@quantiya/codevibe-core 2.0.0 → 2.0.2

package/dist/orchestration-shell/vendor/ink-parse-keypress.d.ts

@@ -0,0 +1,42 @@
+/** Key names that are NOT printable text — `input` is blanked for these. */
+export declare const nonAlphanumericKeys: string[];
+export interface ParsedKeypress {
+    name: string;
+    ctrl: boolean;
+    meta: boolean;
+    shift: boolean;
+    option: boolean;
+    sequence: string;
+    raw: string | undefined;
+    code?: string;
+}
+/** Verbatim port of Ink 5.2.1 `parseKeypress` (string input — Ink sets utf8). */
+export declare const parseKeypress: (s?: string | undefined) => ParsedKeypress;
+/** The `key` object shape Ink's `useInput` hands to its handler. */
+export interface InkKey {
+    upArrow: boolean;
+    downArrow: boolean;
+    leftArrow: boolean;
+    rightArrow: boolean;
+    pageDown: boolean;
+    pageUp: boolean;
+    return: boolean;
+    escape: boolean;
+    ctrl: boolean;
+    shift: boolean;
+    tab: boolean;
+    backspace: boolean;
+    delete: boolean;
+    meta: boolean;
+}
+/**
+ * Mirror of `ink/build/hooks/use-input.js` (5.2.1) lines 46-80: derive the
+ * `(input, key)` pair `useInput` would deliver for a raw data chunk. The Ctrl+C
+ * gate + `reconciler.batchedUpdates` dispatch from use-input.js are intentionally
+ * NOT here — the caller owns dispatch (Ctrl+C is already handled by Ink's
+ * `App.handleInput` before the chunk is emitted).
+ */
+export declare function toInkKey(data: string): {
+    input: string;
+    key: InkKey;
+};

package/dist/orchestration-shell/web/extract.d.ts

@@ -0,0 +1,11 @@
+export interface ExtractResult {
+    title: string;
+    text: string;
+}
+/** Test seam: drop the cached parse5 load so a re-stubbed ESM loader takes effect. */
+export declare function __resetExtractCacheForTest(): void;
+/**
+ * Extract a page title + visible body text from HTML via parse5. Async (parse5 is ESM-only) and
+ * NEVER throws — returns `{ title:'', text:'' }` on the size cap / load / parse failure.
+ */
+export declare function htmlToText(html: string): Promise<ExtractResult>;

package/dist/orchestration-shell/web/fetch.d.ts

@@ -0,0 +1,15 @@
+export type FetchFailureKind = 'blocked' | 'too_large' | 'timeout' | 'network' | 'bad_content' | 'too_many_redirects' | 'http_error';
+export declare class FetchError extends Error {
+    readonly kind: FetchFailureKind;
+    constructor(kind: FetchFailureKind, message: string);
+}
+export interface FetchResult {
+    finalUrl: string;
+    contentType: string;
+    body: string;
+}
+/**
+ * Guarded GET with manual redirect following (full guard re-run per hop). Returns
+ * decoded text or throws FetchError. `signal` lets the caller (Esc) abort.
+ */
+export declare function guardedFetch(rawUrl: string, signal?: AbortSignal): Promise<FetchResult>;

package/dist/orchestration-shell/web/ip.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Canonicalize + classify an address string. Accepts only a real IPv4/IPv6
+ * literal (the fetch guard passes addresses from `dns.lookup`, which are
+ * already canonical). Returns false for anything not provably public unicast
+ * (fail closed). Decimal/hex/octal "IP" host forms are NOT valid `net.isIP`
+ * literals, so they never reach here as a resolved address — and the host-level
+ * guard rejects non-IP, non-DNS hosts separately.
+ */
+export declare function isGlobalUnicastIp(addr: string): boolean;
+/**
+ * Reject hostnames that are obviously local even before DNS, and normalize a
+ * literal-IP host given in a non-canonical encoding (decimal `2130706433`, hex
+ * `0x7f000001`, dotted-hex/octal). Returns:
+ *   - { kind:'ip', addr } when the host is a literal IP (any encoding) → caller
+ *     validates `isGlobalUnicastIp(addr)` directly (no DNS).
+ *   - { kind:'name' } when it's a DNS name to resolve.
+ *   - { kind:'reject' } for `localhost` / `*.local` / unparseable.
+ */
+export declare function classifyHost(rawHost: string): {
+    kind: 'ip';
+    addr: string;
+} | {
+    kind: 'name';
+} | {
+    kind: 'reject';
+};

