@wix/pathgrade 1.0.25 → 1.0.26

package/dist/internal/direct-mcp-v2/codex-profile.js

@@ -0,0 +1,81 @@
+import { access, realpath } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { delimiter, join } from 'node:path';
+export const CODEX_DIRECT_MCP_NORMALIZED_HANDSHAKE = {
+    normalizerVersion: 1,
+    provider: 'codex',
+    controlPlane: 'app-server',
+    streamableHttp: true,
+    controlPlaneHeaders: true,
+    cancellation: 'turn-interrupt',
+    protocolMethods: ['mcpServer/tool/call', 'thread/start', 'turn/interrupt'],
+};
+/** Reviewed macOS arm64 pin captured by RFC 0006. Other platforms fail closed. */
+export const CODEX_DIRECT_MCP_DARWIN_ARM64_PROFILE = {
+    format: 'pathgrade-direct-mcp-runtime-profile-v1',
+    provider: 'codex',
+    platform: 'darwin',
+    architecture: 'arm64',
+    controlPlane: 'app-server',
+    command: {
+        absolutePath: '/Applications/ChatGPT.app/Contents/Resources/codex',
+        args: [],
+        versionArgs: ['--version'],
+    },
+    expectedVersion: 'codex-cli 0.151.0-alpha.7.1',
+    artifacts: [{
+            label: 'codex-cli-0.151.0-alpha.7.1',
+            absolutePath: '/Applications/ChatGPT.app/Contents/Resources/codex',
+            sha256: 'a5976fd714dc0801a6f40e0e2b3051f64f1e0468f6c0f279b7d2a7afb7623f43',
+        }],
+    requiredCapabilities: {
+        streamableHttp: true,
+        controlPlaneHeaders: true,
+        cancellation: 'turn-interrupt',
+    },
+    profileFingerprint: '79ed563e36c65404b385e2a8ebd1c02e33e4c6f86dac589a94b32d4a0cf7f169',
+    runtimeCapabilityFingerprint: '2ea3ca12b39fb6de97464ab539be3986d5fe2f9fda51b718198128a55ba11f27',
+};
+/** Code-owned relocatable identity lock for the admitted public Codex slice. */
+export const CODEX_DIRECT_MCP_DARWIN_ARM64_LOCK = {
+    format: 'pathgrade-direct-mcp-runtime-lock-v1',
+    provider: 'codex',
+    platform: 'darwin',
+    architecture: 'arm64',
+    controlPlane: 'app-server',
+    version: CODEX_DIRECT_MCP_DARWIN_ARM64_PROFILE.expectedVersion,
+    commandArtifact: 'codex-cli-0.151.0-alpha.7.1',
+    args: CODEX_DIRECT_MCP_DARWIN_ARM64_PROFILE.command.args,
+    versionArgs: CODEX_DIRECT_MCP_DARWIN_ARM64_PROFILE.command.versionArgs,
+    artifacts: [{
+            id: 'codex-cli-0.151.0-alpha.7.1',
+            relativePath: 'codex',
+            sha256: CODEX_DIRECT_MCP_DARWIN_ARM64_PROFILE.artifacts[0].sha256,
+        }],
+    capabilities: CODEX_DIRECT_MCP_DARWIN_ARM64_PROFILE.requiredCapabilities,
+    normalizedHandshakeSha256: CODEX_DIRECT_MCP_DARWIN_ARM64_PROFILE.runtimeCapabilityFingerprint,
+};
+/**
+ * Resolve one Codex candidate before admission. Selection is deterministic;
+ * identity failure never falls through to another process.
