@quantiya/codevibe-core 2.0.1 → 2.0.3

package/dist/appsync/event-throttle.d.ts

@@ -0,0 +1,28 @@
+/** Exposed for the single log line in createEvent. */
+export declare const CLIENT_THROTTLE_EVENTS_PER_WINDOW: number;
+interface RateWindow {
+    windowStartMs: number;
+    count: number;
+    toolUseAboveThreshold: number;
+    suppressed: number;
+    logged: boolean;
+}
+/**
+ * Decide whether this outbound event should be suppressed (not sent).
+ * Deterministic given (sessionId, type, now) and prior counter state.
+ * Exported for unit tests; resetThrottleState() clears the module map.
+ */
+export declare function shouldSuppressEvent(sessionId: string, type: string, now: number): boolean;
+/**
+ * Returns the session's rate window exactly once per window — the first time the
+ * throttle engages — for a single log line; later calls in the same window
+ * return undefined. Keeps logging out of the hot path.
+ */
+export declare function consumeThrottleLogOnce(sessionId: string): RateWindow | undefined;
+/** Test-only: clears the per-process rate map. */
+export declare function resetThrottleState(): void;
+/** Test-only: current size of the per-process rate map (eviction-bound check). */
+export declare function throttleMapSize(): number;
+/** Test-only: whether a session is currently tracked (eviction assertions). */
+export declare function throttleMapHas(sessionId: string): boolean;
+export {};

package/dist/appsync/index.d.ts

@@ -1,2 +1,5 @@
 export { AppSyncClient, AppSyncGraphQLError, DownloadUrlResponse } from './appsync-client';
+export { coerceAwsJsonObject } from './appsync-client';
+export type { ClassBPacketEnvelopeMeta } from './appsync-client';
+export type { TaskReviewSummary, TaskReviewSummaryRound, TaskReviewSummaryReviewer, TaskGroupStatusResult, } from './appsync-client';
 export { queries, mutations, subscriptions } from './queries';

package/dist/appsync/queries.d.ts

@@ -12,6 +12,15 @@ export declare const queries: {
      */
     listSessions: string;
     getSubscriptionStatus: string;
+    queryAudit: string;
+    verifyContinuationPacketWritten: string;
+    getReviewerPrompt: string;
+    getClassBSigningPublicKey: string;
+    getInReviewAssignments: string;
+    getTaskGroupTracks: string;
+    getInFlightTeamTracks: string;
+    getTaskGroupStatus: string;
+    getTaskReviewSummary: string;
 };
 export declare const mutations: {
     createSession: string;
@@ -27,9 +36,19 @@ export declare const mutations: {
     classifyPlannerPrompt: string;
     pingPlanner: string;
     applyUserDecision: string;
+    recordContinuationPacketWritten: string;
+    createTaskGroup: string;
+    submitMergeGateVerdict: string;
+    submitTrackVerificationOutcome: string;
+    claimGroupDecision: string;
+    startTask: string;
+    submitImplementorOutput: string;
+    submitReviewerVerdict: string;
 };
 export declare const subscriptions: {
     onEventCreated: string;
     onDeviceKeyRegistered: string;
     onSessionUpdated: string;
+    onClassBPacket: string;
+    onApplyUserDecision: string;
 };

package/dist/audit-keys/index.d.ts

@@ -39,3 +39,35 @@ export declare function dedupKeyForDestructiveActionEscalated(gateId: Uuid, acti
  * passed alongside).
  */
 export declare function dedupKeyForFlagBadApproval(flaggedEntryId: Uuid): string;
+/**
+ * `ModelCall` (CP-7 §3.5) — pre-forward strict audit row.
+ * Identity: `(task_id, "model_call", model_call_id)`.
+ */
+export declare function dedupKeyForModelCall(taskId: Uuid, modelCallId: string): string;
+/**
+ * `ModelCallResult` (CP-7 §3.5) — post-response enrichment row.
+ * Identity: `(task_id, "model_call_result", model_call_id)`. Shares the
+ * `model_call_id` FK with its pre-forward {@link dedupKeyForModelCall}
+ * row; framing keeps the two rows on DISTINCT keys despite the prefix
+ * overlap.
+ */
+export declare function dedupKeyForModelCallResult(taskId: Uuid, modelCallId: string): string;
+/**
+ * `EgressDenied` (CP-7 §3.5) — egress-proxy deny row.
+ * Identity: `(task_id, "egress_denied", caller_event_id)`.
+ */
+export declare function dedupKeyForEgressDenied(taskId: Uuid, callerEventId: string): string;
+/**
+ * `ModelContextScrubbed` (CP-7 §3.5) — I2 scrub row.
+ * Identity: `(task_id, "model_context_scrubbed", model_call_id, field,
+ * pattern_class)`. `field` is a canonical JSONPath; `patternClass` lets
+ * one field tripping two heuristics record both. This multi-string
+ * identity is exactly what the legacy unframed concatenation could not
+ * encode injectively.
+ */
+export declare function dedupKeyForModelContextScrubbed(taskId: Uuid, modelCallId: string, field: string, patternClass: string): string;
+/**
+ * `BrokerCredentialLoaded` (CP-7 §3.5) — keychain vendor-key load row.
+ * Identity: `(task_id, "broker_credential_loaded", credential_issuance_id)`.
+ */
+export declare function dedupKeyForBrokerCredentialLoaded(taskId: Uuid, credentialIssuanceId: string): string;

