cordisx 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/skills/cordisx-plugin-development/references/live-plugin-development.md

@@ -1,7 +1,56 @@
 # Live CordisX plugin development
 
-Use this workflow when the current session is already attached to a CordisX
-development project.
+Use this workflow when debugging or verifying a CordisX plugin on a Codex Host,
+including when the current session is already attached to a development project.
+
+## Choose debugging tools before accessing the Host
+
+This boundary applies when work accesses a CordisX-launched Codex test instance,
+including startup failures, UI inspection, screenshots, interactions, HMR and
+permission failures. First read the active user, Host, and tool restrictions.
+Use CordisX-owned diagnostics and debugging mechanisms for CordisX runtime
+claims. Computer Use/CUA, desktop automation, or a generic browser must not be
+used as a workaround for an explicit restriction, and generic browser evidence
+does not prove behavior in the native `app://` Host.
+
+1. Identify the authorized test instance from the CordisX launch/config and
+   loaded plugin entry. Check the effective Host/CLI build, profile/data mode
+   and launcher-owned debug target before attaching; a matching window title
+   or an open debug port alone is insufficient.
+2. Use the existing `cordisx dev` session, or its documented development launch
+   when a new instance is needed and within scope. Let CordisX own Host injection,
+   Vite bootstrap and reload. Read launcher/Host logs and plugin generation
+   diagnostics to identify the first failing stage.
+3. For runtime inspection or interaction, use CordisX's documented CDP/debug
+   mechanisms on that verified target within the authorized action scope. Use
+   its Host permission diagnostics to check declarations, capability availability,
+   launcher provenance, grants/denials and generation state. Follow the
+   [native debugging runbook](https://github.com/cordisx/cordisx/blob/main/.agents/docs/native-debugging-runbook.md)
+   and the installed version's references; do not invent a private Host API or
+   move debug access into a plugin as a missing-capability fallback.
+4. Verify the expected plugin/build is loaded, inspect the relevant visible
+   contribution and actual state transition, and check cleanup after HMR,
+   replacement or stop as applicable. Logs saying ready or an HMR notification
+   alone do not prove the repaired interaction. Record the mechanism and evidence
+   scope; if native observation is unavailable, report that gap explicitly.
+
+This tool choice does not bypass a permission boundary. Respect explicit user,
+Host and tool restrictions on the target or action, including a denial that
+applies regardless of the access route; do not retry that denied action via CDP.
+Do not forge grants, bypass Host capability or authorization decisions, patch
+the installed Codex app, or access unrelated profiles, windows or data. The
+[documented launcher-owned native policy setup](verification.md#real-native-app-and-playground)
+is part of the authorized development launch; it cannot override an applicable
+user, Host or tool denial.
+
+If a selected tool is prohibited or unsupported for the target, acknowledge the
+tool-selection error and read the actual restriction before continuing. A
+tool-specific limitation does not by itself establish that the user lacks
+authority to debug their own test instance. Continue through CordisX only when
+the action is independently authorized and no applicable denial prohibits it;
+when a restriction's scope is unclear, stop that action and report the exact
+restriction while continuing permitted source/log checks. Do not turn one
+unavailable tool into a blanket refusal of CordisX debugging.
 
 ## Locate the active project
 
@@ -27,7 +76,7 @@ manager links them through the business project's root lockfile.
 Use public CordisX services and structured Host surfaces. Keep plugin ids equal
 to their config ids, and keep product effects under the owning Cordis lifecycle.
 
-Run the project's normal check. Saving a refresh-compatible React component
+Run checks appropriate to the edit and the next decision. Saving a refresh-compatible React component
 module uses Vite React Fast Refresh. Changes to the plugin entry, manifest,
 `apply`, or another non-refresh boundary may stage and replace that plugin's
 generation. Check the in-product result and cleanup; do not claim success from a
@@ -52,7 +101,13 @@ last-good plugin instead of repeatedly restarting over the diagnostic. A failed
 candidate must not publish delayed work into its successor. If launch itself
 fails, retain the first failure log and identify the failing startup phase
 before retrying; a disconnected debugger alone does not establish the cause.
-Keep an active user preview available while testing a replacement in isolation.
+Keep a protected user preview available while testing a replacement in isolation.
+For an independent debug instance with restart/HMR/switch authorization, proceed
+without repeatedly asking about temporary drafts; preserve persistent data and
+non-target instances. Build candidate Host/CLI output outside the active watched
+tree, then keep the reusable launch entry on the working repair combination.
+See the Host [native debugging runbook](https://github.com/cordisx/cordisx/blob/main/.agents/docs/native-debugging-runbook.md)
+for launch stages and data-scope diagnosis.
 
 The development graph is not the production package graph. Use the generated
 `cordisx/vite` build config for delivery; it creates one formal, indexed,
@@ -60,9 +115,10 @@ immutable Vite graph per plugin and keeps source-level dynamic imports, CSS,
 and static assets independently loadable. Production replacement uses CordisX
 package generations, not the development HMR socket.
 
