@quantiya/codevibe-claude-plugin 2.0.75 → 2.0.77

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/conductor-reply.d.ts

@@ -0,0 +1,37 @@
+/**
+ * P61 §12.9 (S2-C4, C2-F2) — the conductor turn's text and its advisory
+ * segment boundaries.
+ *
+ * The persisted conductor `turn` joins every non-`localOnly` advisory of the
+ * turn (trimmed, blank-line separated). The join loses each advisory's
+ * boundaries, `source` and `handoffExcluded` flag, which the hand-off
+ * collectors use. `advisorySegments` records them in the item's telemetry —
+ * inside the encrypted envelope and the chain hash, outside the content
+ * address — so a resumed session can rebuild exactly the entries P had.
+ * The text is byte-identical to the join it replaces.
+ */
+export interface AdvisorySegment {
+    /** UTF-16 offsets into `body.text` (JavaScript string indices). */
+    start: number;
+    end: number;
+    source: 'planner' | 'shell';
+    handoffExcluded?: true;
+}
+interface AdvisoryLike {
+    kind: string;
+    text?: string;
+    source?: 'planner' | 'shell';
+    localOnly?: boolean;
+    handoffExcluded?: boolean;
+}
+export declare function buildConductorReply(delta: readonly AdvisoryLike[]): {
+    text: string;
+    segments: AdvisorySegment[];
+};
+/**
+ * Read `advisorySegments` back from a carried conductor turn. Returns null
+ * when the field is absent or does not exactly tile the text, so the caller
+ * applies the conservative per-item legacy rule (§12.4).
+ */
+export declare function parseAdvisorySegments(text: string, telemetry: unknown): AdvisorySegment[] | null;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/context-items.d.ts

@@ -135,6 +135,8 @@ export declare const CONTEXT_ITEM_TTL_SECONDS: number;
 export declare function ensureContextItemsSessionDirectoryDurable(sessionId: string, beforeParentFsync?: (parent: string, child: string) => Promise<void>): Promise<void>;
 /** Exported for the A1f retention sweep (`gcContextItemLogs`). */
 export declare function contextItemsRootDir(): string;
+/** Filesystem-safe per-session dir key (session ids are opaque routing ids). */
+export declare function sessionDirKey(sessionId: string): string;
 /** Exported for tests + diagnostics. */
 export declare function contextItemsLogPath(sessionId: string): string;
 /**
@@ -173,6 +175,15 @@ export declare function getContextItemLog(sessionId: string): {
     readDurableSnapshot: () => Promise<string | null>;
     commitAndVerifyAgentTurnBatch: (humanOccurrence: ContextItemOccurrence, drafts: CanonicalAgentTurnDraft[]) => Promise<ContextDurabilityReceipt>;
 };
+/**
+ * P61 clean-exit tail for the INACTIVE update (design §9.4, §12.7). Reads the
+ * session's log only if this process already holds it — it never creates a
+ * writer — and returns null when there is none or its tail is unknown.
+ */
+export declare function getContextItemLogTail(sessionId: string): {
+    seq: string;
+    itemSha256: string;
+} | null;
 /**
  * Append one typed item to the session's canonical log (the deterministic-
  * emitter write path). Convenience over `getContextItemLog`.
@@ -213,6 +224,59 @@ export interface VerifiedContextItemsResult extends ChainVerificationResult {
     /** The full parsed chain — EMPTY unless `ok === true` (fail-closed). */
     items: ContextItem[];
 }
+/** P61 B-8 — the outcome of a read-only read of a session's local log. */
+export type ReadOnlyContextLogResult = {
+    status: 'ok';
+    items: ContextItem[];
+    /** The chain's end, as the clean-exit `contextTail` would name it; null for an empty log. */
+    tail: {
+        seq: string;
+        itemSha256: string;
+    } | null;
+    /** An uncommitted AGENT_TURN batch was left out in memory (the writer would truncate it). */
+    virtualRollback: boolean;
+} | {
+    status: 'absent';
+} | {
+    status: 'unreadable';
+    /**
+     * `key-unavailable`, `read-error`, `recovery-journal` and
+     * `unsealable-line` (a sealed line that will not unseal while the key is
+     * available — §8.1's "unreadable local log") all fall back to the hosted
+     * copy. `integrity` (every line unseals, the chain does not verify) is
+     * refused with no fallback.
+     */
+    reason: 'read-error' | 'key-unavailable' | 'recovery-journal' | 'unsealable-line' | 'integrity';
+    chainReason?: ChainVerificationResult['reason'];
+};
+/**
+ * P61 B-8 (design §8.1, INV-3) — read a session's local log **without ever
+ * writing**: no writer is created, nothing is flushed, truncated, rotated or
+ * unlinked. A crash-interrupted AGENT_TURN batch is resolved in memory by the
+ * writer's own rule (`recoverAgentTurnTransaction`): a pending journal with
+ * its matching commit keeps the log only at the journaled post-size; without
+ * the commit, only the bytes before the journaled pre-size count. Anything the
+ * writer would block on is `unreadable` here, never guessed.
+ */
+export declare function readContextLogReadOnly(sessionId: string): Promise<ReadOnlyContextLogResult>;
+/**
+ * One context-log line after unsealing: its plaintext JSON and whether it was
+ * a sealed envelope, or `null` when it could not be unsealed.
+ */
+export type ContextLogLineEntry = {
+    json: string;
+    wasEnvelope: boolean;
+} | null;
+/**
+ * P61 §8.1 — the single, PURE chain verifier (extracted unchanged from the
+ * disk reader above). It checks, line by line and in this order: unsealed,
+ * sealed envelope, parseable, REQUIRED shape, session match, `prev_hash`
+ * linkage, strictly increasing `seq`, content address. The first failing line
+ * decides; any failure returns no items. It hashes the plaintext JSON, so it
+ * runs unchanged over decrypted hosted rows (pass `wasEnvelope: true`) and
+ * over a read-only snapshot that never creates a log writer.
+ */
+export declare function verifyContextLogEntries(sessionId: string, entries: ContextLogLineEntry[]): VerifiedContextItemsResult;
 export declare function readVerifiedContextItems(sessionId: string): Promise<VerifiedContextItemsResult>;
 /**
  * §4.2 chain authority (a) — the ON-DEVICE `verify_chain` over decrypted

