@quantiya/codevibe-core 2.0.1 → 2.0.3

package/dist/keychain/__tests__/keychain-backend.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/keychain/keychain-backend.d.ts

@@ -1,3 +1,85 @@
+type BackendKind = 'keytar' | 'file';
+/**
+ * Is the OS-native keyring service STRUCTURALLY UNREACHABLE in THIS process?
+ *
+ * - macOS / Windows: the OS keychain (Keychain / Credential Manager) is always
+ *   present, so this is always false.
+ * - Linux: keytar/libsecret reaches the Secret Service over the D-Bus *session*
+ *   bus, which it discovers via several mechanisms. On a truly headless box
+ *   (Docker, CI, `ssh` without a GUI/forwarded bus) NONE of them resolve, so
+ *   keytar's native addon LOADS but every operation throws ("Cannot autolaunch
+ *   D-Bus without X11 $DISPLAY" / "no Secret Service"). We return true only when
+ *   EVERY discovery signal is absent — being conservative so we never downgrade
+ *   a machine where the keyring could actually work:
+ *     1. a GUI display (`DISPLAY` / `WAYLAND_DISPLAY`) — D-Bus can X11/Wayland-
+ *        autolaunch a session bus + keyring from these even with no bus env set;
+ *     2. an explicit `DBUS_SESSION_BUS_ADDRESS`;
+ *     3. the per-user bus socket — canonically `$XDG_RUNTIME_DIR/bus`, usually
+ *        `/run/user/<uid>/bus` under systemd; we check both.
+ *
+ * IMPORTANT: this returning true means "no OS keyring is REACHABLE in this
+ * process", NOT "no keytar identity has ever existed on this machine". The same
+ * machine could have a keytar identity from a prior desktop session (e.g. GUI
+ * login, then SSH in with no forwarded bus). Auto-selecting the file backend in
+ * that case would fork the device identity — so the caller gates the auto-fallback
+ * on a "keytar was used here" marker (see `autoFileOrRefuse`), refusing to
+ * silently downgrade a machine that has a real keyring identity. A transiently-
+ * locked desktop keyring still has a bus/display, so it never reaches the
+ * fallback at all.
+ */
+export declare function osKeyringStructurallyAbsent(): boolean;
+/**
+ * Do durable file-backend credentials already exist on this machine? True when
+ * ~/.codevibe holds any `<service>.json` credential file (written by a prior
+ * file-backend session — a headless auto-fallback OR an explicit opt-in run).
+ * The marker dotfiles (`.keyring-used`) are excluded by the `.json` test, and
+ * `<service>.json` is the ONLY `.json` we ever write into ~/.codevibe
+ * (writeFileStore → fileStorePath).
+ *
+ * This is the signal that closes the REVERSE fork: a machine that fell back to
+ * file storage and wrote its device identity there, now running in a session
+ * where the OS keyring is available again. Selecting keytar at that point would
+ * read an EMPTY keyring and mint a brand-new device identity — orphaning the
+ * existing file identity and breaking the user's E2E sessions. So when durable
+ * file creds exist we keep using the file backend instead of switching to keytar.
+ * Checked on every platform (the opt-in path can create file creds anywhere) and
+ * checked in initBackends right AFTER the explicit `CODEVIBE_ALLOW_FILE_KEYCHAIN=1`
+ * opt-in (which always routes to file) but BEFORE the keytar probe, so the no-fork
+ * guarantee holds whether or not keytar loads in this session.
+ *
+ * Exported for direct unit testing — the keytar load itself goes through an
+ * `eval('require')` that escapes the test mock registry, so the predicate is
+ * pinned down here rather than only through a (non-deterministic) init path.
+ */
+export declare function fileStoreHasCredentials(): boolean;
+/** True if the file backend was auto-selected (no OS keyring service present). */
+export declare function wasAutoFileFallback(): boolean;
+/**
+ * The active backend kind, or `null` if not yet initialized / init failed.
+ *
+ * NON-THROWING diagnostic accessor — distinct from the public
+ * `getActiveBackendKind()` (which calls `ensureReady()` and THROWS when no
+ * backend could be initialized; the CP-7 vendor-key store depends on that
+ * throwing contract). This variant NEVER initializes and NEVER throws, so it can
+ * observe the post-init backend state (including the `null` refuse-to-fork
+ * outcome) for tests and diagnostics without triggering initialization.
+ */
+export declare function peekActiveBackendKind(): BackendKind | null;
+/**
+ * The active backend kind (`'keytar'` = OS-native keyring, `'file'` = the
+ * plaintext `~/.codevibe/<service>.json` fallback). Initializes the backend if
+ * it has not been chosen yet, then returns the kind.
+ *
+ * CP-7 r5 HIGH-1: the CP-7 VENDOR-KEY store calls this to FAIL CLOSED rather
+ * than silently persist a plaintext vendor key under the file backend. This is a
+ * READ-ONLY accessor — it does NOT change `get/set/deletePassword` behavior, so
+ * the legitimate OAuth-token file fallback (#29, headless Linux) is untouched.
+ *
+ * Throws the same `KeychainBackendUnavailableError` as the password ops when no
+ * backend could be initialized (keytar failed to load AND no file opt-in).
+ */
+export declare function getActiveBackendKind(): BackendKind;
 export declare function getPassword(service: string, account: string): Promise<string | null>;
 export declare function setPassword(service: string, account: string, password: string): Promise<void>;
 export declare function deletePassword(service: string, account: string): Promise<boolean>;
+export {};

