create-principles-disciple 1.104.2 → 1.105.0

package/host-runtime/dist/production-rulehost-gate.js

@@ -0,0 +1,294 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { buildRuleHostAction, estimateLineChanges, mergeDecisions, SqliteConnection, UNAVAILABLE_RULE_CONTEXT, validateRuleContextV2, validateRuleHostResult, } from '@principles/core/runtime-v2';
+import { createNodeRuleImplementationRuntime, MAX_ACTIVE_RULES, RULE_BATCH_SOURCE_BYTES, RULE_SOURCE_BYTES, } from './rule-implementation-runtime.js';
+const WARNING_LIMIT = 500;
+const MAX_WARNINGS = 16;
+const GATE_DEADLINE_MS = 3_000;
+const ARTIFACT_CONTENT_BYTES = 512 * 1024;
+function boundedWarning(reason, nextAction) {
+    return `${reason}; nextAction=${nextAction}`.replace(/\s+/g, ' ').slice(0, WARNING_LIMIT);
+}
+function addWarning(warnings, reason, nextAction) {
+    if (warnings.length < MAX_WARNINGS)
+        warnings.push(boundedWarning(reason, nextAction));
+}
+function remainingGateMs(startedAt) {
+    return GATE_DEADLINE_MS - (Date.now() - startedAt);
+}
+function createDeadlinePromise(remaining) {
+    let timer;
+    const promise = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error('gate_deadline_exceeded')), remaining);
+        timer.unref?.();
+    });
+    return { promise, clear: () => { if (timer !== undefined)
+            clearTimeout(timer); } };
+}
+async function withinGateDeadline(value, startedAt) {
+    const remaining = remainingGateMs(startedAt);
+    if (remaining <= 0)
+        throw new Error('gate_deadline_exceeded');
+    const deadline = createDeadlinePromise(remaining);
+    try {
+        return await Promise.race([Promise.resolve(value), deadline.promise]);
+    }
+    finally {
+        deadline.clear();
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function readToolInput(rawPayload) {
+    if (!isRecord(rawPayload) || !Object.hasOwn(rawPayload, 'toolInput'))
+        return null;
+    const input = rawPayload.toolInput;
+    if (!isRecord(input) || typeof input.toolName !== 'string' || input.toolName.trim().length === 0)
+        return null;
+    const { params } = input;
+    if (!isRecord(params))
+        return null;
+    return { toolName: input.toolName, params };
+}
+function isRuleMeta(value) {
+    return isRecord(value) && typeof value.name === 'string' && typeof value.version === 'string'
+        && typeof value.ruleId === 'string' && typeof value.coversCondition === 'string';
+}
+function isRuleContext(value) {
+    return validateRuleContextV2(value).valid;
+}
+function isRuleResult(value) {
+    return validateRuleHostResult(value).valid;
+}
+export function createProductionRuleHostGate(options = {}) {
+    const implementationRuntime = options.implementationRuntime ?? createNodeRuleImplementationRuntime();
+    return async (event) => {
+        const startedAt = Date.now();
+        const warnings = [];
+        const input = readToolInput(event.rawPayload);
+        if (!input || input.toolName !== event.context.toolName) {
+            return { decision: 'allow', source: event.source, warnings: [boundedWarning('tool_input_invalid', 'decode and validate toolName and params before dispatch')] };
+        }
+        const isBash = new Set(['bash', 'exec', 'execute', 'run_shell_command']).has(input.toolName);
+        const isWrite = new Set(['write', 'write_file', 'edit', 'edit_file', 'replace', 'apply_patch']).has(input.toolName);
+        const action = buildRuleHostAction(input.toolName, input.params, event.context.workspaceDir, { isBashTool: isBash, isWriteTool: isWrite });
+        if (action.normalizedPath === null)
+            return { decision: 'allow', source: event.source, metadata: { evaluatedLiveRules: 0 } };
+        let context;
