kiokuko 1.0.6 → 1.0.8

package/dist/assurance/inspect.js

@@ -0,0 +1,29 @@
+import * as z from 'zod/v4';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { KiokukoError } from '../errors.js';
+import { parseAssurance } from './contracts.js';
+export const inspectTaskSchema = z.object({
+    cwd: z.string().min(1).max(4096), operation: z.enum(['read', 'files', 'status', 'skill']),
+    path: z.string().min(1).max(500).optional(),
+}).strict();
+/** Preparation-only inspection: fixed operations, no shell parser or executable supplied by the model. */
+export function inspectTask(raw) {
+    const input = parseAssurance(inspectTaskSchema, raw);
+    const root = realpathSync(execFileSync('git', ['-C', realpathSync(input.cwd), 'rev-parse', '--show-toplevel'], { encoding: 'utf8', timeout: 5000 }).trim());
+    if (input.operation === 'files' || input.operation === 'status') {
+        const args = input.operation === 'files' ? ['ls-files', '--cached', '--others', '--exclude-standard'] : ['status', '--short'];
+        return { text: execFileSync('git', ['-C', root, ...args], { encoding: 'utf8', timeout: 5000, maxBuffer: 512000 }) };
+    }
+    const base = input.operation === 'skill' ? path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../skills') : root;
+    const name = input.path ?? '';
+    if (!name || path.isAbsolute(name) || name.split(/[\\/]/).includes('..') || name.split(/[\\/]/).some(p => p === '.git' || p === '.env'))
+        throw new KiokukoError('VALIDATION_ERROR', 'Inspection path is invalid');
+    const resolved = realpathSync(path.join(base, name));
+    if (!resolved.startsWith(realpathSync(base) + path.sep) || !statSync(resolved).isFile() || statSync(resolved).size > 256000)
+        throw new KiokukoError('VALIDATION_ERROR', 'Inspection exceeds its file boundary');
+    return { text: readFileSync(resolved, 'utf8') };
+}
+//# sourceMappingURL=inspect.js.map

package/dist/assurance/inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../../src/assurance/inspect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,0GAA0G;AAC1G,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,MAAM,KAAK,GAAG,cAAc,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5J,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC9H,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACtH,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7H,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAClN,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;IAChN,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;AAClD,CAAC"}

package/dist/assurance/instructions.d.ts

@@ -0,0 +1,2 @@
+export declare const MEMORY_ASSURANCE_INSTRUCTIONS = "When available, inspect task_memory_status for the current delivery and assurance revision. Use task_memory_review for applicable delivered memories: adopt with current basis, invariant, counterexample and verifier, or explain inapplicability/contradiction. Reading alone is not application. For code changes link passing execution evidence to adopted memories; task_execution_evidence is model-reported, while Codex hook evidence is client-observed. Changed targets or deliveries invalidate prior verification. Use task_memory_refresh on the same run for new paths/errors; do not repeat task_prepare. PLAN and code review need grounded decisions, not implementation test runs. Preserve failure/interruption/cancellation as valid terminal outcomes. Capture corrections through memory_capture with exact entry ID/revision, condition, invariant, counterexample and verification; never auto-promote a declaration. Unsupported clients retain advisory operation and must not claim hook observation.";
+//# sourceMappingURL=instructions.d.ts.map

package/dist/assurance/instructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/assurance/instructions.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,s+BAAs+B,CAAC"}

package/dist/assurance/instructions.js

@@ -0,0 +1,2 @@
+export const MEMORY_ASSURANCE_INSTRUCTIONS = 'When available, inspect task_memory_status for the current delivery and assurance revision. Use task_memory_review for applicable delivered memories: adopt with current basis, invariant, counterexample and verifier, or explain inapplicability/contradiction. Reading alone is not application. For code changes link passing execution evidence to adopted memories; task_execution_evidence is model-reported, while Codex hook evidence is client-observed. Changed targets or deliveries invalidate prior verification. Use task_memory_refresh on the same run for new paths/errors; do not repeat task_prepare. PLAN and code review need grounded decisions, not implementation test runs. Preserve failure/interruption/cancellation as valid terminal outcomes. Capture corrections through memory_capture with exact entry ID/revision, condition, invariant, counterexample and verification; never auto-promote a declaration. Unsupported clients retain advisory operation and must not claim hook observation.';
+//# sourceMappingURL=instructions.js.map