-For native behavior, verify the actual isolated `app://` App launched by
-CordisX. A Playground or browser harness is useful supporting evidence only
-when it exposes the same public capability.
+For a claim about native behavior, verify the actual isolated `app://` App
+launched by CordisX when that launch is authorized. A Playground or browser
+harness is useful supporting evidence only when it exposes the same public
+capability. Non-native claims do not require an App launch.
 
 For a native Host interaction, use only a cataloged extension point. If the
 contract is unavailable in the installed CordisX version, say so plainly
@@ -77,12 +133,14 @@ asks for permission, inspect its declaration, availability, generation and
 Host authorization path before changing plugin code. Do not manufacture a
 user grant or infer a wildcard exception from a file URL.
 
-Local-development exceptions are capability-specific; check the owning Host
-reference. For example, [controlled visual authorization](https://github.com/cordisx/cordisx/blob/main/.agents/docs/composer-visuals.md#local-development-authorization)
-recognizes exact Launcher-verified artifacts. Explicit denial and generation
-retirement still apply. Installed artifacts use their ordinary permission
-review, so an automatically authorized development preview does not prove the
-installed permission flow.
+Verified local-development generations automatically authorize all declared
+Host permissions before mount, including scopes introduced by HMR. The Manager
+shows “Allowed for development”. If a fresh development plugin still asks,
+check the running Host version and exact Launcher provenance rather than adding
+plugin-specific permission workarounds. This is an ephemeral Host default, not
+a persistent user grant. Explicit denial, declared scope, capability availability,
+and generation retirement still apply. Installed artifacts retain ordinary
+permission review. See the Host [development permission policy](https://github.com/cordisx/cordisx/blob/main/.agents/docs/development-permissions.md).
 
 ## Isolated transient canvas
 

package/dist/skills/cordisx-plugin-development/references/plugin-authoring.md

@@ -5,13 +5,13 @@
 - Read [project-layouts-and-development.md](project-layouts-and-development.md) before creating files. Choose the layout from the user's project; do not force a business repository into a dedicated plugin monorepo.
 - Use the maintained `create-cordisx-plugin` generator. Infer a concise product slug, keep standalone single-plugin as the default, and select workspace or embedded mode when those shapes fit. Keep the scaffolding command as an implementation detail unless the user asks for it.
 - Do not copy development fixtures as production packages without auditing every field.
-- Keep plugin id, display name, descriptions, permissions, contributions, package files, runtime localization, and both `README.md` and `README.zh-Hans.md` explicit.
+- Keep plugin id, display name, descriptions, permissions, contributions, package files, runtime localization, and the user-facing README material required by the owning project explicit.
 - Include build, focused tests, package inspection, and install/dry-run checks appropriate to the owner repository.
 - Preserve the complete generated `dist/runtime/` Vite graph. The package allowlist must include its formal `artifact.json`, entry, chunks, CSS, and assets; do not copy only `module.js`, and keep declarations or test output outside the graph root.
 - Point a portable package manifest at the prebuilt `dist/runtime/module.js`; keep local development config entries pointed at source for Vite/HMR.
 - Use `cordisXPluginViteConfig()` from the public `cordisx/vite` entry instead of copying its Rollup, singleton virtualization, or artifact-index rules into a plugin project.
-- Declare license and distribution metadata intentionally.
-- Keep a newly created plugin private and `UNLICENSED` by default. Ask only for missing publication metadata when the user requests sharing or publication; an explicit publication request is already authorization and must not trigger redundant confirmation.
+- Declare license and distribution metadata intentionally when the project will be shared or published. A legal unscoped package name or a scope controlled by the publisher is valid; CordisX's own package scope, branch names, approvals, and release workflow are not plugin admission requirements.
+- When publication is outside the request, keep the generated project private and avoid inventing publication metadata. When the user requests sharing or publication, use their intended registry, naming, scope, and license, and ask only for material details that are still missing.
 
