@quantiya/codevibe-core 2.0.48 → 2.0.50

package/dist/orchestration-shell/cli.js

@@ -1696,6 +1696,34 @@ function fileStoreHasCredentials() {
     return !1;
   }
 }
+function isKeytarBinaryMissing(loadError) {
+  return loadError !== null && /Cannot find module ['"][^'"]*keytar\.node['"]/.test(loadError);
+}
+function keytarInstallRoot() {
+  try {
+    let nodeRequire = eval("require"), packageDir = path4.dirname(nodeRequire.resolve("keytar/package.json"));
+    return path4.dirname(path4.dirname(packageDir));
+  } catch {
+    return null;
+  }
+}
+function keytarBinaryMissingMessage(loadError, installRoot, migratedToKeyring = !1) {
+  return [
+    "CodeVibe's keyring module (keytar) is installed without its native binary,",
+    "so CodeVibe cannot read the credentials it keeps in the OS keyring.",
+    "This is an incomplete installation, not a sign-in problem: `codevibe login`",
+    "will not fix it. Repair the module with:",
+    installRoot ? `  (cd "${installRoot}" && npm rebuild prebuild-install keytar)` : "  npm rebuild prebuild-install keytar   (in the directory whose node_modules holds keytar)",
+    "(`codevibe update` also repairs this for the Claude Code plugin.)",
+    // On a migrated machine the fail-closed guarantee must stay visible: file storage is
+    // retired here, and using it would fork the device identity.
+    ...migratedToKeyring ? ["Refusing to fall back to file storage \u2014 that would fork the device identity."] : [],
+    // First line only: Node appends a multi-line "Require stack" that buries the fix.
+    `(keytar load error: ${loadError.split(`
+`)[0]})`
+  ].join(`
+`);
+}
 function autoSelectFileBackend(reason) {
   warnToStderr([
     "",
@@ -1790,7 +1818,15 @@ function initBackends() {
       backend = "keytar", logger.info("[keychain-backend] Using keytar (migrated-to-keyring tombstone present)"), markKeytarUsed();
       return;
     }
-    keytarModule = null, initError = new KeychainBackendUnavailableError(
+    if (keytarModule = null, tombstoneKeytarError && isKeytarBinaryMissing(tombstoneKeytarError)) {
+      initError = new KeychainBackendUnavailableError(
+        keytarBinaryMissingMessage(tombstoneKeytarError, keytarInstallRoot(), !0)
+      ), logger.warn(
+        "[keychain-backend] migrated-to-keyring tombstone but keytar has no native binary \u2014 failing closed (incomplete installation)"
+      );
+      return;
+    }
+    initError = new KeychainBackendUnavailableError(
       [
         "This machine migrated its CodeVibe credentials to the OS keyring, but the",
         "keyring is not reachable in this session (no desktop session / D-Bus).",
@@ -1843,6 +1879,12 @@ function initBackends() {
     autoFileOrRefuse("keytar_load_failed");
     return;
   }
+  if (keytarLoadError && isKeytarBinaryMissing(keytarLoadError)) {
+    initError = new KeychainBackendUnavailableError(
+      keytarBinaryMissingMessage(keytarLoadError, keytarInstallRoot())
+    );
+    return;
+  }
   initError = new KeychainBackendUnavailableError(
     [
       "CodeVibe could not load the OS-native keyring (keytar).",
@@ -3380,6 +3422,21 @@ var queries = {
     }
   `
   ),
+  // Hosted Gemma advisory text generation (browse synthesis, brainstorm, etc.).
+  // Lambda decrypts input prompt via session key, dispatches to Bedrock Gemma,
+  // encrypts response under session key, returns.
+  generatePlannerAdvisory: (
+    /* GraphQL */
+    `
+    mutation GeneratePlannerAdvisory($input: GeneratePlannerAdvisoryInput!) {
+      generatePlannerAdvisory(input: $input) {
+        advisoryText
+        serverLatencyMs
+        providerUsed
+      }
+    }
+  `
+  ),
   // CP-8 min Stage 1 R1 closure (HIGH-1) — applyUserDecision SDK call.
   // Implementation deviation from #C8M-6 literal wording: codevibe-core
   // does NOT take a runtime dep on `@quantiya/quorum-core` (per the
@@ -4644,6 +4701,20 @@ var RECONNECT_CONFIG = {
 function shouldDeliverSubscribedEvent(event, receiveDesktopEvents) {
   return !!(event.source === "MOBILE" /* MOBILE */ || receiveDesktopEvents && event.source === "DESKTOP" /* DESKTOP */);
 }
+var CREDENTIAL_STORAGE_UNAVAILABLE_EXIT_CODE = 78;
+function describeStoredAuthFailure(kind, detail) {
+  return kind === "credential_storage_unavailable" ? {
+    exitCode: CREDENTIAL_STORAGE_UNAVAILABLE_EXIT_CODE,
+    message: [
+      "CodeVibe could not read its stored credentials. This is not a sign-in problem.",
+      detail ?? "The credential store is unavailable."
+    ].join(`
+`)
+  } : kind === "refresh_network" ? {
+    exitCode: 1,
+    message: "Could not reach the CodeVibe sign-in service to refresh your session. Check your network connection and try again; you are still signed in."
+  } : { exitCode: 1, message: 'Not authenticated. Run "codevibe login" to sign in.' };
