@quantiya/codevibe-claude-plugin 2.0.7 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/team-decompose.d.ts

@@ -18,17 +18,17 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
                 access: z.ZodEnum<["write", "read"]>;
             }, "strip", z.ZodTypeAny, {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }, {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }>, "many">;
             test_surfaces: z.ZodArray<z.ZodString, "many">;
             auto_modified_files: z.ZodArray<z.ZodString, "many">;
         }, "strip", z.ZodTypeAny, {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -36,7 +36,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         }, {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -50,7 +50,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -63,7 +63,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -73,13 +73,12 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         implementorAgent?: unknown;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    decompose: true;
     workItems: {
         description: string;
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -88,14 +87,14 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         implementorAgent: "CLAUDE" | "CODEX" | "ANTIGRAVITY";
         isSharedTestOwner: boolean;
     }[];
-}, {
     decompose: true;
+}, {
     workItems: {
         description: string;
         ownershipScope: {
             shared_contracts: {
                 path: string;
-                access: "write" | "read";
+                access: "read" | "write";
             }[];
             write_paths: string[];
             test_surfaces: string[];
@@ -104,6 +103,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
         isSharedTestOwner: boolean;
         implementorAgent?: unknown;
     }[];
+    decompose: true;
 }>, z.ZodObject<{
     decompose: z.ZodLiteral<false>;
     reason: z.ZodString;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/types.d.ts

@@ -136,6 +136,29 @@ export interface RunningTaskState {
     exitCode?: number;
     bypassReason?: 'deterministic_shortcut' | 'planner_outage' | 'planner_degraded_explicit_override';
 }
+/**
+ * P10 E3 r2 — one row of the bare-`/audit` session listing (the
+ * `sessionTasks` value). Deliberately NOT `RunningTaskState`: Agent Teams
+ * child tasks arrive via TEAM_TRACK_ASSIGNED (Stage-2 r1 Codex MED-1) which
+ * carries no pid, so forcing that shape would fabricate fields. Display-only.
+ */
+export interface SessionTaskRecord {
+    taskId: string;
+    /** Implementor agent when known; a team ASSIGNED event may omit it. */
+    agentKind?: string;
+    /** 'single' = TASK_LIFECYCLE-tracked; 'team' = Agent Teams track. */
+    origin: 'single' | 'team';
+    /**
+     * Singles: the lifecycle status — 'running' at dispatch, flipped terminal
+     * by the task-end CLOSER progress events (promoted → 'completed',
+     * discarded → 'cancelled', round_failed → 'failed'; Stage-2 r1 Codex
+     * MED-2 — no production TASK_LIFECYCLE dispatch ever carries a terminal
+     * status). Team rows: the TeamTrackState label verbatim.
+     */
+    status: string;
+    /** Singles: the dispatch stamp. Team rows: first-observed stamp. */
+    startedAt: string;
+}
 /**
  * §5.1 LOCK (lines 547-556). Single reviewer subprocess identity +
  * verdict. `reviewerKind` is hand-listed per CP-1 — CP-3 Stage A
@@ -544,13 +567,15 @@ export interface TeamState {
  * the user is in control (a gate prompt is shown → `waiting_user` clears it).
  * Milestones (diff captured, verdicts received, promoted, …) are NOT stored here
  * — they are appended to `conversation` as persisted scrollback entries. This is
- * desktop-LOCAL only: counts/labels/elapsed, never plaintext (see
+ * desktop-LOCAL only: counts/labels/elapsed, never plaintext — `halt_notice`,
+ * the union's one free-text exception, can never open or refresh this live
+ * line (reducer phase-family guard); it is scrollback-only (see
  * `task-progress.ts`).
  */
 export interface LiveProgress {
     /** The phase of the in-flight spinner line. */
     phase: TaskProgressEvent['phase'];
-    /** The BOUNDED live label (counts/labels/paths only — no plaintext, no embedded timer). */
+    /** The BOUNDED live label (counts/labels/paths only — no plaintext; `halt_notice` never reaches here; no embedded timer). */
     text: string;
     /** When this line was last refreshed. Retained; currently unused (no component reads it). */
     updatedAt: string;
@@ -582,6 +607,11 @@ export interface OrchestrationState {
     plannerHealth: PlannerHealthState;
     conversation: ConversationEntry[];
     runningTasks: Map<string, RunningTaskState>;
+    sessionTasks: Map<string, SessionTaskRecord>;
+    lastReviewerProgress: {
+        text: string;
+        at: string;
+    } | null;
     queuedTasks: QueuedTask[];
     activeReviewerSeats: Map<string, ReviewerSeatState>;
     currentGate: GateState | null;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/workspace-shutdown.d.ts

