@quantiya/codevibe-codex-plugin 2.0.51 → 2.0.53

package/node_modules/@quantiya/codevibe-core/dist/local-executor/anchored-fs.d.ts

@@ -1,5 +1,6 @@
 import { type WorkspaceRootAuthority } from './workspace-authority.js';
 type PublicationPrivateRetirementStage = 'disposed-publish' | 'commit-rename' | 'commit-unlink' | 'commit-sync' | 'pending-rename' | 'pending-unlink' | 'pending-sync' | 'retiring-rename' | 'retiring-unlink' | 'retiring-sync' | 'disposed-rename' | 'disposed-unlink' | 'disposed-sync';
+export declare function invalidatePublicationAuthorityStoreCache(): void;
 export interface AnchoredPublicationAuthorityResidue {
     recordName: string;
     authorityId: string;
@@ -100,6 +101,7 @@ export declare function anchoredReadFileWithinRoot(root: string, relativePath: s
     helperTimeoutMs?: number;
     testHangBeforeRead?: boolean;
     testHangStage?: 'open' | 'read' | 'close';
+    signal?: AbortSignal;
 }): Promise<AnchoredReadFile | null>;
 /** Stream and hash one bounded file entirely in the deadline helper. */
 export declare function anchoredHashFileWithinRoot(root: string, relativePath: string, opts: {
@@ -110,6 +112,7 @@ export declare function anchoredHashFileWithinRoot(root: string, relativePath: s
     afterRead?: () => Promise<void> | void;
     helperTimeoutMs?: number;
     testHangStage?: 'open' | 'read' | 'close';
+    signal?: AbortSignal;
 }): Promise<AnchoredHashedFile | null>;
 export type AnchoredWritePrecondition = {
     kind: 'absent';
@@ -130,6 +133,7 @@ export declare function captureAnchoredIdentity(target: string, opts?: {
     expectedParent?: AnchoredFsIdentity | WorkspaceRootAuthority;
     /** @internal after missing child, before public-parent re-authentication. */
     beforeAbsent?: () => Promise<void> | void;
+    signal?: AbortSignal;
 }): Promise<AnchoredPathIdentity>;
 /** Create or reopen one real direct-child directory under an exact parent. */
 export declare function anchoredEnsureDirectory(parent: WorkspaceRootAuthority, name: string, mode?: number): Promise<WorkspaceRootAuthority>;
@@ -145,7 +149,10 @@ export interface AnchoredEnsuredDirectory {
 export declare function anchoredEnsureDirectoryWithOwnership(parent: WorkspaceRootAuthority, name: string, mode?: number): Promise<AnchoredEnsuredDirectory>;
 /** Create one new direct-child directory without adopting a pre-existing name. */
 export declare function anchoredCreateDirectory(parent: WorkspaceRootAuthority, name: string, mode?: number): Promise<WorkspaceRootAuthority>;
-export declare function captureAnchoredWritePrecondition(filePath: string, maxBytes: number, afterStat?: () => Promise<void> | void, expectedParent?: AnchoredFsIdentity | WorkspaceRootAuthority): Promise<AnchoredWritePrecondition>;
+export declare function captureAnchoredWritePrecondition(filePath: string, maxBytes: number, afterStat?: () => Promise<void> | void, expectedParent?: AnchoredFsIdentity | WorkspaceRootAuthority, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<AnchoredWritePrecondition>;
 export declare function anchoredAtomicWrite(filePath: string, data: string | Buffer, opts: {
     expected: AnchoredWritePrecondition;
     mode?: number;
@@ -191,6 +198,7 @@ export declare function anchoredAtomicWrite(filePath: string, data: string | Buf
     helperTimeoutMs?: number;
     /** @internal deterministic blocked-helper seam. */
     testHangBeforeReady?: boolean;
+    signal?: AbortSignal;
 }): Promise<AnchoredCommittedFile>;
 /**
  * Hold one crash-reclaimable, inode-anchored cross-process lock for the full
@@ -218,6 +226,8 @@ export declare function anchoredRemoveTree(target: string, identity: WorkspaceRo
     afterRename?: (tombstonePath: string) => Promise<void> | void;
     /** @internal lower deterministic helper/tree-cleaner deadline for tests. */
     helperTimeoutMs?: number;
+    /** Optional cancellation signal to bound helper execution. */
+    signal?: AbortSignal;
     /** @internal deterministic blocked-helper seam. */
     testHangBeforeReady?: boolean;
     /** @internal deterministic blocked recursive tree-cleaner seam. */
@@ -228,12 +238,15 @@ export declare function anchoredRemoveFile(filePath: string, expectedIdentity?:
     expectedParent?: AnchoredFsIdentity | WorkspaceRootAuthority;
     /** @internal deterministic post-unlink directory-fsync failure seam. */
     failDirectorySync?: boolean;
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
 }): Promise<void>;
 /** Reclaim dead helper temp/lock/release/token residue for one anchored marker path. */
 export declare function anchoredCleanupWriteArtifacts(filePath: string, opts?: {
     waitForLive?: boolean;
     beforeFinalRemove?: (quarantinePath: string) => Promise<void> | void;
     helperTimeoutMs?: number;
+    signal?: AbortSignal;
     /** Exact parent directory that must own every recovered artifact. */
     expectedParent?: AnchoredFsIdentity | WorkspaceRootAuthority;
     /** @internal deterministic restart-disposition race seam. */
@@ -246,5 +259,11 @@ export declare function anchoredCleanupWriteArtifacts(filePath: string, opts?: {
 export declare function anchoredRemoveEmptyDirectory(dir: string, expectedIdentity?: AnchoredFsIdentity, opts?: {
     /** Exact parent directory that must own the retiring child. */
     expectedParent?: AnchoredFsIdentity | WorkspaceRootAuthority;
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
 }): Promise<void>;
+export declare function withWriteLock<T>(filePath: string, operation: () => Promise<T>, opts?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<T>;
 export {};

