@quantiya/codevibe-codex-plugin 2.0.118 → 2.0.119

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.js

@@ -9363,20 +9363,102 @@ var import_node_crypto34, import_json_freeze14, init_class_b_verify = __esm({
   }
 });
 
+// src/substrate/process-group-run.ts
+function runInOwnProcessGroup(argv, opts) {
+  return new Promise((resolve35, reject) => {
+    let child = (0, import_node_child_process12.spawn)(SH, ["-c", GROUP_LEADER_SCRIPT, argv[0], ...argv.slice(1)], {
+      stdio: ["pipe", "pipe", "pipe", "pipe", "pipe"],
+      detached: !0,
+      windowsHide: !0,
+      env: opts.env
+    }), status = child.stdio[3], release = child.stdio[4], stdoutChunks = [], stderrChunks = [];
+    child.stdout?.on("data", (c) => stdoutChunks.push(c)), child.stderr?.on("data", (c) => stderrChunks.push(c));
+    let reported = null, pending2 = "", releaseGroup = () => {
+      try {
+        release?.end();
+      } catch {
+      }
+    };
+    status?.on("data", (c) => {
+      pending2 += c.toString();
+      let at = pending2.indexOf(`
+`);
+      if (at < 0) return;
+      let code = Number(pending2.slice(0, at).trim());
+      reported = Number.isInteger(code) ? code : null, releaseGroup();
+    }), status?.on("error", () => {
+    }), release?.on?.("error", () => {
+    });
+    let exited = !1, timedOut = !1, timer;
+    if (opts.timeoutMs !== void 0 && (timer = setTimeout(() => {
+      if (timedOut = !0, !exited && child.exitCode === null && child.signalCode === null && child.pid !== void 0)
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch {
+        }
+      releaseGroup();
+    }, opts.timeoutMs)), child.on("exit", () => {
+      exited = !0;
+    }), child.on("error", (err) => {
+      timer && clearTimeout(timer), reject(err);
+    }), child.on("close", () => {
+      timer && clearTimeout(timer), resolve35({
+        // No exit status for a timed-out run (as before) or when the leader was ended before it could report.
+        exitCode: timedOut ? null : reported,
+        stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+        stderr: Buffer.concat(stderrChunks).toString("utf8")
+      });
+    }), opts.input !== void 0 && child.stdin)
+      child.stdin.on("error", () => {
+      }), child.stdin.write(opts.input, "utf8", () => {
+        try {
+          child.stdin?.end();
+        } catch {
+        }
+      });
+    else if (child.stdin)
+      try {
+        child.stdin.end();
+      } catch {
+      }
+  });
+}
+var import_node_child_process12, SH, GROUP_LEADER_SCRIPT, init_process_group_run = __esm({
+  "src/substrate/process-group-run.ts"() {
+    "use strict";
+    import_node_child_process12 = require("node:child_process"), SH = "/bin/sh", GROUP_LEADER_SCRIPT = [
+      "exec 5<&0",
+      "( exec 3>&- 5<&- </dev/null; read -r _ <&4; kill -s KILL 0 ) &",
+      '"$0" "$@" <&5 3>&- 4>&- 5<&- &',
+      "c=$!",
+      "exec 5<&- 4>&-",
+      'wait "$c"',
+      "s=$?",
+      "trap '' PIPE",
+      `printf '%s\\n' "$s" >&3 2>/dev/null`,
+      "exec 3>&-",
+      "wait"
+    ].join(`
+`);
+  }
+});
+
 // src/substrate/command-runner.ts
-var import_node_child_process12, ChildProcessCommandRunner, init_command_runner = __esm({
+var import_node_child_process13, ChildProcessCommandRunner, init_command_runner = __esm({
   "src/substrate/command-runner.ts"() {
     "use strict";
-    import_node_child_process12 = require("node:child_process");
+    import_node_child_process13 = require("node:child_process");
     init_env_scrub();
     init_process_tree();
+    init_process_group_run();
     ChildProcessCommandRunner = class {
       run(argv, opts = {}) {
-        return new Promise((resolve35, reject) => {
-          let child = (0, import_node_child_process12.spawn)(argv[0], argv.slice(1), {
+        let env = scrubSearchApiKeys({ ...process.env });
+        return process.platform !== "win32" && opts.timeoutMs !== void 0 ? runInOwnProcessGroup(argv, { ...opts, env }) : new Promise((resolve35, reject) => {
+          let child = (0, import_node_child_process13.spawn)(argv[0], argv.slice(1), {
             stdio: ["pipe", "pipe", "pipe"],
             windowsHide: !0,
-            env: scrubSearchApiKeys({ ...process.env })
+            env
           }), stdoutChunks = [], stderrChunks = [];
           child.stdout?.on("data", (c) => stdoutChunks.push(c)), child.stderr?.on("data", (c) => stderrChunks.push(c));
           let timer;
@@ -9421,7 +9503,7 @@ var import_node_child_process12, ChildProcessCommandRunner, init_command_runner
           workingDirAuthority: opts.cwdAuthority,
           launchPathAuthorities: opts.launchPathAuthorities,
           ...opts.descendantReap ? { descendantReap: opts.descendantReap } : {}
-        }) : (0, import_node_child_process12.spawn)(argv[0], argv.slice(1), spawnOptions), proc = child;
+        }) : (0, import_node_child_process13.spawn)(argv[0], argv.slice(1), spawnOptions), proc = child;
