@quantiya/codevibe-core 2.0.1 → 2.0.2

package/dist/substrate-launch/le-env-scrub.d.ts

@@ -0,0 +1,77 @@
+import { spawnSync } from "node:child_process";
+/** The guard marker: present on a re-exec'd (already-scrubbed) LE process. */
+export declare const LE_ENV_SCRUBBED_MARKER = "CODEVIBE_LE_ENV_SCRUBBED";
+/** True if `key` is a credential-shaped env var that must not ride the LE env. */
+export declare function isCredShapedEnvKey(key: string): boolean;
+/**
+ * Return the credential-shaped keys present in `env` (the keys the re-exec
+ * scrubs). Exported for the test + for an optional caller-side log of WHAT was
+ * scrubbed (the VALUES are never logged).
+ */
+export declare function findCredShapedKeys(env: Readonly<Record<string, string | undefined>>): string[];
+/**
+ * Build the scrubbed env for the re-exec: a COPY of `env` with every
+ * credential-shaped key REMOVED and the guard marker ADDED. The base-URL /
+ * config-discovery / marker keys + every non-cred var are preserved verbatim so
+ * the re-exec'd LE behaves identically (companion + orchestration unaffected).
+ */
+export declare function buildScrubbedLeEnv(env: Readonly<Record<string, string | undefined>>): Record<string, string>;
+/** Injectable deps so the re-exec logic is unit-testable without a real fork. */
+export interface LeEnvScrubDeps {
+    /** Platform check (default `process.platform`). The vector is macOS-only. */
+    platform?: NodeJS.Platform;
+    /** The env to inspect (default `process.env`). */
+    env?: Readonly<Record<string, string | undefined>>;
+    /** The interpreter to re-exec (default `process.execPath`). */
+    execPath?: string;
+    /** The argv to re-exec with (default `process.argv.slice(1)` — drops node). */
+    argv?: string[];
+    /** The cwd to preserve (default `process.cwd()`). */
+    cwd?: string;
+    /**
+     * The synchronous spawn primitive (default `node:child_process.spawnSync`).
+     * Injected in tests so we can assert the call shape WITHOUT a real re-exec.
+     */
+    spawnSyncFn?: typeof spawnSync;
+    /**
+     * The process-exit primitive (default `process.exit`). Injected in tests so
+     * the re-exec path can be asserted without killing the test runner.
+     */
+    exit?: (code: number) => never;
+    /** Optional structured log sink (no VALUES — only the scrubbed key NAMES). */
+    onScrub?: (scrubbedKeys: string[]) => void;
+}
+/**
+ * Decide-and-act: if the LE's exec-time env carries a credential-shaped var AND
+ * it has NOT already been scrubbed (the guard marker is absent), RE-EXEC the LE
+ * with a scrubbed exec-time env so the sandboxed agent's reachable parent
+ * (KERN_PROCARGS2) carries no credential — then `process.exit()` with the
+ * child's exit code. Otherwise RETURN (the caller continues normally).
+ *
+ * ── r6 HIGH-1 (Codex): SCAN-FIRST, marker is NOT a blind bypass ────────────
+ * The marker (`CODEVIBE_LE_ENV_SCRUBBED`) was checked FIRST and returned EARLY,
+ * so a launch env carrying BOTH the marker AND a cred-shaped var (e.g. a spoofed
+ * `CODEVIBE_LE_ENV_SCRUBBED=1` + `ANTHROPIC_API_KEY=…`) skipped the re-exec — the
+ * LE kept a vendor key in its exec-time procargs, reopening the A5 parent-procargs
+ * vector. The fix REORDERS so the credential SCAN is authoritative:
+ *   - NO cred-shaped key remains  → return clean, regardless of the marker.
+ *   - cred-shaped key present, marker ABSENT → re-exec + set marker (one-shot).
+ *   - cred-shaped key present, marker PRESENT → PATHOLOGICAL/spoofed state. A
+ *     genuine re-exec'd child has NO cred-shaped keys (we stripped them in
+ *     `buildScrubbedLeEnv`), so the marker is NOT trustworthy here: FAIL CLOSED
+ *     (throw) — never launch the LE with cred-shaped vars present, and do NOT
+ *     loop-re-exec (which could spin).
+ * The one-shot loop guard is INTACT for the normal path: the re-exec'd child has
+ * no creds → the scan finds nothing → it returns clean via the first branch.
+ *
+ * On the non-darwin path (or when no cred-shaped var is present) it is a cheap
+ * no-op that returns.
+ *
+ * @returns `false` if no re-exec happened (caller proceeds in THIS process). It
+ *   never returns `true` — when a re-exec IS performed it calls `exit()` and
+ *   does not return (the type is `boolean` for the test's injected-exit case,
+ *   where the stubbed `exit` does return).
+ * @throws if a cred-shaped var is present WHILE the scrub marker is already set
+ *   (the pathological/spoofed state) — fail closed, never launch with a cred.
+ */
+export declare function scrubLeEnvOrReexec(deps?: LeEnvScrubDeps): boolean;