 ## Structured contributions
 

package/dist/skills/cordisx-plugin-development/references/ui-system.md

@@ -29,3 +29,29 @@ Apply these rules before implementation. They are authoring constraints, not scr
 - Place state in the control that represents it. An unavailable policy is a disabled control whose displayed value is “Unavailable”, not a separate badge beside an active select.
 - Use `currentColor` and Host icon tokens. Verify visible contrast in both light and dark themes.
 - Keep concise status copy in the primary UI. Put causal or architectural details in diagnostics, tooltips, or documentation.
+
+## Operation notifications
+
+First verify the installed SDK and Host expose this capability;
+availability and merge status are recorded in the Host reference.
+Use `ctx.notifications.show({ kind, type, message, ... })` for transient operation
+feedback; declare `notifications` in the plugin injection requirements. Host owns
+source icon/name, navigation, More/mute rules, close, timers and optional actions.
+Use stable semantic kinds such as `connection.failed`, independent of localized
+text. Do not build plugin Toast providers, positioned alerts or page-wide error
+state for operation results. Keep field validation and persistent business-object
+state local. Do not notify repeatedly from polling or show the same failure both
+inline and through notifications. Use localized user copy; redact optional details.
+An older Host without the service requires a supported SDK upgrade or honest
+capability unavailability, never a private DOM or home-grown notification fallback.
+See the [Host notification reference](https://github.com/cordisx/cordisx/blob/efbff656d84b482d51598bc5ba303d24134e0c62/.agents/docs/notifications.md).
+
+## Dialogs and complex JSX
+
+Use `Dialog`/`DialogProvider` from `cordisx/ui` or the owner-bound `ctx.dialogs`
+service. Body seats support full JSX, state, async workflows and editors; they
+are not text-only renderers. Host owns the header, footer and rightmost close
+button. Supply structured action descriptors, never a JSX header/footer or CSS
+override of the modal shell. Use the documented modal body container for
+popovers. Declare `dialogs` injection; older Hosts require an upgrade. See the
+[dialog guide](https://github.com/cordisx/cordisx/blob/main/.agents/docs/dialogs.md).

package/dist/skills/cordisx-plugin-development/references/verification.md

@@ -13,8 +13,9 @@
 
 ## Development transport
 
+- Use this section when the request or claim needs live development transport. For prose, metadata, static schema, or packaging-only work, choose the narrower focused checks and do not start an App solely to satisfy this checklist.
 - Run `cordisx dev --dry-run` from the same directory and config-discovery path that users will use. For multiple plugins, prove that every enabled config entry resolves.
-- Run one launcher-owned Vite server and one Electron App for the project. Do not start a development server per plugin.
+- When an authorized live run is needed, use one launcher-owned Vite server and one Electron App for the project. Do not start a development server per plugin.
 - Verify both update triggers when applicable: save a local source file and invoke **Reload plugin** in Manager for one active local-development plugin.
 - Classify the observed result correctly. A refresh-compatible React component edit may retain component state; plugin entry, manifest, or activation changes replace that plugin through the Cordis generation transaction; Host modules outside a refresh boundary restart the CordisX renderer in the current document; config and Node-side launcher changes require restarting the command.
 - A source write proves only that an update was triggered. Inspect the runtime result and verify disposer cleanup, a single active registration/root, and last-good behavior after a failed candidate.
@@ -26,9 +27,10 @@ loader. Do not add a second WebSocket or CDP source-transfer path for production
 
 ## Real native App and Playground
 
-- Use `cordisx dev` for claims about the installed native App. The expected path is an isolated Electron launch whose `app://` renderer imports the launcher-owned loopback Vite entry; do not substitute Computer Use or a generic browser launch.
+- Use `cordisx dev` for claims about the installed native App when that launch is in scope and authorized. The expected path is an isolated Electron launch whose `app://` renderer imports the launcher-owned loopback Vite entry; generic browser evidence does not establish that native path.
 - CDP is the initial bootstrap and native policy-control seam. Before reload it grants loopback access to the exact target origin and enables CSP bypass. Subsequent modules and update notifications use Vite HTTP and Vite's own WebSocket. Source maps are separate resources fetched on demand; readiness follows the current installation's Vite bootstrap acknowledgement rather than a generic page-load event. Stopping restores the permission to `prompt`, disables the bypass, disconnects HMR, and removes Vite-injected styles even when plugin disposal fails.
 - Confirm the native renderer reaches ready and exercise the intended UI or contribution. On stop, verify the Vite/CDP ports, in-memory session state, and launcher-owned process/profile resources are released. The stable dependency cache under `CORDISX_HOME/cache/native-vite` should remain; reject symlinked or foreign-owned cache leaves, and verify that a second launch from the same CLI and workspace roots reuses the cache without an optimizer-triggered reload.
+- Apply the [debugging tool boundary](live-plugin-development.md#choose-debugging-tools-before-accessing-the-host) before native inspection or interaction. Use only mechanisms authorized for that target and action; do not use a different tool to bypass an explicit user, Host, or tool denial. A permitted harness does not establish user interaction or acceptance.
 - Test the actual native state transition relevant to the claim, including replacement of native layout when applicable. Changing fixture labels inside an `app://` page remains simulated evidence; it does not prove the real operation or full native flow.
 - Confirm the inspected window is foreground and running the intended module when verifying pointer or rendering behavior. Check behavior after the update, not just receipt of an HMR notification.
 - Use the maintained local Playground when it directly covers the feature under test.
@@ -40,8 +42,8 @@ loader. Do not add a second WebSocket or CDP source-transfer path for production
 