         if (opts.relayChannel) {
           let channel = child.stdio[3];
           if (!channel) throw new Error("spawnLong: the relay channel (fd 3) was not created");
@@ -9593,7 +9675,7 @@ async function executeSpawnSweep(opts) {
       strandedMembers: [],
       recordSha256
     };
-  let timeoutMs = opts.timeoutMs ?? 1e4, readProcStat = opts.readProcStat ?? defaultReadProcStat, spawner = opts.spawnHelper ?? import_node_child_process15.default.spawn, invocationToken = import_node_crypto45.default.randomBytes(8).toString("hex");
+  let timeoutMs = opts.timeoutMs ?? 1e4, readProcStat = opts.readProcStat ?? defaultReadProcStat, spawner = opts.spawnHelper ?? import_node_child_process16.default.spawn, invocationToken = import_node_crypto45.default.randomBytes(8).toString("hex");
   return new Promise((resolve35) => {
     let settled = !1, timer = null, initialStat = null, child;
     try {
@@ -9804,10 +9886,10 @@ async function executeSpawnSweep(opts) {
     });
   });
 }
-var import_node_child_process15, import_node_crypto45, import_node_fs36, import_node_path4, activeSpawnSweeps, init_spawn_sweep = __esm({
+var import_node_child_process16, import_node_crypto45, import_node_fs36, import_node_path4, activeSpawnSweeps, init_spawn_sweep = __esm({
   "src/local-executor/spawn-sweep.ts"() {
     "use strict";
-    import_node_child_process15 = __toESM(require("node:child_process")), import_node_crypto45 = __toESM(require("node:crypto")), import_node_fs36 = __toESM(require("node:fs")), import_node_path4 = __toESM(require("node:path"));
+    import_node_child_process16 = __toESM(require("node:child_process")), import_node_crypto45 = __toESM(require("node:crypto")), import_node_fs36 = __toESM(require("node:fs")), import_node_path4 = __toESM(require("node:path"));
     init_logger2();
     init_spawn_sweep_binary();
     activeSpawnSweeps = /* @__PURE__ */ new Map();
@@ -10153,14 +10235,14 @@ async function collectRepoStates(authority, knownRepos, options = {}) {
   );
   return Promise.all(clamped.map((r) => collectOne(r, gitExec, timeoutMs)));
 }
-var import_node_child_process17, path95, GIT_TIMEOUT_MS, SCRUBBED_ENV, defaultGitExec, init_dirty_state_collector = __esm({
+var import_node_child_process18, path95, GIT_TIMEOUT_MS, SCRUBBED_ENV, defaultGitExec, init_dirty_state_collector = __esm({
   "src/continuation/dirty-state-collector.ts"() {
     "use strict";
-    import_node_child_process17 = require("node:child_process"), path95 = __toESM(require("node:path")), GIT_TIMEOUT_MS = 5e3, SCRUBBED_ENV = (() => {
+    import_node_child_process18 = require("node:child_process"), path95 = __toESM(require("node:path")), GIT_TIMEOUT_MS = 5e3, SCRUBBED_ENV = (() => {
       let out = {};
       return process.env.PATH && (out.PATH = process.env.PATH), process.env.LANG && (out.LANG = process.env.LANG), process.env.LC_ALL && (out.LC_ALL = process.env.LC_ALL), out;
     })(), defaultGitExec = (args, options) => new Promise((resolve35, reject) => {
-      (0, import_node_child_process17.execFile)(
+      (0, import_node_child_process18.execFile)(
         "git",
         args,
         {
@@ -18765,6 +18847,15 @@ var queries = {
     }
   `
   ),
+  // Sign-out: drop this computer's public key so new sessions stop wrapping a key for it (iOS does the same).
+  removeDeviceKey: (
+    /* GraphQL */
+    `
+    mutation RemoveDeviceKey($deviceId: ID!) {
+      removeDeviceKey(deviceId: $deviceId)
+    }
+  `
+  ),
   grantSessionKey: (
     /* GraphQL */
     `
@@ -26983,8 +27074,8 @@ var AppSyncClient = class _AppSyncClient {
   /**
    * List user device keys
    */
-  async listUserDeviceKeys() {
-    return (await this.graphqlRequest(queries.listUserDeviceKeys, {})).data.listUserDeviceKeys || [];
+  async listUserDeviceKeys(options = {}) {
+    return (await this.graphqlRequest(queries.listUserDeviceKeys, {}, !1, void 0, options.expectedUserId)).data.listUserDeviceKeys || [];
   }
   /**
    * CP-1.b IMPL r4 H-2 — list BACKEND_SERVICE device keys per design
@@ -27015,6 +27106,10 @@ var AppSyncClient = class _AppSyncClient {
     let input = { deviceId, publicKey, platform: platform2, deviceName };
     await this.graphqlRequest(mutations.registerDeviceKey, { input }), logger.info("[AppSyncClient] Device key registered", { deviceId, platform: platform2 });
   }
+  /** Sign-out de-registration transport, fenced to `expectedUserId` on every replay (logic: `auth/device-deregistration.ts`). */
+  async removeDeviceKey(deviceId, expectedUserId) {
+    return (await this.graphqlRequest(mutations.removeDeviceKey, { deviceId }, !1, void 0, expectedUserId))?.data?.removeDeviceKey === !0;
+  }
   /**
    * Grant a session key to an additional device by appending a new
    * per-device wrapped key blob to the session's encryptedKeys array.
@@ -32681,7 +32776,7 @@ async function clearRetiredPlannerCache(userId, cacheRoot = process.env.CODEVIBE
 }
 