package/node_modules/@quantiya/codevibe-core/dist/local-executor/bounded-directory.d.ts

@@ -43,24 +43,13 @@ export interface BoundedDirectoryStat {
 }
 /** Metadata captured in the same isolated enumeration request, when requested. */
 export declare function boundedDirectoryStat(entry: Dirent): BoundedDirectoryStat | undefined;
-/**
- * Enumerate a directory in an isolated process group. The helper's absolute
- * deadline is armed before its first target-filesystem access, so a blocked
- * FUSE/network open, read, or close cannot retain a desktop lifecycle lock.
- * Entries are streamed and charged in the desktop before being retained.
- */
 export declare function readDirectoryBounded(dirPath: string, budget: MetadataBudget, label: string, relativePrefix?: string, opts?: {
-    /** @internal lower deterministic helper deadline for tests. */
     helperTimeoutMs?: number;
-    /** @internal deterministic target-filesystem stall seam. */
+    signal?: AbortSignal;
     testHangStage?: 'open' | 'read' | 'stat' | 'close';
-    /** Capture lstat metadata inside the same deadline-bound worker request. */
     includeStats?: boolean;
-    /** @internal deterministic seam after a missing component, before acknowledgement. */
     beforeMissing?: () => Promise<void> | void;
-    /** @internal deterministic seam before final public-chain authentication. */
     beforeCompletion?: () => Promise<void> | void;
-    /** Exact directory inode that must own the enumeration. */
     expectedDirectory?: {
         dev: string;
         ino: string;
@@ -71,8 +60,6 @@ export declare function readDirectoryBounded(dirPath: string, budget: MetadataBu
         ctimeNs?: string;
         nlink?: string;
     };
-    /** Persisted root authority used to enter the complete relative chain. */
     rootAuthority?: WorkspaceRootAuthority;
-    /** Directory path relative to `rootAuthority` (empty means the root). */
     relativeDirectory?: string;
 }): Promise<Dirent[]>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/bounded-helper.d.ts

@@ -12,7 +12,7 @@ export declare function helperDeadlineEnv(timeoutMs: number): Record<string, str
 /** Spawn every top-level helper in its own POSIX process group. */
 export declare function spawnIsolatedHelper(command: string, args: readonly string[], options: SpawnOptions): ChildProcess;
 export declare function observeChildClose(child: ChildProcess): Promise<number | null>;
-export declare function withHelperDeadline<T>(work: Promise<T>, timeoutMs: number, label: string): Promise<T>;
+export declare function withHelperDeadline<T>(work: Promise<T>, timeoutMs: number, label: string, signal?: AbortSignal): Promise<T>;
 /**
  * Best-effort full-tree termination with a hard upper bound on cleanup wait.
  * POSIX helpers are isolated process-group leaders. Windows uses taskkill's

package/node_modules/@quantiya/codevibe-core/dist/local-executor/durable-directory.d.ts