+}
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 12e4, MIN_HEARTBEAT_INTERVAL_MS = 1e3, MAX_HEARTBEAT_INTERVAL_MS = 3e5;
 function isRecognizedNonProductionEnvironment(env = process.env) {
   let canonicalEnv = getEnvironment(env);
@@ -4670,6 +4741,11 @@ var AppSyncClient = class _AppSyncClient {
      * round-1 Codex M1.
      */
     this.lastAuthFailureKind = null;
+    /**
+     * The credential-store error message behind a `credential_storage_unavailable`
+     * failure (it names the cause and the fix). `null` for every other outcome.
+     */
+    this.lastAuthFailureDetail = null;
     /**
      * Sentinel set inside `performRefresh` / `callCognitoRefresh` when
      * the refresh round-trip fails with a network-shaped error (DNS,
@@ -4786,6 +4862,10 @@ var AppSyncClient = class _AppSyncClient {
   getLastAuthFailureKind() {
     return this.lastAuthFailureKind;
   }
+  /** The credential-store error message behind a `credential_storage_unavailable` failure. */
+  getLastAuthFailureDetail() {
+    return this.lastAuthFailureDetail;
+  }
   /**
    * Heuristic — does the error message look like a transient network
    * failure rather than an auth-token rejection? Used for refresh-path
@@ -4800,13 +4880,13 @@ var AppSyncClient = class _AppSyncClient {
    * Authenticate using stored OAuth tokens from keychain
    */
   async authenticateWithStoredTokens() {
-    this.lastAuthFailureKind = null;
+    this.lastAuthFailureKind = null, this.lastAuthFailureDetail = null;
     try {
       let tokens;
       try {
         tokens = await keychainManager.getTokens(this.environment);
       } catch (error) {
-        return logger.error("[AppSyncClient] Could not read stored authentication tokens:", error), this.lastAuthFailureKind = "credential_storage_unavailable", !1;
+        return logger.error("[AppSyncClient] Could not read stored authentication tokens:", error), this.lastAuthFailureKind = "credential_storage_unavailable", this.lastAuthFailureDetail = error instanceof Error ? error.message : String(error), !1;
       }
       if (!tokens)
         return logger.debug("[AppSyncClient] No stored tokens found"), this.lastAuthFailureKind = "no_tokens", !1;
@@ -5660,6 +5740,31 @@ var AppSyncClient = class _AppSyncClient {
   async pingPlanner(input) {
     return (await this.graphqlRequest(mutations.pingPlanner, { input })).data.pingPlanner;
   }
+  /**
+   * Hosted Gemma advisory text generation (browse synthesis, brainstorm, etc.).
+   *
+   * Implements `PlannerAppSyncTransport.generatePlannerAdvisory`.
+   * Input `prompt` is base64 AES-GCM ciphertext under the session key.
+   * Output `advisoryText` is base64 AES-GCM ciphertext under the session key.
+   */
+  async generatePlannerAdvisory(input) {
+    if (!input || typeof input != "object")
+      throw new Error("generatePlannerAdvisory: input object is required");
+    if (!input.sessionId || typeof input.sessionId != "string")
+      throw new Error("generatePlannerAdvisory: sessionId is required");
+    if (!input.prompt || typeof input.prompt != "string")
+      throw new Error("generatePlannerAdvisory: prompt ciphertext is required");
+    if (input.prompt.length > 2e5)
+      throw new Error(`generatePlannerAdvisory: prompt ciphertext exceeds 200,000 chars ceiling (${input.prompt.length})`);
+    if (input.maxTokens !== void 0 && (input.maxTokens < 1 || input.maxTokens > 1536))
+      throw new Error(`generatePlannerAdvisory: maxTokens must be between 1 and 1536 (got ${input.maxTokens})`);
+    if (input.temperature !== void 0 && (input.temperature < 0 || input.temperature > 1))
+      throw new Error(`generatePlannerAdvisory: temperature must be between 0 and 1 (got ${input.temperature})`);
+    let response = await this.graphqlRequest(mutations.generatePlannerAdvisory, { input });
+    if (!response?.data?.generatePlannerAdvisory)
+      throw new Error("generatePlannerAdvisory: empty response returned from AppSync");
+    return response.data.generatePlannerAdvisory;
+  }
   // MARK: - CP-8 min applyUserDecision (Stage 1 R1 HIGH-1 closure)
   /**
    * CP-8 min Stage 1 R1 HIGH-1 closure (Hendry-approved 2026-05-19).
@@ -63041,30 +63146,30 @@ ${summary}`);
           numPredict: BROWSE_RETRY_NUM_PREDICT
         });
         if (signal?.aborted) return;
-        let retrySummary = sanitizeForTerminal(parseLocalGemmaBrowseSummary(retryRaw)).trim();
+        let trustLine2 = runner?.providerKind === "hosted" ? "No code was changed." : "No hosted model was called and no code was changed.", retrySummary = sanitizeForTerminal(parseLocalGemmaBrowseSummary(retryRaw)).trim();
         if (retrySummary.length > 0) {
           if (signal?.aborted) return;
           advise(
             store,
             headerAdvised ? `${retrySummary}
 
