@quantiya/codevibe-codex-plugin 2.0.6 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/local-model/ollama.d.ts

@@ -13,6 +13,29 @@ export type OllamaRuntimeConfigResult = {
     ok: false;
     reason: string;
 };
+/**
+ * Dogfood #618 — keep the model RESIDENT between shell turns. Ollama's default
+ * keep_alive is 5 minutes: a user who reads a brainstorm for 6 minutes before
+ * replying pays a full model reload on the next turn, and on a busy machine
+ * that reload can blow the whole request timeout. Sent on EVERY generate (each
+ * turn re-ups the window) and on the shell-start pre-warm.
+ */
+export declare const OLLAMA_KEEP_ALIVE = "30m";
+/**
+ * Dogfood #618 — floor for ADVISORY generations (brainstorm/familiarize
+ * fallback, up to 700–1400 output tokens on a 12B + long conversation-context
+ * prompts). Measured warm long-context brainstorm ≈ 6s on an idle machine, but
+ * a cold reload + busy machine blew the shared 60s cap in real dogfood. The
+ * fast-fail 60s default stays for CLASSIFY (≤256 tokens, turn-blocking); an
+ * explicit higher CODEVIBE_LOCAL_MODEL_TIMEOUT_MS still wins over this floor.
+ */
+export declare const ADVISORY_TIMEOUT_FLOOR_MS = 180000;
+/**
+ * Advisory requests use the LARGER of the configured timeout and the advisory
+ * floor, still clamped to the global max — so the env var can raise but never
+ * silently shrink an advisory below its floor.
+ */
+export declare function advisoryTimeoutMs(configTimeoutMs: number): number;
 /**
  * The `/api/pull` STALL window. A real multi-GB model pull runs for many minutes, so the
  * pull must NOT use the single-shot inference timeout ({@link requestOllamaJson}). Instead we
@@ -60,5 +83,22 @@ export declare class OllamaGemmaPlannerRunner implements LocalGemmaPlannerRunner
     constructor(config: OllamaRuntimeConfig);
     classify(promptText: string): Promise<string>;
     generateAdvisory(promptText: string, options?: LocalGemmaAdvisoryOptions): Promise<string>;
+    /**
+     * Dogfood #618 — fire-and-forget model pre-warm. Sends a LOAD-ONLY generate
+     * (empty prompt: Ollama loads the model into memory and returns immediately,
+     * response text is empty by design — so this does NOT go through
+     * `requestOllamaGenerate`, which rejects empty responses) with the standard
+     * keep_alive. NEVER throws: resolves `true` when the model is resident,
+     * `false` on any error — pre-warm failure must not affect shell startup.
+     */
+    warm(): Promise<boolean>;
+    /**
+     * #618 Stage-2 (agy MEDIUM) — release the model on shell exit. Without this,
+     * quitting the shell leaves the 12B (7.4GB) resident for up to the full
+     * keep_alive window, starving other host work. `keep_alive: 0` unloads
+     * immediately; the next shell start's pre-warm covers the reload cost.
+     * Fire-and-forget shape like warm(): unref'd, short cap, never throws.
+     */
+    unload(): Promise<boolean>;
     probe(): Promise<PlannerProbeResult>;
 }

package/node_modules/@quantiya/codevibe-core/dist/orchestration/__tests__/detect-agents.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration/detect-agents.d.ts

@@ -2,6 +2,7 @@ import { Logger } from '../logger';
 import { AppSyncClient } from '../appsync';
 import { CapabilityRegistry } from '../adapter/capabilities';
 export type DetectableAgent = 'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY';
+declare function launcherCompatiblePath(env: NodeJS.ProcessEnv, commonPaths?: string[]): string;
 /**
  * Returns the subset of agents present on PATH. Uses `command -v`
  * (POSIX-standard) rather than `which` for portability across macOS
@@ -12,10 +13,15 @@ export type DetectableAgent = 'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY';
  * installed agents CAN change between plugin launches (user installs
  * a new agent) and the caller decides how often to re-probe.