@@ -0,0 +1,27 @@
+export interface WorkspaceShutdownOperations {
+    flushPlannerCache?: () => Promise<void>;
+    clearPlannerSession?: () => void;
+    disposeQuorumWorkspaces?: () => Promise<void>;
+    drainLocalWorkspaces?: () => Promise<void>;
+    /** Settle already-admitted shell turns after their agent processes drain. */
+    drainShellSubmissions?: () => Promise<void>;
+    /** Flush the settled turns' local and hosted canonical context publications. */
+    finalizeContextItemPublications?: () => Promise<void>;
+    /** Audit/retry exact advisory-image authority after every owning turn settles. */
+    disposeAdvisoryAttachmentAuthority?: () => Promise<void>;
+    disposeLocalDurableSessionResources?: () => Promise<void>;
+    /** Final hosted terminal mutation; no local or hosted turn publication follows. */
+    retireHostedSession?: () => Promise<void>;
+    onPlannerFlushFailure?: (error: Error) => void;
+    onWorkspaceFailure?: (error: Error) => void;
+}
+/**
+ * Start every independent shutdown fence before awaiting any one owner.
+ *
+ * The LocalExecutor's shared durable group retirement is deliberately a final
+ * phase: Quorum may still have an already-admitted terminal publisher that is
+ * allowed to finish while its ingress is closed. Only after both Quorum and
+ * LocalExecutor drains settle can the durable store be enumerated exactly once
+ * without a late publisher recreating a group behind the cleanup pass.
+ */
+export declare function runWorkspaceShutdownOperations(operations: WorkspaceShutdownOperations): Promise<void>;

package/node_modules/@quantiya/codevibe-core/dist/reviewer/output-parser.d.ts

@@ -19,7 +19,26 @@ export interface ParsedVerdict {
      * via `revise_missing_changes` / `suggested_changes_require_revise`).
      */
     suggested_changes: string[];
+    /**
+     * Ordered non-blocking observations from the explicit
+     * `RESIDUAL OBSERVATIONS:` section. These never count as suggested changes.
+     */
+    residual_observations: string[];
+}
+export interface ResidualObservationSplit {
+    /** Reviewer output with the explicit residual section removed. */
+    reviewText: string;
+    /** Ordered, non-empty residual observations. */
+    residualObservations: string[];
 }
+/**
+ * Split the optional P15 residual-observation section from reviewer prose.
+ *
+ * The heading must occupy its own line. Bullets are preferred, but plain
+ * non-empty lines are retained as observations so harmless reviewer format
+ * drift cannot turn a non-blocking note into a revision request.
+ */
+export declare function splitResidualObservations(raw: string): ResidualObservationSplit;
 /**
  * Why a reviewer's reply failed the locked-format check. Discriminated
  * union; the subprocess layer maps any of these into `ReviewerError` with

package/node_modules/@quantiya/codevibe-core/dist/reviewer/types.d.ts

@@ -90,6 +90,9 @@ export interface ReviewerVerdict {
     /** Ordered list of specific changes. **Required** when `verdict === 'REVISE'`;
      *  empty for other verdicts (enforced by the output parser). */
     suggested_changes: string[];
+    /** Optional non-blocking risks or recommendations. These are displayed in
+     *  the terminal summary but never affect consensus or trigger revision. */
+    residual_observations: string[];
     /** Model identifier used (for cost attribution). */
     model_used: string | null;
     /** Tokens consumed by this reviewer. */

package/node_modules/@quantiya/codevibe-core/dist/reviewer/verdict-classifier.d.ts

