@quantiya/codevibe-claude-plugin 2.0.31 → 2.0.32

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/browse-prompt-urls.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.js

@@ -18310,7 +18310,52 @@ ${formatReviewerPolicy(snapshot)}`
 }
 
 // src/planner/local-advisory.ts
-var import_path2 = __toESM(require("path")), MAX_USER_PROMPT_CHARS = 2e3, MAX_README_PREVIEW_CHARS = 900, MAX_RENDERED_PROMPT_CHARS = 18e3, MAX_ADVISORY_SUMMARY_CHARS = 6e3, MAX_BRAINSTORM_PRIOR_TURN_CHARS = 1200, PATH_REDACTION = "[path]", URL_PLACEHOLDER_PREFIX = "__CODEVIBE_URL_", LOCAL_SINGLE_SEGMENT_ROOTS = /* @__PURE__ */ new Set([
+var import_path2 = __toESM(require("path"));
+
+// src/planner/url-protect.ts
+var HTTP_URL_PATTERN_SOURCE = "https?:\\/\\/[^\\s\"'`<>,)}\\]\u3001\u3002\u3003\u3008\u3009\u300A\u300B\u300C\u300D\u300E\u300F\u3010\u3011\u3014\u3015\u3016\u3017\u3018\u3019\u301A\u301B\u301C\u301D\u301E\u301F\uFF01-\uFF0F\uFF1A-\uFF20\uFF3B-\uFF40\uFF5B-\uFF65]+";
+function httpUrlPattern() {
+  return new RegExp(HTTP_URL_PATTERN_SOURCE, "g");
+}
+var URL_PLACEHOLDER_PREFIX = "__CODEVIBE_URL_", URL_PLACEHOLDER_SOURCE = `${URL_PLACEHOLDER_PREFIX}(\\d+)__`, TRAILING_PUNCTUATION = /[.;:!?]+$/;
+function protectUrls(text2) {
+  let urls = [];
+  return {
+    text: text2.replace(httpUrlPattern(), (url) => {
+      let token = `${URL_PLACEHOLDER_PREFIX}${urls.length}__`;
+      return urls.push(url), token;
+    }),
+    urls
+  };
+}
+function restoreUrls(text2, urls) {
+  return text2.replace(new RegExp(URL_PLACEHOLDER_SOURCE, "g"), (token, index) => urls[Number(index)] ?? token);
+}
+function isWellFormedHttpUrl(candidate) {
+  if (candidate.includes("[path]")) return !1;
+  try {
+    let url = new URL(candidate);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return !1;
+  }
+}
+function extractHttpUrls(text2) {
+  let seen = /* @__PURE__ */ new Set(), out = [], re = httpUrlPattern(), tail = new RegExp(`^(?:${HTTP_URL_PATTERN_SOURCE.slice(HTTP_URL_PATTERN_SOURCE.indexOf("[^"))})`);
+  for (let m = re.exec(text2); m !== null; m = re.exec(text2)) {
+    let url = m[0], end = m.index + url.length;
+    for (; text2[end] === ")" && url.split("(").length - 1 > url.split(")").length - 1; ) {
+      url += ")", end += 1;
+      let more = tail.exec(text2.slice(end));
+      more && (url += more[0], end += more[0].length);
+    }
+    re.lastIndex = end, url = url.replace(TRAILING_PUNCTUATION, ""), !(url.length === 0 || seen.has(url)) && (seen.add(url), out.push(url));
+  }
+  return out;
+}
+
+// src/planner/local-advisory.ts
+var MAX_USER_PROMPT_CHARS = 2e3, MAX_README_PREVIEW_CHARS = 900, MAX_RENDERED_PROMPT_CHARS = 18e3, MAX_ADVISORY_SUMMARY_CHARS = 6e3, MAX_BRAINSTORM_PRIOR_TURN_CHARS = 1200, PATH_REDACTION = "[path]", LOCAL_SINGLE_SEGMENT_ROOTS = /* @__PURE__ */ new Set([
   "Applications",
   "Library",
   "System",
@@ -18334,19 +18379,6 @@ var import_path2 = __toESM(require("path")), MAX_USER_PROMPT_CHARS = 2e3, MAX_RE
   "workspace",
   "workspaces"
 ]);
-function protectUrls(text2) {
-  let urls = [];
-  return {
-    text: text2.replace(/https?:\/\/[^\s"'`<>,)}\]]+/g, (url) => {
-      let token = `${URL_PLACEHOLDER_PREFIX}${urls.length}__`;
-      return urls.push(url), token;
-    }),
-    urls
-  };
-}
-function restoreUrls(text2, urls) {
-  return text2.replace(new RegExp(`${URL_PLACEHOLDER_PREFIX}(\\d+)__`, "g"), (_token, index) => urls[Number(index)] ?? _token);
-}
 function isPathBoundary(text2, index) {
   return index <= 0 ? !0 : !/[A-Za-z0-9_./~-]/.test(text2[index - 1] ?? "");
 }
@@ -27645,7 +27677,7 @@ var PlannerOutputUnparseableError = class _PlannerOutputUnparseableError extends
     rationale: { type: "string" },
     clarifying_question: { type: "string" },
     advisory_summary: { type: "string" },
-    browseUrls: { type: "array", items: { type: "string", pattern: "^https?://.*$" } },
+    browseUrls: { type: "array", items: { type: "string" } },
     browseQuery: { type: "string" },
     action: { type: "string", enum: [...LOCAL_GEMMA_ALLOWED_ACTIONS] }
   },
@@ -27663,7 +27695,7 @@ function truncatePlannerTextPreservingEnds(text2, maxChars) {
   return `${text2.slice(0, headChars)}${omission}${text2.slice(-tailChars)}`;
 }
 function sanitizePlannerText(text2, maxChars) {
-  let sanitized = text2.replace(/```[\s\S]*?```/g, "[code block omitted]").replace(/```[\s\S]*$/g, "[code block omitted]").replace(
+  let protectedInput = protectUrls(text2), sanitized = protectedInput.text.replace(/```[\s\S]*?```/g, "[code block omitted]").replace(/```[\s\S]*$/g, "[code block omitted]").replace(
     /^\s*(?:function|class|interface|type|enum|import|export|const|let|var)\b[^\n]{0,240}/gm,
     "[code snippet omitted]"
   ).replace(
@@ -27679,7 +27711,7 @@ function sanitizePlannerText(text2, maxChars) {
     /(^|[\s"'`([{,])(?:\.{1,2}\/)?(?:\.[A-Za-z0-9_.-]+|[A-Za-z0-9_.-]+\.(?:json|ts|tsx|js|jsx|mjs|cjs|env|pem|key|p12|yaml|yml|toml|lock))(?=$|[\s"'`),\]}])/g,
     "$1[path]"
   );
-  return truncatePlannerTextPreservingEnds(sanitized, maxChars);
+  return truncatePlannerTextPreservingEnds(restoreUrls(sanitized, protectedInput.urls), maxChars);
 }
 function sanitizeCanonicalConversationContext(text2, maxChars) {