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/index.d.ts

@@ -24,6 +24,9 @@ import { AdvisoryAttachmentJournal } from './advisory-attachment-journal';
 import type { ImageAttachment } from './types';
 import { type GateDecisionSubmitDeps, type GroupDecisionSubmitDeps } from './gate-decision-submit';
 import { type WorkspaceOutcomeSinkTap } from './workspace-terminal-coordinator';
+import { runShellResumeInShell } from '../session-resume/shell-resume-io';
+import type { ShellResumeOutcome } from '../session-resume/shell-resume';
+import { type RelaunchRequest } from '../session-resume/relaunch';
 export { executeGitStatusSummary } from './git-status-summary';
 import { type ContinuationCliResult, type ContinuationCliDeps } from './slash-routes/continuation';
 import { loadReviewerWizardData } from './slash-routes/reviewers';
@@ -111,6 +114,35 @@ export interface RunOrchestrationShellArgs {
      * teardown `finally` is armed; until then the admitting CLI owns retirement.
      */
     acceptSessionLifecycleOwnership?: () => void;
+    /**
+     * P61 §12.4/§5.4 — present when this shell continues a resumed session S.
+     * The shell seeds the carried exchanges (`RESTORE_CONVERSATION`) under the
+     * §5.4 header before any turn exists, records the carry-over marker's `seq`
+     * for the clean-exit flag, and calls `onStarted` once it owns S's lifecycle
+     * (the resume entry point then releases P's resume lock).
+     */
+    resume?: {
+        restoredItems: import('./context-items').ContextItem[];
+        markerSeq: string;
+        header: {
+            top: string;
+            warnings: string[];
+            bottom: string;
+        };
+        onStarted?: () => void | Promise<void>;
+    };
+    /**
+     * @internal P61 §5.3 — set by `runOrchestrationShell` itself. A `/resume`
+     * switch records P and the lock hand-off token here; teardown marks
+     * `converged` when every phase finished (the same point as the owner
+     * record's finished mark).
+     */
+    resumeSwitch?: {
+        request: RelaunchRequest | null;
+        converged: boolean;
+    };
+    /** @internal Test seam for `/resume` (defaults to the production bindings). */
+    runShellResumeFn?: (opts: Parameters<typeof runShellResumeInShell>[0]) => Promise<ShellResumeOutcome>;
     /** @internal isolated durable advisory-attachment authority for tests. */
     advisoryAttachmentJournal?: AdvisoryAttachmentJournal;
     /**
@@ -376,12 +408,22 @@ export declare function wireTeamMergeAuditSummary(store: OrchestrationStore, tar
     fn?: (summary: any) => void;
     onTeamMergeAuditSummary?: (summary: any) => void;
 }): void;
+/** P61 B-12 — what the shell asks its caller to do after it ends. */
+export interface ShellExitResult {
+    /** A `/resume` switch whose teardown converged: relaunch as `--resume <P>` (§12.6). */
+    relaunch?: RelaunchRequest;
+    /** A `/resume` switch whose teardown did not converge: print the command (§5.3 step 2). */
+    switchFailedFor?: string;
+    /** With `relaunch`: the session C that just ended, named if the child fails (§10). */
+    currentSessionId?: string;
+}
 /**
  * §5 lines 336-365 LOCK + §16 LOCK #14. Single entrypoint that wires
  * the store + emit chokepoint + slash router and either mounts the
- * Ink TUI (TTY) or falls back to line-log (non-TTY).
+ * Ink TUI (TTY) or falls back to line-log (non-TTY). P61 B-12: returns the
+ * relaunch for a `/resume` switch only after a converged teardown.
  */
-export declare function runOrchestrationShell(args: RunOrchestrationShellArgs): Promise<void>;
+export declare function runOrchestrationShell(args: RunOrchestrationShellArgs): Promise<ShellExitResult | undefined>;
 /**
  * PHASE-CP-1-F.1 Part B (LOCK L7) — the bound on the async per-round summary
  * fetch fired AFTER a final-approval prompt is queued. The decision never