-No hosted model was called and no code was changed.` : `${header}
+${trustLine2}` : `${header}
 
 ${retrySummary}
 
-No hosted model was called and no code was changed.`
+${trustLine2}`
           );
           return;
         }
       } catch (retryErr) {
         if (signal?.aborted) return;
-        logger.warn("[orchestration-shell] local browse advisory retry failed", {
+        logger.warn("[orchestration-shell] browse advisory retry failed", {
           error: retryErr.message,
           runtimeLabel: runner.runtimeLabel
         });
       }
       if (signal?.aborted) return;
-      let extract = buildBrowseExtract(safeText);
+      let isHosted = runner?.providerKind === "hosted", modelNoun = isHosted ? "The model" : "The local model", deadEndNoun = isHosted ? "the model" : "the local model", trustLine = isHosted ? "No code was changed." : "No hosted model was called and no code was changed.", extract = buildBrowseExtract(safeText);
       if (extract) {
         if (signal?.aborted) return;
         let extractPrefix = headerAdvised ? "" : `${header}
@@ -63072,18 +63177,18 @@ No hosted model was called and no code was changed.`
 `;
         advise(
           store,
-          `${extractPrefix}The local model couldn't summarize this page, so here is the extracted page text (an extract, not a summary):
+          `${extractPrefix}${modelNoun} couldn't summarize this page, so here is the extracted page text (an extract, not a summary):
 
 ${extract}
 
-${BROWSE_AGENT_OFFER} No hosted model was called and no code was changed.`
+${BROWSE_AGENT_OFFER} ${trustLine}`
         );
         return;
       }
       if (signal?.aborted) return;
       advise(
         store,
-        `Read ${dispFinal} but the local model couldn't summarize it. ${BROWSE_AGENT_OFFER} No hosted model was called and no code was changed.`
+        `Read ${dispFinal} but ${deadEndNoun} couldn't summarize it. ${BROWSE_AGENT_OFFER} ${trustLine}`
       );
     }
   }
@@ -63225,30 +63330,30 @@ ${summary}`);
         if (signal?.aborted) return;
         let retryRaw = await runner.generateAdvisory(retryPrompt, { responseFormat: "text", numCtx: 16384, think: !1 });
         if (signal?.aborted) return;
-        let retrySummary = sanitizeForTerminal(parseLocalGemmaBrowseSummary(retryRaw)).trim();
+        let trustLine2 = runner?.providerKind === "hosted" ? "No code was changed." : "No hosted model was called and no code was changed.", retrySummary = sanitizeForTerminal(parseLocalGemmaBrowseSummary(retryRaw)).trim();
         if (retrySummary.length > 0) {
           if (signal?.aborted) return;
           advise(
             store,
             headerAdvised ? `${retrySummary}
 
-No hosted model was called and no code was changed.` : `${header}
+${trustLine2}` : `${header}
 
 ${retrySummary}
 
-No hosted model was called and no code was changed.`
+${trustLine2}`
           );
           return;
         }
       } catch (retryErr) {
         if (signal?.aborted) return;
-        logger.warn("[orchestration-shell] local multi-browse retry failed", {
+        logger.warn("[orchestration-shell] multi-browse retry failed", {
           error: retryErr.message,
           runtimeLabel: runner.runtimeLabel
         });
       }
       if (signal?.aborted) return;
-      let extracts = sources.map((s) => {
+      let isHosted = runner?.providerKind === "hosted", modelNoun = isHosted ? "The model" : "The local model", deadEndNoun = isHosted ? "the model" : "the local model", trustLine = isHosted ? "No code was changed." : "No hosted model was called and no code was changed.", extracts = sources.map((s) => {
         let ext = buildBrowseExtract(s.content);
         return `[${s.id}] ${s.title}
 ${ext || "(No extract available)"}`;
@@ -63262,11 +63367,11 @@ ${ext || "(No extract available)"}`;
 `;
         advise(
           store,
-          `${extractPrefix}The local model couldn't summarize these pages, so here are the extracted highlights:
+          `${extractPrefix}${modelNoun} couldn't summarize these pages, so here are the extracted highlights:
 