   let sanitized = sanitizePlannerText(text2, Number.MAX_SAFE_INTEGER).trim();
@@ -27845,11 +27877,59 @@ ${keptOptionalLines.join(`
 ${payloadJson}
 ${outputReminder}` : baseRendered;
 }
-function extractJsonObject2(raw) {
+function firstBalancedJsonObject(raw, from = 0) {
+  let start = raw.indexOf("{", from);
+  if (start < 0) return null;
+  let depth = 0, inString = !1, escaped = !1;
+  for (let i = start; i < raw.length; i++) {
+    let ch = raw[i];
+    if (inString) {
+      escaped ? escaped = !1 : ch === "\\" ? escaped = !0 : ch === '"' && (inString = !1);
+      continue;
+    }
+    if (ch === '"')
+      inString = !0;
+    else if (ch === "{")
+      depth += 1;
+    else if (ch === "}" && (depth -= 1, depth === 0))
+      return { text: raw.slice(start, i + 1), end: i + 1 };
+  }
+  return null;
+}
+function assertNoConflictingTrailingDecision(rest, first) {
+  let firstAction = typeof first.action == "string" ? first.action : void 0, conflict = (action) => {
+    throw new PlannerOutputUnparseableError(
+      `local Gemma planner output contained a second decision object with a conflicting action (${String(firstAction)} then ${action})`
+    );
+  }, cursor = 0;
+  for (; ; ) {
+    let next = firstBalancedJsonObject(rest, cursor);
+    if (next === null) break;
+    cursor = next.end;
+    let parsed = parseJsonObjectText(next.text, []);
+    if (parsed === null) continue;
+    let action = parsed.action;
+    typeof action == "string" && action !== firstAction && conflict(action);
+  }
+  let lexical = /(?<!\\)"action"\s*:\s*"([^"\\]*)"/g;
+  for (let m = lexical.exec(rest); m !== null; m = lexical.exec(rest))
+    m[1] !== firstAction && conflict(m[1]);
+}
+function parseJsonObjectText(text2, errors) {
+  try {
+    return JSON.parse(text2);
+  } catch (err) {
+    errors.push(err);
+  }
+  try {
+    return JSON.parse(stripTrailingCommas(text2));
+  } catch {
+    return null;
+  }
+}
+function legacyJsonObjectSlice(raw) {
   let trimmed = raw.trim(), fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(trimmed), body = fenced ? fenced[1].trim() : trimmed, start = body.indexOf("{"), end = body.lastIndexOf("}");
-  if (start < 0 || end <= start)
-    throw new PlannerOutputUnparseableError("local Gemma planner output contained no JSON object");
-  return body.slice(start, end + 1);
+  return start < 0 || end <= start ? null : body.slice(start, end + 1);
 }
 function stripTrailingCommas(jsonStr) {
   let result = "", inString = !1, escaped = !1;
@@ -27874,23 +27954,29 @@ function stripTrailingCommas(jsonStr) {
   }
   return result;
 }
-function repairAndParseLocalGemmaJson(raw, initialErr) {
-  let candidate = extractJsonObject2(raw), strippedCommas = stripTrailingCommas(candidate);
-  try {
-    return JSON.parse(strippedCommas);
-  } catch {
-    throw new PlannerOutputUnparseableError(
-      `local Gemma planner output was not valid JSON: ${initialErr.message}`
-    );
+function parseLocalGemmaJsonObject(raw) {
+  let errors = [], balanced = firstBalancedJsonObject(raw);
+  if (balanced !== null) {
+    let parsed = parseJsonObjectText(balanced.text, errors);
+    if (parsed !== null)
+      return assertNoConflictingTrailingDecision(raw.slice(balanced.end), parsed), parsed;
   }
+  let legacy = legacyJsonObjectSlice(raw);
+  if (legacy !== null && legacy !== balanced?.text) {
+    let parsed = parseJsonObjectText(legacy, errors);
+    if (parsed !== null) return parsed;
+  }
+  throw balanced === null && legacy === null ? new PlannerOutputUnparseableError("local Gemma planner output contained no JSON object") : new PlannerOutputUnparseableError(
+    `local Gemma planner output was not valid JSON: ${errors[0]?.message ?? "unknown parse error"}`
+  );
+}
+var RAW_OUTPUT_HEAD_CHARS = 500;
+function summarizeRawOutputForLog(raw) {
+  let cleaned = raw.replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "").replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)?/g, "").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g, "");
+  return cleaned.length <= RAW_OUTPUT_HEAD_CHARS ? cleaned : `${cleaned.slice(0, RAW_OUTPUT_HEAD_CHARS)}\u2026 (+${cleaned.length - RAW_OUTPUT_HEAD_CHARS} chars)`;
 }
 function parseLocalGemmaPlannerDecision(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(extractJsonObject2(raw));
-  } catch (err) {
-    parsed = repairAndParseLocalGemmaJson(raw, err);
-  }
+  let parsed = parseLocalGemmaJsonObject(raw);
   if (!parsed || typeof parsed != "object")
     throw new PlannerOutputUnparseableError("local Gemma planner output was not a JSON object");
   let obj = parsed;
@@ -27938,7 +28024,11 @@ var LocalGemmaPlannerAdapter = class {
       jsonSchema: LOCAL_GEMMA_DECISION_JSON_SCHEMA,
       numPredict: 1024
     });
-    return parseLocalGemmaPlannerDecision(raw);
+    try {
+      return parseLocalGemmaPlannerDecision(raw);
+    } catch (err) {
+      throw err instanceof PlannerOutputUnparseableError && err.rawOutputHead === void 0 && (err.rawOutputHead = summarizeRawOutputForLog(raw)), err;
+    }
   }
   async probe() {
     return this.runner.probe ? this.runner.probe() : {
@@ -60807,6 +60897,13 @@ var LastModeFileSchema = import_zod3.z.object({
 var React19 = __toESM(require("react"));
 
