@quantiya/codevibe-core 2.0.7 → 2.0.9

package/dist/appsync/__tests__/dispose-watcher-socket.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/appsync/__tests__/refresh-open-prompt-ttl-chunk.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/appsync/appsync-client.d.ts

@@ -1,8 +1,30 @@
+import WebSocket from 'ws';
 import { CreateEventInput, CreateSessionInput, UpdateSessionInput, UpdateEventStatusInput, Event, Session, EventSource, DeviceKey, GrantSessionKeyInput, UpdateReviewerPolicyInput, UserReviewerPolicySnapshot } from '../types';
 import type { PostDecisionAction } from '../orchestration-shell/types';
+import type { InvocationUsageSnapshot } from '../reviewer/token-usage';
 import type { CreateTaskGroupInput, CreateTaskGroupResult, SubmitMergeGateVerdictInput, SubmitMergeGateVerdictResult, SubmitTrackVerificationOutcomeInput, SubmitTrackVerificationOutcomeResult, ClaimGroupDecisionInput, ClaimGroupDecisionResult } from '../local-executor/task-group-types';
 import type { ReviewerVerdict, ReviewerRole, AgentKind as ReviewerAgentKind } from '../reviewer/types';
 import type { PlannerDecision } from '../planner/types';
+/**
+ * Dispose a watcher/subscription WebSocket without crashing the process
+ * (#657 D-1 fix-forward — the clean-quit session/admission leak).
+ *
+ * `ws.close()` on a still-CONNECTING socket aborts the handshake and emits an
+ * ASYNC 'error' ("WebSocket was closed before the connection was established")
+ * on a LATER tick. Every prior disposal site paired `close(1000)` with
+ * `removeAllListeners()` — in either order — so that late emission always
+ * found a listener-less socket and crashed Node with an unhandled 'error'
+ * mid-teardown, BEFORE `retireHostedSession` could land the session INACTIVE
+ * mutation. Net effect: every clean `/quit` whose Class B watcher (or any
+ * other watcher) was mid-(re)connect leaked an ACTIVE session row AND an
+ * `activeSessionAdmissionCount` slot (#101 class), hard-capping the
+ * 19-scenario GA baseline after exactly the free headroom.
+ *
+ * Order is load-bearing: strip stale handlers FIRST, re-arm a swallow-all
+ * 'error' handler, THEN close. Exported for the regression test only — not
+ * part of the public SDK surface.
+ */
+export declare function disposeWatcherSocket(ws: WebSocket, subscriptionId?: string): void;
 /**
  * One assigned reviewer seat returned by `getInReviewAssignments`. Mirrors the
  * engine `InReviewAssignment` serde (camelCase) in
@@ -26,33 +48,37 @@ export interface InReviewAssignment {
  * recovery-row type — NOT an extension of the live `TrackAssignedPayload` (so the
  * live Class B contract stays unpolluted). Mirrors the engine handler's camelCase
  * `TeamTrackRecoveryRow` serde:
- *   - ALWAYS present: `taskGroupId`, `trackIndex`, `relaunch`, and `encryptedBrief?`
+ *   - ALWAYS present: `taskGroupId`, `trackIndex`, `taskId`,
+ *     `dispatchGeneration`, `relaunch`, and `encryptedBrief?`
  *     (omitted when the track had no description → recovery treats it as an empty
- *     brief). `taskGroupId` is on EVERY row (seed-only too) so the desktop keys its
- *     recovered brief + corrupt-brief tombstone by `(taskGroupId, trackIndex)` —
- *     B.2 aggregates across groups, so a bare `trackIndex` key could cross-blend
- *     two groups (#593 Stage-2 r2 Codex MEDIUM).
+ *     brief). The four identity fields bind recovered brief and tombstone
+ *     authority to `(taskGroupId, trackIndex, taskId, dispatchGeneration)`;
+ *     reused group/index slots cannot cross-contaminate generations.
  *   - ONLY when `relaunch === true` (flattened at top level): the full live
- *     `TrackAssigned` wire-field set (`taskId`, `implementorAgent`,
- *     `ownershipScope`, `isSharedTestOwner`, `stateDir`, `dispatchId`,
- *     `dispatchGeneration`, `conflictContext`) PLUS recovery metadata (`gateRunId`,
+ *     `TrackAssigned` wire-field set (the always-present identity fields plus
+ *     `implementorAgent`, `ownershipScope`, `isSharedTestOwner`, `stateDir`,
+ *     `dispatchId`, `conflictContext`) and recovery metadata (`gateRunId`,
  *     `gateType`). These camelCase keys are byte-identical to the live
  *     `TrackAssigned` Class B packet, so `normalizeTrackAssignedWire(row)` accepts
  *     a relaunch row directly (it picks the expected keys and ignores the extras).
  *
  * Typed loosely (`unknown` payload past the always-present fields) because the
- * relaunch keys are present-or-absent; the recovery loop runs the shared
- * `normalizeTrackAssignedWire` + `isValidTrackAssignedPayload` validators on the
- * raw row (never a divergent second validator), so the SDK does not re-type them.
+ * relaunch keys are present-or-absent. Recovery first validates complete row