package/dist/auth/auth-service.d.ts

@@ -1,4 +1,28 @@
+import * as http from 'http';
 import { TokenData } from '../types';
+export declare const PRIMARY_PORT = 8080;
+export declare const PORT_RANGE_SIZE = 20;
+/**
+ * Bind an HTTP server to the first available port in
+ * PRIMARY_PORT..PRIMARY_PORT+PORT_RANGE_SIZE-1.
+ *
+ * Retries at the `.listen()` level (no separate probe) to avoid TOCTOU races.
+ * Installs a persistent post-bind error listener to prevent process crash on
+ * later server errors (e.g., EMFILE during connection accept).
+ *
+ * @param handler - the request handler
+ * @returns { server, port } once the server is successfully listening
+ * @throws Error with code='EADDRINUSE_ALL' if ALL ports in range are in use
+ * @throws Original error if a non-EADDRINUSE error fires (EACCES, etc.)
+ *
+ * Callers MUST wrap this in try/catch to fire the appropriate auth-failure
+ * beacon BEFORE rejecting — otherwise the outer auth-cli fallback downgrades
+ * the failure to `unknown` and we lose port_range_exhausted telemetry.
+ */
+export declare function bindOAuthServer(handler: http.RequestListener): Promise<{
+    server: http.Server;
+    port: number;
+}>;
 /**
  * Authentication service for OAuth flows
  */
@@ -51,11 +75,17 @@ export declare class AuthService {
      */
     private generateState;
     /**
-     * Build authorization URL
+     * Build authorization URL with dynamic redirect_uri (port-range fix).
      */
     private buildAuthUrl;
     /**
-     * Exchange authorization code for tokens
+     * Exchange authorization code for tokens.
+     *
+     * `redirectUri` MUST match the one passed to buildAuthUrl earlier — Cognito
+     * compares them at the token endpoint and rejects mismatches. This is the
+     * load-bearing change for the port-range fix to work end-to-end: if the
+     * authorize URL used port 8081 and the token POST uses 8080, Cognito
+     * returns redirect_uri_mismatch.
      */
     private exchangeCodeForTokens;
     /**

package/dist/auth/auth-telemetry.d.ts

@@ -14,7 +14,7 @@
  * Keep values snake_case to match GA4 custom-dimension conventions
  * used elsewhere in the codebase (`step`, `source`, `reason`).
  */
-export type AuthFailureReason = 'port_in_use' | 'server_listen_failed' | 'browser_open_failed' | 'login_timeout' | 'cognito_rejected' | 'state_mismatch' | 'no_authorization_code' | 'token_exchange_failed' | 'token_exchange_network_error' | 'keychain_write_failed' | 'user_aborted' | 'unknown';
+export type AuthFailureReason = 'port_in_use' | 'port_range_exhausted' | 'server_listen_failed' | 'browser_open_failed' | 'login_timeout' | 'cognito_rejected' | 'state_mismatch' | 'no_authorization_code' | 'token_exchange_failed' | 'token_exchange_network_error' | 'keychain_write_failed' | 'user_aborted' | 'unknown';
 /**
  * Auth flow stage the failure occurred in. Useful for GA4 faceting;
  * each reason has an implicit stage but keeping it as a distinct
@@ -82,6 +82,24 @@ export declare function fireAuthFailedBeacon(reason: AuthFailureReason, extra?:
     stage?: AuthStage;
     errorFragment?: string;
 }): Promise<void>;
+/**
+ * Coarse reason a machine fell back to file-based credential storage.
+ * - `no_keyring_service`: keytar's native addon LOADED but there's no OS
+ *   keyring service to talk to (structurally-headless Linux — no D-Bus session).
+ * - `keytar_load_failed`: keytar's native addon failed to load AND the machine
+ *   is structurally headless (libsecret absent on a no-keyring box).
+ */
+export type KeychainFallbackReason = 'no_keyring_service' | 'keytar_load_failed';
+/**
+ * Fire the `keychain_file_fallback` beacon when keychain-backend auto-selects
+ * the file backend on a structurally-headless machine. Deliberately a DISTINCT
+ * event from `auth_failed` — this is a successful, working fallback, not a
+ * failure. Lets analytics see the headless cohort and confirm the headless fix
+ * is reaching the field (the old `keychain_write_failed` signal goes quiet for
+ * these users, so we need a positive beacon, not just an absence). No PII: only
+ * platform / source / the coarse reason literal.
+ */
+export declare function fireKeychainFileFallbackBeacon(reason: KeychainFallbackReason): Promise<void>;
 /**
  * Attach the reason + beaconed marker to an Error. Non-enumerable so
  * the symbols don't serialize if the error object is ever JSON'd.