 ${extracts}
 
-${BROWSE_AGENT_OFFER} No hosted model was called and no code was changed.`
+${BROWSE_AGENT_OFFER} ${trustLine}`
         );
         return;
       }
@@ -63274,7 +63379,7 @@ ${BROWSE_AGENT_OFFER} No hosted model was called and no code was changed.`
       let sourceCountLabel = sources.length === 1 ? "1 source" : `${sources.length} sources`;
       advise(
         store,
-        `Read ${sourceCountLabel} but the local model couldn't summarize ${sources.length === 1 ? "it" : "them"}. ${BROWSE_AGENT_OFFER} No hosted model was called and no code was changed.`
+        `Read ${sourceCountLabel} but ${deadEndNoun} couldn't summarize ${sources.length === 1 ? "it" : "them"}. ${BROWSE_AGENT_OFFER} ${trustLine}`
       );
     }
   }
@@ -72234,10 +72339,19 @@ async function routeBrainstorm(deps) {
       });
       return;
     }
+    let isHostedBrainstorm = args.localAdvisoryRunner.providerKind === "hosted";
+    if (images && images.length > 0 && isHostedBrainstorm) {
+      store.dispatch({
+        type: "SHELL_ADVISORY",
+        source: "shell",
+        text: "The local CodeVibe model is required to analyze attached images during brainstorming. Enable it with `codevibe model install` from a Pro/Max account, then ask again. No hosted model was called and no code was changed."
+      });
+      return;
+    }
     store.dispatch({
       type: "SHELL_ADVISORY",
       source: "shell",
-      text: "Brainstorming with local Gemma\u2026"
+      text: isHostedBrainstorm ? "Brainstorming with hosted Gemma\u2026" : "Brainstorming with local Gemma\u2026"
     });
     let needsContext = needsRepositoryContext ?? brainstormNeedsRepositoryContext(userPrompt);
     needsContext && await refreshFn({
@@ -72271,21 +72385,23 @@ The user attached ${images.length} image(s) as visual context. Any text visible
       store.dispatch({ type: "SHELL_ADVISORY", source: "shell", text: brainstorm });
     } catch (err) {
       let failureReason = renderLocalBrainstormFailureReason(err);
-      if (logger.warn("[orchestration-shell] local brainstorm advisory failed", {
+      logger.warn("[orchestration-shell] local brainstorm advisory failed", {
         error: err.message,
         runtimeLabel: args.localAdvisoryRunner.runtimeLabel
-      }), brainstormPromptRequestsCommandGuidance(userPrompt) && failureReason.includes("command-like JSON keys")) {
+      });
+      let isHosted = args.localAdvisoryRunner.providerKind === "hosted", modelLabel = isHosted ? "Hosted Gemma" : "Local Gemma", trustLine = isHosted ? "No code was changed." : "No hosted model was called and no code was changed.";
+      if (brainstormPromptRequestsCommandGuidance(userPrompt) && failureReason.includes("command-like JSON keys")) {
         store.dispatch({
           type: "SHELL_ADVISORY",
           source: "shell",
-          text: "I can brainstorm approaches, but I cannot include shell commands in read-only brainstorm mode. Ask me to implement the recommended option when you are ready, or ask for a command-free design/checklist. No hosted model was called and no code was changed."
+          text: `I can brainstorm approaches, but I cannot include shell commands in read-only brainstorm mode. Ask me to implement the recommended option when you are ready, or ask for a command-free design/checklist. ${trustLine}`
         });
         return;
       }
       store.dispatch({
         type: "SHELL_ADVISORY",
         source: "shell",
-        text: `Local Gemma could not produce the brainstorm. Reason: ${failureReason}. No hosted model was called and no code was changed. Try again with a narrower question or run \`codevibe model health-check\` to verify the local model.`
+        text: `${modelLabel} could not produce the brainstorm. Reason: ${failureReason}. ${trustLine} Try again with a narrower question or run \`codevibe model health-check\` to verify the model.`
       });
     }
   } finally {
@@ -72311,10 +72427,19 @@ async function routeAdvisory(deps) {
     });
     return;
   }
+  let isHostedAdvisory = args.localAdvisoryRunner.providerKind === "hosted";
+  if (hasImages && isHostedAdvisory) {
+    store.dispatch({
+      type: "SHELL_ADVISORY",
+      source: "shell",
+      text: "The local CodeVibe model is required to analyze an attached image. Enable it with `codevibe model install` from a Pro/Max account, then ask again. No hosted model was called and no code was changed."
+    });
+    return;
+  }
   store.dispatch({
     type: "SHELL_ADVISORY",
     source: "shell",
-    text: hasImages ? "Analyzing the attached image(s) with local Gemma\u2026" : "Answering with local Gemma\u2026"
+    text: hasImages ? "Analyzing the attached image(s) with local Gemma\u2026" : isHostedAdvisory ? "Answering with hosted Gemma\u2026" : "Answering with local Gemma\u2026"
   });
   let MAX_ADVISORY_CLARIFICATIONS = 4, MAX_ADVISORY_CLARIFICATION_QUESTION_CHARS = 400, MAX_ADVISORY_CLARIFICATION_ANSWER_CHARS = 1e3, MAX_ADVISORY_CANONICAL_CONTEXT_CHARS = 6e3, MAX_ADVISORY_USER_PROMPT_CHARS = 4e3, MAX_ADVISORY_PROMPT_CHARS = 42e3, MAX_ADVISORY_PAGE_CHARS = 24e3, MAX_ADVISORY_STATUS_CHARS = 1500, MAX_ADVISORY_PAGE_TOKENS = 6e3, MAX_ADVISORY_PROMPT_TOKENS = 13500, statusText = "";
   try {
@@ -72448,21 +72573,21 @@ async function routeAdvisory(deps) {
       });
       return;
     }
-    let fallback = deps.fallbackSummary?.trim();
+    let fallback = deps.fallbackSummary?.trim(), effectiveIsHosted = args.localAdvisoryRunner.providerKind === "hosted", modelNoun = effectiveIsHosted ? "The model" : "The local model", modelLabel = effectiveIsHosted ? "Hosted Gemma" : "Local Gemma", trustLine = effectiveIsHosted ? "No code was changed." : "No hosted model was called and no code was changed.", generationScope = effectiveIsHosted ? "hosted" : "local";
     if (fallback) {
       store.dispatch({
         type: "SHELL_ADVISORY",
         source: "shell",
         text: sanitizeForTerminal(`${fallback}
 