package/dist/substrate-launch/sanitized-env.d.ts

@@ -0,0 +1,73 @@
+import type { VendorProvider } from "../credential-broker/types";
+/**
+ * The minimal SAFE env keys the agent process needs for hygiene — NEVER
+ * credentials. We copy these from a caller-supplied safe source (defaulting to
+ * a fixed minimal set), NOT a blanket `process.env` sweep.
+ *
+ * Deliberately EXCLUDES: anything `*_KEY`/`*_TOKEN`/`*_SECRET`, AWS_*, GH_*,
+ * GOOGLE_*, ANTHROPIC_*, OPENAI_*, SSH_*, npm_config_*, and every other ambient
+ * var. If a future hygiene var is needed, it is added HERE explicitly.
+ */
+export declare const SAFE_ENV_ALLOWLIST: readonly string[];
+/** A fixed, minimal PATH for the sandbox — does NOT trust the host PATH. */
+export declare const SANDBOX_DEFAULT_PATH = "/usr/local/bin:/usr/bin:/bin";
+/** Inputs for building the agent's sanitized base env. */
+export interface SanitizedEnvInput {
+    /** The vendor the substrate-confined implementor brokers (Claude/Codex). */
+    provider: VendorProvider;
+    /**
+     * The URL the agent reaches the broker at FROM INSIDE the sandbox
+     * (`SubstrateSpec.sandboxBrokerUrl`). For Claude this becomes
+     * `ANTHROPIC_BASE_URL`; for Codex the base_url goes in config (the env is not
+     * the redirect channel) but we still set it for parity/debuggability.
+     */
+    sandboxBrokerUrl: string;
+    /**
+     * The HOME the agent sees inside the sandbox. For A1 Docker this is the
+     * container workdir-adjacent home; for A5 it is the worktree (the only
+     * writable fs). NEVER the host home (that would expose the keychain/dotfiles).
+     */
+    sandboxHome: string;
+    /**
+     * The IN-SANDBOX path of the apiKeyHelper bootstrap dir (PART D). The agent
+     * config (`settings.json` for Claude / `config.toml` for Codex) lives HERE,
+     * and that config is what points the CLI at the broker apiKeyHelper / `[auth]
+     * command`. We MUST point the agent at this dir via the CLI's native config-
+     * discovery env, or the agent never reads the helper and the "creditless"
+     * loop is fake (Stage-2 M-1):
+     *   - Claude → `CLAUDE_CONFIG_DIR` (SPIKE-FINDINGS §1 method: isolated
+     *     `HOME` + `CLAUDE_CONFIG_DIR` is the discovery path the spike used).
+     *   - Codex  → `CODEX_HOME` (SPIKE-FINDINGS §2 empirical: clean `HOME` +
+     *     `CODEX_HOME` is the config-discovery path the spike used).
+     * Required for the substrate path; the I1 allow-list still drops every cred.
+     */
+    sandboxBootstrapDir: string;
+    /**
+     * A SAFE source for the hygiene values (LANG/TERM/…). Defaults to a minimal
+     * fixed map. The LE may pass a curated subset of `process.env` for locale, but
+     * ONLY the SAFE_ENV_ALLOWLIST keys are copied — credentials never are.
+     */
+    safeSource?: Readonly<Record<string, string | undefined>>;
+    /** Override the sandbox PATH (default {@link SANDBOX_DEFAULT_PATH}). */
+    path?: string;
+}
+/**
+ * Build the agent's sanitized BASE env (allow-list; no markers). The caller
+ * (the spawn seam) folds the §3.6 marker keys in afterward via
+ * `buildSubstrateImplementorEnv`. The result is the COMPLETE non-marker env the
+ * agent sees — every ambient credential is ABSENT because nothing is copied
+ * unless it is on the allow-list.
+ *
+ * @returns a fresh `Record<string,string>` containing ONLY: PATH, HOME, the
+ *   safe hygiene keys present in `safeSource`, and the broker base-URL var(s).
+ */
+export declare function buildSanitizedBaseEnv(input: SanitizedEnvInput): Record<string, string>;
+/**
+ * Defensive fail-closed guard: assert the built env carries NO credential-
+ * shaped key. The allow-list builder never produces one, but this is the
+ * belt-and-suspenders check the LE runs before launch — a thrown error here is
+ * a HARD STOP (better to refuse to launch than to leak a credential into the
+ * agent). The broker base-URL vars are explicitly exempt (they are not
+ * credentials and not key-shaped). Returns the env unchanged on success.
+ */
+export declare function assertNoAmbientCreds(env: Readonly<Record<string, string>>): void;

