@quantiya/codevibe-core 2.0.0 → 2.0.2

package/dist/orchestration-shell/attachments.d.ts

@@ -0,0 +1,152 @@
+import type { ImageAttachment } from './types';
+/** Per-file on-disk cap (§10.5). */
+export declare const MAX_IMAGE_BYTES: number;
+/** Max attachments on the FINAL accumulated+deduped task set (§5). */
+export declare const MAX_ATTACHMENTS = 8;
+/** Sniff the raster MIME from the first bytes. Returns null if not a known raster. */
+export declare function sniffImageMime(head: Buffer): {
+    mime: string;
+    ext: string;
+} | null;
+/**
+ * Extract candidate image-path SPANS from the raw text. Two passes:
+ *   1. single/double-quoted spans ending in an image extension;
+ *   2. on the remaining text (quoted spans masked out), bare / backslash-escaped
+ *      / `file://` / `~`-relative spans ending in an image extension.
+ * Returns the EXACT matched span (`rawToken`, incl. quotes/escapes) — the brief
+ * replacement (§8) rewrites this exact span.
+ */
+export declare function extractImagePathSpans(text: string): Array<{
+    rawToken: string;
+}>;
+export interface IngestReject {
+    token: string;
+    reason: string;
+}
+export interface IngestResult {
+    attachments: ImageAttachment[];
+    rejects: IngestReject[];
+}
+export interface IngestOptions {
+    cwd: string;
+    homedir: string;
+    /** ID minter (default `randomUUID`); injectable for deterministic tests. */
+    newId?: () => string;
+    /** Already-accumulated attachments (clarification loop) — for the FINAL count cap + sourcePath dedup (§5). */
+    existing?: ImageAttachment[];
+}
+/**
+ * Detect + validate image attachments in `text` (§4). UX-level validation
+ * (existsSync + regular-file + size + magic-sniff); the fd-safe `O_NOFOLLOW`
+ * re-validation at copy/base64 time (§7.3/§6) is the security boundary. Dedups by
+ * `sourcePath` (merging `rawTokens`) and enforces `MAX_ATTACHMENTS` on the FINAL
+ * accumulated set (`existing` ∪ newly-detected).
+ */
+export declare function detectImageAttachments(text: string, opts: IngestOptions): IngestResult;
+/**
+ * Build validated `ImageAttachment`s DIRECTLY from resolved absolute paths — no text
+ * tokenization (Stage-1 R2 M-1). Used for the §13 Option-2 InputBar chip: the paths
+ * are carried out-of-band, so re-serializing them through the text detector would
+ * mangle paths containing `"`/`\`. Each path is `path.resolve`d + validated via the
+ * SAME `promoteLexicalImagePath` (authoritative re-validation of the InputBar's
+ * optimistic check). Deduped by resolved path; `MAX_ATTACHMENTS` enforced.
+ */
+export declare function attachmentsFromPaths(paths: string[], opts?: {
+    newId?: () => string;
+    existing?: ImageAttachment[];
+}): IngestResult;
+/** Human advisory for a set of rejects (§4/§9) — a clear, actionable line per reject. */
+export declare function formatIngestRejects(rejects: IngestReject[]): string | null;
+/** The in-worktree attachments dir (§7). Excluded from BOTH diff-capture paths + promote. */
+export declare const SHADOW_ATTACHMENTS_DIR = ".codevibe-attachments";
+/** The AGENT-NEUTRAL in-worktree relative ref for an attachment (§7.2/§8). */
+export declare function attachmentRelPath(a: ImageAttachment): string;
+export interface CopiedAttachment {
+    id: string;
+    relPath: string;
+    mime: string;
+}
+export interface PreparedAttachments {
+    copiedAttachments: CopiedAttachment[];
+    failedAttachments: ImageAttachment[];
+    /** The brief with FAILED-copy refs rewritten to a neutral marker (no dangling ref). */
+    roundBrief: string;
+}
+/**
+ * Per-round copy + failure-rewrite in ONE step (§7.3, rev-7). For each attachment,
+ * fd-copy (the §6/§7.3 `O_NOFOLLOW` + byte-ceiling + re-sniff re-validation) into
+ * `<shadowDir>/.codevibe-attachments/<id>.<ext>` via a temp + atomic rename; for a
+ * FAILED copy, unlink the partial dest AND rewrite that attachment's neutral rel-ref
+ * in `roundBrief` to `[attached image skipped]` (so no dangling ref survives). The
+ * returned `roundBrief` (failures neutralized) feeds BOTH the per-agent stdin AND
+ * the execute-first payload. Never throws / never hard-blocks.