-(Note: detailed local generation returned an empty answer; showing concise answer.)`)
+(Note: detailed ${generationScope} generation returned an empty answer; showing concise answer.)`)
       });
       return;
     }
     store.dispatch({
       type: "SHELL_ADVISORY",
       source: "shell",
-      text: hasImages ? "The local model returned no answer for the attached image(s). No code was changed." : "The local model returned an empty answer. Try rephrasing with a bit more detail. No code was changed."
+      text: hasImages ? `${modelNoun} returned no answer for the attached image(s). ${trustLine}` : `${modelNoun} returned an empty answer. Try rephrasing with a bit more detail. ${trustLine}`
     });
   } catch (err) {
     logger.warn("[orchestration-shell] local advisory failed", {
@@ -72470,7 +72595,7 @@ async function routeAdvisory(deps) {
       hasImages,
       runtimeLabel: args.localAdvisoryRunner.runtimeLabel
     });
-    let fallback = deps.fallbackSummary?.trim();
+    let fallback = deps.fallbackSummary?.trim(), effectiveIsHosted = args.localAdvisoryRunner.providerKind === "hosted", modelLabel = effectiveIsHosted ? "Hosted Gemma" : "Local Gemma", trustLine = effectiveIsHosted ? "No code was changed." : "No hosted model was called and no code was changed.", generationScope = effectiveIsHosted ? "hosted" : "local";
     if (fallback) {
       let reason = renderLocalBrainstormFailureReason(err);
       store.dispatch({
@@ -72478,14 +72603,14 @@ async function routeAdvisory(deps) {
         source: "shell",
         text: sanitizeForTerminal(`${fallback}
 
-(Note: detailed local generation was unavailable: ${reason}. Showing concise answer.)`)
+(Note: detailed ${generationScope} generation was unavailable: ${reason}. Showing concise answer.)`)
       });
       return;
     }
     store.dispatch({
       type: "SHELL_ADVISORY",
       source: "shell",
-      text: hasImages ? `Local Gemma could not analyze the attached image(s). Reason: ${renderLocalBrainstormFailureReason(err)}. No hosted model was called and no code was changed.` : `Local Gemma could not answer. Reason: ${renderLocalBrainstormFailureReason(err)}. No hosted model was called and no code was changed.`
+      text: hasImages ? `${modelLabel} could not analyze the attached image(s). Reason: ${renderLocalBrainstormFailureReason(err)}. ${trustLine}` : `${modelLabel} could not answer. Reason: ${renderLocalBrainstormFailureReason(err)}. ${trustLine}`
     });
   }
 }
@@ -75731,6 +75856,109 @@ Local planner error. Falling back to hosted Gemma planner on AWS.
   }
 };
 