  */
-export declare function detectInstalledAgents(): DetectableAgent[];
+export declare function detectInstalledAgents(env?: NodeJS.ProcessEnv): DetectableAgent[];
+declare function isAgentInstalled(agent: DetectableAgent, env: NodeJS.ProcessEnv, commonPaths?: string[]): boolean;
+export declare const __testing: {
+    isAgentInstalled: typeof isAgentInstalled;
+    launcherCompatiblePath: typeof launcherCompatiblePath;
+};
 /**
  * Detect-and-push convenience for plugin daemon startup. All three
- * plugins (Claude, Gemini, Codex) call this once at start(). Runs
+ * plugins (Claude, Codex, Antigravity) call this once at start(). Runs
  * the local PATH probe, then pushes the set to the backend via
  * updateAvailableAgents. Idempotent — the backend dedupes and stores.
  * Non-fatal on the network failure path (caller should `.catch()`
@@ -25,7 +31,7 @@ export declare function detectInstalledAgents(): DetectableAgent[];
  * CP-1.f LOCK RP-3 — `replace` semantics. `User.availableAgents` is a
  * cross-device UNION by default (`replace=false`), which never removes a
  * stale agent (a `GEMINI` from a prior device/install would linger and
- * get composed into the reviewer panel → `spawn gemini ENOENT`). The
+ * get composed into the reviewer panel → unsupported agent spawn). The
  * orchestration shell passes `replace=true` so the stored set is EXACTLY
  * the current orchestration host's installed agents, AND — also per
  * RP-3 — always writes even on zero detection (no skip-on-empty) so a
@@ -41,30 +47,4 @@ export declare function detectInstalledAgents(): DetectableAgent[];
  *                Default false (1.x companion union path).
  */
 export declare function pushDetectedAgents(client: AppSyncClient, log: Pick<Logger, 'info' | 'warn'>, capabilityRegistry?: CapabilityRegistry, detectFn?: () => DetectableAgent[], replace?: boolean): Promise<void>;
-/**
- * Quorum 2.0 (2f.0.a.6) per-session orchestration CLI override applier.
- * All three plugin wrappers (`codevibe-claude`, `codevibe-gemini`,
- * `codevibe-codex`) export `CODEVIBE_ORCHESTRATION_OVERRIDE=true|false`
- * to the tmux env when the user passes `--orchestration` /
- * `--no-orchestration`. The daemon inherits this via the hook env
- * chain and calls THIS function after every session-creation site
- * to pin the per-session decision — wins outright over the server's
- * User.orchestrationEnabledDefault auto-populate.
- *
- * Called from each plugin's daemon at every session-creation call
- * site. Claude has one (handleSessionStart covers new + /resume
- * because Claude Code fires SessionStart on /resume). Gemini has
- * two (handleSessionStart + switchToResumedSession — /resume doesn't
- * fire SessionStart in Gemini). Codex has two (createLaunchSession
- * + handleSessionStarted — launch session gets replaced by runtime
- * session_meta).
- *
- * Non-fatal on error — a failed override doesn't block session setup;
- * the server's auto-populate decision stands and the user can flip
- * the session via mobile toggle after the fact.
- *
- * @param client     AppSyncClient authenticated for the session's owner
- * @param sessionId  Backend session ID (post-resumeOrCreateSession)
- * @param log        Logger
- */
-export declare function applyPerSessionOrchestrationOverride(client: AppSyncClient, sessionId: string, log: Pick<Logger, 'info' | 'warn'>): Promise<void>;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration/index.d.ts

@@ -1,3 +1,2 @@
-export { detectInstalledAgents, pushDetectedAgents, applyPerSessionOrchestrationOverride, type DetectableAgent, } from './detect-agents';
-export { runOrchestrationCli } from './orchestration-cli';
+export { detectInstalledAgents, pushDetectedAgents, type DetectableAgent, } from './detect-agents';
 export { V1_ORCHESTRATION_PROMPT_KIND, V1_ORCHESTRATION_OPTIONS, mapOptionNumberToUserDecisionKind, mapOptionToUserDecisionKind, type V1OrchestrationOption, type V1UserDecisionKind, } from './v1-options';

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/a1a-planner-offers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/a6-cli-surface.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/advisory-attachment-journal.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/advisory-attachments-dir-race.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/advisory-multi-mention-panel.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/advisory-panel-attachments.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/advisory-quota-stdout-result.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/agent-turn-context-batch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/bounded-shutdown.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/brainstorm-quorum-wiring.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/brainstorm-quorum.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/cli-team-session-key.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/command-intent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/context-compaction.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/context-items-hosted-sync.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/context-items-wiring.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/context-items.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/cp8-full-team-events.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/cp8-team-decomposed-zk.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/explicit-tty-exit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/mention-suggest.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/planner-offer-e1.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/route-browse-summarize-recovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/__tests__/workspace-shutdown.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/advisory-attachment-journal.d.ts

