@quantiya/codevibe-codex-plugin 2.0.6 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/credential-broker/oauth-account-lock.d.ts

@@ -0,0 +1,150 @@
+/** Liveness of a recorded lock owner (only `dead` is ever reclaimed). */
+export type OwnerLiveness = "alive" | "dead" | "unknown";
+/** The `owner.json` record written once per acquisition. */
+export interface LockOwner {
+    pid: number;
+    host: string;
+    /** Random per-ACQUISITION nonce — the fence for every destructive/heartbeat op. */
+    ownerId: string;
+    /** Acquisition time (ISO), for diagnostics. */
+    startedAt: string;
+}
+export interface OAuthAccountLockOptions {
+    /** The canonical lockdir path (keyed to the OAuth account). */
+    lockDir: string;
+    /** Staleness TTL (» max critical-section time). Default 30s. */
+    ttlMs?: number;
+    /** Heartbeat interval (« TTL). Default 5s. */
+    heartbeatMs?: number;
+    /** Contention deadline. Default 60s. */
+    maxWaitMs?: number;
+    /**
+     * OWNERLESS-strand grace (F6). A lockdir present with NO readable `owner.json`
+     * is a crash strand (mkdir succeeded but the owner write / rmdir did not) that is
+     * FENCED-recovered once its mtime has been idle THIS long. Default = 2×TTL — far
+     * larger than the sub-millisecond mkdir→owner.json write window, so a live
+     * mid-acquire is never mistaken for a strand. Set high to disable recovery in
+     * practice.
+     */
+    ownerlessGraceMs?: number;
+    /** Base retry backoff. Default 25ms (capped 1s). */
+    backoffMs?: number;
+    now?: () => number;
+    delay?: (ms: number) => Promise<void>;
+    /** This process's pid (injectable for tests). */
+    pid?: number;
+    /** This host's id (injectable for tests). */
+    hostId?: string;
+    /** Liveness probe (injectable for tests). Default = same-host `process.kill(pid,0)`. */
+    isProcessAlive?: (pid: number, host: string) => OwnerLiveness;
+    /** Per-acquisition nonce generator (injectable for tests). */
+    randomId?: () => string;
+    /** `utimes(lockdir)` heartbeat op (injectable so tests can observe/spy). */
+    utimesFn?: (dir: string) => Promise<void>;
+    /** Disable the auto-interval heartbeat (tests drive ticks manually). */
+    disableAutoHeartbeat?: boolean;
+}
+/** A held lock. `release` is one-shot + idempotent. */
+export interface LockHandle {
+    readonly ownerId: string;
+    /**
+     * Reassert-before-mutation (§5 primary revocation-wins backstop): re-read the
+     * canonical `owner.json` and return true iff `ownerId === ours`. The broker
+     * calls this IMMEDIATELY before EVERY keychain `setPassword`/`deletePassword`,
+     * aborting fail-closed on a false result — independently defeating any
+     * displacement that COMPLETED before the re-read.
+     */
+    reassertOwnership(): Promise<boolean>;
+    /** One-shot release: cancel+join heartbeat, then unlink+rmdir under `ownerId` re-assert. */
+    release(): Promise<void>;
+    /** TEST-ONLY: run one heartbeat tick synchronously (simulates a queued `utimes`). */
+    _tickForTest(): Promise<void>;
+}
+/** The portable cross-process OAuth-account lock (§5 / AMEND-1). */
+export declare class OAuthAccountLock {
+    private readonly lockDir;
+    private readonly ownerFile;
+    private readonly reclaimGuardDir;
+    private readonly ttlMs;
+    private readonly heartbeatMs;
+    private readonly maxWaitMs;
+    private readonly ownerlessGraceMs;
+    private readonly backoffMs;
+    private readonly now;
+    private readonly delayFn;
+    private readonly pid;
+    private readonly hostId;
+    private readonly isProcessAlive;
+    private readonly randomId;
+    private readonly utimesFn;
+    private readonly disableAutoHeartbeat;
+    constructor(opts: OAuthAccountLockOptions);
+    /**
