create-agdf 0.14.5 → 0.20.1

package/lib/runtime-check-consent/codex-hooks.js

@@ -0,0 +1,96 @@
+import { spawn } from "node:child_process";
+import process from "node:process";
+
+const HASH = /^sha256:[a-f0-9]{64}$/;
+const TRUST = new Set(["managed", "trusted", "modified", "untrusted"]);
+const unavailable = () => ({ status: "unavailable" });
+
+// Native metadata is permission evidence only. This client never starts a task,
+// executes a hook, calculates a replacement trust hash or writes host settings.
+export function parseCodexHookObservation(response, cwd) {
+  const entries = response?.result?.data;
+  if (response?.error || !Array.isArray(entries) || entries.length !== 1) return unavailable();
+  const entry = entries[0];
+  if (!entry || entry.cwd !== cwd || !Array.isArray(entry.hooks)
+      || !Array.isArray(entry.errors) || entry.errors.length
+      || !Array.isArray(entry.warnings) || entry.warnings.length) return unavailable();
+  const hooks = entry.hooks.filter((hook) => hook?.pluginId === "agdf@agdf"
+    && hook.eventName === "sessionStart");
+  if (hooks.length !== 1) return unavailable();
+  const hook = hooks[0];
+  if (hook.source !== "plugin" || hook.handlerType !== "command"
+      || typeof hook.enabled !== "boolean" || typeof hook.key !== "string" || !hook.key.trim()
+      || typeof hook.currentHash !== "string" || !HASH.test(hook.currentHash) || !TRUST.has(hook.trustStatus)
+      || (hook.trustStatus === "managed" && hook.isManaged !== true)) return unavailable();
+  return {
+    status: "observed",
+    hook: { key: hook.key, enabled: hook.enabled, current_hash: hook.currentHash,
+      trust_status: hook.trustStatus },
+  };
+}
+
+export function observeCodexHooks({ cwd = process.cwd(), executable = "codex",
+  env = process.env, spawnProcess = spawn, timeoutMs = 5000, maxOutputBytes = 1024 * 1024 } = {}) {
+  return new Promise((resolve) => {
+    let child;
+    let timer;
+    let settled = false;
+    let phase = "initialize";
+    let pending = "";
+    let outputBytes = 0;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try { child?.stdin?.end(); } catch { /* Transport may already be closed. */ }
+      try { child?.kill(); } catch { /* Process may already have exited. */ }
+      resolve(result);
+    };
+    const send = (message) => {
+      if (settled) return;
+      try { child.stdin.write(`${JSON.stringify(message)}\n`); }
+      catch { finish(unavailable()); }
+    };
+    try {
+      child = spawnProcess(executable, ["app-server"], {
+        cwd, env, stdio: ["pipe", "pipe", "pipe"], shell: false, windowsHide: true,
+      });
+      timer = setTimeout(() => finish(unavailable()), timeoutMs);
+      child.on("error", () => finish(unavailable()));
+      child.on("close", () => finish(unavailable()));
+      child.stdin.on("error", () => finish(unavailable()));
+      const countOutput = (chunk) => {
+        outputBytes += Buffer.byteLength(chunk);
+        if (outputBytes > maxOutputBytes) finish(unavailable());
+      };
+      child.stderr.on("data", countOutput);
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        countOutput(chunk);
+        if (settled) return;
+        pending += chunk;
+        let newline;
+        while (!settled && (newline = pending.indexOf("\n")) !== -1) {
+          const line = pending.slice(0, newline);
+          pending = pending.slice(newline + 1);
+          let message;
+          try { message = JSON.parse(line); }
+          catch { finish(unavailable()); break; }
+          if (!message || typeof message !== "object") { finish(unavailable()); break; }
+          if (phase === "initialize" && message.id === 1) {
+            if (message.error || !message.result) { finish(unavailable()); break; }
+            phase = "hooks";
+            send({ method: "initialized" });
+            send({ id: 2, method: "hooks/list", params: { cwds: [cwd] } });
+          } else if (phase === "hooks" && message.id === 2) {
+            finish(parseCodexHookObservation(message, cwd));
+          }
+        }
+      });
+      send({ id: 1, method: "initialize", params: {
+        clientInfo: { name: "agdf_runtime_check_observer", version: "1" },
+        capabilities: { experimentalApi: true, requestAttestation: false },
+      } });
+    } catch { finish(unavailable()); }
+  });
+}

