@quantiya/codevibe-claude-plugin 2.0.40 → 2.0.42

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/command-intent.d.ts

@@ -53,4 +53,22 @@ export declare function extractAllAgentMentionIntents(text: string): AgentMentio
 export declare function stripLeadingAgentControlToken(text: string): string;
 export declare function buildCommandIntentEnvelope(intent: AgentMentionIntent): CommandIntentEnvelope;
 export declare function buildCommandIntentMetadata(text: string): CommandIntentMetadata | undefined;
+/**
+ * Detects whether a prompt or brief expresses need for external web browsing or online searching.
+ * Used by QuorumLoop to dynamically attach web tools ONLY when needed, preserving full
+ * sandboxing for normal non-web tasks.
+ *
+ * Supports language-agnostic URLs, as well as English, Chinese, and Japanese web search intents.
+ */
+export declare function isWebAccessNeeded(text: string): boolean;
+/**
+ * Detects whether a prompt expresses intent to create, write, save, or modify local files/reports,
+ * as opposed to a purely read-only conversational request.
+ * Used as a backstop when classifying or routing web requests so that prompts asking to fetch/search
+ * AND write/save to a local file route to `start_task` (implementor execution) instead of desktop `browse`.
+ *
+ * Designed to handle English, Chinese, Japanese, Korean, European languages, and universal structural patterns
+ * (e.g. file targets and shell redirection), while accurately filtering out informational "how-to" / conceptual questions.
+ */
+export declare function hasFileMutationIntent(text: string): boolean;
 export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/quorum-loop.d.ts

@@ -690,6 +690,7 @@ export declare class QuorumLoop {
      * are removed with the task's other per-task state at its terminal cleanup.
      */
     private readonly singleTaskContextByTask;
+    private readonly webAccessByTask;
     /**
      * CP-1.f revise-context fix (dogfood task 2ac68708, 2026-06-11) — the BINDING
      * user-requested changes for a task, accumulated across ALL revise rounds.

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/team-decompose.d.ts

@@ -18,17 +18,17 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
                 access: z.ZodEnum<["write", "read"]>;
             }, "strip", z.ZodTypeAny, {
                 path: string;
-                access: "read" | "write";
+                access: "write" | "read";
             }, {
                 path: string;
-                access: "read" | "write";
+                access: "write" | "read";
             }>, "many">;
             test_surfaces: z.ZodArray<z.ZodString, "many">;
             auto_modified_files: z.ZodArray<z.ZodString, "many">;
         }, "strip", z.ZodTypeAny, {
             shared_contracts: {
                 path: string;
-                access: "read" | "write";
+                access: "write" | "read";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -36,7 +36,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         }, {
             shared_contracts: {
                 path: string;
-                access: "read" | "write";
+                access: "write" | "read";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -50,7 +50,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "read" | "write";
+                access: "write" | "read";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -63,7 +63,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "read" | "write";
+                access: "write" | "read";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -78,7 +78,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "read" | "write";
+                access: "write" | "read";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -94,7 +94,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "read" | "write";
+                access: "write" | "read";
             }[];
             write_paths: string[];
             test_surfaces: string[];

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/web/agent-web-server.d.ts

@@ -0,0 +1,44 @@
+import * as fs from 'node:fs';
+import { redactAbsoluteLocalPaths } from '../../planner/local-advisory';
+export { redactAbsoluteLocalPaths };
+export declare const MAX_SEARCHES_PER_TURN = 5;
+export declare const MAX_FETCHES_PER_TURN = 10;
+export declare const MAX_DYNAMIC_FETCH_CHARS = 50000;
+export declare const TRUNCATION_MARKER = "\n\n[Content truncated at 50,000 characters]";
+export interface WebAuditRecord {
+    timestamp: string;
+    tool: 'codevibe_web_search' | 'codevibe_web_fetch';
+    target: string;
+    agent: string;
+    status: 'ok' | 'error' | 'quota_exceeded' | 'blocked';
+    statusCode?: number;
+    byteCount?: number;
+    durationMs: number;
+    provider?: string;
+}
+export interface AgentWebTurnContext {
+    turnId: string;
+    sessionId: string;
+    token: string;
+    socketPath: string;
+    fallbackDir?: string;
+    mcpConfigPath: string;
+    close: () => Promise<void>;
+}
+export declare function sanitizeUrlForAudit(rawUrl: string): string;
+export declare function sweepOrphanedFallbackDirs(tmpRoot?: string, deps?: {
+    lstat?: typeof fs.lstatSync;
+    getuid?: () => number;
+}): void;
+export declare function resolveBridgePath(): string;
+export declare function writeAuditEntry(sessionId: string, record: WebAuditRecord): void;
+export declare function formatFetchedContent(contentType: string, rawBody: string, url: string, signal?: AbortSignal): Promise<{
+    title: string;
+    content: string;
+}>;
+export declare function startAgentWebTurn(options: {
+    sessionId: string;
+    turnId?: string;
+    agent?: string;
+    signal?: AbortSignal;
+}): Promise<AgentWebTurnContext>;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/web/extract.d.ts

