@quantiya/codevibe-claude-plugin 2.0.34 → 2.0.36

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/InputBar.d.ts

@@ -124,5 +124,10 @@ export interface InputBarProps {
      * `@all` plus the local agents detected for this signed-in user/device.
      */
     mentionSuggestions?: MentionSuggestion[];
+    /**
+     * Cancellation callback (WEB-BROWSING-DESIGN.md §Cancellation).
+     * Fires on Escape key when dropdown is closed and gate prompt is not active.
+     */
+    onCancel?: () => void;
 }
 export declare function InputBar(props: InputBarProps): React.ReactElement;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/OrchestrationApp.d.ts

@@ -50,6 +50,11 @@ export interface OrchestrationAppProps {
      * #C8M-11 and never reach `onUserInput`. `images` (IMAGE-ATTACHMENT-DESIGN.md
      * §13 Option 2) carries the resolved path(s) of `[Image #N]` input chips. */
     onUserInput: (text: string, images?: string[]) => void;
+    /**
+     * Cancellation callback (WEB-BROWSING-DESIGN.md line 61).
+     * Forwarded to <InputBar onCancel={props.onCancel}>.
+     */
+    onCancel?: () => void;
     /**
      * CP-8 min Stage 1 R1 closure + Stage 2 r1 Codex HIGH-1 (REQUIRED). The
      * desktop-side AppSync transport surface (codevibe-core's own

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/context-compaction.d.ts

@@ -23,7 +23,8 @@ export declare const COMPACTION_KEEP_HOT_RECENT_ITEMS = 16;
 export declare const CONTEXT_ITEMS_RETENTION_MS: number;
 /**
  * The rendered session-context section's own budget (inside the F6 total) for
- * the implementor dispatch block and the brainstorm panel: 2,000 chars, every
+ * the implementor dispatch block (the brainstorm panel uses
+ * `SESSION_CONTEXT_SECTION_MAX_CHARS_BRAINSTORM` below): 2,000 chars, every
  * line capped by `capForRender`, stop at the first line that does not fit — the
  * shipped behaviour. The planner's classification render uses
  * `SESSION_CONTEXT_SECTION_MAX_CHARS_CLASSIFY` below (Stage-1 r1 F5 / r2 F2,
@@ -34,10 +35,16 @@ export declare const SESSION_CONTEXT_SECTION_MAX_CHARS = 2000;
  * The planner's CLASSIFICATION render (2026-09-12): hot turns render WHOLE inside
  * a 6,000-char section under the local runner's explicit 16K-token window.
  * Stage-1 r1 F5 — this applies ONLY to `purpose: 'classification'`: the implementor
- * dispatch block (hard 4,800-char total, `DISPATCH_CONTEXT_MAX_CHARS`) and the
- * brainstorm panel keep the 2,000-char section and the per-line cap above.
+ * dispatch block (hard 4,800-char total, `DISPATCH_CONTEXT_MAX_CHARS`) keeps the
+ * 2,000-char section and the per-line cap above.
  */
 export declare const SESSION_CONTEXT_SECTION_MAX_CHARS_CLASSIFY = 6000;
+/**
+ * The BRAINSTORM panel render: hot turns render WHOLE inside a 4,800-char section
+ * (aligns with MAX_WORKFLOW_HANDOFF_TOTAL_CHARS). Prevents 400-char sentence-cutting
+ * between multi-agent deliberation turns while preserving the overall budget.
+ */
+export declare const SESSION_CONTEXT_SECTION_MAX_CHARS_BRAINSTORM = 4800;
 /**
  * A1f Stage-1 R1 HIGH + Stage-2 R1 (H1/M2/M3/M5) — one distilled FACT:
  *  - `body` — the source item's COMPLETE typed payload, verbatim (M3:

