@quantiya/codevibe-core 2.0.0 → 2.0.2

package/dist/orchestration-shell/cohort-flag.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Filesystem location of the cohort-flag file (`~/.codevibe/cohort-flags.json`).
+ * Exposed as a function so test code can monkey-patch via env override.
+ */
+export declare function cohortFlagFilePath(): string;
+/**
+ * Reads the named cohort flag for the given session/user. Returns
+ * `false` on every failure mode (file missing, malformed JSON, flag
+ * unset, non-boolean value). This is fail-closed by design — per §3
+ * H6 mitigation, the cohort gate MUST default off until Phase 4 flips
+ * the flag.
+ *
+ * `sessionId` is accepted in the signature for future per-session
+ * cohort overrides; CP-1.a ignores it.
+ */
+export declare function getCohortFlag(name: string, _sessionId: string): Promise<boolean>;

package/dist/orchestration-shell/components/AuditLogPanel.d.ts

@@ -0,0 +1,11 @@
+import * as React from 'react';
+import { type AuditBrowserModel } from '../audit-browser';
+export interface AuditLogPanelProps {
+    model: AuditBrowserModel;
+}
+/**
+ * Render the per-task audit browser. Newest-first. An empty chain renders the
+ * neutral `No audit entries yet.` line; otherwise the titled entry list.
+ */
+export declare function AuditLogPanel(props: AuditLogPanelProps): React.ReactElement;
+export default AuditLogPanel;

package/dist/orchestration-shell/components/CodeVibeLogo.d.ts

@@ -0,0 +1,2 @@
+import * as React from 'react';
+export declare function CodeVibeLogo(): React.ReactElement;

package/dist/orchestration-shell/components/ConversationPane.d.ts

@@ -0,0 +1,13 @@
+import * as React from 'react';
+import { ConversationEntry } from '../types';
+export interface ConversationPaneProps {
+    entries: ConversationEntry[];
+    /**
+     * [#469 gate-pin] `taskId → "Track N"` map (from `state.team`) so the pinned
+     * `gate-prompt` control can label WHICH team track is awaiting the user's
+     * decision. `null`/absent for single-implementor / Companion sessions.
+     */
+    trackLabelByTaskId?: Map<string, string> | null;
+}
+export declare function renderConversationEntry(entry: ConversationEntry, trackLabelByTaskId?: Map<string, string> | null): React.ReactElement;
+export declare function ConversationPane(props: ConversationPaneProps): React.ReactElement;