@@ -59,4 +59,5 @@ export declare function resolveClassifiedVerdictFields(classification: VerdictCl
     verdict: VerdictKind;
     reasoning: string;
     suggested_changes: string[];
+    residual_observations: string[];
 };

package/node_modules/@quantiya/codevibe-core/dist/session/session-rekey.d.ts

@@ -27,9 +27,10 @@ export interface RekeyOptions {
  * bound to its current public key and nothing is forced.
  *
  * @param sessionId  The session to re-key.
- * @param sessionKey The plaintext session key (base64). The caller must
- *                   already hold this — typically from
- *                   keychainManager.getCachedSessionKey(sessionId).
+ * @param sessionKey The caller's current plaintext session key (base64).
+ *                   This is only an admission hint: after fetching the
+ *                   authoritative row, the function re-derives/loads the key
+ *                   for that row's exact generation before wrapping.
  * @param appSyncClient Authenticated AppSyncClient.
  * @param options Optional behavior knobs. See RekeyOptions.
  * @returns The number of new grants that succeeded.

package/node_modules/@quantiya/codevibe-core/dist/substrate/command-runner.d.ts

@@ -1,4 +1,5 @@
 import type { CommandResult, CommandRunner, RunnerProc } from './types';
+import type { WorkspaceRootAuthority } from '../local-executor/workspace-authority';
 /**
  * The production `CommandRunner` — runs `docker` / `sandbox-exec` via
  * `node:child_process`. No shell is used (argv is passed directly to
@@ -15,5 +16,6 @@ export declare class ChildProcessCommandRunner implements CommandRunner {
         signal?: AbortSignal;
         env?: Readonly<Record<string, string>>;
         cwd?: string;
+        cwdAuthority?: WorkspaceRootAuthority;
     }): RunnerProc;
 }