 ## Delivery evidence
 
-- Run the focused tests and owner-repository full gates.
-- Run typecheck, build, package/install checks, audit, and diff check when required by the repository.
+- Run the checks required by the repository that owns the plugin and the evidence needed for the claim. CordisX Host maintainer gates apply only to CordisX-owned changes.
+- Run typecheck, build, package/install checks, audit, and diff check when required by that repository or delivery target.
 - Record real request evidence: no lazy chunk/CSS/image before the feature is opened; those resources appear after the trigger; a second open does not issue a second evaluation; and a replaced generation cannot become active later.
 - Exercise the relevant real runtime in the needed theme and layout states; these should confirm rules already encoded in components and tests, not serve as the first design review.
-- Keep any user-reviewed Playground open while starting a replacement on a new port.
+- Honor the current preview agreement. Preserve a protected review instance; use already-authorized restart/HMR for an independent debug instance while retaining persistent data and non-target windows.

package/dist/skills/cordisx-plugin-development/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "2026-09-08.2",
+  "version": "2026-09-20.1",
   "source": "https://github.com/cordisx/cordisx/tree/main/skills/cordisx-plugin-development"
 }

package/dist/skills/cordisx-qa/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: cordisx-qa
+description: Answer and, when explicitly requested, record CordisX user-experience questions with context and evidence. Use for common usage questions, known pitfalls, practical tradeoffs, observed workarounds, and questions about what is implemented, tested, released, or installed. This is Question & Answer guidance, not software quality assurance or a substitute for versioned CordisX documentation.
+---
+
+# CordisX User Experience Q&A
+
+Answer the user's actual question with the shortest evidence-backed explanation
+that resolves it. Q&A captures contextual product experience; it does not own
+the standard product contract. Questions about what CordisX officially supports
+or how a command works belong to Docs even when phrased as a question. The
+bundled revision and owning source are recorded in
+[version.json](version.json).
+
+## Find the answer
+
+1. Identify the relevant CordisX version, Host, operating mode, project shape,
+   and action when they materially affect the answer. Reuse facts already in
+   context instead of asking for them again.
+2. For product commands, compatibility, configuration, architecture, security,
+   or public contracts, read [cordisx-docs](../cordisx-docs/SKILL.md) first.
+3. Search the owning Host user guides before inventing a new answer. Start with
+   the [user experience Q&A](https://github.com/cordisx/cordisx/blob/main/.agents/docs/user-experience-qa.md)
+   and use the linked
+   [startup Q&A](https://github.com/cordisx/cordisx/blob/main/.agents/docs/startup-qa.md)
+   for launch and setup questions.
+4. Prefer evidence from the applicable version's docs, source, diagnostics,
+   focused checks, or an explicitly described observation. Keep a suggestion
+   labeled as a suggestion.
+
+## Answer format
+
+Use a natural answer for simple questions. When context or evidence matters,
+make these elements clear without forcing a rigid template:
+
+- **Answer:** the practical resolution or decision;
+- **Applies when:** version, platform, mode, or project conditions;
+- **Basis:** the documentation, diagnostic, test, or observation supporting it;
+- **Status:** implemented, tested, merged, published, or installed, when the
+  distinction matters.
+
+Do not generalize one incident into a universal rule. If reliable evidence is
+missing or conflicting, say what is known, what remains uncertain, and the
+smallest read-only check that would distinguish the possibilities.
+
+## Record experience only on request
+
+Record a new Q&A entry when the user asks to preserve or update the experience.
+Use their requested destination or an existing personal or project Q&A record.
+For a contribution to shared product documentation, use the existing owner
+document when one covers the topic; the Host user-experience Q&A is for
+cross-topic experience that has no better owner.
+
+If the shared source is unavailable or not writable, save a local Markdown
+Q&A draft in the current authorized workspace or notes location and report its
+path. Personal notes do not require access to CordisX's repositories. Do not
+write user experience into an installed, launcher-managed Skill directory or
+claim that a local draft has been published to the shared documentation.
+
+Write the entry as a real question and answer. Include its applicability and
+evidence, link the normative documentation, and retain meaningful limitations
+or failed approaches. When repeated evidence becomes a supported product rule,
+update or link the owning documentation rather than maintaining a competing
+rule in Q&A.
+
+Do not publish raw conversations, private logs, credentials, account details,
+local paths, task identifiers, or internal-only data. Redact or summarize the
+minimum reusable fact. Do not automatically record every interaction, and do
+not claim an edit was recorded, merged, published, or installed without direct
+evidence for that state.
+
+## Boundaries
+
+- Informational queries are read-only. They do not authorize configuration
+  changes, grants, App launches, uploads, publishing, or releases.
+- Q&A does not grant access or turn an unavailable capability into an available
+  one. Use existing authorization and report the missing boundary honestly.
+- Repository branch names, package scopes, approvals, and release processes
+  apply only to their owning repository. Third-party plugins may use legal
+  unscoped names or the publisher's own scope.
+- For plugin implementation or debugging, use
+  [cordisx-plugin-development](../cordisx-plugin-development/SKILL.md) after
+  resolving the user's question.

package/dist/skills/cordisx-qa/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "CordisX User Experience Q&A"
+  short_description: "Answer CordisX usage questions with context and evidence"
+  default_prompt: "Use $cordisx-qa to answer this CordisX user-experience question with its applicability, evidence, and exact implementation or release status."