+ */
+export async function resolveCodexScenarioExecutable(environment) {
+    const bundled = CODEX_DIRECT_MCP_DARWIN_ARM64_PROFILE.command.absolutePath;
+    if (await isExecutable(bundled))
+        return realpath(bundled);
+    for (const directory of (environment.PATH ?? '').split(delimiter).filter(Boolean)) {
+        const candidate = join(directory, 'codex');
+        if (await isExecutable(candidate))
+            return realpath(candidate);
+    }
+    throw new Error('RUNTIME_NOT_ADMITTED: no Codex executable was discovered');
+}
+async function isExecutable(path) {
+    try {
+        await access(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/internal/direct-mcp-v2/compiler.d.ts

@@ -0,0 +1,12 @@
+import type { JsonObject, MatchExpr, ScenarioArtifact, ScenarioDiagnostic } from './types.js';
+export type CompileScenarioResult = {
+    ok: true;
+    artifact: ScenarioArtifact;
+} | {
+    ok: false;
+    diagnostics: ScenarioDiagnostic[];
+};
+export declare function matchExpression(args: JsonObject, expression: MatchExpr): boolean;
+export declare function compileScenario(source: unknown): CompileScenarioResult;
+export declare function compileScenarioText(text: string): CompileScenarioResult;
+export declare function isSha256(value: unknown): value is string;

package/dist/internal/direct-mcp-v2/compiler.js

@@ -0,0 +1,449 @@
+/* oxlint-disable anti-slop/no-unknown-parameters, anti-slop/no-unsafe-dictionary-type, anti-slop/no-runtime-typeof -- This module is the strict I/O-boundary parser for untrusted scenario JSON. */
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { canonicalJson, MISSING, parsePointer, parseStrictJson, resolvePointer, sha256Canonical } from './json.js';
+const ID = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const ajv = new Ajv2020({ allErrors: true, strict: true, validateFormats: false });
+function object(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function diag(list, code, path, message) {
+    list.push({ code, path, message });
+}
+function exactKeys(value, allowed, path, diagnostics) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key))
+            diag(diagnostics, 'UNKNOWN_FIELD', `${path}/${key}`, `unknown field ${key}`);
+    }
+}
+function validId(value, path, diagnostics) {
+    if (typeof value !== 'string' || !ID.test(value)) {
+        diag(diagnostics, 'INVALID_ID', path, 'expected an ID matching ^[A-Za-z][A-Za-z0-9_-]{0,63}$');
+        return false;
+    }
+    return true;
+}
+function inspectSchema(schema, path, diagnostics) {
+    if (schema.type !== 'object')
+        diag(diagnostics, 'INVALID_SCHEMA_ROOT', path, 'inputSchema root type must be object');
+    const walk = (value, current) => {
+        if (Array.isArray(value))
+            return value.forEach((entry, index) => walk(entry, `${current}/${index}`));
+        if (!object(value))
+            return;
+        for (const [key, entry] of Object.entries(value)) {
+            const entryPath = `${current}/${key}`;
+            if (key === '$dynamicRef' || key === '$dynamicAnchor' || key === '$vocabulary' || key === 'format') {
+                diag(diagnostics, 'UNSUPPORTED_SCHEMA_KEYWORD', entryPath, `${key} is not admitted in v2`);
+            }
+            if (key === '$ref' && (typeof entry !== 'string' || !entry.startsWith('#/'))) {
+                diag(diagnostics, 'REMOTE_SCHEMA_REFERENCE', entryPath, 'only local $defs references are admitted');
+            }
+            walk(entry, entryPath);
+        }
+    };
+    walk(schema, path);
+    try {
+        if (!ajv.validateSchema(schema)) {
+            for (const error of ajv.errors ?? []) {
+                diag(diagnostics, 'INVALID_JSON_SCHEMA', `${path}${error.instancePath}`, `${error.keyword}: ${error.message ?? 'invalid schema'}`);
+            }
+        }
+        else {
+            ajv.compile(schema);
+        }
+    }
+    catch (error) {
+        diag(diagnostics, 'INVALID_JSON_SCHEMA', path, error instanceof Error ? error.message : String(error));
+    }
+}
+function validateOutcome(value, path, diagnostics) {
+    if (!object(value) || (value.kind !== 'success' && value.kind !== 'tool-error')) {
+        diag(diagnostics, 'INVALID_OUTCOME', path, 'expected success or tool-error outcome');
+        return false;
+    }
+    if (value.kind === 'success') {
+        exactKeys(value, ['kind', 'content', 'structuredContent'], path, diagnostics);
+        if (!Array.isArray(value.content) || value.content.some((entry) => !object(entry) || typeof entry.type !== 'string')) {
+            diag(diagnostics, 'INVALID_OUTCOME', `${path}/content`, 'success content must be MCP content objects');