@@ -1,3 +1,13 @@
+export declare class WebExtractTimeoutError extends Error {
+    constructor(timeoutMs: number);
+}
+export declare class WebExtractAbortError extends Error {
+    constructor();
+}
+export interface WorkerExtractOptions {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
 export interface ExtractResult {
     title: string;
     text: string;
@@ -9,6 +19,13 @@ export declare function __resetExtractCacheForTest(): void;
  * NEVER throws — returns `{ title:'', text:'' }` on the size cap / load / parse failure.
  */
 export declare function htmlToText(html: string): Promise<ExtractResult>;
+export declare const DEFAULT_WORKER_TIMEOUT_MS = 5000;
+export declare function resolveExtractWorkerPath(): string;
+/**
+ * Isolated worker-thread parse5 text extraction with bounded wall-clock timeout
+ * and abort signal cancellation support.
+ */
+export declare function htmlToTextWorker(html: string, options?: WorkerExtractOptions): Promise<ExtractResult>;
 export interface ExtractQuerySnippetsOptions {
     maxChars?: number;
     leadChars?: number;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/web/fetch.d.ts

@@ -26,6 +26,16 @@ export declare function pinnedLookup(frozen: {
     address: string;
     family: number;
 }[]): net.LookupFunction;
+/** Perform ONE guarded GET (no redirect following). Resolves with {status, headers, body|null, location}. */
+export declare function getOnce(url: URL, frozen: {
+    address: string;
+    family: number;
+}[], signal: AbortSignal | undefined, options?: GuardedFetchOptions): Promise<{
+    status: number;
+    location?: string;
+    contentType: string;
+    body?: Buffer;
+}>;
 /**
  * Guarded GET with manual redirect following (full guard re-run per hop). Returns
  * decoded text or throws FetchError. `signal` lets the caller (Esc) abort.

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/web/web-extract-worker.d.ts

@@ -0,0 +1,12 @@
+export interface WorkerExtractResult {
+    title: string;
+    text: string;
+}
+export type WorkerMessage = {
+    success: true;
+    result: WorkerExtractResult;
+} | {
+    success: false;
+    error: string;
+};
+export declare function extractHtmlTree(html: string): Promise<WorkerExtractResult>;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/web-extract-worker.js

@@ -0,0 +1,7 @@
+"use strict";var y=Object.create;var g=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var _=Object.getOwnPropertyNames;var v=Object.getPrototypeOf,P=Object.prototype.hasOwnProperty;var D=(e,t)=>{for(var s in t)g(e,s,{get:t[s],enumerable:!0})},S=(e,t,s,c)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of _(t))!P.call(e,a)&&a!==s&&g(e,a,{get:()=>t[a],enumerable:!(c=C(t,a))||c.enumerable});return e};var I=(e,t,s)=>(s=e!=null?y(v(e)):{},S(t||!e||!e.__esModule?g(s,"default",{value:e,enumerable:!0}):s,e)),O=e=>S(g({},"__esModule",{value:!0}),e);var U={};D(U,{extractHtmlTree:()=>R});module.exports=O(U);var i=require("node:worker_threads"),W=new Set(["script","style","nav","header","footer","aside","noscript","svg","template","iframe","select","option","button","form","fieldset","menu","datalist","dialog","head","title","meta","link"]),T=new Set(["p","div","br","li","tr","h1","h2","h3","h4","h5","h6","section","article","ul","ol","table","blockquote","pre","hr","td","th"]),A=new Set(["p","br","li","tr","h1","h2","h3","h4","h5","h6"]),b=new Set(["td","th"]),d="",G=` ${d} `,j=new RegExp(`(?:[ \\t]*${d})+[ \\t]*\\n`,"g"),L=new Set(["main","article"]),E="http://www.w3.org/1999/xhtml";function f(e){return typeof e.tagName=="string"}function k(e){return e.nodeName==="#text"}function p(e){let t=e.childNodes;return Array.isArray(t)?t:[]}function H(e){let t=p(e).find(n=>f(n)&&n.tagName==="html");if(!t)return"";let s=p(t).find(n=>f(n)&&n.tagName==="head");if(!s)return"";let c=p(s).find(n=>f(n)&&n.tagName==="title"&&n.namespaceURI===E);if(!c)return"";let a="";for(let n of p(c))k(n)&&(a+=n.value);return a.replace(/\s+/g," ").trim()}async function R(e){let s=(await import("parse5")).parse(e),c=H(s),a=[],n=[],u=0,w=!1,N=l=>{a.push(l),u>0&&n.push(l)},h=p(s).map(l=>({node:l})).reverse();for(;h.length>0;){let l=h.pop(),r=l.node;if(l.exit){if(f(r)){let o=r.tagName.toLowerCase();T.has(o)&&N(b.has(o)?G:A.has(o)?`
+`:" "),L.has(o)&&r.namespaceURI===E&&u>0&&u--}continue}if(k(r)){N(r.value.includes(d)?r.value.split(d).join(""):r.value);continue}if(!f(r))continue;let m=r.tagName.toLowerCase();if(W.has(m))continue;T.has(m)&&N(A.has(m)?`
+`:" "),L.has(m)&&r.namespaceURI===E&&(u++,w=!0),h.push({node:r,exit:!0});let x=p(r);for(let o=x.length-1;o>=0;o--)h.push({node:x[o]})}let M=(w&&n.join("").trim().length>0?n:a).join("").replace(/\u00a0/g," ").replace(/[ \t\f\v]+/g," ").replace(j,`
+`).split(d).join("|").replace(/ *\n[ \n]*/g,`
+`).replace(/\n{3,}/g,`
+
+`).trim();return{title:c,text:M}}if(!i.isMainThread&&i.parentPort){let e=i.workerData;e&&typeof e.html=="string"&&R(e.html).then(t=>{i.parentPort.postMessage({success:!0,result:t})}).catch(t=>{i.parentPort.postMessage({success:!1,error:t?.message||String(t)})})}0&&(module.exports={extractHtmlTree});