+// src/planner/hosted-advisory.ts
+init_logger2();
+var HostedGemmaAdvisoryRunner = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.runtimeLabel = "Hosted Gemma (AWS Bedrock)";
+    this.providerKind = "hosted";
+  }
+  async generateAdvisory(promptText, options) {
+    if (options?.images && options.images.length > 0)
+      throw new Error(
+        "HostedGemmaAdvisoryRunner: image attachments are not supported by hosted Bedrock Gemma. A local vision model is required."
+      );
+    let sessionId = this.deps.activeSessionIdHolder.value;
+    if (!sessionId)
+      throw new Error("Hosted Gemma advisory generation failed: no active session ID");
+    let sessionKey = await this.deps.sessionKeyResolver.getSessionKey(sessionId);
+    if (!sessionKey)
+      throw new Error(`Hosted Gemma advisory generation failed: session key unresolved for session ${sessionId}`);
+    let encryptedPrompt = this.deps.crypto.encryptString(promptText, sessionKey), maxTokens = options?.numPredict, temperature = options?.temperature, start = Date.now();
+    try {
+      let response = await this.deps.transport.generatePlannerAdvisory({
+        sessionId,
+        prompt: encryptedPrompt,
+        ...maxTokens !== void 0 ? { maxTokens } : {},
+        ...temperature !== void 0 ? { temperature } : {}
+      });
+      return this.deps.crypto.decryptString(response.advisoryText, sessionKey);
+    } catch (err) {
+      let elapsedMs = Date.now() - start;
+      throw logger.warn("[hosted-advisory] generatePlannerAdvisory failed", {
+        sessionId,
+        elapsedMs,
+        error: err?.message
+      }), err;
+    }
+  }
+  async warm() {
+    return !0;
+  }
+  async unload() {
+    return !0;
+  }
+};
+
+// src/planner/composite-advisory.ts
+init_logger2();
+var CompositeAdvisoryRunner = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.localHealthy = !!opts.localRunner;
+  }
+  get runtimeLabel() {
+    return this.opts.tier === "FREE" || this.localHealthy ? this.opts.localRunner?.runtimeLabel ?? "Local Gemma" : this.opts.hostedRunner.runtimeLabel;
+  }
+  get providerKind() {
+    return this.opts.tier === "FREE" || this.localHealthy ? "local" : "hosted";
+  }
+  async generateAdvisory(promptText, options) {
+    if (this.opts.tier === "FREE") {
+      if (!this.opts.localRunner)
+        throw new Error(
+          "LocalModelUnavailable: local Gemma is not installed or enabled. Free tier operates in local-only mode."
+        );
+      return this.opts.localRunner.generateAdvisory(promptText, options);
+    }
+    if (options?.images && options.images.length > 0) {
+      if (!this.localHealthy || !this.opts.localRunner)
+        throw new Error(
+          "LocalModelUnavailable: local CodeVibe vision model is required to analyze attached images."
+        );
+      return this.opts.localRunner.generateAdvisory(promptText, options);
+    }
+    if (this.localHealthy && this.opts.localRunner)
+      try {
+        return await this.opts.localRunner.generateAdvisory(promptText, options);
+      } catch (err) {
+        logger.warn("[composite-advisory] local advisory failed; falling back to hosted Bedrock Gemma", {
+          error: err?.message
+        }), this.localHealthy = !1, this.opts.onFallbackToHosted?.(err);
+      }
+    return this.opts.hostedRunner.generateAdvisory(promptText, options);
+  }
+  async warm() {
+    if (this.opts.localRunner?.warm)
+      try {
+        return await this.opts.localRunner.warm();
+      } catch {
+        return !1;
+      }
+    return !0;
+  }
+  async unload() {
+    if (this.opts.localRunner?.unload)
+      try {
+        return await this.opts.localRunner.unload();
+      } catch {
+        return !1;
+      }
+    return !0;
+  }
+};
+
 // src/session/session-rekey.ts
 init_logger2();
 