+     * Acquire the lock (bounded by `maxWaitMs`). Resolves a {@link LockHandle} on
+     * success; REJECTS fail-closed on: an unwritable lockdir root, a contention
+     * timeout (live/ambiguous/ownerless holder), or a dead/stranded reclaim guard.
+     * ZERO side effects on the persisted bundle on any fail-closed path.
+     */
+    acquire(): Promise<LockHandle>;
+    /** Whether the EXISTING lockdir holder is reclaimable (dead), an ownerless strand
+     *  (F6), or must be waited on. */
+    private classifyExistingHolder;
+    /**
+     * Reclaim a stale, provably-dead lockdir under the SEPARATE reclaim guard.
+     * Returns a fresh {@link LockHandle} on success, or `null` if the reclaim was
+     * aborted (a sibling already reclaimed, or the guard is held). Throws only if
+     * the guard is dead/stranded (fail-closed → offline cleanup).
+     */
+    private tryReclaim;
+    /**
+     * FENCED recovery of a stranded OWNERLESS lockdir (F6) — the same reclaim-guard
+     * mutex + rename primitive as the dead-owner path, so at most one recoverer ever
+     * proceeds and no live successor is displaced. Returns a fresh {@link LockHandle}
+     * on success, or `null` if aborted (guard held/stranded, an owner appeared, or the
+     * dir freshened/vanished under the guard).
+     *
+     * RESIDUAL (documented): the ONE window this cannot fully close is a live acquirer
+     * OS-suspended (SIGSTOP) or GC-frozen for LONGER than `ownerlessGraceMs` precisely
+     * within the sub-millisecond gap between its `mkdir(lockDir)` and its
+     * `writeFile(owner.json)`. If that acquirer's owner-write lands AFTER our rename +
+     * fresh mkdir, it overwrites our `owner.json`; our `reassertOwnership()` (the
+     * broker's before-every-mutation backstop) then returns false and we abort — no two
+     * committed writers for vendor-key callers. For the keychain file-store lock (which
+     * does not reassert) this leaves a vanishingly-narrow two-writer window, strictly
+     * better than the previous PERMANENT strand that broke all auth until offline
+     * cleanup. The grace (default 2×TTL) makes the precondition astronomically unlikely.
+     */
+    private tryReclaimOwnerless;
+    /** Remove a renamed-away ownerless strand (it holds no owner.json by definition). */
+    private removeOwnerlessStaleDir;
+    /** Write `owner.json`, start the heartbeat, and build the handle. */
+    private onAcquired;
+    private tryMkdir;
+    /**
+     * Tri-state read of a lockdir's owner.json (R4-2). Only a genuine ENOENT is
+     * `absent`; a present-but-unreadable (EACCES/EIO/…) or unparseable/invalid file is
+     * `unreadable` (fail closed — never treated as ownerless or dead).
+     */
+    private readOwnerState;
+    /**
+     * Boolean-owner accessor for the non-recovery paths (heartbeat tick, reassert,
+     * release, dead-owner reclaim, stale-dir cleanup): an `unreadable` owner maps to
+     * `null`, which is the SAFE direction for every one of those (reassert→false→abort;
+     * tick→skip; release→don't touch; dead-reclaim re-read→abort). The
+     * ownerless-recovery path uses `readOwnerState` directly so it can tell `absent`
+     * (recoverable) from `unreadable` (must wait).
+     */
+    private readOwner;
+    private lockDirAge;
+    private removeStaleDir;
+    private rmdirQuiet;
+    private backoff;
+}
+/**
+ * Default lockdir path for a provider's OAuth account — a stable per-host path
+ * under `~/.codevibe/locks/` (all C4 brokers are same-host, so a shared
+ * filesystem path gives cross-process exclusion). NOT under the substrate
+ * mount (I1) — this is host-side broker coordination only.
+ */
+export declare function defaultOAuthLockDir(account: string): string;
+export declare function createOAuthAccountLock(opts: OAuthAccountLockOptions): OAuthAccountLock;