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/resume-modal.d.ts

@@ -0,0 +1,19 @@
+/**
+ * P61 §5.2/§5.3 — the in-shell `/resume` picker and §8.4 continue/cancel
+ * choice. A pre-shell launch mounts its own Ink render (`ResumePicker.tsx`);
+ * inside the running shell the same components replace the `<InputBar>`
+ * through store state, and the awaiting `/resume` handler is resolved by the
+ * component's callbacks. One modal per store at a time.
+ */
+import type { PickerRow } from '../session-resume/picker-rows';
+import type { OrchestrationAction } from './types';
+type Dispatch = {
+    dispatch(action: OrchestrationAction): void;
+};
+/** The picker: resolves the chosen session ID, or null on Esc. */
+export declare function pickInShell(store: Dispatch, rows: PickerRow[]): Promise<string | null>;
+/** The §8.4 choice: true for "Continue without …"; Cancel (the default) is false. */
+export declare function chooseInShell(store: Dispatch, prompt: string, continueLabel: string): Promise<boolean>;
+/** Called by the rendered modal (and by teardown, with null): close it and resolve the waiter. */
+export declare function settleResumeModal(store: Dispatch, value: string | boolean | null): void;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/slash-router.d.ts

@@ -41,6 +41,8 @@ export interface SlashCommandInfo {
  */
 export declare const USER_RULE_PIN_PENDING = "PENDING \u2014 entrypoint pins the rule";
 export declare const USER_RULES_LIST_PENDING = "PENDING \u2014 entrypoint lists pinned rules";
+/** P61 §5.3 — the entrypoint resolves the target and runs the switch. */
+export declare const RESUME_PENDING = "PENDING \u2014 entrypoint resumes a session";
 export declare const USER_RULES_FORGET_PENDING = "PENDING \u2014 entrypoint retires a pinned rule";
 /** True if `command` is a shell-exit command (`/quit` / `/exit`). */
 export declare function isExitCommand(command: string): boolean;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/types.d.ts