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/index.d.ts

@@ -265,6 +265,7 @@ export { renderEntryAsLine, runLineLogFallback } from './non-tty-fallback';
 export { initInkRuntime, getInkRuntime } from './ink-runtime';
 export { reducer } from './reducer';
 export { createOrchestrationStore, type OrchestrationStore } from './store';
+export { routeBrowse, type RouteBrowseDeps } from './route-browse';
 export type { Mode, Tier, PlannerDecision, AgentKind, PlannerHealthState, RunningTaskState, ReviewerSeatState, GateState, ExecutionEventEntry, RefusalEventEntry, BypassEventEntry, MobileEventEntry, EventStreamEntry, ConversationEntry, QueuedTask, PendingClarification, OrchestrationState, OrchestrationAction, LastModeFile, TeamState, TeamTrackEntry, TeamTrackState, TeamMergeGateStatus, LiveProgress, } from './types';
 export { formatElapsed, isSpinnerPhase, renderProgressLine, type TaskProgressEvent, type OnProgress, } from './task-progress';
 export { runDeclaredTestSurfaces, DECLARED_TEST_TIMEOUT_MS, type DeclaredTestResult, type DeclaredTestReason, type RunDeclaredTestSurfacesArgs, } from './declared-test-runner';
@@ -488,6 +489,7 @@ export declare function routeReadOnlyAgentMention(args: {
     shellArgs: RunOrchestrationShellArgs;
     intent: AgentMentionIntent;
     advisoryBrief: string;
+    retainedPage?: RetainedBrowsePage | null;
     /**
      * [#637] This turn's validated image attachments + the ordered `[Image #N]`
      * chip-path list — the SAME `turnAttachments`/`turnImagePaths` pair the /task
@@ -919,6 +921,10 @@ export interface HandleShellUserInputDeps extends StructuralSummaryRunDeps {
      * buffered replies. Optional — direct unit callers/tests may omit it.
      */
     turnOwnership?: BrainstormTurnOwnership;
+    /**
+     * Optional AbortSignal for in-flight web browsing cancellation (Esc-abort).
+     */
+    browseSignal?: AbortSignal;
 }
 /**
  * Slash + natural-language dispatch. Extracted from `runOrchestrationShell`
@@ -993,8 +999,19 @@ export declare function tokenizeCommandLine(input: string): {
     error?: string;
 };
 export declare function handleShellUserInput(deps: HandleShellUserInputDeps): Promise<void>;
+/**
+ * TTL bounding for retained browse pages (15 minutes).
+ * Follow-up mentions within 15 minutes receive the retained page; older pages
+ * expire and are cleared to prevent leaking stale web data into unrelated future turns.
+ */
+export declare const RETAINED_PAGE_MAX_AGE_MS: number;
+export declare function getFreshRetainedBrowsePage(pages: Map<string, RetainedBrowsePage>, sessionId: string, now?: number): RetainedBrowsePage | null;
 /** Test seam — clear the per-session retained pages between cases. */
 export declare function resetRetainedBrowsePagesForTests(): void;
+/** Test seam — set a per-session retained page for tests. */
+export declare function setRetainedBrowsePageForTests(sessionId: string, page: RetainedBrowsePage): void;
+/** Test seam — get a per-session retained page for tests. */
+export declare function getRetainedBrowsePageForTests(sessionId: string): RetainedBrowsePage | null;
 /**
  * [A1g] Stage-2 round-4 (Codex round-3 MEDIUM) — the EXPLICIT per-turn panel-
  * ownership token. `serializeShellSubmissions` mints ONE fresh object per