package/dist/auth/index.d.ts

@@ -1,3 +1,4 @@
 export { AuthService, authService } from './auth-service';
+export { bindOAuthServer, PRIMARY_PORT, PORT_RANGE_SIZE } from './auth-service';
 export { runAuthCli } from './auth-cli';
 export { fireAuthCompletedBeacon, fireAuthFailedBeacon, markErrorBeaconed, errorWasBeaconed, getErrorReason, type AuthFailureReason, type AuthStage, } from './auth-telemetry';

package/dist/companion-mode/__tests__/detect-parallel.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/companion-mode/index.d.ts

@@ -33,9 +33,10 @@ export interface CompanionArgs {
     /** Test seam — override bin-path resolver (real impl uses `command -v`). */
     resolveBinPath?: (kind: DetectableAgent) => string | null;
     /**
-     * Test seam — override the `<wrapper> --version` 2s health-probe
-     * (§4 line 280). Real impl spawns the wrapper with a SIGKILL on
-     * timeout. Per Stage 2 r1 Codex MEDIUM-2.
+     * Test seam — override the `<wrapper> --version` health-probe
+     * (§4 line 280; timeout AGENT_VERSION_PROBE_TIMEOUT_MS). Real impl
+     * spawns the wrapper with a SIGKILL on timeout. Per Stage 2 r1 Codex
+     * MEDIUM-2.
      */
     versionProbe?: (binPath: string) => Promise<boolean>;
 }

package/dist/companion-mode/persist-preference.d.ts

@@ -1,6 +1,6 @@
 export declare function companionPreferenceFilePath(): string;
 export interface CompanionPreference {
-    lastAgent: 'CLAUDE' | 'GEMINI' | 'CODEX';
+    lastAgent: 'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY';
     lastUsedAt: string;
 }
 /**

package/dist/config/config.d.ts

@@ -1,7 +1,14 @@
 /**
  * Environment type
+ *
+ * 'experiment' is a separate AWS environment for CodeVibe 2.0 testing —
+ * isolated DDB/Cognito/AppSync/Lambda stacks in us-east-1, manual-deploy
+ * only (NOT in the codevibe-backend pipeline). Plugins/mobile clients
+ * opt in by setting `ENVIRONMENT=experiment`. See
+ * `codevibe-backend/docs/2.0/PHASE-INFRA-EXPERIMENT-ENV-DESIGN.md`
+ * LOCK #IE-5.
  */
-export type Environment = 'development' | 'production';
+export type Environment = 'development' | 'production' | 'experiment';
 /**
  * Configuration interface
  */

package/dist/continuation/__tests__/dirty-state-collector.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/continuation/__tests__/integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/continuation/__tests__/packet-reader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/continuation/__tests__/packet-writer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/continuation/__tests__/parity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/continuation/__tests__/status-cli.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/continuation/dirty-state-collector.d.ts