+ * shape/correlation, then runs the shared `normalizeTrackAssignedWire` +
+ * `isValidTrackAssignedPayload` live validators.
  */
 export interface TeamTrackRecoveryRow {
     /**
      * The owning task group's id — present on EVERY row (seed-only + relaunch) so
-     * recovered briefs + tombstones key by `(taskGroupId, trackIndex)` and B.2's
-     * cross-group aggregation can't collide on a shared `trackIndex` (#593 r2).
+     * recovered rows carry complete authority, so B.2's cross-group aggregation
+     * cannot collide on a shared `trackIndex`.
      */
     taskGroupId: string;
     trackIndex: number;
+    /** Child task identity; present on seed-only and relaunch rows. */
+    taskId: string;
+    /** Current u32 dispatch generation; present on every recovery row. */
+    dispatchGeneration: number;
     /** Bare base64 ciphertext; absent when the track had no description. */
     encryptedBrief?: string;
     relaunch: boolean;
@@ -89,6 +115,33 @@ export interface PutContextItemInput {
     trackId?: string;
     ciphertext: string;
 }
+/** Host-emittable audit surface used by the signed Class A transport. */
+export interface RecordExecutionEventInput {
+    taskId: string;
+    sessionId: string;
+    kind: 'TASK_CREATED' | 'TASK_TERMINATED' | 'PROGRESS_EVENT' | 'TOOL_USE' | 'DESTRUCTIVE_ACTION_ESCALATED' | 'FLAG_BAD_APPROVAL';
+    /** Free-form JSON; encrypted before crossing AppSync. */
+    payload: unknown;
+    dedupKeyHex: string;
+    /**
+     * O1 C1 (#652) §3.1 item 3 — the plaintext flag-target locator, REQUIRED
+     * when `kind = 'FLAG_BAD_APPROVAL'` and absent otherwise (non-flag events
+     * stay byte-identical to the pre-O1-C1 wire). Row COORDINATES only — zero
+     * content. Field names mirror the Rust handler DTO
+     * (`RecordExecutionEventInput` in core-rs `types.rs`, camelCase serde) —
+     * the wire-shape source of truth. The server rejects a request whose
+     * `taskId` ≠ `flaggedTaskId` (the per-task dedup-partition pin).
+     */
+    flaggedTaskId?: string;
+    /**
+     * The flagged row's audit-table sort key — the zero-padded 16-digit
+     * `seqNum` string exactly as surfaced by `queryAudit`'s additive
+     * `AuditEntryWireRow.seqNum` projection.
+     */
+    flaggedSeqNum?: string;
+    /** The flagged entry's `entry_id` (also the dedup-key derivation input). */
+    flaggedEntryId?: string;
+}
 /**
  * PHASE-CP-1-F.1 Part A (LOCK L2) — tolerant `AWSJSON!` object read.
  *
@@ -133,6 +186,63 @@ export interface TaskReviewSummaryReviewer {
     reasoning: string;
     /** ReviewerVerdict.suggested_changes (may be empty). */
     suggestedChanges: string[];
+    /** Non-blocking observations that did not request another revision. */
+    residualObservations?: string[];
+}
+export interface TaskReviewSummaryRequirements {
+    problem: string;
+    expectedOutputs: string[];
+}
+export interface TaskReviewSummaryImplementor {
+    agent: string;
+    trackIndex?: number;
+    taskId: string;
+}
+export interface TaskReviewSummaryQuorumSeat {
+    seatId: number;
+    role: string;
+    agent: string;
+}
+export interface TaskReviewSummaryQuorum {
+    seats: TaskReviewSummaryQuorumSeat[];
+    roundCount: number;
+    revisionCount: number;
+}
+export interface TaskReviewSummaryMergeGate {
+    applicable: boolean;
+    outcome: string;
+    resolution?: string;
+}
+export interface TaskReviewSummaryDurations {
+    taskElapsedMs?: number;
+    reviewerElapsedMs?: number;
+    availability: string;
+}
+export interface TaskReviewSummaryTokenUsage {
+    knownTotal?: number;
+    knownInput?: number;
+    knownOutput?: number;
+    knownCachedInput?: number;
+    availability: string;
+    unavailableRoles: string[];
+    invocations?: TaskReviewSummaryTokenInvocation[];
+}
+export interface TaskReviewSummaryTokenInvocation {
+    role: string;
+    agent: string;
+    taskId?: string;
+    trackIndex?: number;
+    round?: number;
+    gateId?: string;
+    seatId?: number;
+    reviewerRole?: string;
+    inputTokens?: number;
+    outputTokens?: number;
+    cachedInputTokens?: number;
+    totalTokens?: number;
+    elapsedMs?: number;
+    availability: string;
+    unavailableReason?: string;
 }
 /** One round in the per-round summary (decrypted). */
 export interface TaskReviewSummaryRound {
@@ -153,6 +263,15 @@ export interface TaskReviewSummaryRound {
  * projection; `truncatedForSize`/`omittedRounds` flag the size-cap degrade.
  */
 export interface TaskReviewSummary {
+    /** Present on the additive P15 terminal-report shape; absent on legacy v1. */
+    schemaVersion?: number;
+    requirements?: TaskReviewSummaryRequirements;
+    implementors?: TaskReviewSummaryImplementor[];
+    reviewQuorum?: TaskReviewSummaryQuorum;
