@quantiya/codevibe-core 2.0.6 → 2.0.7

package/dist/keychain/keychain-manager.d.ts

@@ -87,9 +87,26 @@ export declare class KeychainManager {
      */
     isTokenExpired(tokens: TokenData): boolean;
     /**
-     * Get session key for a session, decrypting from encryptedKeys if needed
+     * Get the session key for a session.
+     *
+     * When `encryptedKeys` are provided they are the AUTHORITATIVE source and the
+     * cache is trusted ONLY if its stored generation matches `sessionKeyGen`
+     * (tool-event consolidation §4.5 / Stage-2 Codex H2 / #230 Finding 1). A
+     * generation mismatch — the session was RECREATED under a new key (K2) while
+     * the cache still holds the prior generation's key (K1) — forces a fresh
+     * derive from `encryptedKeys`, so `getSessionKey` can never hand back a stale
+     * K1 for a K2 session. On a cache hit at the matching generation the cached
+     * key is returned (a re-derive per event would be a needless ECDH cost, and
+     * the ONLY writers of a generation's entry are this method's own derive and
+     * `cacheSessionKey`-with-the-derived-key, so the entry is always authoritative
+     * for its generation).
+     *
+     * When `encryptedKeys` are NOT provided (cache-only callers — e.g. the
+     * orchestration QuorumLoop's `getSessionKey(sessionId)`), the cached key is
+     * returned regardless of generation. This preserves the shipped cache-only
+     * behavior; those callers do not participate in the generation-binding.
      */
-    getSessionKey(sessionId: string, encryptedKeys?: EncryptedSessionKey[]): Promise<string | null>;
+    getSessionKey(sessionId: string, encryptedKeys?: EncryptedSessionKey[], sessionKeyGen?: string | null): Promise<string | null>;
     /**
      * Generate and encrypt a new session key for all devices.
      *
@@ -115,9 +132,13 @@ export declare class KeychainManager {
         skippedDeviceIds: string[];
     };
     /**
-     * Cache a session key
+     * Cache a session key, optionally bound to the session GENERATION it was
+     * derived under (§4.5). Callers that hold the authoritative key + generation
+     * (the session create/resume path) pass `sessionKeyGen` so a later
+     * `getSessionKey(..., encryptedKeys, gen)` trusts the entry only at the
+     * matching generation. Legacy cache-only callers omit it (stored as `null`).
      */
-    cacheSessionKey(sessionId: string, sessionKey: string): void;
+    cacheSessionKey(sessionId: string, sessionKey: string, sessionKeyGen?: string | null): void;
     /**
      * Get a cached session key without touching the backend or attempting
      * to decrypt from encryptedKeys. Returns null if the session key is not

package/dist/local-executor/__tests__/reviewer-rationale-flag.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/local-executor/class-a-sign.d.ts

@@ -23,6 +23,21 @@ export interface DeviceSigningKey {
  * exact canonical string and catch future json-freeze JCS drift.
  */
 export declare function canonicalJsonForSigning(obj: Record<string, unknown>, signatureFieldName: string): string;
+/**
+ * Sign `canonical` (the JCS string) with the device's P-256 key under
+ * ECDSA-P-256-with-SHA-256, returning the STANDARD-base64 of the raw 64-byte
+ * r‖s (IEEE P-1363) signature. Matches the Rust verifier's
+ * `Signature::from_slice(&B64.decode(sig))` decode path (signing.rs:203-218).
+ */
+export declare function signCanonical(canonical: string, keys: DeviceSigningKey): string;
+/**
+ * Generic writer-attestation signing primitive. Unlike Class A envelopes,
+ * every field in this closed object is in the signing domain; the signature
+ * is carried in the adjacent GraphQL input rather than embedded in `payload`.
+ */
+export declare function signWriterEventPayload(payload: Record<string, unknown>, keys: DeviceSigningKey): string;
+export declare const WRITER_EVENT_ATTESTATION_SCHEMA: "codevibe.encrypted_desktop_event.writer.v1";
+export declare function signWriterEventEnvelope(envelope: Record<string, unknown>, keys: DeviceSigningKey): string;
 /**
  * Sign a Class A envelope object. The canonical bytes are the JCS of the
  * envelope with `signature` removed (matching Rust

