@quantiya/codevibe-codex-plugin 2.0.48 → 2.0.49

package/node_modules/@quantiya/codevibe-core/dist/local-executor/shadow-recovery.d.ts

@@ -250,6 +250,21 @@ interface RegisteredShadowRoot extends AnchoredFsIdentity {
     canonicalPath?: string;
     birthtimeNs?: string;
 }
+/**
+ * FU-1 — a registered physical-copy root whose pathname is gone and whose bytes could NOT be proven reclaimed.
+ *
+ * Carries the two paths the user needs to act, because the generic surfacing cannot: the implementor-round
+ * classifier returns a closed label and never the raw message, and the durable log projection strips message,
+ * name, code and path. Both are deliberate wire-safety controls (#SR-2), so the recovery instructions travel as
+ * STRUCTURED FIELDS on the error rather than as text the classifier would have to parse or leak. Rendering these
+ * two paths in full — desktop, hosted events and durable diagnostics — is FU1-D2, an owner decision made with the
+ * trade-off stated: they are CodeVibe-registered root paths, never raw error text and never user content.
+ */
+export declare class StaleShadowRootError extends Error {
+    readonly stalePath: string;
+    readonly registryPath: string;
+    constructor(stalePath: string, registryPath: string);
+}
 /**
  * Durable quota-scope registry. Every process sharing `stateRoot` registers its
  * physical shadow root before copying, so the aggregate scan cannot be split by

