@quantiya/codevibe-codex-plugin 2.0.6 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.d.ts

@@ -1,6 +1,7 @@
 import { AppSyncClient } from '../appsync';
 import { Session } from '../types';
 import { Mode, Tier } from './types';
+import { type ModeSelectionDeps } from './mode-selection';
 import { type RunOrchestrationShellArgs } from './index';
 import { type ShellEventEmit } from './emit-shell-event';
 import { BackendPlannerClient, PlannerCacheLayer, PlannerHealthMachine, type LocalGemmaAdvisoryRunner, type LocalGemmaPlannerRunner } from '../planner';
@@ -15,46 +16,13 @@ import { type VerdictClassifier } from '../reviewer/verdict-classifier';
 import { type LocalModelArtifactConfig, type LocalModelCommand, type LocalModelEntitlement, type LocalModelStore } from '../local-model/manager';
 import { type LocalModelState } from '../local-model/state';
 /**
- * CP-1.b IMPL r5 H-1 — Sentinel error thrown by the stub-session
- * planner adapter. `handleShellUserInput` catches this typed class and
- * routes it through the explicit error renderer (SLASH_OUTPUT) so the
- * user sees an actionable message in the conversation pane instead of
- * a silent log line. Stub sessions (sessionId prefix `cp1a-local-` or
- * empty `encryptedKeys`) cannot reach the Lambda — `encryptedKeys` is
- * missing, the keychain resolver returns null, and the planner client
- * throws "session key unresolved" deep inside classify(). Surfacing
- * that as a typed error at the adapter boundary is cleaner than the
- * generic Error from `BackendPlannerClient.classify()`.
+ * Sentinel error rendered by the shell when the configured local planner
+ * runtime is unavailable. Session bootstrap failures are handled before the
+ * TUI opens and never use this planner-level error path.
  */
 export declare class PlannerUnavailableError extends Error {
     constructor(msg: string);
 }
-/**
- * CP-1.b IMPL r5 H-1 — Stub-session planner adapter.
- *
- * CP-1.a still ships a fake `cp1a-local-*` session with no
- * `encryptedKeys[]`. The production `BackendPlannerClient` cannot
- * classify against that session — the Lambda requires E2E-encrypted
- * payloads, which requires the session key, which the keychain
- * resolver cannot derive without `encryptedKeys`.
- *
- * Rather than wire up the production stack and let it fail with a
- * generic "session key unresolved" Error deep inside classify(), we
- * detect stub sessions at bootstrap and construct this adapter, which
- * throws a typed `PlannerUnavailableError` on classify(). The shell's
- * `handleShellUserInput` catches this and renders an actionable
- * message to the user (`PLANNER_UNAVAILABLE: <reason>`). CP-1.c lands
- * the real session bootstrap (resumeOrCreateSession + AppSync) and
- * this adapter is no longer wired in.
- */
-export declare class PlannerUnavailableAdapter implements PlannerAdapter {
-    private readonly reason;
-    private activeSessionId;
-    constructor(reason: string);
-    classify(_input: PlannerInput): Promise<PlannerDecision>;
-    probe(): Promise<PlannerProbeResult>;
-    setActiveSession(sessionId: string | null): void;
-}
 /**
  * Local-LLM planner placeholder for the Gemma QAT migration slice. This adapter
  * is intentionally local-only: it never calls AppSync planner mutations or any
@@ -68,21 +36,38 @@ export declare class LocalModelPlannerUnavailableAdapter implements PlannerAdapt
     probe(): Promise<PlannerProbeResult>;
     setActiveSession(_sessionId: string | null): void;
 }
-/**
- * CP-1.b IMPL r5 H-1 — Detect a CP-1.a stub session. Two signals:
- *   (a) `sessionId` starts with `cp1a-local-` (the
- *       `buildStubSession()` prefix).