@@ -0,0 +1,46 @@
+import type { AuthorityScope } from '../local-executor/authority';
+import type { RepoState } from './types';
+export interface KnownRepo {
+    /** repo basename (e.g., `codevibe-backend`). */
+    repo: string;
+    /** absolute filesystem path of repo root. */
+    path: string;
+}
+export interface GitExecOptions {
+    /** `cwd` for the git invocation. */
+    cwd: string;
+    /** Wall-clock timeout in milliseconds. */
+    timeoutMs?: number;
+}
+export type GitExecFn = (args: string[], options: GitExecOptions) => Promise<string>;
+/**
+ * Default `git` executor. Honors `cwd` + timeout, scrubs the env.
+ * Returns stdout as utf8. Throws on non-zero exit / timeout / spawn
+ * failure — caller catches and emits the `"unknown"` sentinel row.
+ */
+export declare const defaultGitExec: GitExecFn;
+export interface DirtyStateCollector {
+    collect(): Promise<RepoState[]>;
+}
+export interface DirtyStateCollectorOptions {
+    gitExec?: GitExecFn;
+    timeoutMs?: number;
+}
+/**
+ * §4.7 LOCK #C6-A-7 — enumerate `knownRepos`, clamp to authority,
+ * collect git metadata for each in-scope repo. Sentinel-friendly:
+ * missing git, non-git dirs, and timeouts each produce a row with
+ * `"unknown"` strings instead of throwing.
+ */
+export declare function collectRepoStates(authority: AuthorityScope, knownRepos: KnownRepo[], options?: DirtyStateCollectorOptions): Promise<RepoState[]>;
+/**
+ * Factory that produces a `DirtyStateCollector` bound to a known-repo
+ * snapshot + authority scope. Used by `createContinuationPacketWriter`
+ * to inject the collector as a dependency (test seam).
+ */
+export declare function createDirtyStateCollector(deps: {
+    authority: AuthorityScope;
+    knownRepos: KnownRepo[];
+    gitExec?: GitExecFn;
+    timeoutMs?: number;
+}): DirtyStateCollector;

package/dist/continuation/index.d.ts

@@ -0,0 +1,8 @@
+export type { AgentKind, HandoffReason, GateState, RepoState, ContinuationPacket, PacketWriteInput, PacketWriteResult, PacketListEntry, ContinuationPacketReadResult, } from './types';
+export { PacketFidelityError, PacketIoError, PacketHashMismatch, PacketAuditEmitError, PacketNotFound, PacketUnverified, FrontmatterMalformed, SchemaInvalid, PacketPermissionsLoose, } from './types';
+export { createContinuationPacketWriter, buildContinuationPacket, computePacketHash, renderPacketMarkdown, getPacketFilePath, getTaskDirectoryPath, } from './packet-writer';
+export type { ContinuationPacketWriter, ContinuationPacketWriterDeps, } from './packet-writer';
+export { createContinuationPacketReader, splitFrontmatter, validatePacketSchema, } from './packet-reader';
+export type { ContinuationPacketReader, ContinuationPacketReaderDeps, } from './packet-reader';
+export { collectRepoStates, createDirtyStateCollector, defaultGitExec, } from './dirty-state-collector';
+export type { DirtyStateCollector, DirtyStateCollectorOptions, GitExecFn, GitExecOptions, KnownRepo, } from './dirty-state-collector';

package/dist/continuation/packet-reader.d.ts

@@ -0,0 +1,33 @@
+import type { AppSyncClient } from '../appsync/appsync-client';
+import type { ContinuationPacket, PacketListEntry, RepoState } from './types';
+export interface ContinuationPacketReaderDeps {
+    appsync: AppSyncClient;
+    /** Test seam — override the home directory. Defaults to `os.homedir()`. */
+    homeDir?: string;
+}
+export interface ContinuationPacketReader {
+    read(taskId: string, expectedHash?: string): Promise<ContinuationPacket>;
+    list(): Promise<PacketListEntry[]>;
+}
+/**
+ * Split a markdown body into YAML frontmatter + prose body. Returns
+ * `null` for the frontmatter when the body is missing the leading
+ * `---` fence.
+ */
+export declare function splitFrontmatter(body: string): {
+    yaml: string | null;
+    prose: string;
+};
+/**
+ * Validate that a parsed YAML object matches the 17-field
+ * `ContinuationPacket` schema per LOCK #C6-A-1. Returns the typed
+ * packet on success; throws `SchemaInvalid` with a list of issues
+ * otherwise.
+ */
+export declare function validatePacketSchema(parsed: unknown): ContinuationPacket;
+/**
+ * Factory for the CP-6 packet reader.
+ */
+export declare function createContinuationPacketReader(deps: ContinuationPacketReaderDeps): ContinuationPacketReader;
+export { getPacketFilePath, getTaskDirectoryPath } from './packet-writer';
+export type { RepoState };