+    mergeGate?: TaskReviewSummaryMergeGate;
+    durations?: TaskReviewSummaryDurations;
+    tokenUsage?: TaskReviewSummaryTokenUsage;
+    residualRisks?: string[];
     rounds: TaskReviewSummaryRound[];
     /** The resolution that produced the final-approval prompt (normally proceed). */
     finalOutcome: string;
@@ -282,8 +401,31 @@ export declare class AppSyncClient {
      */
     private lastRefreshNetworkError;
     private pendingRefresh;
+    private pendingRefreshCredential;
+    /**
+     * All five WebSocket watcher families reconcile the same process-wide token
+     * cache. Collapse concurrent reconnects onto one bounded durable read /
+     * refresh operation so a keyring stall cannot multiply native calls.
+     */
+    private pendingReconnectReconciliation;
+    /**
+     * A stopped watcher cancels only its wait on the shared reconciliation. The
+     * flight remains live for other watcher families and owns its own deadline.
+     */
+    private reconnectReconciliationWaiters;
+    /**
+     * Every in-process credential replacement advances this generation. Async
+     * refresh/reconciliation work captures it before starting and may mutate the
+     * token cache only while that captured generation is still current.
+     */
+    private tokenStateGeneration;
     private lastRefreshFailureAt;
+    private lastRefreshFailureCredential;
     private static readonly REFRESH_BACKOFF_MS;
+    /** Bounds the shared Cognito flight even when a transport ignores abort. */
+    private static readonly COGNITO_REFRESH_TIMEOUT_MS;
+    /** Bounds the durable read and any refresh as one reconnect operation. */
+    private static readonly RECONNECT_RECONCILIATION_TIMEOUT_MS;
     private deviceKeyWatcher;
     private sessionUpdateWatchers;
     private applyUserDecisionWatchers;
@@ -322,6 +464,23 @@ export declare class AppSyncClient {
     /**
      * Refresh expired tokens
      */
+    private static abortReason;
+    private static throwIfAborted;
+    /**
+     * Bound one stage by its owning operation's absolute deadline. Every stage
+     * receives the same `deadlineAtMs`; a storage-backed retry therefore consumes
+     * the first attempt's elapsed time instead of acquiring another full timeout.
+     * `onTimeout` is used by network stages to abort their transport, while the
+     * explicit race remains authoritative when it ignores that signal.
+     */
+    private static awaitWithinAbsoluteDeadline;
+    /**
+     * Cancel only this caller's wait. The shared operation remains live for
+     * concurrent callers and its owner clears the single-flight slot only when
+     * the operation itself settles.
+     */
+    private static awaitSharedFlightForCaller;
+    private replaceTokens;
     private refreshTokens;
     /**
      * Do the work of refreshing tokens. Tries the caller-supplied tokens
@@ -345,25 +504,35 @@ export declare class AppSyncClient {
      */
     private callCognitoRefresh;
     /**
-     * Apply a successful refresh response: update in-memory cache first,
-     * clear the backoff sentinel, then persist to storage. Success here
-     * is defined as "the process has usable fresh tokens in memory" —
-     * storage persistence is degraded-success, not a failure mode.
+     * Apply a successful refresh response to this process's in-memory cache.
+     * Cognito's refresh response does not rotate the durable refresh token, so
+     * the already-stored credentials remain sufficient to refresh again after a
+     * restart.
      *
-     * Ordering matters. The API call to Cognito already succeeded, which
-     * means we hold valid access/id tokens right now. If we delayed the
-     * in-memory update until after persistence and the keychain write
-     * threw (keychain locked, disk full, file-backend permission error),
-     * we'd be stuck with stale-and-known-dead tokens in memory while
-     * holding valid fresh tokens in local scope that vanish at the end
-     * of this function. That would re-break both guarantees this hotfix
-     * makes: no-restart recovery becomes "restart required to escape
-     * the keychain-lock window," and backoff stays unarmed so the
-     * caller hot-loops against a working Cognito endpoint — R1's MEDIUM
-     * on round 1 of this review. Persistence-failure is loud-logged
-     * so operators can see degraded durability without losing availability.
+     * Do not rewrite durable login credentials from this background refresh.
+     * Native keychain writes are not cancellable: once a deadline wins, a late
+     * write could otherwise overwrite a newer out-of-band login or resurrect
+     * credentials deleted by a concurrent logout process. Login/logout remain
+     * the sole durable credential writers; refresh remains one bounded,