- *   (b) `session.encryptedKeys` is empty / missing (any session
- *       lacking E2E keys cannot route through the Lambda).
- *
- * Either signal triggers the stub-session adapter. The (b) gate is
- * a defensive fallback for the case where CP-1.c starts a real
- * session bootstrap but `prepareSessionEncryption()` returns null
- * (no device keys registered): the planner is genuinely unavailable
- * until the user registers a device key.
- */
-export declare function isStubSession(session: Session): boolean;
-export declare function buildStubSessionShellArgs(args: Omit<RunOrchestrationShellArgs, 'disableStructuralContextRefresh'>): RunOrchestrationShellArgs;
+export type OrchestrationSessionBootstrapFailureKind = 'auth_required' | 'backend_unavailable' | 'encryption_unavailable' | 'session_limit' | 'session_create_failed';
+/** An orchestration shell cannot exist without an admitted encrypted session. */
+export declare class OrchestrationSessionBootstrapError extends Error {
+    readonly kind: OrchestrationSessionBootstrapFailureKind;
+    readonly cause?: unknown;
+    constructor(kind: OrchestrationSessionBootstrapFailureKind, message: string, cause?: unknown);
+}
+export declare function classifyOrchestrationSessionBootstrapError(error: unknown): OrchestrationSessionBootstrapError;
+export declare class CliAuthenticationError extends Error {
+    readonly kind: 'auth_required' | 'auth_unavailable' | 'credential_storage_unavailable';
+    readonly cause?: unknown;
+    constructor(kind: 'auth_required' | 'auth_unavailable' | 'credential_storage_unavailable', message: string, cause?: unknown);
+}
+/** Subscription verification is mandatory before either product mode starts. */
+export declare class CliEntitlementError extends Error {
+    readonly kind: "entitlement_unavailable";
+    readonly cause?: unknown;
+    constructor(message: string, cause?: unknown);
+}
+/** Both Companion and Orchestration require a verified signed-in account. */
+export declare function requireCliAuthentication(client: Pick<AppSyncClient, 'authenticateWithStoredTokens' | 'getLastAuthFailureKind'>): Promise<void>;
+export interface ParsedCliArgs {
+    agent?: 'CLAUDE' | 'CODEX' | 'ANTIGRAVITY';
+    help: boolean;
+    passthrough: string[];
+}
+export declare class CliUsageError extends Error {
+    constructor(message: string);
+}
+export declare function parseCliArgs(argv: string[]): ParsedCliArgs;
+/** Resolve the product mode without opening the mode picker for --agent. */
+export declare function resolveLaunchMode(args: Pick<ParsedCliArgs, 'agent'>, tier: Tier, deps?: ModeSelectionDeps): Promise<Mode>;
 /**
  * CP-1.f §3.C.19 — resolve a REAL backend session for the orchestration loop
  * (closes #513). When authenticated:
@@ -96,19 +81,45 @@ export declare function buildStubSessionShellArgs(args: Omit<RunOrchestrationShe
  *      `Session.encryptedKeys` (can decrypt encProposal/verdict) AND the local
  *      key cache is warm. Stage-1 FIX 1 — replaces the prior crypto-dropping
  *      `createSession` reimplementation that hung the loop ("no session key").
- * Falls back to `buildStubSession()` when unauthenticated / offline / on any
- * error — the stub-session guards downstream keep that path fully usable.
+ * Authentication, encryption, and backend admission are hard prerequisites.
+ * Failures propagate to `main`, which exits before opening the shell.
  *
  * The tier is resolved here too (§3.C.19): a `CODEVIBE_TIER` env override wins
- * (the dev/dogfood lever), else `getSubscriptionStatus`, else FREE (fail-closed
- * — Orchestration Mode is never surfaced to Free).
+ * (the dev/dogfood lever), otherwise `getSubscriptionStatus` must succeed.