+        let enrichment = { currentGfi: 0, recentThinking: false, epTier: 0, bashRisk: 'unknown' };
+        const request = {
+            workspaceDir: event.context.workspaceDir, sessionId: event.context.sessionId,
+            targetPath: action.normalizedPath, toolName: input.toolName, rawPayload: event.rawPayload,
+        };
+        if (options.ruleInputEnrichmentProvider) {
+            try {
+                const candidate = await withinGateDeadline(options.ruleInputEnrichmentProvider(request), startedAt);
+                if (isRecord(candidate) && typeof candidate.currentGfi === 'number' && Number.isFinite(candidate.currentGfi)
+                    && typeof candidate.recentThinking === 'boolean' && typeof candidate.epTier === 'number' && Number.isFinite(candidate.epTier)
+                    && (candidate.bashRisk === 'safe' || candidate.bashRisk === 'normal' || candidate.bashRisk === 'dangerous' || candidate.bashRisk === 'unknown')) {
+                    enrichment = { currentGfi: candidate.currentGfi, recentThinking: candidate.recentThinking, epTier: candidate.epTier, bashRisk: candidate.bashRisk };
+                }
+                else
+                    addWarning(warnings, 'rule_input_enrichment_invalid', 'repair the host enrichment provider');
+            }
+            catch (error) {
+                addWarning(warnings, `rule_input_enrichment_failed: ${error instanceof Error ? error.message : String(error)}`, 'inspect the host enrichment provider');
+            }
+        }
+        if (options.ruleContextProvider) {
+            try {
+                const candidate = await withinGateDeadline(options.ruleContextProvider(request), startedAt);
+                if (candidate === undefined) {
+                    context = undefined;
+                }
+                else {
+                    const validation = validateRuleContextV2(candidate);
+                    if (isRuleContext(candidate))
+                        context = candidate;
+                    else {
+                        context = UNAVAILABLE_RULE_CONTEXT;
+                        addWarning(warnings, `rule_context_invalid: ${validation.errors.join('; ')}`, 'repair the host context provider');
+                    }
+                }
+            }
+            catch (error) {
+                context = UNAVAILABLE_RULE_CONTEXT;
+                addWarning(warnings, `rule_context_provider_failed: ${error instanceof Error ? error.message : String(error)}`, 'inspect the host context provider and retry');
+            }
+        }
+        const dbPath = path.join(event.context.workspaceDir, '.pd', 'state.db');
+        if (remainingGateMs(startedAt) <= 0) {
+            return { decision: 'allow', source: event.source, warnings: [boundedWarning('gate_deadline_exceeded', 'inspect host context providers and active RuleCode resource use')] };
+        }
+        if (!fs.existsSync(dbPath)) {
+            return { decision: 'allow', source: event.source, warnings: [boundedWarning('activation_db_not_found', 'initialize_workspace_runtime_state')] };
+        }
+        const connection = new SqliteConnection({ workspaceDir: event.context.workspaceDir, readonly: true, bootstrapIfMissing: false });
+        const candidates = [];
+        try {
+            const rows = connection.getDb().prepare(`
+        SELECT a.activation_id, a.artifact_id, a.target_ref, a.action,
+               p.source_rule_id, p.source_principle_id,
+               length(CAST(p.content_json AS BLOB)) AS content_bytes
+        FROM activations a JOIN pi_artifacts p ON a.artifact_id = p.artifact_id
+        WHERE a.channel = 'code_tool_hook' AND a.deactivated_at IS NULL
+        ORDER BY a.activated_at ASC
+        LIMIT ?