@@ -339,6 +339,8 @@ export type ConversationEntry = {
      * rewrite needs. Carried into `pending.attachmentPaths` when a clarification mints.
      */
     imagePaths?: string[];
+    /** P61 §12.4 — seeded from a resumed session's carry-over; never part of a turn delta. */
+    restored?: true;
 } | {
     kind: 'planner-decision';
     id: string;
@@ -348,6 +350,8 @@ export type ConversationEntry = {
     rationale: string;
     taskId?: string;
     brainstorm?: BrainstormContextMetadata;
+    /** P61 §12.4 — seeded from a resumed session's carry-over. */
+    restored?: true;
 } | {
     kind: 'subagent-event';
     id: string;
@@ -378,6 +382,11 @@ export type ConversationEntry = {
     final: true;
     command: string;
     output: string;
+    /**
+     * P61 §5.3 — this output ends the shell like `/exit` (a `/resume` switch).
+     * The exit detectors honour it as well as `/exit` and `/quit`.
+     */
+    exit?: true;
 } | {
     kind: 'advisory';
     id: string;
@@ -387,6 +396,8 @@ export type ConversationEntry = {
     text: string;
     localOnly?: true;
     handoffExcluded?: true;
+    /** P61 §12.4 — seeded from a resumed session's carry-over. */
+    restored?: true;
 } | {
     kind: 'gate-prompt';
     id: string;
@@ -559,8 +570,9 @@ export interface PendingPlannerOffer {
  * team (`launchTeamFromWorkItems`), so both paths share the numbering. A team
  * group is one number (its child tasks render `#n.1`, `#n.2` via `state.team`).
  * `retryOf` links a `#n retry` task (P46a C2/C3) to the `apply_failed` original.
- * In-memory only: production has no session resume (design §2.4/A8), so every
- * launch is a new session with its own numbering; nothing is persisted.
+ * In-memory only; nothing is persisted. Every launch is a new session with its
+ * own numbering, and so is a resume: it creates a successor session whose task
+ * numbers restart at #1 (P61 SESSION-RESUME-DESIGN §5.4, §7; amends P46 §2.4/A8).
  */
 export interface TaskOrdinalRecord {
     readonly ordinal: number;
@@ -858,6 +870,13 @@ export interface OrchestrationState {
      * `<OrchestrationApp>` renders `<ImplementorSetupWizard>` in place of `<InputBar>`.
      */
     implementorWizard: ImplementorWizardState | null;
+    /**
+     * P61 §5.2/§5.3 — the in-shell `/resume` picker or §8.4 continue/cancel
+     * choice. While non-null, `<OrchestrationApp>` renders it in place of the
+     * `<InputBar>`. Optional so existing state fixtures stay valid; absent and
+     * null both mean no modal.
+     */
+    resumeModal?: ResumeModalState | null;
     /**
      * `[ADDITIVE WIDENING — O1 C1 (#652)]` per
      * PHASE-O1-C1-SAFETY-OBSERVABILITY-DESIGN.md §3.1 item 1: the shell used to
@@ -981,11 +1000,23 @@ export interface ImplementorWizardState {
  * NEW variant or required field is tagged here before the reducer
  * consumes it.
  */
+export type RestoredConversationEntry = Extract<ConversationEntry, {
+    kind: 'user-message';
+} | {
+    kind: 'advisory';
+} | {
+    kind: 'planner-decision';
+}> & {
+    restored: true;
+};
 export type OrchestrationAction = {
     type: 'USER_INPUT';
     text: string;
     attachments?: ImageAttachment[];
     imagePaths?: string[];
+} | {
+    type: 'RESTORE_CONVERSATION';
+    entries: ReadonlyArray<RestoredConversationEntry>;
 } | {
     type: 'PLANNER_DECISION';
     decision: PlannerDecision;
@@ -1012,6 +1043,7 @@ export type OrchestrationAction = {
     type: 'SLASH_OUTPUT';
     command: string;
     output: string;
+    exit?: true;
 } | {
     type: 'CLARIFICATION_ANSWERED';
     answer: string;
@@ -1168,6 +1200,11 @@ export type OrchestrationAction = {
     wizard: ImplementorWizardState;
 } | {
     type: 'IMPLEMENTOR_WIZARD_CLOSE';
+} | {
+    type: 'RESUME_MODAL_OPEN';
+    modal: ResumeModalState;
+} | {
+    type: 'RESUME_MODAL_CLOSE';
 } | {
     type: 'AUDIT_FLAG_INDEX_RETAINED';
     index: AuditFlagIndex;
@@ -1193,3 +1230,12 @@ export interface LastModeFile {
  * `src/types/auth.ts` already.
  */
 export type Tier = 'FREE' | 'PRO' | 'MAX';
+/** P61 §5.2/§5.3 — what the in-shell `/resume` modal shows. */
+export type ResumeModalState = {
+    kind: 'picker';
+    rows: import('../session-resume/picker-rows').PickerRow[];
+} | {
+    kind: 'choice';
+    prompt: string;
+    continueLabel: string;
+};

package/node_modules/@quantiya/codevibe-core/dist/session/pending-session-create.d.ts