package/node_modules/@quantiya/codevibe-core/dist/credential-broker/oauth-refresh.d.ts

@@ -0,0 +1,72 @@
+import type { VendorOAuthBundle } from "./types";
+/**
+ * The injected refresh transport (§5). Separate from the model `UpstreamClient`
+ * (different content type, form body, token endpoint). Widened to accept an
+ * optional `signal` (the stop-lifecycle end-to-end cancellation contract).
+ * Resolves `{status, rawBody, contentType}`; REJECTS only on a transport error
+ * OR a 3xx redirect (redirect confinement).
+ */
+export interface RefreshTransport {
+    post(args: {
+        url: string;
+        body: string;
+        contentType: string;
+        signal?: AbortSignal;
+    }): Promise<RefreshTransportResponse>;
+}
+export interface RefreshTransportResponse {
+    status: number;
+    /** Raw response text (bounded); parsed by the classifier, NEVER logged. */
+    rawBody: string;
+    /** Lowercased response `content-type`, if any. */
+    contentType?: string;
+    /**
+     * True iff the body exceeded the bounded-read cap and was NOT materialized
+     * (transport streamed at most the cap + cancelled). The classifier treats an
+     * oversized body as transient WITHOUT parsing (it was never fully read).
+     */
+    oversized?: boolean;
+}
+/** The outcome of a refresh attempt — drives the reactive/proactive posture. */
+export type RefreshOutcome = {
+    kind: "rotated";
+    bundle: VendorOAuthBundle;
+} | {
+    kind: "permanent";
+    reason: string;
+} | {
+    kind: "transient";
+    reason: string;
+};
+/**
+ * The production fetch-backed {@link RefreshTransport}. Mirrors
+ * `FetchUpstreamClient`'s hardened posture for the NEW secret surface.
+ */
+export declare class FetchRefreshTransport implements RefreshTransport {
+    private readonly opts;
+    constructor(opts?: {
+        fetchFn?: typeof fetch;
+        timeoutMs?: number;
+    });
+    post(args: {
+        url: string;
+        body: string;
+        contentType: string;
+        signal?: AbortSignal;
+    }): Promise<RefreshTransportResponse>;
+}
+/** Build the OAuth2 refresh-grant form body (`refresh_token` is a secret). */
+export declare function buildRefreshBody(refreshToken: string): string;
+/**
+ * Perform ONE token refresh against the pinned endpoint and classify the
+ * result. On success returns a `rotated` bundle that already applies the §5
+ * write-through merge rule (`refresh_token`/`id_token` ?? current;
+ * `account_id` from current; `last_refresh` = now) — persistence + cache +
+ * generation advance are the caller's job (under the cross-broker lock).
+ *
+ * `now` supplies the `last_refresh` timestamp (injectable for tests).
+ */
+export declare function refreshOAuthToken(current: VendorOAuthBundle, transport: RefreshTransport, opts?: {
+    signal?: AbortSignal;
+    now?: () => Date;
+}): Promise<RefreshOutcome>;

