@quantiya/codevibe-claude-plugin 2.0.73 → 2.0.75

package/node_modules/@quantiya/codevibe-core/dist/local-model/ollama-gemma-runner.d.ts

@@ -0,0 +1,18 @@
+import { GemmaCallError } from '../planner/gemma-errors';
+import { type GemmaRunner, type RunnerAdvisoryOptions, type RunnerCapabilities, type RunnerClassifyOptions, type RunnerResult } from '../planner/gemma-runner';
+import { type OllamaRuntimeConfig } from './ollama';
+/** Map any failure of a local call to the typed set (§3.2). */
+export declare function toLocalGemmaError(err: unknown, signal?: AbortSignal): GemmaCallError;
+export declare class OllamaGemmaRunner implements GemmaRunner {
+    private readonly config;
+    readonly runtime: "local";
+    readonly label: string;
+    readonly capabilities: RunnerCapabilities;
+    private readonly legacy;
+    constructor(config: OllamaRuntimeConfig);
+    classify(prompt: string, opts: RunnerClassifyOptions): Promise<RunnerResult>;
+    generateAdvisory(prompt: string, opts: RunnerAdvisoryOptions): Promise<RunnerResult>;
+    probe(): Promise<boolean>;
+    warm(): Promise<boolean>;
+    unload(): Promise<boolean>;
+}

package/node_modules/@quantiya/codevibe-core/dist/local-model/ollama.d.ts

@@ -93,6 +93,32 @@ export interface OllamaPullProgress {
 }
 /** Progress sink for {@link requestOllamaPull}. Defaults to a no-op so existing callers/tests are unaffected. */
 export type OllamaPullProgressListener = (progress: OllamaPullProgress) => void;
+/** Raw result of a non-streamed generate (planner parity runner contract, §3.2). */
+export interface OllamaDetailedGeneration {
+    /** The model's text, NOT trimmed and possibly empty (the pipeline decides). */
+    text: string;
+    doneReason?: string;
+    promptEvalCount?: number;
+}
+/** Thrown when the prompt filled the context window (the runner maps it to a context-full error). */
+export declare class OllamaContextWindowFullError extends Error {
+    constructor(message: string);
+}
+/**
+ * Planner parity §3.2 — the non-streamed generate the shared pipeline's local runner uses
+ * for classify: same request body and window check as {@link requestOllamaGenerate}, but it
+ * returns the raw text with `done_reason` (an empty answer is the pipeline's decision, not a
+ * transport error) and honours an abort signal.
+ */
+export declare function requestOllamaGenerateDetailed(config: OllamaRuntimeConfig, promptText: string, opts: {
+    numPredict: number;
+    jsonSchema?: object;
+    formatJson?: boolean;
+    timeoutMs?: number;
+    numCtx?: number;
+    think?: boolean;
+    signal?: AbortSignal;
+}): Promise<OllamaDetailedGeneration>;
 /**
  * Consecutive streamed tokens that render NO visible text before the generation is cut
  * off. Observed 2026-09-12 on gemma4:12b-it-qat / Ollama 0.31.1 at temperature 0: the model

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/attachments.d.ts

@@ -1,4 +1,5 @@
 import type { ImageAttachment } from './types';
+import type { PipelineImage } from '../planner/gemma-pipeline';
 import { type AnchoredCommittedFile } from '../local-executor/anchored-fs';
 import { type WorkspaceRootAuthority } from '../local-executor/workspace-authority';
 import { AdvisoryAttachmentJournal, type AdvisoryAttachmentBatchAuthority, type AdvisoryAttachmentPublicationAuthority } from './advisory-attachment-journal';
@@ -166,8 +167,6 @@ export declare function rewriteAttachmentTokensToRefs(brief: string, attachments
  * two token classes (typed raw-path spans vs `[Image #N]` chips) are disjoint.