package/dist/local-executor/__tests__/agentic-disposable-repo.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/agentic-resolve.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/agentic-resolver-flag.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/class-a-sign.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/class1-reconcilers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/class2-resolver.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/confined-model-caller.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/conflict-classifier.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/conflict-resolution-durable-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/conflict-resolution-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/cp1f-quorum-consumer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/cp7-audit-writer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/durable-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/git-lock-retry.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/implementor-argv.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/local-executor-teams.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-conflict-extract.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-conflict-git.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-conflict-resolve-agentic.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-conflict-resolve.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-journal-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-train-agentic-recovery.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-train-w3.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-train-waveb.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/merge-train.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/promote-wal-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/revert-reconcile.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/revert-runner.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/shared-contract-detector.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/substrate-engage.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/team-execution-flag.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/track-registry.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/wb2-review-bundle.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/wb2-substrate-spawn.live.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/workspace-shadow.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/__tests__/worktree-merge.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/agentic-disposable-repo.d.ts

@@ -0,0 +1,52 @@
+/** A structured failure in disposable-repo materialization or fd-safe import. */
+export declare class DisposableRepoError extends Error {
+    readonly reason: 'init' | 'ls-tree' | 'pack-objects' | 'dangerous-attributes' | 'read-tree' | 'checkout';
+    constructor(reason: 'init' | 'ls-tree' | 'pack-objects' | 'dangerous-attributes' | 'read-tree' | 'checkout', message: string);
+}
+/** A structured rejection from {@link fdSafeReadFile} (fail-closed → human-gate). */
+export declare class FdSafeImportError extends Error {
+    readonly reason: 'empty' | 'nul' | 'absolute' | 'traversal' | 'missing' | 'symlink-component' | 'not-regular' | 'hardlink';
+    constructor(reason: 'empty' | 'nul' | 'absolute' | 'traversal' | 'missing' | 'symlink-component' | 'not-regular' | 'hardlink', message: string);
+}
+/** A materialized disposable repo + its cleanup. */
+export interface DisposableRepo {
+    /** The working-tree root the agent resolves in (its own `.git` lives under it). */
+    repoDir: string;
+    /** Remove the disposable repo (try/finally — even on timeout/crash). */
+    cleanup(): Promise<void>;
+}
+export interface MaterializeOpts {
+    /** The REAL repo whose `conflictedTree` object closure is imported. */
+    realRepoDir: string;
+    /** The off-branch merge-result tree (`mergeTreeOffBranch`) — full both-sides clean changes + markers. */
+    conflictedTree: string;
+    /** Parent dir for the disposable repo — MUST be under the task's writable workspace area. */
+    parentDir: string;
+    /**
+     * Scan-before-checkout (injected to keep this module decoupled from merge-train;
+     * the live caller passes `scanIntegrationTreeAttributes`). Returns the flagged
+     * dangerous paths for a tree (empty = safe).
+     */
+    scanTree: (repoDir: string, tree: string) => Promise<string[]>;
+}
+/**
+ * Materialize a disposable repo checked out at `conflictedTree`, via direct pinned
+ * plumbing (NO `git clone`/upload-pack). Cleans up + rethrows on any failure.
+ */
+export declare function materializeDisposableRepo(opts: MaterializeOpts): Promise<DisposableRepo>;
+/**
+ * Atomically rename `dir` to a fresh RANDOM sibling path before reading it back —
+ * the exited agent / any disowned background process does NOT know the new path,
+ * so it cannot pre-place symlinks to win a TOCTOU race. The caller reads from the
+ * returned staged path (and is responsible for removing it). Same-filesystem
+ * rename → atomic.
+ */
+export declare function stageDirForRead(dir: string): Promise<string>;
+/**
+ * fd-safe read of ONE conflicted file at `relPath` under `rootDir` (CP-14 WB2 §2.1).
+ * `rootDir` SHOULD be a {@link stageDirForRead} staging path. Closes leaf+parent
+ * symlink (realpath-strict + `O_NOFOLLOW`), hardlink (`nlink===1`),
+ * dir/FIFO/device (`isFile`), and the read race (read-from-the-verified-fd). Any
+ * violation throws {@link FdSafeImportError} → the caller fails closed (human-gate).
+ */
+export declare function fdSafeReadFile(rootDir: string, relPath: string): Promise<Buffer>;

