@quantiya/codevibe-claude-plugin 2.0.7 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/declared-test-runner.d.ts

@@ -1,6 +1,8 @@
 import type { Dirent, Stats } from 'node:fs';
 import type { runShellCommand } from '../local-executor/verification-gates/shell-runner';
 import type { ShadowDiffFile } from '../local-executor/workspace-shadow';
+import type { ProcessCleanupOwner } from '../local-executor/process-tree';
+import { type WorkspaceRootAuthority } from '../local-executor/workspace-authority';
 /** Default per-file wall-clock budget for a declared-test `node` run. */
 export declare const DECLARED_TEST_TIMEOUT_MS = 300000;
 /**
@@ -20,6 +22,9 @@ export interface DeclaredTestResult {
     ranCount: number;
     /** Never-written declared file / empty-or-JS-less declared dir (§3.D, VISIBLE). */
     skipped: string[];
+    /** False means the caller must retain the test cwd. */
+    workspaceCleanupSafe?: false;
+    workspaceCleanupOwner?: ProcessCleanupOwner;
 }
 export interface RunDeclaredTestSurfacesArgs {
     /** cwd holding the agent's changes (the shadow root). */
@@ -37,8 +42,8 @@ export interface RunDeclaredTestSurfacesArgs {
     realpath: (p: string) => Promise<string>;
     /** Injected — file/dir discriminate on the resolved target. */
     stat: (p: string) => Promise<Stats>;
-    /** Injected — directory expansion. */
-    readdir: (p: string) => Promise<Dirent[]>;
+    /** @internal test-only directory expansion seam; production streams via opendir. */
+    readdir?: (p: string) => Promise<Dirent[]>;
     /**
      * Injected (#609) — read a file's UTF-8 contents (nearest-`package.json` framework detection).
      * A throw (ENOENT / EISDIR / unreadable) is TOTAL-handled by `detectFramework` (→ keep walking up,
@@ -47,6 +52,20 @@ export interface RunDeclaredTestSurfacesArgs {
     readFile: (p: string) => Promise<string>;
     /** Default `DECLARED_TEST_TIMEOUT_MS`. */
     timeoutMs?: number;
+    /** Cooperative session-shutdown cancellation for spawned test processes. */
+    signal?: AbortSignal;
+    /** Exact snapshot incarnation selected before declared-test discovery. */
+    shadowRootAuthority?: WorkspaceRootAuthority;
+    /** @internal deterministic root-replacement seam after initial validation. */
+    afterAuthorityCheck?: () => Promise<void> | void;
+    /** @internal deterministic A→B→A restoration before the final check. */
+    beforeAuthorityCompletion?: () => Promise<void> | void;
+    /** @internal deterministic root replacement immediately before framework discovery. */
+    beforeFrameworkDiscovery?: () => Promise<void> | void;
+    /** @internal helper-held missing-intermediate authority seam. */
+    beforeClassificationMissing?: () => Promise<void> | void;
+    /** @internal helper-held missing-leaf completion seam. */
+    beforeClassificationCompletion?: () => Promise<void> | void;
 }
 /**
  * Canonicalize a declared scope / diff path for comparison: collapse backslashes to

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/emit-shell-event.d.ts

@@ -1,5 +1,6 @@
 import { AppSyncClient } from '../appsync';
 import { type Session } from '../types';
+import type { E1ProducerKind } from '../e1';
 /**
  * §3 LOCK lines 173-181. Names + per-type metadata shapes are part of
  * the Stage A contract. CP-1.a ships the union; CP-1.b/c/d add call
@@ -34,6 +35,12 @@ export interface ShellEventEmit {
     writerEventNonce?: string;
     /** Proven local key mismatch: emit the safe legacy joined fallback. */
     disableWriterAttestation?: boolean;
+    ownerToken?: string;
+    promptId?: string;
+    producerKind?: E1ProducerKind;
+    mobileActionable?: boolean;
+    resolvedPromptId?: string;
+    resolutionAt?: string;
 }
 /**
  * Test seam — allows the unit tests to swap the AppSync client without