@@ -6,10 +6,6 @@ export interface DurableDirectoryIdentity {
     mtimeMs: number;
     created: boolean;
 }
-/**
- * Create/validate a directory tree and seal every acknowledged target with
- * child-then-parent fsync inside a killable, deadline-bound helper.
- */
 export declare function ensureDurableDirectoryTree(target: string, opts?: {
     /** Existing durable ancestor; every controlled descendant is resealed on every retry. */
     anchorPath?: string;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/process-tree.d.ts

@@ -24,6 +24,8 @@ export declare function spawnPosixOwnedProcess(command: string, args: readonly s
     /** @internal deterministic directory-durability failure seam. */
     syncOwnerDirectory?: (dir: string, file: string) => Promise<void>;
 }): ChildProcess;
+export declare function processOwnerRoot(): string;
+export declare function ensureProcessOwnerRoot(): Promise<WorkspaceRootAuthority>;
 /** Original-handle status channel; missing/malformed status fails closed. */
 export declare function processHostCleanupStatus(child: ChildProcess, ownership: ProcessTreeOwnership): Promise<boolean>;
 /** Durable target-group identity emitted before the supervised command settles. */
@@ -70,10 +72,13 @@ export interface ProcessCleanupOwner {
     /** OS-native process incarnation, not reusable with the numeric PID/PGID. */
     incarnationId: string;
 }
+export declare function validateProcessCleanupOwner(value: ProcessCleanupOwner): void;
 /** Restart/session-start sweep for owners durably published before user code ran. */
 export declare function reapDurableProcessOwners(opts?: {
     /** @internal isolated registry root for tests. */
     rootDir?: string;
+    /** Optional cancellation signal to bound sweep execution. */
+    signal?: AbortSignal;
     /** @internal deterministic same-inode growth seam. */
     afterOwnerStat?: (file: string) => Promise<void> | void;
     /** @internal lower deterministic helper deadline for tests. */
@@ -88,6 +93,8 @@ export declare function reapDurableProcessOwners(opts?: {
     reaped: number;
     retained: number;
 }>;
+export declare function validateDesktopProcessIdentity(value: ProcessIdentity | undefined): asserts value is ProcessIdentity;
+export declare function legacyOwnerRecordIsDefinitelyRetired(owner: ProcessCleanupOwner): Promise<boolean>;
 export declare class ProcessTreeTerminationError extends Error {
     constructor(message: string);
 }
@@ -112,6 +119,7 @@ export declare function terminateOwnedProcessTree(args: {
     ownership: ProcessTreeOwnership;
     directKill: () => void;
     timeoutMs?: number;
+    signal?: AbortSignal;
     /** @internal deterministic POSIX signal seam. */
     processKill?: ProcessKill;
     /** @internal deterministic POSIX wait seam. */
@@ -127,5 +135,6 @@ export declare function retryProcessCleanupOwner(owner: ProcessCleanupOwner, sea
     readProcessIncarnation?: ReadProcessIncarnation;
     sleep?: (ms: number) => Promise<void>;
     timeoutMs?: number;
+    signal?: AbortSignal;
 }): Promise<void>;
 export {};

package/node_modules/@quantiya/codevibe-core/dist/local-executor/shadow-protocol.d.ts

@@ -218,8 +218,14 @@ export interface ShadowEnv {
     sleep?: (ms: number) => Promise<void>;
     /** Override the per-task state dir root (default `~/.codevibe/shadow-state`). */
     stateRootDir?: string;
+    /** Override the process owner root (default `~/.codevibe/process-owners`). */
+    ownerRootDir?: string;
     /** Override the shadow temp-dir root (default `os.tmpdir()`). */
     shadowRootDir?: string;
+    /** Optional cancellation signal to bound sweep execution. */
+    signal?: AbortSignal;
+    /** Optional helper timeout in milliseconds for subprocess operations. */
+    helperTimeoutMs?: number;
     /** @internal lower deterministic limit for serialized-marker boundary tests. */
     maxStateMarkerBytes?: number;
     /** TTL for the GC reaper. */

package/node_modules/@quantiya/codevibe-core/dist/local-executor/shadow-recovery.d.ts