package/node_modules/@quantiya/codevibe-core/dist/substrate/docker.d.ts

@@ -1,5 +1,6 @@
 import { type ForwarderFactory } from './forwarder';
 import type { CommandRunner, EgressObservationHook, Substrate, SubstrateHandle, SubstrateSpec } from './types';
+import { type WorkspaceRootAuthority, type WorkspaceRootLease } from '../local-executor/workspace-authority';
 /** Where, inside the container, the worktree is mounted (the agent's cwd/home). */
 export declare const CONTAINER_WORKDIR = "/workspace";
 /** Injectable deps — default-wired to the real runtime; stubbed in unit tests. */
@@ -14,12 +15,13 @@ export interface DockerSubstrateDeps {
     image?: string;
     /**
      * Override the host root for the per-session scratch dir (default:
-     * os.tmpdir()). The per-session dir holds ONLY the broker socket (in `uds/`),
-     * the relay script, and the scrubbed git-proxy (in `gitproxy/`) — no secrets.
-     * The git-proxy now lives UNDER this dir (MED fix), so the one
-     * teardown/rollback rm removes it.
+     * os.tmpdir()). The per-session dir holds ONLY the broker socket (in `uds/`)
+     * and the relay script — no secrets or repository metadata.
+     * The one teardown/rollback removal retires the complete session authority.
      */
     sessionRoot?: string;
+    /** Original-handle bind source (native Linux by default; injectable for seam tests). */
+    acquireWorkdirLease?: (authority: WorkspaceRootAuthority) => Promise<WorkspaceRootLease>;
 }
 /** The deterministic per-session container name. */
 export declare function containerName(id: string): string;
@@ -44,7 +46,6 @@ export declare function buildContainerEntrypoint(sanitizedEnv: Readonly<Record<s
  * surface the conformance test pins:
  *   - `--network none`         → STRUCTURAL default-deny (only `lo`, no egress).
  *   - `-v <workdir>:/workspace` → ONLY the worktree mounted (rw).
- *   - `-v <gitProxy>:/workspace/.git:ro` → scrubbed `.git`, read-only (if any).
  *   - `-v <relayScript>:/codevibe/relay.js:ro` → the in-container relay (ro).
  *   - `-v <udsDir>:/codevibe/broker:rw`  → the bind-mounted broker UDS dir (rw,
  *     so the container's `connect()` works; the dir holds only the socket).
@@ -63,7 +64,6 @@ export declare function buildRunArgv(args: {
     id: string;
     image: string;
     workdir: string;
-    gitProxyPath: string | null;
     relayScriptPath: string;
     udsDir: string;
     sanitizedEnv: Readonly<Record<string, string>>;
@@ -101,40 +101,15 @@ export declare class DockerSubstrate implements Substrate {
     private readonly onEgressDenied;
     private readonly image;
     private readonly sessionRoot;
+    private readonly acquireWorkdirLease;
     constructor(deps?: DockerSubstrateDeps);
     launch(spec: SubstrateSpec): Promise<SubstrateHandle>;
     private rollback;
-    /**
-     * r5 HIGH-2 (Codex — NULL-vs-THROW gap). The proxy build produced no usable
-     * proxy (it returned `null` OR threw). Decide the safe outcome by whether the
-     * workdir actually HAS a `.git`:
-     *
-     *   - NO `<workdir>/.git`            → return `null` (a non-git workdir; the
-     *                                      `docker run` mounts only the worktree,
-     *                                      git reports "not a repository" — no
-     *                                      credential surface either way).
-     *   - `<workdir>/.git` EXISTS        → write an EMPTY SCRUBBED `.git` overlay
-     *                                      (a dir with ONLY a stripped synthetic
-     *                                      `config` — NO remotes/creds/hooks) and
-     *                                      return its path, so the `:ro` bind mount
-     *                                      SHADOWS the real `.git`. Degraded git
-     *                                      reads, but the credential surface is
-     *                                      fail-closed.
-     *   - overlay write ALSO fails       → roll back + throw (NEVER mount the
-     *                                      worktree with a live `.git`).
-     *
-     * Used for BOTH the null-return and the throw path so a workdir with a real
-     * but unresolvable `.git` can never reach the agent un-shadowed. `fsp.stat`
-     * (NOT `lstat`) follows a `.git` that is a symlink/dir/file alike — any of
-     * those "exists" cases must be shadowed.
-     */
-    private ensureGitOverlayOrFailClosed;
     private assertDockerAvailable;
 }
 export declare const __testing: {
     DEFAULT_IMAGE: string;
     CONTAINER_WORKDIR: string;
-    CONTAINER_GIT: string;
     CONTAINER_RELAY_PATH: string;
     CONTAINER_BROKER_DIR: string;
     RELAY_PORT: number;

package/node_modules/@quantiya/codevibe-core/dist/substrate/index.d.ts

@@ -8,5 +8,4 @@ export { SubstrateUnavailableError, SubstrateLaunchError } from "./errors";
 export { ChildProcessCommandRunner } from "./command-runner";
 export { HostEgressForwarder, defaultForwarderFactory } from "./forwarder";
 export type { ForwarderSpec, ForwarderFactory } from "./forwarder";
-export { buildScrubbedGitProxy, resolveGitCommonDir } from "./git-proxy";
 export { IN_CONTAINER_RELAY_SOURCE, CONTAINER_RELAY_PATH, CONTAINER_BROKER_DIR, CONTAINER_BROKER_SOCK, BROKER_SOCK_NAME, RELAY_PORT, } from "./relay-script";