package/dist/assurance/instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../../src/assurance/instructions.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG,m+BAAm+B,CAAC"}

package/dist/assurance/refresh.d.ts

@@ -0,0 +1,3 @@
+import type { SqliteDatabase } from '../db/adapter.js';
+export declare function refreshTaskMemory(db: SqliteDatabase, raw: unknown, signal?: AbortSignal): Promise<Record<string, unknown>>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/assurance/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/assurance/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAYvD,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,oCAiD7F"}

package/dist/assurance/refresh.js

@@ -0,0 +1,73 @@
+import { scopedMemoryUseSignal } from '../context/scoped-memory-use.js';
+import path from 'node:path';
+import { LedgerStore } from '../ledger/store.js';
+import { KiokukoError } from '../errors.js';
+import { assertCapabilityCatalogBinding } from '../akinator/capability-binding.js';
+import { deriveMemoryPolicy, resolveCapabilities, hasBlockingRequiredCapability } from '../akinator/capabilities.js';
+import { readContextBrokerRunState } from '../context/broker.js';
+import { queryScopedContextGated } from '../context/scoped-broker.js';
+import { resolveProjectWorkspaceReadOnly } from '../memory/workspaces.js';
+import { canonicalContentHash } from '../serialization/validate.js';
+import { memoryRefreshSchema, parseAssurance } from './contracts.js';
+import { assertAssuranceCwd, assuranceState, bindAssuranceRoot, taskAssuranceReport } from './service.js';
+export async function refreshTaskMemory(db, raw, signal) {
+    signal?.throwIfAborted();
+    const input = parseAssurance(memoryRefreshSchema, raw);
+    const run = new LedgerStore(db).readRun(input.runId);
+    if (!run)
+        throw new KiokukoError('NOT_FOUND', 'Task run not found');
+    assertCapabilityCatalogBinding(run.metadata, input.capabilities);
+    const project = await resolveProjectWorkspaceReadOnly(db, input.cwd);
+    if (!project || project.workspace !== run.workspace)
+        throw new KiokukoError('CONFLICT', 'Refresh repository differs from run');
+    for (const file of input.changedPaths)
+        if (path.isAbsolute(file) || file.split(/[\\/]/).includes('..')) {
+            throw new KiokukoError('VALIDATION_ERROR', 'Refresh paths must stay within the repository');
+        }
+    const digest = canonicalContentHash(input);
+    const prior = db.prepare('SELECT request_digest, response_json FROM task_assurance_requests WHERE run_id = ? AND request_id = ?')
+        .get(input.runId, input.requestId);
+    if (prior) {
+        if (prior.request_digest !== digest)
+            throw new KiokukoError('CONFLICT', 'Refresh request identity conflicts');
+        return JSON.parse(prior.response_json);
+    }
+    const state = assertAssuranceCwd(db, input.runId, input.cwd);
+    if (state.revision !== input.expectedRevision)
+        throw new KiokukoError('CONFLICT', 'Refresh revision changed');
+    const bound = run.metadata.kiokukoAgentTaskContextBinding;
+    const boundBudget = bound && typeof bound === 'object' && !Array.isArray(bound) ? bound.maxContextChars : undefined;
+    if (input.maxContextChars !== undefined && typeof boundBudget === 'number' && input.maxContextChars !== boundBudget)
+        throw new KiokukoError('CONFLICT', 'Refresh context budget differs from the prepared run');
+    const budget = input.maxContextChars ?? (typeof boundBudget === 'number' ? boundBudget : undefined);
+    const current = readContextBrokerRunState(db, input.runId);
+    const resolution = resolveCapabilities({ task: run.title ?? current.taskProfile.target ?? "task", profile: current.taskProfile, recommendedTags: current.recommendedTags, capabilities: input.capabilities, memoryUse: 'none' });
+    if (hasBlockingRequiredCapability(resolution))
+        throw new KiokukoError('CONFLICT', 'Required capability unavailable');
+    // Rank outside the write transaction; recheck the revision in the broker's atomic persistence gate.
+    let response = {};
+    await queryScopedContextGated(db, {
+        project, task: run.title ?? current.taskProfile.target ?? "task", taskProfile: current.taskProfile, runId: input.runId,
+        recommendedTags: current.recommendedTags, changedPaths: input.changedPaths, errorSignatures: input.errorSignatures,
+        ...(budget === undefined ? {} : { characterBudget: budget }),
+    }, candidate => {
+        const memoryUse = scopedMemoryUseSignal(db, run.workspace, candidate);
+        const policy = deriveMemoryPolicy(current.taskProfile, memoryUse, input.capabilities);
+        return { persist: !policy.contextWithheld, value: policy, assertBeforePersist: () => {
+                signal?.throwIfAborted();
+                if (scopedMemoryUseSignal(db, run.workspace, candidate) !== memoryUse)
+                    throw new KiokukoError('CONFLICT', 'Memory capability decision changed during refresh');
+                if (assuranceState(db, input.runId)?.revision !== input.expectedRevision)
+                    throw new KiokukoError('CONFLICT', 'Refresh lost a concurrent update');
+            } };
+    }, {}, (context, policy) => {
+        const after = assuranceState(db, input.runId);
+        if (after.revision === input.expectedRevision)
+            db.prepare('UPDATE task_assurance SET revision=revision+1 WHERE run_id=?').run(input.runId);
+        bindAssuranceRoot(db, input.runId, project.repositoryRoot, policy.contextWithheld ? 'capability_withheld' : context?.retrieval?.status);
+        response = { context, memoryPolicy: policy, assurance: taskAssuranceReport(db, input.runId, false) };
+        db.prepare('INSERT INTO task_assurance_requests VALUES (?, ?, ?, ?)').run(input.runId, input.requestId, digest, JSON.stringify(response));
+    });
+    return response;
+}
+//# sourceMappingURL=refresh.js.map