package/dist/local-executor/group-decision-outcome.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Map a group-escalation decision label to its authoritative
+ * `TEAM_GROUP_RESOLVED.outcome` const. Both accept-family decisions resolve the
+ * group `complete`; each reject-family decision has its OWN distinct terminal so
+ * mobile can tell abort / restart / plain-reject apart (the closed-enum promise).
+ *
+ * A label outside the closed 5-option set (only reachable from a corrupt persisted
+ * marker — the SDK re-validates live labels) maps to the safest `group_user_rejected`
+ * so a recovered decision still resolves the group rather than stranding it.
+ */
+export declare function decisionToGroupOutcome(decision: string): string;

package/dist/local-executor/implementor-argv.d.ts

@@ -15,6 +15,20 @@ export interface ImplementorArgvPlan {
     /** Where the final proposal text is captured from after `await handle.done`. */
     capture: ImplementorCaptureSurface;
 }
+/**
+ * Claude read-only advisory variant for broad @agent/@all brainstorm turns.
+ *
+ * This is intentionally separate from `buildImplementorArgv('CLAUDE', 'plan')`:
+ * normal plan mode keeps Read/Grep/Glob for explicit repo inspection, while
+ * broad advisory turns should answer without crawling the workspace. Keeping
+ * this as a first-class argv builder lets the command allowlist and drift tests
+ * cover the exact runtime command instead of relying on ad hoc shell rewrites.
+ *
+ * Claude CLI has two related controls: `--allowed-tools` restricts an available
+ * tool set, while `--tools ""` disables all built-in tools. Use the latter here
+ * because broad advisory turns should have no file-inspection tools at all.
+ */
+export declare function buildClaudeNoToolsPlanArgv(): ImplementorArgvPlan;
 /**
  * D9 — the ONE shared `CODEVIBE_AGY_MODEL` resolver used by BOTH
  * `buildImplementorArgv` (the spawned argv) and `agyImplementorAllowlistEntries`
@@ -44,10 +58,19 @@ export declare const AGY_IMPLEMENTOR_PRINT_TIMEOUT = "3600s";
  * static template can neither pin the value nor omit it when set. Two
  * FULLY-PINNED templates (plan `--sandbox` vs execute
  * `--dangerously-skip-permissions` — the N-3 defense-in-depth split), with
- * `<workdir>` as the SOLE trailing wildcard. Appended by
+ * `<workdir> --print <prompt>` under the trailing wildcard. The prompt is
+ * necessarily argv-visible because Agy 1.1.2 removed its stdin prompt mode;
+ * the fixed mode/model/timeout prefix remains pinned. Appended by
  * `makeImplementorCommandScope` at scope construction.
  */
 export declare function agyImplementorAllowlistEntries(): string[];
+/**
+ * Materialize the trusted stdin payload into Agy 1.1.2's required
+ * `--print <prompt>` argument. Fail closed unless the argv is the exact
+ * canonical placeholder shape produced by `buildImplementorArgv`; callers
+ * cannot use this helper to rewrite arbitrary Agy commands.
+ */
+export declare function bindAgyPrintPrompt(argv: readonly string[], prompt: string | undefined, workingDir: string): string[];
 /**
  * D3 — the abs-path brief preamble for an agy implementor/decomposer/resolver
  * spawn. agy is WORKSPACE-CENTRIC: it ignores the process cwd, so the brief
@@ -60,9 +83,12 @@ export declare function agyImplementorAllowlistEntries(): string[];
 export declare function agyWorkdirBriefPreamble(workdir: string): string;
 /**