package/dist/orchestration-shell/web/sanitize.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Strip terminal control / escape sequences from untrusted text, preserving
+ * only printable characters + deliberate whitespace (`\n`, `\t`, space, and CR
+ * which is normalized to `\n` by callers). Linear-time, single pass.
+ *
+ * Removed:
+ *   - CSI  `ESC [ … final`            (cursor/screen/SGR manipulation)
+ *   - OSC  `ESC ] … (BEL | ESC \)`    (e.g. OSC-52 clipboard, window title)
+ *   - DCS/SOS/PM/APC `ESC (P|X|^|_) … ST`
+ *   - two-char escapes `ESC <byte>`   (incl. a lone trailing ESC)
+ *   - C0 controls 0x00–0x1f EXCEPT \t (0x09) and \n (0x0a)  (CR 0x0d dropped — callers normalize EOL first)
+ *   - DEL 0x7f and C1 controls 0x80–0x9f (incl. 8-bit CSI 0x9b / OSC 0x9d)
+ */
+export declare function sanitizeForTerminal(input: string): string;

package/dist/orchestration-shell/web/search.d.ts

@@ -0,0 +1,16 @@
+export interface SearchResult {
+    url: string;
+    title: string;
+}
+/**
+ * Parse DDG HTML result anchors. DDG wraps targets as
+ * `//duckduckgo.com/l/?uddg=<encoded-target>&...`; we decode `uddg` to the real
+ * URL. Linear scan over anchor tags; tolerant of markup drift. Returns ≤limit
+ * http(s) results. NEVER throws.
+ */
+export declare function parseDdgResults(html: string, limit?: number): SearchResult[];
+/**
+ * Run a keyless web search. Returns ≤limit results, or [] on any failure
+ * (network/parse) — the caller decides the advisory. `signal` lets Esc abort.
+ */
+export declare function webSearch(query: string, signal?: AbortSignal, limit?: number): Promise<SearchResult[]>;

package/dist/planner/__tests__/cache-clarification-bypass.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/planner/__tests__/cache.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/planner/__tests__/client.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/planner/__tests__/health-machine-transitions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/planner/__tests__/local-gemma.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/planner/__tests__/types-zod.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/planner/adapter.d.ts

@@ -0,0 +1,16 @@
+export type { PlannerInput, PlannerDecision, PlannerProbeResult, SessionContext, BudgetHint, Clarification, CachedClassification, ClassificationKind, Tier, PlannerHealthState, PlannerHealthTransition, } from './types';
+import type { PlannerInput, PlannerDecision, PlannerProbeResult } from './types';
+export interface PlannerAdapter {
+    classify(input: PlannerInput): Promise<PlannerDecision>;
+    probe(): Promise<PlannerProbeResult>;
+    /**
+     * CP-1.b IMPL r2 H-3 — Bind the active session for subsequent
+     * `probe()` calls. Stage 2 r1 added this to `BackendPlannerClient`
+     * but missed declaring it on the interface, so callers — notably
+     * `runOrchestrationShell` — never invoked it and `probe()` threw
+     * "no active session" unconditionally in production.
+     *
+     * Pass `null` on session teardown to clear the binding.
+     */
+    setActiveSession(sessionId: string | null): void;
+}