@@ -0,0 +1,165 @@
+import { type AnchoredCommittedFile } from '../local-executor/anchored-fs';
+import { type ProcessIdentity } from '../local-executor/process-identity';
+import { type ProcessCleanupOwner } from '../local-executor/process-tree';
+import { type WorkspaceRootAuthority } from '../local-executor/workspace-authority';
+export declare function advisoryAttachmentJournalRoot(home?: string): string;
+export interface BatchRecordV1 {
+    version: 1;
+    kind: 'batch';
+    batchId: string;
+    sessionId: string;
+    workspaceKey: string;
+    owner: ProcessIdentity;
+    workspaceRoot: WorkspaceRootAuthority;
+    directory: WorkspaceRootAuthority;
+    createdAtMs: number;
+}
+interface AttachmentContentAuthority {
+    sha256: string;
+    size: number;
+    mode: number;
+}
+export interface AttachmentRecordV1 {
+    version: 1;
+    kind: 'attachment';
+    recordId: string;
+    batchId: string;
+    sessionId: string;
+    owner: ProcessIdentity;
+    workspaceRoot: WorkspaceRootAuthority;
+    directory: WorkspaceRootAuthority;
+    targetName: string;
+    content: AttachmentContentAuthority;
+    phase: 'pending' | 'committed';
+    file: AnchoredCommittedFile | null;
+    createdAtMs: number;
+}
+export interface AdvisoryProcessRecordV1 {
+    version: 1;
+    kind: 'process';
+    recordId: string;
+    batchId: string;
+    sessionId: string;
+    owner: ProcessIdentity;
+    workspaceRoot: WorkspaceRootAuthority;
+    processOwner: ProcessCleanupOwner;
+    createdAtMs: number;
+}
+export interface AdvisoryAttachmentBatchAuthority {
+    readonly value: BatchRecordV1;
+    readonly recordPath: string;
+    readonly recordIdentity: AnchoredCommittedFile;
+}
+export interface AdvisoryAttachmentPublicationAuthority {
+    readonly value: AttachmentRecordV1;
+    readonly recordPath: string;
+    readonly recordIdentity: AnchoredCommittedFile;
+}
+export interface AdvisoryProcessAuthority {
+    readonly value: AdvisoryProcessRecordV1;
+    readonly recordPath: string;
+    readonly recordIdentity: AnchoredCommittedFile;
+}
+export interface AdvisoryAttachmentRecoveryResult {
+    recoveredAttachments: number;
+    retiredBatches: number;
+    retainedLive: number;
+}
+export declare class AdvisoryAttachmentWorkspaceBlockedError extends Error {
+    constructor(message?: string);
+}
+export declare class AdvisoryAttachmentJournal {
+    private readonly sessionId;
+    private readonly rootPath;
+    private readonly anchorPath;
+    private readonly currentOwner;
+    private readonly ownerIsAlive;
+    private readonly retryProcessOwner;
+    private readonly mintId;
+    private readonly now;
+    private readonly retirementSettleMs;
+    private rootAuthority;
+    private readonly activeBatchIds;
+    constructor(opts: {
+        sessionId: string;
+        /** @internal isolated private root for deterministic tests. */
+        rootDir?: string;
+        /** @internal existing ancestor for the isolated private root. */
+        anchorPath?: string;
+        /** @internal deterministic OS-incarnation seam for recovery tests. */
+        currentProcessIdentityFn?: () => Promise<ProcessIdentity>;
+        /** @internal deterministic liveness seam for recovery tests. */
+        isProcessIdentityAliveFn?: (identity: ProcessIdentity) => Promise<boolean>;
+        /** @internal deterministic exact process-group recovery seam. */
+        retryProcessCleanupOwnerFn?: (owner: ProcessCleanupOwner) => Promise<void>;
+        /** @internal deterministic UUID seam for recovery/collision tests. */
+        newId?: () => string;
+        /** @internal deterministic timestamp seam for canonical-record tests. */
+        now?: () => number;
+        /** @internal shorten the transient helper-retirement observation window. */
+        retirementSettleMs?: number;
+    });
+    private openRoot;
+    private readRecord;
+    private readRetirementRecord;
+    private helperArtifactTarget;
+    private listRecords;
+    private writeNewRecord;
+    private replaceRecord;
+    private removeRecord;
+    private assertBatchToken;
+    private assertPublicationToken;
+    private assertProcessToken;
+    private recoverProcessRecord;
+    /**
+     * `anchoredRemoveFile` quarantines an exact file under a fresh private
+     * `.codevibe-retire-*` name before unlink. If the helper dies in that narrow
+     * interval, recover the tombstone by immutable inode/content authority rather
+     * than by a pathname capability that the helper deliberately never exposes.