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/explicit-tty-exit.d.ts

@@ -1,6 +1,5 @@
 export interface ExplicitTtyExitDeps {
-    runPlannerTeardown: () => Promise<void>;
-    retireSession: () => Promise<void>;
+    runTeardown: () => Promise<void>;
     unmount: () => void;
 }
 export interface ExplicitTtyExitCoordinator {

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/gate-decision-submit.d.ts

@@ -152,6 +152,11 @@ export interface GroupDecisionSubmitDeps {
      * after an accept-family COMMIT. ABSENT → no-op (tests).
      */
     markAccepted?: (taskGroupId: string) => Promise<void>;
+    /**
+     * Accept-family finalizer: retire PREPARED/APPLIED authority by exact base or
+     * post-image proof before marking accepted or clearing reviewed bundles.
+     */
+    finalizeAcceptedGroup: (taskGroupId: string) => Promise<void>;
     /**
      * HIGH-1 / LOCK #589-J — persist the CLAIMED-but-not-COMMITted decision to the
      * durable record, called IMMEDIATELY after the CLAIM phase mints `claimToken`
@@ -170,6 +175,12 @@ export interface GroupDecisionSubmitDeps {
      * (so a later reconcile never re-drives it). ABSENT → no-op (tests).
      */
     clearPendingDecision?: (taskGroupId: string) => Promise<void>;
+    /**
+     * Reclaim terminal durable group bytes after COMMIT, convergence, lifecycle
+     * transition, reissue (when requested), and pending-decision removal. The
+     * durable store rechecks every crash-authority predicate before deleting.
+     */
+    gcTerminalGroup?: (taskGroupId: string) => Promise<void>;
     /**
      * Drive the per-track render flip through the SAME `emitGroupConvergence`
      * chokepoint (D2): accept-family → tracks stay/flip `Passed`; reject-family →

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/gate-prompts.d.ts

@@ -429,12 +429,51 @@ export interface ReviewSummaryRoundModel {
     /** Aggregated REVISE seat findings (the auto-revision driver), or null. */
     readonly reviseNotes: string | null;
 }
+export interface ReviewSummaryTerminalModel {
+    readonly schemaVersion: number;
+    readonly requirements: {
+        readonly problem: string;
+        readonly expectedOutputs: ReadonlyArray<string>;
+    };
+    readonly implementors: ReadonlyArray<{
+        readonly agent: string;
+        readonly trackIndex: number | null;
+        readonly taskId: string;
+    }>;
+    readonly reviewQuorum: {
+        readonly seats: ReadonlyArray<{
+            readonly seatId: number;
+            readonly role: string;
+            readonly agent: string;
+        }>;
+        readonly roundCount: number;
+        readonly revisionCount: number;
+    };
+    readonly mergeGate: {
+        readonly applicable: boolean;
+        readonly outcome: string;
+        readonly resolution: string | null;
+    };
+    readonly durations: {
+        readonly taskElapsedMs: number | null;
+        readonly reviewerElapsedMs: number | null;
+        readonly availability: string;
+    };
+    readonly tokenUsage: {
+        readonly knownTotal: number | null;
+        readonly availability: string;
+        readonly unavailableRoles: ReadonlyArray<string>;
+    };
+    readonly residualRisks: ReadonlyArray<string>;
+}
 /**
  * The fully-extracted, render-ready per-round review summary model. PURE
  * function of the decrypted summary. `null`-attached (entry has no
  * `reviewSummary`) → the panel renders nothing extra (fail-open base prompt).
  */
 export interface ReviewSummaryPanelModel {
+    /** Additive P15 schema-v2 terminal header; null for legacy schema v1. */
+    readonly terminal: ReviewSummaryTerminalModel | null;
     readonly rounds: ReadonlyArray<ReviewSummaryRoundModel>;
     /** finalOutcome display value (proceed | auto_revise | escalate). */
     readonly finalOutcome: string;
@@ -448,6 +487,41 @@ export interface ReviewSummaryPanelModel {
  * object degrades to an empty/safe model, never throws.
  */
 export interface DecryptedReviewSummaryInput {
+    readonly schemaVersion?: number;
+    readonly requirements?: {
+        readonly problem?: string;
+        readonly expectedOutputs?: ReadonlyArray<string>;
+    };
+    readonly implementors?: ReadonlyArray<{
+        readonly agent?: string;
+        readonly trackIndex?: number;
+        readonly taskId?: string;
+    }>;
+    readonly reviewQuorum?: {
+        readonly seats?: ReadonlyArray<{
+            readonly seatId?: number;
+            readonly role?: string;
+            readonly agent?: string;
+        }>;
+        readonly roundCount?: number;
+        readonly revisionCount?: number;
+    };
+    readonly mergeGate?: {
+        readonly applicable?: boolean;
+        readonly outcome?: string;
+        readonly resolution?: string;
+    };
+    readonly durations?: {
+        readonly taskElapsedMs?: number;
+        readonly reviewerElapsedMs?: number;
+        readonly availability?: string;
+    };
+    readonly tokenUsage?: {
+        readonly knownTotal?: number;
+        readonly availability?: string;
+        readonly unavailableRoles?: ReadonlyArray<string>;
+    };
+    readonly residualRisks?: ReadonlyArray<string>;
     readonly rounds?: ReadonlyArray<{
         readonly round?: number;
         readonly proposal?: string;
@@ -458,6 +532,7 @@ export interface DecryptedReviewSummaryInput {
             readonly decision?: string;
             readonly reasoning?: string;
             readonly suggestedChanges?: ReadonlyArray<string>;
+            readonly residualObservations?: ReadonlyArray<string>;
         }>;
         readonly outcome?: string;
         readonly reviseNotes?: string;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/index.d.ts