+      `).all(MAX_ACTIVE_RULES + 1);
+            if (!Array.isArray(rows)) {
+                addWarning(warnings, 'activation_query_invalid', 'inspect state.db schema and integrity');
+            }
+            else if (rows.length > MAX_ACTIVE_RULES) {
+                return { decision: 'allow', source: event.source, warnings: [boundedWarning(`active_rule_limit_exceeded: maximum ${MAX_ACTIVE_RULES}`, 'deactivate excess active RuleHost rules and retry')], metadata: { evaluatedLiveRules: 0 } };
+            }
+            else {
+                for (const row of rows) {
+                    if (!isRecord(row) || typeof row.content_bytes !== 'number' || !Number.isSafeInteger(row.content_bytes) || row.content_bytes < 0) {
+                        return { decision: 'allow', source: event.source, warnings: [boundedWarning('artifact_content_size_invalid', 'inspect state.db artifact content integrity')], metadata: { evaluatedLiveRules: 0 } };
+                    }
+                    if (row.content_bytes > ARTIFACT_CONTENT_BYTES) {
+                        const activation = typeof row.activation_id === 'string' ? row.activation_id : 'unknown';
+                        return { decision: 'allow', source: event.source, warnings: [boundedWarning(`artifact_content_budget_exceeded: activation=${activation} bytes=${row.content_bytes} maximum=${ARTIFACT_CONTENT_BYTES}`, 'reduce the active artifact envelope and reactivate the rule')], metadata: { evaluatedLiveRules: 0 } };
+                    }
+                }
+                const groups = new Map();
+                for (const row of rows) {
+                    if (!isRecord(row) || typeof row.target_ref !== 'string' || row.target_ref.length === 0) {
+                        addWarning(warnings, 'activation_row_invalid', 'deactivate and recreate the malformed activation');
+                        continue;
+                    }
+                    const group = groups.get(row.target_ref) ?? [];
+                    group.push(row);
+                    groups.set(row.target_ref, group);
+                }
+                for (const [targetRef, group] of groups) {
+                    if (group.length !== 1) {
+                        addWarning(warnings, `duplicate_active_activation: ${targetRef}`, 'deactivate all but one activation for this target_ref');
+                        continue;
+                    }
+                    const [row] = group;
+                    if (!row || row.action !== 'code_tool_hook_live_activate')
+                        continue;
+                    const activationId = row.activation_id;
+                    const artifactId = row.artifact_id;
+                    const expectedContentBytes = row.content_bytes;
+                    if (typeof activationId !== 'string' || typeof artifactId !== 'string' || typeof expectedContentBytes !== 'number') {
+                        addWarning(warnings, 'activation_required_fields_invalid', 'deactivate and recreate the activation');
+                        continue;
+                    }
+                    const contentRow = connection.getDb().prepare(`
+            SELECT content_json, length(CAST(content_json AS BLOB)) AS content_bytes
+            FROM pi_artifacts WHERE artifact_id = ?
+          `).get(artifactId);
+                    if (!isRecord(contentRow) || typeof contentRow.content_json !== 'string'
+                        || typeof contentRow.content_bytes !== 'number' || !Number.isSafeInteger(contentRow.content_bytes)) {
+                        addWarning(warnings, `activation_artifact_invalid: ${activationId}`, 'inspect state.db artifact content integrity');
+                        continue;
+                    }
+                    const contentJson = contentRow.content_json;
+                    const returnedContentBytes = Buffer.byteLength(contentJson, 'utf8');
+                    if (contentRow.content_bytes > ARTIFACT_CONTENT_BYTES || returnedContentBytes > ARTIFACT_CONTENT_BYTES) {
+                        return { decision: 'allow', source: event.source, warnings: [boundedWarning(`artifact_content_budget_exceeded: activation=${activationId} bytes=${Math.max(contentRow.content_bytes, returnedContentBytes)} maximum=${ARTIFACT_CONTENT_BYTES}`, 'reduce the active artifact envelope and reactivate the rule')], metadata: { evaluatedLiveRules: 0 } };