package/dist/orchestration-shell/components/GateDetailsPanel.d.ts

@@ -0,0 +1,57 @@
+import * as React from 'react';
+import { ConversationEntry } from '../types';
+import { type GatePromptEnvelope, type ReviewSummaryPanelModel } from '../gate-prompts';
+export interface GateDetailsPanelProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'gate-prompt';
+    }>;
+}
+/**
+ * [TUI re-render fix #469] Render ONLY the envelope-derived READ-ONLY context
+ * (headline / reason / timeline / cascade / reviewers / unavailable line) for a
+ * gate prompt. Extracted from `GateDetailsPanel` so the same byte-identical
+ * context block can be rendered into the write-once `<Static>` `gate-panel`
+ * snapshot (variant 'prompt') without dragging the live review-summary along.
+ * Returns `null` when there is no context to show (B.9 backward-compat:
+ * older-engine events carry none of these fields).
+ *
+ * PURE: receives the already-decrypted `envelope`; no crypto, no I/O.
+ */
+export declare function GateContextPanel(props: {
+    envelope: GatePromptEnvelope;
+}): React.ReactElement | null;
+/**
+ * [TUI re-render fix #469] Render ONLY the PHASE-CP-1-F.1 Part B per-round
+ * review summary block. Extracted from `GateDetailsPanel` so the same
+ * byte-identical block can be rendered into the write-once `<Static>`
+ * `gate-panel` snapshot (variant 'summary'). Returns `null` when there are no
+ * rounds (so the caller emits no empty Static block).
+ *
+ * Renders proposal + per-seat verdict/reasoning/suggested-changes + revise
+ * notes for EACH round (proposal gate rounds 0..N, the auto-revisions). The
+ * single-round happy path renders one round; revise rounds render the revised
+ * proposal for the next round. PURE — receives the already-decrypted model.
+ *
+ * NB: the leading `marginTop: 1` on the header preserves the spacer row that
+ * separated the summary from the context block when both were one flat column
+ * (so `GateContextPanel + renderReviewSummarySection` composes byte-identically
+ * to the original single-array render).
+ */
+export declare function renderReviewSummarySection(reviewSummary: ReviewSummaryPanelModel): React.ReactElement | null;
+/**
+ * Render the GateDetailsPanel for a gate-prompt entry. Returns `null` when
+ * there is no context to show (no headline, no reason, no timeline, no
+ * reviewers, no unavailable line) AND no review summary — degrades to nothing
+ * rather than an empty box (B.9 backward-compat: older-engine events carry none
+ * of these fields).
+ *
+ * [TUI re-render fix #469] Now COMPOSED from the two extracted pieces
+ * (`GateContextPanel` + `renderReviewSummarySection`) so the live entry, the
+ * Static `gate-panel` prompt, and the Static `gate-panel` summary all render
+ * from the SAME source. Output is byte-identical to the pre-split single-array
+ * render: an outer column Box flows the context column above the summary column
+ * exactly as one flat column did, and the summary header keeps its `marginTop:
+ * 1` spacer.
+ */
+export declare function GateDetailsPanel(props: GateDetailsPanelProps): React.ReactElement | null;
+export default GateDetailsPanel;

package/dist/orchestration-shell/components/GatePanelEntry.d.ts

@@ -0,0 +1,9 @@
+import * as React from 'react';
+import { ConversationEntry } from '../types';
+export interface GatePanelEntryProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'gate-panel';
+    }>;
+}
+export declare function GatePanelEntry(props: GatePanelEntryProps): React.ReactElement | null;
+export default GatePanelEntry;

package/dist/orchestration-shell/components/GatePromptEntry.d.ts

@@ -0,0 +1,16 @@
+import * as React from 'react';
+import { ConversationEntry } from '../types';
+export interface GatePromptEntryProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'gate-prompt';
+    }>;
+    /**
+     * [#469 gate-pin] Best-effort "Track N" label for the gate's owning team
+     * track, derived by `<OrchestrationApp>` from `state.team` (taskId → index).
+     * Absent for single-implementor / Companion sessions (no team) — the header
+     * then omits the track suffix.
+     */
+    trackLabel?: string;
+}
+export declare function GatePromptEntry(props: GatePromptEntryProps): React.ReactElement;
+export default GatePromptEntry;