package/node_modules/@quantiya/codevibe-core/dist/credential-broker/types.d.ts

@@ -1,3 +1,5 @@
+import type * as http from "node:http";
+import type { Readable } from "node:stream";
 /**
  * The vendor providers Rung 1 brokers. Claude + Codex (Anthropic +
  * OpenAI) only — Gemini stays out of the substrate (§6 Q4, agy is
@@ -13,13 +15,15 @@ export type BrokerRouteMethod = "POST" | "GET";
  */
 export interface BrokerRoute {
     method: BrokerRouteMethod;
-    path: "/v1/messages" | "/v1/responses" | "/healthz";
+    path: "/v1/messages" | "/v1/responses" | "/healthz" | "/models" | "/v1/models";
     /** Whether the route requires a valid agent→broker token. */
     auth: "broker_token" | "none";
 }
 /**
- * The broker's locked route table — exactly three routes (§3.2). Any
- * other method+path → 403.
+ * The broker's locked route table (§3.2). Any other method+path → 403.
+ * `/models` and `/v1/models` are local compatibility metadata endpoints for
+ * Codex CLI provider preflight; they never forward to upstream or require a
+ * vendor credential.
  */
 export declare const BROKER_ROUTES: readonly BrokerRoute[];
 /**
@@ -34,8 +38,8 @@ export type BrokerStatus = 200 | 400 | 401 | 403 | 502 | 503;
  * the §3.2 contract is "everything else → 403", so the type MUST be able
  * to represent a *disallowed* route for the W1 gateway's `handle()` to be
  * conformance-testable (send `/v1/admin` / `DELETE` → assert 403). Only
- * the three `(method, path)` pairs in `BROKER_ROUTES` are forwarded; every
- * other request fails closed at 403.
+ * the model POST `(method, path)` pairs in `BROKER_ROUTES` are forwarded;
+ * every other request fails closed at 403, except local metadata/health routes.
  */
 export interface BrokerRequest {
     method: string;
@@ -62,7 +66,31 @@ export interface BrokerResponse {
     status: BrokerStatus;
     /** Upstream model-bound JSON body on 200; an error envelope otherwise. */
     body?: unknown;
+    /**
+     * Discriminant guard (PHASE-643 §3.0): a buffered `BrokerResponse` NEVER
+     * carries `kind`. A streamed 200-SSE forward that already wrote to the sink
+     * returns {@link BrokerHandled} (`{kind:"handled"}`) instead, so `"kind" in
+     * result` narrows the two apart in `handleHttp` (strict-TS valid).
+     */
+    kind?: never;
+}
+/**
+ * PHASE-643 §3.0 — the sentinel a 200-SSE forward returns AFTER it has streamed
+ * the response into the caller-provided sink (headers written + body piped). The
+ * HTTP adapter must NOT then write a second response; `"kind" in result` narrows
+ * this from a {@link BrokerResponse}.
+ */
+export interface BrokerHandled {
+    readonly kind: "handled";
 }
+/**
+ * PHASE-643 §3.0 — the minimal response surface the broker streams a 200-SSE
+ * forward into. `handleHttp` passes the node `http.ServerResponse`; non-HTTP
+ * callers pass nothing (buffered fallback). Restricted to the members the
+ * streaming write uses (`writeHead`/`headersSent`/`destroy`) plus the writable-
+ * stream surface `pipeline()` drives to completion.
+ */
+export type ResponseSink = Pick<http.ServerResponse, "writeHead" | "headersSent" | "destroy"> & NodeJS.WritableStream;
 /**
  * The lifecycle surface of the per-session local broker daemon (§3.2).
  * The LE starts one broker per session on `127.0.0.1:<ephemeral>` and
@@ -77,14 +105,72 @@ export interface ModelGatewayBroker {
     healthz(): Promise<boolean>;
     /** Handle one model-gateway request (the §3.2 route surface). */
     handle(req: BrokerRequest): Promise<BrokerResponse>;
+    /**
+     * PHASE-643 §3.0 — the streaming overload: a 200 `text/event-stream` response
+     * is proxied incrementally into `sink` and resolves {@link BrokerHandled};
+     * every other disposition (and a 200-SSE WITHOUT a sink) resolves a buffered
+     * {@link BrokerResponse}.
+     */
+    handle(req: BrokerRequest, sink: ResponseSink): Promise<BrokerResponse | BrokerHandled>;
     /** Tear down; zeroize the in-process upstream credential (§3.3). */
     stop(): Promise<void>;
 }
+/**
+ * The C4 ChatGPT-subscription OAuth bundle (PHASE-626 §3/§5) — the token
+ * material copied out of Codex's `~/.codex/auth.json` `tokens` object plus
+ * `last_refresh`. Stored (as JSON) under the SEPARATE keychain account