@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import { AppSyncClient } from '../appsync';
 import { Session } from '../types';
 import { OrchestrationStore } from './store';
+import { AdvisoryAttachmentJournal } from './advisory-attachment-journal';
 import type { ImageAttachment } from './types';
 import { type GroupDecisionSubmitDeps } from './gate-decision-submit';
 import { type ContinuationCliResult, type ContinuationCliDeps } from './slash-routes/continuation';
@@ -43,6 +44,8 @@ export interface RunOrchestrationShellArgs {
      * teardown `finally` is armed; until then the admitting CLI owns retirement.
      */
     acceptSessionLifecycleOwnership?: () => void;
+    /** @internal isolated durable advisory-attachment authority for tests. */
+    advisoryAttachmentJournal?: AdvisoryAttachmentJournal;
     /**
      * CP-1.b IMPL r2 H-3 — Optional planner adapter. When supplied,
      * `runOrchestrationShell` binds the active session via

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/planner-offer-e1.d.ts

@@ -0,0 +1,97 @@
+import type { ShellEventEmit, ShellEventEmitResult } from './emit-shell-event';
+/** The run-scoped shell emitter (`createShellEventEmitter(...)`). */
+export type ShellEmitter = (args: ShellEventEmit) => Promise<ShellEventEmitResult>;
+/** The run-scoped `openPrompts` TTL co-refresh transport (§3.1). */
+export type OpenPromptTtlRefresher = (promptIds: string[]) => Promise<string[]>;
+/** Everything the ledger needs to (re-)emit an offer raise. */
+export interface PlannerOfferRaiseContext {
+    sessionId: string;
+    /** The offer question — the INTERACTIVE_PROMPT content (re-raised verbatim). */
+    content: string;
+    /** The offer payload — the INTERACTIVE_PROMPT metadata (re-raised verbatim). */
+    metadata: Record<string, unknown>;
+    agentType?: string;
+    title?: string;
+}
+/**
+ * The core CORE_OFFER producer ledger + durable-ledger refresh loop. A single
+ * instance lives per process (one orchestration shell per process); `beginRun`
+ * re-binds the transports + resets state for a fresh run.
+ */
+export declare class PlannerOfferE1Ledger {
+    /** Open offers, keyed by the offer's stable `conversationEntryId` (§6a-4). */
+    private readonly raises;
+    /** promptIds whose raise emit is un-acked → retry-until-ack (mirrors the plugins'
+     * `e1NeedsReRaise`). */
+    private readonly needsReRaise;
+    /** promptIds whose resolution emit is un-acked → retry-until-ack (F-C4). */
+    private readonly pendingResolutions;
+    private timer;
+    private emit;
+    private refreshTtl;
+    private readonly refreshMs;
+    private draining;
+    constructor(opts?: {
+        refreshMs?: number;
+    });
+    /**
+     * Install the run-scoped TTL-refresh transport and RESET all per-run state. Call
+     * once at shell start; a re-run (tests) gets a clean ledger + no stale timer.
+     */
+    beginRun(refreshTtl: OpenPromptTtlRefresher): void;
+    /**