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.js

@@ -30495,13 +30495,18 @@ async function hasUnreclaimedExposureRetention(stateRoot) {
   }
   return !1;
 }
+var StaleShadowRootError = class extends Error {
+  constructor(stalePath, registryPath) {
+    super("registered physical-copy root disappeared while quota authority is retained"), this.name = "StaleShadowRootError", this.stalePath = stalePath, this.registryPath = registryPath;
+  }
+};
 function isSameRegisteredRootAuthority(prior, current) {
   return prior.dev === current.dev && prior.ino === current.ino && prior.version === current.version && prior.canonicalPath === current.canonicalPath && prior.birthtimeNs === current.birthtimeNs;
 }
 function isSameRootAfterDeviceReincarnation(prior, current) {
   return prior.dev !== current.dev && prior.ino === current.ino && prior.version === current.version && prior.canonicalPath === current.canonicalPath && prior.birthtimeNs === current.birthtimeNs;
 }
-async function collectDurablyReferencedShadowRoots(stateRoot, stateRootAuthority, maxStateMarkerBytes, registeredShadowRoots, afterTaskEntry, afterMarkerEntry, afterMarkerStat, allowUnrecognizedRegularFiles = !1, allowUnregisteredReferences = !1, allowConcurrentSiblingTeardown = !1) {
+async function collectDurablyReferencedShadowRoots(stateRoot, stateRootAuthority, maxStateMarkerBytes, registeredShadowRoots, afterTaskEntry, afterMarkerEntry, afterMarkerStat, allowUnrecognizedRegularFiles = !1, allowUnregisteredReferences = !1, allowConcurrentSiblingTeardown = !1, markerIndex) {
   let retryConcurrentSiblingTeardown = (error, target) => {
     let code = error?.code, message = error instanceof Error ? error.message : String(error), isSiblingChurn = code === "ENOENT" || message.includes("workspace root changed while opening") || message.includes("workspace root cwd identity mismatch") || message.includes("workspace root changed during authority capture") || message.includes("bounded-directory target identity mismatch") || message.includes("bounded-directory parent changed while opening") || message.includes("bounded-directory parent changed while descending") || message.includes("anchored read root authority unavailable") || message.includes("anchored read root identity mismatch") || message.includes("anchored read root incarnation mismatch") || message.includes("anchored read directory chain changed") || message.includes("anchored read directory changed while descending") || message.includes("anchored read cwd identity mismatch") || message.includes("anchored read file identity mismatch") || message.includes("anchored read file changed during read") || message.includes("anchored read file path changed") || message.includes("anchored read file changed after read");
     throw allowConcurrentSiblingTeardown && isSiblingChurn ? new Error(
@@ -30591,7 +30596,7 @@ async function collectDurablyReferencedShadowRoots(stateRoot, stateRootAuthority
           if (allowUnregisteredReferences) continue;
           throw new Error("physical-copy root reference marker names an unregistered root");
         }
-        referenced.add(markerRoot2);
+        referenced.add(markerRoot2), markerIndex && markerIndex.set(markerRoot2, [...markerIndex.get(markerRoot2) ?? [], stateFile]);
         continue;
       }
       let preliminary = value;
@@ -30602,7 +30607,7 @@ async function collectDurablyReferencedShadowRoots(stateRoot, stateRootAuthority
         if (allowUnregisteredReferences) continue;
         throw new Error("physical-copy root exposure marker names an unregistered root");
       }
-      referenced.add(markerRoot);
+      referenced.add(markerRoot), markerIndex && markerIndex.set(markerRoot, [...markerIndex.get(markerRoot) ?? [], stateFile]);
     }
   }
   return referenced;
@@ -30640,7 +30645,7 @@ async function registerAndListQuotaShadowRoots(stateRoot, stateRootIdentity, cur
     else
       throw new Error("physical-copy root changed identity while quota authority is retained");
   if (!priorCurrent && mode === "register-current" && consumeMetadataPath(registryBudget, currentShadowRoot, "physical-copy root registry"), mode === "register-current" && byPath.set(currentShadowRoot, { path: currentShadowRoot, ...currentShadowRootIdentity }), byPath.size > 256) throw new Error("physical-copy root registry exceeds 256 roots");
-  let retained = [], scanBudget = createPathBudget(), referencedShadowRoots = null, hasPhysicalCopyEntry = async (candidate) => {
+  let retained = [], scanBudget = createPathBudget(), referencedShadowRoots = null, vanishedMarkerIndex = null, hasPhysicalCopyEntry = async (candidate) => {
     let liveRoot;
     try {
       liveRoot = await captureWorkspaceRootAuthority(candidate.path);
@@ -30668,7 +30673,79 @@ async function registerAndListQuotaShadowRoots(stateRoot, stateRootIdentity, cur
     afterQuotaReferenceTaskEntry,
     afterQuotaReferenceMarkerEntry,
     afterQuotaReferenceMarkerStat
-  ), !referencedShadowRoots.has(candidate.path));
+  ), !referencedShadowRoots.has(candidate.path)), vanishedRootInodeSurvives = async (candidate) => {
+    let parent = path26.dirname(candidate.path);
+    if (parent === candidate.path) return !0;
+    try {
+      await fs19.lstat(parent);
+    } catch (err) {
+      return err.code !== "ENOENT";
+    }
+    let entries;
+    try {
+      entries = await readDirectoryBounded(
+        parent,
+        scanBudget,
+        "physical-copy root reconcile parent scan",
+        parent,
+        { includeStats: !0 }
+      );
+    } catch {
+      return !0;
+    }
+    for (let entry of entries) {