package/dist/planner/cache.d.ts

@@ -0,0 +1,35 @@
+import type { CachedClassification } from './types';
+export declare class PlannerCacheLayer {
+    private workflowCache;
+    private signatureCache;
+    private hydrated;
+    private mutex;
+    private cacheRoot;
+    constructor(cacheRoot?: string);
+    getWorkflowClassification(userId: string, prompt: string): Promise<CachedClassification | null>;
+    setWorkflowClassification(userId: string, prompt: string, c: CachedClassification): Promise<void>;
+    /**
+     * CP-1.b Stage 2 r2 M-2 — Explicit lazy-persist flush for callers
+     * that need to durably commit pending in-memory inserts (e.g.
+     * orchestration-shell on session end). LOCK #18 permits this
+     * trigger.
+     */
+    flush(): Promise<void>;
+    getSignatureClassification(userId: string, sigHash: string): CachedClassification | null;
+    setSignatureClassification(userId: string, sigHash: string, c: CachedClassification): void;
+    flushForTier(userId: string): Promise<void>;
+    flushAll(): Promise<void>;
+    purgeOnUserSwitch(newUserId: string): Promise<void>;
+    private hydrateWorkflowIfNeeded;
+    private rotateCorrupt;
+    private persistWorkflow;
+    private cacheDir;
+    private userIdPrefix;
+    private workflowFilePath;
+    private canonicalize;
+    private assertNoActionJson;
+    private evictLru;
+    private ensureCacheRoot;
+    private ensureDir;
+    private rmRecursiveSafe;
+}

package/dist/planner/client.d.ts

@@ -0,0 +1,103 @@
+import type { PlannerInput, PlannerDecision, PlannerProbeResult, Tier } from './types';
+import type { PlannerAdapter } from './adapter';
+import type { PlannerCacheLayer } from './cache';
+import type { PlannerHealthMachine } from './health-state';
+/**
+ * AppSync transport interface. Minimal shape so unit tests can inject
+ * a stub without mounting the full @quantiya/codevibe-core AppSyncClient.
+ */
+export interface PlannerAppSyncTransport {
+    classifyPlannerPrompt(input: {
+        sessionId: string;
+        prompt: string;
+        clarifications: string;
+        sessionContext: string;
+        budgetHint: string;
+    }): Promise<{
+        decision: string;
+        cacheHit: boolean;
+        cacheKind: string | null;
+        serverLatencyMs: number;
+        providerUsed: string;
+    }>;
+    pingPlanner(input: {
+        sessionId: string;
+    }): Promise<{
+        ok: boolean;
+        ms: number;
+    }>;
+}
+/**
+ * Crypto bridge — `encryptString` + `encryptJson` + `decryptJson`
+ * variants the adapter needs. Mirrors the existing
+ * codevibe-core CryptoService surface; injectable for tests.
+ */
+export interface PlannerCryptoBridge {
+    /** Encrypt a UTF-8 string to base64 AES-GCM ciphertext. */
+    encryptString(plaintext: string, sessionKeyB64: string): string;
+    /** Decrypt base64 AES-GCM → UTF-8 string. */
+    decryptString(ciphertextB64: string, sessionKeyB64: string): string;
+    /** Encrypt JSON-serializable value → base64 ciphertext. */
+    encryptJson(obj: unknown, sessionKeyB64: string): string;
+}
+export interface SessionKeyResolver {
+    getSessionKey(sessionId: string): Promise<string | null>;
+}
+export interface ShellEventEmit {
+    sessionId: string;
+    type: 'PLANNER_DECISION' | 'PLANNER_CACHE_HIT' | 'PLANNER_DEGRADED' | 'PLANNER_OUTAGE' | 'PLANNER_RECOVERED';
+    metadata?: Record<string, unknown>;
+}
+export type EmitShellEventFn = (args: ShellEventEmit) => Promise<void>;
+/**
+ * CP-1.b Stage 2 r2 M-3 — Typed errors that must NOT degrade health.
+ *
+ * The Lambda surfaces tier-gate / budget rejections as named-error
+ * GraphQL responses. Stage 2 r1's catch block recorded EVERY failure
+ * as a provider-health failure via `health.recordCall(elapsed, false)`,
+ * incorrectly driving the health machine toward Degraded/Outage on
+ * what are user-tier policy events (not provider outages). The
+ * client now classifies errors and ONLY records provider failures
+ * against health; tier/budget rejections emit NOTIFICATION events
+ * and throw without touching the machine.
+ */
+export declare class PlannerBudgetExceededError extends Error {
+    constructor(msg: string);
+}
+export declare class PlannerTierGateRejectedError extends Error {
+    constructor(msg: string);
+}
+export declare class BackendPlannerClient implements PlannerAdapter {
+    private transport;
+    private cache;
+    private health;
+    private crypto;
+    private sessionKeyResolver;
+    private emitShellEvent;
+    /** Shell-side tier-change detection (LOCK #30). */
+    lastClassifyTier: Tier | null;
+    /**
+     * CP-1.b Stage 2 r2 M-4 — Active session for probe(). The probe
+     * mutation requires a sessionId for ownership check; carrying the
+     * session in client state lets callers use the canonical
+     * `PlannerAdapter.probe()` contract. Set via `setActiveSession()`
+     * by orchestration-shell on session start.
+     */
+    private activeSessionId;
+    constructor(transport: PlannerAppSyncTransport, cache: PlannerCacheLayer, health: PlannerHealthMachine, crypto: PlannerCryptoBridge, sessionKeyResolver: SessionKeyResolver, emitShellEvent: EmitShellEventFn);
+    /**
+     * CP-1.b Stage 2 r2 M-4 — Set the active session ID used by
+     * `probe()`. Called by the orchestration-shell on session start
+     * (and cleared to `null` on session end).
+     */
+    setActiveSession(sessionId: string | null): void;
+    classify(input: PlannerInput): Promise<PlannerDecision>;
+    /**
+     * CP-1.b Stage 2 r2 M-4 — Honor the `PlannerAdapter.probe()`
+     * contract by reading the session from client state (set via
+     * `setActiveSession()`). Stage 2 r1 threw unconditionally and
+     * required callers to use the now-removed `probeWithSession()`
+     * method, which violated the adapter interface.
+     */
+    probe(): Promise<PlannerProbeResult>;
+}