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/route-browse.d.ts

@@ -1,5 +1,7 @@
 import type { OrchestrationStore } from './store';
 import type { LocalGemmaAdvisoryRunner } from '../planner/local-advisory';
+import { guardedFetch } from './web/fetch';
+import { webSearch } from './web/search';
 /**
  * A page the shell read this session, retained (2026-09-12) so a follow-up
  * ("that sounds like a summary, I am looking for your thoughts") can be answered
@@ -27,10 +29,28 @@ export interface RouteBrowseDeps {
     signal?: AbortSignal;
     /** Called once readable text was extracted from a fetched page (before summarizing). */
     onPageRead?: (page: RetainedBrowsePage) => void;
+    /** Dependency injection for guardedFetch (for tests / isolation). */
+    guardedFetchFn?: typeof guardedFetch;
+    /** Dependency injection for webSearch (for tests / isolation). */
+    webSearchFn?: typeof webSearch;
+    /**
+     * Optional delegation callback when an `@agent` mention is routed through browse.
+     * If provided, browse fetches the page(s) and delegates answering to the mentioned agent.
+     * Returns true if successfully handled.
+     */
+    delegateAnswer?: (args: {
+        header: string;
+        page?: RetainedBrowsePage;
+    }) => Promise<boolean>;
 }
 /**
- * Orchestrate a `browse` route. Fetch an explicit URL, or run a keyless web
- * search and read the top result, then answer via local Gemma. Mirrors
+ * Strip leading agent mention tokens, common command/browse noise, redact paths,
+ * terminal-sanitize, and cap at 200 characters for fallback public web search queries.
+ */
+export declare function deriveSanitizedFallbackSearchQuery(prompt: string): string;
+/**
+ * Orchestrate a `browse` route. Fetch an explicit URL, or run a web
+ * search and read the top results in parallel, then answer via local Gemma. Mirrors
  * routeBrainstorm/routeFamiliarize (no-model advisory, clean failures, no crash).
  */
 export declare function routeBrowse(deps: RouteBrowseDeps): Promise<void>;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/web/extract.d.ts

@@ -9,3 +9,21 @@ export declare function __resetExtractCacheForTest(): void;
  * NEVER throws — returns `{ title:'', text:'' }` on the size cap / load / parse failure.
  */
 export declare function htmlToText(html: string): Promise<ExtractResult>;
+export interface ExtractQuerySnippetsOptions {
+    maxChars?: number;
+    leadChars?: number;
+}
+/**
+ * Tokenize query into search keywords (>= 3 chars for Latin/digits, >= 2 chars for CJK, plus CJK bigrams).
+ * Discards stopwords (Simplified + Traditional CJK and common Latin function words) and strips URLs.
+ */
+export declare function extractQueryTokens(query: string): string[];
+/**
+ * Extract query-relevant snippets from extracted page text.
+ * Always retains the lead (context / introduction, ~500 chars), plus highest-scoring
+ * paragraphs matching query keywords across the entire document (e.g. pricing,
+ * release dates, or specs at the bottom of long pages).
+ * Returns paragraphs stitched in original document order with `[...]` omission markers.
+ * NEVER throws.
+ */
+export declare function extractQueryRelevantSnippets(fullText: string, query: string, options?: ExtractQuerySnippetsOptions): string;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/web/fetch.d.ts

@@ -8,8 +8,12 @@ export interface FetchResult {
     contentType: string;
     body: string;
 }
+export interface GuardedFetchOptions {
+    headers?: Record<string, string>;
+    allowJson?: boolean;
+}
 /**
  * Guarded GET with manual redirect following (full guard re-run per hop). Returns
  * decoded text or throws FetchError. `signal` lets the caller (Esc) abort.
  */
-export declare function guardedFetch(rawUrl: string, signal?: AbortSignal): Promise<FetchResult>;
+export declare function guardedFetch(rawUrl: string, signal?: AbortSignal, options?: GuardedFetchOptions): Promise<FetchResult>;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/web/search.d.ts

@@ -1,6 +1,15 @@
 export interface SearchResult {
     url: string;
     title: string;
+    snippet?: string;
+    source?: 'google' | 'brave' | 'duckduckgo';
+}
+export interface WebSearchOptions {
+    limit?: number;
+    provider?: 'auto' | 'google' | 'brave' | 'duckduckgo';
+    googleApiKey?: string;
+    googleCx?: string;
+    braveApiKey?: string;
 }
 /**
  * Parse DDG HTML result anchors. DDG wraps targets as
@@ -10,7 +19,27 @@ export interface SearchResult {
  */
 export declare function parseDdgResults(html: string, limit?: number): SearchResult[];
 /**
- * Run a keyless web search. Returns ≤limit results, or [] on any failure
- * (network/parse) — the caller decides the advisory. `signal` lets Esc abort.
+ * Query Google Custom Search JSON API when configured.
+ * Returns empty array on missing config or error (never throws).
+ */
+export declare function fetchGoogleCseResults(query: string, signal?: AbortSignal, limit?: number, config?: {
+    apiKey?: string;
+    cx?: string;
+}): Promise<SearchResult[]>;
+/**
+ * Query Brave Search API when configured.
+ * Returns empty array on missing config or error (never throws).
+ */
+export declare function fetchBraveSearchResults(query: string, signal?: AbortSignal, limit?: number, config?: {
+    apiKey?: string;
+}): Promise<SearchResult[]>;
+/**
+ * Run a multi-provider web search with waterfall fallback.
+ * Priority: Google CSE -> Brave API -> DuckDuckGo HTML.
+ * Returns ≤limit results, or [] on total failure. NEVER throws.
+ */
+/**
+ * Fetch results from DuckDuckGo HTML endpoint as zero-config default.
  */
-export declare function webSearch(query: string, signal?: AbortSignal, limit?: number): Promise<SearchResult[]>;
+export declare function fetchDuckDuckGoResults(query: string, signal?: AbortSignal, limit?: number): Promise<SearchResult[]>;
+export declare function webSearch(query: string, signal?: AbortSignal, limitOrOptions?: number | WebSearchOptions): Promise<SearchResult[]>;