package/dist/assurance/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/assurance/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACrH,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAE1G,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAkB,EAAE,GAAY,EAAE,MAAoB;IAC5F,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,cAAc,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACpE,8BAA8B,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;IAC/H,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY;QAAE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;QAC9F,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC;SAC9H,GAAG,CAAoD,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxF,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;QAC9G,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAA4B,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IAC1D,MAAM,WAAW,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,KAAK,WAAW;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,sDAAsD,CAAC,CAAC;IAChN,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,IAAI,CAAC,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACjO,IAAI,6BAA6B,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IACrH,oGAAoG;IACpG,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,MAAM,uBAAuB,CAAC,EAAE,EAAE;QAChC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,IAAI,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;QACtH,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe;QAClH,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;KAC7D,EAAE,SAAS,CAAC,EAAE;QACb,MAAM,SAAS,GAAG,qBAAqB,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtF,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE;gBAClF,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,IAAI,qBAAqB,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,SAAS;oBAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,mDAAmD,CAAC,CAAC;gBAC/J,IAAI,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,KAAK,KAAK,CAAC,gBAAgB;oBAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,kCAAkC,CAAC,CAAC;YACnJ,CAAC,EAAE,CAAC;IACN,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB;YAAE,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3I,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxI,QAAQ,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACrG,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5I,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/assurance/service.d.ts

@@ -0,0 +1,54 @@
+import type { SqliteDatabase, SqliteRow } from '../db/adapter.js';
+import type { ContextDeliveryView } from '../context/delivery.js';
+export interface AssuranceState extends SqliteRow {
+    run_id: string;
+    revision: number;
+    delivery_id: string | null;
+    repository_root: string | null;
+    retrieval_status: string;
+    observed_changes: number;
+}
+export declare function assuranceState(db: SqliteDatabase, runId: string): AssuranceState | undefined;
+export declare function enrollAssurance(db: SqliteDatabase, runId: string, now: string): void;
+export declare function bindAssuranceDelivery(db: SqliteDatabase, delivery: ContextDeliveryView): void;
+export declare function bindAssuranceRoot(db: SqliteDatabase, runId: string, root: string, retrievalStatus?: string): void;
+export declare function assertAssuranceCwd(db: SqliteDatabase, runId: string, cwd: string): AssuranceState;
+export declare function assuranceMutation<T extends {
+    runId: string;
+    requestId: string;
+    expectedRevision: number;
+    cwd: string;
+}, R extends object>(db: SqliteDatabase, input: T, effect: (state: AssuranceState) => R): R & {
+    revision: number;
+};
+export declare function reviewTaskMemory(db: SqliteDatabase, raw: unknown): {
+    recorded: boolean;
+    provenance: string;
+    untrusted: boolean;
+} & {
+    revision: number;
+};
+/** Only the local hook adapter calls with client_observed. Public APIs always use model_reported. */
+export declare function recordTaskEvidence(db: SqliteDatabase, raw: unknown, provenance?: 'model_reported' | 'client_observed', observed?: {
+    executionDigest: string;
+    onRecorded: (evidenceId: string) => void;
+}): {
+    evidenceId: `${string}-${string}-${string}-${string}-${string}`;
+    provenance: "model_reported" | "client_observed";
+    outcome: "failed" | "unknown" | "passed" | "skipped";
+} & {
+    revision: number;
+};
+export interface AssuranceReport {
+    mode: 'legacy_unobserved' | 'tracked';
+    revision: number | null;
+    retrieval: string;
+    pending: string[];
+    stale: string[];
+    missingVerification: string[];
+    observed: boolean;
+    complete: boolean;
+}
+export declare function taskAssuranceReport(db: SqliteDatabase, runId: string, verifyState?: boolean): AssuranceReport;
+export declare function assertAssuranceCompletion(db: SqliteDatabase, runId: string, outcome: string): void;
+//# sourceMappingURL=service.d.ts.map