package/dist/planner/health-state.d.ts

@@ -0,0 +1,24 @@
+import type { PlannerHealthState, PlannerHealthTransition } from './types';
+export type { PlannerHealthState, PlannerHealthTransition };
+export declare class PlannerHealthMachine {
+    private emitFn;
+    state: PlannerHealthState;
+    consecutiveFailures: number;
+    consecutiveSuccesses: number;
+    recentLatenciesMs: number[];
+    private readonly URGENT_FAILURE_FOR_DEGRADE;
+    private readonly P95_DEGRADE_THRESHOLD_MS;
+    private readonly P95_RECOVER_THRESHOLD_MS;
+    private readonly DEGRADED_TO_OUTAGE_FAILURES;
+    private readonly RECOVER_SUCCESSES_NEEDED;
+    private readonly RING_BUFFER_SIZE;
+    private readonly DEGRADED_PROBE_INTERVAL_MS;
+    private readonly OUTAGE_PROBE_INTERVAL_MS;
+    private lastProbeAt;
+    constructor(emitFn: (transition: PlannerHealthTransition) => void);
+    recordCall(latencyMs: number, success: boolean): PlannerHealthState;
+    shouldProbe(): boolean;
+    markProbeFired(): void;
+    private deriveNextState;
+    private p95Of;
+}

package/dist/planner/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types';
+export * from './adapter';
+export { PlannerCacheLayer } from './cache';
+export { PlannerHealthMachine } from './health-state';
+export { BackendPlannerClient, PlannerBudgetExceededError, PlannerTierGateRejectedError, type PlannerAppSyncTransport, type PlannerCryptoBridge, type SessionKeyResolver, type ShellEventEmit, type EmitShellEventFn, } from './client';
+export { LocalGemmaPlannerAdapter, parseLocalGemmaPlannerDecision, renderLocalGemmaPlannerPrompt, type LocalGemmaPlannerRunner, } from './local-gemma';
+export { parseLocalGemmaAdvisorySummary, renderLocalGemmaFamiliarizePrompt, type LocalGemmaAdvisoryRunner, } from './local-advisory';