 // src/orchestration-shell/index.ts
-var path113 = __toESM(require("path")), os55 = __toESM(require("os")), import_promises6 = require("node:fs/promises"), fs93 = __toESM(require("node:fs")), import_node_fs54 = require("node:fs"), import_node_child_process19 = require("node:child_process"), import_node_util3 = require("node:util"), import_node_async_hooks = require("node:async_hooks");
+var path113 = __toESM(require("path")), os55 = __toESM(require("os")), import_promises6 = require("node:fs/promises"), fs93 = __toESM(require("node:fs")), import_node_fs54 = require("node:fs"), import_node_child_process20 = require("node:child_process"), import_node_util3 = require("node:util"), import_node_async_hooks = require("node:async_hooks");
 
 // src/orchestration-shell/web/sanitize.ts
 function sanitizeForTerminal(input) {
@@ -47496,7 +47591,9 @@ var DockerHandle = class {
     try {
       runRes = await this.runner.run(runArgv);
     } catch (e) {
-      throw await this.rollback(sessionDir, forwarder, workdirLease), new SubstrateLaunchError(
+      throw await this.runner.run(buildKillArgv(id5)).catch(() => {
+      }), await this.runner.run(buildRmArgv(id5)).catch(() => {
+      }), await this.rollback(sessionDir, forwarder, workdirLease), new SubstrateLaunchError(
         "docker",
         `container run failed to spawn: ${e.message}`,
         e
@@ -49175,7 +49272,7 @@ var path58 = __toESM(require("node:path"));
 init_anchored_fs();
 
 // src/local-executor/verification-gates/shell-runner.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 init_bounded_output();
 init_process_tree();
 init_workspace_authority();
@@ -49185,7 +49282,7 @@ async function runShellCommand(args) {
   let now = args.nowMs ?? Date.now, startedAt = now();
   if (args.signal?.aborted)
     return { exitCode: -1, stdout: "", stderr: "verification gate aborted", durationMs: 0 };
-  let spawner = args.spawnFn ?? import_node_child_process13.spawn, workingDirAuthority = args.workingDirAuthority;
+  let spawner = args.spawnFn ?? import_node_child_process14.spawn, workingDirAuthority = args.workingDirAuthority;
   if (workingDirAuthority) {
     if (assertWorkspaceRootAuthoritySchema(workingDirAuthority), workingDirAuthority.canonicalPath !== args.cwd)
       throw new Error("verification cwd authority is bound to a different path");
@@ -50771,7 +50868,7 @@ async function listBaselineShards(stateDir, shadowDir) {
 }
 