+ */
+export declare function prepareAttachmentsForSpawn(roundBrief: string, attachments: ImageAttachment[], shadowDir: string): PreparedAttachments;
+/**
+ * Per-agent rendering of the copied-attachment refs, appended to the brief at spawn
+ * (§7.2). The stored/canonical brief is agent-NEUTRAL (`.codevibe-attachments/<id>.<ext>`);
+ * this adds the agent-specific pointer: Claude/Codex → an `Attached images:` list of
+ * relative paths (read via their Read tool); Gemini → the `@./…` form.
+ */
+export declare function renderAttachmentsForAgent(agent: string, copied: CopiedAttachment[], workdir?: string): string;
+/**
+ * The TEAM-DECOMPOSER brief transform (§7.5). The decomposition implementor runs
+ * in the REAL repo (no shadow, no copy), so it must NOT see an in-worktree ref OR
+ * an absolute path — replace every typed image token with a text-only marker. The
+ * ACTUAL images flow to the implementing track(s) via the group attachment set;
+ * the decomposer only needs to know an image exists so it routes work sensibly.
+ */
+export declare function stripAttachmentsForDecomposer(brief: string, attachments: ImageAttachment[]): string;
+/**
+ * Replace every typed image rawToken span (across the turn + clarification answers)
+ * with the AGENT-NEUTRAL in-worktree relative ref (§8) so no absolute `/Users/…`
+ * path leaks into a brief that gets stored / encrypted / sent to an implementor.
+ * Used by `composeImplementationBrief` AND (Stage-2 R1 HIGH-2) by the team-launch
+ * path to sanitize the manual `/team` per-track briefs, which never pass through
+ * `composeImplementationBrief`.
+ */
+export declare function rewriteAttachmentTokensToRefs(brief: string, attachments: ImageAttachment[]): string;
+/**
+ * §13 Option-2 — replace each `[Image #N]` chip token with the ref of the attachment
+ * for the N-th CARRIED PATH. `orderedPaths` is the ordered-with-DUPLICATES resolved
+ * carried-path list aligned 1:1 with the chip numbers in `brief` (the InputBar
+ * renumbers chips densely in reading order at submit, and the shell accumulates +
+ * cross-turn-renumbers across a clarification so numbers are globally unique). Keying
+ * on the carried PATH (then resolving to the deduped attachment) — rather than a
+ * deduped `attachments[N-1]` index — is what makes a DUPLICATE same-file drag
+ * (`images=[A,A,B]` → dedup `[A,B]`) map `#1→A #2→A #3→B` correctly (Stage-2 R5), and
+ * a cross-turn accumulation map each turn's image to its own ref (the multi-turn case).
+ * An out-of-range N or an unknown path (a typed literal `[Image #99]`) degrades to a
+ * neutral marker — never a wrong ref. Run AFTER `rewriteAttachmentTokensToRefs`; the
+ * two token classes (typed raw-path spans vs `[Image #N]` chips) are disjoint.
+ */
+export declare function rewriteChipTokensByNumber(brief: string, orderedPaths: string[], attachments: ImageAttachment[]): string;
+/** Per-model-call total base64-source cap (§6): base64 inflates ~33%; distinct from the 10 MB per-file copy cap. */
+export declare const MAX_BASE64_SOURCE_BYTES: number;
+/**
+ * The SECURITY-boundary read (§4/§6/§7.3): open the LEXICAL absolute path with
+ * `O_RDONLY | O_NOFOLLOW` (refuses if the final component is a symlink — defeats a
+ * post-ingest swap to a symlink-to-`/etc/…`), `fstat` the FD (re-check
+ * regular-file), read with a running byte ceiling (defends a file that grew after
+ * ingest), and re-sniff the magic bytes from the FD. NEVER a naive
+ * `fs.readFile(sourcePath)`. Throws on any violation. Shared by the base64 read
+ * (§6) and the copy-into-shadow path (§7.3).