+     */
+    private findRetiredImage;
+    private recoverAttachmentRecord;
+    recoverDeadOwners(): Promise<AdvisoryAttachmentRecoveryResult>;
+    assertWorkspaceSafe(workingDir: string): Promise<void>;
+    assertBatchOwnsWorkspace(batch: AdvisoryAttachmentBatchAuthority, workingDir: string): Promise<void>;
+    beginBatch(args: {
+        workspaceRoot: WorkspaceRootAuthority;
+        directory: WorkspaceRootAuthority;
+    }): Promise<AdvisoryAttachmentBatchAuthority>;
+    /**
+     * Bind one exact advisory process group to the image batch before the
+     * untrusted target receives its launch ACK. A separate record per panel cell
+     * avoids shared-record CAS races when several advisors start concurrently.
+     */
+    beginProcess(batch: AdvisoryAttachmentBatchAuthority, processOwner: ProcessCleanupOwner): Promise<AdvisoryProcessAuthority>;
+    /**
+     * Retire a process binding only after exact process-group absence is proven.
+     * The spawn layer already performs this proof before its retirement hook;
+     * repeating it here makes the journal API independently fail closed.
+     */
+    retireProcess(authority: AdvisoryProcessAuthority, processOwner: ProcessCleanupOwner): Promise<void>;
+    beginPublication(args: {
+        batch: AdvisoryAttachmentBatchAuthority;
+        extension: string;
+        bytes: Buffer;
+    }): Promise<AdvisoryAttachmentPublicationAuthority>;
+    commitPublication(authority: AdvisoryAttachmentPublicationAuthority, file: AnchoredCommittedFile): Promise<AdvisoryAttachmentPublicationAuthority>;
+    abortUnpublished(authority: AdvisoryAttachmentPublicationAuthority): Promise<void>;
+    cleanupPublication(authority: AdvisoryAttachmentPublicationAuthority): Promise<void>;
+    /**
+     * Resolve an ambiguous image/journal commit failure from the immutable
+     * pending authority. The record identity may legitimately have advanced to
+     * `committed` before the caller lost the acknowledgement, so this verifies
+     * the immutable batch/target/content tuple rather than requiring the stale
+     * record inode.
+     */
+    recoverPublication(authority: AdvisoryAttachmentPublicationAuthority): Promise<void>;
+    finishBatch(batch: AdvisoryAttachmentBatchAuthority): Promise<void>;
+    /**
+     * Final normal-exit audit. It retries only this journal instance's batches
+     * (or definitely-dead predecessors), then refuses successful retirement while
+     * any record for the session remains.
+     */
+    disposeSession(): Promise<void>;
+}
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/attachments.d.ts

@@ -1,4 +1,7 @@
 import type { ImageAttachment } from './types';
+import { type AnchoredCommittedFile } from '../local-executor/anchored-fs';
+import { type WorkspaceRootAuthority } from '../local-executor/workspace-authority';
+import { AdvisoryAttachmentJournal, type AdvisoryAttachmentBatchAuthority, type AdvisoryAttachmentPublicationAuthority } from './advisory-attachment-journal';
 /** Per-file on-disk cap (§10.5). */
 export declare const MAX_IMAGE_BYTES: number;
 /** Max attachments on the FINAL accumulated+deduped task set (§5). */
@@ -66,27 +69,69 @@ export interface CopiedAttachment {
     relPath: string;
     mime: string;
 }
+/**
+ * Exact filesystem authority retained from advisory staging through cleanup.