package/node_modules/@quantiya/codevibe-core/dist/substrate/sandbox-exec.d.ts

@@ -68,19 +68,6 @@ export declare function buildSeatbeltProfile(workdir: string, execPath?: string,
  * invariant that host secrets stay unreadable still holds).
  */
 extraReadDirs?: readonly string[], 
-/**
- * Stage-2 HIGH (Codex — the `.git` credential leak). The host path of the
- * SCRUBBED `.git` proxy (built by `git-proxy.ts`, same as A1's mount). When
- * provided, the profile (a) GRANTS read on it (read-only — the agent runs
- * `git` against it via `GIT_DIR`) and (b) DENIES read+write of the REAL
- * `<workdir>/.git`, so the agent CANNOT read the host repo's credential
- * helpers / tokenized remotes / hooks / reflogs directly. Without this the A5
- * agent runs on the host fs and the `(allow file-read* (subpath "<wd>"))`
- * grant would expose the real `.git`. Null/absent for a non-git workdir (the
- * `.git` deny is still emitted — denying a non-existent path is harmless and
- * keeps the profile shape uniform).
- */
-gitProxyDir?: string | null, 
 /**
  * r5 HIGH-1 (Codex) — the home dir to anchor the file-keychain (`~/.codevibe`)
  * DENY at. Default `os.homedir()`; injectable for deterministic tests. The

package/node_modules/@quantiya/codevibe-core/dist/substrate/types.d.ts

@@ -1,4 +1,5 @@
 import type { Readable, Writable } from "node:stream";
+import type { WorkspaceRootAuthority } from "../local-executor/workspace-authority";
 /**
  * Isolation backend for a substrate. `firecracker` is [DEF →
  * A3-after-C2] — declared so the union admits the hosted runner without
@@ -24,10 +25,12 @@ export type EgressFidelity = "strict" | "coarse";
 export interface SubstrateSpec {
     isolationTech: IsolationTech;
     /**
-     * Canonical host path of the session worktree — the ONLY filesystem
-     * mounted (§6 Q3 git-proxy).
+     * Canonical host path of the session workspace — the only mutable filesystem
+     * mounted; repository metadata is hidden by the substrate.
      */
     workdir: string;
+    /** Exact host workdir incarnation for task-scoped mutable launches. */
+    workdirAuthority?: WorkspaceRootAuthority;
     /**
      * Where the broker actually listens on the HOST (e.g.
      * `127.0.0.1:<ephemeral>`).
@@ -243,5 +246,7 @@ export interface CommandRunner {
         env?: Readonly<Record<string, string>>;
         /** Child working directory. Absent → inherit the parent's cwd. */
         cwd?: string;
+        /** Exact cwd incarnation held through native process creation. */
+        cwdAuthority?: WorkspaceRootAuthority;
     }): RunnerProc;
 }

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/__tests__/reviewer-credential-preflight.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/engage-substrate.d.ts

@@ -2,6 +2,7 @@ import { type RotationHandle } from "../credential-broker";
 import type { BrokerDeps } from "../credential-broker/broker";
 import type { ModelGatewayBroker, UpstreamClient, VendorProvider } from "../credential-broker/types";
 import type { ProcessRole } from "../local-executor/types";
+import type { WorkspaceRootAuthority } from "../local-executor/workspace-authority";
 import type { SubstrateHandle } from "../substrate/types";
 import { type FallbackLadderDeps } from "./fallback-ladder";
 /** Map the implementor agent to the broker provider (Claude+Codex only, §6 Q4). */
@@ -21,6 +22,8 @@ export interface EngageSubstrateInput {
     agentKind: "CLAUDE" | "GEMINI" | "CODEX" | "ANTIGRAVITY";
     /** Canonical host path of the session worktree (the only fs mounted). */
     workdir: string;
+    /** Exact workdir incarnation for task-scoped mutable dispatch. */
+    workdirAuthority?: WorkspaceRootAuthority;
     /** The implementor role marker value (always 'implementor' here). */
     role: ProcessRole;
     /**

