameSpendMetadata = import_zod5.z.object({
   prompts: import_zod5.z.number().optional(),
   tokens_estimated: import_zod5.z.number().optional()
 });
+var CallerProvenance = import_zod5.z.record(import_zod5.z.string(), import_zod5.z.json());
 var ModuleAttribution = import_zod5.z.object({
   mode: import_zod5.z.enum(["explicit", "inferred", "fallback"]),
   confidence: import_zod5.z.enum(["high", "medium", "low"]),
@@ -10966,7 +10975,8 @@ var FrameStatusSnapshot = import_zod5.z.object({
   next_action: import_zod5.z.string(),
   blockers: import_zod5.z.array(import_zod5.z.string()).optional(),
   merge_blockers: import_zod5.z.array(import_zod5.z.string()).optional(),
-  tests_failing: import_zod5.z.array(import_zod5.z.string()).optional()
+  tests_failing: import_zod5.z.array(import_zod5.z.string()).optional(),
+  provenance: CallerProvenance.optional()
 });
 var CapabilityTier = import_zod5.z.enum(["senior", "mid", "junior"]);
 var TaskComplexity = import_zod5.z.object({
@@ -10994,7 +11004,7 @@ var Frame = import_zod5.z.object({
   status_snapshot: FrameStatusSnapshot,
   keywords: import_zod5.z.array(import_zod5.z.string()).optional(),
   atlas_frame_id: import_zod5.z.string().optional(),
-  // Link to Atlas Frame (spatial neighborhood)
+  // Legacy Policy Neighborhood snapshot reference
   feature_flags: import_zod5.z.array(import_zod5.z.string()).optional(),
   permissions: import_zod5.z.array(import_zod5.z.string()).optional(),
   module_attribution: ModuleAttribution.optional(),
@@ -11218,6 +11228,13 @@ var COMPATIBILITY_OBJECTS = Object.freeze({
 
 // node_modules/@smartergpt/lex/dist/memory/store/postgres/scoped-frame-store.js
 var import_node_crypto14 = require("crypto");
+var FRAME_STORE_PROTECTED_RELATIONS = Object.freeze([
+  "frames",
+  "lex_frame_store_migrations",
+  "lex_frame_store_unowned_frames_v1",
+  "lex_frame_store_recovery_operations",
+  "lex_frame_store_recovery_assignments"
+]);
 
 // node_modules/@smartergpt/lex/dist/memory/store/postgres/behavioral-store.js
 var import_node_crypto15 = require("crypto");

package/dist/sdk/index.d.ts

@@ -62,8 +62,8 @@ type GateStatus = z.infer<typeof GateStatus>;
  * Merge status
  */
 declare const MergeStatus: z.ZodEnum<{
-    success: "success";
     error: "error";
+    success: "success";
     conflict: "conflict";
 }>;
 type MergeStatus = z.infer<typeof MergeStatus>;
@@ -71,8 +71,8 @@ type MergeStatus = z.infer<typeof MergeStatus>;
  * Audit profile
  */
 declare const AuditProfile: z.ZodEnum<{
-    debug: "debug";
     basic: "basic";
+    debug: "debug";
     standard: "standard";
     compliance: "compliance";
 }>;
@@ -167,8 +167,8 @@ type MergeDryRunStartedPayload = z.infer<typeof MergeDryRunStartedPayload>;
 declare const MergeDryRunFinishedPayload: z.ZodObject<{
     item: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
     status: z.ZodEnum<{
-        success: "success";
         error: "error";
+        success: "success";
         conflict: "conflict";
     }>;
     conflicts: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -188,8 +188,8 @@ type MergeConflictDetectedPayload = z.infer<typeof MergeConflictDetectedPayload>
 declare const MergeFinishedPayload: z.ZodObject<{
     item: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
     status: z.ZodEnum<{
-        success: "success";
         error: "error";
+        success: "success";
         conflict: "conflict";
     }>;
     commit: z.ZodOptional<z.ZodString>;
@@ -595,8 +595,8 @@ declare const MergeDryRunFinishedEvent: z.ZodObject<{
     payload: z.ZodObject<{
         item: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
         status: z.ZodEnum<{
-            success: "success";
             error: "error";
+            success: "success";
             conflict: "conflict";
         }>;
         conflicts: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -718,8 +718,8 @@ declare const MergeFinishedEvent: z.ZodObject<{
     payload: z.ZodObject<{
         item: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
         status: z.ZodEnum<{
-            success: "success";
             error: "error";
+            success: "success";
             conflict: "conflict";
         }>;
         commit: z.ZodOptional<z.ZodString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartergpt/lexrunner",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -131,7 +131,7 @@
     "@modelcontextprotocol/sdk": "^1.18.2",
     "@octokit/auth-token": "^6.0.0",
     "@octokit/rest": "^22.0.0",
-    "@smartergpt/lex": "^4.0.0",
+    "@smartergpt/lex": "4.0.3",
     "@types/babel__traverse": "^7.28.0",
     "ajv": "^8.20.0",
     "better-sqlite3-multiple-ciphers": "^12.6.2",