+            return false;
+        }
+        if (value.structuredContent !== undefined && !object(value.structuredContent)) {
+            diag(diagnostics, 'INVALID_OUTCOME', `${path}/structuredContent`, 'structuredContent must be an object');
+            return false;
+        }
+        return true;
+    }
+    exactKeys(value, ['kind', 'code', 'message', 'data'], path, diagnostics);
+    if (typeof value.code !== 'string' || typeof value.message !== 'string' || (value.data !== undefined && !object(value.data))) {
+        diag(diagnostics, 'INVALID_OUTCOME', path, 'tool-error requires string code/message and optional object data');
+        return false;
+    }
+    return true;
+}
+function validateMatch(value, path, diagnostics) {
+    if (!object(value)) {
+        diag(diagnostics, 'INVALID_MATCH', path, 'match expression must be an object');
+        return false;
+    }
+    exactKeys(value, ['exactArgs', 'all'], path, diagnostics);
+    if ('exactArgs' in value) {
+        if ('all' in value || !object(value.exactArgs)) {
+            diag(diagnostics, 'INVALID_MATCH', path, 'exactArgs must be the only match operator and must be an object');
+            return false;
+        }
+        return true;
+    }
+    if (!Array.isArray(value.all) || value.all.length === 0) {
+        diag(diagnostics, 'INVALID_MATCH', `${path}/all`, 'all must be a non-empty array');
+        return false;
+    }
+    const pointers = new Set();
+    let valid = true;
+    for (const [index, raw] of value.all.entries()) {
+        const predicatePath = `${path}/all/${index}`;
+        if (!object(raw) || typeof raw.pointer !== 'string') {
+            diag(diagnostics, 'INVALID_MATCH_PREDICATE', predicatePath, 'predicate requires a JSON Pointer');
+            valid = false;
+            continue;
+        }
+        try {
+            parsePointer(raw.pointer);
+        }
+        catch (error) {
+            diag(diagnostics, 'INVALID_JSON_POINTER', `${predicatePath}/pointer`, error instanceof Error ? error.message : String(error));
+            valid = false;
+        }
+        if (pointers.has(raw.pointer)) {
+            diag(diagnostics, 'DUPLICATE_MATCH_POINTER', `${predicatePath}/pointer`, 'all entries require unique pointers');
+            valid = false;
+        }
+        pointers.add(raw.pointer);
+        const operators = ['equals', 'present', 'absent'].filter((key) => key in raw);
+        if (operators.length !== 1 || (raw.present !== undefined && raw.present !== true) || (raw.absent !== undefined && raw.absent !== true)) {
+            diag(diagnostics, 'INVALID_MATCH_PREDICATE', predicatePath, 'predicate requires exactly one of equals, present:true, absent:true');
+            valid = false;
+        }
+        exactKeys(raw, ['pointer', ...operators], predicatePath, diagnostics);
+    }
+    if (valid) {
+        // SAFETY: every entry was validated above as an object with a valid pointer and exactly one admitted operator.
+        const predicates = value.all;
+        for (let left = 0; left < predicates.length; left += 1)
+            for (let right = left + 1; right < predicates.length; right += 1) {
+                if (predicatesContradict(predicates[left], predicates[right])) {
+                    diag(diagnostics, 'CONTRADICTORY_MATCH', path, `predicates at indexes ${left} and ${right} contradict`);
+                    valid = false;
+                }
+            }
+    }
+    return valid;
+}
+function predicateMatches(args, predicate) {
+    const actual = resolvePointer(args, predicate.pointer);
+    if ('present' in predicate)
+        return actual !== MISSING;
+    if ('absent' in predicate)
+        return actual === MISSING;
+    return actual !== MISSING && canonicalJson(actual) === canonicalJson(predicate.equals);
+}
+export function matchExpression(args, expression) {
+    if ('exactArgs' in expression)
+        return canonicalJson(args) === canonicalJson(expression.exactArgs);
+    return expression.all.every((predicate) => predicateMatches(args, predicate));
+}
+function pointerAncestor(left, right) {
+    return right.startsWith(`${left}/`);
+}
+function predicatesContradict(left, right) {
+    if (left.pointer === right.pointer) {
+        if (('absent' in left && !('absent' in right)) || ('absent' in right && !('absent' in left)))
+            return true;
+        return 'equals' in left && 'equals' in right && canonicalJson(left.equals) !== canonicalJson(right.equals);
+    }
+    const ancestor = pointerAncestor(left.pointer, right.pointer) ? left : pointerAncestor(right.pointer, left.pointer) ? right : undefined;
+    const descendant = ancestor === left ? right : ancestor === right ? left : undefined;