@@ -77110,7 +77338,7 @@ function renderPreflight(agents, auth, connectivity, orphans) {
       let reason = agent.error ? `(${agent.error})` : "(not in $PATH)";
       console.log(`  [${colors.yellow}missing${colors.reset}] ${agent.name} ${colors.dim}${reason}${colors.reset}`);
     }
-  agents.filter((a) => a.installed).length === 0 && console.log(`  ${colors.red}! At least one agent CLI (Claude, Codex, or Antigravity) is required.${colors.reset}`), console.log(), console.log(`${colors.bold}Authentication & Credentials:${colors.reset}`), auth.error ? console.log(`  [${colors.red}error${colors.reset}] Auth check failed: ${auth.error}`) : !auth.authenticated && !auth.tokenExpired ? (console.log(`  [${colors.yellow}missing${colors.reset}] Not authenticated.`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to sign in.${colors.reset}`)) : auth.tokenExpired ? (console.log(`  [${colors.yellow}expired${colors.reset}] Token expired for ${auth.email ?? "user"}`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe doctor --repair --yes${colors.reset}${colors.dim}' to refresh.${colors.reset}`)) : console.log(`  [${colors.green}ok${colors.reset}] Authenticated as ${auth.email ?? "user"}${auth.expiresAt ? ` ${colors.dim}(valid until ${auth.expiresAt})${colors.reset}` : ""}`), auth.deviceIdentityError ? (console.log(`  [${colors.red}error${colors.reset}] Device Identity: ${auth.deviceIdentityError}`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to re-establish device credentials.${colors.reset}`)) : auth.deviceIdentityPresent ? console.log(`  [${colors.green}ok${colors.reset}] Device Identity ${auth.deviceIdentityId ? `${colors.dim}(${auth.deviceIdentityId})${colors.reset}` : ""}`) : (console.log(`  [${colors.yellow}missing${colors.reset}] Device Identity not found`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to generate device credentials.${colors.reset}`));
+  agents.filter((a) => a.installed).length === 0 && console.log(`  ${colors.red}! At least one agent CLI (Claude, Codex, or Antigravity) is required.${colors.reset}`), console.log(), console.log(`${colors.bold}Authentication & Credentials:${colors.reset}`), auth.error ? console.log(`  [${colors.red}error${colors.reset}] Auth check failed: ${auth.error}`) : !auth.authenticated && !auth.tokenExpired ? (console.log(`  [${colors.yellow}missing${colors.reset}] Not authenticated.`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to sign in.${colors.reset}`)) : auth.tokenExpired ? (console.log(`  [${colors.yellow}expired${colors.reset}] Token expired for ${auth.email ?? "user"}`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe doctor --repair --yes${colors.reset}${colors.dim}' to refresh.${colors.reset}`)) : console.log(`  [${colors.green}ok${colors.reset}] Authenticated as ${auth.email ?? "user"}${auth.expiresAt ? ` ${colors.dim}(valid until ${auth.expiresAt})${colors.reset}` : ""}`), auth.error ? console.log(`  [${colors.yellow}unknown${colors.reset}] Device Identity: not checked (the credential store could not be read \u2014 see above)`) : auth.deviceIdentityError ? (console.log(`  [${colors.red}error${colors.reset}] Device Identity: ${auth.deviceIdentityError}`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to re-establish device credentials.${colors.reset}`)) : auth.deviceIdentityPresent ? console.log(`  [${colors.green}ok${colors.reset}] Device Identity ${auth.deviceIdentityId ? `${colors.dim}(${auth.deviceIdentityId})${colors.reset}` : ""}`) : (console.log(`  [${colors.yellow}missing${colors.reset}] Device Identity not found`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to generate device credentials.${colors.reset}`));
   let backendName = auth.vendorKeys.custodyBackend === "keytar" ? "OS Keychain" : "File Store";
   if (console.log(`  [${auth.vendorKeys.anthropic ? colors.green + "ok" : colors.dim + "none"}${colors.reset}] Anthropic Vendor Key ${colors.dim}(${auth.vendorKeys.anthropic ? backendName : "not set"})${colors.reset}`), console.log(`  [${auth.vendorKeys.openai ? colors.green + "ok" : colors.dim + "none"}${colors.reset}] OpenAI Credential ${colors.dim}(${auth.vendorKeys.openai ? backendName : "not set"})${colors.reset}`), console.log(), console.log(`${colors.bold}Backend Connectivity:${colors.reset}`), connectivity.appsyncReachable ? console.log(`  [${colors.green}ok${colors.reset}] AppSync API (${connectivity.latencyMs ?? 0}ms) ${colors.dim}${connectivity.appsyncUrl}${colors.reset}`) : console.log(`  [${colors.red}unreachable${colors.reset}] AppSync API: ${connectivity.error ?? "unreachable"} ${colors.dim}(${connectivity.appsyncUrl})${colors.reset}`), console.log(), console.log(`${colors.bold}Workspace & Process State:${colors.reset}`), orphans.error ? console.log(`  [${colors.red}error${colors.reset}] Orphan inspection failed: ${orphans.error}`) : orphans.orphanedShadowCount > 0 || orphans.deadProcessOwnersCount > 0 ? (console.log(`  [${colors.yellow}residue${colors.reset}] ${orphans.orphanedShadowCount} orphaned worktree shadow(s), ${orphans.deadProcessOwnersCount} dead process registration(s)`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe doctor --repair --yes${colors.reset}${colors.dim}' to prune.${colors.reset}`)) : console.log(`  [${colors.green}ok${colors.reset}] Clean \u2014 0 orphaned shadows, 0 dead process registrations.`), orphans.retainedStateDiagnostics && orphans.retainedStateDiagnostics.length > 0)
     for (let diag of orphans.retainedStateDiagnostics)
@@ -80294,13 +80522,20 @@ async function requireCliAuthentication(client) {