  */
 export declare function resumeOrCreateSession(appsyncClient: AppSyncClient, deps?: {
     resolveSessionIdFn?: (client: AppSyncClient) => Promise<string | null>;
+    /** Already verified by CLI startup; avoids a contradictory second lookup. */
+    tier?: Tier;
+    /** Claims lifecycle responsibility immediately after backend admission. */
+    onAdmitted?: (session: Session) => void;
 }): Promise<{
     session: Session;
     tier: Tier;
 }>;
+export declare function resolveCliTier(appsyncClient: AppSyncClient): Promise<Tier>;
+/** Production startup boundary: preserve actionable typed tier failures. */
+export declare function resolveCliTierForStartup(appsyncClient: AppSyncClient, writeError?: (message: string) => void): Promise<Tier | null>;
+export interface AdmittedSessionOwnershipController {
+    /** Synchronous admission edge; safe to call from the pending-ledger helper. */
+    onAdmitted(session: Session): void;
+    /** Run post-admission startup until the shell accepts teardown ownership. */
+    run<T>(launch: (acceptOwnership: () => void) => Promise<T>): Promise<T>;
+    /** Close a failed bootstrap and retire any session already admitted. */
+    abort(): Promise<void>;
+}
+/**
+ * Install lifecycle ownership before admission begins. The pending-create path
+ * calls `onAdmitted` immediately after response validation, before any further
+ * keychain or ledger await, closing the post-admission cleanup/signal window.
+ */
+export declare function createAdmittedSessionOwnershipController(appsyncClient: AppSyncClient): AdmittedSessionOwnershipController;
+/** Test/consumer convenience for a session that has already been admitted. */
+export declare function runWithAdmittedSessionOwnership<T>(args: {
+    appsyncClient: AppSyncClient;
+    session: Session;
+    launch: (acceptOwnership: () => void) => Promise<T>;
+}): Promise<T>;
 /**
  * CP-8 Slice C (#570) — parse a top-level `audit show <task-id> [--json]
  * [--session <id>]` subcommand from the raw argv. Returns null when the argv is
@@ -124,7 +135,6 @@ export interface ParsedAuditArgs {
 export declare function parseAuditArgs(argv: string[]): ParsedAuditArgs | null;
 export interface ParsedModelArgs {
     command: LocalModelCommand | 'help';
-    viaWithLocalModelFlag: boolean;
 }
 /**
  * Parse local-model meta commands before mode selection. These commands must
@@ -220,7 +230,7 @@ export declare function main(argv: string[]): Promise<number>;
  *
  * Exported for unit tests; production callers go through `main()`.
  */
-export declare function buildProductionPlannerStack(appsyncClient: AppSyncClient, emitter: (args: ShellEventEmit) => Promise<void>): {
+export declare function buildProductionPlannerStack(appsyncClient: AppSyncClient, emitter: (args: ShellEventEmit) => Promise<unknown>): {
     adapter: BackendPlannerClient;
     cache: PlannerCacheLayer;
     health: PlannerHealthMachine;
@@ -247,6 +257,11 @@ export interface BuildTeamLocalExecutorResult {
      * `BuildQuorumLoopExecutorResult.policyRejectionTap`).
      */
     policyRejectionTap: PolicyRejectionTap;
+    /**
+     * A1e (P3 slice-wiring REMAP) — the dispatch-context tap holder (see
+     * `BuildQuorumLoopExecutorResult.dispatchContextTap`).