+ * Paths alone are never deletion authority.
+ */
+export interface AdvisoryAttachmentCleanupAuthority {
+    /** Private durable owner; the shared exact ignore guard is persistent. */
+    journal: AdvisoryAttachmentJournal;
+    batch: AdvisoryAttachmentBatchAuthority;
+    /** Only exact turn-owned image publications. */
+    files: Array<{
+        identity: AnchoredCommittedFile;
+        publication: AdvisoryAttachmentPublicationAuthority;
+    }>;
+}
 export interface PreparedAttachments {
     copiedAttachments: CopiedAttachment[];
     failedAttachments: ImageAttachment[];
     /** The brief with FAILED-copy refs rewritten to a neutral marker (no dangling ref). */
     roundBrief: string;
+    /** Present only for real-worktree advisory staging. */
+    advisoryCleanupAuthority: AdvisoryAttachmentCleanupAuthority | null;
 }
+/**
+ * Stage read-only brainstorm attachments in the user's real worktree.
+ *
+ * This path deliberately remains separate from implementor snapshot staging:
+ * user-owned conflicting entries are never removed, and the caller receives
+ * exact creation + inode identity so its per-turn cleanup cannot traverse a
+ * replacement symlink.
+ */
+export declare function prepareAttachmentsForAdvisoryWorktree(roundBrief: string, attachments: ImageAttachment[], workdir: string, journal: AdvisoryAttachmentJournal, opts?: {
+    /** @internal deterministic root-replacement seam. */
+    onRootCaptured?: (authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal deterministic directory-replacement seam. */
+    onDirEnsured?: (authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal deterministic pre-publication swap seam. */
+    beforeFileCommit?: (attachment: ImageAttachment, destination: string) => Promise<void> | void;
+}): Promise<PreparedAttachments>;
+/**
+ * Retire only files committed by one advisory staging call. Exact file,
+ * directory, and root identities are re-authenticated by anchored helpers;
+ * replacement entries are retained untouched.
+ */
+export declare function cleanupPreparedAdvisoryAttachments(prepared: PreparedAttachments, opts?: {
+    /** @internal deterministic exact-unlink race seam. */
+    beforeFileRemove?: (file: AnchoredCommittedFile, quarantinePath: string) => Promise<void> | void;
+}): Promise<void>;
 /**
  * Per-round copy + failure-rewrite in ONE step (§7.3, rev-7). For each attachment,
- * fd-copy (the §6/§7.3 `O_NOFOLLOW` + byte-ceiling + re-sniff re-validation) into
- * `<shadowDir>/.codevibe-attachments/<id>.<ext>` via a temp + atomic rename; for a
- * FAILED copy, unlink the partial dest AND rewrite that attachment's neutral rel-ref
- * in `roundBrief` to `[attached image skipped]` (so no dangling ref survives). The
- * returned `roundBrief` (failures neutralized) feeds BOTH the per-agent stdin AND
- * the execute-first payload. Never throws / never hard-blocks.
+ * validate the captured snapshot authority, create its attachments directory
+ * through the anchored helper, and publish each bounded/re-sniffed image with
+ * an anchored atomic write. A failed copy rewrites that attachment's neutral
+ * reference to `[attached image skipped]`; this function never hard-blocks the
+ * task on attachment failure.
  */
-export declare function prepareAttachmentsForSpawn(roundBrief: string, attachments: ImageAttachment[], shadowDir: string): PreparedAttachments;
+export declare function prepareAttachmentsForSpawn(roundBrief: string, attachments: ImageAttachment[], shadowRootAuthority: WorkspaceRootAuthority): Promise<PreparedAttachments>;
 /**
  * Per-agent rendering of the copied-attachment refs, appended to the brief at spawn
  * (§7.2). The stored/canonical brief is agent-NEUTRAL (`.codevibe-attachments/<id>.<ext>`);
  * this adds the agent-specific pointer: Claude/Codex → an `Attached images:` list of
- * relative paths (read via their Read tool); Gemini → the `@./…` form.
+ * relative paths (read via their Read tool); Antigravity → an absolute-path list (its
+ * Read tool resolves against agy's own scratch project, not the shadow cwd). (Gemini was
+ * SUNSET in 2026-07 and is never dispatched — its `@./…` rendering branch was removed.)