package/dist/assurance/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/assurance/service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAKlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAOlE,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;CAClJ;AACD,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE5F;AACD,wBAAgB,eAAe,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAEpF;AACD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAK7F;AACD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAOjH;AACD,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAejG;AACD,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,SAAS,MAAM,EACvI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,CAAC,GACjE,CAAC,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAiB1B;AAOD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO;;;;;cAxB9C,MAAM;EA2CxB;AACD,qGAAqG;AACrG,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,GAAE,gBAAgB,GAAG,iBAAoC,EAAE,QAAQ,CAAC,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE;;;;;cA7CvM,MAAM;EAyDxB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAClF,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;CACzG;AACD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,UAAO,GAAG,eAAe,CAsC1G;AACD,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAIlG"}

package/dist/assurance/service.js

@@ -0,0 +1,183 @@
+import { realpathSync } from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { withImmediateTransaction } from '../db/transaction.js';
+import { KiokukoError } from '../errors.js';
+import { LedgerStore } from '../ledger/store.js';
+import { readContextBrokerRunState } from '../context/broker.js';
+import { hasActionableMemorySelection, memoryReasoningRequired } from '../akinator/capabilities.js';
+import { canonicalContentHash } from '../serialization/validate.js';
+import { sanitizeJson } from '../security/sanitize.js';
+import { memoryReviewSchema, executionEvidenceSchema, parseAssurance } from './contracts.js';
+import { repositoryStateDigest } from './snapshot.js';
+export function assuranceState(db, runId) {
+    return db.prepare('SELECT * FROM task_assurance WHERE run_id = ?').get(runId);
+}
+export function enrollAssurance(db, runId, now) {
+    db.prepare('INSERT INTO task_assurance(run_id, updated_at) VALUES (?, ?)').run(runId, now);
+}
+export function bindAssuranceDelivery(db, delivery) {
+    const state = assuranceState(db, delivery.runId);
+    if (!state || state.delivery_id === delivery.deliveryId)
+        return;
+    db.prepare("UPDATE task_assurance SET delivery_id = ?, revision = revision + 1, retrieval_status = ?, updated_at = ? WHERE run_id = ?")
+        .run(delivery.deliveryId, delivery.items.length ? 'delivered' : 'no_match', new Date().toISOString(), delivery.runId);
+}
+export function bindAssuranceRoot(db, runId, root, retrievalStatus) {
+    const state = assuranceState(db, runId);
+    if (!state)
+        return;
+    const canonical = realpathSync(root);
+    if (state.repository_root && state.repository_root !== canonical)
+        throw new KiokukoError('CONFLICT', 'Run repository root changed');
+    db.prepare('UPDATE task_assurance SET repository_root = ?, retrieval_status = COALESCE(?, retrieval_status) WHERE run_id = ?')
+        .run(canonical, retrievalStatus ?? null, runId);
+}
+export function assertAssuranceCwd(db, runId, cwd) {
+    const run = new LedgerStore(db).readRun(runId);
+    if (!run || run.status !== 'active')
+        throw new KiokukoError('CONFLICT', 'Task assurance requires an active run');
+    const state = assuranceState(db, runId);
+    if (!state)
+        throw new KiokukoError('CONFLICT', 'Historical run has no assurance contract');
+    const canonical = realpathSync(cwd);
+    let root = state.repository_root;
+    if (!root) {
+        const rows = db.prepare('SELECT canonical_root FROM repository_locations l JOIN repositories r ON r.repository_id = l.repository_id WHERE r.workspace = ?')
+            .all(run.workspace);
+        root = rows.find(row => canonical === row.canonical_root || canonical.startsWith(row.canonical_root + path.sep))?.canonical_root ?? null;
+    }
+    if (!root || (canonical !== root && !canonical.startsWith(root + path.sep)))