   }
   if (authenticated) return;
   let failureKind = client.getLastAuthFailureKind();
-  throw failureKind === "refresh_network" ? new CliAuthenticationError(
-    "auth_unavailable",
-    "CodeVibe could not verify your sign-in because the authentication service is unreachable. Check your connection and try again."
-  ) : failureKind === "credential_storage_unavailable" ? new CliAuthenticationError(
-    "credential_storage_unavailable",
-    "CodeVibe could not read stored sign-in credentials. Unlock or repair your credential store, then try again."
-  ) : new CliAuthenticationError(
+  if (failureKind === "refresh_network")
+    throw new CliAuthenticationError(
+      "auth_unavailable",
+      "CodeVibe could not verify your sign-in because the authentication service is unreachable. Check your connection and try again."
+    );
+  if (failureKind === "credential_storage_unavailable") {
+    let detail = client.getLastAuthFailureDetail?.() ?? null;
+    throw new CliAuthenticationError(
+      "credential_storage_unavailable",
+      "CodeVibe could not read stored sign-in credentials. Unlock or repair your credential store, then try again." + (detail ? `
+${detail}` : "")
+    );
+  }
+  throw new CliAuthenticationError(
     "auth_required",
     "Not signed in. Run `codevibe login`, then launch CodeVibe again."
   );
@@ -80939,13 +81174,14 @@ Note: --export will overwrite any existing file at <path>.
   try {
     authenticated = await appsyncClient.authenticateWithStoredTokens();
   } catch (e) {
-    return err(
-      `Not signed in \u2014 run \`codevibe login\` first (${e?.message ?? "auth unavailable"}).
-`
-    ), 2;
+    return err(`CodeVibe could not verify your sign-in (${e?.message ?? "auth unavailable"}).
+`), 2;
+  }
+  if (!authenticated) {
+    let kind = appsyncClient.getLastAuthFailureKind?.() ?? null;
+    return kind === "credential_storage_unavailable" || kind === "refresh_network" ? (err(`${describeStoredAuthFailure(kind, appsyncClient.getLastAuthFailureDetail?.() ?? null).message}
+`), 2) : (err("Not signed in \u2014 run `codevibe login` first.\n"), 2);
   }
-  if (!authenticated)
-    return err("Not signed in \u2014 run `codevibe login` first.\n"), 2;
   let sessionId = parsed.sessionId ?? null;
   if (!sessionId) {
     let resolveSessionId = deps?.resolveSessionIdFn ?? resolveActiveSessionId;
@@ -81250,7 +81486,8 @@ ${err.message}
 function buildProductionPlannerStack(appsyncClient, emitter) {
   let transport = {
     classifyPlannerPrompt: (input) => appsyncClient.classifyPlannerPrompt(input),
-    pingPlanner: (input) => appsyncClient.pingPlanner(input)
+    pingPlanner: (input) => appsyncClient.pingPlanner(input),
+    generatePlannerAdvisory: (input) => appsyncClient.generatePlannerAdvisory(input)
   }, cache = new PlannerCacheLayer(), adaptedEmitter = async (e) => {
     await emitter({
       sessionId: e.sessionId,
@@ -81291,9 +81528,18 @@ function buildProductionPlannerStack(appsyncClient, emitter) {
     sessionKeyResolver,
     adaptedEmitter
   ), realSetActiveSession = adapter.setActiveSession.bind(adapter);
-  return adapter.setActiveSession = (sessionId) => {
+  adapter.setActiveSession = (sessionId) => {
     activeSessionIdHolder.value = sessionId, realSetActiveSession(sessionId);
-  }, { adapter, cache, health };
+  };
+  let hostedAdvisoryRunner = new HostedGemmaAdvisoryRunner({
+    transport: {
+      generatePlannerAdvisory: (input) => appsyncClient.generatePlannerAdvisory(input)
+    },
+    crypto: crypto33,
+    sessionKeyResolver,
+    activeSessionIdHolder
+  });
+  return { adapter, cache, health, hostedAdvisoryRunner };
 }
 function resolvePlannerAdapter(args) {
   let env = args.env ?? process.env, forceHosted = env.CODEVIBE_FORCE_HOSTED_PLANNER === "1" || env.CODEVIBE_PLANNER_PROVIDER === "hosted", tier = args.tier, isPaidTier = tier === "PRO" || tier === "MAX";
@@ -81304,7 +81550,7 @@ function resolvePlannerAdapter(args) {
         adapter: hostedStack.adapter,
         runtimeKind: "hosted",
         runtimeLabel: "Hosted Gemma (AWS Bedrock)",
-        advisoryRunner: args.localPlanner.advisoryRunner,
+        advisoryRunner: hostedStack.hostedAdvisoryRunner,
         classifyRunner: args.localPlanner.classifyRunner,
         cache: hostedStack.cache,
         health: hostedStack.health,
@@ -81336,6 +81582,10 @@ function resolvePlannerAdapter(args) {
         onNotice: (msg) => {
           process.stdout.write(msg);
         }
+      }), compositeAdvisoryRunner = new CompositeAdvisoryRunner({
+        localRunner: args.localPlanner.advisoryRunner,
+        hostedRunner: hostedStack.hostedAdvisoryRunner,
+        tier
       });
       return {
         adapter: compositeAdapter,
@@ -81345,7 +81595,7 @@ function resolvePlannerAdapter(args) {
         get runtimeLabel() {
           return compositeAdapter.runtimeLabel;
         },
-        advisoryRunner: args.localPlanner.advisoryRunner,
+        advisoryRunner: compositeAdvisoryRunner,
         classifyRunner: args.localPlanner.classifyRunner,
         cache: hostedStack.cache,
         health: hostedStack.health,
@@ -81378,7 +81628,7 @@ function resolvePlannerAdapter(args) {
       adapter: hostedStack.adapter,
       runtimeKind: "hosted",
       runtimeLabel: "Hosted Gemma (AWS Bedrock)",
-      advisoryRunner: null,
+      advisoryRunner: hostedStack.hostedAdvisoryRunner,
       classifyRunner: args.localPlanner.classifyRunner,
       cache: hostedStack.cache,
       health: hostedStack.health,