+ * `vendor-oauth-openai`, deliberately distinct from the `vendor-key-openai`
+ * (C3) account. Structure pinned against Codex CLI 0.144.4 (§13 OQ-2):
+ * `{auth_mode, tokens:{id_token, access_token, refresh_token, account_id}, last_refresh}`.
+ */
+export interface VendorOAuthBundle {
+    /** OAuth access token — `Authorization: Bearer <access_token>` upstream. */
+    access_token: string;
+    /** OAuth refresh token — the refresh-engine input; a SECOND secret (§5). */
+    refresh_token: string;
+    /** ChatGPT account id — the `ChatGPT-Account-Id` header (§13 OQ-1). */
+    account_id: string;
+    /**
+     * RFC3339 timestamp of the last successful refresh (advances on EVERY
+     * refresh success — §5 write-through merge rule). Gates the proactive-age
+     * threshold. NOT a secret.
+     */
+    last_refresh: string;
+    /** Optional id_token (carried through refreshes; not credential-bearing upstream). */
+    id_token?: string;
+}
+/**
+ * The credential class resolved by the broker's precedence engine (§5).
+ * The raw-string assumption of C1/C2/C3 does NOT extend to C4 — the bundle
+ * is a structured secret — so the resolved credential is DISCRIMINATED so
+ * every consumer (header builder, self-cred guard, fingerprint, upstream
+ * override) is class-aware (§5 "every consumer is class-aware").
+ *
+ * - `api_key`           — C1 `sk-ant-api…` / C3 `sk-…` (raw string).
+ * - `subscription_token`— C2 `sk-ant-oat…` (raw string; Bearer-only + C2 beta).
+ * - `oauth_bundle`      — C4 ChatGPT-subscription bundle (structured).
+ */
+export type ResolvedCredential = {
+    readonly class: "api_key";
+    readonly material: string;
+} | {
+    readonly class: "subscription_token";
+    readonly material: string;
+} | {
+    readonly class: "oauth_bundle";
+    readonly material: VendorOAuthBundle;
+};
 /**
  * The provider-scoped vendor-key storage API (§3.3) — [NEW], owner W1.
  * Reuses the existing keychain backend (OS keyring + file fallback).
  * Signatures only in W0; the implementation (keychain accounts
  * `vendor-key-<provider>`) lands in W1.
+ *
+ * PHASE-626 §5 widens this interface with the C4 OAuth-bundle methods +
+ * `clearVendorKey` (Stage-2 R1 Codex M-8 / R2 agy M-1). ALL apply the SAME
+ * keychain-only fail-closed gate as `get/setVendorKey`, factored through one
+ * shared gate helper so the two accounts (`vendor-key-*` / `vendor-oauth-*`)
+ * cannot drift.
  */
 export interface VendorKeyStore {
     /**
@@ -96,6 +182,25 @@ export interface VendorKeyStore {
     getVendorKey(provider: VendorProvider): Promise<string | null>;
     /** Persist the user's vendor key for `provider` (one-time setup step). */
     setVendorKey(provider: VendorProvider, key: string): Promise<void>;
+    /**
+     * Delete the user's C3-class vendor key for `provider` (Stage-2 R1 Codex
+     * M-8). Behind the SAME keychain-only gate as `setVendorKey` so `clear
+     * --class api-key` has a store-owned, gate-respecting deletion rather than
+     * a CLI-side keychain reach-around. Returns true iff a key was removed.
+     */
+    clearVendorKey(provider: VendorProvider): Promise<boolean>;
+    /**
+     * Read the C4 OAuth bundle for `provider` (§5). Same keychain-only gate as
+     * `getVendorKey`: `null` on the file backend (fail closed, no plaintext read).
+     */
+    getVendorOAuthBundle(provider: VendorProvider): Promise<VendorOAuthBundle | null>;
+    /**
+     * Persist the C4 OAuth bundle for `provider` as ONE atomic whole-bundle
+     * `setPassword` (§7 no torn tuple). Same keychain-only gate as `setVendorKey`.
+     */
+    setVendorOAuthBundle(provider: VendorProvider, bundle: VendorOAuthBundle): Promise<void>;
+    /** Delete the C4 OAuth bundle for `provider`. Returns true iff one was removed. */
+    clearVendorOAuthBundle(provider: VendorProvider): Promise<boolean>;
 }
 /**
  * The agent→broker token (§3.3): per-session, broker-minted, opaque,
@@ -109,17 +214,47 @@ export interface BrokerToken {
     readonly expiresAtMs: number;
 }
 /**
- * The result of a broker→vendor upstream call. The broker maps upstream
- * status to the agent-facing `BrokerStatus` (§3.2): an upstream 401/403
- * (bad/expired vendor key) → 502 (NOT a pass-through), every other status