+        throw new KiokukoError('CONFLICT', 'Evidence belongs to another repository');
+    bindAssuranceRoot(db, runId, root);
+    return { ...state, repository_root: root };
+}
+export function assuranceMutation(db, input, effect) {
+    return withImmediateTransaction(db, () => {
+        const digest = canonicalContentHash(input);
+        const prior = db.prepare('SELECT request_digest, response_json FROM task_assurance_requests WHERE run_id = ? AND request_id = ?')
+            .get(input.runId, input.requestId);
+        if (prior) {
+            if (prior.request_digest !== digest)
+                throw new KiokukoError('CONFLICT', 'Assurance request identity was reused with different content');
+            return JSON.parse(prior.response_json);
+        }
+        const state = assertAssuranceCwd(db, input.runId, input.cwd);
+        if (state.revision !== input.expectedRevision)
+            throw new KiokukoError('CONFLICT', 'Task assurance revision changed');
+        const response = { ...effect(state), revision: state.revision + 1 };
+        db.prepare('UPDATE task_assurance SET revision = ?, updated_at = ? WHERE run_id = ?')
+            .run(response.revision, new Date().toISOString(), input.runId);
+        db.prepare('INSERT INTO task_assurance_requests VALUES (?, ?, ?, ?)').run(input.runId, input.requestId, digest, JSON.stringify(response));
+        return response;
+    });
+}
+function assertCurrentDelivery(state, deliveryId) {
+    if (state.delivery_id !== deliveryId)
+        throw new KiokukoError('CONFLICT', 'Task delivery changed; review the current delivery');
+}
+function safeText(value) {
+    return sanitizeJson(value).value;
+}
+export function reviewTaskMemory(db, raw) {
+    const input = parseAssurance(memoryReviewSchema, raw);
+    return assuranceMutation(db, input, state => {
+        assertCurrentDelivery(state, input.deliveryId);
+        const entry = db.prepare(`SELECT e.current_revision FROM context_delivery_entries d JOIN entries e ON e.id = d.entry_id
+      WHERE d.delivery_id = ? AND d.entry_id = ? AND d.entry_revision = ?`).get(input.deliveryId, input.entryId, input.entryRevision);
+        if (!entry || entry.current_revision !== input.entryRevision)
+            throw new KiokukoError('CONFLICT', 'Memory revision changed or was not delivered');
+        for (const evidenceId of input.evidenceIds) {
+            const evidence = db.prepare('SELECT run_id, delivery_id FROM task_execution_evidence WHERE evidence_id = ?').get(evidenceId);
+            if (!evidence || evidence.run_id !== input.runId || evidence.delivery_id !== input.deliveryId)
+                throw new KiokukoError('CONFLICT', 'Evidence belongs to another run or delivery');
+        }
+        db.prepare(`INSERT INTO task_memory_reviews VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(run_id, delivery_id, entry_id, entry_revision) DO UPDATE SET decision=excluded.decision, basis=excluded.basis,
+      invariant_text=excluded.invariant_text, counterexample=excluded.counterexample, verification=excluded.verification,
+      evidence_ids_json=excluded.evidence_ids_json, created_at=excluded.created_at`)
+            .run(input.runId, input.deliveryId, input.entryId, input.entryRevision, input.decision, safeText(input.basis), safeText(input.invariant ?? ''), safeText(input.counterexample ?? ''), safeText(input.verification ?? ''), JSON.stringify(input.evidenceIds), new Date().toISOString());
+        return { recorded: true, provenance: 'model_reported', untrusted: true };
+    });
+}
+/** Only the local hook adapter calls with client_observed. Public APIs always use model_reported. */
+export function recordTaskEvidence(db, raw, provenance = 'model_reported', observed) {
+    const input = parseAssurance(executionEvidenceSchema, raw);
+    return assuranceMutation(db, { ...input, provenance }, state => {
+        assertCurrentDelivery(state, input.deliveryId);
+        if (repositoryStateDigest(state.repository_root) !== input.stateDigest)
+            throw new KiokukoError('CONFLICT', 'Validation target changed');
+        const evidenceId = randomUUID();