+    if (!ancestor || !descendant)
+        return false;
+    if ('absent' in ancestor)
+        return !('absent' in descendant);
+    if (!('equals' in ancestor))
+        return false;
+    const suffix = descendant.pointer.slice(ancestor.pointer.length);
+    const actual = resolvePointer(ancestor.equals, suffix);
+    if ('present' in descendant)
+        return actual === MISSING;
+    if ('absent' in descendant)
+        return actual !== MISSING;
+    return actual === MISSING || canonicalJson(actual) !== canonicalJson(descendant.equals);
+}
+function allPairDisjoint(left, right) {
+    for (const a of left)
+        for (const b of right) {
+            if (predicatesContradict(a, b))
+                return true;
+        }
+    return 'unknown';
+}
+function pairDisjoint(left, right) {
+    if ('exactArgs' in left)
+        return matchExpression(left.exactArgs, right) ? 'unknown' : true;
+    if ('exactArgs' in right)
+        return matchExpression(right.exactArgs, left) ? 'unknown' : true;
+    return allPairDisjoint(left.all, right.all);
+}
+function defaultRejection(qualifiedToolId) {
+    return { id: `NoMatch_${qualifiedToolId.replace('/', '_')}`, code: 'SCENARIO_NO_MATCH', message: `No scenario case matched ${qualifiedToolId}` };
+}
+function sortRecord(value) {
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, value[key]]));
+}
+function applyRules(rules, diagnostics) {
+    for (const rule of rules.filter((entry) => entry.invalid))
+        diag(diagnostics, rule.code, rule.path, rule.message);
+}
+function validateSource(source, diagnostics) {
+    exactKeys(source, ['version', 'scenarioId', 'initialState', 'servers', 'states', 'concurrency'], '$', diagnostics);
+    const servers = object(source.servers) ? source.servers : {};
+    const states = object(source.states) ? source.states : {};
+    applyRules([
+        { invalid: source.version !== 2, code: 'INVALID_VERSION', path: '$/version', message: 'version must be 2' },
+        { invalid: source.concurrency !== 'poison-effectful-overlap', code: 'INVALID_CONCURRENCY', path: '$/concurrency', message: 'unsupported concurrency policy' },
+        { invalid: !object(source.servers) || Object.keys(servers).length === 0, code: 'INVALID_SERVERS', path: '$/servers', message: 'servers must be a non-empty object' },
+        { invalid: !object(source.states) || Object.keys(states).length === 0, code: 'INVALID_STATES', path: '$/states', message: 'states must be a non-empty object' },
+    ], diagnostics);
+    validId(source.scenarioId, '$/scenarioId', diagnostics);
+    validId(source.initialState, '$/initialState', diagnostics);
+    return { servers, states };
+}
+function validateServers(servers, diagnostics) {
+    for (const [serverId, rawServer] of Object.entries(servers)) {
+        const serverPath = `$/servers/${serverId}`;
+        validId(serverId, `$/servers/${serverId}`, diagnostics);
+        if (!object(rawServer)) {
+            diag(diagnostics, 'INVALID_SERVER', serverPath, 'server must be an object');
+            continue;
+        }
+        exactKeys(rawServer, ['instructions', 'tools'], serverPath, diagnostics);
+        applyRules([{ invalid: rawServer.instructions !== undefined && typeof rawServer.instructions !== 'string', code: 'INVALID_SERVER', path: `${serverPath}/instructions`, message: 'instructions must be a string' }], diagnostics);
+        const tools = object(rawServer.tools) ? rawServer.tools : {};
+        if (!object(rawServer.tools) || Object.keys(tools).length === 0) {
+            diag(diagnostics, 'INVALID_TOOLS', `${serverPath}/tools`, 'tools must be a non-empty object');
+            continue;
+        }
+        validateTools(tools, serverPath, diagnostics);
+    }
+}
+function validateTools(tools, serverPath, diagnostics) {
+    for (const [toolId, rawTool] of Object.entries(tools)) {
+        const toolPath = `${serverPath}/tools/${toolId}`;
+        validId(toolId, toolPath, diagnostics);
+        if (!object(rawTool)) {
+            diag(diagnostics, 'INVALID_TOOL', toolPath, 'tool must be an object');
+            continue;
+        }
+        exactKeys(rawTool, ['description', 'inputSchema'], toolPath, diagnostics);
+        applyRules([{ invalid: typeof rawTool.description !== 'string', code: 'INVALID_TOOL', path: `${toolPath}/description`, message: 'description must be a string' }], diagnostics);
+        if (!object(rawTool.inputSchema))
+            diag(diagnostics, 'INVALID_JSON_SCHEMA', `${toolPath}/inputSchema`, 'inputSchema must be an object');
+        else {
+            // SAFETY: object() established the JSON object representation; canonicalJson already rejected non-JSON values.