package/lib/runtime-check-consent/codex-plugin-consent.js

@@ -0,0 +1,118 @@
+import { spawn } from "node:child_process";
+import process from "node:process";
+import { isAbsolute } from "node:path";
+import { resolveHostCommand } from "../host-command.js";
+
+export const CODEX_DISPATCH_POLICY_KEY = 'plugins."agdf@agdf".mcp_servers.agdf.tools.agdf_dispatch.approval_mode';
+const KEY = CODEX_DISPATCH_POLICY_KEY;
+const policy = config => config?.plugins?.["agdf@agdf"]?.mcp_servers?.agdf;
+
+const approvalMode = config => policy(config)?.tools?.agdf_dispatch?.approval_mode;
+const blocked = config => {
+  const plugin = config?.plugins?.["agdf@agdf"];
+  const server = policy(config);
+  return plugin?.enabled === false || server?.enabled === false
+    || server?.tools?.agdf_dispatch?.enabled === false
+    || (Array.isArray(server?.enabled_tools) && !server.enabled_tools.includes("agdf_dispatch"))
+    || server?.disabled_tools?.includes("agdf_dispatch");
+};
+
+// Only the documented plugin-scoped tool policy is written by Codex itself. No hook trust hashes,
+// global approvals, sandbox settings, server commands or other plugins are changed here.
+export function approveCodexDispatcher(options = {}) {
+  return updateUserToolPolicy(options, {
+    success: "configured",
+    decide(config, userConfig, phase) {
+      if (blocked(config) || blocked(userConfig)) return { finish: ["blocked", "existing_disable_preserved"] };
+      if (approvalMode(config) === "approve" && approvalMode(userConfig) === "approve") return { finish: ["configured", "none"] };
+      if (phase === 4) return { finish: ["failed", "policy_not_effective"] };
+      return { write: "approve" };
+    },
+  });
+}
+
+// Uninstall counterpart: removes only the approval AGDF wrote, through the same native API, and
+// reports a key Codex keeps as retained instead of claiming a clean removal.
+export function revokeCodexDispatcher(options = {}) {
+  return updateUserToolPolicy(options, {
+    success: "removed",
+    decide(_config, userConfig, phase) {
+      if (approvalMode(userConfig) === undefined) return { finish: [phase === 2 ? "absent" : "removed", "none"] };
+      if (phase === 4) return { finish: ["retained", "policy_not_removed"] };
+      return { write: null };
+    },
+  });
+}
+
+function updateUserToolPolicy({ env = process.env, cwd = process.cwd(),
+  executable = env.CODEX_BIN || "codex", spawnProcess = spawn, timeoutMs = 15000,
+  resolveCommand = resolveHostCommand } = {}, { success, decide }) {
+  return new Promise(resolve => {
+    let child, timer, pending = "", bytes = 0, settled = false, phase = 1;
+    let writeAttempted = false, userFile;
+    const finish = (status, reason) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try { child?.stdin?.end(); child?.kill(); } catch {}
+      resolve({ status, reason, tool: "agdf_dispatch", policy_key: KEY, config_file: userFile,
+        write_attempted: writeAttempted,
+        verification: [success, "absent"].includes(status) ? "config_readback" : "unverified" });
+    };
+    const send = (method, params) => {
+      try { child.stdin.write(`${JSON.stringify({ id: phase, method, params })}\n`); }
+      catch { finish("failed", "transport_failed"); }
+    };
+    const read = () => send("config/read", { includeLayers: true, cwd });