package/dist/local-executor/agentic-resolve.d.ts

@@ -0,0 +1,54 @@
+/**
+ * CP-14 WB2 §2.1 path C (dispatch-time fail-closed, D3-A) — the live
+ * {@link DispatchImplementor} closure THROWS this when the per-resolve confinement
+ * re-engage returns `mode: 'none'` (NEVER spawn the resolver agent unconfined).
+ * {@link resolveAgenticSlot} catches it LOCALLY and returns a clean
+ * `human_gate` (trigger `dispatch_unconfined`) — symmetric with the `materialize`
+ * trigger; the `finally` still cleans up the disposable repo. Any OTHER throw from
+ * `dispatchImplementor` (timeout, agent failure) propagates unchanged.
+ */
+export declare class AgenticDispatchUnconfinedError extends Error {
+    constructor(message: string);
+}
+/** Dispatch the incoming track's implementor into the disposable repo (read+write). */
+export type DispatchImplementor = (args: {
+    /** The disposable repo working-tree root (its own `.git`). */
+    repoDir: string;
+    /** The class-2 conflicted files the agent must resolve (markers removed). */
+    conflictedPaths: readonly string[];
+    /** The implementor agent kind + its per-spawn task identity. */
+    implementorAgent: string;
+    implementorTaskId: string;
+}) => Promise<void>;
+export interface AgenticResolveArgs {
+    realRepoDir: string;
+    conflictedTree: string;
+    /** The slot's class-2 conflicted paths — the ONLY paths whose resolved content imports. */
+    class2Paths: readonly string[];
+    /** The incoming track's implementor identity (re-dispatched as the resolver). */
+    implementorAgent: string;
+    implementorTaskId: string;
+    /** Under the task's writable workspace area. */
+    parentDir: string;
+    /** scan-before-checkout (the live caller passes `scanIntegrationTreeAttributes`). */
+    scanTree: (repoDir: string, tree: string) => Promise<string[]>;
+    /** Real implementor spawn (LE seam); tests stub it. */
+    dispatchImplementor: DispatchImplementor;
+}
+export interface AgenticResolveResolved {
+    status: 'resolved';
+    /** Resolved bytes per class-2 path (selective import — only these). */
+    resolvedBlobs: Map<string, Buffer>;
+}
+export interface AgenticResolveHumanGate {
+    status: 'human_gate';
+    trigger: 'materialize' | 'dispatch_unconfined' | 'marker_residue' | 'ref_drift' | 'fd_safe_reject' | 'missing_resolution';
+    reason: string;
+}
+export type AgenticResolveOutcome = AgenticResolveResolved | AgenticResolveHumanGate;
+/**
+ * Run the agentic class-2 resolve for ONE slot. Returns the resolved bytes for the
+ * class-2 paths (selective import), or a fail-closed human-gate. The merge-train
+ * builds the agentic record + commit from the resolved bytes (Phase 5).
+ */
+export declare function resolveAgenticSlot(args: AgenticResolveArgs): Promise<AgenticResolveOutcome>;