+            inspectSchema(rawTool.inputSchema, `${toolPath}/inputSchema`, diagnostics);
+        }
+    }
+}
+function validateStates(parts, initialState, diagnostics) {
+    const transitions = new Map(Object.keys(parts.states).map((stateId) => [stateId, new Set()]));
+    const transitionTools = new Set();
+    const context = { ...parts, transitions, transitionTools, diagnostics };
+    for (const [stateId, rawState] of Object.entries(parts.states))
+        validateState(stateId, rawState, context);
+    return { ...parts, transitionTools, reachable: collectReachable(parts.states, transitions, initialState, diagnostics) };
+}
+function validateState(stateId, rawState, context) {
+    const statePath = `$/states/${stateId}`;
+    validId(stateId, statePath, context.diagnostics);
+    if (!object(rawState)) {
+        diag(context.diagnostics, 'INVALID_STATE', statePath, 'state must be an object');
+        return;
+    }
+    exactKeys(rawState, ['tools'], statePath, context.diagnostics);
+    if (!object(rawState.tools)) {
+        diag(context.diagnostics, 'INVALID_STATE_TOOLS', `${statePath}/tools`, 'tools must be an object');
+        return;
+    }
+    for (const [qualifiedToolId, rawDecision] of Object.entries(rawState.tools)) {
+        validateDecisionTable(stateId, qualifiedToolId, rawDecision, context);
+    }
+}
+function validateDecisionTable(stateId, qualifiedToolId, rawDecision, context) {
+    const path = `$/states/${stateId}/tools/${qualifiedToolId}`;
+    validateQualifiedTool(qualifiedToolId, path, context.servers, context.diagnostics);
+    if (!object(rawDecision)) {
+        diag(context.diagnostics, 'INVALID_DECISION_TABLE', path, 'decision table must be an object');
+        return;
+    }
+    exactKeys(rawDecision, ['cases', 'otherwise'], path, context.diagnostics);
+    if (!Array.isArray(rawDecision.cases)) {
+        diag(context.diagnostics, 'INVALID_CASES', `${path}/cases`, 'cases must be an array');
+        return;
+    }
+    const caseIds = new Set();
+    const validCases = rawDecision.cases.flatMap((rawCase, index) => {
+        const validCase = validateCase(rawCase, `${path}/cases/${index}`, stateId, qualifiedToolId, caseIds, context);
+        return validCase ? [validCase] : [];
+    });
+    validateCaseDisjointness(validCases, path, context.diagnostics);
+    validateOtherwise(rawDecision.otherwise, path, context.diagnostics);
+}
+function validateQualifiedTool(qualifiedToolId, path, servers, diagnostics) {
+    const segments = qualifiedToolId.split('/');
+    if (segments.length !== 2 || !ID.test(segments[0]) || !ID.test(segments[1])) {
+        diag(diagnostics, 'INVALID_QUALIFIED_TOOL_ID', path, 'expected <serverId>/<toolId>');
+        return;
+    }
+    const server = servers[segments[0]];
+    const tools = object(server) && object(server.tools) ? server.tools : {};
+    if (!object(tools[segments[1]]))
+        diag(diagnostics, 'UNKNOWN_TOOL_REFERENCE', path, `tool ${qualifiedToolId} is not declared`);
+}
+function validateCase(rawCase, casePath, stateId, qualifiedToolId, caseIds, context) {
+    if (!object(rawCase)) {
+        diag(context.diagnostics, 'INVALID_CASE', casePath, 'case must be an object');
+        return undefined;
+    }
+    exactKeys(rawCase, ['id', 'when', 'outcome', 'transition'], casePath, context.diagnostics);
+    validateCaseId(rawCase.id, casePath, caseIds, context.diagnostics);
+    const matchValid = validateMatch(rawCase.when, `${casePath}/when`, context.diagnostics);
+    const outcomeValid = validateOutcome(rawCase.outcome, `${casePath}/outcome`, context.diagnostics);
+    validateTransition(rawCase, casePath, stateId, qualifiedToolId, context);
+    if (!matchValid || !outcomeValid)
+        return undefined;
+    // SAFETY: ID, match, outcome, transition, and exact keys were validated above.
+    // oxlint-disable-next-line anti-slop/no-chained-type-assertions -- Record validation establishes the complete ScenarioCase contract.