package/dist/types/auth.d.ts

@@ -11,5 +11,10 @@ export interface TokenData {
 }
 /**
  * Environment configuration
+ *
+ * Mirrors `src/config/config.ts` Environment. Kept in sync (LOCK #IE-5):
+ * widening one without the other surfaces as duplicate-definition compile
+ * errors at every import site. See
+ * `codevibe-backend/docs/2.0/PHASE-INFRA-EXPERIMENT-ENV-DESIGN.md`.
  */
-export type Environment = 'development' | 'production';
+export type Environment = 'development' | 'production' | 'experiment';

package/dist/types/events.d.ts

@@ -23,7 +23,9 @@ export declare enum EventType {
     PLANNER_RECOVERED = "PLANNER_RECOVERED",
     SLASH_COMMAND_INVOKED = "SLASH_COMMAND_INVOKED",
     STRUCTURAL_SUMMARY_GENERATED = "STRUCTURAL_SUMMARY_GENERATED",
-    LOCAL_AUTHORITY_REFUSAL = "LOCAL_AUTHORITY_REFUSAL"
+    LOCAL_AUTHORITY_REFUSAL = "LOCAL_AUTHORITY_REFUSAL",
+    CONTINUATION_PACKET_WRITTEN = "CONTINUATION_PACKET_WRITTEN",
+    CONTINUATION_PACKET_FAILED = "CONTINUATION_PACKET_FAILED"
 }
 export declare enum EventSource {
     DESKTOP = "DESKTOP",

package/dist/types/reviewer.d.ts

@@ -25,20 +25,20 @@ export declare enum ReviewerRole {
 /**
  * One seat in a user's reviewer panel. `seat_id` is the panel position
  * (0-indexed: Pro has seats 0–1, Max has 0–2). `role` is the review lens
- * — unique within a policy. `agent` (CLAUDE | GEMINI | CODEX) may repeat
- * across seats — single-vendor users get multiple same-kind seats with
- * distinct roles.
+ * — unique within a policy. `agent` (CLAUDE | GEMINI | CODEX | ANTIGRAVITY —
+ * AGY-2.0 Phase A reviewer-type contract, task #51) may repeat across seats
+ * — single-vendor users get multiple same-kind seats with distinct roles.
  */
 export interface ReviewerAgentSpec {
     seatId: number;
     role: ReviewerRole;
-    agent: 'CLAUDE' | 'GEMINI' | 'CODEX';
+    agent: 'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY';
     modelHint?: string | null;
 }
 export interface ReviewerAgentSpecInput {
     seatId: number;
     role: ReviewerRole;
-    agent: 'CLAUDE' | 'GEMINI' | 'CODEX';
+    agent: 'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY';
     modelHint?: string | null;
 }
 /**
@@ -60,7 +60,7 @@ export interface UpdateReviewerPolicyInput {
  */
 export interface UserReviewerPolicySnapshot {
     userId: string;
-    availableAgents?: Array<'CLAUDE' | 'GEMINI' | 'CODEX'> | null;
+    availableAgents?: Array<'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY'> | null;
     orchestrationEnabledDefault?: boolean | null;
     reviewerSeats?: ReviewerAgentSpec[] | null;
     updatedAt: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -16,7 +16,8 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "emit-types": "tsc --emitDeclarationOnly",
-    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --packages=external --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\"",
+    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --packages=external --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && npm run verify-no-test-hooks",
+    "verify-no-test-hooks": "if grep -Elq 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT' dist/index.js dist/orchestration-shell/cli.js; then echo 'ERROR: a CODEVIBE_TEST_FORCE_* test hook leaked into a published bundle (prod-unreachability invariant)'; exit 1; fi; echo 'OK — no test-only hooks in published bundles'",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run build",
     "test": "vitest run",
@@ -27,14 +28,17 @@
     "@iarna/toml": "^2.2.5",
     "@npmcli/package-json": "^5.2.1",
     "gradient-string": "^3.0.0",
-    "ink": "^5.2.1",
+    "ink": "5.2.1",
     "ink-select-input": "^6.2.0",
     "ink-spinner": "^5.0.0",
     "ink-text-input": "^6.0.0",
+    "json-freeze": "^1.0.0",
+    "parse5": "^7.3.0",
     "react": "^18.3.1",
     "ulid": "^3.0.0",
     "uuid": "^9.0.0",
     "ws": "^8.14.0",
+    "yaml": "^2.9.0",
     "zod": "^3.23.0"
   },
   "optionalDependencies": {