package/dist/local-executor/agentic-resolver-flag.d.ts

@@ -0,0 +1,9 @@
+/** The env var that disables the agentic class-2 resolver (opt-OUT). */
+export declare const AGENTIC_RESOLVER_ENV_VAR = "CODEVIBE_AGENTIC_RESOLVER";
+/**
+ * Is the agentic class-2 resolver enabled? DEFAULT-ON. The canonical falsy
+ * tokens (`0`/`false`/`off`/`no`, case-insensitive) disable it; anything else
+ * — including unset — is ON. `env` is injected for deterministic tests;
+ * production passes `process.env`.
+ */
+export declare function isAgenticResolverEnabled(env?: NodeJS.ProcessEnv): boolean;

package/dist/local-executor/authority.d.ts

@@ -5,8 +5,9 @@ export interface AuthorityScope {
     networkAllowed: boolean;
     commandAllowlist: string[];
     expiresAt: string;
+    egressAllowlist?: string[];
 }
-export type AuthorityRefusalCategory = 'authority_scope_conflict' | 'signature_invalid' | 'ulid_replay' | 'policy_rejection';
+export type AuthorityRefusalCategory = 'authority_scope_conflict' | 'signature_invalid' | 'ulid_replay' | 'policy_rejection' | 'egress_denied';
 export interface AuthorityRefusal {
     category: AuthorityRefusalCategory;
     detail: string;
@@ -25,5 +26,36 @@ export declare function enforceRead(scope: AuthorityScope, p: string): Promise<s
 export declare function safeReadFile(scope: AuthorityScope, p: string, options?: {
     encoding?: BufferEncoding;
 }): Promise<string | Buffer>;
+/**
+ * CP-1.f Hybrid authority split (dogfood fix 2026-06-10) — merge an engine-issued
+ * per-task path scope (`incoming`, from a `TaskAuthorized` Class-B packet) OVER
+ * the desktop-seeded `base` scope (the static implementor command authority from
+ * `makeImplementorCommandScope`).
+ *
+ * The engine is the authority on per-task PATH scopes (write/read/network/expiry);
+ * the DESKTOP is the authority on WHICH agent binaries may run (the
+ * `commandAllowlist`). The engine therefore sends `command_allowlist: []` VERBATIM
+ * on every `TaskAuthorized` (task_authorizer.rs:334 — pinned by its
+ * `command_allowlist.is_empty()` assertion). A wholesale `this.scope = incoming`
+ * (the pre-fix `advanceAuthorityScope`) wiped the desktop's seeded implementor
+ * allowlist, so the SECOND task of a session spawned its implementor against an
+ * EMPTY allowlist → `authority_scope_conflict: command "claude …" not in
+ * allowlist []` (the live dogfood blocker — task 1 ran on the seeded initial
+ * scope, then its `TaskAuthorized`-on-approve replaced the scope with the engine's
+ * empty-command scope, and task 2's round-0 spawn was refused).
+ *
+ * The merge takes the engine's path/network/expiry fields and UNIONs the command
+ * allowlists, preserving the base (desktop) command authority. Today the engine's
+ * `incoming.commandAllowlist` is always `[]` so the result is exactly the base
+ * allowlist; the union is defense-in-depth (an engine that ever sends additional
+ * command entries adds them rather than replaces). This is the behavior the
+ * implementor-argv.ts doc already promised: "`advanceAuthorityScope` will MERGE
+ * the engine's expiring path scope over this static command authority."
+ *
+ * Mirrors the team-track `scopeFromOwnership` idiom (local-executor-impl.ts),
+ * which already preserves `commandAllowlist: [...this.scope.commandAllowlist]`
+ * when deriving a per-track scope.
+ */
+export declare function mergeAuthorityScope(base: AuthorityScope, incoming: AuthorityScope): AuthorityScope;
 export declare function enforceNetwork(scope: AuthorityScope): void;
 export declare function enforceCommand(scope: AuthorityScope, argv: string[]): void;