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/index.d.ts

@@ -6,6 +6,8 @@ export { buildSanitizedBaseEnv, assertNoAmbientCreds, SAFE_ENV_ALLOWLIST, SANDBO
 export type { SanitizedEnvInput } from "./sanitized-env";
 export { ApiKeyBootstrap, SANDBOX_BOOTSTRAP_DIR, HELPER_SCRIPT_NAME, TOKEN_FILE_NAME, CODEX_PROVIDER_ID, } from "./apikey-bootstrap";
 export type { ApiKeyBootstrapInput } from "./apikey-bootstrap";
+export { assertReviewerVendorCredential, reviewerProviderFor, withReviewerCredentialPreflight, ReviewerCredentialMissingError, REVIEWER_CREDENTIAL_MISSING, } from "./reviewer-credential-preflight";
+export type { ReviewerCredentialStore } from "./reviewer-credential-preflight";
 export { scrubLeEnvOrReexec, buildScrubbedLeEnv, findCredShapedKeys, isCredShapedEnvKey, LE_ENV_SCRUBBED_MARKER, } from "./le-env-scrub";
 export type { LeEnvScrubDeps } from "./le-env-scrub";
 export { Cp7AuditWriter, CP7_CANONICAL_FORM_VERSION, GENESIS_PREV_HASH, canonicalJson, canonicalEntryBytes, computeEntryHash, verifyChain, } from "../local-executor/cp7-audit-writer";

package/node_modules/@quantiya/codevibe-core/dist/substrate-launch/reviewer-credential-preflight.d.ts

@@ -0,0 +1,50 @@
+import type { VendorProvider } from "../credential-broker";
+/**
+ * Typed marker for the missing-credential failure so the loop can surface the
+ * remediation on the user-facing NOTIFICATION channel (Stage-2 r2 Codex MED-1)
+ * without string-matching. Identified by `name` (survives bundling) — callers
+ * check `err.name === REVIEWER_CREDENTIAL_MISSING` rather than instanceof.
+ */
+export declare const REVIEWER_CREDENTIAL_MISSING = "ReviewerCredentialMissingError";
+export declare class ReviewerCredentialMissingError extends Error {
+    name: string;
+}
+/**
+ * The minimal store surface the preflight needs (structurally satisfied by
+ * `KeychainVendorKeyStore`); narrow so tests can stub it without keychain IO.
+ */
+export interface ReviewerCredentialStore {
+    getVendorKey(provider: VendorProvider): Promise<string | null>;
+    getVendorOAuthBundle(provider: VendorProvider): Promise<unknown | null>;
+}
+/**
+ * Map a reviewer agent kind (lowercase, as the loop's engager input carries it)
+ * to its broker vendor provider. Non-Trusted agents (gemini/antigravity) have
+ * no broker provider — they never sandbox, so the preflight is a no-op for
+ * them (the loop pre-routes them to legacy+badge before engaging anyway).
+ */
+export declare function reviewerProviderFor(agent: string): VendorProvider | null;
+/**
+ * Throw (fail-closed) when a Trusted reviewer is about to substrate-engage but
+ * no vendor credential exists for its provider. The message is the user-facing
+ * remediation — it propagates verbatim through the loop's engage-failure
+ * ESCALATE (`spawnOneSeat`) and the Wave-B fall-through WARN.
+ */
+export declare function assertReviewerVendorCredential(agent: string, store: ReviewerCredentialStore): Promise<void>;
+/**
+ * Wrap a reviewer substrate engager with the credential preflight, ordered
+ * AFTER tier selection (Stage-2 r2 Codex MED-2): the underlying engage runs
+ * first, and the credential check applies ONLY when the ladder actually chose
+ * the `substrate` (broker) mode — a `reduced_trust` selection never consults
+ * credentials, preserving the pre-flip legacy-plus-badge fallback on hosts
+ * with no establishable sandbox tier. On substrate + missing credential the
+ * engaged substrate is torn down and the actionable
+ * `ReviewerCredentialMissingError` propagates (fail-closed, no ambient
+ * fallback).
+ */
+export declare function withReviewerCredentialPreflight<I extends {
+    agent: string;
+}, R extends {
+    mode: string;
+    teardown: () => Promise<void>;
+}>(engage: (input: I) => Promise<R>, store: ReviewerCredentialStore): (input: I) => Promise<R>;

package/node_modules/@quantiya/codevibe-core/dist/test-publication-authority-setup.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/tool-activity/replay-cursor.d.ts