package/dist/continuation/packet-writer.d.ts

@@ -0,0 +1,86 @@
+import type { AppSyncClient } from '../appsync/appsync-client';
+import type { AuthorityScope } from '../local-executor/authority';
+import type { ContinuationPacket, PacketWriteInput, PacketWriteResult, RepoState } from './types';
+import { type DirtyStateCollector } from './dirty-state-collector';
+export interface ContinuationPacketWriterDeps {
+    /** Direct mutation invocation per LOCK #C6-A-10.4.10.2 — NOT routed via emitShellEvent. */
+    appsync: AppSyncClient;
+    /** Authority scope for dirty-state clamp per LOCK #C6-A-7. */
+    authority: AuthorityScope;
+    /**
+     * Optional INFORMATIONAL Class A timeline mirror. Failure is swallowed;
+     * the AUTHORITATIVE audit row is what `recordContinuationPacketWritten`
+     * produced.
+     */
+    shellEmit?: (event: {
+        type: string;
+        taskId: string;
+        packetHash: string;
+    }) => Promise<void>;
+    /** Test seam — override the dirty-state collector. */
+    dirtyStateCollector?: DirtyStateCollector;
+    /** Test seam — override the home directory. Defaults to `os.homedir()`. */
+    homeDir?: string;
+    /** Test seam — clock injection. */
+    clock?: () => number;
+    /** Test seam — random tmp-suffix injection. */
+    randomHex?: () => string;
+}
+export interface ContinuationPacketWriter {
+    write(input: PacketWriteInput): Promise<PacketWriteResult>;
+    /** Test-only — exposes the per-task mutex map size for assertions. */
+    readonly mutexMapSizeForTests: number;
+}
+/**
+ * §8.1 AUTO-SENTINEL placeholders — the values `buildContinuationPacket` writes
+ * for `completedWork` / `remainingWork` / `verification` when the source
+ * implementor did NOT enumerate its progress (e.g. a HARD quota cap where the
+ * agent never produced a structured continuation output — the realistic case
+ * the quota fork covers). Exported so the resume path
+ * (`QuorumLoop.buildResumeBrief`) can DETECT the sentinel-only case and frame
+ * the task summary as the full actionable work, instead of echoing "unknown"
+ * back to the resumed agent (which reads it as "nothing to do" and no-ops).
+ */
+export declare const WORK_NOT_ENUMERATED_SENTINEL = "unknown \u2014 implementor did not enumerate";
+export declare const VERIFICATION_NOT_RECORDED_SENTINEL = "not_checked \u2014 no verification recorded by source implementor";
+/**
+ * Build the canonical 17-field `ContinuationPacket` from the caller-
+ * supplied `PacketWriteInput`. Applies the §8.1 sentinel taxonomy:
+ *   - 8 STRICT-REQUIRED fields → throw `PacketFidelityError` on
+ *     undefined.
+ *   - 1 CALLER-OR-COLLECTOR field (`repoStates`) → fall through to
+ *     `repoStatesFromCollector` (which the caller pre-resolved).
+ *   - 7 AUTO-SENTINEL fields → default per §8.1 table.
+ *   - 1 WRITER-CONSTANT field (`packetVersion`) → always `1`.
+ */
+export declare function buildContinuationPacket(input: PacketWriteInput, repoStatesFromCollector: RepoState[]): ContinuationPacket;
+/**
+ * §4.2 LOCK #C6-A-2 — compute the JCS-canonical-JSON SHA-256 hash of
+ * the typed packet struct. Library pin: `json-freeze@^1.x` (RFC 8785
+ * conformant). The TS-side hash MUST match the Rust `serde_jcs` hash
+ * byte-for-byte (P1 parity test).
+ */
+export declare function computePacketHash(packet: ContinuationPacket): string;
+/**
+ * §4.2 LOCK #C6-A-2 — render the YAML frontmatter + prose-body
+ * markdown body. The YAML frontmatter is the human-readable
+ * serialization; the JCS-canonical-JSON is the cross-impl hash input.
+ * Both are derived from the same parsed struct.
+ */
+export declare function renderPacketMarkdown(packet: ContinuationPacket): string;
+/**
+ * §4.3 LOCK #C6-A-3 — resolve the absolute path to a task's directory.
+ * Exported for use by the reader + status CLI.
+ */
+export declare function getTaskDirectoryPath(taskId: string, homeDir?: string): string;
+/**
+ * §4.3 LOCK #C6-A-3 — resolve the absolute path to a task's
+ * CONTINUATION.md.
+ */
+export declare function getPacketFilePath(taskId: string, homeDir?: string): string;
+/**
+ * Factory for the CP-6 packet writer. Per-task `Mutex` map is owned by
+ * the returned instance (one map per writer instance — production
+ * code wires a single writer per LE process).
+ */
+export declare function createContinuationPacketWriter(deps: ContinuationPacketWriterDeps): ContinuationPacketWriter;