 // src/orchestration-shell/index.ts
+function resolveBrowseUrls(modelUrls, prompt) {
+  if (!modelUrls || modelUrls.length === 0) return;
+  let promptUrls = extractHttpUrls(prompt);
+  if (promptUrls.length > 0) return promptUrls;
+  let usable = modelUrls.filter(isWellFormedHttpUrl);
+  return usable.length > 0 ? usable : void 0;
+}
 var OrchestrationShellStartupError = class extends Error {
   constructor(message, cause) {
     super(message), this.name = "OrchestrationShellStartupError", this.cause = cause;
@@ -65248,7 +65345,10 @@ async function handleShellUserInput(deps) {
     if (err instanceof PlannerOutputUnparseableError && isLocalPlannerRuntime(args)) {
       logger.warn(
         "[orchestration-shell] planner output unparseable; request not dispatched",
-        { error: errMsg }
+        // `rawOutputHead` (2026-09-11): the bounded, control-free head of what
+        // the model actually returned — the incident line without it needed a
+        // live repro to explain "Expected property name … at position 1".
+        { error: errMsg, rawOutputHead: err.rawOutputHead }
       ), store.dispatch({
         type: "SHELL_ADVISORY",
         source: "shell",
@@ -65411,6 +65511,7 @@ async function handleShellUserInput(deps) {
     return;
   }
   if (decision.action === "browse") {
+    let browseUrls = resolveBrowseUrls(decision.browseUrls, plannerInput.prompt);
     await routeBrowse({
       store,
       localAdvisoryRunner: args.localAdvisoryRunner,
@@ -65418,7 +65519,7 @@ async function handleShellUserInput(deps) {
       // Recent conversation → the model formulates a context-aware search query (resolve
       // acronyms/pronouns) instead of searching the raw command sentence.
       priorTurns: collectRecentConversationTurns(store.getState().conversation, plannerInput.prompt),
-      ...decision.browseUrls ? { browseUrls: decision.browseUrls } : {},
+      ...browseUrls && browseUrls.length > 0 ? { browseUrls } : {},
       ...decision.browseQuery ? { browseQuery: decision.browseQuery } : {}
     });
     return;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/index.d.ts