package/dist/planner/local-advisory.d.ts

@@ -0,0 +1,84 @@
+import type { StructuralSummary } from '../structural-summary/types';
+export interface LocalGemmaAdvisoryRunner {
+    generateAdvisory(promptText: string, options?: LocalGemmaAdvisoryOptions): Promise<string>;
+    runtimeLabel: string;
+}
+export type LocalGemmaAdvisoryResponseFormat = 'json' | 'text';
+export interface LocalGemmaAdvisoryOptions {
+    responseFormat?: LocalGemmaAdvisoryResponseFormat;
+    numPredict?: number;
+    /**
+     * RAW base64 images (NO `data:` prefix) for the MULTIMODAL local answerer
+     * (IMAGE-ATTACHMENT-DESIGN.md §6). Set ONLY by the shell's `routeAdvisory` /
+     * image-brainstorm with `responseFormat:'text'`. The Ollama runtime forwards
+     * these to `/api/generate images[]`; the subprocess `LocalGemmaProcessRunner`
+     * has no image channel and IGNORES them (documented no-op, §6 Role B). NEVER set
+     * on the classifier (forced-JSON) or on `browse`/`familiarize`.
+     */
+    images?: string[];
+}
+export declare function redactAbsoluteLocalPaths(text: string): string;
+export declare function renderLocalGemmaFamiliarizePrompt(args: {
+    userPrompt: string;
+    summary: StructuralSummary;
+}): string;
+/**
+ * WEB-BROWSING (docs/WEB-BROWSING-DESIGN.md): build the advisory prompt for a
+ * fetched web page. The model ANSWERS THE USER'S QUESTION grounded in the fetched
+ * content. `content`/`title`/`url` are ALREADY terminal-sanitized by the caller;
+ * here we additionally treat them as untrusted DATA in the prompt.
+ *
+ * Dogfood-tuned against the real local model (see MAX_BROWSE_CONTENT_CHARS): the prompt
+ * is deliberately CONCISE + title-pointing — a long, heavily-instructed prompt makes the
+ * small model WORSE (it ignores the answer and over-cautiously refuses or invents). The
+ * model answers in PROSE (caller uses responseFormat:'text'); `parseLocalGemmaBrowseSummary`
+ * tolerates either prose or JSON. The title/content stay in the JSON DATA payload (escaped
+ * — also defeats label-spoofing) and are NEVER interpolated into the instruction prose.
+ *
+ * Budget: cap title/url/userPrompt + content (lead), then SHRINK on ACTUAL rendered length
+ * (JSON.stringify can expand quote/backslash-heavy text) so the emitted JSON stays valid.
+ */
+export declare function renderLocalGemmaBrowsePrompt(args: {
+    userPrompt: string;
+    source: {
+        url: string;
+        title: string;
+    };
+    content: string;
+}): string;
+/**
+ * WEB-BROWSING (search-route): turn the user's request + recent conversation into a
+ * concise web-search QUERY. The local model resolves acronyms/pronouns from context
+ * (e.g. "do a web search on ACP" + a prior turn defining "Agent Client Protocol" →
+ * "ACP Agent Client Protocol") — replacing the old brittle regex that searched the raw
+ * command sentence. Dogfood-validated against the real local model (gemma4 8B): produces
+ * context-aware terms, and clean terms when there's no useful context.
+ *
+ * The output is a short keyword string used ONLY as a DDG search query — the caller
+ * sanitizes + path-redacts + caps it. Prior turns are the user's OWN conversation (already
+ * sanitized at ingest); the prompt asks for a query only and is framed as untrusted data.
+ */
+export declare function renderLocalGemmaSearchQueryPrompt(args: {
+    userPrompt: string;
+    priorTurns?: string[];
+}): string;
+export declare function renderLocalGemmaBrainstormPrompt(args: {
+    userPrompt: string;
+    summary?: StructuralSummary | null;
+    priorTurns?: string[];
+}): string;
+export declare function brainstormPromptRequestsCommandGuidance(text: string): boolean;
+/**
+ * WEB-BROWSING (search-route hardening): a LENIENT summary parse for the browse
+ * route. Unlike `parseLocalGemmaAdvisorySummary` (which hard-rejects any key
+ * besides `summary`), the model summarizing a content-rich page often adds extra
+ * keys (`version`, `key_points`, …) — that should NOT hard-fail the answer. We
+ * extract `summary` if present, else the longest string field, else the
+ * stringified object as a last resort; then redact + cap. Throws only if there's
+ * genuinely no usable text. The browse caller now uses `{responseFormat:'text'}`, so
+ * PROSE (the raw-text fallback) is the common path; a JSON object is still tolerated if
+ * the model emits one.
+ */
+export declare function parseLocalGemmaBrowseSummary(raw: string): string;
+export declare function parseLocalGemmaAdvisorySummary(raw: string): string;
+export declare function parseLocalGemmaBrainstormSummary(raw: string): string;