package/dist/skills/cordisx-qa/version.json

@@ -0,0 +1,4 @@
+{
+  "version": "2026-09-20.1",
+  "source": "https://github.com/cordisx/cordisx/tree/main/skills/cordisx-qa"
+}

package/dist/src/agent-loop-control-contracts.d.ts

@@ -0,0 +1,8 @@
+import type { AgentLoopControlV1 } from '@cordisx/protocol/agent-loop-control/v1';
+export type * from '@cordisx/protocol/agent-loop-control/v1';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        readonly agentLoopControl: AgentLoopControlV1;
+    }
+}
+//# sourceMappingURL=agent-loop-control-contracts.d.ts.map

package/dist/src/agent-loop-control-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loop-control-contracts.d.ts","sourceRoot":"","sources":["../../src/agent-loop-control-contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AACjF,mBAAmB,yCAAyC,CAAA;AAC5D,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,CAAA;KAC9C;CACF"}

package/dist/src/agent-loop-control-contracts.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-loop-control-contracts.js.map

package/dist/src/agent-loop-control-contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loop-control-contracts.js","sourceRoot":"","sources":["../../src/agent-loop-control-contracts.ts"],"names":[],"mappings":""}

package/dist/src/agent-session-migration-contracts.d.ts

@@ -10,7 +10,7 @@ import type { AgentAdmissionBootstrapReservationService, AgentAdmissionBootstrap
 import type { AgentAdmissionBootstrapRoomReservationService, AgentAdmissionBootstrapRoomTargetService } from '@cordisx/protocol/agent-admission/v5';
 import type { AgentAdmissionBootstrapRouteDeclarationService, AgentAdmissionBootstrapRouteReservationService } from '@cordisx/protocol/agent-admission/v6';
 import type { AgentPageAdmissionReservationService, AgentPageAdmissionRouteDeclarationService, AgentPageAdmissionRouteReservationService, AgentPageAdmissionTargetService, AgentPageFreshRoomNavigationService } from '@cordisx/protocol/agent-page-admission/v2';
-import type { AgentDetailNavigationService, AgentSessionDetailReferenceService } from '@cordisx/protocol/agent-detail-navigation/v1';
+import type { AgentDetailNavigationService, AgentSessionDetailReferenceService } from '@cordisx/protocol/agent-detail-navigation/v2';
 import type { SessionId, SessionRegistry } from '@cordisx/protocol/sessions/v1';
 export declare const CORDISX_AGENT_SESSION_LEGACY_ACQUIRE_SCHEMA_V1: "https://raw.githubusercontent.com/cordisx/cordisx/main/packages/cli/schemas/agent-session-legacy-acquire.v1.schema.json";
 export declare const CORDISX_AGENT_SESSION_LEGACY_ACQUIRE_CONTRACT_V1: "cordisx.host-agent-session-legacy-acquire/v1";

package/dist/src/agent-task-contracts.d.ts

@@ -0,0 +1,12 @@
+export type * from '@cordisx/protocol/agent-task-binding/v1';
+import type { AgentTaskApprovals, AgentTaskOwnership } from '@cordisx/protocol/agent-task-binding/v1';
+export type * from '@cordisx/protocol/agent-task/v1';
+import type { AgentTasks } from '@cordisx/protocol/agent-task/v1';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        agentTasks?: AgentTasks;
+        agentTaskApprovals?: AgentTaskApprovals;
+        agentTaskOwnership?: AgentTaskOwnership;
+    }
+}
+//# sourceMappingURL=agent-task-contracts.d.ts.map

package/dist/src/agent-task-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-task-contracts.d.ts","sourceRoot":"","sources":["../../src/agent-task-contracts.ts"],"names":[],"mappings":"AAAA,mBAAmB,yCAAyC,CAAA;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AACrG,mBAAmB,iCAAiC,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AAEjE,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,UAAU,CAAC,EAAE,UAAU,CAAA;QACvB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;QACvC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;KACxC;CACF"}

package/dist/src/agent-task-contracts.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-task-contracts.js.map

package/dist/src/agent-task-contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-task-contracts.js","sourceRoot":"","sources":["../../src/agent-task-contracts.ts"],"names":[],"mappings":""}

package/dist/src/agent-task-permission-manifest.d.ts

@@ -0,0 +1,10 @@
+import type { PluginRuntimeManifestV12 } from '@cordisx/protocol/plugin-manifest/v12';
+import type { PluginRuntimeManifestV11 } from '@cordisx/protocol/plugin-manifest/v11';
+import { type CordisXPluginManifestV10 } from './extension-point-interaction-permissions.js';
+export declare const CORDISX_PLUGIN_MANIFEST_SCHEMA_V12: "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v12.schema.json";
+export declare const CORDISX_PLUGIN_MANIFEST_SCHEMA_V11: "https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v11.schema.json";
+export type CordisXPluginManifestV12 = Omit<PluginRuntimeManifestV12, 'services'> & Pick<CordisXPluginManifestV10, 'services'>;
+export type CordisXPluginManifestV11 = Omit<PluginRuntimeManifestV11, 'services'> & Pick<CordisXPluginManifestV10, 'services'>;
+/** Preserve earlier manifest branches while validating only the additive public declarations. */
+export declare function normalizeTaskManifest(value: unknown, expectedId: string): CordisXPluginManifestV11 | CordisXPluginManifestV12;
+//# sourceMappingURL=agent-task-permission-manifest.d.ts.map