@@ -2,6 +2,21 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import { AppSyncClient } from '../appsync';
 import { Session } from '../types';
 import { OrchestrationStore } from './store';
+/**
+ * WEB-BROWSING-DESIGN.md rev 6 — the address for a model-chosen fetch.
+ *
+ * The classifier owns the fetch-vs-search decision: a `browse` decision WITH
+ * `browseUrls` is a fetch, one WITHOUT is a search (`browseQuery`). This helper
+ * never turns a search into a fetch (Stage-1 r1 F4: a URL that merely appears
+ * in "search for alternatives to https://x.com" stays a search). For a fetch,
+ * the user's literal URL is the address: the classify prompt is path-redacted
+ * before the model sees it, so the model's echo can be mangled
+ * (`https://[path]` in the 2026-09-11 incident) or drift. Only when the prompt
+ * carries no URL are the model's well-formed URLs used; a fetch decision whose
+ * every URL is unusable and whose prompt has none yields no URL (the route then
+ * falls back to `browseQuery` or asks for a URL).
+ */
+export declare function resolveBrowseUrls(modelUrls: string[] | undefined, prompt: string): string[] | undefined;
 import { AdvisoryAttachmentJournal } from './advisory-attachment-journal';
 import type { ImageAttachment } from './types';
 import { type GateDecisionSubmitDeps, type GroupDecisionSubmitDeps } from './gate-decision-submit';

package/node_modules/@quantiya/codevibe-core/dist/planner/__tests__/local-gemma-browse-regression.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/planner/__tests__/url-protect.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/planner/local-gemma.d.ts