  */
 export declare function renderAttachmentsForAgent(agent: string, copied: CopiedAttachment[], workdir?: string): string;
 /**

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/bounded-shutdown.d.ts

@@ -0,0 +1,22 @@
+export type ShutdownDeadlineClass = 'normal' | 'signal';
+export interface BoundedSharedShutdownOperation {
+    wait: (deadlineClass?: ShutdownDeadlineClass) => Promise<void>;
+}
+export interface BoundedSharedShutdownOperationOptions {
+    start: () => Promise<void>;
+    normalTimeoutMs: number;
+    signalTimeoutMs: number;
+    onTimeout?: (deadlineClass: ShutdownDeadlineClass, timeoutMs: number) => void;
+    /**
+     * Optionally turn a deadline into a caller-visible failure. Normal shutdown
+     * uses this to refuse a successful exit while cleanup authority is still
+     * unresolved; signal shutdown intentionally remains best-effort and bounded.
+     */
+    timeoutError?: (deadlineClass: ShutdownDeadlineClass, timeoutMs: number) => Error | undefined;
+}
+/**
+ * Starts one shutdown operation and gives normal and signal callers one shared
+ * absolute timeout each. Repeated callers never restart either the operation or
+ * their deadline, so nested teardown paths cannot multiply the exit latency.
+ */
+export declare function createBoundedSharedShutdownOperation(options: BoundedSharedShutdownOperationOptions): BoundedSharedShutdownOperation;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/brainstorm-quorum.d.ts

@@ -0,0 +1,118 @@
+import type { Tier } from './types';
+import type { CommandIntentTarget } from './command-intent';
+/**
+ * The frontier panel's active-set members. This is the intersection of the
+ * `@`-mention vocabulary (`command-intent.ts` — Gemini is excluded from direct
+ * mentions) with the review quorum's ACTIVE_AGENT_KINDS (`detectInstalledAgents`
+ * probes exactly these three; Gemini is legacy-readable but not new-routable).
+ */
+export type BrainstormPanelActiveAgent = 'CLAUDE' | 'CODEX' | 'ANTIGRAVITY';
+/**
+ * OQ-BRAINSTORM-COST resolution: the frontier brainstorm panel is **Max-only**
+ * ("Max-only panel?"). Firing frontier agents per turn is expensive; the default
+ * interactive brainstorm remains the local 12B (`routeBrainstorm`), available to
+ * Pro/Max. The panel (both `@all` broadcast AND a directed `@agent` frontier
+ * routing) is gated here.
+ */
+export declare const BRAINSTORM_PANEL_MIN_TIER: Tier;
+/**
+ * The resolved panel active set, mirroring the review quorum's
+ * "installed ∧ non-quota-walled ∧ tier-permitted" intersection
+ * (quorum-loop `getDetectedAgents()` + `pickAutoContinuationTarget`).
+ */
+export type BrainstormPanelResolution = {
+    kind: 'ready';
+    activeAgents: BrainstormPanelActiveAgent[];
+} | {
+    kind: 'tier_gated';
+} | {
+    kind: 'no_agents';
+} | {
+    kind: 'all_quota_walled';
+    walled: BrainstormPanelActiveAgent[];
+};
+/**
+ * Resolve which frontier agents fire for this brainstorm turn.
+ *
+ * Order of gates (each fails to a distinct, user-legible reason):
+ *  1. **Tier** — below Max → `tier_gated` (no agent is spawned).
+ *  2. **Target ∩ installed** — an `@all` broadcast targets every installed
+ *     panel agent; a directed `@claude`/`@codex`/`@agy` targets exactly that one
+ *     IF installed. Empty → `no_agents`.
+ *  3. **Minus quota-walled** — subtract the session's quota-exhausted set (the
+ *     way `pickAutoContinuationTarget` subtracts `quotaFailedAgentsByTask`). If
+ *     every candidate is walled → `all_quota_walled` (nothing fires).
+ *
+ * Pure: the caller supplies the already-detected installed set and the walled
+ * set (both live in index.ts's session-scoped state).