+                    }
+                    if (contentRow.content_bytes !== expectedContentBytes || returnedContentBytes !== contentRow.content_bytes) {
+                        return { decision: 'allow', source: event.source, warnings: [boundedWarning(`artifact_content_size_changed: activation=${activationId}`, 'retry after the active artifact update completes')], metadata: { evaluatedLiveRules: 0 } };
+                    }
+                    try {
+                        const content = JSON.parse(contentJson);
+                        if (!isRecord(content) || typeof content.implementationCode !== 'string' || content.implementationCode.length === 0) {
+                            addWarning(warnings, `activation_artifact_invalid: ${activationId}`, 'regenerate the rule artifact with implementationCode');
+                            continue;
+                        }
+                        const sourceBytes = Buffer.byteLength(content.implementationCode, 'utf8');
+                        if (sourceBytes > RULE_SOURCE_BYTES) {
+                            return { decision: 'allow', source: event.source, warnings: [boundedWarning(`rule_source_budget_exceeded: activation=${activationId} bytes=${sourceBytes}`, `reduce each RuleCode source below ${RULE_SOURCE_BYTES} bytes`)], metadata: { evaluatedLiveRules: 0 } };
+                        }
+                        if (Object.hasOwn(content, 'requiresContextVersion')) {
+                            if (content.requiresContextVersion !== 2) {
+                                addWarning(warnings, `unsupported_context_version: ${String(content.requiresContextVersion)}`, 'regenerate the rule artifact for context version 2');
+                                continue;
+                            }
+                            if (!context) {
+                                addWarning(warnings, 'rule_context_v2_unavailable', 'enable and wire the host rule context provider');
+                                continue;
+                            }
+                        }
+                        const ruleId = typeof content.ruleId === 'string' ? content.ruleId : typeof row.source_rule_id === 'string' ? row.source_rule_id : artifactId;
+                        const principleId = typeof content.principleId === 'string' ? content.principleId : typeof row.source_principle_id === 'string' ? row.source_principle_id : ruleId;
+                        const fallbackMeta = { name: activationId, version: '1', ruleId, coversCondition: 'all' };
+                        candidates.push({ implId: activationId, ruleId, principleId, meta: isRuleMeta(content.meta) ? content.meta : fallbackMeta, source: content.implementationCode });
+                    }
+                    catch (error) {
+                        addWarning(warnings, `implementation_unhealthy: ${error instanceof Error ? error.message : String(error)}`, 'fix the RuleCode and reactivate the rule');
+                    }
+                }
+            }
+            const hostInput = {
+                action,
+                workspace: { isRiskPath: false, planStatus: 'NONE', hasPlanFile: false },
+                session: { sessionId: event.context.sessionId, currentGfi: enrichment.currentGfi, recentThinking: enrichment.recentThinking },
+                evolution: { epTier: enrichment.epTier },
+                derived: { estimatedLineChanges: estimateLineChanges({ toolName: input.toolName, params: input.params }), bashRisk: enrichment.bashRisk },
+                ...(context ? { context } : {}),
+            };
+            const batchSourceBytes = candidates.reduce((sum, candidate) => sum + Buffer.byteLength(candidate.source, 'utf8'), 0);
+            if (batchSourceBytes > RULE_BATCH_SOURCE_BYTES) {
+                return { decision: 'allow', source: event.source, warnings: [boundedWarning(`rule_source_budget_exceeded: batchBytes=${batchSourceBytes}`, `reduce total active RuleCode below ${RULE_BATCH_SOURCE_BYTES} bytes`)], metadata: { evaluatedLiveRules: 0 } };