  * Build the implementor invocation argv for `agent` in `mode`. The leading
- * executable name (`claude` / `codex` / `gemini` / `agy`) is the argv[0] so
- * callers can pass the whole array to `spawnImplementor` (which resolves the
- * binary from PATH). The brief is fed on stdin by the caller (`stdinPayload`).
+ * executable name (`claude` / `codex` / `agy`) is the argv[0] so callers can
+ * pass the whole array to `spawnImplementor` (which resolves the binary from
+ * PATH). The caller supplies the brief through `stdinPayload`; Claude and
+ * Codex receive it on stdin, while Agy's spawn boundary replaces the canonical
+ * final empty `--print` placeholder with that validated payload. (GEMINI is
+ * SUNSET — the `case 'GEMINI'` throws; it is never a routable implementor.)
  *
  * `workdir` (AGY-2.0 D3) is REQUIRED for ANTIGRAVITY (agy is
  * workspace-centric — `--add-dir <workdir>` is its only view of the tree; the
@@ -71,6 +97,31 @@ export declare function agyWorkdirBriefPreamble(workdir: string): string;
  * ignore it.
  */
 export declare function buildImplementorArgv(agent: AgentKind, mode: ImplementorMode, workdir?: string): ImplementorArgvPlan;
+/**
+ * A1b (Codex summary never-read fix, READ side) — read a Codex implementor's
+ * `--output-last-message` capture file, resolving the HOST path the same way
+ * the reviewer provider does (`src/reviewer/providers/codex.ts::
+ * resolveLastMessagePaths` — the lifted shared pattern, not a duplicate):
+ *
+ *   1. The direct capture path (`plan.capture.path`, an absolute `os.tmpdir()`
+ *      file) — the legacy/unconfined case, where codex wrote the host tmp file.
+ *   2. `<workdir>/<basename>` — the CONFINED-substrate case. This candidate is
+ *      only ever populated because the spawn path REWRITES the codex argv:
+ *      `relocateCodexLastMessageForSubstrate` (below) turns the absolute value
+ *      into a bare basename when the substrate is proven engaged, so codex
+ *      (cwd = workdir on both A1/A5 backends) writes `<workdir>/<basename>` —
+ *      host-readable via the A1 bind-mount / the A5 shared fs. Without that
+ *      write-side rewrite an absolute tmp path is unwritable (A5) or lands in
+ *      the container's own /tmp (A1) and no read candidate could ever find it.
+ *      The workdir is the round's shadow dir.
+ *
+ * The first readable candidate wins; it is best-effort unlinked after the read
+ * (we own the file's lifecycle — mirrors the reviewer/decomposer cleanup).
+ * NEVER throws: a missing/unreadable file on every candidate returns `''` (the
+ * summary is an audit-only nicety; the captured diff, not the summary, is the
+ * round's contract).
+ */
+export declare function readImplementorLastMessage(capturePath: string, workdir?: string): string;
 /**
  * Positive runtime evidence that this process is ACTUALLY inside a container —
  * the confinement boundary that `CODEVIBE_TRUSTED_CONTAINER` asserts. Docker
@@ -118,7 +169,7 @@ export declare function isTrustedContainerBoundary(env?: NodeJS.ProcessEnv, inCo
  * namespaces / macOS Seatbelt) and is the only filesystem confinement.
  *
  * NARROW BY DESIGN:
- *   - Only CODEX is affected (Claude/Gemini have no bwrap inner sandbox).
+ *   - Only CODEX is affected (Claude + Antigravity have no bwrap inner sandbox).
  *   - Only `workspace-write` (the EXECUTE variant) is rewritten. `read-only`
  *     (PLAN mode) is left untouched — it is a DELIBERATE write restriction, and