  */
 export declare function rewriteChipTokensByNumber(brief: string, orderedPaths: string[], attachments: ImageAttachment[]): string;
-/** Per-model-call total base64-source cap (§6): base64 inflates ~33%; distinct from the 10 MB per-file copy cap. */
-export declare const MAX_BASE64_SOURCE_BYTES: number;
 /**
  * The SECURITY-boundary read (§4/§6/§7.3): open the LEXICAL absolute path with
  * `O_RDONLY | O_NOFOLLOW` (refuses if the final component is a symlink — defeats a
@@ -182,19 +181,14 @@ export declare function readImageFdSafe(sourcePath: string, maxBytes?: number):
     mime: string;
 };
 /**
- * Shell-layer helper (§6): read the attachments fd-safe and return RAW base64
- * (NO `data:` prefix — Ollama's `images[]` wants raw base64) for the LOCAL model,
- * under a per-call total-source-bytes cap + a count cap (first-N-under-cap). Any
- * attachment that fails the fd-safe read is returned in `failed` — callers
- * proceed text-only with a content-free advisory, never block/throw.
+ * Shell-layer helper (§6, planner parity §3.7): the turn's attachments as pipeline images.
+ * Each is read fd-safe (`readImageFdSafe`) only when a call selects images; a read that
+ * fails makes that image "unreadable" (the shared note names it) and never blocks the call.
+ * Selection — attachment order, first-N-under-cap, formats — is the pipeline's, per attempt,
+ * under the routed runtime's capability (`selectImagesForCapability`; local reads 8 images
+ * up to 8 MiB per call in PNG/JPEG/GIF/BMP, hosted 8 up to 2,400,000 B and also WEBP).
  */
-export declare function attachmentsToBase64(attachments: ImageAttachment[], opts?: {
-    maxTotalBytes?: number;
-    maxCount?: number;
-}): {
-    images: string[];
-    failed: ImageAttachment[];
-};
+export declare function attachmentsToPipelineImages(attachments: ImageAttachment[]): PipelineImage[];
 /**
  * Detects whether a clarifying question emitted on an image attachment turn is a blind deflection
  * caused by a text-only classifier's inability to see/inspect images (e.g. asking the user to

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.d.ts

@@ -5,7 +5,9 @@ import { type ModeSelectionDeps } from './mode-selection';
 import { type RunOrchestrationShellArgs } from './index';
 import { type ShellEventEmit, type ShellEventEmitResult } from './emit-shell-event';
 import { type ShadowEnv } from '../local-executor/workspace-shadow';
-import { BackendPlannerClient, PlannerCacheLayer, PlannerHealthMachine, HostedGemmaAdvisoryRunner, type AdvisoryRunner, type LocalGemmaAdvisoryRunner, type LocalGemmaPlannerRunner } from '../planner';
+import { GemmaCallPipeline } from '../planner/gemma-pipeline';
+import { HostedGemmaRunner } from '../planner/hosted-gemma-runner';
+import { OllamaGemmaRunner } from '../local-model/ollama-gemma-runner';
 import type { PlannerAdapter, PlannerInput, PlannerDecision, PlannerProbeResult } from '../planner/adapter';
 import { keychainManager } from '../keychain';
 export { keychainManager };
@@ -18,7 +20,7 @@ import type { WorkspaceOutcomeSinkTap } from './workspace-terminal-coordinator';
 import type { GroupDecisionSubmitDeps } from './gate-decision-submit';
 import { QuorumLoop, type ReviewerSafetyNoticeSink } from './quorum-loop';
 import type { TaskProgressEvent } from './task-progress';
-import { type VerdictClassifier } from '../reviewer/verdict-classifier';
+import { type VerdictClassifier, type VerdictGemmaPort } from '../reviewer/verdict-classifier';
 import { type LocalModelArtifactConfig, type LocalModelCommand, type LocalModelEntitlement, type LocalModelStore } from '../local-model/manager';
 import { type LocalModelState } from '../local-model/state';
 /**
@@ -30,10 +32,9 @@ export declare class PlannerUnavailableError extends Error {
     constructor(msg: string);
 }
 /**
- * Local-LLM planner placeholder for the Gemma QAT migration slice. This adapter
- * is intentionally local-only: it never calls AppSync planner mutations or any
- * hosted fallback. Until the verified Gemma runner is wired, natural-language
- * planning requests fail closed with an actionable shell message.