+        db.prepare('INSERT INTO task_execution_evidence VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+            .run(evidenceId, input.runId, input.deliveryId, state.repository_root, realpathSync(input.cwd), observed?.executionDigest ?? canonicalContentHash(input.execution), input.stateDigest, input.outcome, input.exitCode, provenance, new Date().toISOString());
+        observed?.onRecorded(evidenceId);
+        return { evidenceId, provenance, outcome: input.outcome };
+    });
+}
+export function taskAssuranceReport(db, runId, verifyState = true) {
+    const state = assuranceState(db, runId);
+    const report = { mode: state ? 'tracked' : 'legacy_unobserved', revision: state?.revision ?? null,
+        retrieval: state?.retrieval_status ?? 'unobserved', pending: [], stale: [], missingVerification: [], observed: false, complete: true };
+    if (!state)
+        return report;
+    const profile = readContextBrokerRunState(db, runId).taskProfile;
+    if (!memoryReasoningRequired(profile, 'actionable'))
+        return report;
+    if (state.retrieval_status === 'pending') {
+        report.pending.push('memory_retrieval');
+        report.complete = false;
+        return report;
+    }
+    if (!state.delivery_id)
+        return report; // Capability withholding preserves repository-only work.
+    const delivery = db.prepare('SELECT run_id FROM context_deliveries WHERE delivery_id = ?').get(state.delivery_id);
+    if (!delivery || delivery.run_id !== runId)
+        throw new KiokukoError('INTEGRITY_ERROR', 'Assurance delivery is missing or belongs to another run');
+    const items = db.prepare('SELECT entry_id, entry_revision, selection_reason_json FROM context_delivery_entries WHERE delivery_id = ?')
+        .all(state.delivery_id);
+    let digest = null;
+    let adoptedCount = 0;
+    let allObserved = true;
+    const codeChange = profile.taskType === 'build' || profile.taskType === 'debug' || state.observed_changes === 1;
+    for (const item of items) {
+        if (!hasActionableMemorySelection([{ selectionReasons: JSON.parse(item.selection_reason_json) }]))
+            continue;
+        const current = db.prepare('SELECT current_revision FROM entries WHERE id = ?').get(item.entry_id);
+        if (!current || current.current_revision !== item.entry_revision) {
+            report.stale.push(item.entry_id);
+            continue;
+        }
+        const review = db.prepare('SELECT decision, evidence_ids_json FROM task_memory_reviews WHERE run_id = ? AND delivery_id = ? AND entry_id = ? AND entry_revision = ?')
+            .get(runId, state.delivery_id, item.entry_id, item.entry_revision);
+        if (!review) {
+            report.pending.push(item.entry_id);
+            continue;
+        }
+        if (review.decision !== 'adopted' || !codeChange)
+            continue;
+        adoptedCount += 1;
+        if (!verifyState)
+            continue;
+        if (!digest && state.repository_root)
+            digest = repositoryStateDigest(state.repository_root);
+        const ids = JSON.parse(review.evidence_ids_json);
+        const evidence = ids.map(id => db.prepare('SELECT * FROM task_execution_evidence WHERE evidence_id = ?').get(id));
+        const valid = evidence.length > 0 && evidence.every(e => e && e.run_id === runId && e.delivery_id === state.delivery_id
+            && e.repository_root === state.repository_root && e.state_digest === digest && e.outcome === 'passed' && e.exit_code === 0);
+        if (!valid)
+            report.missingVerification.push(item.entry_id);
+        if (!valid || evidence.some(e => e?.provenance !== 'client_observed'))
+            allObserved = false;
+    }
+    report.complete = report.pending.length + report.stale.length + report.missingVerification.length === 0;
+    report.observed = verifyState && adoptedCount > 0 && allObserved && report.complete;
+    return report;
+}
+export function assertAssuranceCompletion(db, runId, outcome) {
+    if (outcome !== 'completed')
+        return;
+    const report = taskAssuranceReport(db, runId);
+    if (!report.complete)
+        throw new KiokukoError('CONFLICT', 'Memory review or regression verification is incomplete', { assurance: report });
+}
+//# sourceMappingURL=service.js.map