 // src/local-executor/shadow-volume-probe.ts
-var import_node_child_process14 = require("node:child_process"), import_node_crypto39 = require("node:crypto"), import_node_fs32 = require("node:fs"), fs55 = __toESM(require("node:fs/promises")), path63 = __toESM(require("node:path")), PROBE_ENTRY_RE = /^\.codevibe-probe-[0-9a-f]{32}(?:\.(?:renamed|link))?$/;
+var import_node_child_process15 = require("node:child_process"), import_node_crypto39 = require("node:crypto"), import_node_fs32 = require("node:fs"), fs55 = __toESM(require("node:fs/promises")), path63 = __toESM(require("node:path")), PROBE_ENTRY_RE = /^\.codevibe-probe-[0-9a-f]{32}(?:\.(?:renamed|link))?$/;
 function newProbeEntryName() {
   return `.codevibe-probe-${(0, import_node_crypto39.randomBytes)(16).toString("hex")}`;
 }
@@ -50779,7 +50876,7 @@ async function bootIdentity(platform2 = process.platform) {
   if (platform2 === "linux") return (await fs55.readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
   if (platform2 === "darwin")
     return new Promise((resolve35, reject) => {
-      (0, import_node_child_process14.execFile)("/usr/sbin/sysctl", ["-n", "kern.boottime"], (err, stdout) => {
+      (0, import_node_child_process15.execFile)("/usr/sbin/sysctl", ["-n", "kern.boottime"], (err, stdout) => {
         err ? reject(err) : resolve35(stdout.trim());
       });
     });
@@ -62699,7 +62796,7 @@ var crypto26 = __toESM(require("node:crypto")), fs72 = __toESM(require("node:fs/
 init_logger2();
 
 // src/local-executor/worktree-merge.ts
-var import_node_child_process16 = require("node:child_process"), crypto25 = __toESM(require("node:crypto")), fs71 = __toESM(require("node:fs/promises")), os39 = __toESM(require("node:os")), path85 = __toESM(require("node:path")), import_node_util = require("node:util");
+var import_node_child_process17 = require("node:child_process"), crypto25 = __toESM(require("node:crypto")), fs71 = __toESM(require("node:fs/promises")), os39 = __toESM(require("node:os")), path85 = __toESM(require("node:path")), import_node_util = require("node:util");
 
 // src/local-executor/git-lock-retry.ts
 var realSleep = (ms) => new Promise((resolve35) => setTimeout(resolve35, ms));
@@ -62735,7 +62832,7 @@ function withGitLockRetry(op, opts = {}) {
 // src/local-executor/worktree-merge.ts
 init_env_scrub();
 init_logger2();
-var execFile8 = (0, import_node_util.promisify)(import_node_child_process16.execFile), GIT_MAXBUF = 64 * 1024 * 1024, MERGE_IMPL_ID = "git-host-v1", DETERMINISM_CONTRACT_ID = "ort+histogram+diff3+renames+dirrenames+indent", cachedMergeImplId;
+var execFile8 = (0, import_node_util.promisify)(import_node_child_process17.execFile), GIT_MAXBUF = 64 * 1024 * 1024, MERGE_IMPL_ID = "git-host-v1", DETERMINISM_CONTRACT_ID = "ort+histogram+diff3+renames+dirrenames+indent", cachedMergeImplId;
 async function resolveMergeImplId() {
   if (cachedMergeImplId !== void 0) return cachedMergeImplId;
   try {
@@ -62991,7 +63088,7 @@ async function pinnedGit(repoDir, args, opts = {}) {
 async function pinnedGitWithInput(repoDir, args, input, opts = {}) {
   let configPrefix = [...W2_HERMETIC_CONFIG, ...PINNED_GIT_CONFIG];
   return await new Promise((resolve35, reject) => {
-    let child = (0, import_node_child_process16.spawn)("git", ["-C", repoDir, ...configPrefix, ...args], {
+    let child = (0, import_node_child_process17.spawn)("git", ["-C", repoDir, ...configPrefix, ...args], {
       env: sanitizeGitEnv(),
       stdio: ["pipe", "pipe", "pipe"]
     }), stdout = "", stderr = "", stdoutBytes = 0;
@@ -75544,7 +75641,7 @@ var import_node_crypto55 = require("node:crypto"), import_node_fs47 = require("n
 init_spawn_sweep_binary();
 