@@ -21,6 +21,37 @@ declare function fingerprintIntent(intent: PendingSessionCreateIntent): string;
 declare function readPending(sessionId: string): Promise<PendingSessionCreateRecord | null>;
 declare function removePending(sessionId: string, record?: PendingSessionCreateRecord): Promise<void>;
 declare function findPendingForIntent(intent: PendingSessionCreateIntent, logger: Logger): Promise<PendingSessionCreateRecord | null>;
+export declare function localSigningFingerprint(publicKeyB64: string): string;
+/**
+ * How the backend resolved a createSession call, relative to the sealed request.
+ *  - `exact`  — the backend admitted THIS sealed create byte-for-byte (it echoed
+ *               our envelopes): our locally-generated key is authoritative.
+ *  - `resume` — §4.9 resume-not-overwrite: a same-owner row already existed and
+ *               the backend returned it verbatim, wrapping a DIFFERENT generation's
+ *               key (K1) than we sealed (K2). The caller reconciles the key from
+ *               the returned encryptedKeys (#229 / #230 Finding 1) and fails closed
+ *               if this device is absent — never caching our local phantom.
+ */
+export type CreateResponseClass = 'exact' | 'resume';
+/**
+ * Classify a backend createSession response against the sealed request, throwing
+ * `SESSION_CREATE_RESPONSE_MISMATCH` for anything that is NEITHER provably our own
+ * sealed create NOR a legitimate same-owner resume-not-overwrite.
+ *
+ * A syntactically valid response is not proof that this exact sealed create was
+ * admitted. Kill-switch sentinels (random `__blocked__` userId), cross-owner rows
+ * (the backend throws `Unauthorized`, but defense-in-depth here too), and
+ * stale/wrong-session responses must remain replayable instead of consuming the
+ * only durable request and caching a key under the wrong identity.
+ *
+ * The fresh-vs-resume signal is `envelopesMatch`. A real resume can NEVER echo our
+ * freshly-generated envelopes (K1 ≠ K2, wrapped anew every create), so:
+ *  - divergent envelopes from the same owner → the resume (accept, `resume`);
+ *  - matching envelopes (our own key) that still diverge on another identity field
+ *    → corruption, not a resume (reject).
+ * §4.5 X3-AMEND-1 / §4.9 (tool-event consolidation #229 / #230 Finding 1).
+ */
+export declare function classifyCreateResponse(session: Session, request: CreateSessionInput): CreateResponseClass;
 /**
  * Persist one exact create envelope before network I/O and replay it unchanged
  * after an ambiguous transport failure or process restart.

package/node_modules/@quantiya/codevibe-core/dist/session-resume/ResumePicker.d.ts

@@ -0,0 +1,21 @@
+/**
+ * P61 §5.2 — the resume picker and the §8.4 continue/cancel choice (Ink).
+ * Callers `await initInkRuntime()` first. Rows come from `toPickerRows`.
+ */
+import * as React from 'react';
+import { type PickerRow } from './picker-rows';
+export declare function ResumePicker(props: {
+    rows: PickerRow[];
+    onSelect: (sessionId: string) => void;
+    onCancel: () => void;
+}): React.ReactElement;
+export declare function ResumeChoice(props: {
+    prompt: string;
+    /** "Continue without them" (default) or, for a missing carry-over, "Continue without it". */
+    continueLabel?: string;
+    onChoose: (continueWithout: boolean) => void;
+}): React.ReactElement;
+/** Mount the picker before the shell; resolves with the chosen ID, or null on Esc. */
+export declare function runResumePicker(rows: PickerRow[]): Promise<string | null>;
+/** Mount the §8.4 choice; resolves true for "Continue without …". */
+export declare function runResumeChoice(prompt: string, continueLabel?: string): Promise<boolean>;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/carry-over.d.ts