+            }
+            const batchSources = candidates.map((candidate) => ({ source: candidate.source, filename: `activation-${candidate.implId}` }));
+            const remaining = remainingGateMs(startedAt);
+            if (remaining <= 0) {
+                return { decision: 'allow', source: event.source, warnings: [boundedWarning('gate_deadline_exceeded', 'reduce active RuleCode count or source size and retry')], metadata: { evaluatedLiveRules: 0 } };
+            }
+            const batch = implementationRuntime.evaluateBatch(batchSources, hostInput, remaining);
+            if (!batch.ok || !batch.results) {
+                return { decision: 'allow', source: event.source, warnings: [boundedWarning(`${batch.reason ?? 'rule_batch_failed'}: ${batch.detail ?? 'unknown failure'}`, 'inspect active RuleCode resource use and repair or deactivate the unhealthy rule')], metadata: { evaluatedLiveRules: 0 } };
+            }
+            const timedOutChild = batch.results.find((candidate) => !candidate.ok && candidate.error?.includes('timed out'));
+            if (timedOutChild) {
+                return { decision: 'allow', source: event.source, warnings: [boundedWarning(`rule_batch_timeout: ${timedOutChild.error ?? 'unknown child timeout'}`, 'fix or deactivate the unhealthy RuleCode and retry')], metadata: { evaluatedLiveRules: 0 } };
+            }
+            const implementations = [];
+            for (let index = 0; index < candidates.length; index += 1) {
+                const candidate = candidates[index];
+                const batchResult = batch.results[index];
+                if (!candidate || !batchResult) {
+                    addWarning(warnings, 'rule_batch_result_missing', 'inspect the RuleCode runtime result contract');
+                    continue;
+                }
+                if (!batchResult.ok) {
+                    addWarning(warnings, `implementation_unhealthy: ${batchResult.error ?? 'unknown child error'}`, 'fix the RuleCode and reactivate the rule');
+                    continue;
+                }
+                const validation = validateRuleHostResult(batchResult.result);
+                if (!isRuleResult(batchResult.result)) {
+                    addWarning(warnings, `invalid RuleHostResult: ${validation.errors.join('; ')}`, 'fix the RuleCode result and reactivate the rule');
+                    continue;
+                }
+                const validatedResult = batchResult.result.matched
+                    ? { ...batchResult.result, ruleId: candidate.ruleId, principleId: candidate.principleId }
+                    : batchResult.result;
+                implementations.push({ ...candidate, evaluate: () => validatedResult });
+            }
+            const result = mergeDecisions(implementations, hostInput, {
+                warn(message) { addWarning(warnings, message, 'inspect the unhealthy activation and RuleCode output'); },
+            });
+            if (result?.decision === 'block') {
+                if (result.reason.trim().length === 0) {
+                    addWarning(warnings, 'deny_reason_missing', 'fix the RuleCode to return a non-empty block reason');
+                    return { decision: 'allow', source: event.source, warnings, metadata: { evaluatedLiveRules: implementations.length } };
+                }
+                return { decision: 'deny', reason: result.reason, source: event.source, ...(warnings.length ? { warnings } : {}), metadata: { evaluatedLiveRules: implementations.length, ruleId: result.ruleId, principleId: result.principleId } };
+            }
+            return { decision: 'allow', source: event.source, ...(warnings.length ? { warnings } : {}), metadata: { evaluatedLiveRules: implementations.length, ruleDecision: result?.decision ?? 'allow' } };
+        }
+        catch (error) {
+            addWarning(warnings, `activation_read_failed: ${error instanceof Error ? error.message : String(error)}`, 'inspect state.db schema and integrity');
+            return { decision: 'allow', source: event.source, warnings, metadata: { evaluatedLiveRules: 0 } };
+        }
+        finally {
+            connection.close();
+        }
+    };
+}