- * carries through.
+ * The result of a broker→vendor upstream call (PHASE-643 §3.1). The client
+ * resolves at HEADERS — `status` + lowercased `headers` are known before the
+ * body is read — and the body is then consumed EXACTLY ONCE: either incrementally
+ * as a stream (the 200-SSE forward, §3.3) OR fully-buffered as text (every other
+ * disposition, §3.2). Both consumers are abortable by `stop()` (LOCK #643-2). The
+ * broker maps upstream status to the agent-facing `BrokerStatus` (§3.2): an
+ * upstream 401/403 (bad/expired vendor key) → 502 (NOT a pass-through), every
+ * other status carries through.
+ *
+ * LOCK #643-1 — one-shot body: `bodyStream()` and `readText()` are mutually
+ * exclusive AND single-use; a second or mixed call THROWS. This eliminates the
+ * dual-model ambiguity (a buffered `.body` alongside a stream) the phase closes.
  */
-export interface UpstreamResponse {
-    /** Raw upstream HTTP status. */
+export interface UpstreamResult {
+    /** Raw upstream HTTP status (known at headers, before the body is read). */
     status: number;
-    /** Parsed JSON body (model-bound). */
-    body?: unknown;
+    /** Upstream response headers with LOWERCASED keys (e.g. `content-type`). */
+    headers: Readonly<Record<string, string>>;
+    /**
+     * Consume the body ONCE as a Node stream — the 200-SSE incremental-forward
+     * path (§3.3). Destroying the returned stream cancels the upstream fetch. XOR
+     * with {@link readText} (LOCK #643-1).
+     */
+    bodyStream(): Readable;
+    /**
+     * Consume the body ONCE as fully-buffered text — every non-streamed
+     * disposition (non-SSE 200, any non-200, a 401 drain; §3.2). Has its OWN
+     * full-read timeout AND composes the broker abort signal, so a stalled read
+     * cancels immediately. XOR with {@link bodyStream} (LOCK #643-1).
+     */
+    readText(): Promise<string>;
 }
+/**
+ * @deprecated PHASE-643 renamed `UpstreamResponse` → {@link UpstreamResult}. The
+ * alias preserves the exported SYMBOL for type importers, but NOT the legacy
+ * `{status, body?}` SHAPE — implementors of {@link UpstreamClient.post} MUST
+ * migrate to the one-shot body surface (a TS implementor of the old shape fails
+ * to compile; a declared SemVer-major break — core 2.0 ships on the `@next`
+ * channel and every implementor is in-repo).
+ */
+export type UpstreamResponse = UpstreamResult;
 /**
  * The broker→vendor upstream HTTP client (§3.3/§3.4). INJECTED so W1 tests
  * use a stub (no real network). The real fetch-backed client lands when
@@ -129,13 +264,26 @@ export interface UpstreamClient {
     /**
      * POST the canonical request upstream. `headers` already includes the
      * synthesized vendor/version headers AND the injected upstream
-     * credential (the caller adds the credential header). Resolves with the
-     * upstream status + body; rejects only on a transport/network error
-     * (which the broker maps to its forward-error path).
+     * credential (the caller adds the credential header). Resolves at HEADERS
+     * with the upstream status + lowercased headers; the body is consumed ONCE
+     * via {@link UpstreamResult.bodyStream}/{@link UpstreamResult.readText}
+     * (PHASE-643 §3.1). Rejects only on a transport/network error (which the
+     * broker maps to its forward-error path).
+     *
+     * PHASE-626 §5 stop-lifecycle (Stage-2 R4 Codex #1): `signal` is the
+     * SECOND pinned-interface widening (alongside the new `VendorKeyStore`
+     * methods). The broker owns the outer credential-bearing frame, so it
+     * MUST be able to abort the in-flight model-forward on `stop()` drain-
+     * timeout — registering only `FetchUpstreamClient`'s PRIVATE timeout
+     * controller is unreachable from the broker. `FetchUpstreamClient`
+     * composes this broker signal with its internal timeout controller so
+     * either can abort the request. Optional so the W1 stub + older callers
+     * still satisfy the interface.
      */
     post(args: {
         url: string;
         headers: Readonly<Record<string, string>>;
         body: unknown;
-    }): Promise<UpstreamResponse>;
+        signal?: AbortSignal;
+    }): Promise<UpstreamResult>;
 }