@@ -0,0 +1,81 @@
+/**
+ * P61 session resume — select and re-author the carry-over
+ * (SESSION-RESUME-DESIGN.md §7, §8.2, §8.3; DD-2: N = 20).
+ *
+ * Selection is pure over P's VERIFIED items. Re-authoring appends the chosen
+ * items to S's log through the single-writer path in P's seq order, remapping
+ * content-id refs and the one body field that names another item (a rule
+ * retirement's occurrence `seq`), and ends with one `session_resumed` marker.
+ */
+import type { ContextItem, ContextItemDraft } from '../orchestration-shell/context-items';
+export declare const CARRY_OVER_EXCHANGES = 20;
+export declare const CARRY_OVER_MAX_BYTES: number;
+export declare const SESSION_RESUMED_ACTION = "session_resumed";
+/** True when `item` is the carry-over marker of a resume of `fromSessionId` (§8.4 "S's marker"). */
+export declare function isResumeMarkerFor(item: ContextItem, fromSessionId: string): boolean;
+export interface CarryOverPlan {
+    /** P's items to re-author, in P's seq order. */
+    items: ContextItem[];
+    counts: {
+        exchanges: number;
+        droppedExchanges: number;
+        rules: number;
+        openQuestions: number;
+        taskNotes: number;
+    };
+    /** True when the rules, closure and marker alone exceeded the cap (§8.2). */
+    rulesOnly: boolean;
+}
+/**
+ * §8.2 — choose the carry-over from P's verified items.
+ * - Every live rule (readLiveUserRules semantics); never dropped.
+ * - Exchanges: the N most recent human turns, each with every later
+ *   session-scoped turn/decision/open question up to the next human turn
+ *   (rule decisions and earlier markers excluded; they enter only below).
+ * - Rule-retirement closure (S2-C1): every retired rule occurrence whose
+ *   source human turn is carried, with each retirement of a carried occurrence.
+ * - Task notes: task-scoped task_spec/verdict/artifact_ref/decision items of
+ *   tasks first seen inside a carried exchange (display and audit only).
+ * - Excluded: repo_state, rationale, earlier `session_resumed` markers.
+ * - 1 MiB over every carried item as serialized: rules first, then exchange
+ *   groups newest first; the oldest are dropped first (DD-2 loss boundary).
+ */
+export declare function planCarryOver(items: readonly ContextItem[], exchangesWanted?: number, maxBytes?: number): CarryOverPlan;
+export interface ReauthorResult {
+    /** S's items as appended, in order; the last is the marker. */
+    appended: ContextItem[];
+    marker: ContextItem;
+}
+export declare class CarryOverAppendError extends Error {
+    readonly at: number;
+    constructor(at: number);
+}
+/**
+ * §8.3 — append the plan to S's log, in P's seq order, then the marker. Any
+ * null append aborts (durability gate step 1); the caller removes S's
+ * directory by exact path and claims nothing.
+ */
+export declare function reauthorCarryOver(args: {
+    successorSessionId: string;
+    predecessorSessionId: string;
+    plan: CarryOverPlan;
+    sourceComplete: boolean;
+    /**
+     * §8.4 step 2: the plan's items were read from this session (the
+     * predecessor's own predecessor), not from `predecessorSessionId`.
+     */
+    rebuiltFrom?: string;
+    append: (sessionId: string, draft: ContextItemDraft) => Promise<ContextItem | null>;
+}): Promise<ReauthorResult>;
+/** The tail descriptor (`contextTail`) of a context item. */
+export declare function itemTail(item: ContextItem): {
+    seq: string;
+    itemSha256: string;
+};
+/** §8.2: the header line when only standing rules could be carried (P61B-S1-F7). */
+export declare const RULES_ONLY_WARNING = "Only standing rules were restored; the conversation was too large.";
+/**
+ * Whether a carry-over marker records the §8.2 rules-only case: no exchange carried and at least
+ * one dropped (the plan's `rulesOnly`, as the ledger-replay path sees it, from the marker alone).
+ */
+export declare function markerRecordsRulesOnly(marker: ContextItem): boolean;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/clean-exit.d.ts