+    try {
+      const command = resolveCommand(executable, { env });
+      child = spawnProcess(command.executable, [...command.prefixArgs, "app-server"], { cwd, env, stdio: ["pipe", "pipe", "pipe"], shell: false, windowsHide: true });
+      timer = setTimeout(() => finish("failed", writeAttempted ? "write_outcome_unverified" : "timeout"), timeoutMs);
+      child.on("error", () => finish("failed", "transport_failed"));
+      child.on("close", () => finish("failed", "transport_closed"));
+      child.stdin.on("error", () => finish("failed", "transport_failed"));
+      const count = chunk => { bytes += Buffer.byteLength(chunk); if (bytes > 4 * 1024 * 1024) finish("failed", "output_limit"); };
+      child.stderr.on("data", count);
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", chunk => {
+        if (settled) return;
+        count(chunk);
+        pending += chunk;
+        let newline;
+        while (!settled && (newline = pending.indexOf("\n")) !== -1) {
+          const line = pending.slice(0, newline); pending = pending.slice(newline + 1);
+          let message;
+          try { message = JSON.parse(line); } catch { finish("failed", "invalid_response"); break; }
+          if (!message || typeof message !== "object") { finish("failed", "invalid_response"); break; }
+          if (message.id !== phase) continue;
+          if (message.error || !message.result) { finish("failed", "host_rejected"); break; }
+          if (phase === 1) {
+            child.stdin.write(`${JSON.stringify({ method: "initialized" })}\n`);
+            phase = 2; read();
+          } else if (phase === 2 || phase === 4) {
+            const config = message.result.config;
+            if (!config || typeof config !== "object" || Array.isArray(config)) { finish("failed", "invalid_config_readback"); break; }
+            // A project/profile override is not evidence of global installation consent.
+            const users = Array.isArray(message.result.layers)
+              ? message.result.layers.filter(layer => layer?.name?.type === "user" && !layer.name.profile) : [];
+            const user = users?.length === 1 ? users[0] : null;
+            if (!user || user.disabledReason || typeof user.name.file !== "string" || !isAbsolute(user.name.file)
+                || typeof user.version !== "string" || !user.version || !user.config || typeof user.config !== "object"
+                || Array.isArray(user.config) || (userFile && userFile !== user.name.file)) {
+              finish("failed", "user_config_unverified"); break;
+            }
+            userFile = user.name.file;
+            const decision = decide(config, user.config, phase);
+            if (decision.finish) { finish(...decision.finish); break; }
+            phase = 3; writeAttempted = true;
+            send("config/value/write", { keyPath: KEY, value: decision.write, mergeStrategy: "replace",
+              filePath: userFile, expectedVersion: user.version });
+          } else if (phase === 3) {
+            phase = 4; read();
+          }
+        }
+      });
+      send("initialize", { clientInfo: { name: "agdf_plugin_consent", version: "1" }, capabilities: { experimentalApi: true } });
+    } catch { finish("failed", "transport_failed"); }
+  });
+}