+ */
+export declare function readImageFdSafe(sourcePath: string, maxBytes?: number): {
+    buf: Buffer;
+    mime: string;
+};
+/**
+ * Shell-layer helper (§6): read the attachments fd-safe and return RAW base64
+ * (NO `data:` prefix — Ollama's `images[]` wants raw base64) for the LOCAL model,
+ * under a per-call total-source-bytes cap + a count cap (first-N-under-cap). Any
+ * attachment that fails the fd-safe read is returned in `failed` — callers
+ * proceed text-only with a content-free advisory, never block/throw.
+ */
+export declare function attachmentsToBase64(attachments: ImageAttachment[], opts?: {
+    maxTotalBytes?: number;
+    maxCount?: number;
+}): {
+    images: string[];
+    failed: ImageAttachment[];
+};

package/dist/orchestration-shell/audit-browser.d.ts

@@ -0,0 +1,115 @@
+/** Fail-closed payload line (routing step 3 + decrypt failure). */
+export declare const ENTRY_DETAILS_UNAVAILABLE = "Entry details unavailable";
+/** Empty/sparse chain empty-state. */
+export declare const NO_AUDIT_ENTRIES = "No audit entries yet.";
+/** queryAudit error / 1 MB overflow empty-state. */
+export declare const AUDIT_LOG_TOO_LARGE = "Audit log too large to display here \u2014 export coming soon";
+/** Screen title. */
+export declare const AUDIT_LOG_TITLE = "Audit log";
+/** Max interstitial headline (non-Max → render this + the existing upgrade CTA). */
+export declare const AUDIT_BROWSER_MAX_HEADLINE = "The audit browser is a Max feature";
+/**
+ * The SINGLE shared client constant naming which `kind`s may render directly
+ * from a non-envelope plaintext payload (shared-contract §3 step 2). Today
+ * exactly `task_authorized`. Any other non-envelope payload FAILS CLOSED.
+ * A future CP-9/CP-12 wire-public kind must be added here explicitly before
+ * it renders plaintext — the default for "plaintext I don't recognize" is
+ * suppress-not-show (zero-knowledge defense).
+ */
+export declare const WIRE_PUBLIC_PLAINTEXT_KINDS: ReadonlySet<string>;
+/**
+ * `auditKindCopy` — every key is a REAL serde wire label from the Rust enum
+ * (`codevibe-audit/src/lib.rs:121-337`, `#[serde(rename_all = "snake_case")]`).
+ * The `audit-browser.test.ts` asserts every key is in the canonical wire-label
+ * set (so a typo can't silently ship). Unknown/future kind → the raw snake_case
+ * string (see `auditKindLabel`), never blank.
+ */
+export declare const auditKindCopy: Readonly<Record<string, string>>;
+/** Humanize a wire kind via `auditKindCopy`; unknown/future → raw snake_case. */
+export declare function auditKindLabel(kind: string): string;
+/**
+ * The minimal content-decrypt primitive the router needs — structurally
+ * compatible with `cryptoService.decryptContent(ciphertextB64, sessionKeyB64)`.
+ * Injected so the parity test runs with a mock (no live crypto).