package/host-runtime/dist/rule-implementation-runtime.d.ts

@@ -0,0 +1,25 @@
+export declare const RULE_BATCH_TIMEOUT_MS = 2500;
+export declare const RULE_BATCH_OUTPUT_BYTES: number;
+export declare const RULE_SOURCE_BYTES: number;
+export declare const RULE_BATCH_SOURCE_BYTES: number;
+export declare const MAX_ACTIVE_RULES = 32;
+export interface RuleBatchSource {
+    source: string;
+    filename: string;
+}
+export interface RuleBatchResult {
+    ok: boolean;
+    result?: unknown;
+    error?: string;
+}
+export type RuleBatchFailureReason = 'rule_batch_timeout' | 'rule_batch_output_exceeded' | 'rule_batch_failed';
+export interface RuleBatchEvaluation {
+    ok: boolean;
+    results?: readonly RuleBatchResult[];
+    reason?: RuleBatchFailureReason;
+    detail?: string;
+}
+export interface RuleImplementationRuntime {
+    evaluateBatch(rules: readonly RuleBatchSource[], input: unknown, timeoutMs: number): RuleBatchEvaluation;
+}
+export declare function createNodeRuleImplementationRuntime(): RuleImplementationRuntime;

package/host-runtime/dist/rule-implementation-runtime.js

@@ -0,0 +1,114 @@
+import { spawnSync } from 'node:child_process';
+export const RULE_BATCH_TIMEOUT_MS = 2_500;
+export const RULE_BATCH_OUTPUT_BYTES = 64 * 1024;
+export const RULE_SOURCE_BYTES = 64 * 1024;
+export const RULE_BATCH_SOURCE_BYTES = 256 * 1024;
+export const MAX_ACTIVE_RULES = 32;
+const EVALUATION_PROCESS_SOURCE = String.raw `
+const vm = require('node:vm');
+const fs = require('node:fs');
+function normalize(sourceCode) {
+  const withoutExports = sourceCode
+    .replace(/export\s+const\s+meta\s*=/, 'const meta =')
+    .replace(/export\s+function\s+evaluate\s*\(/, 'function evaluate(');
+  return withoutExports + '\nglobalThis.__pdRuleModule = { meta: typeof meta === "undefined" ? undefined : meta, evaluate: typeof evaluate === "undefined" ? undefined : evaluate };';
+}
+function preview(error) { return String(error).slice(0, 500); }
+try {
+  const workerData = JSON.parse(fs.readFileSync(0, 'utf8'));
+  const results = [];
+  for (const rule of workerData.rules) {
+    try {
+      const context = vm.createContext(Object.create(null));
+      new vm.Script(normalize(rule.source), { filename: rule.filename }).runInContext(context, { timeout: 1000 });
+      if (!context.__pdRuleModule || typeof context.__pdRuleModule.evaluate !== 'function') throw new Error('compiled module has no evaluate function');
+      // Sandbox boundary: hand the context ONLY a primitive JSON string and
+      // build the call input + helpers with the context's own intrinsics.
+      // Passing host-realm objects (the parsed input, a host-built helpers
+      // object) would let rule source walk .constructor.constructor back to
+      // the host realm's Function constructor and reach the child process
+      // and require — a full sandbox escape with user privileges.
+      context.__pdInputJson = JSON.stringify(workerData.input);
+      new vm.Script(
+        'const __pdCallInput = JSON.parse(globalThis.__pdInputJson);' +
+        'delete globalThis.__pdInputJson;' +
+        'const __pdCallHelpers = Object.freeze({' +
+        ' isRiskPath: () => __pdCallInput.workspace.isRiskPath,' +
+        ' getToolName: () => __pdCallInput.action.toolName,' +
+        ' getEstimatedLineChanges: () => __pdCallInput.derived.estimatedLineChanges,' +
+        ' getBashRisk: () => __pdCallInput.derived.bashRisk,' +
+        ' hasPlanFile: () => __pdCallInput.workspace.hasPlanFile,' +
+        ' getPlanStatus: () => __pdCallInput.workspace.planStatus,' +
+        ' getEpTier: () => __pdCallInput.evolution.epTier' +
+        '});', { filename: rule.filename + '.bootstrap' }
+      ).runInContext(context, { timeout: 1000 });
+      const result = new vm.Script('__pdRuleModule.evaluate(__pdCallInput, __pdCallHelpers)', { filename: rule.filename + '.call' })
+        .runInContext(context, { timeout: 1000 });
+      results.push({ ok: true, result });
+    } catch (error) {
+      results.push({ ok: false, error: preview(error) });
+    }
+  }
+  process.stdout.write(JSON.stringify({ ok: true, results }));
+} catch (error) {
+  process.stdout.write(JSON.stringify({ ok: false, error: preview(error) }));