+    return rawCase;
+}
+function validateCaseId(value, casePath, caseIds, diagnostics) {
+    if (!validId(value, `${casePath}/id`, diagnostics))
+        return;
+    if (caseIds.has(value))
+        diag(diagnostics, 'DUPLICATE_CASE_ID', `${casePath}/id`, `duplicate case ID ${value}`);
+    caseIds.add(value);
+}
+function validateTransition(rawCase, casePath, stateId, qualifiedToolId, context) {
+    if (rawCase.transition === undefined)
+        return;
+    const transition = rawCase.transition;
+    if (!object(transition) || !validId(transition.to, `${casePath}/transition/to`, context.diagnostics)) {
+        diag(context.diagnostics, 'INVALID_TRANSITION', `${casePath}/transition`, 'transition requires a valid target state');
+    }
+    else if (!object(context.states[transition.to])) {
+        diag(context.diagnostics, 'UNKNOWN_TRANSITION_TARGET', `${casePath}/transition/to`, `unknown state ${transition.to}`);
+    }
+    else {
+        context.transitions.get(stateId)?.add(transition.to);
+        context.transitionTools.add(qualifiedToolId);
+    }
+    if (object(rawCase.outcome) && rawCase.outcome.kind === 'tool-error')
+        diag(context.diagnostics, 'ERROR_TRANSITION', casePath, 'tool-error cases cannot transition');
+}
+function validateCaseDisjointness(validCases, path, diagnostics) {
+    for (const [leftIndex, left] of validCases.entries()) {
+        for (const right of validCases.slice(leftIndex + 1)) {
+            if (pairDisjoint(left.when, right.when) !== true)
+                diag(diagnostics, 'CASE_OVERLAP_UNPROVEN', `${path}/cases`, `cases ${left.id} and ${right.id} are overlapping or not provably disjoint`);
+        }
+    }
+}
+function validateOtherwise(value, path, diagnostics) {
+    if (value === undefined)
+        return;
+    if (!object(value) || !validId(value.id, `${path}/otherwise/id`, diagnostics) || value.code !== 'SCENARIO_NO_MATCH' || typeof value.message !== 'string') {
+        diag(diagnostics, 'INVALID_OTHERWISE', `${path}/otherwise`, 'otherwise requires id, SCENARIO_NO_MATCH code, and message');
+        return;
+    }
+    exactKeys(value, ['id', 'code', 'message'], `${path}/otherwise`, diagnostics);
+}
+function collectReachable(states, transitions, initialState, diagnostics) {
+    const reachable = new Set();
+    const queue = initialState && object(states[initialState]) ? [initialState] : [];
+    while (queue.length > 0) {
+        const state = queue.shift();
+        if (reachable.has(state))
+            continue;
+        reachable.add(state);
+        queue.push(...(transitions.get(state) ?? []));
+    }
+    for (const stateId of Object.keys(states))
+        if (!reachable.has(stateId))
+            diag(diagnostics, 'UNREACHABLE_STATE', `$/states/${stateId}`, `state ${stateId} is unreachable`);
+    return reachable;
+}
+function validateInitialState(source, states, diagnostics) {
+    const initialState = typeof source.initialState === 'string' ? source.initialState : undefined;
+    if (initialState && !object(states[initialState]))
+        diag(diagnostics, 'UNKNOWN_INITIAL_STATE', '$/initialState', 'initialState is not declared');
+    return initialState;
+}
+function buildArtifact(source, graph) {
+    // SAFETY: buildArtifact runs only when every ScenarioMachineV2 field has passed the validators above.
+    // oxlint-disable-next-line anti-slop/no-chained-type-assertions -- The parser intentionally narrows its fully validated input once at this boundary.