@@ -1,5 +1,19 @@
 import { z } from 'zod';
 import type { Logger } from '../logger';
+/** Keep every ordinary replay read comfortably below Node/Buffer's platform limits. */
+export declare const DEFAULT_REPLAY_READ_BYTES: number;
+/**
+ * A JSONL record may be larger than the ordinary batch, so the reader extends in
+ * fixed-size chunks until it finds the terminating newline. This cap bounds the
+ * one-record memory cost without imposing any limit on the transcript FILE size.
+ */
+export declare const DEFAULT_REPLAY_MAX_FRAME_BYTES: number;
+export declare class ReplayFrameTooLargeError extends Error {
+    readonly startOffset: number;
+    readonly maxFrameBytes: number;
+    readonly code = "REPLAY_FRAME_TOO_LARGE";
+    constructor(startOffset: number, maxFrameBytes: number);
+}
 export declare const ReplayCursorStateSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     /** The transcript path this cursor tracks (a change ⇒ rescan from 0). */
@@ -23,8 +37,8 @@ export declare const ReplayCursorStateSchema: z.ZodObject<{
     carryover: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     version: 1;
-    byteOffset: number;
     canonicalPath: string;
+    byteOffset: number;
     fileIdentity: {
         dev: number;
         ino: number;
@@ -33,8 +47,8 @@ export declare const ReplayCursorStateSchema: z.ZodObject<{
     carryover: string;
 }, {
     version: 1;
-    byteOffset: number;
     canonicalPath: string;
+    byteOffset: number;
     fileIdentity: {
         dev: number;
         ino: number;
@@ -57,7 +71,7 @@ export interface ReplayFrame {
 }
 /** A pure read snapshot — no persisted state is mutated by {@link ToolReplayCursor.readFrames}. */
 export interface ReadFramesResult {
-    /** Complete lines from the checkpoint (or 0 after a rotation) to EOF. */
+    /** Complete lines in this bounded batch from the checkpoint (or 0 after a rotation). */
     frames: ReplayFrame[];
     /** True when the file rotated/truncated and was rescanned from 0. */
     rotated: boolean;
@@ -67,6 +81,14 @@ export interface ReadFramesResult {
     carryover: string;
     /** Byte offset just past the last COMPLETE line — the max checkpoint candidate. */
     endOfComplete: number;
+    /**
+     * True when this stat snapshot contains bytes beyond the bounded read. The
+     * caller may immediately run another batch after checkpointing this one.
+     * False at the snapshot EOF, including when EOF is an incomplete trailing line.
+     */
+    hasMore: boolean;
+    /** Bytes actually read from disk for this batch (diagnostics/tests). */
+    bytesRead: number;
     /** The identity + size captured AT read time — pass to {@link ToolReplayCursor.checkpoint} for a consistent snapshot. */
     fileIdentity: {
         dev: number;
@@ -81,6 +103,10 @@ export interface ToolReplayCursorOptions {
     canonicalPath: string;
     logger: Logger;
     root?: string;
+    /** Ordinary bounded batch size. Defaults to 4 MiB. */
+    readBytes?: number;
+    /** Maximum bytes allowed in one unterminated JSONL record. Defaults to 64 MiB. */
+    maxFrameBytes?: number;
 }
 /**
  * The durable tool-replay cursor for ONE session's transcript. Split into a PURE
@@ -94,6 +120,8 @@ export declare class ToolReplayCursor {
     private readonly canonicalPath;
     private readonly logger;
     private readonly rootDir;
+    private readonly readBytes;
+    private readonly maxFrameBytes;
     private state;
     constructor(opts: ToolReplayCursorOptions);
     private filePath;
@@ -105,11 +133,17 @@ export declare class ToolReplayCursor {
     /** The current durable checkpoint (0 when fresh). */
     byteOffset(): number;
     /**
-     * Read + byte-frame the transcript from the durable checkpoint (or 0 after a
-     * rotation) to EOF. PURE — persists nothing. Frames on `\n` (0x0A), an ASCII
-     * byte that never appears mid-UTF-8-char, so every complete-line boundary is a
-     * safe UTF-8 (and byte-offset) boundary; the trailing partial is returned as
-     * `carryover` and re-read next cycle.
+     * Read + byte-frame ONE BOUNDED transcript batch from the durable checkpoint
+     * (or 0 after a rotation). PURE — persists nothing. File positions are ordinary
+     * safe JS integers, so offsets above Node's signed 32-bit Buffer length remain
+     * valid; no allocation is based on `(fileSize - checkpoint)`.
+     *
+     * Frames on `\n` (0x0A), an ASCII byte that never appears mid-UTF-8-char, so
+     * every complete-line boundary is a safe UTF-8 (and byte-offset) boundary. If
+     * the ordinary batch contains no newline, fixed-size reads extend only until
+     * the first record terminator or `maxFrameBytes`. Thus transcript FILE size is
+     * unbounded while one malformed/huge JSONL RECORD has a controlled bound.
+     * The trailing partial is returned as `carryover` and re-read next cycle.
      */
     readFrames(): Promise<ReadFramesResult>;
     /**