package/lib/runtime-check-consent/contract.js

@@ -1,3 +1,7 @@
+import { sessionCommand as codexSessionCommand } from "../host-adapters/codex/session-command.js";
+import { sessionCommand as claudeSessionCommand } from "../host-adapters/claude/session-command.js";
+import { sessionCommand as copilotSessionCommand } from "../host-adapters/copilot/session-command.js";
+import { sessionCommand as openCodeSessionCommand } from "../host-adapters/opencode/session-command.js";
 import { createHash } from "node:crypto";
 
 const OPERATIONS = Object.freeze([
@@ -31,7 +35,7 @@ export function validateRuntimeCheckCapability(capability) {
     throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: read-only constraints required");
   }
   const surfaces = capability.surfaces ?? {};
-  if (surfaces.codex !== "native-hook-review" || surfaces.claude !== "exact-command-rule"
+  if (surfaces.codex !== "native-hook-review" || surfaces.claude !== "plugin-enablement"
       || surfaces.copilot !== "plugin-hook-review"
       || surfaces.opencode !== "plugin-internal"
       || surfaces["portable-skills"] !== "manual-external-required") {
@@ -59,13 +63,10 @@ export function runtimeCheckCapabilityIdentity({ capability, surface, runtimeDig
 }
 
 export function fixedRuntimeCheckCommand(surface, pluginRoot, platform = process.platform) {
-  if (surface === "opencode") return "plugin:agdf:automatic-runtime-checks";
-  if (surface === "copilot") return 'node "${PLUGIN_ROOT}/runtime/agdf-session-check.js"';
-  if (surface === "codex" || surface === "claude") {
-    return platform === "win32"
-      ? "node \"$([Environment]::GetEnvironmentVariable('PLUGIN_ROOT') + [Environment]::GetEnvironmentVariable('CLAUDE_PLUGIN_ROOT'))\\runtime\\agdf-session-check.js\""
-      : "node \"${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT}}/runtime/agdf-session-check.js\"";
-  }
+  if (surface === "opencode") return openCodeSessionCommand(pluginRoot, platform);
+  if (surface === "copilot") return copilotSessionCommand(pluginRoot, platform);
+  if (surface === "codex") return codexSessionCommand(pluginRoot, platform);
+  if (surface === "claude") return claudeSessionCommand(pluginRoot, platform);
   const normalizedRoot = platform === "win32" ? pluginRoot.replaceAll("/", "\\") : pluginRoot;
   return `node \"${normalizedRoot}${platform === "win32" ? "\\" : "/"}runtime${platform === "win32" ? "\\" : "/"}agdf-session-check.js\"`;
 }

package/lib/runtime-check-consent/coordinator.js

@@ -17,7 +17,7 @@ export function resolveRuntimeCheckDecision({ explicitValue, interactive = false
 
 export function consentDisclosure(surface) {
   const permissionOwner = surface === "codex" ? "Codex native hook trust"
-    : surface === "claude" ? "Claude Code user permission settings"
+    : surface === "claude" ? "Claude Code plugin enablement"
     : surface === "copilot" ? "GitHub Copilot plugin hook review"
     : "OpenCode plugin and explicit permission configuration";
   return Object.freeze({
@@ -27,11 +27,11 @@ export function consentDisclosure(surface) {
     when: "at session start",
     executable: "runtime/agdf-session-check.js inside the installed AGDF runtime",
     reads: "AGDF runtime identity and .agdf/control state in the current repository",
-    writes: "one AGDF-owned intent receipt and, only where supported, one exact host permission rule",
+    writes: surface === "claude" ? "nothing; enabling the AGDF plugin is the consent" : "one AGDF-owned intent receipt",
     network: "none",
     permission_owner: permissionOwner,
     renewal: "material command, runtime, source, scope or adapter identity change requires renewed consent",
-    revocation: `npx --yes @agdf/cli@latest runtime-checks manual --surface ${surface}`,
+    revocation: surface === "claude" ? "claude plugin disable agdf@agdf" : `npx --yes @agdf/cli@latest runtime-checks manual --surface ${surface}`,
     gate_authority: "none",
     choices: [...RUNTIME_CHECK_DECISIONS],
   });

package/lib/runtime-check-consent/service.js

@@ -4,13 +4,12 @@ import { fileURLToPath } from "node:url";
 import { join } from "node:path";
 import process from "node:process";
 import { generatedRoot, pluginDefinition } from "../cli/runtime-context.js";
-import { defaultOpenCodeConfigDir, resolveOpenCodeInstalledPackage } from "../installers/opencode.js";
+import { openCodeRuntimeSource, executeOpenCodeRuntimeCheck } from "../host-adapters/opencode/runtime-check.js";
 import { defaultAgdfDataRoot } from "../installers/local-marketplace.js";
-import { digestNormalizedPluginSource } from "../runtime/plugin-provenance.js";
+import { digestNormalizedPluginSource } from "#agdf-core/runtime/plugin-provenance.js";
 import { fixedRuntimeCheckCommand, runtimeCheckCapabilityIdentity } from "./contract.js";
 import { consentDisclosure, resolveRuntimeCheckDecision } from "./coordinator.js";
-import { claudePermissionRule } from "./adapters.js";
-import { configureClaudeExactRuntimeRule, defaultClaudeSettingsPath, revokeClaudeRuntimeRule } from "./claude-settings.js";
+import { CLAUDE_PLUGIN_DISABLE_COMMAND, claudeRuntimeCheckState, removeLegacyClaudeRuntimeCheckState } from "../host-adapters/claude/runtime-check.js";
 import { createRuntimeCheckReceipt, readRuntimeCheckReceipt, writeRuntimeCheckReceipt } from "./state.js";
 
 export { fixedRuntimeCheckCommand } from "./contract.js";
@@ -25,7 +24,7 @@ export function prepareInstallConsent(surface, options = {}, adapters = {}) {
 