package/dist/orchestration-shell/components/InputBar.d.ts

@@ -0,0 +1,55 @@
+import * as React from 'react';
+import type { SlashCommandInfo } from '../slash-router';
+/**
+ * Worst-case dropdown height in rows: the window (MAX_SUGGESTIONS) + a
+ * `↑ N more` indicator + a `↓ N more` indicator. Exported so `<OrchestrationApp>`
+ * can reserve exactly this many rows in the live-region height cap while the
+ * dropdown can be open (Stage-2 — keeps the dropdown from re-triggering #469).
+ */
+export declare const DROPDOWN_MAX_ROWS: number;
+/**
+ * Gate-prompt-aware input modes per PHASE-CP-8-MIN-DESIGN.md §7
+ * + #C8M-5. `maxOption: number` (NOT a `2 | 5` literal union) per
+ * #C8M-1 server-derived purity — the parent derives it from
+ * `envelope.options.length` at the active gate-prompt entry.
+ */
+export type GatePromptMode = {
+    kind: 'awaiting-number';
+    maxOption: number;
+} | {
+    kind: 'awaiting-notes';
+    decisionDraft: string;
+} | {
+    kind: 'submitting';
+} | null;
+/**
+ * Sentinel string emitted via `onSubmit` when the user types the exact
+ * literal `/cancel` (case-sensitive) in `awaiting-notes` mode. The parent
+ * (`<OrchestrationApp>`) MUST intercept this sentinel and dispatch
+ * `GATE_PROMPT_NOTES_CANCELLED` instead of treating the text as notes
+ * plaintext. Without this sentinel, `/cancel` would be submitted AS the
+ * notes string to `applyUserDecision`, destroying user intent
+ * (Stage 2 r2 Codex NEW-HIGH-1).
+ */
+export declare const GATE_PROMPT_NOTES_CANCEL_SENTINEL = "__GATE_PROMPT_NOTES_CANCEL__";
+export interface InputBarProps {
+    onSubmit: (text: string, images?: string[]) => void;
+    /** Optional placeholder shown when value is empty. */
+    placeholder?: string;
+    /** Initial value (used for history recall). */
+    initialValue?: string;
+    /**
+     * CP-8 min Wave 1B. When non-null, restricts/disables input per the
+     * gate-prompt mode; when null, normal text-input behavior. See module
+     * docstring for the four states.
+     */
+    gatePromptMode?: GatePromptMode;
+    /**
+     * TUI redesign (2026-06-29) — the tier-filtered slash catalog for
+     * autocomplete (built by the parent via `listSlashCommands(tier)`). Absent /
+     * empty (CP-1.a callers, or the parent suppressing the dropdown while a task
+     * streams / a gate is pinned) → no dropdown.
+     */
+    slashCommands?: SlashCommandInfo[];
+}
+export declare function InputBar(props: InputBarProps): React.ReactElement;

package/dist/orchestration-shell/components/LiveProgressLine.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { LiveProgress } from '../types';
+export interface LiveProgressLineProps {
+    progress: LiveProgress | null;
+    /** Test seam; otherwise derived from the live terminal width, then 80 (mirrors StatusBar). */
+    columns?: number;
+}
+export declare function LiveProgressLine(props: LiveProgressLineProps): React.ReactElement | null;

package/dist/orchestration-shell/components/MultiTrackStatusNode.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { TeamState } from '../types';
+export interface MultiTrackStatusNodeProps {
+    team: TeamState;
+    /** [P1b] Test seam; otherwise derived from live stdout, then 80 (mirrors StatusBar). */
+    columns?: number;
+}
+export declare function MultiTrackStatusNode(props: MultiTrackStatusNodeProps): React.ReactElement;