package/dist/src/agent-task-permission-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-task-permission-manifest.d.ts","sourceRoot":"","sources":["../../src/agent-task-permission-manifest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAA;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAA;AAKrF,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,8CAA8C,CAAA;AAGrD,eAAO,MAAM,kCAAkC,EAC7C,yGAAkH,CAAA;AACpH,eAAO,MAAM,kCAAkC,EAC7C,yGAAkH,CAAA;AACpH,MAAM,MAAM,wBAAwB,GAChC,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,GAC1C,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAA;AAC9C,MAAM,MAAM,wBAAwB,GAChC,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,GAC1C,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAA;AA0D9C,iGAAiG;AACjG,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,GACjB,wBAAwB,GAAG,wBAAwB,CAwCrD"}

package/dist/src/agent-task-permission-manifest.js

@@ -0,0 +1,103 @@
+import { normalizeUsageDeclaration, normalizeUsageManifestV11 } from './usage-permissions.js';
+import { CORDISX_PLUGIN_MANIFEST_SCHEMA_V10, normalizeVisualManifestV10, } from './extension-point-interaction-permissions.js';
+import { normalizePermissionRationaleV2, normalizePermissionSecurityV2 } from './permission-model-v2.js';
+export const CORDISX_PLUGIN_MANIFEST_SCHEMA_V12 = 'https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v12.schema.json';
+export const CORDISX_PLUGIN_MANIFEST_SCHEMA_V11 = 'https://raw.githubusercontent.com/cordisx/cordisx-protocol/main/schemas/plugin-manifest.v11.schema.json';
+function object(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Expected task permission object');
+    }
+    return value;
+}
+function exact(value, keys) {
+    if (Object.keys(value).some(key => !keys.includes(key)))
+        throw new Error('Unknown task permission field');
+}
+const localId = /^[a-z0-9][a-z0-9._-]{0,95}$/u;
+function taskDeclaration(value) {
+    const declaration = object(value);
+    exact(declaration, ['name', 'required', 'rationale', 'security', 'scope']);
+    if (declaration.required !== false || !['approvals.request', 'approvals.answer'].includes(String(declaration.name))) {
+        throw new Error('Task approval permission must be optional');
+    }
+    const scope = object(declaration.scope);
+    const request = declaration.name === 'approvals.request';
+    const key = request ? 'task' : 'taskRequester';
+    const oldKey = request ? 'sessionIds' : 'authorityRequester';
+    exact(scope, [key, oldKey]);
+    const selector = object(scope[key]);
+    exact(selector, ['kind', 'commandId']);
+    if (selector.kind !== 'agent-task-command' || typeof selector.commandId !== 'string'
+        || !localId.test(selector.commandId))
+        throw new Error('Invalid task command selector');
+    const oldScope = scope[oldKey] === undefined ? {} : { [oldKey]: scope[oldKey] };
+    // Use the existing normalizer for the optional independent route branch.
+    const old = scope[oldKey] === undefined ? undefined : normalizeVisualManifestV10({
+        $schema: CORDISX_PLUGIN_MANIFEST_SCHEMA_V10,
+        schemaVersion: 10,
+        id: 'task-permission-check',
+        services: [],
+        capabilities: [{ ...declaration, scope: oldScope }],
+    }, 'task-permission-check').capabilities[0];
+    if (request && old !== undefined && (!('sessionIds' in old.scope) || Array.isArray(old.scope.sessionIds))) {
+        throw new Error('Task branch permits only an independent Host route');
+    }
+    return Object.freeze({
+        name: declaration.name,
+        required: false,
+        ...(declaration.rationale === undefined
+            ? {}
+            : { rationale: normalizePermissionRationaleV2(declaration.rationale, 'task.rationale') }),
+        ...(declaration.security === undefined
+            ? {}
+            : { security: normalizePermissionSecurityV2(declaration.security, 'task.security') }),
+        scope: Object.freeze({
+            ...(old?.scope ?? {}),
+            [key]: Object.freeze({ kind: 'agent-task-command', commandId: selector.commandId }),
+        }),
+    });
+}
+/** Preserve earlier manifest branches while validating only the additive public declarations. */
+export function normalizeTaskManifest(value, expectedId) {
+    const manifest = object(value);
+    const version = manifest.schemaVersion;
+    if (version === 11)
+        return normalizeUsageManifestV11(value, expectedId);
+    if ((version !== 11 && version !== 12)
+        || manifest.$schema !== (version === 12 ? CORDISX_PLUGIN_MANIFEST_SCHEMA_V12 : CORDISX_PLUGIN_MANIFEST_SCHEMA_V11)
+        || !Array.isArray(manifest.capabilities) || manifest.capabilities.length > 37)
+        throw new Error('Unsupported task manifest');
+    const names = new Set();
+    const additions = [];
+    const baseCapabilities = [];
+    for (const value of manifest.capabilities) {
+        const declaration = object(value);
+        if (typeof declaration.name !== 'string' || names.has(declaration.name)) {
+            throw new Error('Duplicate or invalid capability');
+        }
+        names.add(declaration.name);
+        const scope = object(declaration.scope);
+        if (version === 12 && ('task' in scope || 'taskRequester' in scope))
+            additions.push(taskDeclaration(value));
+        else if (declaration.name === 'usage.read') {
+            additions.push(normalizeUsageDeclaration(value));
+        }
+        else
+            baseCapabilities.push(value);
+    }
+    const base = normalizeVisualManifestV10({
+        ...manifest,
+        $schema: CORDISX_PLUGIN_MANIFEST_SCHEMA_V10,
+        schemaVersion: 10,
+        capabilities: baseCapabilities,
+    }, expectedId);
+    const normalized = [...base.capabilities, ...additions];
+    const byName = new Map(normalized.map(item => [item.name, item]));
+    return Object.freeze({
+        ...base,
+        $schema: manifest.$schema,
+        schemaVersion: version,
+        capabilities: Object.freeze(manifest.capabilities.map(item => byName.get(object(item).name))),
+    });
+}
+//# sourceMappingURL=agent-task-permission-manifest.js.map