@@ -0,0 +1,33 @@
+import type { UpdateSessionInput } from '../types/session';
+/** Characters of the last human prompt kept in the picker preview (§9.4). */
+export declare const LAST_PROMPT_PREVIEW_CHARS = 60;
+/** The backend's cap on the preview's ciphertext. */
+export declare const ENCRYPTED_LAST_PROMPT_MAX_BYTES = 1024;
+export type CleanExitFields = Pick<UpdateSessionInput, 'contextTail' | 'contextTailIsResumeMarker' | 'encryptedLastPrompt'>;
+/** Record the session's most recent human turn (called once it is appended). */
+export declare function recordLastHumanPrompt(sessionId: string, text: string): void;
+/**
+ * The `encryptedLastPrompt` for a prompt and a key in hand: a published-then-retired S, whose shell
+ * never ran here (P61B-S1-L12). Same preview rule and cap as the shell's. Never throws.
+ */
+export declare function encryptedPromptPreview(text: string, sessionKey: string): string | undefined;
+/** Record the `seq` of the carry-over marker a resume wrote into this session's log. */
+export declare function recordResumeMarkerSeq(sessionId: string, seq: string): void;
+/**
+ * The fields to add to this session's INACTIVE update, on the ordered
+ * retirement and on the last-ditch one alike. Never throws.
+ */
+export declare function buildCleanExitFields(sessionId: string): Promise<CleanExitFields>;
+/** Fire-and-forget at a resumed shell's start. Read-only (B-8): never initializes or rotates the writer. Never throws. */
+export declare function primeDurableTail(sessionId: string): Promise<void>;
+/** How long a startup-failure retirement waits for the start-time read (P61B-S1-E1). */
+export declare const PRIME_WAIT_MAX_MS = 1000;
+/**
+ * The clean-exit fields for the retirement of a session whose shell failed while starting
+ * (P61B-S1-E1, found by E2E-1 round 2): a resumed S can fail right after its seeding, before the
+ * fire-and-forget `primeDurableTail` read has finished. Waits at most `PRIME_WAIT_MAX_MS` for that
+ * read, then answers as `buildCleanExitFields`. A plain session has no clean-exit state, so it gets
+ * `{}` at once. Never throws.
+ */
+export declare function cleanExitFieldsAfterPrime(sessionId: string, maxWaitMs?: number): Promise<CleanExitFields>;
+export declare function resetCleanExitStateForTests(): void;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/cli-resume.d.ts

@@ -0,0 +1,41 @@
+/**
+ * P61 — the CLI half of `--continue` / `--resume [<id>]` (design §5.1): run the
+ * entry point, then hand S to the shell with its seeding, header and lock
+ * release. Returns an exit code instead when no shell should start.
+ */
+import type { AppSyncClient } from '../appsync/appsync-client';
+import type { Logger } from '../logger';
+import type { Session } from '../types/session';
+import { type ResumeStart } from './resume-entry';
+import type { ResumeEntryPoint } from './resume-target';
+export interface ResumeShellArgs {
+    restoredItems: ResumeStart['restoredItems'];
+    markerSeq: string;
+    header: {
+        top: string;
+        warnings: string[];
+        bottom: string;
+    };
+    onStarted: () => Promise<void>;
+}
+export declare function resumeEntryFromArgs(args: {
+    resume?: {
+        id?: string;
+    };
+    continue?: true;
+}, cwd: string): ResumeEntryPoint | null;
+export declare function startResumedSession(opts: {
+    client: AppSyncClient;
+    entry: ResumeEntryPoint;
+    cwd: string;
+    isTTY: boolean;
+    logger: Logger;
+    ownSessionId?: string;
+}): Promise<{
+    kind: 'exit';
+    code: number;
+} | {
+    kind: 'start';
+    session: Session;
+    shell: ResumeShellArgs;
+}>;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/completeness-copy.d.ts