@@ -1,3 +1,4 @@
+import * as fs from 'node:fs/promises';
 import { type AnchoredFsIdentity, type AnchoredCommittedFile, type AnchoredPathIdentity, type AnchoredWritePrecondition } from './anchored-fs';
 import { type ProcessCleanupOwner } from './process-tree';
 import { type ProcessIdentity } from './process-identity';
@@ -138,19 +139,34 @@ export declare function isWithinRoot(root: string, candidate: string): boolean;
 export declare function assertSafeStateComponent(value: string): void;
 export declare function stateFileNameForShadow(shadowDir: string): string;
 export declare function exposureRetentionFileNameForShadow(shadowDir: string): string;
-export declare function writeExposureRetentionMarker(stateFile: string, marker: ExposureRetentionMarker, expectedStateDir: WorkspaceRootAuthority, onCommitted?: (fileAuthority: RetainedStateFileAuthority, stateDirAuthority: WorkspaceRootAuthority) => void): Promise<void>;
+export declare function writeExposureRetentionMarker(stateFile: string, marker: ExposureRetentionMarker, expectedStateDir: WorkspaceRootAuthority, onCommitted?: (fileAuthority: RetainedStateFileAuthority, stateDirAuthority: WorkspaceRootAuthority) => void, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<void>;
 /** Publish an exact, durable delete decision before recursive removal begins. */
-export declare function publishExposureDeleteDisposition(stateFile: string, marker: ExposureRetentionMarker, authority: WorkspaceRootAuthority, expectedStateDir: WorkspaceRootAuthority, onCommitted?: (fileAuthority: RetainedStateFileAuthority, stateDirAuthority: WorkspaceRootAuthority) => void): Promise<ExposureRetentionMarker>;
+export declare function publishExposureDeleteDisposition(stateFile: string, marker: ExposureRetentionMarker, authority: WorkspaceRootAuthority, expectedStateDir: WorkspaceRootAuthority, onCommitted?: (fileAuthority: RetainedStateFileAuthority, stateDirAuthority: WorkspaceRootAuthority) => void, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<ExposureRetentionMarker>;
 /** Persist that the disposition completed and no physical bytes remain owned. */
-export declare function publishExposureReclaimed(stateFile: string, marker: ExposureRetentionMarker, expectedStateDir: WorkspaceRootAuthority, onCommitted?: (fileAuthority: RetainedStateFileAuthority, stateDirAuthority: WorkspaceRootAuthority) => void): Promise<ExposureRetentionMarker>;
+export declare function publishExposureReclaimed(stateFile: string, marker: ExposureRetentionMarker, expectedStateDir: WorkspaceRootAuthority, onCommitted?: (fileAuthority: RetainedStateFileAuthority, stateDirAuthority: WorkspaceRootAuthority) => void, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<ExposureRetentionMarker>;
 /** Retire a negative bridge only when its generated public name is absent. */
-export declare function removeExposureRetentionMarkerIfPublicAbsent(stateFile: string, publicShadowDir: string, expected: ExposureRetentionMarker, shadowRoot: string, physicalCopyScope: string, expectedStateDir?: WorkspaceRootAuthority, expectedFileAuthority?: RetainedStateFileAuthority): Promise<boolean>;
+export declare function removeExposureRetentionMarkerIfPublicAbsent(stateFile: string, publicShadowDir: string, expected: ExposureRetentionMarker, shadowRoot: string, physicalCopyScope: string, expectedStateDir?: WorkspaceRootAuthority, expectedFileAuthority?: RetainedStateFileAuthority, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<boolean>;
 export interface ExposureRetentionSnapshot {
     marker: ExposureRetentionMarker;
     stateFileIdentity: AnchoredPathIdentity;
     stateDirAuthority: WorkspaceRootAuthority;
 }
-export declare function readExposureRetentionMarkerSnapshot(stateFile: string, taskId: string, shadowRoot: string, physicalCopyScope: string, expectedStateDir?: WorkspaceRootAuthority): Promise<ExposureRetentionSnapshot>;
+export declare function readExposureRetentionMarkerSnapshot(stateFile: string, taskId: string, shadowRoot: string, physicalCopyScope: string, expectedStateDir?: WorkspaceRootAuthority, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<ExposureRetentionSnapshot>;
 export declare function shadowLifecycleLockPath(shadowRoot: string, snapshotPath: string): string;
 export declare function buildCasRecoveryAuthority(root: WorkspaceRootAuthority, baseline: readonly {
     path: string;
@@ -177,8 +193,9 @@ export declare function assertStateMarkerLifecycleCapacity(marker: ShadowStateFi