+     * memory-only operation.
      */
     private applyRefreshedTokens;
+    /**
+     * Reconcile durable login credentials with this process's token cache before
+     * reconnecting a WebSocket watcher.
+     *
+     * Background refresh deliberately leaves the durable refresh credential
+     * unchanged. When storage still contains the older access/id pair for that
+     * same refresh token, a newer non-expired in-memory pair must therefore win;
+     * otherwise every reconnect would issue a redundant Cognito refresh. A
+     * different stored refresh token is an out-of-band login and remains
+     * authoritative.
+     */
+    private reconcileTokensBeforeReconnect;
+    private performReconnectTokenReconciliation;
+    private beginReconnectReconciliationWait;
+    private finishReconnectReconciliationWait;
+    private cancelReconnectReconciliationWait;
     /**
      * Check if authenticated
      */
@@ -387,6 +556,14 @@ export declare class AppSyncClient {
      * available for retry/diagnosis.
      */
     putContextItem(input: PutContextItemInput): Promise<void>;
+    /**
+     * Persist one host-authenticated execution fact. The payload is encrypted
+     * under the task's session key; for team child tasks the backend performs the
+     * same conditional write as the audit append to renew that exact track lease.
+     */
+    recordExecutionEvent(input: RecordExecutionEventInput, sessionKeyBase64: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
     /**
      * Update a session
      */
@@ -400,6 +577,16 @@ export declare class AppSyncClient {
      * Create an event
      */
     createEvent(input: CreateEventInput): Promise<Event>;
+    /**
+     * E1 (§3.1) — liveness TTL co-refresh for the caller's still-open prompt rows
+     * (+ their deep-linked Events). Plugins call this heartbeat-driven for their
+     * durable open-prompt ledger so a >7-day-open prompt's row is NOT TTL-deleted
+     * (under-nag). The backend is scoped to `$ctx.identity.sub` + `attribute_exists`
+     * per promptId, so it works post-retirement too. Returns the promptIds whose
+     * row/Event had already aged out — the caller re-raises those (§6a-4
+     * return-driven re-raise). No-ops on an empty list (no network call).
+     */
+    refreshOpenPromptTtl(promptIds: string[]): Promise<string[]>;
     /**
      * Update event status
      */
@@ -666,7 +853,9 @@ export declare class AppSyncClient {
      * real classification; the signing helper is `signMergeClassification` in
      * `local-executor/class-a-sign.ts`). W2.a ships the SDK surface only.
      */
-    submitMergeGateVerdict(input: SubmitMergeGateVerdictInput): Promise<SubmitMergeGateVerdictResult>;
+    submitMergeGateVerdict(input: SubmitMergeGateVerdictInput, opts?: {
+        signal?: AbortSignal;
+    }): Promise<SubmitMergeGateVerdictResult>;
     /**
      * PHASE-589/469 W1 (LOCK #589-F) — report that ONE team track HARD-FAILED
      * its own local gate (a declared-test failure or an out-of-scope write). The
@@ -718,6 +907,7 @@ export declare class AppSyncClient {
         sessionId: string;
         decision: PlannerDecision;
         availableAgents?: string[];
+        implementorAgent?: string;
     }): Promise<{
         workflowState: string;
     }>;
@@ -733,6 +923,7 @@ export declare class AppSyncClient {
         sessionId: string;
         roundNumber: number;
         rawOutput: string;
+        usage?: InvocationUsageSnapshot;
     }, sessionKeyBase64: string): Promise<{
         gateId: string;
         workflowState: string;
@@ -1085,6 +1276,8 @@ export declare class AppSyncClient {
     /** Shared initial confirmation makes duplicate start calls idempotent. */
     private heartbeatInitialPulses;
     private heartbeatInitialOutcomes;
+    /** Every pulse that may still persist a timestamp, including periodic pulses. */
+    private heartbeatInFlight;
     /**
      * Start periodic heartbeat for a session.
      * Updates lastHeartbeatAt on the session every intervalMs (default 2 minutes).
@@ -1095,6 +1288,15 @@ export declare class AppSyncClient {
      * Stop heartbeat for a session.
      */
     stopHeartbeat(sessionId: string): void;
+    /**
+     * Fence every heartbeat generation, wait for already-issued timestamp writes,
+     * then persist an expired timestamp so mobile immediately renders the desktop
+     * disconnected. The ordering is load-bearing: writing the tombstone before an
+     * in-flight pulse settles would let that older pulse make the row look live
+     * again after this method returned.
+     */
+    invalidateHeartbeat(sessionId: string): Promise<boolean>;
+    private trackHeartbeatPulse;
     /**
      * Send a single heartbeat update.
      */