package/dist/assurance/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/assurance/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAKtD,MAAM,UAAU,cAAc,CAAC,EAAkB,EAAE,KAAa;IAC9D,OAAO,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAiB,KAAK,CAAC,CAAC;AAChG,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,EAAkB,EAAE,KAAa,EAAE,GAAW;IAC5E,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC7F,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,EAAkB,EAAE,QAA6B;IACrF,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO;IAChE,EAAE,CAAC,OAAO,CAAC,2HAA2H,CAAC;SACpI,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1H,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,EAAkB,EAAE,KAAa,EAAE,IAAY,EAAE,eAAwB;IACzG,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACpI,EAAE,CAAC,OAAO,CAAC,kHAAkH,CAAC;SAC3H,GAAG,CAAC,SAAS,EAAE,eAAe,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,EAAkB,EAAE,KAAa,EAAE,GAAW;IAC/E,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,uCAAuC,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,kIAAkI,CAAC;aACxJ,GAAG,CAA6B,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC,cAAc,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,IAAI,IAAI,CAAC;IAC3I,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,wCAAwC,CAAC,CAAC;IAC1J,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAC7C,CAAC;AACD,MAAM,UAAU,iBAAiB,CAC/B,EAAkB,EAAE,KAAQ,EAAE,MAAoC;IAElE,OAAO,wBAAwB,CAAC,EAAE,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC;aAC9H,GAAG,CAAoD,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM;gBAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,8DAA8D,CAAC,CAAC;YACxI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAA6B,CAAC;QACrE,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB;YAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpE,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC;aAClF,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1I,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AACD,SAAS,qBAAqB,CAAC,KAAqB,EAAE,UAAyB;IAC7E,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,oDAAoD,CAAC,CAAC;AACjI,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,KAAe,CAAC;AAC7C,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,EAAkB,EAAE,GAAY;IAC/D,MAAM,KAAK,GAAG,cAAc,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;QAC1C,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC;0EAC6C,CAAC,CAAC,GAAG,CAA+B,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChK,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,8CAA8C,CAAC,CAAC;QACjJ,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC,GAAG,CAAiD,UAAU,CAAC,CAAC;YAC7K,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,6CAA6C,CAAC,CAAC;QACnL,CAAC;QACD,EAAE,CAAC,OAAO,CAAC;;;mFAGoE,CAAC;aAC7E,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAC3G,QAAQ,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5K,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AACD,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAC,EAAkB,EAAE,GAAY,EAAE,aAAmD,gBAAgB,EAAE,QAAgF;IACxN,MAAM,KAAK,GAAG,cAAc,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,EAAE;QAC7D,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,qBAAqB,CAAC,KAAK,CAAC,eAAgB,CAAC,KAAK,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;QACzI,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC;aACvF,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,eAAgB,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,eAAe,IAAI,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,WAAW,EACpL,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAKD,MAAM,UAAU,mBAAmB,CAAC,EAAkB,EAAE,KAAa,EAAE,WAAW,GAAG,IAAI;IACvF,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,IAAI;QAChH,SAAS,EAAE,KAAK,EAAE,gBAAgB,IAAI,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzI,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC;IACjE,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;QAAC,OAAO,MAAM,CAAC;IAAC,CAAC;IAC9H,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,CAAC,yDAAyD;IAChG,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,CAAqB,KAAK,CAAC,WAAW,CAAC,CAAC;IACtI,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;IACjJ,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,4GAA4G,CAAC;SACnI,GAAG,CAA8E,KAAK,CAAC,WAAW,CAAC,CAAC;IACvG,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,gBAAgB,KAAK,CAAC,CAAC;IAChH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,4BAA4B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAa,EAAE,CAAC,CAAC;YAAE,SAAS;QACxH,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAA+B,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACjH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,0IAA0I,CAAC;aAClK,GAAG,CAAkD,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACtH,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,UAAU;YAAE,SAAS;QAC3D,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe;YAAE,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAa,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,CAAY,EAAE,CAAC,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;eAClH,CAAC,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC;QAC9H,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,iBAAiB,CAAC;YAAE,WAAW,GAAG,KAAK,CAAC;IAC7F,CAAC;IACD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC;IACxG,MAAM,CAAC,QAAQ,GAAG,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC;IACpF,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,EAAkB,EAAE,KAAa,EAAE,OAAe;IAC1F,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO;IACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,wDAAwD,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5I,CAAC"}