package/node_modules/@quantiya/codevibe-core/dist/types/encryption.d.ts

@@ -55,4 +55,9 @@ export interface GrantSessionKeyInput {
     ephemeralPublicKey: string;
     /** SHA-256 of the exact registered public-key string used to wrap the key. */
     recipientPublicKeySha256: string;
+    /**
+     * Exact session-key generation used to produce `encryptedKey`, or the
+     * generation-absent sentinel for a legacy row.
+     */
+    expectedSessionKeyGen: string;
 }

package/node_modules/@quantiya/codevibe-core/dist/types/events.d.ts

@@ -95,6 +95,11 @@ export interface CreateEventInput {
     promptId?: string;
     timestamp?: string;
     isEncrypted?: boolean;
+    ownerToken?: string;
+    producerKind?: string;
+    mobileActionable?: boolean;
+    resolvedPromptId?: string;
+    resolutionAt?: string;
     clientEventId?: string;
     expectedSessionKeyGen?: string;
     encryptionVersion?: number;

package/node_modules/@quantiya/codevibe-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -16,8 +16,8 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "emit-types": "tsc --emitDeclarationOnly",
-    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --packages=external --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && npm run verify-no-test-hooks",
-    "verify-no-test-hooks": "if grep -Elq 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT' dist/index.js dist/orchestration-shell/cli.js; then echo 'ERROR: a CODEVIBE_TEST_FORCE_* test hook leaked into a published bundle (prod-unreachability invariant)'; exit 1; fi; echo 'OK — no test-only hooks in published bundles'",
+    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --minify-syntax --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && npm run verify-no-test-hooks",
+    "verify-no-test-hooks": "if grep -ERl 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT|CODEVIBE_ANCHORED_PUBLICATION_AUTHORITY_ROOT|codevibe-anchored-publications-|cv-publication-authority-vitest-|codevibe\\.test\\.publication-authority-|setPublicationAuthorityRootForTestBuild|__CODEVIBE_TEST_BUILD__' dist; then echo 'ERROR: a test-only hook leaked into a published artifact (prod-unreachability invariant)'; exit 1; fi; echo 'OK — no test-only hooks in published artifacts'",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run build",
     "test": "vitest run",