package/dist/appsync/queries.d.ts

@@ -24,10 +24,12 @@ export declare const queries: {
     getTaskReviewSummary: string;
 };
 export declare const mutations: {
+    recordExecutionEvent: string;
     putContextItem: string;
     createSession: string;
     updateSession: string;
     createEvent: string;
+    refreshOpenPromptTtl: string;
     updateEventStatus: string;
     registerDeviceKey: string;
     grantSessionKey: string;

package/dist/auth/__tests__/keychain-cli-nudge.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/__tests__/keychain-cli.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/keychain-cli.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Run the `keychain` subcommand group. Returns the process exit code (does NOT
+ * call `process.exit` — the caller does, keeping this unit-testable). `argv` is
+ * the raw process argv (node, script, "keychain", subcommand, flags…).
+ */
+export declare function runKeychainCli(argv: string[]): Promise<number>;
+/**
+ * Advisory nudge for `codevibe login` / `codevibe status` (GA follow-up to #642):
+ * when this machine still holds file-backed credentials, has NOT migrated, and the
+ * OS keyring is actually usable, print the `keychain migrate` suggestion. Purely
+ * additive output — never throws, never mutates state, silent on any ambiguity
+ * (see migrate-nudge.ts invariants).
+ */
+export declare function maybePrintKeychainMigrationNudge(print?: (line: string) => void): Promise<void>;