+ */
+export type DecryptContentFn = (encryptedB64: string, sessionKeyBase64: string) => string;
+/** How a single entry's payload resolved (§3). */
+export type AuditEntryRouteStatus = 'decrypted' | 'plaintext' | 'unavailable';
+/** A reviewer-verdict suggested-change / finding row (untruncated). */
+export interface AuditReviewerVerdictModel {
+    /** Display label for the 4-value verdict via `decisionCopy` (unknown → raw). */
+    readonly decisionLabel: string;
+    /** Seat / role / agent provenance line, or null when absent. */
+    readonly provenance: string | null;
+    /** The UNTRUNCATED reviewer reasoning, or null when absent. */
+    readonly reasoning: string | null;
+    /** Each suggested-changes entry (untruncated), or empty. */
+    readonly suggestedChanges: ReadonlyArray<string>;
+}
+/** A `task_authorized` wire-public plaintext authority model. */
+export interface AuditTaskAuthorizedModel {
+    readonly authorizedAction: string | null;
+    readonly authorityScope: string | null;
+    readonly authorityExpiresAt: string | null;
+    readonly approvalEventId: string | null;
+}
+/** The render model for ONE audit entry (§4). */
+export interface AuditEntryModel {
+    /** Per-entry stable key (timestamp + entryId fallback). */
+    readonly entryId: string;
+    /** Humanized kind label (`auditKindCopy`; unknown → raw snake_case). */
+    readonly kindLabel: string;
+    /** Raw snake_case kind (for tests / forward-compat display). */
+    readonly kind: string;
+    /** RFC3339 timestamp (header line), or null when absent. */
+    readonly timestamp: string | null;
+    /** How the payload resolved. */
+    readonly status: AuditEntryRouteStatus;
+    /**
+     * The neutral payload line shown when `status === 'unavailable'`
+     * (`Entry details unavailable`), else null.
+     */
+    readonly unavailableLine: string | null;
+    /** Reviewer-verdict full review (only `reviewer_verdict_recorded`), or null. */
+    readonly reviewerVerdict: AuditReviewerVerdictModel | null;
+    /** `task_authorized` authority scalars, or null. */
+    readonly taskAuthorized: AuditTaskAuthorizedModel | null;
+    /**
+     * Best-effort pretty-printed JSON of an ALREADY-SAFE payload (a decrypted
+     * envelope OR an allow-listed plaintext) that didn't match its expected
+     * per-kind shape, OR an unknown-but-ENVELOPE kind. NEVER set for a
+     * fail-closed entry. Null when a structured model rendered instead.
+     */
+    readonly rawJson: string | null;
+}
+/**
+ * Route ONE audit row's payload per shared-contract §3 (shape-detect →
+ * allow-list → fail-closed) and build its render model. INVARIANT: every row
+ * yields a rendered model OR the neutral `Entry details unavailable` line —
+ * NEVER ciphertext, NEVER a crash, NEVER raw-JSON for an unknown non-envelope
+ * plaintext.
+ *
+ * @param row        one raw `Record<string, unknown>` from `queryAudit().rows`
+ * @param sessionKey the task's session key (base64), or null when unavailable
+ * @param decrypt    injected `cryptoService.decryptContent` (mock in tests)
+ */
+export declare function routeAuditEntry(row: Record<string, unknown>, sessionKey: string | null, decrypt: DecryptContentFn): AuditEntryModel;
+/** The full render model for the per-task audit browser. */
+export interface AuditBrowserModel {
+    readonly title: string;
+    /** Newest-first entry models. Empty → render `emptyLine`. */
+    readonly entries: ReadonlyArray<AuditEntryModel>;
+    /** Set when there are zero entries (the `No audit entries yet.` line). */
+    readonly emptyLine: string | null;
+}
+/**
+ * Build the full newest-first audit browser model from the server-ascending
+ * `rows`. PURE — takes the rows + the session key + the injected decrypt fn.
+ * Ordering (§2): the rows come back server-ascending; we reverse to newest-first
+ * (using `timestamp`/`entryId` as keys — there is NO `seq_num` on the wire).
+ */
+export declare function buildAuditBrowserModel(rows: ReadonlyArray<Record<string, unknown>>, sessionKey: string | null, decrypt: DecryptContentFn): AuditBrowserModel;
+/** Render a single entry model as readable plaintext lines. */
+export declare function renderAuditEntryText(entry: AuditEntryModel): string[];
+/** Render the whole browser model as a readable newest-first timeline. */
+export declare function renderAuditBrowserText(model: AuditBrowserModel): string;

package/dist/orchestration-shell/audit-runner.d.ts

@@ -0,0 +1,59 @@
+import type { AppSyncClient } from '../appsync';
+import type { Tier } from './types';
+import { type AuditBrowserModel, type DecryptContentFn } from './audit-browser';
+/** Upgrade CTA appended below the Max interstitial (matches the existing copy). */
+export declare const AUDIT_BROWSER_UPGRADE_HINT = "Upgrade to Max at https://quantiya.ai/codevibe to access the audit browser.";
+/**
+ * The minimal AppSync surface the runner needs — `queryAudit` (the existing
+ * 2-arg `{taskId,sessionId}` method) + `getSubscriptionStatus`. Narrowed so the
+ * tests can inject a stub without the full client.