+ */
+export declare function resolveBrainstormPanel(input: {
+    tier: Tier;
+    target: CommandIntentTarget;
+    /**
+     * [#637] ALL mention targets of a multi-mention turn (ordered, de-duplicated —
+     * `extractAllAgentMentionIntents`). When present it supersedes `target` for
+     * the active-set computation: the candidates are the mentioned agents ∩
+     * installed IN MENTION ORDER, and any `'ALL'` member means the whole installed
+     * set (existing `@all` semantics win). `target` stays the FIRST mention — the
+     * frozen `CommandIntentEnvelope`'s. Absent/single-element → prior behavior.
+     */
+    targets?: readonly CommandIntentTarget[];
+    detectedAgents: readonly BrainstormPanelActiveAgent[];
+    quotaWalled: ReadonlySet<BrainstormPanelActiveAgent>;
+}): BrainstormPanelResolution;
+/**
+ * The ContextItem `author.agent_id` for a panel agent — the lowercase mention id
+ * (§4 example: `'claude' | 'codex' | 'gemini' | 'agy'`). The rehydration render
+ * shows this verbatim as the attribution label ("claude: …", "agy: …"), so a
+ * later `@claude "critique the above"` sees WHO said what.
+ */
+export declare function agentIdForAuthor(agent: BrainstormPanelActiveAgent): 'claude' | 'codex' | 'agy';
+/**
+ * §8.2 — surface the active-set count/identities UP FRONT so the fan-out cost is
+ * visible before it fires (the design's "→ Opus 4.8 · GPT-5.5 · Gemini 5.5").
+ * The display names come from the caller (index.ts `agentDisplayName`) so the
+ * mapping stays single-sourced.
+ */
+export declare function renderBrainstormPanelHeader(activeAgents: readonly BrainstormPanelActiveAgent[], displayName: (agent: BrainstormPanelActiveAgent) => string): string;
+/**
+ * Below Max: the frontier panel is fenced, but the local model still
+ * brainstorms. No frontier agent was called and no code was changed.
+ */
+export declare function brainstormTierGateMessage(target: CommandIntentTarget): string;
+/**
+ * Every candidate for this mention is currently quota-walled for the session.
+ */
+export declare function brainstormAllQuotaWalledMessage(walled: readonly BrainstormPanelActiveAgent[], displayName: (agent: BrainstormPanelActiveAgent) => string): string;
+/**
+ * [A1g] Stage-2 (Codex round-2 HIGH) — the CLOSED-LABEL notice for a single
+ * brainstorm-panel cell that FAILED (a spawn/exec error, a quota wall, OR the
+ * absolute-ceiling timeout — #635). This is the ONLY per-agent failure text that
+ * enters the panel section, which the turn-mirror mirrors to mobile as
+ * ASSISTANT_RESPONSE. The substantive diagnostic (the sanitized advisory fallback
+ * / raw error) MUST NOT ride this section — it stays desktop-local via
+ * `logger.warn` (the WIRE is what the ZK invariant governs, NOT the local log
+ * file, which never leaves the machine). The invariant is stricter than
+ * ZK-on-wire (the mirror is E2E-encrypted regardless): only a BOUNDED enum label
+ * is surfaced on the wire, never the agent's diagnostic. Three labels only —
+ * quota-wall vs timeout vs generic failure — so no free-form detail can leak
+ * through. [#635] the `'quota_walled'`/`'failed'` strings are preserved VERBATIM
+ * from the prior 2-label version; only `'timed_out'` is new.
+ */
+export type BrainstormPanelFailureReason = 'quota_walled' | 'timed_out' | 'failed';
+export declare function brainstormPanelFailureNotice(reason: BrainstormPanelFailureReason): string;
+/**
+ * Compose the panel brief fed to each frontier agent: the typed-store
+ * "idea-so-far + open-questions" projection (rendered by
+ * `renderRehydratedSessionContext(role:'brainstorm')`, so it carries prior
+ * attributed panel turns) as a labeled PREFIX, then the current request. The
+ * projection is PRIOR context only — the current turn is authored into the store
+ * AFTER this turn completes (the mirror chokepoint), so there is no overlap.
+ *
+ * Empty `priorContext` (fresh session / unverifiable chain — fail-closed to
+ * NOTHING) degrades to just the request, exactly as today.
+ */
+export declare function composeBrainstormPanelBrief(input: {
+    priorContext: string;
+    requestBrief: string;
+}): string;