  *     `danger-full-access` would let a plan-mode agent write, violating the plan
@@ -127,6 +178,37 @@ export declare function isTrustedContainerBoundary(env?: NodeJS.ProcessEnv, inCo
  * Pure; returns a NEW array when it rewrites, the same array otherwise.
  */
 export declare function applyOuterBoundarySandbox(argv: readonly string[], agent: AgentKind, outerBoundaryConfines: boolean): string[];
+/**
+ * A1b (Codex summary never-read fix, WRITE side) — substrate-aware relocation
+ * of the Codex `--output-last-message` value. Mirrors the reviewer provider's
+ * `resolveLastMessagePaths(sandboxed=true, …)` contract on the IMPLEMENTOR
+ * path: under the CP-7 substrate codex CANNOT write the host `os.tmpdir()`
+ * (A1 Docker never mounts host /tmp — an absolute tmp path writes the
+ * CONTAINER's own /tmp, unreadable by the host; A5 Seatbelt grants writes to
+ * the WORKDIR only — the write is DENIED outright; the reviewer provider
+ * documents the same false-on-both-backends failure at codex.ts:143-152). So
+ * when the substrate is PROVEN engaged, rewrite the absolute capture path to
+ * its bare BASENAME: codex's cwd IS the workdir on both backends (A5 `exec`
+ * spawns with `cwd: workdir`; A1 runs in `/workspace`, the workdir
+ * bind-mount), so the file lands at `<workdir>/<basename>` — exactly where
+ * `readImplementorLastMessage`'s relocated candidate reads it back.
+ *
+ * Called from `LocalExecutor.spawnImplementor` at the SAME per-spawn rewrite
+ * point as `applyOuterBoundarySandbox`, gated on the engager's OWN
+ * `substrateEngaged` proof — NOT predicted at argv-build time (the engage
+ * outcome — substrate vs reduced_trust vs legacy — is only knowable when the
+ * engager actually runs), and NOT on the trusted-container boundary (there the
+ * desktop and codex share ONE fs namespace, so the absolute tmp path works and
+ * must stay — it is read candidate #1).
+ *
+ * NARROW BY DESIGN (mirrors `applyOuterBoundarySandbox`):
+ *   - Only CODEX (the only file-capture agent) is affected.
+ *   - Only when `substrateEngaged`; the unconfined argv is byte-identical.
+ *   - The command-allowlist templates end `--output-last-message *`, so the
+ *     rewritten argv still passes `enforceCommand` (drift-guard-tested).
+ * Pure; returns a NEW array when it rewrites, a copy otherwise.
+ */
+export declare function relocateCodexLastMessageForSubstrate(argv: readonly string[], agent: AgentKind, substrateEngaged: boolean): string[];
 /**
  * Authority `commandAllowlist` entries covering EVERY (agent, mode) argv
  * `buildImplementorArgv` can produce. The single-impl + team LEs seed this
@@ -142,8 +224,8 @@ export declare function applyOuterBoundarySandbox(argv: readonly string[], agent
  *
  * Matching (authority.ts `enforceCommand`): an entry is a LITERAL full
  * `argv.join(' ')` match, OR a ` *`-suffix TEMPLATE (prefix match).
- *   - Claude / Gemini argvs are fixed → literal entries. (Gemini's `-p ''`
- *     empty arg yields a DOUBLE space in the join — preserved verbatim here.)
+ *   - Claude argvs are fixed → literal entries. (Gemini is SUNSET as of
+ *     2026-07 and is no longer a routable implementor, so it has no entry.)
  *   - Codex carries a per-spawn temp path in `--output-last-message <tmp>` →
  *     a ` *` template: the literal prefix up to `--output-last-message`, then
  *     the wildcard absorbs the varying path + trailing `-`.