+ */
+export type AuditAppSyncClient = Pick<AppSyncClient, 'queryAudit' | 'getSubscriptionStatus'>;
+export interface RunAuditBrowserDeps {
+    /** The authenticated AppSync client (caller ran `authenticateWithStoredTokens`). */
+    appsyncClient: AuditAppSyncClient;
+    /** The task to browse. */
+    taskId: string;
+    /** The session the task belongs to (the `queryAudit` 2-arg shape needs it). */
+    sessionId: string;
+    /**
+     * The effective tier. When provided (the CLI passes `readTierFromEnvOrDefault`),
+     * it is authoritative (honors `CODEVIBE_TIER`). When omitted, the runner reads
+     * `getSubscriptionStatus().tier` from the backend.
+     */
+    tier?: Tier;
+    /** Test seam — defaults to `cryptoService.decryptContent`. */
+    decryptFn?: DecryptContentFn;
+    /** Test seam — defaults to `keychainManager.getSessionKey(sessionId)`. */
+    getSessionKeyFn?: (sessionId: string) => Promise<string | null>;
+    /**
+     * Test seam — overrides the Max-gate tier resolution entirely (skips
+     * getSubscriptionStatus). When set, this wins over `tier` + the backend read.
+     */
+    resolveTierFn?: () => Promise<Tier>;
+}
+/** The outcome of a browser run. */
+export type RunAuditBrowserResult = {
+    kind: 'gated';
+    headline: string;
+    upgradeHint: string;
+} | {
+    kind: 'ok';
+    model: AuditBrowserModel;
+} | {
+    kind: 'error';
+    line: string;
+    reason: string;
+};
+/**
+ * Run the per-task audit browser: Max-gate → fetch → resolve session key →
+ * route + build the newest-first render model. Returns a discriminated result
+ * the shell / CLI render. NEVER throws (every failure → a structured result).
+ */
+export declare function runAuditBrowser(deps: RunAuditBrowserDeps): Promise<RunAuditBrowserResult>;
+/**
+ * Render a `RunAuditBrowserResult` as readable plaintext (the meta-CLI default
+ * output + the inline `/audit` shell output). The `--json` CLI path renders the
+ * model directly as JSON instead (see `cli.ts`).
+ */
+export declare function renderAuditResultText(result: RunAuditBrowserResult): string;

package/dist/orchestration-shell/bracketed-paste.d.ts

@@ -0,0 +1,26 @@
+/** DECSET enable: terminal starts wrapping pastes in START…END. */
+export declare const ENABLE_BRACKETED_PASTE = "\u001B[?2004h";
+/** DECSET disable: restore normal paste behavior. */
+export declare const DISABLE_BRACKETED_PASTE = "\u001B[?2004l";
+/** Paste-start marker (6 bytes). */
+export declare const PASTE_START = "\u001B[200~";
+/** Paste-end marker (6 bytes). */
+export declare const PASTE_END = "\u001B[201~";
+/** Minimal write-stream shape we need (real `process.stdout` satisfies it). */
+export interface DecsetStream {
+    write(s: string): unknown;
+    isTTY?: boolean;
+    writable?: boolean;
+}
+/** `<OrchestrationApp>` registers its `useStdout().stdout` here on mount. */
+export declare function setRenderStdout(stdout: DecsetStream | null): void;
+/** Enable bracketed paste on the render stdout (idempotent; TTY-gated). */
+export declare function enableBracketedPaste(explicit?: DecsetStream | null): void;
+/**
+ * Disable bracketed paste (idempotent; TTY-gated). Safe to call from the signal
+ * path AND the unmount cleanup (double-call is a no-op once disabled). Callers
+ * that clear the render-stdout ref MUST disable FIRST, then clear (Stage-2 LOW).
+ */
+export declare function disableBracketedPaste(explicit?: DecsetStream | null): void;
+/** Test-only: reset module state between tests. */
+export declare function __resetBracketedPasteStateForTests(): void;