package/dist/companion-mode/index.d.ts

@@ -53,6 +53,20 @@ export interface CompanionProcessResult {
  * both PATH alias dependency and a manifest path traversal/symlink escape.
  */
 export declare function resolveDeclaredCompanionLauncher(packageJsonPath: string): string | null;
+/**
+ * Resolve a Companion plugin manifest from either:
+ *
+ * 1. this core package's ordinary dependency graph (published install), or
+ * 2. the node_modules graph that contains the CLI path used to start Node
+ *    (local npm-link/dev-link install).
+ *
+ * Node resolves a symlinked module from its real path by default. Consequently,
+ * a locally linked codevibe-core cannot see the plugin siblings that remain
+ * under the meta-package's node_modules when it uses lexical `require.resolve`
+ * alone. `process.argv[1]` retains the invoked, meta-package-owned CLI path, so
+ * a require anchored there reproduces the dependency graph the user launched.
+ */
+export declare function resolveCompanionPluginManifest(packageName: string, invokedCliPath?: string | undefined): string | null;
 /**
  * §4 LOCK lines 232-273. Detect → resolve → persist → exec.
  *

package/dist/credential-broker/oauth-account-lock.d.ts

@@ -18,6 +18,15 @@ export interface OAuthAccountLockOptions {
     heartbeatMs?: number;
     /** Contention deadline. Default 60s. */
     maxWaitMs?: number;
+    /**
+     * OWNERLESS-strand grace (F6). A lockdir present with NO readable `owner.json`
+     * is a crash strand (mkdir succeeded but the owner write / rmdir did not) that is
+     * FENCED-recovered once its mtime has been idle THIS long. Default = 2×TTL — far
+     * larger than the sub-millisecond mkdir→owner.json write window, so a live
+     * mid-acquire is never mistaken for a strand. Set high to disable recovery in
+     * practice.
+     */
+    ownerlessGraceMs?: number;
     /** Base retry backoff. Default 25ms (capped 1s). */
     backoffMs?: number;
     now?: () => number;
@@ -59,6 +68,7 @@ export declare class OAuthAccountLock {
     private readonly ttlMs;
     private readonly heartbeatMs;
     private readonly maxWaitMs;
+    private readonly ownerlessGraceMs;
     private readonly backoffMs;
     private readonly now;
     private readonly delayFn;
@@ -76,7 +86,8 @@ export declare class OAuthAccountLock {
      * ZERO side effects on the persisted bundle on any fail-closed path.
      */
     acquire(): Promise<LockHandle>;
-    /** Whether the EXISTING lockdir holder is reclaimable (dead), or must be waited on. */
+    /** Whether the EXISTING lockdir holder is reclaimable (dead), an ownerless strand
+     *  (F6), or must be waited on. */
     private classifyExistingHolder;
     /**
      * Reclaim a stale, provably-dead lockdir under the SEPARATE reclaim guard.
@@ -85,9 +96,44 @@ export declare class OAuthAccountLock {
      * the guard is dead/stranded (fail-closed → offline cleanup).
      */
     private tryReclaim;
+    /**
+     * FENCED recovery of a stranded OWNERLESS lockdir (F6) — the same reclaim-guard
+     * mutex + rename primitive as the dead-owner path, so at most one recoverer ever
+     * proceeds and no live successor is displaced. Returns a fresh {@link LockHandle}
+     * on success, or `null` if aborted (guard held/stranded, an owner appeared, or the
+     * dir freshened/vanished under the guard).
+     *
+     * RESIDUAL (documented): the ONE window this cannot fully close is a live acquirer
+     * OS-suspended (SIGSTOP) or GC-frozen for LONGER than `ownerlessGraceMs` precisely
+     * within the sub-millisecond gap between its `mkdir(lockDir)` and its
+     * `writeFile(owner.json)`. If that acquirer's owner-write lands AFTER our rename +
+     * fresh mkdir, it overwrites our `owner.json`; our `reassertOwnership()` (the
+     * broker's before-every-mutation backstop) then returns false and we abort — no two
+     * committed writers for vendor-key callers. For the keychain file-store lock (which
+     * does not reassert) this leaves a vanishingly-narrow two-writer window, strictly
+     * better than the previous PERMANENT strand that broke all auth until offline
+     * cleanup. The grace (default 2×TTL) makes the precondition astronomically unlikely.
+     */
+    private tryReclaimOwnerless;
+    /** Remove a renamed-away ownerless strand (it holds no owner.json by definition). */
+    private removeOwnerlessStaleDir;
     /** Write `owner.json`, start the heartbeat, and build the handle. */
     private onAcquired;
     private tryMkdir;
+    /**
+     * Tri-state read of a lockdir's owner.json (R4-2). Only a genuine ENOENT is
+     * `absent`; a present-but-unreadable (EACCES/EIO/…) or unparseable/invalid file is
+     * `unreadable` (fail closed — never treated as ownerless or dead).
+     */
+    private readOwnerState;
+    /**
+     * Boolean-owner accessor for the non-recovery paths (heartbeat tick, reassert,
+     * release, dead-owner reclaim, stale-dir cleanup): an `unreadable` owner maps to
+     * `null`, which is the SAFE direction for every one of those (reassert→false→abort;
+     * tick→skip; release→don't touch; dead-reclaim re-read→abort). The
+     * ownerless-recovery path uses `readOwnerState` directly so it can tell `absent`
+     * (recoverable) from `unreadable` (must wait).
+     */
     private readOwner;
     private lockDirAge;
     private removeStaleDir;