 function prospectiveRuntimeCheckIdentity(surface, platform = process.platform) {
   if (surface === "opencode") {
-    const installed = resolveOpenCodeInstalledPackage(defaultOpenCodeConfigDir(), pluginDefinition.opencode.npmPackage);
+    const installed = openCodeRuntimeSource();
     if (!installed.loadable || !installed.digest) return null;
     return runtimeCheckCapabilityIdentity({
       capability: pluginDefinition.automaticRuntimeChecks,
@@ -52,6 +51,7 @@ function prospectiveRuntimeCheckIdentity(surface, platform = process.platform) {
 }
 
 export function retainCurrentInstallConsent(surface, dataRoot = defaultAgdfDataRoot(), platform = process.platform) {
+  if (surface === "claude") return null;
   const capabilityIdentity = prospectiveRuntimeCheckIdentity(surface, platform);
   if (!capabilityIdentity) return null;
   const current = readRuntimeCheckReceipt(dataRoot, surface);
@@ -66,6 +66,14 @@ export function retainCurrentInstallConsent(surface, dataRoot = defaultAgdfDataR
 
 export function persistInstallConsent({ surface, decision, installed, dataRoot, platform, claudeSettingsPath }) {
   if (decision === "cancel") return { requested: "cancelled", effective: "cancelled", reason: "consent_not_provided", capability_identity: null, verification: "not_attempted", mutation: "none", rollback: "none" };
+  if (surface === "claude") {
+    const removed = removeLegacyClaudeRuntimeCheckState({ claudeSettingsPath, dataRoot: dataRoot ?? defaultAgdfDataRoot() });
+    return {
+      ...claudeRuntimeCheckState(decision === "enable" ? "enabled" : "manual"),
+      mutation: removed.length ? "legacy_rule_or_receipt_removed" : "none",
+      rollback: "none",
+    };
+  }
   const runtimeDigest = installed?.runtimeDigest ?? installed?.digest;
   if (!installed?.pluginRoot || !runtimeDigest || !installed?.sourceDigest) {
     return { requested: decision === "enable" ? "enabled" : "manual", effective: "manual", reason: "host_permission_unverified", capability_identity: null, verification: "unavailable", mutation: "none", rollback: "none" };
@@ -79,46 +87,33 @@ export function persistInstallConsent({ surface, decision, installed, dataRoot,
     command,
   });
   const receipt = createRuntimeCheckReceipt({ surface, decision, capabilityIdentity, command });
-  let configured = null;
-  let configurationReason = null;
-  if (surface === "claude" && decision === "enable") {
-    configured = configureClaudeExactRuntimeRule({
-      path: claudeSettingsPath ?? defaultClaudeSettingsPath(),
-      rule: claudePermissionRule({ platform: platform ?? process.platform, command }),
-    });
-    if (configured.status !== "configured") {
-      configurationReason = configured.reason;
-      configured = null;
-    }
-  }
-  try {
-    writeRuntimeCheckReceipt(dataRoot ?? defaultAgdfDataRoot(), receipt);
-  } catch (error) {
-    configured?.rollback();
-    throw error;
-  }
-  if (configurationReason) return { requested: "enabled", effective: "degraded", reason: configurationReason, capability_identity: capabilityIdentity, verification: "conflict", mutation: "receipt_written", rollback: "none" };
+  writeRuntimeCheckReceipt(dataRoot ?? defaultAgdfDataRoot(), receipt);
   return {
     requested: receipt.requested_state,
     effective: receipt.requested_state === "manual" ? "manual" : "decision_required",
     reason: receipt.requested_state === "manual" ? "consent_not_provided" : "host_permission_unverified",
     capability_identity: capabilityIdentity,
     verification: receipt.requested_state === "manual" ? "not_required" : "host_unverified",
-    mutation: surface === "claude" && decision === "enable" ? "exact_rule_and_receipt_written" : "receipt_written",
+    mutation: "receipt_written",
     rollback: "none",
   };
 }
 