package/node_modules/@quantiya/codevibe-core/dist/planner/index.d.ts

@@ -4,4 +4,4 @@ export { PlannerCacheLayer } from './cache';
 export { PlannerHealthMachine } from './health-state';
 export { BackendPlannerClient, PlannerBudgetExceededError, PlannerTierGateRejectedError, type PlannerAppSyncTransport, type PlannerCryptoBridge, type SessionKeyResolver, type ShellEventEmit, type EmitShellEventFn, } from './client';
 export { LocalGemmaPlannerAdapter, parseLocalGemmaPlannerDecision, PlannerOutputUnparseableError, renderLocalGemmaPlannerPrompt, type LocalGemmaPlannerRunner, } from './local-gemma';
-export { parseLocalGemmaAdvisorySummary, renderLocalGemmaFamiliarizePrompt, type LocalGemmaAdvisoryRunner, } from './local-advisory';
+export { parseLocalGemmaAdvisorySummary, renderLocalGemmaFamiliarizePrompt, renderLocalGemmaMultiBrowsePrompt, renderLocalGemmaBrowsePrompt, MAX_MULTI_BROWSE_TOTAL_CONTENT_CHARS, MAX_MULTI_BROWSE_RENDERED_PROMPT_CHARS, type LocalGemmaAdvisoryRunner, } from './local-advisory';