package/dist/crypto/__tests__/open-prompt-id.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto/index.d.ts

@@ -1,3 +1,4 @@
 export { CryptoService, cryptoService, CryptoError, ENCRYPTION_VERSION } from './crypto-service';
 export { encryptForEmit } from './encrypt-for-emit';
 export type { EncryptedEmitPayload } from './encrypt-for-emit';
+export { E1_PROMPT_ID_DOMAIN, deriveOpenPromptId, mintOwnerToken, } from './open-prompt-id';

package/dist/crypto/open-prompt-id.d.ts

@@ -0,0 +1,36 @@
+/**
+ * E1 "missed-prompt recovery" — the producer-side self-certifying promptId
+ * commitment (PHASE-E1-MISSED-PROMPT-RECOVERY-DESIGN.md §3.1 / §4).
+ *
+ * A producer (a plugin, or core's own planner-offer path) mints a secret
+ * `ownerToken` per raise and emits `promptId = deriveOpenPromptId(ownerToken)`.
+ * The backend's `classifyRaise` re-derives and admits the openPrompts row ONLY
+ * when `promptId == derive(ownerToken)` (WRITE_ROW). Because SHA-256 is
+ * preimage-resistant, an attacker who knows a victim's promptId cannot produce a
+ * token that derives to it, so ownership survives the token never being stored
+ * server-side (it is NEVER projected back to clients).
+ *
+ * THIS IS A CROSS-PRODUCER BYTE CONTRACT. This file is the byte-for-byte port of
+ * the backend `lambda/shared/e1-open-prompts.ts` derive. core / codex / claude /
+ * agy MUST all reproduce the SAME bytes: same domain string, the SINGLE `\0`
+ * (0x00) separator, UTF-8 encoding of the token, SHA-256, first 16 bytes, and the
+ * v4 UUID version/variant shaping. A single divergent byte yields a different
+ * promptId → the backend REJECTs the raise → a HIDDEN prompt (under-nag). The
+ * pinned golden vectors in `__tests__/open-prompt-id.test.ts` (identical to the
+ * backend's `cdk/test/e1-open-prompts.test.ts`) lock this. Do NOT alter the
+ * domain, drop/duplicate the separator, or re-encode.
+ */
+/** Pinned domain separator for the promptId commitment (never change post-ship). */
+export declare const E1_PROMPT_ID_DOMAIN = "codevibe.e1.openprompt.promptid.v1";
+/**
+ * `derive(ownerToken) = uuidFormat( SHA-256(E1_DOMAIN ‖ 0x00 ‖ ownerToken)[:16] )`
+ * A BARE UUID — NO `synth-` prefix. Preimage-resistant.
+ */
+export declare function deriveOpenPromptId(ownerToken: string): string;
+/**
+ * Mint a fresh 256-bit secret `ownerToken` for one raise. Hex-encoded so it is a
+ * safe plaintext GraphQL string. Never persisted server-side; the producer
+ * stashes it in its durable PromptRaiseRecord so a retirement/resume re-raise can
+ * re-commit the SAME promptId.
+ */
+export declare function mintOwnerToken(): string;

package/dist/e1/__tests__/prompt-raise.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/e1/index.d.ts