 export function setRuntimeChecksManual({ dataRoot = defaultAgdfDataRoot(), surface, platform = process.platform, claudeSettingsPath }) {
+  if (surface === "claude") {
+    const removed = removeLegacyClaudeRuntimeCheckState({ claudeSettingsPath, dataRoot });
+    return {
+      ...claudeRuntimeCheckState("manual"),
+      effective: "unavailable",
+      reason: "unsupported_host_capability",
+      mutation: removed.length ? "legacy_rule_or_receipt_removed" : "none",
+      rollback: "none",
+      next_action: `Claude Code runs the AGDF session check whenever the AGDF plugin is enabled; to stop it, run: ${CLAUDE_PLUGIN_DISABLE_COMMAND}`,
+    };
+  }
   const result = readRuntimeCheckReceipt(dataRoot, surface);
   if (result.status === "receipt_missing") return { requested: "manual", effective: "manual", reason: "consent_not_provided", capability_identity: null, verification: "not_required", mutation: "none", rollback: "none", path: result.path };
   if (result.status !== "valid") return { requested: "manual", effective: result.status, reason: result.status, capability_identity: null, verification: "unavailable", mutation: "none", rollback: "none", path: result.path };
-  if (surface === "claude" && result.receipt.requested_state === "enabled") {
-    revokeClaudeRuntimeRule({
-      path: claudeSettingsPath ?? defaultClaudeSettingsPath(),
-      rule: claudePermissionRule({ platform, command: result.receipt.command }),
-    });
-  }
   const receipt = createRuntimeCheckReceipt({
     surface,
     decision: "manual",
@@ -132,13 +127,14 @@ export function setRuntimeChecksManual({ dataRoot = defaultAgdfDataRoot(), surfa
     reason: "consent_not_provided",
     capability_identity: receipt.capability_identity,
     verification: "not_required",
-    mutation: surface === "claude" ? "exact_owned_rule_removed" : "receipt_updated",
+    mutation: "receipt_updated",
     rollback: "none",
     path: result.path,
   };
 }
 
 export function runtimeCheckStatus(dataRoot = defaultAgdfDataRoot(), surface, platform = process.platform) {
+  if (surface === "claude") return { ...claudeRuntimeCheckState(), mutation: "none", rollback: "none" };
   const result = readRuntimeCheckReceipt(dataRoot, surface);
   if (result.status !== "valid") return { requested: "unknown", effective: result.status, reason: result.status, capability_identity: null, verification: "unavailable", mutation: "none", rollback: "none", path: result.path };
   const currentIdentity = prospectiveRuntimeCheckIdentity(surface, platform);
@@ -157,25 +153,5 @@ export function executeOpenCodeAutomaticRuntimeCheck({
   statusResolver = runtimeCheckStatus,
   entrypointExists = existsSync,
 } = {}) {
-  const status = statusResolver(dataRoot, "opencode");
-  if (status.requested !== "enabled" || status.effective !== "decision_required") {
-    return { ...status, ran: false, output: "" };
-  }
-  const entrypoint = join(packageRoot, "generated", "plugins", "agdf", "runtime", "agdf-session-check.js");
-  if (!entrypointExists(entrypoint)) {
-    return { ...status, effective: "unavailable", reason: "unsupported_host_capability", verification: "entrypoint_missing", ran: false, output: "" };
-  }
-  const child = run(executable, [entrypoint], {
-    cwd: directory,
-    env: { ...process.env, AGDF_SURFACE: "opencode" },
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout: 10000,
-    maxBuffer: 1024 * 1024,
-  });
-  const output = String(child.stdout || "").trim().slice(0, 20000);
-  if (child.status !== 0 || !output.includes("AGDF automatic runtime check:")) {
-    return { ...status, effective: "degraded", reason: "host_permission_unverified", verification: "execution_failed", ran: true, output: "" };
-  }
-  return { ...status, effective: "enabled", reason: "none", verification: "host_observed", ran: true, output };
+  return executeOpenCodeRuntimeCheck({ directory, dataRoot, packageRoot, run, executable, statusResolver, entrypointExists });
 }

package/lib/runtime-check-consent/state.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { renameSyncWithRetry } from "../fs-swap.js";
+import { renameSyncWithRetry } from "#agdf-core/fs-swap.js";
 
 export function runtimeCheckReceiptPath(dataRoot, surface) {
   if (!["codex", "claude", "copilot", "opencode"].includes(surface)) throw new Error("AGDF_RUNTIME_CHECK_RECEIPT_SURFACE_INVALID");