package/dist/local-executor/local-executor-impl.d.ts

@@ -17,15 +17,15 @@ import type { TrackTipsView } from './durable-store';
  * `tier:'none'` (moat-OFF) reduced-trust badge.
  *
  * The ordinary `emitShellEvent` chokepoint RESOLVES WITHOUT EMITTING when the
- * cohort flag is off, the session is a `cp1a-local-*` stub, or no session key
- * exists (see `emit-shell-event.ts`); the team store tap likewise ignores the
+ * no session key exists (see
+ * `emit-shell-event.ts`); the team store tap likewise ignores the
  * `cp7_reduced_trust` notification. A `tier:'none'` badge routed through it can
  * therefore "succeed" (await resolves) while the user sees NOTHING — and the
  * legacy unsandboxed spawn would proceed on only a WARN.
  *
  * A `StrictBadgeSink` MUST instead CONFIRM that the user-facing NOTIFICATION was
  * ACTUALLY delivered (e.g. `createEvent` was invoked) and THROW when it cannot
- * deliver (cohort off / no session / stub / tap-ignored). For `tier:'none'` a
+ * deliver (no session / stub / tap-ignored). For `tier:'none'` a
  * throw → FAIL CLOSED (no legacy spawn). It is INTENTIONALLY separate from the
  * audit emit: audit emission stays on the existing Class-A / shell-event path;
  * this sink is ONLY the user-facing moat-OFF warning.
@@ -73,6 +73,7 @@ export type SubstrateEngageResult = {
     reducedTrust: boolean;
     reducedTrustReason?: string;
     substrateHandle: SubstrateHandle;
+    agentConfigDir?: string;
     refreshBrokerToken(): Promise<void>;
     teardown(): Promise<void>;
 } | {
@@ -94,6 +95,16 @@ export type SubstrateEngager = (input: {
     agentKind: AgentKind;
     workdir: string;
     role: ProcessRole;
+    /**
+     * A1d (design §8.1) — the spawn demands hard confinement (`SpawnArgs.
+     * requireConfined`; today only the WB2 agentic class-2 resolver dispatch).
+     * Threaded so the engager can build the WRITE-CONFINED resolver row for a
+     * broker-less reduced-trust agent (GEMINI/ANTIGRAVITY) instead of returning
+     * an immediate `reduced_trust` — which the requireConfined guard below would
+     * fail-close to the human gate (the design's mandatory fallback, which still
+     * applies whenever the row cannot be established).
+     */
+    requireConfined?: boolean;
 }) => Promise<SubstrateEngageResult>;
 export interface LocalExecutorImplDeps {
     sessionId: string;
@@ -114,7 +125,7 @@ export interface LocalExecutorImplDeps {
     /**
      * Builds the `SpawnArgs.argv` for a track's implementor given the track
      * payload + canonicalized state dir. The shell knows which agent binary
-     * (claude/gemini/codex) to invoke and the prompt wiring; the LE only
+     * (claude/codex/agy) to invoke and the prompt wiring; the LE only
      * orchestrates spawn + idempotency + state-dir isolation. When omitted, the
      * MergeGate happy-path + idempotency tests still exercise the registry via a
      * `spawnTrackImplementor` stub.
@@ -201,8 +212,8 @@ export interface LocalExecutorImplDeps {
      * `tier:'none'` (moat-OFF) reduced-trust badge. When supplied (production
      * wiring in cli.ts), the moat-OFF badge is delivered through THIS sink — which
      * confirms the NOTIFICATION actually reached `createEvent` and THROWS on a
-     * silent no-op (cohort off / no session key / stub / tap-ignored) — instead of
-     * the cohort-gated `emitShellEvent` that can resolve without emitting. A throw
+     * silent no-op (no session key / stub / tap-ignored) — instead of
+     * `emitShellEvent` that can resolve without emitting. A throw
      * here makes the `tier:'none'` path FAIL CLOSED (no unsandboxed spawn).
      *
      * ABSENT (default) → the legacy behavior: the badge goes through
@@ -448,7 +459,7 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      *     ambient `process.env` reachable): the badge MUST be DELIVERED before the
      *     agent runs. It is routed through the STRICT delivery sink
      *     (`deps.strictBadgeSink`) which CONFIRMS the NOTIFICATION actually reached
-     *     `createEvent` and THROWS on a silent no-op (cohort off / no session key /
+     *     `createEvent` and THROWS on a silent no-op (no session key /
      *     stub / tap-ignored) — the ordinary `emitShellEvent` would RESOLVE without
      *     emitting in those cases (Finding 2). This method AWAITS that delivery with
      *     a bounded timeout and RE-THROWS on a reject/timeout. The WARN log stays

package/dist/local-executor/merge-conflict-resolve.d.ts

@@ -33,6 +33,17 @@ export interface ConflictResolverContext {
         class2Paths: readonly string[];
         implementorAgent: string;
         implementorTaskId: string;
+        /**
+         * A1d / P2 resolver-intent (design §5/§8.1) — the slot's two sides, so the
+         * resolver builder can compute BOTH sides' bounded INTENT diffs
+         * (`baseSha → oursCommit` = the integration so far; `baseSha → theirsCommit`
+         * = the incoming track) for the resolver brief. `baseSha` is optional
+         * (absent on the reconstruction-replay path) — absent ⇒ the intent-diff
+         * projection degrades gracefully (brief shape unchanged).
+         */
+        oursCommit: string;
+        theirsCommit: string;
+        baseSha?: string;
     }) => Promise<AgenticResolveOutcome>;
     /** Shared-contract detector tuning (always-gate globs + planner shared_contracts). */
     detectorOpts?: SharedContractDetectorOptions;
@@ -98,4 +109,12 @@ export declare function resolveSlotConflicts(args: {
     incomingImplementorTaskId?: string;
     /** CP-14 WB2 — tags durable records PENDING for this resolve attempt (recovery case 3). */
     attemptId?: string;
+    /**
+     * A1d / P2 resolver-intent — the merge-train's pinned integration base
+     * (`foundation.baseSha` / the journal record's `baseSha`), threaded through to
+     * the agentic resolver so it can compute both sides' intent diffs. Optional:
+     * absent (e.g. the reconstruction-replay caller) ⇒ no intent diffs (graceful
+     * degrade; never gates a resolve).
+     */
+    baseSha?: string;
 }): Promise<SlotResolveResult>;