package/node_modules/@quantiya/codevibe-core/dist/reviewer/index.d.ts

@@ -7,10 +7,10 @@ export { parseVerdictOutput, VerdictParseErrorClass } from './output-parser.js';
 export type { RunReviewerOptions, SubprocessError, SubprocessOutcome, } from './subprocess.js';
 export { runReviewer, SubprocessErrorClass } from './subprocess.js';
 export type { ClaudeReviewerProviderOptions } from './providers/claude.js';
-export { ClaudeReviewerProvider } from './providers/claude.js';
+export { ClaudeReviewerProvider, buildCommand as buildClaudeReviewerCommand } from './providers/claude.js';
 export type { CodexReviewerProviderOptions } from './providers/codex.js';
 export { CodexReviewerProvider } from './providers/codex.js';
 export type { AntigravityReviewerProviderOptions } from './providers/antigravity.js';
-export { AntigravityReviewerProvider } from './providers/antigravity.js';
+export { AntigravityReviewerProvider, buildCommand as buildAntigravityReviewerCommand } from './providers/antigravity.js';
 export { ReviewerRegistry, createSubprocessReviewerRegistry, } from './registry.js';
 export { MockReviewerSpawner, StaticReviewerMock } from './mocks.js';

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/engage-substrate.d.ts

@@ -80,6 +80,8 @@ export interface EngageSubstrateInput {
     claudeScratchHostRoot?: string;
     /** Safe locale source for the sanitized env (default: none). */
     localeSource?: Readonly<Record<string, string | undefined>>;
+    /** If true, the turn has active web tools (MCP bridge) and runs in reduced-trust mode. */
+    webBrowsingActive?: boolean;
 }
 /**
  * The substrate-engaged result: the spawn seam runs the agent via

package/node_modules/@quantiya/codevibe-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.35",
+  "version": "2.0.37",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -11,12 +11,13 @@
     "dist/**/*.d.ts",
     "dist/index.js",
     "dist/orchestration-shell/cli.js",
+    "dist/orchestration-shell/web-extract-worker.js",
     "bin"
   ],
   "scripts": {
     "typecheck": "tsc --noEmit",
     "emit-types": "tsc -p tsconfig.types.json --emitDeclarationOnly",
-    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --minify-syntax --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && npm run verify-no-test-hooks && npm run verify-no-test-types",
+    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --minify-syntax --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && esbuild src/orchestration-shell/web/web-extract-worker.ts --bundle --platform=node --target=node18 --minify --packages=external --outfile=dist/orchestration-shell/web-extract-worker.js && npm run verify-no-test-hooks && npm run verify-no-test-types",
     "verify-no-test-hooks": "if grep -ERl 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT|CODEVIBE_ANCHORED_PUBLICATION_AUTHORITY_ROOT|codevibe-anchored-publications-|cv-publication-authority-vitest-|codevibe\\.test\\.publication-authority-|setPublicationAuthorityRootForTestBuild|__CODEVIBE_TEST_BUILD__|_onBeforeLinkForTesting|_onBeforeSummariesLockForTesting|__codevibe_test_on_before_link|__codevibe_test_on_before_summaries_lock' dist; then echo 'ERROR: a test-only hook leaked into a published artifact (prod-unreachability invariant)'; exit 1; fi; echo 'OK — no test-only hooks in published artifacts'",
     "verify-no-test-types": "if find dist -type f \\( -path '*/__tests__/*' -o -name '*.test.d.ts' -o -name 'test-publication-authority-setup.d.ts' \\) | grep -q .; then echo 'verify-no-test-types: test declarations present in dist (tsconfig.types.json must exclude test sources)' >&2; exit 1; fi",
     "clean": "rm -rf dist",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-claude-plugin",
-  "version": "2.0.40",
+  "version": "2.0.42",
   "description": "Control Claude Code from your iPhone and Android — real-time sync, approve file edits, send prompts by voice. Part of CodeVibe.",
   "main": "dist/server.js",
   "codevibe": {
@@ -48,7 +48,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@quantiya/codevibe-core": "^2.0.35",
+    "@quantiya/codevibe-core": "^2.0.37",
     "@quantiya/quorum-core": "^1.0.1",
     "dotenv": "^16.6.1",
     "express": "^5.1.0",