+  process.exitCode = 1;
+}
+`;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseBatchResults(value, expectedLength) {
+    if (!isRecord(value) || value.ok !== true || !Array.isArray(value.results) || value.results.length !== expectedLength)
+        return null;
+    const results = [];
+    for (const candidate of value.results) {
+        if (!isRecord(candidate) || typeof candidate.ok !== 'boolean')
+            return null;
+        if (candidate.ok) {
+            if (!Object.hasOwn(candidate, 'result'))
+                return null;
+            results.push({ ok: true, result: candidate.result });
+        }
+        else {
+            if (typeof candidate.error !== 'string')
+                return null;
+            results.push({ ok: false, error: candidate.error.slice(0, 500) });
+        }
+    }
+    return results;
+}
+export function createNodeRuleImplementationRuntime() {
+    return {
+        evaluateBatch(rules, input, timeoutMs) {
+            const child = spawnSync(process.execPath, ['--max-old-space-size=32', '-e', EVALUATION_PROCESS_SOURCE], {
+                input: JSON.stringify({ rules, input }), encoding: 'utf8', timeout: Math.max(1, Math.min(timeoutMs, RULE_BATCH_TIMEOUT_MS)),
+                maxBuffer: RULE_BATCH_OUTPUT_BYTES, windowsHide: true,
+            });
+            if (child.error) {
+                const code = isRecord(child.error) && typeof child.error.code === 'string' ? child.error.code : '';
+                if (code === 'ETIMEDOUT')
+                    return { ok: false, reason: 'rule_batch_timeout', detail: child.error.message.slice(0, 500) };
+                if (code === 'ENOBUFS')
+                    return { ok: false, reason: 'rule_batch_output_exceeded', detail: child.error.message.slice(0, 500) };
+                return { ok: false, reason: 'rule_batch_failed', detail: child.error.message.slice(0, 500) };
+            }
+            if (Buffer.byteLength(child.stdout, 'utf8') >= RULE_BATCH_OUTPUT_BYTES) {
+                return { ok: false, reason: 'rule_batch_output_exceeded', detail: 'child output reached the configured byte bound' };
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(child.stdout);
+            }
+            catch {
+                return { ok: false, reason: 'rule_batch_failed', detail: `child returned invalid JSON: ${child.stderr.trim().slice(0, 300)}` };
+            }
+            const results = parseBatchResults(parsed, rules.length);
+            if (!results) {
+                const detail = isRecord(parsed) && typeof parsed.error === 'string' ? parsed.error.slice(0, 500) : 'child result shape invalid';
+                return { ok: false, reason: 'rule_batch_failed', detail };
+            }
+            return { ok: true, results };
+        },
+    };
+}

package/host-runtime/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@principles/host-runtime",
+  "version": "0.1.0",
+  "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "lint": "eslint \"src/**/*.ts\""
+  },
+  "dependencies": {
+    "@principles/core": "file:../core",
+    "better-sqlite3": "^13.0.3",
+    "js-yaml": "^5.2.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^26.1.2",
+    "@types/js-yaml": "^4.0.9",
+    "typescript": "^7.0.2",
+    "vite": "^8.0.16",
+    "vitest": "^4.1.10"
+  },
+  "license": "MIT"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.104.2",
+  "version": "1.105.0",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {
@@ -12,6 +12,7 @@
     "pd-cli",
     "console",
     "core",
+    "host-runtime",
     "templates",
     "README.md",
     "LICENSE"

package/pd-cli/dist/commands/health-codex.d.ts

@@ -0,0 +1,7 @@
+interface CodexHealthOptions {
+    workspace?: string;
+    json?: boolean;
+}
+export declare function handleHealthCodex(opts?: CodexHealthOptions): Promise<void>;
+export {};
+//# sourceMappingURL=health-codex.d.ts.map

package/pd-cli/dist/commands/health-codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-codex.d.ts","sourceRoot":"","sources":["../../src/commands/health-codex.ts"],"names":[],"mappings":"AAsBA,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA2GD,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoHpF"}