package/node_modules/@quantiya/codevibe-core/dist/credential-broker/upstream-client.d.ts

@@ -1,4 +1,4 @@
-import type { UpstreamClient, UpstreamResponse } from "./types";
+import type { UpstreamClient, UpstreamResult } from "./types";
 /**
  * The production fetch-backed {@link UpstreamClient}. Constructed once per
  * broker session by the LE and injected into `LocalModelGatewayBroker`
@@ -16,5 +16,6 @@ export declare class FetchUpstreamClient implements UpstreamClient {
         url: string;
         headers: Readonly<Record<string, string>>;
         body: unknown;
-    }): Promise<UpstreamResponse>;
+        signal?: AbortSignal;
+    }): Promise<UpstreamResult>;
 }

package/node_modules/@quantiya/codevibe-core/dist/credential-broker/vendor-key-store.d.ts

@@ -1,4 +1,4 @@
-import type { VendorKeyStore, VendorProvider } from "./types";
+import type { VendorKeyStore, VendorOAuthBundle, VendorProvider } from "./types";
 /**
  * Keychain-backed implementation of {@link VendorKeyStore} (§3.3). Reads
  * the same keychain service the rest of CodeVibe uses (`getConfig()
@@ -51,4 +51,35 @@ export declare class KeychainVendorKeyStore implements VendorKeyStore {
      * per-session into broker memory.
      */
     setVendorKey(provider: VendorProvider, key: string): Promise<void>;
+    /**
+     * Delete the C3-class vendor key (Stage-2 R1 Codex M-8). Behind the SAME
+     * keychain-only gate as `setVendorKey`: on the file backend it FAILS CLOSED
+     * (throws, does NOT delete from `~/.codevibe`) rather than silently touching
+     * the plaintext store. Returns true iff a key was actually removed.
+     */
+    clearVendorKey(provider: VendorProvider): Promise<boolean>;
+    /**
+     * Read the C4 OAuth bundle (§5). KEYCHAIN-ONLY on the read side exactly like
+     * `getVendorKey`: on the file backend returns `null` (fail closed, no
+     * plaintext read) so a legacy / manually-placed bundle is never sourced.
+     * A corrupted (non-JSON) stored value is treated as absent (`null`) — the
+     * broker then fails closed rather than trusting a torn value.
+     */
+    getVendorOAuthBundle(provider: VendorProvider): Promise<VendorOAuthBundle | null>;
+    /**
+     * Persist the C4 OAuth bundle as ONE atomic whole-bundle `setPassword`
+     * (§7 — no torn tuple: access/refresh/account_id/last_refresh are written
+     * together or not at all). Same keychain-only gate as `setVendorKey`: FAILS
+     * CLOSED on the file backend. The token material is never logged.
+     */
+    setVendorOAuthBundle(provider: VendorProvider, bundle: VendorOAuthBundle): Promise<void>;
+    /**
+     * Delete the C4 OAuth bundle. Behind the SAME keychain-only gate: on the
+     * file backend it FAILS CLOSED (throws). Returns true iff one was removed.
+     * Clearing the bundle is a revocation — the broker must hold the §5 cross-
+     * process OAuth-account lock around this call so a concurrent refresh can
+     * not resurrect it (revocation wins); the store method itself is the
+     * gate-respecting primitive the locked caller uses.
+     */
+    clearVendorOAuthBundle(provider: VendorProvider): Promise<boolean>;
 }

package/node_modules/@quantiya/codevibe-core/dist/crypto/__tests__/encrypt-for-emit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/crypto/__tests__/open-prompt-id.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/crypto/encrypt-for-emit.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The on-wire shape a companion emits to AppSync `createEvent`.
+ */
+export interface EncryptedEmitPayload {
+    content: string;
+    metadata: any;
+    isEncrypted: boolean;
+}
+/**
+ * (#638) Decide how a mobile-visible event should be emitted.
+ *
+ * Returns the on-wire `{ content, metadata, isEncrypted }`:
+ *  - encryption state UNRESOLVED (`encryptionResolved === false`) → returns `null`:
+ *    the caller MUST drop the event (FAIL-CLOSED). Until resumeOrCreateSession has
+ *    set the session's encryption state we do NOT yet know whether the session is
+ *    encrypted, and `sessionKey` may still be a STALE prior-session key — so
+ *    treat unknown as encrypted and never emit plaintext. (#638 F1: closes the
+ *    plaintext-for-encrypted RACE where a hook event landing during the bootstrap
+ *    await, or a transient/generic resume error, left `sessionIsEncrypted=false`
+ *    and leaked cleartext.)
+ *  - `sessionKey` present → AES-256-GCM ciphertext + `{ encrypted: <meta> }`
+ *    (isEncrypted=true). A `null`/`undefined` `plainMetadata` passes through
+ *    untouched (some hook events carry none) — matching the shape mobile expects.
+ *  - CONFIRMED unencrypted/legacy session (resolved, no key AND `sessionIsEncrypted`
+ *    false) → plaintext (isEncrypted=false).
+ *  - session IS encrypted but keyless (`sessionIsEncrypted && !sessionKey`) →
+ *    returns `null`: the caller MUST drop the event (FAIL-CLOSED). Emitting
+ *    cleartext for an encrypted session is the confidentiality regression #638
+ *    exists to close. Routing every emit site through this ONE chokepoint means a
+ *    newly-added site cannot silently regress it.
+ *
+ * `encryptionResolved` defaults to `true` so existing 4-arg call sites (and every
+ * emit path whose session identity is already resolved) behave exactly as before;
+ * only a caller that can emit DURING session bootstrap needs to thread the flag.
+ *
+ * Pure: no logging, no I/O, no side effects. Callers own the drop log so the
+ * fail-closed decision is never silent.
+ */
+export declare function encryptForEmit(sessionKey: string | null, sessionIsEncrypted: boolean, plaintext: string, plainMetadata: any, encryptionResolved?: boolean): EncryptedEmitPayload | null;