package/dist/orchestration-shell/components/OrchestrationApp.d.ts

@@ -0,0 +1,129 @@
+import * as React from 'react';
+import { OrchestrationStore } from '../store';
+import { ConversationEntry, PostDecisionAction, Tier } from '../types';
+import type { PlannerRuntimeKind } from '../status-format';
+import type { UpdateReviewerPolicyInput, UserReviewerPolicySnapshot } from '../../types/reviewer';
+import { type ApplyUserDecisionClient as SharedApplyUserDecisionClient, type GroupDecisionSubmitDeps } from '../gate-decision-submit';
+/**
+ * Minimal SDK contract for the applyUserDecision wire. Structurally
+ * compatible with the full `AppSyncClient.applyUserDecision` signature
+ * — keeps the orchestration shell decoupled from the heavier AppSync
+ * surface (tests can inject a stub).
+ *
+ * Audited-path fix (Fix 8): this is now a re-export of the shared
+ * `gate-decision-submit` contract so the TTY + non-TTY surfaces never drift.
+ */
+export type ApplyUserDecisionClient = SharedApplyUserDecisionClient;
+/**
+ * Minimal SDK contract for the `/reviewer-setup` wizard's save step. Structurally
+ * compatible with `AppSyncClient.updateReviewerPolicy`. Optional on the App
+ * (CP-1.a / Companion / test callers never open the wizard); when the wizard IS
+ * open but this is absent, the save fails closed with an advisory instead of
+ * throwing (the entrypoint always provides the real client).
+ */
+export interface ReviewerPolicyClient {
+    updateReviewerPolicy(input: UpdateReviewerPolicyInput): Promise<UserReviewerPolicySnapshot>;
+}
+export interface OrchestrationAppProps {
+    store: OrchestrationStore;
+    tier: Tier;
+    /**
+     * TUI redesign (2026-06-29) — the boot-time planner runtime kind + display
+     * label, threaded from `RunOrchestrationShellArgs` for the status-bar planner
+     * badge. Absent (CP-1.a callers / tests) → treated as `hosted` (no badge).
+     */
+    plannerRuntimeKind?: PlannerRuntimeKind;
+    plannerLabel?: string;
+    /**
+     * TUI redesign (2026-06-29) — the PLAINTEXT cwd for the status bar, threaded
+     * from the shell entry (process.cwd()). Sourced here rather than from
+     * `state.session.projectPath`, which is AES-GCM-encrypted at rest and never
+     * decrypted (Stage-1 HIGH — that would render ciphertext). Absent (tests /
+     * CP-1.a callers) → falls back to the live process.cwd().
+     */
+    cwd?: string;
+    /** Hook called when `<InputBar>` submits text AND there is no active
+     * gate-prompt. The host wires this to the slash router / planner
+     * classifier. Gate-prompt submits are intercepted internally per
+     * #C8M-11 and never reach `onUserInput`. `images` (IMAGE-ATTACHMENT-DESIGN.md
+     * §13 Option 2) carries the resolved path(s) of `[Image #N]` input chips. */
+    onUserInput: (text: string, images?: string[]) => void;
+    /**
+     * CP-8 min Stage 1 R1 closure + Stage 2 r1 Codex HIGH-1 (REQUIRED). The
+     * desktop-side AppSync transport surface (codevibe-core's own
+     * AppSyncClient — see #C8M-6 deviation). Required so production gate
+     * submits cannot silently fail-closed at the SDK edge with "AppSync
+     * client not configured". The shell entry (`runOrchestrationShell`)
+     * always has an authenticated client by the
+     * `RunOrchestrationShellArgs` contract; tests inject a stub.
+     * Future omissions will fail TypeScript compile rather than break at
+     * runtime.
+     */
+    appsyncClient: ApplyUserDecisionClient;
+    /**
+     * Session-key resolver invoked just-in-time when a gate-prompt submit
+     * includes notes. Returns the base64 session key for the caller's
+     * session, or `null` if the session is not E2E-encrypted.
+     *
+     * Stage 2 r2 Codex NEW-HIGH-2: this prop is now REQUIRED (non-optional)
+     * because the underlying `AppSyncClient.applyUserDecision` enforces
+     * `sessionKeyBase64 !== undefined` whenever `notes` is supplied. Without
+     * the resolver, production Path B `_WITH_NOTES` submits throw at the
+     * SDK edge with "sessionKeyBase64 is required when notes are
+     * supplied" — masked by Tests 21/22 which stub the resolver. Production
+     * callers (`runOrchestrationShell`) bind this to
+     * `keychainManager.getSessionKey(sessionId)`. Tests inject a stub.
+     *
+     * If the resolver returns `null` AND `notes` are present, the submit
+     * handler dispatches `GATE_PROMPT_SUBMIT_FAILED` with a locked error
+     * message — it MUST NOT silently submit unencrypted notes.
+     */
+    getSessionKey: (sessionId: string) => Promise<string | null>;
+    /**
+     * CP-1.f execute-first (D5) — invoked after a gate-prompt `applyUserDecision`
+     * resolves, with the engine's `postAction`. The shell wires it to the
+     * QuorumLoop so a NON-authorize terminal (`abort_task` / `restart_proposal` /
+     * `terminate_gate`) DISCARDS the task's shadow. The APPROVE path
+     * (`final_approval_resolved`) is handled by the `TaskAuthorized` Class-B edge
+     * (promote, #PR-3) — NOT here — and a revise (`open_new_round`) KEEPS the
+     * shadow. ABSENT (tests / non-loop sessions) → no-op (back-compat).
+     */
+    onTerminalDecision?: (taskId: string, postAction: PostDecisionAction, expectedShadow?: unknown) => void;
+    /**
+     * Instance-pinned discard (live dogfood race 2026-06-11, option-4 "Reject and
+     * restart"): resolves the live shadow instance for a task. Read at the TOP of
+     * `submitGateDecision` (before the SDK await) so the discard pins to the OLD
+     * (rejected) shadow, not the restart's fresh one. ABSENT → no capture (no-op).
+     */
+    captureShadow?: (taskId: string) => unknown;
+    /**
+     * PHASE-589/469 W3.2 — the two-phase group-escalation decision transport.
+     * Present ONLY for a TEAM session (built in `cli.ts`, completed in
+     * `runOrchestrationShell` as `gateDecisionDeps.groupDecision` with this shell's
+     * store merged in). Threaded straight into the SHARED `routeGatePromptInput`
+     * deps so a `task_group_halted` 5-option group-escalation prompt resolves
+     * through `submitGroupDecision` (CLAIM→revert→COMMIT) on the TTY surface — NOT
+     * just the non-TTY fallback. Without it a TTY group-escalation submit
+     * fail-closes at the SDK edge with "Team decision transport not configured"
+     * (live dogfood). ABSENT (single-impl / Companion / tests) → a group prompt can
+     * never be synthesized, so this is never consulted. The optional spread at the
+     * call site keeps the deps object byte-identical to a non-team session when
+     * absent.
+     */
+    groupDecision?: GroupDecisionSubmitDeps;
+    /**
+     * `/reviewer-setup` wizard (2026-06-29) — the SDK surface the wizard's save
+     * step writes through. Present for real shell sessions (`runOrchestrationShell`
+     * binds `args.appsyncClient`); absent for CP-1.a / Companion / test callers,
+     * which never dispatch `REVIEWER_WIZARD_OPEN`. When absent AND a wizard is
+     * somehow open, the save fails closed with an advisory.
+     */
+    reviewerPolicyClient?: ReviewerPolicyClient;
+}
+/**
+ * A finalized entry STARTS a user turn iff it's a typed prompt or a real
+ * `/slash` command. Exported for unit testing. Synthetic non-`/` slash-outputs
+ * (e.g. `planner-error`, a natural-language failure RESPONSE) are NOT turn-starts.
+ */
+export declare function isTurnStart(entry: ConversationEntry): boolean;
+export declare function OrchestrationApp(props: OrchestrationAppProps): React.ReactElement;