+ * The planner when the session has NO model source (Free tier without a usable local
+ * model, D-9 included): it never calls AppSync planner mutations or any hosted model, and
+ * natural-language planning requests fail closed with an actionable shell message.
  */
 export declare class LocalModelPlannerUnavailableAdapter implements PlannerAdapter {
     private readonly reason;
@@ -202,18 +203,13 @@ export declare function checkImplementorCredentialNotice(args?: {
     platform?: string;
 }): Promise<string | null>;
 export interface LocalGemmaPlannerBuildResult {
-    adapter: PlannerAdapter;
-    advisoryRunner: LocalGemmaAdvisoryRunner | null;
     /**
-     * REVIEWER-VERDICT-GEMMA-CLASSIFIER-DESIGN.md (§Wiring) — the SAME resolved
-     * Gemma runner instance as {@link advisoryRunner} (both `null` on the unavailable
-     * path), exposed with the wider `LocalGemmaPlannerRunner` type (it carries
-     * `classify`, which the verdict classifier needs; `advisoryRunner` keeps the
-     * stricter `LocalGemmaAdvisoryRunner` type its consumer requires). One instance ⇒
-     * a SINGLE availability source for both the planner and the verdict classifier —
-     * they can never disagree about whether Gemma is up.
+     * The local Gemma transport (planner parity §3.1), or `null` when the local model is
+     * unavailable — `reason` then says why. One instance per session: `resolvePlannerAdapter`
+     * puts it in the session's runner source, which serves the planner, every advisory call
+     * and the reviewer-verdict classifier, so they never disagree about whether Gemma is up.
      */
-    classifyRunner: LocalGemmaPlannerRunner | null;
+    runner: OllamaGemmaRunner | null;
     runtimeKind: NonNullable<RunOrchestrationShellArgs['plannerRuntimeKind']>;
     /**
      * TUI redesign (2026-06-29) — display label for the status-bar planner badge
@@ -253,60 +249,49 @@ export declare function runAuditCli(parsed: ParsedAuditArgs, deps?: {
 }): Promise<number>;
 export declare function main(argv: string[]): Promise<number>;
 /**
- * CP-1.b IMPL r4 H-1 — Production planner stack factory.
- *
- * Builds the full BackendPlannerClient + PlannerCacheLayer +
- * PlannerHealthMachine chain so the orchestration shell can call
- * `plannerAdapter.classify()` on natural-language input.
+ * Planner parity §3.1 — the HOSTED Gemma transport over this session's AppSync client:
+ * the client-rendered planner-proxy paths, encrypted under the session key, which it
+ * resolves through `keychainManager.getSessionKey` (as the retired hosted advisory runner
+ * did). The pipeline's `setActiveSession` binds it to the session.
  *
- * Co-located with the CLI bootstrap (NOT inside `runOrchestrationShell`)
- * because the shell accepts an injected adapter for tests; the
- * production bootstrap site is the single canonical instantiation
- * point.
- *
- * Exported for unit tests; production callers go through `main()`.
+ * Exported for unit tests; production callers go through `resolvePlannerAdapter`.