package/dist/src/agent-task-permission-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-task-permission-manifest.js","sourceRoot":"","sources":["../../src/agent-task-permission-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAO7F,OAAO,EACL,kCAAkC,EAElC,0BAA0B,GAC3B,MAAM,8CAA8C,CAAA;AACrD,OAAO,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAA;AAExG,MAAM,CAAC,MAAM,kCAAkC,GAC7C,yGAAkH,CAAA;AACpH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,yGAAkH,CAAA;AAQpH,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AACD,SAAS,KAAK,CAAC,KAA8B,EAAE,IAAuB;IACpE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;AAC3G,CAAC;AACD,MAAM,OAAO,GAAG,8BAA8B,CAAA;AAE9C,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACjC,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IAC1E,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,KAAK,mBAAmB,CAAA;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAA;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAA;IAC5D,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACnC,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAA;IACtC,IACE,QAAQ,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ;WAC7E,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAA;IAC/E,yEAAyE;IACzE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAC/E,OAAO,EAAE,kCAAkC;QAC3C,aAAa,EAAE,EAAE;QACjB,EAAE,EAAE,uBAAuB;QAC3B,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;KACpD,EAAE,uBAAuB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC3C,IAAI,OAAO,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,8BAA8B,CAAC,WAAW,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,6BAA6B,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;QACvF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC;YACrB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;SACpF,CAAC;KACH,CAA+D,CAAA;AAClE,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,UAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAA;IACtC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACvE,IACE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,EAAE,CAAC;WAC/B,QAAQ,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,kCAAkC,CAAC;WAC/G,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;QAC7E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,SAAS,GAEX,EAAE,CAAA;IACN,MAAM,gBAAgB,GAAc,EAAE,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,eAAe,IAAI,KAAK,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;aACtG,IAAI,WAAW,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAA;QAClD,CAAC;;YAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,0BAA0B,CAAC;QACtC,GAAG,QAAQ;QACX,OAAO,EAAE,kCAAkC;QAC3C,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,gBAAgB;KAC/B,EAAE,UAAU,CAAC,CAAA;IACd,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAoC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,IAAI;QACP,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,aAAa,EAAE,OAAO;QACtB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAc,CAAE,CAAC,CAAC;KACzG,CAAwD,CAAA;AAC3D,CAAC"}

package/dist/src/agent-task-record.d.ts

@@ -0,0 +1,22 @@
+import type { AgentTaskCreateRequest, AgentTaskCreateResult, AgentTaskResolvedContext } from '@cordisx/protocol/agent-task/v1';
+/** Host-only correlation in the existing native Session owner store. */
+export interface AgentTaskRecord {
+    readonly operationId: string;
+    readonly fingerprint: string;
+    readonly sessionId: string;
+    readonly messageId: string;
+    readonly context: AgentTaskResolvedContext;
+    readonly bindingPolicy?: 'none' | 'required';
+    readonly phase: 'intent' | 'creating' | 'created' | 'binding' | 'approval-installing' | 'approval-install-failed' | 'submitting' | 'finished';
+    readonly result?: AgentTaskCreateResult;
+}
+export declare function canonicalTaskJson(value: unknown): string;
+export declare function validTaskRequest(value: AgentTaskCreateRequest): boolean;
+export declare class AgentTaskContextMismatch extends Error {
+    readonly sessionId: string;
+    constructor(sessionId: string);
+}
+export declare class AgentTaskApprovalCleanupError extends Error {
+    constructor();
+}
+//# sourceMappingURL=agent-task-record.d.ts.map