 /** Retire only the exact marker bytes authenticated during failed creation. */
 export declare function retireFailedCreateStateMarker(stateFile: string, taskId: string, stateRootAuthority: WorkspaceRootAuthority, maxBytes: number): Promise<void>;
 export declare function validateMarkerShape(value: unknown, expectedTaskId: string): ShadowStateFileV2;
-export declare function workspaceAuthorityOptions(env: ShadowEnv, target: string, boundary: string): {
+export declare function workspaceAuthorityOptions(env: ShadowEnv, target?: string, boundary?: string): {
     helperTimeoutMs?: number;
+    signal?: AbortSignal;
     testHangStage?: 'realpath' | 'lstat' | 'open' | 'stat' | 'close';
 };
 /** Fresh, bounded cleanup-only read used by live disposal and restart GC. */
@@ -199,7 +216,10 @@ export declare function ensurePrivateDirectory(dir: string, opts?: {
     anchorPath?: string;
     failDirectorySyncStage?: 'target-child' | 'target-parent';
 }): Promise<DurableDirectoryIdentity>;
-export declare function atomicWriteFile(filePath: string, content: string, expected: AnchoredWritePrecondition, beforeCommit?: () => Promise<void> | void, afterValidation?: () => Promise<void> | void, serializeInProcess?: boolean, expectedParent?: AnchoredFsIdentity, maxTargetBytes?: number, failDirectorySync?: boolean, publicationOwnerKey?: string): Promise<AnchoredCommittedFile>;
+export declare function atomicWriteFile(filePath: string, content: string, expected: AnchoredWritePrecondition, beforeCommit?: () => Promise<void> | void, afterValidation?: () => Promise<void> | void, serializeInProcess?: boolean, expectedParent?: AnchoredFsIdentity, maxTargetBytes?: number, failDirectorySync?: boolean, publicationOwnerKey?: string, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<AnchoredCommittedFile>;
 export declare function isAnchoredWritePreconditionError(err: unknown): boolean;
 export declare function assertMarkerTransition(from: ShadowPromoteState | null, to: ShadowPromoteState, opts: {
     allowApplyingDisposal: boolean;
@@ -211,7 +231,10 @@ export declare function sameWorkspaceIncarnation(left: WorkspaceRootAuthority, r
 export declare function buildSnapshotIncarnationIndex(shadowRootAuthority: WorkspaceRootAuthority, env?: ShadowEnv): Promise<SnapshotIncarnationIndex>;
 /** Locate one renamed original snapshot without ever adopting its current name. */
 export declare function findSnapshotIncarnation(shadowRootAuthority: WorkspaceRootAuthority, expected: WorkspaceRootAuthority, snapshotIncarnations?: SnapshotIncarnationIndex, env?: ShadowEnv): Promise<WorkspaceRootAuthority | null>;
-export declare function hasCleanupBlockAnchor(shadowDir: string): Promise<boolean>;
+export declare function hasCleanupBlockAnchor(shadowDir: string, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<boolean>;
 interface SnapshotOwnerAnchor {
     version: 1 | 2;
     shadowDirIdentity: AnchoredFsIdentity;
@@ -228,7 +251,10 @@ export declare function physicalCopyScopeHash(scopeId: string): string;
  * no longer authenticate its prepared target/temp state, so deletion must
  * never outrun this reconciliation boundary.
  */
-export declare function reconcileSnapshotPublicationAuthorityBeforeRemoval(snapshotRootAuthority: WorkspaceRootAuthority): Promise<void>;
+export declare function reconcileSnapshotPublicationAuthorityBeforeRemoval(snapshotRootAuthority: WorkspaceRootAuthority, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<void>;
 /**
  * Stable, bounded ownership key for every private publication transaction
  * created on behalf of one task-state namespace. The private publication store
@@ -237,13 +263,20 @@ export declare function reconcileSnapshotPublicationAuthorityBeforeRemoval(snaps
  */
 export declare function workspacePublicationAuthorityOwnerKey(stateRootCanonicalPath: string, taskId: string): string;
 export declare function writeSnapshotOwnerAnchor(ownerFile: string, snapshotRootAuthority: WorkspaceRootAuthority, ownerProcessIdentity: ProcessIdentity, physicalCopyScope: string, physicalCopyBytes: number, publicationOwnerKey: string): Promise<void>;
-export declare function readSnapshotOwnerAnchor(shadowDir: string): Promise<SnapshotOwnerAnchor | null>;
+export declare function readSnapshotOwnerAnchor(shadowDir: string, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+    openFileHandle?: (filePath: string, flags: number) => Promise<fs.FileHandle>;
+}): Promise<SnapshotOwnerAnchor | null>;