+     */
+    dispatchContextTap: DispatchContextTap;
     /**
      * PHASE-589/469 W3.2 — the two-phase group-escalation decision deps (WITHOUT
      * the store; `runOrchestrationShell` completes it). Threaded into
@@ -288,6 +303,24 @@ export interface PolicyRejectionTap {
         recommendedRecovery: string;
     }) => void;
 }
+/**
+ * A1e (P3 slice-wiring REMAP) — the dispatch-context tap holder (mirrors
+ * `progressTap`). `cli.ts` builds it with an inert `fn` (returns `''` — no
+ * block); the QuorumLoop's `projectDispatchContext` calls
+ * `dispatchContextTap.fn(input)`, and `runOrchestrationShell` installs the
+ * real composer (`composeDispatchContextBlock` — the resolved `context_ref`
+ * slice + the fresh-only `repo_state` overview + the §8.3 background
+ * re-delegation hook) at startup, where the shell's generator/tier/session
+ * scope lives. Until then (and for non-loop sessions) the projection is
+ * inert and the implementor stdin is byte-identical to pre-A1e.
+ */
+export interface DispatchContextTap {
+    fn: (input: {
+        taskId: string;
+        agent: string;
+        roundNumber: number;
+    }) => Promise<string>;
+}
 /**
  * [Gemma classifier · D11 + §Wiring] Resolve the reviewer verdict classifier
  * threaded onto `QuorumLoopDeps.classifyVerdict`.
@@ -318,6 +351,11 @@ export interface BuildQuorumLoopExecutorResult {
      * (a classified `SHELL_ADVISORY`).
      */
     policyRejectionTap: PolicyRejectionTap;
+    /**
+     * A1e (P3 slice-wiring REMAP) — the dispatch-context tap holder. `cli.ts`
+     * threads it into `runOrchestrationShell`, which installs the real composer.
+     */
+    dispatchContextTap: DispatchContextTap;
 }
 /**
  * CP-1.f §3.C — Stage-2 r2 (Codex) FIX B. Construct the SINGLE-TASK QuorumLoop +
@@ -345,7 +383,7 @@ export interface BuildQuorumLoopExecutorResult {
 export declare function buildQuorumLoopExecutor(args: {
     appsyncClient: AppSyncClient;
     session: Session;
-    emitter: (args: ShellEventEmit) => Promise<void>;
+    emitter: (args: ShellEventEmit) => Promise<unknown>;
     /** CP-1.f LOCK RP-6 — host-detected agents threaded into the loop. */
     detectedAgents?: string[];
     /** #585 auto-continuation (Max) — the resolved tier, threaded to the loop. */
@@ -357,17 +395,6 @@ export declare function buildQuorumLoopExecutor(args: {
      */
     classifyRunner?: LocalGemmaPlannerRunner | null;
 }): Promise<BuildQuorumLoopExecutorResult>;
-/**
- * PHASE-589+469 W2 (#TC-5) — map an LE hook-bridge event to the chokepoint's
- * `ShellEventEmit`. The team-result summary (`ASSISTANT_RESPONSE`, from
- * `emitGroupConvergence`) KEEPS its type AND forwards `content` (the
- * light-markdown digest the phone renders); `LOCAL_AUTHORITY_REFUSAL` maps 1:1;
- * every other type is coerced to `NOTIFICATION` (audit fallback — those never
- * occur on the team paths). Exported so the #TC-5 test drives the REAL mapping
- * (not a reproduction): a regression that dropped the `ASSISTANT_RESPONSE` type
- * or its `content` — which would silently make the mobile summary dead — is
- * caught here.
- */
 export declare function mapTeamLeEventToShellEmit(e: Parameters<LEEmitShellEventFn>[0]): ShellEventEmit;
 /**
  * Construct the team-mode LocalExecutorImpl + the store-tap holder. Returns the
@@ -379,7 +406,7 @@ export declare function mapTeamLeEventToShellEmit(e: Parameters<LEEmitShellEvent
 export declare function buildTeamLocalExecutor(args: {
     appsyncClient: AppSyncClient;
     session: Session;
-    emitter: (args: ShellEventEmit) => Promise<void>;
+    emitter: (args: ShellEventEmit) => Promise<unknown>;
     initialScope: AuthorityScope;
     /** CP-1.f LOCK RP-6 — host-detected agents threaded into the loop. */
     detectedAgents?: string[];