 // src/substrate/pasta-isolation-check.ts
-var import_node_child_process18 = require("node:child_process"), import_node_crypto54 = require("node:crypto"), fs82 = __toESM(require("node:fs")), import_node_net2 = __toESM(require("node:net")), path101 = __toESM(require("node:path"));
+var import_node_child_process19 = require("node:child_process"), import_node_crypto54 = require("node:crypto"), fs82 = __toESM(require("node:fs")), import_node_net2 = __toESM(require("node:net")), path101 = __toESM(require("node:path"));
 init_logger2();
 init_pasta();
 function evaluateIsolation(e) {
@@ -75657,7 +75754,7 @@ async function runIsolationCheck(opts = {}) {
       ISOLATION_PROBE_SOURCE,
       JSON.stringify(ports)
     ], stdout = await new Promise((resolve35, reject) => {
-      let child = (0, import_node_child_process18.spawn)(argv[0], argv.slice(1), { stdio: ["ignore", "pipe", "pipe"] }), out = "", err = "", timer = setTimeout(() => {
+      let child = (0, import_node_child_process19.spawn)(argv[0], argv.slice(1), { stdio: ["ignore", "pipe", "pipe"] }), out = "", err = "", timer = setTimeout(() => {
         child.kill("SIGKILL"), reject(new Error("isolation probe timed out"));
       }, opts.timeoutMs ?? 6e4);
       child.stdout.on("data", (d) => {
@@ -96665,7 +96762,7 @@ function resolveBrowseUrls(modelUrls, prompt) {
   let usable = modelUrls.filter(isWellFormedHttpUrl);
   return usable.length > 0 ? usable : void 0;
 }
-var execFileAsync = (0, import_node_util3.promisify)(import_node_child_process19.execFile);
+var execFileAsync = (0, import_node_util3.promisify)(import_node_child_process20.execFile);
 function recordStartedTask(store, result, agent) {
   result.outcome !== void 0 && result.outcome !== "running" || store.dispatch({
     type: "TASK_LIFECYCLE",
@@ -107731,7 +107828,7 @@ async function engageWriteConfinedResolverSandbox(input) {
 }
 
 // src/substrate-launch/le-env-scrub.ts
-var import_node_child_process20 = require("node:child_process"), LE_ENV_SCRUBBED_MARKER = "CODEVIBE_LE_ENV_SCRUBBED", CRED_KEY_PATTERNS = [
+var import_node_child_process21 = require("node:child_process"), LE_ENV_SCRUBBED_MARKER = "CODEVIBE_LE_ENV_SCRUBBED", CRED_KEY_PATTERNS = [
   /^ANTHROPIC_/i,
   /^OPENAI_/i,
   /^GOOGLE_/i,
@@ -107770,7 +107867,7 @@ function scrubLeEnvOrReexec(deps = {}) {
     throw new Error(
       `[le-env-scrub] Refusing to launch the Local Executor: the scrub marker (${LE_ENV_SCRUBBED_MARKER}) is set but credential-shaped env vars are still present (${scrubbedKeys.join(", ")}). A genuine re-exec'd child has NO credential-shaped vars; this indicates a spoofed marker or a broken scrub. Fail closed (CP-7 I1, A5 parent-procargs vector) \u2014 never launch the LE with a vendor credential in its exec-time procargs.`
     );
-  let spawnSyncFn = deps.spawnSyncFn ?? import_node_child_process20.spawnSync, execPath = deps.execPath ?? process.execPath, argv = deps.argv ?? process.argv.slice(1), cwd = deps.cwd ?? process.cwd(), scrubbedEnv = buildScrubbedLeEnv(env);
+  let spawnSyncFn = deps.spawnSyncFn ?? import_node_child_process21.spawnSync, execPath = deps.execPath ?? process.execPath, argv = deps.argv ?? process.argv.slice(1), cwd = deps.cwd ?? process.cwd(), scrubbedEnv = buildScrubbedLeEnv(env);
   try {
     deps.onScrub?.(scrubbedKeys);
   } catch {

package/node_modules/@quantiya/codevibe-core/dist/substrate/process-group-run.d.ts

@@ -0,0 +1,8 @@
+import type { CommandResult } from './types';
+export declare const GROUP_LEADER_SCRIPT: string;
+export interface GroupRunOptions {
+    timeoutMs?: number;
+    input?: string;
+    env: NodeJS.ProcessEnv;
+}
+export declare function runInOwnProcessGroup(argv: string[], opts: GroupRunOptions): Promise<CommandResult>;

package/node_modules/@quantiya/codevibe-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.102",
+  "version": "2.0.103",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-codex-plugin",
-  "version": "2.0.118",
+  "version": "2.0.119",
   "description": "Control OpenAI Codex CLI from your iPhone and Android — real-time sync, approve file edits, send prompts by voice. Part of CodeVibe.",
   "main": "dist/server.js",
   "codevibe": {
@@ -47,7 +47,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@quantiya/codevibe-core": "^2.0.102",
+    "@quantiya/codevibe-core": "^2.0.103",
     "@quantiya/quorum-core": "^1.0.1",
     "chokidar": "^4.0.0",
     "dotenv": "^16.6.1",