 /**
  * Sum durable reservations under the cross-process quota fence. Invalid owner
  * authority consumes the whole limit, so cloning can continue but a physical
  * fallback cannot allocate unknown additional disk.
  */
-export declare function scanPersistedPhysicalCopyBytes(shadowRoots: readonly RegisteredShadowRoot[], physicalCopyScope: string, limit: number): Promise<number>;
+export declare function scanPersistedPhysicalCopyBytes(shadowRoots: readonly RegisteredShadowRoot[], physicalCopyScope: string, limit: number, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<number>;
 interface RegisteredShadowRoot extends AnchoredFsIdentity {
     path: string;
     version?: 1;
@@ -270,7 +303,10 @@ export declare class StaleShadowRootError extends Error {
  * physical shadow root before copying, so the aggregate scan cannot be split by
  * different temp-root configuration.
  */
-export declare function registerAndListQuotaShadowRoots(stateRoot: string, stateRootIdentity: WorkspaceRootAuthority, currentShadowRoot: string, currentShadowRootIdentity: WorkspaceRootAuthority, publicationOwnerKey: string, maxStateMarkerBytes: number, afterQuotaReferenceTaskEntry?: (stateDir: string) => Promise<void> | void, afterQuotaReferenceMarkerEntry?: (filePath: string) => Promise<void> | void, afterQuotaReferenceMarkerStat?: (filePath: string) => Promise<void> | void, failDirectorySync?: boolean, mode?: 'register-current' | 'retire-current-if-unused', afterQuotaRetirementTargetProof?: (shadowRoot: string) => Promise<void> | void): Promise<RegisteredShadowRoot[]>;
+export declare function registerAndListQuotaShadowRoots(stateRoot: string, stateRootIdentity: WorkspaceRootAuthority, currentShadowRoot: string, currentShadowRootIdentity: WorkspaceRootAuthority, publicationOwnerKey: string, maxStateMarkerBytes: number, afterQuotaReferenceTaskEntry?: (stateDir: string) => Promise<void> | void, afterQuotaReferenceMarkerEntry?: (filePath: string) => Promise<void> | void, afterQuotaReferenceMarkerStat?: (filePath: string) => Promise<void> | void, failDirectorySync?: boolean, mode?: 'register-current' | 'retire-current-if-unused', afterQuotaRetirementTargetProof?: (shadowRoot: string) => Promise<void> | void, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<RegisteredShadowRoot[]>;
 /**
  * Retire the exact current shadow-root authority after terminal cleanup.
  *
@@ -280,7 +316,10 @@ export declare function registerAndListQuotaShadowRoots(stateRoot: string, state
  * by any durable state or exposure marker. A missing, replaced, renamed, or
  * referenced authority remains fail-closed in `registerAndListQuotaShadowRoots`.
  */
-export declare function retireQuotaShadowRootIfUnused(stateRoot: string, stateRootIdentity: WorkspaceRootAuthority, currentShadowRoot: string, currentShadowRootIdentity: WorkspaceRootAuthority, publicationOwnerKey: string, maxStateMarkerBytes: number, afterQuotaReferenceTaskEntry?: (stateDir: string) => Promise<void> | void, afterQuotaReferenceMarkerEntry?: (filePath: string) => Promise<void> | void, afterQuotaReferenceMarkerStat?: (filePath: string) => Promise<void> | void, failDirectorySync?: boolean, afterQuotaRetirementTargetProof?: (shadowRoot: string) => Promise<void> | void): Promise<boolean>;
+export declare function retireQuotaShadowRootIfUnused(stateRoot: string, stateRootIdentity: WorkspaceRootAuthority, currentShadowRoot: string, currentShadowRootIdentity: WorkspaceRootAuthority, publicationOwnerKey: string, maxStateMarkerBytes: number, afterQuotaReferenceTaskEntry?: (stateDir: string) => Promise<void> | void, afterQuotaReferenceMarkerEntry?: (filePath: string) => Promise<void> | void, afterQuotaReferenceMarkerStat?: (filePath: string) => Promise<void> | void, failDirectorySync?: boolean, afterQuotaRetirementTargetProof?: (shadowRoot: string) => Promise<void> | void, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<boolean>;
 interface CleanupBlockAnchorRead {
     present: boolean;
     cleanupOwners: ProcessCleanupOwner[];
@@ -293,6 +332,9 @@ export declare function readCleanupBlockAnchor(shadowDir: string, expected: {
     shadowDir: string;
     shadowDirIdentity: AnchoredFsIdentity;
     snapshotRootAuthority: WorkspaceRootAuthority;
+}, opts?: {
+    helperTimeoutMs?: number;
+    signal?: AbortSignal;
 }): Promise<CleanupBlockAnchorRead>;
 export declare function dedupeCleanupOwners(owners: readonly ProcessCleanupOwner[]): ProcessCleanupOwner[];
 export {};