+    const typed = source;
+    const compiledStates = {};
+    for (const stateId of Object.keys(typed.states).sort()) {
+        const typedState = typed.states[stateId];
+        const tools = {};
+        for (const qualifiedToolId of Object.keys(typedState.tools).sort()) {
+            const decision = typedState.tools[qualifiedToolId];
+            const [serverId, toolId] = qualifiedToolId.split('/');
+            tools[qualifiedToolId] = {
+                qualifiedToolId,
+                serverId,
+                toolId,
+                cases: [...decision.cases].sort((a, b) => a.id.localeCompare(b.id, 'en')),
+                otherwise: decision.otherwise ?? defaultRejection(qualifiedToolId),
+                effectful: graph.transitionTools.has(qualifiedToolId),
+            };
+        }
+        compiledStates[stateId] = { tools };
+    }
+    const canonicalIr = {
+        version: 2,
+        scenarioId: typed.scenarioId,
+        initialState: typed.initialState,
+        servers: sortRecord(Object.fromEntries(Object.entries(typed.servers).map(([serverId, server]) => [serverId, { ...server, tools: sortRecord(server.tools) }]))),
+        states: compiledStates,
+        reachableStates: [...graph.reachable].sort(),
+        concurrency: typed.concurrency,
+    };
+    const format = 'pathgrade-scenario-machine-v2';
+    return { format, canonicalIr, artifactDigest: sha256Canonical({ format, canonicalIr }) };
+}
+export function compileScenario(source) {
+    try {
+        canonicalJson(source);
+    }
+    catch (error) {
+        return { ok: false, diagnostics: [{ code: 'INVALID_JSON_VALUE', path: '$', message: error instanceof Error ? error.message : String(error) }] };
+    }
+    if (!object(source))
+        return { ok: false, diagnostics: [{ code: 'INVALID_SOURCE', path: '$', message: 'scenario must be an object' }] };
+    const diagnostics = [];
+    const parts = validateSource(source, diagnostics);
+    validateServers(parts.servers, diagnostics);
+    const initialState = validateInitialState(source, parts.states, diagnostics);
+    const graph = validateStates(parts, initialState, diagnostics);
+    diagnostics.sort((a, b) => canonicalJson(a).localeCompare(canonicalJson(b), 'en'));
+    return diagnostics.length > 0 ? { ok: false, diagnostics } : { ok: true, artifact: buildArtifact(source, graph) };
+}
+export function compileScenarioText(text) {
+    try {
+        return compileScenario(parseStrictJson(text));
+    }
+    catch (error) {
+        return { ok: false, diagnostics: [{ code: 'INVALID_JSON_TEXT', path: '$', message: error instanceof Error ? error.message : String(error) }] };
+    }
+}
+export function isSha256(value) {
+    return typeof value === 'string' && SHA256.test(value);
+}

package/dist/internal/direct-mcp-v2/cursor-direct-mcp.d.ts

@@ -0,0 +1,14 @@
+import { runAcpDirectMcpTrial, type AcpDirectMcpTrialResult } from './acp-direct-mcp.js';
+import type { ScenarioMachineV2 } from './types.js';
+export declare const CURSOR_DIRECT_MCP_FLAG = "PATHGRADE_INTERNAL_CURSOR_DIRECT_MCP_V2";
+export declare function isCursorDirectMcpSelected(environment?: NodeJS.ProcessEnv): boolean;
+export declare function cursorDirectMcpDisableReason(): string | undefined;
+/** Test-only reset for proving the fail-closed process latch. */
+export declare function __resetCursorDirectMcpDisablementForTesting(): void;
+export declare function mapCursorProviderEnvironment(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function runCursorDirectMcpTrial(options: {
+    scenario: ScenarioMachineV2;
+    environment?: NodeJS.ProcessEnv;
+    artifactDirectory?: string;
+    createClient?: Parameters<typeof runAcpDirectMcpTrial>[0]['createClient'];
+}): Promise<AcpDirectMcpTrialResult>;

package/dist/internal/direct-mcp-v2/cursor-direct-mcp.js

@@ -0,0 +1,60 @@
+import { join } from 'node:path';
+import { defaultPorts } from '../../providers/credentials.js';
+import { curateAcpProcessEnvironment, runAcpDirectMcpTrial } from './acp-direct-mcp.js';
+import { CURSOR_DIRECT_MCP_DARWIN_ARM64_PROFILE } from './cursor-profile.js';
+export const CURSOR_DIRECT_MCP_FLAG = 'PATHGRADE_INTERNAL_CURSOR_DIRECT_MCP_V2';
+const disabledProfiles = new Map();
+export function isCursorDirectMcpSelected(environment = process.env) {
+    return environment[CURSOR_DIRECT_MCP_FLAG] === '1' && !disabledProfiles.has(CURSOR_DIRECT_MCP_DARWIN_ARM64_PROFILE.profileFingerprint);
+}
+export function cursorDirectMcpDisableReason() {
+    return disabledProfiles.get(CURSOR_DIRECT_MCP_DARWIN_ARM64_PROFILE.profileFingerprint);
+}
+/** Test-only reset for proving the fail-closed process latch. */
+// oxlint-disable-next-line inhuman/no-empty-wrappers -- This test seam exposes Map.clear without exposing mutable production state.