+      let stat13 = boundedDirectoryStat(entry);
+      if (stat13 && stat13.ino === candidate.ino) return !0;
+    }
+    return !1;
+  }, canRetireVanishedRoot = async (candidate) => {
+    if (await vanishedRootInodeSurvives(candidate)) return !1;
+    let referenced = referencedShadowRoots, markers = vanishedMarkerIndex;
+    if ((referenced === null || markers === null) && (markers = /* @__PURE__ */ new Map(), referenced = await collectDurablyReferencedShadowRoots(
+      stateRoot,
+      stateRootIdentity,
+      maxStateMarkerBytes,
+      new Set(byPath.keys()),
+      afterQuotaReferenceTaskEntry,
+      afterQuotaReferenceMarkerEntry,
+      afterQuotaReferenceMarkerStat,
+      // TOLERANT on purpose. (Stage 1 F4: an earlier version of this comment said "unlike the
+      // retirement-mode call above" — that was wrong, and had been wrong on main too: the retirement-mode
+      // call already passes all three flags true. The scan that stays STRICT is the one behind
+      // `canRetireReincarnatedRoot`.)
+      //
+      // This scan answers one narrow question — is the DEAD root still referenced? — and it runs on a state root
+      // shared by every CodeVibe session and agent on the machine. Strict mode aborts the whole reconcile on
+      // anything unexpected anywhere in that directory, which in practice means: a stray regular file (the
+      // registry's own `.bak` copies — including the ones `codevibe doctor --repair` used to write there before
+      // Stage 1 F5 moved every write it makes to `~/.codevibe/shadow-root-backups/`), a marker naming a
+      // root some other agent never cleaned up (six such directories existed on the dogfood machine), or a
+      // sibling session tearing down concurrently. Any of those would re-wedge the user with
+      // `physical-copy root reference state entry changed type` and no way out — which is exactly what the
+      // real-surface E2E hit.
+      //
+      // Tolerating them cannot lose quota authority: an entry this scan skips is simply not counted as a
+      // reference, and the retirement still requires the root's inode to be proven freed first.
+      !0,
+      // allowUnrecognizedRegularFiles
+      !0,
+      // allowUnregisteredReferences
+      !0,
+      // allowConcurrentSiblingTeardown — surfaces as a retryable enumeration change
+      markers
+    ), referencedShadowRoots = referenced, vanishedMarkerIndex = markers), !referenced.has(candidate.path)) return !0;
+    for (let markerFile of markers.get(candidate.path) ?? []) {
+      await anchoredRemoveFile(markerFile);
+      let taskStateDir = path26.dirname(markerFile);
+      try {
+        await anchoredRemoveEmptyDirectory(taskStateDir, void 0, { expectedParent: stateRootIdentity });
+      } catch (err) {
+        let code = err.code;
+        if (code !== "ENOTEMPTY" && code !== "ENOENT" && code !== "EEXIST") throw err;
+      }
+    }
+    return !0;
+  };
   if (mode === "retire-current-if-unused") {
     let candidate = priorCurrent;
     if (await assertWorkspaceRootAuthority(
@@ -30731,8 +30808,8 @@ async function registerAndListQuotaShadowRoots(stateRoot, stateRootIdentity, cur
       )).some((entry) => entry.isDirectory() && !entry.isSymbolicLink() && (SHADOW_DIR_RE.test(entry.name) || SHADOW_STAGING_DIR_RE.test(entry.name) || SHADOW_TREE_TOMBSTONE_RE.test(entry.name))) ? retained.push(candidate) : reincarnatedDevice !== null && (await canRetireReincarnatedRoot(candidate) || retained.push(candidate));
     } catch (err) {
       if (err.code === "ENOENT") {
-        if (!await canRetireReincarnatedRoot(candidate))
-          throw new Error("registered physical-copy root disappeared while quota authority is retained");
+        if (!await canRetireReincarnatedRoot(candidate) && !await canRetireVanishedRoot(candidate))
+          throw new StaleShadowRootError(candidate.path, registryPath);
         byPath.delete(candidate.path);
         continue;
       }
@@ -52157,6 +52234,8 @@ var AUTHORITY_REFUSAL_LABEL = {
 function classifyImplementorRoundFailure(err) {
   if (err instanceof AuthorityError)
     return AUTHORITY_REFUSAL_LABEL[err.refusal.category] ?? "the implementor was refused authority";
+  if (err instanceof StaleShadowRootError)
+    return `the recorded workspace-copy folder ${err.stalePath} is missing and its contents could not be accounted for (they may have been moved). Run \`codevibe doctor\` to review and clear it`;
   let msg = err instanceof Error ? err.message.toLowerCase() : "";
   return msg.includes("enoent") || msg.includes("spawn") || msg.includes("command not found") || msg.includes("not installed") ? "the coding agent could not be started" : "an unexpected error occurred";
 }
@@ -55236,7 +55315,12 @@ ${section}`);
       }
       logger.warn("[QuorumLoop] implementor round failed", {
         gateId,
-        ...errorShapeOnly(err)
+        ...errorShapeOnly(err),
+        // FU-1 — the ONE exception to the shape-only projection, decided as FU1-D2. These are CodeVibe-registered
+        // root pathnames carried as structured fields, never raw error text and never user content; without them
+        // the log records `messageBytes` and nothing else, and a machine-wide outage is undiagnosable after the
+        // fact (it was, twice, on 2026-09-17).
+        ...err instanceof StaleShadowRootError ? { staleShadowRoot: err.stalePath, shadowRootRegistry: err.registryPath } : {}
       });
       let reason = classifyImplementorRoundFailure(err);
       this.surfaceHalt(`The task could not proceed \u2014 ${reason}.`);