@@ -0,0 +1,2 @@
+export { newPromptRaise, raiseFieldsFromRecord, } from './prompt-raise';
+export type { E1ProducerKind, PromptRaiseRecord, E1RaiseFields, } from './prompt-raise';

package/dist/e1/prompt-raise.d.ts

@@ -0,0 +1,65 @@
+/**
+ * E1 missed-prompt recovery — the SHARED producer-side raise identity
+ * (PHASE-E1-MISSED-PROMPT-RECOVERY-DESIGN.md §4 / §6a-4). core + claude + codex +
+ * agy all mint + emit + persist the SAME shape so a retirement/resume re-raise
+ * re-commits the SAME `promptId`.
+ *
+ * A producer mints a fresh `ownerToken` at FIRST raise and stashes it in a
+ * durable `PromptRaiseRecord`. Every raise/re-raise emits
+ * `promptId = deriveOpenPromptId(ownerToken)` + the token, so the backend
+ * `classifyRaise` WRITE_ROWs the durable open-prompt row (first raise on the
+ * `attribute_not_exists` branch, a re-raise on the `ownerToken = :token` branch).
+ *
+ * SECRECY INVARIANT (design Stage-1 v37): `ownerToken` is the secret behind the
+ * commitment — it must be stripped from EVERY same-user-readable surface (it is
+ * never in a Query/fan-out/listEvents projection). Persist it ONLY in the local
+ * durable record on the producer's own machine.
+ *
+ * Scope: this is the shared E1 IDENTITY. Each plugin's persistence adapter wraps
+ * this record with its own re-raise CONTENT (the prompt text / options), because
+ * those shapes differ per agent (claude tmux options, codex tool-input, agy pane
+ * capture). Keep the identity here; keep the content in the plugin.
+ */
+export type E1ProducerKind = 'PLUGIN_APPROVAL' | 'CORE_OFFER';
+/** The durable, per-producer record (§6a-4). Persisted locally; never uploaded. */
+export interface PromptRaiseRecord {
+    /** = deriveOpenPromptId(ownerToken). The stable cross-surface prompt identity. */
+    promptId: string;
+    /** IMMUTABLE 256-bit secret minted ONCE at first raise. NEVER surface it. */
+    ownerToken: string;
+    /** The session this prompt belongs to (for the resolve-delete origin binding). */
+    sessionId: string;
+    producerKind: E1ProducerKind;
+    /** CLAUDE | CODEX | ANTIGRAVITY (for the mobile row + fan-out). */
+    agentType?: string;
+    title?: string;
+    /** false = SUPPRESSED (options unparseable → badge-only NOTIFICATION carrier). */
+    mobileActionable: boolean;
+    /** First-raise wall clock (ms); record-creation time, for local ordering/debug. */
+    raisedAtMs: number;
+}
+/** The additive `CreateEventInput` fields a raise/re-raise puts on the wire. */
+export interface E1RaiseFields {
+    ownerToken: string;
+    promptId: string;
+    producerKind: E1ProducerKind;
+    mobileActionable: boolean;
+}
+/** Derive the wire fields from a (new or persisted) record — pure. */
+export declare function raiseFieldsFromRecord(r: PromptRaiseRecord): E1RaiseFields;
+/**
+ * FIRST raise: mint a fresh secret, derive its committed promptId, and return
+ * both the wire fields and the durable record to persist. The caller persists
+ * `record` (via its per-plugin adapter) so a later restart can re-raise.
+ */
+export declare function newPromptRaise(opts: {
+    sessionId: string;
+    producerKind: E1ProducerKind;
+    mobileActionable: boolean;
+    agentType?: string;
+    title?: string;
+    nowMs?: number;
+}): {
+    record: PromptRaiseRecord;
+    fields: E1RaiseFields;
+};