package/node_modules/@quantiya/codevibe-core/dist/local-executor/workspace-authority.d.ts

@@ -14,6 +14,8 @@ export interface WorkspaceRootAuthority {
 export interface WorkspaceAuthorityCaptureOptions {
     /** @internal lower deterministic helper deadline for tests. */
     helperTimeoutMs?: number;
+    /** Optional cancellation signal to abort helper execution. */
+    signal?: AbortSignal;
     /** @internal deterministic target-filesystem stall seam. */
     testHangStage?: 'realpath' | 'lstat' | 'open' | 'stat' | 'close';
 }

package/node_modules/@quantiya/codevibe-core/dist/local-executor/workspace-shadow.d.ts

@@ -244,7 +244,9 @@ export declare class WorkspaceShadow {
          * set this flag.
          */
         applyingAuthorityRetired?: boolean;
-    }): Promise<void>;
+        helperTimeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<boolean>;
     private retirePhysicalCopyRootIfUnused;
     private retainExposureWriteAuthority;
     private runOwnedStateFileWrite;
@@ -255,7 +257,6 @@ export declare class WorkspaceShadow {
      * continue. A displaced original state directory is retained fail-closed.
      */
     private exactStateResourcesAreRetired;
-    /** Reclaim a renamed original without ever adopting its public replacement. */
     private discardDisplacedSnapshot;
     private refreshRetainedStateAuthorities;
     /** Orphan teardown is ordinary instance-owned teardown. */