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/doctor-cli.d.ts

@@ -0,0 +1,44 @@
+interface RegisteredRoot {
+    path: string;
+    dev?: string;
+    ino?: string;
+    canonicalPath?: string;
+    birthtimeNs?: string;
+    version?: number;
+}
+/** What the registry says about one root, and what the filesystem says back. */
+export interface RootDiagnosis {
+    root: RegisteredRoot;
+    /** The registered pathname resolves to a directory right now. */
+    present: boolean;
+    /**
+     * The recorded inode was found among the root's siblings — the folder was renamed and its copies still exist,
+     * so the entry is still real quota authority. `undefined` when the parent EXISTS but could not be enumerated,
+     * which is a refusal to guess rather than an answer; a parent that is gone reads `false` (F1-10).
+     */
+    inodeSurvives?: boolean;
+    /** Durable markers that name this root (`dirname(shadowDir)` / `dirname(finalShadowDir)`). */
+    markers: string[];
+    verdict: 'healthy' | 'reconcilable' | 'bytes-may-exist' | 'unknown';
+}
+/** The product's own state root — never a second spelling of it (Stage 1 F7). */
+export declare function shadowStateRoot(): string;
+/** Read the registry. A missing or unreadable registry is reported, never repaired. */
+export declare function readRegistry(stateRoot: string): {
+    roots: RegisteredRoot[];
+    raw: string;
+} | null;
+/** Every durable marker under the state root, mapped to the root it names. */
+export declare function collectMarkers(stateRoot: string): Map<string, string[]>;
+/**
+ * Does the recorded inode still exist among the root's siblings?
+ *
+ * `false` — proven gone, so the entry is reconcilable. `true` — a sibling still holds it, so the bytes are real.
+ * `undefined` — the parent exists but could not be READ, which is a refusal to guess rather than an answer.
+ */
+export declare function inodeSurvivesInParent(root: RegisteredRoot): boolean | undefined;
+export declare function diagnose(stateRoot: string, roots: RegisteredRoot[]): RootDiagnosis[];
+export declare function runDoctorCli(argv: string[], opts?: {
+    stateRoot?: string;
+}): Promise<number>;
+export {};

package/node_modules/@quantiya/codevibe-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.41",
+  "version": "2.0.42",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -18,7 +18,7 @@
     "typecheck": "tsc --noEmit",
     "emit-types": "tsc -p tsconfig.types.json --emitDeclarationOnly",
     "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --minify-syntax --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && esbuild src/orchestration-shell/web/web-extract-worker.ts --bundle --platform=node --target=node18 --minify --packages=external --outfile=dist/orchestration-shell/web-extract-worker.js && npm run verify-no-test-hooks && npm run verify-no-test-types",
-    "verify-no-test-hooks": "if grep -ERl 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT|CODEVIBE_ANCHORED_PUBLICATION_AUTHORITY_ROOT|codevibe-anchored-publications-|cv-publication-authority-vitest-|codevibe\\.test\\.publication-authority-|setPublicationAuthorityRootForTestBuild|__CODEVIBE_TEST_BUILD__|_onBeforeLinkForTesting|_onBeforeSummariesLockForTesting|__codevibe_test_on_before_link|__codevibe_test_on_before_summaries_lock' dist; then echo 'ERROR: a test-only hook leaked into a published artifact (prod-unreachability invariant)'; exit 1; fi; echo 'OK — no test-only hooks in published artifacts'",
+    "verify-no-test-hooks": "if grep -ERl 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT|CODEVIBE_ANCHORED_PUBLICATION_AUTHORITY_ROOT|codevibe-anchored-publications-|cv-publication-authority-vitest-|codevibe\\.test\\.publication-authority-|setPublicationAuthorityRootForTestBuild|__CODEVIBE_TEST_BUILD__|_onBeforeLinkForTesting|_onBeforeSummariesLockForTesting|__codevibe_test_on_before_link|__codevibe_test_on_before_summaries_lock' dist; then echo 'ERROR: a test-only hook leaked into a published artifact (prod-unreachability invariant)'; exit 1; fi; echo 'OK \u2014 no test-only hooks in published artifacts'",
     "verify-no-test-types": "if find dist -type f \\( -path '*/__tests__/*' -o -name '*.test.d.ts' -o -name 'test-publication-authority-setup.d.ts' \\) | grep -q .; then echo 'verify-no-test-types: test declarations present in dist (tsconfig.types.json must exclude test sources)' >&2; exit 1; fi",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run build",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@quantiya/codevibe-codex-plugin",
-  "version": "2.0.48",
-  "description": "Control OpenAI Codex CLI from your iPhone and Android — real-time sync, approve file edits, send prompts by voice. Part of CodeVibe.",
+  "version": "2.0.49",
+  "description": "Control OpenAI Codex CLI from your iPhone and Android \u2014 real-time sync, approve file edits, send prompts by voice. Part of CodeVibe.",
   "main": "dist/server.js",
   "codevibe": {
     "companionLauncher": "./libexec/companion-launcher"
@@ -47,7 +47,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@quantiya/codevibe-core": "^2.0.41",
+    "@quantiya/codevibe-core": "^2.0.42",
     "@quantiya/quorum-core": "^1.0.1",
     "chokidar": "^4.0.0",
     "dotenv": "^16.6.1",