package/dist/planner/local-gemma.d.ts

@@ -0,0 +1,23 @@
+import type { PlannerAdapter } from './adapter';
+import type { LocalGemmaAdvisoryRunner } from './local-advisory';
+import type { PlannerDecision, PlannerInput, PlannerProbeResult } from './types';
+export interface LocalGemmaPlannerRunner {
+    classify(promptText: string): Promise<string>;
+    generateAdvisory?: LocalGemmaAdvisoryRunner['generateAdvisory'];
+    probe?(): Promise<PlannerProbeResult>;
+    runtimeLabel: string;
+}
+/**
+ * Text-only route classifier prompt. It intentionally excludes repository
+ * paths, summaries, source snippets, file bodies, and the raw structural digest.
+ */
+export declare function renderLocalGemmaPlannerPrompt(input: PlannerInput): string;
+export declare function parseLocalGemmaPlannerDecision(raw: string): PlannerDecision;
+export declare class LocalGemmaPlannerAdapter implements PlannerAdapter {
+    private readonly runner;
+    private activeSessionId;
+    constructor(runner: LocalGemmaPlannerRunner);
+    classify(input: PlannerInput): Promise<PlannerDecision>;
+    probe(): Promise<PlannerProbeResult>;
+    setActiveSession(sessionId: string | null): void;
+}

