@quantiya/codevibe-codex-plugin 2.0.64 → 2.0.66

package/node_modules/@quantiya/codevibe-core/dist/local-executor/local-executor-impl.d.ts

@@ -26,14 +26,14 @@ import { type ReviewedShadowDiffFile, type ShadowEnv } from './workspace-shadow'
  * therefore "succeed" (await resolves) while the user sees NOTHING — and the
  * legacy unsandboxed spawn would proceed on only a WARN.
  *
- * A `StrictBadgeSink` MUST instead CONFIRM that the user-facing NOTIFICATION was
- * ACTUALLY delivered (e.g. `createEvent` was invoked) and THROW when it cannot
- * deliver (no session / stub / tap-ignored). For `tier:'none'` a
+ * A `StrictBadgeSink` MUST instead confirm canonical safety-notice persistence
+ * (or legacy encrypted createEvent acknowledgment), and THROW when it cannot
+ * persist (no session / stub / tap-ignored). This is not a phone ACK. For `tier:'none'` a
  * throw → FAIL CLOSED (no legacy spawn). It is INTENTIONALLY separate from the
  * audit emit: audit emission stays on the existing Class-A / shell-event path;
- * this sink is ONLY the user-facing moat-OFF warning.
+ * this sink handles both moat-OFF and coarse-egress safety warnings.
  *
- * Resolves on a confirmed delivery; REJECTS on a silent no-op / undeliverable.
+ * Coarse-egress failure stays best effort; moat-OFF failure refuses the spawn.
  */
 export type StrictBadgeSink = (badge: {
     sessionId: string;
@@ -603,10 +603,10 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      *
      * W2 Stage-2 HIGH — DELIVERY DISCIPLINE per tier:
      *   - `tier: 'none'` (the moat is fully OFF — the agent runs unsandboxed with
-     *     ambient `process.env` reachable): the badge MUST be DELIVERED before the
-     *     agent runs. It is routed through the STRICT delivery sink
-     *     (`deps.strictBadgeSink`) which CONFIRMS the NOTIFICATION actually reached
-     *     `createEvent` and THROWS on a silent no-op (no session key /
+     *     ambient `process.env` reachable): the badge MUST be PERSISTED before the
+     *     agent runs. It is routed through the STRICT sink
+     *     (`deps.strictBadgeSink`) which confirms a canonical V2 notice or legacy
+     *     encrypted createEvent acknowledgment, and THROWS on a silent no-op (no session key /
      *     stub / tap-ignored) — the ordinary `emitShellEvent` would RESOLVE without
      *     emitting in those cases (Finding 2). This method AWAITS that delivery with
      *     a bounded timeout and RE-THROWS on a reject/timeout. The WARN log stays
@@ -629,8 +629,8 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * the NOTIFICATION emit settles successfully within
      * `REDUCED_TRUST_BADGE_DELIVERY_TIMEOUT_MS`; REJECTS if the emit rejects OR the
      * timeout fires first. The caller fails closed on a reject (refuses the
-     * unsandboxed spawn) so no agent ever runs moat-OFF without the user having
-     * been warned.
+     * unsandboxed spawn). This persistence deadline does not prove the user has
+     * read the notice or that a phone rendered it.
      */
     private awaitBadgeDeliveryOrThrow;
     private spawnWithLifecycle;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.d.ts

@@ -10,13 +10,13 @@ import type { PlannerAdapter, PlannerInput, PlannerDecision, PlannerProbeResult
 import { keychainManager } from '../keychain';
 export { keychainManager };
 import type { TaskAuditSummaryModel } from './audit-summary';
-import { type LocalExecutor, type AuthorityScope, type EmitShellEventFn as LEEmitShellEventFn } from '../local-executor';
+import { type LocalExecutor, type AuthorityScope, type EmitShellEventFn as LEEmitShellEventFn, type StrictBadgeSink } from '../local-executor';
 import { type ReviewerCredentialStore } from '../substrate-launch';
 import { type EngineGroupState } from '../local-executor';
 import type { TeamTapEvent } from './index';
 import type { WorkspaceOutcomeSinkTap } from './workspace-terminal-coordinator';
 import type { GroupDecisionSubmitDeps } from './gate-decision-submit';
-import { QuorumLoop } from './quorum-loop';
+import { QuorumLoop, type ReviewerSafetyNoticeSink } from './quorum-loop';
 import type { TaskProgressEvent } from './task-progress';
 import { type VerdictClassifier } from '../reviewer/verdict-classifier';
 import { type LocalModelArtifactConfig, type LocalModelCommand, type LocalModelEntitlement, type LocalModelStore } from '../local-model/manager';
@@ -409,6 +409,11 @@ export interface DispatchContextTap {
         brief: string;
     }) => Promise<string>;
 }
+/** Same canonical reporter as implementors, without changing the reviewer's
+ * advisory policy. Local echo precedes the network; V2 never sends the reason
+ * text as an ordinary Event. The loop catches failure and still tears down. */
+export declare function makeReviewerSafetyNoticeSink(appsyncClient: AppSyncClient, session: Session, localNotice: (message: string) => void, legacyEmitter: LEEmitShellEventFn): ReviewerSafetyNoticeSink;
+export declare function makeStrictBadgeSink(appsyncClient: AppSyncClient, session: Session, legacyEmitter: LEEmitShellEventFn): StrictBadgeSink;
 /**
  * [Gemma classifier · D11 + §Wiring] Resolve the reviewer verdict classifier
  * threaded onto `QuorumLoopDeps.classifyVerdict`.
@@ -449,8 +454,8 @@ export interface BuildQuorumLoopExecutorResult {
  * CP-1.f §3.C — Stage-2 r2 (Codex) FIX B. Construct the SINGLE-TASK QuorumLoop +
  * its driving LE for a non-team orchestration session (Pro OR Max-without-teams).
  *
- * The single-implementor reviewer-quorum loop is a Pro+Max feature (Pro = 2
- * seats, Max = 3 seats per `codevibe-policy`); only Agent Teams / MergeGate
+ * The single-implementor reviewer-quorum loop is a Pro+Max feature (Pro = 1
+ * seat, Max = 1–2 seats per `codevibe-policy`); only Agent Teams / MergeGate
  * (CP-12) is Max-only. Before this fix the QuorumLoop was built ONLY inside
  * `buildTeamLocalExecutor` (gated on `tier === 'MAX'`), so a real Pro
  * orchestration session got NO loop → `start_task` silently no-op'd (the only