package/dist/assurance/snapshot.d.ts

@@ -0,0 +1,3 @@
+/** Hash the Git-visible source, tests and configuration; never persist file contents. */
+export declare function repositoryStateDigest(root: string): string;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/assurance/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/assurance/snapshot.ts"],"names":[],"mappings":"AAMA,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyB1D"}

package/dist/assurance/snapshot.js

@@ -0,0 +1,44 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, realpathSync, existsSync } from 'node:fs';
+import path from 'node:path';
+import { KiokukoError } from '../errors.js';
+/** Hash the Git-visible source, tests and configuration; never persist file contents. */
+export function repositoryStateDigest(root) {
+    const canonical = realpathSync(root);
+    const gitRoot = execFileSync('git', ['-C', canonical, 'rev-parse', '--show-toplevel'], { encoding: 'utf8', timeout: 5000 }).trim();
+    if (realpathSync(gitRoot) !== canonical)
+        throw new KiokukoError('CONFLICT', 'Evidence requires the canonical repository root');
+    const names = execFileSync('git', ['-C', canonical, 'ls-files', '-z', '--cached', '--others', '--exclude-standard'], { encoding: 'utf8', timeout: 5000, maxBuffer: 4 * 1024 * 1024 });
+    const configuration = ['.env', '.env.local', '.codex/config.toml', '.codex/hooks.json', '.kiokuko.json'].filter(name => existsSync(path.join(canonical, name)));
+    const files = [...new Set([...names.split('\0').filter(Boolean), ...configuration])].sort();
+    if (files.length > 20000)
+        throw new KiokukoError('VALIDATION_ERROR', 'Repository snapshot exceeds its file budget');
+    const hash = createHash('sha256').update('kiokuko-state-v1\0');
+    let bytes = 0;
+    for (const file of files) {
+        const full = path.resolve(canonical, file);
+        if (!full.startsWith(canonical + path.sep))
+            throw new KiokukoError('INTEGRITY_ERROR', 'Snapshot path escapes the repository');
+        hash.update(file).update('\0');
+        let stat;
+        try {
+            stat = lstatSync(full);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                hash.update('deleted\0');
+                continue;
+            }
+            throw error;
+        }
+        if (!stat.isFile() || realpathSync(full) !== full)
+            throw new KiokukoError('VALIDATION_ERROR', 'Snapshot cannot verify symlinks or non-regular files');
+        bytes += stat.size;
+        if (bytes > 64 * 1024 * 1024)
+            throw new KiokukoError('VALIDATION_ERROR', 'Repository snapshot exceeds its byte budget');
+        hash.update(String(stat.mode)).update('\0').update(readFileSync(full)).update('\0');
+    }
+    return hash.digest('hex');
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/assurance/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../src/assurance/snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnI,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,iDAAiD,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACtL,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChK,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;QAC9H,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAC7C,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC/F,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;QACtJ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;QACnB,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;QACxH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAkB,MAAM,WAAW,CAAC;AAMpD,OAAO,EAAwB,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAU1F,OAAO,EAA0B,KAAK,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAA0B,KAAK,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAG9F,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAMhF,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAsTnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAClD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACjD;AA2eD,wBAAgB,QAAQ,CAAC,YAAY,GAAE,eAAoB,GAAG,OAAO,CA+OpE;AAaD,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAAiB,EAAE,YAAY,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B/G"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,WAAW,CAAC;AAMpD,OAAO,EAAwB,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAU1F,OAAO,EAA0B,KAAK,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAA0B,KAAK,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAG9F,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAMhF,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAsTnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAClD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACjD;AA2eD,wBAAgB,QAAQ,CAAC,YAAY,GAAE,eAAoB,GAAG,OAAO,CAgPpE;AAaD,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAAiB,EAAE,YAAY,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B/G"}

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { registerCodexHookCommand } from './commands/codex-hook.js';
 import { registerAkinatorMemoryCommands } from './commands/akinator-memory.js';
 import { Command, CommanderError } from 'commander';
 import { constants as fsConstants } from 'node:fs';
@@ -817,6 +818,7 @@ export function buildCli(dependencies = {}) {
     });
     registerServerCommands(cli, dependencies.server);
     registerAgentCommand(cli, dependencies.agent);
+    registerCodexHookCommand(cli);
     registerLedgerCommands(cli, { withDatabase });
     registerAkinatorMemoryCommands(cli);
     registerSkillsCommands(cli, dependencies.skills ?? { withDatabase });