package/dist/local-executor/revert-reconcile.d.ts

@@ -63,6 +63,18 @@ export interface ReconcileDeps {
      * to a later start (the marker survives; never block on a missing key).
      */
     getSessionKey?: (sessionId: string) => Promise<string | null>;
+    /**
+     * CP-8-FULL Stage-2 R1 Codex F1/HIGH — drive the per-track + group convergence
+     * emit (the SAME `driveGroupDecisionConvergence` chokepoint the live gate uses)
+     * for a CLAIM-crash-recovered decision, so a decision COMMITted at startup still
+     * emits its typed `TEAM_TRACK_STATUS` + `TEAM_GROUP_RESOLVED` terminal to mobile
+     * (D4: mobile keys the resolved banner off `TEAM_GROUP_RESOLVED`). Present for a
+     * TEAM session alongside `commitClient`; ABSENT (non-team / older callers) → the
+     * recovery COMMIT still lands, only the wire emit is skipped (no regression vs the
+     * pre-CP-8 recovery, which emitted nothing). The outcome is the DECISION-driven
+     * `decisionToGroupOutcome` — identical to the live path, so the two never diverge.
+     */
+    driveGroupConvergence?: (taskGroupId: string, outcome: string) => Promise<void>;
     /** Optional clock injection for deterministic GC tests. */
     now?: () => number;
 }

package/dist/local-executor/reviewer-rationale-flag.d.ts

@@ -0,0 +1,10 @@
+/** The env var that enables reviewer-visible implementor rationale (opt-IN). */
+export declare const REVIEWER_RATIONALE_ENV_VAR = "CODEVIBE_REVIEWER_RATIONALE";
+/**
+ * Is reviewer-visible implementor rationale enabled? DEFAULT-OFF. ONLY the
+ * canonical truthy tokens (`1`/`true`/`on`/`yes`, case-insensitive) enable it;
+ * anything else — including unset, empty, and garbage — is OFF (fail-closed:
+ * a typo can never silently widen what reviewers see). `env` is injected for
+ * deterministic tests; production passes `process.env`.
+ */
+export declare function isReviewerRationaleEnabled(env?: NodeJS.ProcessEnv): boolean;

package/dist/local-executor/types.d.ts

@@ -15,6 +15,7 @@ export interface SpawnArgs {
     stdinPayload?: string;
     signal?: AbortSignal;
     taskId?: string;
+    lifecycleAudit?: 'active_task' | 'none';
     onProcessSpawned?: ProcessSpawnedHook;
     onProcessExited?: ProcessExitedHook;
     substrate?: SubstrateHandle;

package/dist/local-model/manager.d.ts

@@ -4,7 +4,7 @@ import { type LocalModelState, type LocalModelStateStore } from './state';
 import { type OllamaPullProgressListener } from './ollama';
 import type { LocalGemmaPlannerRunner } from '../planner/local-gemma';
 export type LocalModelCommand = 'install' | 'status' | 'remove' | 'enable' | 'warm' | 'health-check';
-export type LocalModelEntitlementSource = 'backend' | 'unauthenticated' | 'unavailable';
+export type LocalModelEntitlementSource = 'backend' | 'environment' | 'unauthenticated' | 'unavailable';
 export interface LocalModelEntitlement {
     tier: Tier | 'UNKNOWN';
     source: LocalModelEntitlementSource;