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.d.ts

@@ -4,12 +4,14 @@ import { Mode, Tier } from './types';
 import { type ModeSelectionDeps } from './mode-selection';
 import { type RunOrchestrationShellArgs } from './index';
 import { type ShellEventEmit, type ShellEventEmitResult } from './emit-shell-event';
+import { type ShadowEnv } from '../local-executor/workspace-shadow';
 import { BackendPlannerClient, PlannerCacheLayer, PlannerHealthMachine, type LocalGemmaAdvisoryRunner, type LocalGemmaPlannerRunner } from '../planner';
 import type { PlannerAdapter, PlannerInput, PlannerDecision, PlannerProbeResult } from '../planner/adapter';
 import { keychainManager } from '../keychain';
 export { keychainManager };
 import type { TaskAuditSummaryModel } from './audit-summary';
 import { type LocalExecutor, type AuthorityScope, type EmitShellEventFn as LEEmitShellEventFn } from '../local-executor';
+import { type ReviewerCredentialStore } from '../substrate-launch';
 import { type EngineGroupState } from '../local-executor';
 import type { TeamTapEvent } from './index';
 import type { WorkspaceOutcomeSinkTap } from './workspace-terminal-coordinator';
@@ -111,6 +113,8 @@ export interface AdmittedSessionOwnershipController {
     run<T>(launch: (acceptOwnership: () => void) => Promise<T>): Promise<T>;
     /** Close a failed bootstrap and retire any session already admitted. */
     abort(): Promise<void>;
+    /** Synonym for abort(): await full teardown and bounded orphan sweep. */
+    close(): Promise<void>;
 }
 /**
  * Install lifecycle ownership before admission begins. The pending-create path
@@ -130,7 +134,7 @@ export declare const ORCHESTRATION_ORPHAN_SWEEP_STALE_THRESHOLD_MS: number;
  * aborted test runs, or ungraceful terminal closures. Non-blocking best-effort
  * operation; mirrors companion-plugin startup sweeps.
  */
-export declare function triggerStartupOrphanSweep(appsyncClient: AppSyncClient, currentSessionId: string, staleThresholdMs?: number, tmpRoot?: string): Promise<number>;
+export declare function triggerStartupOrphanSweep(appsyncClient: AppSyncClient, currentSessionId: string, staleThresholdMs?: number, tmpRoot?: string, shadowEnv?: ShadowEnv): Promise<number>;
 /**
  * CP-8 Slice C (#570) — parse a top-level `audit show <task-id> [--json]
  * [--session <id>]` subcommand from the raw argv. Returns null when the argv is
@@ -184,7 +188,19 @@ export declare function resolveLocalModelBoot(args: {
     requestedMode: Mode;
     entitlement: LocalModelEntitlement;
     state: LocalModelState;
+    env?: NodeJS.ProcessEnv;
 }): LocalModelBootDecision;
+/**
+ * Preflight onboarding check: on substrate-capable platforms (macOS/Linux),
+ * verify vendor credentials exist for detected/installed implementor agents
+ * (Claude/Codex). Emits an actionable notice before entering Orchestration Mode
+ * so the user knows upfront before mid-task broker 503s occur.
+ */
+export declare function checkImplementorCredentialNotice(args?: {
+    detectedAgents?: string[];
+    store?: ReviewerCredentialStore;
+    platform?: string;
+}): Promise<string | null>;
 export interface LocalGemmaPlannerBuildResult {
     adapter: PlannerAdapter;
     advisoryRunner: LocalGemmaAdvisoryRunner | null;
@@ -250,11 +266,47 @@ export declare function main(argv: string[]): Promise<number>;
  *
  * Exported for unit tests; production callers go through `main()`.
  */
-export declare function buildProductionPlannerStack(appsyncClient: AppSyncClient, emitter: (args: ShellEventEmit) => Promise<unknown>): {
+export interface ProductionPlannerStackResult {
     adapter: BackendPlannerClient;
     cache: PlannerCacheLayer;
     health: PlannerHealthMachine;
-};
+}
+export declare function buildProductionPlannerStack(appsyncClient: AppSyncClient, emitter: (args: ShellEventEmit) => Promise<unknown>): ProductionPlannerStackResult;
+export interface ResolvePlannerAdapterArgs {
+    localPlanner: LocalGemmaPlannerBuildResult;
+    tier: Tier;
+    appsyncClient: AppSyncClient;
+    emitter: (args: ShellEventEmit) => Promise<unknown>;
+    env?: NodeJS.ProcessEnv;
+    buildHostedStack?: (appsyncClient: AppSyncClient, emitter: (args: ShellEventEmit) => Promise<unknown>) => ProductionPlannerStackResult;
+}
+export interface ResolvedPlannerResult {
+    adapter: PlannerAdapter;
+    runtimeKind: NonNullable<RunOrchestrationShellArgs['plannerRuntimeKind']>;
+    runtimeLabel: string;
+    advisoryRunner: LocalGemmaAdvisoryRunner | null;
+    classifyRunner: LocalGemmaPlannerRunner | null;
+    cache: PlannerCacheLayer | null;
+    health: PlannerHealthMachine | null;
+    source: 'local' | 'hosted' | 'local_unavailable';
+}
+/**
+ * Resolves the active planner adapter for the orchestration shell session.
+ *
+ * Precedence & Invariants:
+ * 1. Forced hosted mode (`CODEVIBE_FORCE_HOSTED_PLANNER=1` or `CODEVIBE_PLANNER_PROVIDER=hosted`):
+ *    - Allowed for PRO and MAX tiers. Returns the production hosted Bedrock planner stack.
+ *    - Disallowed for FREE tier (preserves $0 marginal cost invariant). Falls back to local adapter.
+ * 2. Local-first preference:
+ *    - When local Gemma is enabled and operational (`!localPlanner.reason`), returns the local adapter
+ *      (`local_gemma_qat`).
+ * 3. Unavailable fallback:
+ *    - When local Gemma is unavailable (`localPlanner.reason` is truthy):
+ *      - PRO / MAX: Falls back to the hosted Bedrock planner stack (`hosted`).
+ *      - FREE: Retains the local unavailable adapter (`local_unavailable`), strictly preventing
+ *        cloud inference costs.
+ */
+export declare function resolvePlannerAdapter(args: ResolvePlannerAdapterArgs): ResolvedPlannerResult;
 export interface BuildTeamLocalExecutorResult {
     localExecutor: LocalExecutor;
     /** Shell-installed writer-outcome coordinator used by v2 team promotion. */