@@ -0,0 +1,52 @@
+/**
+ * P61 §8.4 completeness decisions and the §8.1 failure copy for P's chosen
+ * source. Pure. `<device>` is P's creator computer as this account names it;
+ * when it is this computer (the resume fell back to the hosted copy here),
+ * the copy follows the §8.1 fallback reason instead.
+ */
+import type { HostedFallbackReason } from './source-choice';
+export type CompletenessKind = 'complete' | 'continues-past-tail' | 'cut-at-tail' | 'short' | 'no-tail' | 'integrity' | 'ambiguous';
+export interface CopyContext {
+    /** P's creator computer as listed for this account, e.g. "MacBook Pro" or "(unknown device)". */
+    deviceLabel: string;
+    /** True when P's creator computer is this one. */
+    deviceIsThisComputer: boolean;
+    /** Why the hosted copy is being read on the computer where P ran (null elsewhere, or for a local read). */
+    fallbackReason: HostedFallbackReason | null;
+}
+export declare const CONTINUE_WITHOUT_THEM = "Continue without them";
+export declare const CONTINUE_WITHOUT_IT = "Continue without it";
+export type ContinueLabel = typeof CONTINUE_WITHOUT_THEM | typeof CONTINUE_WITHOUT_IT;
+export type CompletenessDecision = {
+    kind: 'proceed';
+    warning?: string;
+}
+/** Arrow-key choice; Cancel is the default and a launch without a terminal cancels. */
+ | {
+    kind: 'choose';
+    prompt: string;
+    continueLabel: typeof CONTINUE_WITHOUT_THEM;
+    cancelLabel: 'Cancel';
+} | {
+    kind: 'refuse';
+    text: string;
+};
+export declare const CUT_AT_TAIL_WARNING = "This session's last moments are ambiguous and were left out.";
+export declare const NO_TAIL_WARNING = "This session didn't end cleanly; its last moments may be missing.";
+export declare const INTEGRITY_REFUSAL = "This session's saved context failed its integrity check, so it can't be resumed.";
+export declare const KEYCHAIN_REFUSAL = "This computer's keychain is locked or unavailable. Unlock it and try again.";
+export declare const UNREADABLE_LOCAL_REFUSAL = "This session's saved context on this computer can't be read (it may be damaged, or this computer's CodeVibe identity may have been reset), and its online copy can't be used, so it can't be resumed.";
+/** §8.1: the refusal when the hosted copy itself cannot be used (integrity or ambiguous). */
+export declare function hostedFailureRefusal(kind: 'integrity' | 'ambiguous', ctx: CopyContext): string;
+/**
+ * The "chain ends before contextTail" prompt. Also §8.4 step 2's prompt for a
+ * resumed session's own items when its carry-over is rebuilt from P.
+ */
+export declare function shortPrompt(ctx: CopyContext): string;
+export declare function completenessDecision(kind: CompletenessKind, ctx: CopyContext): CompletenessDecision;
+/**
+ * §8.4 step 3: a resumed session S whose chain lacks its marker, when its
+ * carry-over cannot be rebuilt from P. `ctx` describes S's own copy (S's
+ * computer and S's fallback reason); `<P>` is S's predecessor.
+ */
+export declare function missingCarryOverPrompt(predecessorSessionId: string, ctx: CopyContext): string;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/create-outcome.d.ts

@@ -0,0 +1,43 @@
+/**
+ * P61 session resume — classify a resume create's failure (SESSION-RESUME-DESIGN.md
+ * §10 class table, §12.2.4; Phase B implementation design B-3).
+ *
+ * The plain-launch ledger's definitive-rejection sets are deliberately NOT
+ * reused: they treat `Unauthorized` as definitive (a resume keeps S's
+ * directory and ledger then, because an earlier attempt may have admitted S)
+ * and they miss wire codes the resume path must recognise. AppSync strips a
+ * Lambda error's type, so every class is matched on `errorType` OR the stable
+ * message code that leads the GraphQL error message.
+ */
+export type ResumeRefusalReason = 'NOT_FOUND' | 'NOT_ORCHESTRATION' | 'STILL_ACTIVE' | 'ALREADY_RESUMED' | 'WINDOW_CLOSED';
+export type ResumeCreateOutcome = 
+/** S was never admitted: remove S's prepared directory by exact path, drop the ledger. */
+{
+    kind: 'rejected';
+    cause: 'resume-not-allowed';
+    reason: ResumeRefusalReason;
+    successorSessionId?: string;
+} | {
+    kind: 'rejected';
+    cause: 'limit' | 'rate' | 'account-deletion' | 'session-id-reserved' | 'invalid-status' | 'old-backend' | 'invalid-request' | 'resume-unavailable';
+}
+/** Keep S's directory and the ledger: the outcome is unknown until a definitive answer. */
+ | {
+    kind: 'ambiguous';
+    cause: 'unauthorized' | 'transient';
+}
+/** Keep S's directory, drop the ledger. */
+ | {
+    kind: 'conflict';
+    cause: 'creation-request-conflict';
+}
+/** S WAS admitted and then retired before its shell ran: keep the directory (its only carry-over), drop the ledger. */
+ | {
+    kind: 'admitted-then-retired';
+};
+/** Parse the backend's definitive claim refusal, if this error is one. */
+export declare function parseResumeNotAllowed(error: unknown): {
+    reason: ResumeRefusalReason;
+    successorSessionId?: string;
+} | null;
+export declare function classifyResumeCreateFailure(error: unknown): ResumeCreateOutcome;