  */
-export interface ProductionPlannerStackResult {
-    adapter: BackendPlannerClient;
-    cache: PlannerCacheLayer;
-    health: PlannerHealthMachine;
-    hostedAdvisoryRunner: HostedGemmaAdvisoryRunner;
-}
-export declare function buildProductionPlannerStack(appsyncClient: AppSyncClient, emitter: (args: ShellEventEmit) => Promise<unknown>): ProductionPlannerStackResult;
+export declare function buildHostedGemmaRunner(appsyncClient: AppSyncClient): HostedGemmaRunner;
 export interface ResolvePlannerAdapterArgs {
     localPlanner: LocalGemmaPlannerBuildResult;
     tier: Tier;
     appsyncClient: AppSyncClient;
-    emitter: (args: ShellEventEmit) => Promise<unknown>;
     env?: NodeJS.ProcessEnv;
-    buildHostedStack?: (appsyncClient: AppSyncClient, emitter: (args: ShellEventEmit) => Promise<unknown>) => ProductionPlannerStackResult;
+    /** Test seam. */
+    buildHostedRunner?: (appsyncClient: AppSyncClient) => HostedGemmaRunner;
 }
 export interface ResolvedPlannerResult {
     adapter: PlannerAdapter;
+    /**
+     * The session's Gemma pipeline — the ONLY caller of a runner (§3.1). It serves the
+     * planner (through `adapter`), every advisory call and the reviewer-verdict classifier.
+     * `null` when the session has no model source.
+     */
+    pipeline: GemmaCallPipeline | null;
+    /** The status badge's initial state (display only). */
     runtimeKind: NonNullable<RunOrchestrationShellArgs['plannerRuntimeKind']>;
     runtimeLabel: string;
-    advisoryRunner: AdvisoryRunner | null;
-    classifyRunner: LocalGemmaPlannerRunner | null;
-    cache: PlannerCacheLayer | null;
-    health: PlannerHealthMachine | null;
-    source: 'local' | 'hosted' | 'local_unavailable';
+    source: 'composite' | 'local' | 'hosted' | 'local_unavailable';
 }
 /**
- * Resolves the active planner adapter for the orchestration shell session.
+ * Resolves the session's runner source (planner parity §3.1):
+ *
+ * | Tier    | Local available | Source                  |
+ * |---------|-----------------|-------------------------|
+ * | Pro/Max | yes             | composite (local first) |
+ * | Pro/Max | no              | hosted runner alone     |
+ * | Free    | yes             | local runner alone      |
+ * | Free    | no              | none (unavailable)      |
  *
- * Precedence & Invariants:
- * 1. Forced hosted mode (`CODEVIBE_FORCE_HOSTED_PLANNER=1` or `CODEVIBE_PLANNER_PROVIDER=hosted`):
- *    - Allowed for PRO and MAX tiers. Returns the production hosted Bedrock planner stack and hosted advisory runner.
- *    - Disallowed for FREE tier (preserves $0 marginal cost invariant). Falls back to local adapter.
- * 2. Local-first preference:
- *    - When local Gemma is enabled and operational (`!localPlanner.reason`), returns the composite adapter
- *      and composite advisory runner for PRO/MAX (local-first with seamless hosted Bedrock fallback).
- *      Returns local adapter/runner for FREE tier.
- * 3. Unavailable fallback:
- *    - When local Gemma is unavailable (`localPlanner.reason` is truthy):
- *      - PRO / MAX: Falls back to the hosted Bedrock planner stack (`hosted`) and hosted advisory runner.
- *      - FREE: Retains the local unavailable adapter (`local_unavailable`), strictly preventing
- *        cloud inference costs.
+ * `CODEVIBE_FORCE_HOSTED_PLANNER=1` / `CODEVIBE_PLANNER_PROVIDER=hosted` select the
+ * hosted runner alone ONLY for Pro/Max; a Free session keeps the table and never sends a
+ * hosted request. One pipeline over the source serves the planner, every advisory call
+ * and the verdict classifier, so they all see the same runtime at the same moment.