package/dist/orchestration-shell/components/ReviewerSetupWizard.d.ts

@@ -0,0 +1,24 @@
+import * as React from 'react';
+import type { ReviewerWizardState } from '../types';
+import { type UpdateReviewerPolicyInput } from '../../types/reviewer';
+/**
+ * Worst-case wizard height in rows: rounded border (2) + title (1) + current
+ * context (1) + question (1) + the bounded role list (ROLE_LIST_LIMIT) + hint
+ * (1). Exported so `<OrchestrationApp>` reserves this in the #469 live-region
+ * height cap while a wizard is open (it renders in the InputBar's slot, so the
+ * cap must budget for the wizard, not the shorter InputBar).
+ */
+export declare const WIZARD_MAX_ROWS: number;
+export interface ReviewerSetupWizardProps {
+    wizard: ReviewerWizardState;
+    /**
+     * Persist the chosen policy. The parent owns the network write + result
+     * advisory + `REVIEWER_WIZARD_CLOSE` (which unmounts this component). Called
+     * exactly once per wizard run; the component shows a "Saving…" step until the
+     * parent closes the modal.
+     */
+    onSubmit: (input: UpdateReviewerPolicyInput) => void;
+    /** Abandon the wizard with NO policy change (Esc / explicit Cancel). */
+    onCancel: () => void;
+}
+export declare function ReviewerSetupWizard(props: ReviewerSetupWizardProps): React.ReactElement;