package/dist/src/agent-task-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-task-record.d.ts","sourceRoot":"","sources":["../../src/agent-task-record.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACzB,MAAM,iCAAiC,CAAA;AAExC,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC5C,QAAQ,CAAC,KAAK,EACV,QAAQ,GACR,UAAU,GACV,SAAS,GACT,SAAS,GACT,qBAAqB,GACrB,yBAAyB,GACzB,YAAY,GACZ,UAAU,CAAA;IACd,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CACxC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAoBxD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAgBvE;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM;CAGvC;AAED,qBAAa,6BAA8B,SAAQ,KAAK;;CAIvD"}

package/dist/src/agent-task-record.js

@@ -0,0 +1,52 @@
+export function canonicalTaskJson(value) {
+    const seen = new Set();
+    const normalize = (item) => {
+        if (item === null || typeof item === 'string' || typeof item === 'boolean')
+            return item;
+        if (typeof item === 'number' && Number.isFinite(item))
+            return item;
+        if (typeof item !== 'object' || seen.has(item))
+            throw new Error('Task input must be JSON');
+        seen.add(item);
+        try {
+            if (Array.isArray(item))
+                return item.map(normalize);
+            if (Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null) {
+                throw new Error('Task input must be plain JSON');
+            }
+            return Object.fromEntries(Object.keys(item).sort().map(key => [key, normalize(item[key])]));
+        }
+        finally {
+            seen.delete(item);
+        }
+    };
+    return JSON.stringify(normalize(value));
+}
+export function validTaskRequest(value) {
+    const id = (value) => typeof value === 'string' && value.length > 0 && value.length <= 512;
+    const keys = (value, allowed) => Object.keys(value).every(key => allowed.includes(key));
+    return !!value && keys(value, ['operationId', 'definition', 'context', 'text', 'options', 'tool'])
+        && id(value.operationId) && !!value.definition && id(value.definition.agentId) && id(value.definition.revision)
+        && keys(value.definition, ['agentId', 'revision'])
+        && typeof value.text === 'string' && value.text.trim().length > 0 && value.text.length <= 500_000
+        && !!value.tool && id(value.tool.commandId) && value.tool.scope !== undefined
+        && keys(value.tool, ['commandId', 'scope'])
+        && (value.options === undefined
+            || (!!value.options && keys(value.options, ['provider', 'model', 'reasoningEffort', 'maxTokens'])
+                && [value.options.provider, value.options.model, value.options.reasoningEffort].every(item => item === undefined || id(item))
+                && (value.options.maxTokens === undefined
+                    || (Number.isSafeInteger(value.options.maxTokens) && value.options.maxTokens > 0))));
+}
+export class AgentTaskContextMismatch extends Error {
+    sessionId;
+    constructor(sessionId) {
+        super('Native task execution directory did not match the resolved context');
+        this.sessionId = sessionId;
+    }
+}
+export class AgentTaskApprovalCleanupError extends Error {
+    constructor() {
+        super('Task approval cleanup could not be established');
+    }
+}
+//# sourceMappingURL=agent-task-record.js.map

package/dist/src/agent-task-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-task-record.js","sourceRoot":"","sources":["../../src/agent-task-record.ts"],"names":[],"mappings":"AA0BA,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,SAAS,GAAG,CAAC,IAAa,EAAW,EAAE;QAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACvF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAClE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QAC1F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACnD,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7F,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAE,IAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC9F,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,CAAA;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC5D,MAAM,EAAE,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAA;IACpH,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAiB,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAClH,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;WAC7F,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;WAC5G,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;WAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO;WAC9F,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;WAC1E,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;WACxC,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS;eAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;mBAC5F,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAC3F,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,CAAC,CAC/B;mBACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;uBACpC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9F,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B;IAArB,YAAqB,SAAiB;QACpC,KAAK,CAAC,oEAAoE,CAAC,CAAA;QADxD,cAAS,GAAT,SAAS,CAAQ;IAEtC,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACzD,CAAC;CACF"}

package/dist/src/capability-risk-catalog.d.ts

@@ -44,6 +44,8 @@ export declare class CapabilityRiskCatalog {
     snapshot(): readonly CordisXCapabilityRiskCatalogEntry[];
     assertScope(capability: CordisXPermissionCapabilityV4, scope: CordisXPermissionScopeV4): void;
 }
+/** Exact Host-owned allowlist. Marketplace identity or certification alone never expands it. */
+export declare function certifiedImplicitApprovalEligible(capability: CordisXPermissionCapabilityV4, scope: CordisXPermissionScopeV4, certification: CordisXCertifiedPermissionProjectionV1): boolean;
 export declare class PermissionDecisionEngine {
     private readonly catalog;
     constructor(catalog?: CapabilityRiskCatalog);