package/dist/local-model/ollama.d.ts

@@ -13,6 +13,29 @@ export type OllamaRuntimeConfigResult = {
     ok: false;
     reason: string;
 };
+/**
+ * Dogfood #618 — keep the model RESIDENT between shell turns. Ollama's default
+ * keep_alive is 5 minutes: a user who reads a brainstorm for 6 minutes before
+ * replying pays a full model reload on the next turn, and on a busy machine
+ * that reload can blow the whole request timeout. Sent on EVERY generate (each
+ * turn re-ups the window) and on the shell-start pre-warm.
+ */
+export declare const OLLAMA_KEEP_ALIVE = "30m";
+/**
+ * Dogfood #618 — floor for ADVISORY generations (brainstorm/familiarize
+ * fallback, up to 700–1400 output tokens on a 12B + long conversation-context
+ * prompts). Measured warm long-context brainstorm ≈ 6s on an idle machine, but
+ * a cold reload + busy machine blew the shared 60s cap in real dogfood. The
+ * fast-fail 60s default stays for CLASSIFY (≤256 tokens, turn-blocking); an
+ * explicit higher CODEVIBE_LOCAL_MODEL_TIMEOUT_MS still wins over this floor.
+ */
+export declare const ADVISORY_TIMEOUT_FLOOR_MS = 180000;
+/**
+ * Advisory requests use the LARGER of the configured timeout and the advisory
+ * floor, still clamped to the global max — so the env var can raise but never
+ * silently shrink an advisory below its floor.
+ */
+export declare function advisoryTimeoutMs(configTimeoutMs: number): number;
 /**
  * The `/api/pull` STALL window. A real multi-GB model pull runs for many minutes, so the
  * pull must NOT use the single-shot inference timeout ({@link requestOllamaJson}). Instead we
@@ -60,5 +83,22 @@ export declare class OllamaGemmaPlannerRunner implements LocalGemmaPlannerRunner
     constructor(config: OllamaRuntimeConfig);
     classify(promptText: string): Promise<string>;
     generateAdvisory(promptText: string, options?: LocalGemmaAdvisoryOptions): Promise<string>;
+    /**
+     * Dogfood #618 — fire-and-forget model pre-warm. Sends a LOAD-ONLY generate
+     * (empty prompt: Ollama loads the model into memory and returns immediately,
+     * response text is empty by design — so this does NOT go through
+     * `requestOllamaGenerate`, which rejects empty responses) with the standard
+     * keep_alive. NEVER throws: resolves `true` when the model is resident,
+     * `false` on any error — pre-warm failure must not affect shell startup.
+     */
+    warm(): Promise<boolean>;
+    /**
+     * #618 Stage-2 (agy MEDIUM) — release the model on shell exit. Without this,
+     * quitting the shell leaves the 12B (7.4GB) resident for up to the full
+     * keep_alive window, starving other host work. `keep_alive: 0` unloads
+     * immediately; the next shell start's pre-warm covers the reload cost.
+     * Fire-and-forget shape like warm(): unref'd, short cap, never throws.
+     */
+    unload(): Promise<boolean>;
     probe(): Promise<PlannerProbeResult>;
 }

package/dist/orchestration/__tests__/detect-agents.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration/detect-agents.d.ts