package/node_modules/@quantiya/codevibe-core/dist/crypto/index.d.ts

@@ -1 +1,4 @@
 export { CryptoService, cryptoService, CryptoError, ENCRYPTION_VERSION } from './crypto-service';
+export { encryptForEmit } from './encrypt-for-emit';
+export type { EncryptedEmitPayload } from './encrypt-for-emit';
+export { E1_PROMPT_ID_DOMAIN, deriveOpenPromptId, mintOwnerToken, } from './open-prompt-id';

package/node_modules/@quantiya/codevibe-core/dist/crypto/open-prompt-id.d.ts

@@ -0,0 +1,36 @@
+/**
+ * E1 "missed-prompt recovery" — the producer-side self-certifying promptId
+ * commitment (PHASE-E1-MISSED-PROMPT-RECOVERY-DESIGN.md §3.1 / §4).
+ *
+ * A producer (a plugin, or core's own planner-offer path) mints a secret
+ * `ownerToken` per raise and emits `promptId = deriveOpenPromptId(ownerToken)`.
+ * The backend's `classifyRaise` re-derives and admits the openPrompts row ONLY
+ * when `promptId == derive(ownerToken)` (WRITE_ROW). Because SHA-256 is
+ * preimage-resistant, an attacker who knows a victim's promptId cannot produce a
+ * token that derives to it, so ownership survives the token never being stored
+ * server-side (it is NEVER projected back to clients).
+ *
+ * THIS IS A CROSS-PRODUCER BYTE CONTRACT. This file is the byte-for-byte port of
+ * the backend `lambda/shared/e1-open-prompts.ts` derive. core / codex / claude /
+ * agy MUST all reproduce the SAME bytes: same domain string, the SINGLE `\0`
+ * (0x00) separator, UTF-8 encoding of the token, SHA-256, first 16 bytes, and the
+ * v4 UUID version/variant shaping. A single divergent byte yields a different
+ * promptId → the backend REJECTs the raise → a HIDDEN prompt (under-nag). The
+ * pinned golden vectors in `__tests__/open-prompt-id.test.ts` (identical to the
+ * backend's `cdk/test/e1-open-prompts.test.ts`) lock this. Do NOT alter the
+ * domain, drop/duplicate the separator, or re-encode.
+ */
+/** Pinned domain separator for the promptId commitment (never change post-ship). */
+export declare const E1_PROMPT_ID_DOMAIN = "codevibe.e1.openprompt.promptid.v1";
+/**
+ * `derive(ownerToken) = uuidFormat( SHA-256(E1_DOMAIN ‖ 0x00 ‖ ownerToken)[:16] )`
+ * A BARE UUID — NO `synth-` prefix. Preimage-resistant.
+ */
+export declare function deriveOpenPromptId(ownerToken: string): string;
+/**
+ * Mint a fresh 256-bit secret `ownerToken` for one raise. Hex-encoded so it is a
+ * safe plaintext GraphQL string. Never persisted server-side; the producer
+ * stashes it in its durable PromptRaiseRecord so a retirement/resume re-raise can
+ * re-commit the SAME promptId.
+ */
+export declare function mintOwnerToken(): string;

package/node_modules/@quantiya/codevibe-core/dist/daemon/__tests__/process-guards.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@quantiya/codevibe-core/dist/daemon/index.d.ts

@@ -0,0 +1,2 @@
+export { installDaemonProcessGuards, isNetworkClass, } from './process-guards';
+export type { DaemonGuardLogger, DaemonProcessGuardOptions, } from './process-guards';