@@ -31,6 +31,14 @@ export interface LocalGemmaPlannerRunner {
  * without inventing a successful classification or starting a task.
  */
 export declare class PlannerOutputUnparseableError extends Error {
+    /**
+     * The first {@link RAW_OUTPUT_HEAD_CHARS} characters of the model output that
+     * failed to parse (terminal-control bytes stripped), attached by the adapter so
+     * the shell's warn line records WHAT the model said. Before 2026-09-11 nothing
+     * logged the raw text and the `<channel|>` echo incident needed a live repro
+     * to diagnose. Absent when the error was raised without a raw string in hand.
+     */
+    rawOutputHead?: string;
     constructor(message: string);
 }
 export declare const LOCAL_GEMMA_DECISION_JSON_SCHEMA: {
@@ -49,7 +57,6 @@ export declare const LOCAL_GEMMA_DECISION_JSON_SCHEMA: {
             type: string;
             items: {
                 type: string;
-                pattern: string;
             };
         };
         browseQuery: {
@@ -70,6 +77,10 @@ export declare const LOCAL_GEMMA_DECISION_JSON_SCHEMA: {
 export declare function renderLocalGemmaPlannerPrompt(input: PlannerInput, options?: {
     isSubprocessRunner?: boolean;
 }): string;
+/** Characters of raw model output retained on {@link PlannerOutputUnparseableError.rawOutputHead}. */
+export declare const RAW_OUTPUT_HEAD_CHARS = 500;
+/** Terminal-control-free, bounded head of a raw model output for the warn log. */
+export declare function summarizeRawOutputForLog(raw: string): string;
 export declare function parseLocalGemmaPlannerDecision(raw: string): PlannerDecision;
 export declare class LocalGemmaPlannerAdapter implements PlannerAdapter {
     private readonly runner;

package/node_modules/@quantiya/codevibe-core/dist/planner/url-protect.d.ts

@@ -0,0 +1,20 @@
+/** Source of the shared http(s) URL matcher (no `g` state — build with {@link httpUrlPattern}). */
+export declare const HTTP_URL_PATTERN_SOURCE = "https?:\\/\\/[^\\s\"'`<>,)}\\]\u3001\u3002\u3003\u3008\u3009\u300A\u300B\u300C\u300D\u300E\u300F\u3010\u3011\u3014\u3015\u3016\u3017\u3018\u3019\u301A\u301B\u301C\u301D\u301E\u301F\uFF01-\uFF0F\uFF1A-\uFF20\uFF3B-\uFF40\uFF5B-\uFF65]+";
+/** A fresh global RegExp for {@link HTTP_URL_PATTERN_SOURCE}. */
+export declare function httpUrlPattern(): RegExp;
+/** Replace every http(s) URL with an opaque placeholder; returns the URLs in order. */
+export declare function protectUrls(text: string): {
+    text: string;
+    urls: string[];
+};
+/** Put the URLs captured by {@link protectUrls} back in place of their placeholders. */
+export declare function restoreUrls(text: string, urls: string[]): string;
+/** `http:`/`https:` and parseable by WHATWG `URL`; never a redacted `[path]` echo. */
+export declare function isWellFormedHttpUrl(candidate: string): boolean;
+/**
+ * The literal http(s) URLs a user typed, in order, de-duplicated, with trailing
+ * sentence punctuation dropped (`read https://x.com/a.` → `https://x.com/a`) and
+ * balanced parentheses kept (`…/wiki/Foo_(bar)` stays whole — F7). Pure text
+ * extraction — scheme/port/host validation stays in `guardedFetch`.
+ */
+export declare function extractHttpUrls(text: string): string[];

package/node_modules/@quantiya/codevibe-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.26",
+  "version": "2.0.27",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-claude-plugin",
-  "version": "2.0.31",
+  "version": "2.0.32",
   "description": "Control Claude Code from your iPhone and Android — real-time sync, approve file edits, send prompts by voice. Part of CodeVibe.",
   "main": "dist/server.js",
   "codevibe": {
@@ -48,7 +48,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@quantiya/codevibe-core": "^2.0.26",
+    "@quantiya/codevibe-core": "^2.0.27",
     "@quantiya/quorum-core": "^1.0.1",
     "dotenv": "^16.6.1",
     "express": "^5.1.0",