+     * F-C1 — raise (or re-present) a planner offer and INSPECT the emit result. On a
+     * transient failure (`{emitted:false}` or a throw) PARK the promptId for
+     * retry-until-ack. First presentation mints a fresh secret + committed promptId;
+     * a re-present across turns reuses it (stable id → the backend re-raises on the
+     * `ownerToken=:token` branch, no duplicate row). Never throws.
+     */
+    raiseOffer(emit: ShellEmitter, conversationEntryId: string, ctx: PlannerOfferRaiseContext): Promise<void>;
+    /**
+     * F-C4 — resolve an offer: emit the SIGNED resolution NOTIFICATION so its
+     * `openPrompts` row exact-clears, retried-until-ack. The ledger identity is moved
+     * OUT of the open-offer set (stops refresh/re-raise) INTO the pending-resolution
+     * set and is NOT dropped until the clear is backend-acknowledged (or is proven
+     * un-attestable → over-nag to TTL). A no-op if the offer never raised a row (a
+     * pre-E1 in-flight offer). Never throws.
+     */
+    resolveOffer(emit: ShellEmitter, conversationEntryId: string, sessionId: string): Promise<void>;
+    /** Stop the refresh timer (shell teardown). Idempotent. */
+    stopTimer(): void;
+    /** Is there a LIVE open-offer ledger entry for this entryId? (content-key floor) */
+    hasOpenOffer(conversationEntryId: string): boolean;
+    /** The committed promptId for an open offer (undefined once resolved/absent). */
+    promptIdFor(conversationEntryId: string): string | undefined;
+    isParkedForReRaise(promptId: string): boolean;
+    hasPendingResolution(promptId: string): boolean;
+    /** Run ONE refresh tick synchronously (the interval calls this; exposed for tests). */
+    runTick(): Promise<void>;
+    private getOrCreateEntry;
+    private buildRaiseEmit;
+    /**
+     * Emit ONE offer raise + park on failure (F-C1). ACK (`{emitted:true}`) clears any
+     * retry flag; `{emitted:false}` or a throw parks the promptId so a later tick
+     * re-emits until the backend writes the row.
+     */
+    private emitRaise;
+    /**
+     * Emit ONE resolution + retry-until-ack (F-C4). ACK (`{emitted:true}`) drops the
+     * identity (the row exact-cleared, or the conditional Delete no-op'd for an
+     * already-gone row — both acknowledged). A transient `{emitted:false}` keeps the
+     * identity for the next tick; a terminal/un-attestable reason (or the retry cap)
+     * gives up → the row over-nags to its own TTL.
+     */
+    private emitResolution;
+    /** Retry every parked raise whose ledger entry is still open (F-C1 drain). */
+    private drainReRaises;
+    /** Retry every un-acked resolution; give up past the attempt cap (F-C4 drain). */
+    private drainResolutions;
+    /**
+     * §3.1 — co-refresh the OPEN offers' `openPrompts` row TTLs; FULL-re-raise any
+     * promptId the backend reports as already aged-out (return-driven re-raise, §6a-4).
+     */
+    private refreshOpenTtls;
+    private findOpenEntryByPromptId;
+    private ensureTimer;
+    private maybeStopTimer;
+}