@@ -2,6 +2,7 @@ import { Logger } from '../logger';
 import { AppSyncClient } from '../appsync';
 import { CapabilityRegistry } from '../adapter/capabilities';
 export type DetectableAgent = 'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY';
+declare function launcherCompatiblePath(env: NodeJS.ProcessEnv, commonPaths?: string[]): string;
 /**
  * Returns the subset of agents present on PATH. Uses `command -v`
  * (POSIX-standard) rather than `which` for portability across macOS
@@ -12,10 +13,15 @@ export type DetectableAgent = 'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY';
  * installed agents CAN change between plugin launches (user installs
  * a new agent) and the caller decides how often to re-probe.
  */
-export declare function detectInstalledAgents(): DetectableAgent[];
+export declare function detectInstalledAgents(env?: NodeJS.ProcessEnv): DetectableAgent[];
+declare function isAgentInstalled(agent: DetectableAgent, env: NodeJS.ProcessEnv, commonPaths?: string[]): boolean;
+export declare const __testing: {
+    isAgentInstalled: typeof isAgentInstalled;
+    launcherCompatiblePath: typeof launcherCompatiblePath;
+};
 /**
  * Detect-and-push convenience for plugin daemon startup. All three
- * plugins (Claude, Gemini, Codex) call this once at start(). Runs
+ * plugins (Claude, Codex, Antigravity) call this once at start(). Runs
  * the local PATH probe, then pushes the set to the backend via
  * updateAvailableAgents. Idempotent — the backend dedupes and stores.
  * Non-fatal on the network failure path (caller should `.catch()`
@@ -25,7 +31,7 @@ export declare function detectInstalledAgents(): DetectableAgent[];
  * CP-1.f LOCK RP-3 — `replace` semantics. `User.availableAgents` is a
  * cross-device UNION by default (`replace=false`), which never removes a
  * stale agent (a `GEMINI` from a prior device/install would linger and
- * get composed into the reviewer panel → `spawn gemini ENOENT`). The
+ * get composed into the reviewer panel → unsupported agent spawn). The
  * orchestration shell passes `replace=true` so the stored set is EXACTLY
  * the current orchestration host's installed agents, AND — also per
  * RP-3 — always writes even on zero detection (no skip-on-empty) so a
@@ -41,30 +47,4 @@ export declare function detectInstalledAgents(): DetectableAgent[];
  *                Default false (1.x companion union path).
  */
 export declare function pushDetectedAgents(client: AppSyncClient, log: Pick<Logger, 'info' | 'warn'>, capabilityRegistry?: CapabilityRegistry, detectFn?: () => DetectableAgent[], replace?: boolean): Promise<void>;
-/**
- * Quorum 2.0 (2f.0.a.6) per-session orchestration CLI override applier.
- * All three plugin wrappers (`codevibe-claude`, `codevibe-gemini`,
- * `codevibe-codex`) export `CODEVIBE_ORCHESTRATION_OVERRIDE=true|false`
- * to the tmux env when the user passes `--orchestration` /
- * `--no-orchestration`. The daemon inherits this via the hook env
- * chain and calls THIS function after every session-creation site
- * to pin the per-session decision — wins outright over the server's
- * User.orchestrationEnabledDefault auto-populate.
- *
- * Called from each plugin's daemon at every session-creation call
- * site. Claude has one (handleSessionStart covers new + /resume
- * because Claude Code fires SessionStart on /resume). Gemini has
- * two (handleSessionStart + switchToResumedSession — /resume doesn't
- * fire SessionStart in Gemini). Codex has two (createLaunchSession
- * + handleSessionStarted — launch session gets replaced by runtime
- * session_meta).
- *
- * Non-fatal on error — a failed override doesn't block session setup;
- * the server's auto-populate decision stands and the user can flip
- * the session via mobile toggle after the fact.
- *
- * @param client     AppSyncClient authenticated for the session's owner
- * @param sessionId  Backend session ID (post-resumeOrCreateSession)
- * @param log        Logger
- */
-export declare function applyPerSessionOrchestrationOverride(client: AppSyncClient, sessionId: string, log: Pick<Logger, 'info' | 'warn'>): Promise<void>;
+export {};

package/dist/orchestration/index.d.ts

@@ -1,3 +1,2 @@
-export { detectInstalledAgents, pushDetectedAgents, applyPerSessionOrchestrationOverride, type DetectableAgent, } from './detect-agents';
-export { runOrchestrationCli } from './orchestration-cli';
+export { detectInstalledAgents, pushDetectedAgents, type DetectableAgent, } from './detect-agents';
 export { V1_ORCHESTRATION_PROMPT_KIND, V1_ORCHESTRATION_OPTIONS, mapOptionNumberToUserDecisionKind, mapOptionToUserDecisionKind, type V1OrchestrationOption, type V1UserDecisionKind, } from './v1-options';

package/dist/orchestration-shell/__tests__/a1a-planner-offers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/a6-cli-surface.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/advisory-attachments-dir-race.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/advisory-multi-mention-panel.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/advisory-panel-attachments.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/advisory-quota-stdout-result.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/agent-turn-context-batch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/bounded-shutdown.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/brainstorm-quorum-wiring.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/brainstorm-quorum.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/cli-team-session-key.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/command-intent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/context-compaction.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/context-items-hosted-sync.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/context-items-wiring.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/context-items.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/cp8-full-team-events.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/cp8-team-decomposed-zk.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/explicit-tty-exit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/mention-suggest.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/orchestration-shell/__tests__/route-browse-summarize-recovery.test.d.ts

@@ -0,0 +1 @@
+export {};