  */
 export declare function resolvePlannerAdapter(args: ResolvePlannerAdapterArgs): ResolvedPlannerResult;
 export interface BuildTeamLocalExecutorResult {
@@ -410,7 +395,7 @@ export interface DispatchContextTap {
     }) => Promise<string>;
 }
 /** Same canonical reporter as implementors, without changing the reviewer's
- * advisory policy. Local echo precedes the network; V2 never sends the reason
+ * advisory policy. Local echo precedes the network; canonical reports never send the reason
  * text as an ordinary Event. The loop catches failure and still tears down. */
 export declare function makeReviewerSafetyNoticeSink(appsyncClient: AppSyncClient, session: Session, localNotice: (message: string) => void, legacyEmitter: LEEmitShellEventFn): ReviewerSafetyNoticeSink;
 export declare function makeStrictBadgeSink(appsyncClient: AppSyncClient, session: Session, legacyEmitter: LEEmitShellEventFn): StrictBadgeSink;
@@ -420,16 +405,17 @@ export declare function makeStrictBadgeSink(appsyncClient: AppSyncClient, sessio
  *
  *  - `classifyRunner === undefined` → the classifier is NOT wired (unit tests /
  *    the canned-prompt legacy paths the design leaves on regex) → `undefined`
- *    (the provider uses `parseVerdictOutput`). Production ALWAYS wires it (a
- *    `LocalGemmaPlannerRunner | null`), so this branch never fires in production.
+ *    (the provider uses `parseVerdictOutput`). Production ALWAYS wires it (the
+ *    session's Gemma pipeline or `null`), so this branch never fires in production.
  *  - `CODEVIBE_REVIEWER_VERDICT_CLASSIFIER=regex` → `undefined` (the ONLY operator
  *    revert to the regex parser). Any other value (incl. a typo) stays `gemma` so
  *    a mistyped flag can NEVER silently disable the fail-closed classifier.
- *  - `gemma` (default) → the real fail-closed Gemma classifier when the runner is
- *    present; a dummy always-ESCALATE classifier when it is `null` (Ollama
- *    unreachable at boot) — NEVER a silent regex fallback (agy-MED-1).
+ *  - `gemma` (default) → the real fail-closed Gemma classifier over the session's
+ *    pipeline (parity D-11: the same source as the planner, so it fails over with
+ *    it); a dummy always-ESCALATE classifier when it is `null` (no model source at
+ *    boot) — NEVER a silent regex fallback (agy-MED-1).
  */
-export declare function resolveVerdictClassifier(classifyRunner: LocalGemmaPlannerRunner | null | undefined, env?: NodeJS.ProcessEnv): VerdictClassifier | undefined;
+export declare function resolveVerdictClassifier(classifyRunner: VerdictGemmaPort | null | undefined, env?: NodeJS.ProcessEnv): VerdictClassifier | undefined;
 export interface BuildQuorumLoopExecutorResult {
     localExecutor: LocalExecutor;
     quorumLoop: QuorumLoop;
@@ -486,7 +472,7 @@ export declare function buildQuorumLoopExecutor(args: {
      * planner's), forwarded to `buildAndArmQuorumLoop` where the verdict classifier is
      * built. ABSENT (tests) → the classifier is not wired → regex parser.
      */
-    classifyRunner?: LocalGemmaPlannerRunner | null;
+    classifyRunner?: VerdictGemmaPort | null;
 }): Promise<BuildQuorumLoopExecutorResult>;
 /**
  * Single-task LE emit → wire shape. Exported for tests.
@@ -529,7 +515,7 @@ export declare function buildTeamLocalExecutor(args: {
      * planner's), forwarded to `buildAndArmQuorumLoop` where the verdict classifier is
      * built. ABSENT (tests) → the classifier is not wired → regex parser.
      */
-    classifyRunner?: LocalGemmaPlannerRunner | null;
+    classifyRunner?: VerdictGemmaPort | null;
     /** P36: Task-completion audit summary local store callback. */
     onTaskAuditSummary?: (summary: TaskAuditSummaryModel, markdown: string) => void;
     /** P36: Aggregate team merge audit summary callback. */