package/dist/orchestration-shell/components/StatusBar.d.ts

@@ -0,0 +1,20 @@
+import * as React from 'react';
+import { Tier } from '../types';
+import { type PlannerRuntimeKind } from '../status-format';
+export interface StatusBarProps {
+    /**
+     * Current working directory — the PLAINTEXT cwd threaded from the shell entry
+     * (process.cwd()). NOTE: do NOT source this from `session.projectPath`, which
+     * is AES-GCM-encrypted at rest in E2E sessions and is never decrypted (Stage-1
+     * HIGH — that would render ciphertext as the path).
+     */
+    cwd: string;
+    tier: Tier;
+    /** Boot-time planner runtime kind (NOT a live probe). */
+    plannerRuntimeKind: PlannerRuntimeKind;
+    /** Display label for the local model (e.g. `gemma4`). */
+    plannerLabel: string;
+    /** Test seam — overrides the terminal width used for cwd truncation. */
+    columns?: number;
+}
+export declare function StatusBar(props: StatusBarProps): React.ReactElement;

package/dist/orchestration-shell/components/nodes/AdvisoryEntry.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { ConversationEntry } from '../../types';
+export interface AdvisoryEntryProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'advisory';
+    }>;
+}
+export declare function AdvisoryEntry(props: AdvisoryEntryProps): React.ReactElement;

package/dist/orchestration-shell/components/nodes/GateStatusNode.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { ConversationEntry } from '../../types';
+export interface GateStatusNodeProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'gate-status-node';
+    }>;
+}
+export declare function GateStatusNode(props: GateStatusNodeProps): React.ReactElement;

package/dist/orchestration-shell/components/nodes/PlannerDecisionEntry.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { ConversationEntry } from '../../types';
+export interface PlannerDecisionEntryProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'planner-decision';
+    }>;
+}
+export declare function PlannerDecisionEntry(props: PlannerDecisionEntryProps): React.ReactElement;

package/dist/orchestration-shell/components/nodes/ReviewerQuorumStatusNode.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { ConversationEntry } from '../../types';
+export interface ReviewerQuorumStatusNodeProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'reviewer-status-node';
+    }>;
+}
+export declare function ReviewerQuorumStatusNode(props: ReviewerQuorumStatusNodeProps): React.ReactElement;

package/dist/orchestration-shell/components/nodes/SlashOutputEntry.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { ConversationEntry } from '../../types';
+export interface SlashOutputEntryProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'slash-output';
+    }>;
+}
+export declare function SlashOutputEntry(props: SlashOutputEntryProps): React.ReactElement;

package/dist/orchestration-shell/components/nodes/SubagentEventEntry.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { ConversationEntry } from '../../types';
+export interface SubagentEventEntryProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'subagent-event';
+    }>;
+}
+export declare function SubagentEventEntry(props: SubagentEventEntryProps): React.ReactElement;

package/dist/orchestration-shell/components/nodes/UserMessageEntry.d.ts

@@ -0,0 +1,8 @@
+import * as React from 'react';
+import { ConversationEntry } from '../../types';
+export interface UserMessageEntryProps {
+    entry: Extract<ConversationEntry, {
+        kind: 'user-message';
+    }>;
+}
+export declare function UserMessageEntry(props: UserMessageEntryProps): React.ReactElement;