package/node_modules/@quantiya/codevibe-core/dist/planner/local-advisory.d.ts

@@ -27,12 +27,25 @@ export interface LocalGemmaAdvisoryOptions {
      * on the classifier (forced-JSON) or on `browse`/`familiarize`.
      */
     images?: string[];
+    /**
+     * Explicit context window length (tokens) for Ollama `/api/generate options.num_ctx`.
+     * For multi-source browsing, callers pass numCtx: 8192 to expand the active context
+     * window to accommodate multi-source prompts alongside output token generation.
+     */
+    numCtx?: number;
+    /**
+     * Control hidden reasoning/thinking tokens in Ollama models (e.g. Gemma 4).
+     * Omitted unless set; browse callers pass false (R8-F2, R9-F4).
+     */
+    think?: boolean;
 }
 export declare function redactAbsoluteLocalPaths(text: string): string;
 export declare function renderLocalGemmaFamiliarizePrompt(args: {
     userPrompt: string;
     summary: StructuralSummary;
 }): string;
+export declare const MAX_BROWSE_CONTENT_CHARS = 12000;
+export declare const MAX_MULTI_BROWSE_TOTAL_CONTENT_CHARS = 6000;
 /**
  * WEB-BROWSING (docs/WEB-BROWSING-DESIGN.md): build the advisory prompt for a
  * fetched web page. The model ANSWERS THE USER'S QUESTION grounded in the fetched
@@ -46,7 +59,7 @@ export declare function renderLocalGemmaFamiliarizePrompt(args: {
  * tolerates either prose or JSON. The title/content stay in the JSON DATA payload (escaped
  * — also defeats label-spoofing) and are NEVER interpolated into the instruction prose.
  *
- * Budget: cap title/url/userPrompt + content (lead), then SHRINK on ACTUAL rendered length
+ * Budget: cap title/url/userPrompt + content, then SHRINK on ACTUAL rendered length
  * (JSON.stringify can expand quote/backslash-heavy text) so the emitted JSON stays valid.
  */
 export declare function renderLocalGemmaBrowsePrompt(args: {
@@ -57,6 +70,52 @@ export declare function renderLocalGemmaBrowsePrompt(args: {
     };
     content: string;
 }): string;
+export interface BrowseSourceInput {
+    url: string;
+    title: string;
+    content: string;
+    id?: number | string;
+}
+export declare const MAX_MULTI_BROWSE_RENDERED_PROMPT_CHARS = 8000;
+export declare const MAX_MULTI_BROWSE_PER_SOURCE_URL_CHARS = 500;
+export declare const MAX_MULTI_BROWSE_PER_SOURCE_TITLE_CHARS = 150;
+/**
+ * Compute the per-source snippet extraction budget so that the resulting rendered
+ * prompt stays within MAX_MULTI_BROWSE_RENDERED_PROMPT_CHARS (8,000 chars) upfront.
+ *
+ * Framing overhead breakdown:
+ * - Fixed instructions / prose: ~1,140 chars
+ * - Top-level JSON scaffolding: ~40 chars
+ * - Per-source JSON scaffolding (keys, id, spacing): ~85 chars per source
+ * - User question: userPromptLength (capped to 1,000)
+ * - Source metadata: URLs (capped to perSourceUrlBudget) + titles (capped to perSourceTitleBudget)
+ * - JSON escaping safety margin: 200 chars
+ *
+ * Exported so route-browse.ts extracts snippets at the exact budget needed, ensuring
+ * the shrink loop does not need to cut content or discard query-relevant snippets (R2-F2 & R3-F3).
+ */
+export declare function computeMultiBrowseContentBudget(params: {
+    survivingCount: number;
+    userPrompt?: string;
+    sourcesMetadata?: Array<{
+        url?: string;
+        title?: string;
+    }>;
+}): number;
+/**
+ * WEB-BROWSING (multi-source synthesis): build an advisory prompt for MULTIPLE
+ * fetched web sources (1 to 5). The local model answers the user's question,
+ * synthesizing facts across all sources, citing sources by number/title, and noting
+ * any discrepancies.
+ *
+ * Budget: Total rendered prompt budget strictly capped to MAX_MULTI_BROWSE_RENDERED_PROMPT_CHARS (8,000 chars, ~2,000 estimated input tokens)
+ * with combined source content bounded to MAX_MULTI_BROWSE_TOTAL_CONTENT_CHARS (6,000 chars, ~1,500 estimated tokens).
+ * Character budget bounds prompt size before dispatch; runtime tokenization and context capacity depend on the local model runner's configuration.
+ */
+export declare function renderLocalGemmaMultiBrowsePrompt(args: {
+    userPrompt: string;
+    sources: BrowseSourceInput[];
+}): string;
 export declare function boundedPriorBrainstormTurns(turns: string[] | undefined): string[];
 /**
  * WEB-BROWSING (search-route): turn the user's request + recent conversation into a

package/node_modules/@quantiya/codevibe-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.29",
+  "version": "2.0.31",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-claude-plugin",
-  "version": "2.0.34",
+  "version": "2.0.36",
   "description": "Control Claude Code from your iPhone and Android — real-time sync, approve file edits, send prompts by voice. Part of CodeVibe.",
   "main": "dist/server.js",
   "codevibe": {
@@ -48,7 +48,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@quantiya/codevibe-core": "^2.0.29",
+    "@quantiya/codevibe-core": "^2.0.31",
     "@quantiya/quorum-core": "^1.0.1",
     "dotenv": "^16.6.1",
     "express": "^5.1.0",
@@ -76,5 +76,14 @@
     "ts-jest": "^29.4.9",
     "ts-node": "^10.9.2",
     "typescript": "^5.9.3"
-  }
+  },
+  "bundleDependencies": [
+    "@quantiya/codevibe-core",
+    "@quantiya/quorum-core",
+    "dotenv",
+    "express",
+    "graphql",
+    "uuid",
+    "ws"
+  ]
 }