+export function __resetCursorDirectMcpDisablementForTesting() {
+    disabledProfiles.clear();
+}
+export function mapCursorProviderEnvironment(environment) {
+    const result = curateAcpProcessEnvironment(environment);
+    const appApiKey = environment.APP_CURSOR_API_KEY;
+    const appBaseUrl = environment.APP_CURSOR_API_BASE_URL;
+    const apiKey = environment.CURSOR_API_KEY ?? appApiKey;
+    const baseUrl = environment.CURSOR_API_BASE_URL ?? appBaseUrl;
+    if (apiKey)
+        result.CURSOR_API_KEY = apiKey;
+    if (baseUrl)
+        result.CURSOR_API_BASE_URL = baseUrl;
+    return result;
+}
+export async function runCursorDirectMcpTrial(options) {
+    const environment = options.environment ?? process.env;
+    if (!isCursorDirectMcpSelected(environment)) {
+        const reason = cursorDirectMcpDisableReason();
+        throw new Error(reason ? `Cursor direct MCP disabled for admitted profile: ${reason}` : `${CURSOR_DIRECT_MCP_FLAG} is disabled`);
+    }
+    try {
+        const runtimeEnvironment = mapCursorProviderEnvironment(environment);
+        const localHomeLinks = [];
+        if (!runtimeEnvironment.CURSOR_API_KEY) {
+            const ports = defaultPorts();
+            if (ports.platform !== 'darwin' || !await ports.keychainEntryExists('cursor-access-token', 'cursor-user')) {
+                throw new Error('RUNTIME_NOT_ADMITTED: Cursor direct MCP requires CURSOR_API_KEY, APP_CURSOR_API_KEY, or a local cursor-agent OAuth login');
+            }
+            localHomeLinks.push({ relativePath: 'Library/Keychains', hostPath: join(ports.homedir, 'Library/Keychains') });
+        }
+        return await runAcpDirectMcpTrial({
+            provider: 'cursor',
+            scenario: options.scenario,
+            environment: runtimeEnvironment,
+            profile: CURSOR_DIRECT_MCP_DARWIN_ARM64_PROFILE,
+            artifactDirectory: options.artifactDirectory,
+            createClient: options.createClient,
+            localHomeLinks,
+        });
+    }
+    catch (error) {
+        disabledProfiles.set(CURSOR_DIRECT_MCP_DARWIN_ARM64_PROFILE.profileFingerprint, (error instanceof Error ? error.message : String(error)).slice(0, 500));
+        throw error;
+    }
+}

package/dist/internal/direct-mcp-v2/cursor-profile.d.ts

@@ -0,0 +1,38 @@
+import type { AcpNormalizedHandshake } from './acp-client.js';
+import type { RuntimeCapabilityProfile } from './types.js';
+export declare const CURSOR_DIRECT_MCP_NORMALIZED_HANDSHAKE: AcpNormalizedHandshake;
+/** Reviewed macOS arm64 pin captured by RFC 0006. Other platforms fail closed. */
+export declare const CURSOR_DIRECT_MCP_DARWIN_ARM64_PROFILE: RuntimeCapabilityProfile;
+/** Code-owned portable identity for the Cursor ACP author-session slice. */
+export declare const CURSOR_ACP_AUTHOR_DARWIN_ARM64_LOCK: {
+    readonly format: "pathgrade-direct-mcp-runtime-lock-v1";
+    readonly provider: "cursor";
+    readonly platform: "darwin";
+    readonly architecture: "arm64";
+    readonly controlPlane: "acp-v1";
+    readonly version: "2026.06.26-7079533";
+    readonly commandArtifact: "cursor-wrapper";
+    readonly args: readonly ["acp"];
+    readonly versionArgs: readonly ["--version"];
+    readonly artifacts: readonly [{
+        readonly id: "cursor-wrapper";
+        readonly relativePath: "cursor-agent";
+        readonly sha256: "b7babf47d8b1eee28ac27a74affa02a559bb38103a6e71fbb1f120805d51fedf";
+    }, {
+        readonly id: "cursor-index";
+        readonly relativePath: "index.js";
+        readonly sha256: "80eca3cae34cd9af1ee63cdf962eaad42d2a720a2268866e6467aca1b5ab5de0";
+    }, {
+        readonly id: "cursor-node";
+        readonly relativePath: "node";
+        readonly sha256: "336b5b3ebc5deb86df842102b20b6e4761605b7a667823e68dda7761b91a161b";
+    }];
+    readonly capabilities: {
+        readonly streamableHttp: true;
+        readonly controlPlaneHeaders: true;
+        readonly cancellation: "session-cancel";
+    };
+    readonly normalizedHandshakeSha256: "75d455ba86260766996f533485c54657764095af306e72a4f4616b759eedf59b";
+};
+/** Resolve ordinary Cursor command discovery before exact lock admission. */
+export declare function resolveCursorExecutable(environment: Readonly<Record<string, string | undefined>>, command?: string): Promise<string>;