package/dist/local-executor/class-a-emit.d.ts

@@ -1,5 +1,6 @@
 import type { AdapterProgressEnvelope } from '../adapter/progress';
 import { AuthorityRefusal, AuthorityRefusalCategory } from './authority';
+import { type DeviceSigningKey } from './class-a-sign';
 import { AgentKind, FailureClass, ProcessRole } from './types';
 export type ExecutionEventKind = 'PROCESS_SPAWNED' | 'TOOL_USE' | 'FILE_CHANGE' | 'VERIFICATION_RUN' | 'PROCESS_EXITED';
 export type ClassAMessageType = 'EXECUTION_EVENT' | 'EXECUTOR_REFUSAL' | 'VERIFICATION_RESULT' | 'ADAPTER_PROGRESS';
@@ -89,9 +90,10 @@ export declare class ClassAEmitter {
     private readonly sink;
     private readonly cap;
     private readonly logger?;
+    private readonly signingKey?;
     private readonly seenUlids;
     private readonly messageIdFactory;
-    constructor(sink: ClassASink, seenUlids?: Set<string>, cap?: number, logger?: EmitterLogger | undefined, messageIdFactory?: () => string);
+    constructor(sink: ClassASink, seenUlids?: Set<string>, cap?: number, logger?: EmitterLogger | undefined, messageIdFactory?: () => string, signingKey?: DeviceSigningKey | undefined);
     emitProcessSpawned(ctx: ClassAEmitterContext, args: {
         pid: number;
         processRole: ProcessRole;

package/dist/local-executor/class-a-sign.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The device's raw P-256 key material, as stored on the device identity
+ * (`KeychainManager`). Both halves are STANDARD base64 of the raw bytes:
+ *   - `privateKeyB64`: 32-byte P-256 scalar (`getPrivateKey()` raw form).
+ *   - `publicKeyB64`: 64-byte uncompressed point x‖y, NO 0x04 prefix
+ *     (`getPublicKey().subarray(1)` raw form).
+ * This matches `crypto-service.ts:52-68` + the 2f.3.a wire-format lock.
+ */
+export interface DeviceSigningKey {
+    privateKeyB64: string;
+    publicKeyB64: string;
+}
+/**
+ * Produce the RFC 8785 JCS canonical-JSON STRING of `obj` with its
+ * `signatureFieldName` key REMOVED (the signature cannot be part of its own
+ * signing input). Mirrors the Rust `canonical_json_for_signing` /
+ * `canonical_json_for_merge_classification` discipline: materialize the
+ * object, drop the signature key, then canonicalize. The object's keys are
+ * already camelCase on the wire; JCS sorts them lexicographically so the
+ * camelCase wire names are what get hashed.
+ *
+ * Exported so tests (and the golden-vector fixture generator) can assert the
+ * exact canonical string and catch future json-freeze JCS drift.
+ */
+export declare function canonicalJsonForSigning(obj: Record<string, unknown>, signatureFieldName: string): string;
+/**
+ * Sign a Class A envelope object. The canonical bytes are the JCS of the
+ * envelope with `signature` removed (matching Rust
+ * `canonical_json_for_signing`, signing.rs:126-141). Returns the
+ * STANDARD-base64 raw-64-byte signature to assign to `envelope.signature`.
+ *
+ * `unsignedEnvelope` is the envelope object WITHOUT (or before) the
+ * `signature` field is set; any existing `signature` key is stripped before
+ * canonicalizing, so passing a partially-populated object is safe.
+ */
+export declare function signClassAEnvelope(unsignedEnvelope: Record<string, unknown>, keys: DeviceSigningKey): string;
+/**
+ * Sign a MergeGate classification (#C12-8). The signing domain is the JCS of
+ * the classification with `signatureB64` removed AND `leDeviceId` INSIDE the
+ * domain (only `signatureB64` is stripped) — the device binds itself into
+ * its own signature. Matches the Rust
+ * `canonical_json_for_merge_classification`, which removes only the
+ * camelCase `signatureB64` key.
+ *
+ * Callers (W2.b) build the classification object, set `leDeviceId`, leave
+ * `signatureB64` empty/unset, call this helper, then assign the returned
+ * base64 to `signatureB64`. The crypto lives here so W2.b only orchestrates.
+ *
+ * @param classificationWithoutSig the camelCase classification object with
+ *        `leDeviceId` populated and `signatureB64` empty/absent.
+ * @param keys the LE's device P-256 key material.
+ * @param leDeviceId the signing device id; written into the classification's
+ *        `leDeviceId` field (inside the signing domain) before canonicalizing
+ *        — so the caller cannot accidentally sign over a stale/blank value.
+ * @returns the STANDARD-base64 raw-64-byte signature for `signatureB64`.
+ */
+export declare function signMergeClassification(classificationWithoutSig: Record<string, unknown>, keys: DeviceSigningKey, leDeviceId: string): string;