package/dist/planner/types.d.ts

@@ -0,0 +1,123 @@
+import { z } from 'zod';
+export type Tier = 'FREE' | 'PRO' | 'MAX';
+export interface SessionContext {
+    sessionId: string;
+    userId: string;
+    tier: Tier;
+    currentTaskState: 'none' | 'in_progress' | 'awaiting_user' | 'awaiting_review' | 'merge_gate_pending';
+    structuralSummaryDigest: string;
+    recentEventCount: number;
+}
+export declare const SessionContextSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    userId: z.ZodString;
+    tier: z.ZodEnum<["FREE", "PRO", "MAX"]>;
+    currentTaskState: z.ZodEnum<["none", "in_progress", "awaiting_user", "awaiting_review", "merge_gate_pending"]>;
+    structuralSummaryDigest: z.ZodString;
+    recentEventCount: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    sessionId: string;
+    userId: string;
+    tier: "FREE" | "PRO" | "MAX";
+    currentTaskState: "none" | "merge_gate_pending" | "in_progress" | "awaiting_user" | "awaiting_review";
+    structuralSummaryDigest: string;
+    recentEventCount: number;
+}, {
+    sessionId: string;
+    userId: string;
+    tier: "FREE" | "PRO" | "MAX";
+    currentTaskState: "none" | "merge_gate_pending" | "in_progress" | "awaiting_user" | "awaiting_review";
+    structuralSummaryDigest: string;
+    recentEventCount: number;
+}>;
+export interface BudgetHint {
+    wallClockMsRemaining: number;
+    reviseAttempts: number;
+}
+export declare const BudgetHintSchema: z.ZodObject<{
+    wallClockMsRemaining: z.ZodNumber;
+    reviseAttempts: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    wallClockMsRemaining: number;
+    reviseAttempts: number;
+}, {
+    wallClockMsRemaining: number;
+    reviseAttempts: number;
+}>;
+export interface Clarification {
+    question: string;
+    answer: string;
+}
+export declare const ClarificationSchema: z.ZodObject<{
+    question: z.ZodString;
+    answer: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    question: string;
+    answer: string;
+}, {
+    question: string;
+    answer: string;
+}>;
+export interface PlannerInput {
+    prompt: string;
+    clarifications: Clarification[];
+    sessionContext: SessionContext;
+    budgetHint: BudgetHint;
+}
+export interface PlannerDecision {
+    action: 'start_task' | 'summarize_current_status' | 'advisory_response' | 'ask_user' | 'refuse' | 'team_decompose' | 'familiarize' | 'brainstorm' | 'browse';
+    rationale: string;
+    clarifying_question?: string;
+    advisory_summary?: string;
+    /** WEB-BROWSING — explicit http(s) URLs to read (validated/guarded downstream). */
+    browseUrls?: string[];
+    /** WEB-BROWSING — a web-search query when no explicit URL is given. */
+    browseQuery?: string;
+    /** Opaque per parent §6 lines 967-972; CP-1 NEVER inspects fields. */
+    gateRequest?: Record<string, unknown>;
+}
+export declare const PlannerDecisionSchema: z.ZodObject<{
+    action: z.ZodEnum<["start_task", "summarize_current_status", "advisory_response", "ask_user", "refuse", "team_decompose", "familiarize", "brainstorm", "browse"]>;
+    rationale: z.ZodString;
+    clarifying_question: z.ZodOptional<z.ZodString>;
+    advisory_summary: z.ZodOptional<z.ZodString>;
+    browseUrls: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    browseQuery: z.ZodOptional<z.ZodString>;
+    gateRequest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    action: "start_task" | "summarize_current_status" | "advisory_response" | "ask_user" | "refuse" | "team_decompose" | "familiarize" | "brainstorm" | "browse";
+    rationale: string;
+    clarifying_question?: string | undefined;
+    advisory_summary?: string | undefined;
+    browseUrls?: string[] | undefined;
+    browseQuery?: string | undefined;
+    gateRequest?: Record<string, unknown> | undefined;
+}, {
+    action: "start_task" | "summarize_current_status" | "advisory_response" | "ask_user" | "refuse" | "team_decompose" | "familiarize" | "brainstorm" | "browse";
+    rationale: string;
+    clarifying_question?: string | undefined;
+    advisory_summary?: string | undefined;
+    browseUrls?: string[] | undefined;
+    browseQuery?: string | undefined;
+    gateRequest?: Record<string, unknown> | undefined;
+}>;
+export interface PlannerProbeResult {
+    ok: boolean;
+    latencyMs: number;
+    errorClass?: 'timeout' | 'rate_limited' | 'unreachable' | 'malformed_response' | 'auth_failed';
+}
+export type ClassificationKind = 'workflow_status_query' | 'workflow_audit_query' | 'workflow_review_query' | 'workflow_continuation_query' | 'advisory_response_safe' | 'ask_user_clarification';
+export interface CachedClassification {
+    kind: ClassificationKind;
+    clarifyingQuestion?: string;
+    advisorySummary?: string;
+}
+export type PlannerHealthState = 'Available' | 'Degraded' | 'Outage';
+export interface PlannerHealthTransition {
+    newState: PlannerHealthState;
+    fromState: PlannerHealthState;
+    reason: string;
+    consecutiveFailures: number;
+    consecutiveSuccesses: number;
+    p95Ms: number;
+}

package/dist/reviewer/__tests__/antigravity-provider.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/reviewer/__tests__/claude-provider-json.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/reviewer/__tests__/cp7-reviewer-sandbox.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/reviewer/__tests__/output-parser-classifier-helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/reviewer/__tests__/verdict-classifier.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/reviewer/index.d.ts

@@ -11,5 +11,7 @@ export type { GeminiEnvelope, GeminiModelStats, GeminiReviewerProviderOptions, G
 export { GeminiReviewerProvider } from './providers/gemini.js';
 export type { CodexReviewerProviderOptions } from './providers/codex.js';
 export { CodexReviewerProvider } from './providers/codex.js';
+export type { AntigravityReviewerProviderOptions } from './providers/antigravity.js';
+export { AntigravityReviewerProvider } from './providers/antigravity.js';
 export { ReviewerRegistry, createSubprocessReviewerRegistry, } from './registry.js';
 export { MockReviewerSpawner, StaticReviewerMock } from './mocks.js';