@quantiya/codevibe-core 2.0.7 → 2.0.9

package/dist/substrate/types.d.ts

@@ -1,4 +1,5 @@
 import type { Readable, Writable } from "node:stream";
+import type { WorkspaceRootAuthority } from "../local-executor/workspace-authority";
 /**
  * Isolation backend for a substrate. `firecracker` is [DEF →
  * A3-after-C2] — declared so the union admits the hosted runner without
@@ -24,10 +25,12 @@ export type EgressFidelity = "strict" | "coarse";
 export interface SubstrateSpec {
     isolationTech: IsolationTech;
     /**
-     * Canonical host path of the session worktree — the ONLY filesystem
-     * mounted (§6 Q3 git-proxy).
+     * Canonical host path of the session workspace — the only mutable filesystem
+     * mounted; repository metadata is hidden by the substrate.
      */
     workdir: string;
+    /** Exact host workdir incarnation for task-scoped mutable launches. */
+    workdirAuthority?: WorkspaceRootAuthority;
     /**
      * Where the broker actually listens on the HOST (e.g.
      * `127.0.0.1:<ephemeral>`).
@@ -133,6 +136,14 @@ export interface SubstrateProc {
     readonly stdin: Writable | null;
     readonly stdout: Readable | null;
     readonly stderr: Readable | null;
+    /**
+     * The host command runner advertises this only when the returned process is
+     * itself wrapped by CodeVibe's authenticated POSIX process host. The Local
+     * Executor must then await that host's cleanup proof before retiring a
+     * workspace. Docker-backed substrate processes omit it because the
+     * container, rather than a host POSIX group, owns their lifecycle.
+     */
+    readonly hostProcessTreeOwnership?: "posix-host";
     kill(signal?: NodeJS.Signals): boolean;
     on(event: "close" | "error" | "exit", cb: (...a: unknown[]) => void): this;
 }
@@ -243,5 +254,7 @@ export interface CommandRunner {
         env?: Readonly<Record<string, string>>;
         /** Child working directory. Absent → inherit the parent's cwd. */
         cwd?: string;
+        /** Exact cwd incarnation held through native process creation. */
+        cwdAuthority?: WorkspaceRootAuthority;
     }): RunnerProc;
 }

package/dist/substrate-launch/__tests__/reviewer-credential-preflight.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/substrate-launch/engage-substrate.d.ts

@@ -2,6 +2,7 @@ import { type RotationHandle } from "../credential-broker";
 import type { BrokerDeps } from "../credential-broker/broker";
 import type { ModelGatewayBroker, UpstreamClient, VendorProvider } from "../credential-broker/types";
 import type { ProcessRole } from "../local-executor/types";
+import type { WorkspaceRootAuthority } from "../local-executor/workspace-authority";
 import type { SubstrateHandle } from "../substrate/types";
 import { type FallbackLadderDeps } from "./fallback-ladder";
 /** Map the implementor agent to the broker provider (Claude+Codex only, §6 Q4). */
@@ -21,6 +22,8 @@ export interface EngageSubstrateInput {
     agentKind: "CLAUDE" | "GEMINI" | "CODEX" | "ANTIGRAVITY";
     /** Canonical host path of the session worktree (the only fs mounted). */
     workdir: string;
+    /** Exact workdir incarnation for task-scoped mutable dispatch. */
+    workdirAuthority?: WorkspaceRootAuthority;
     /** The implementor role marker value (always 'implementor' here). */
     role: ProcessRole;
     /**

package/dist/substrate-launch/index.d.ts

@@ -6,6 +6,8 @@ export { buildSanitizedBaseEnv, assertNoAmbientCreds, SAFE_ENV_ALLOWLIST, SANDBO
 export type { SanitizedEnvInput } from "./sanitized-env";
 export { ApiKeyBootstrap, SANDBOX_BOOTSTRAP_DIR, HELPER_SCRIPT_NAME, TOKEN_FILE_NAME, CODEX_PROVIDER_ID, } from "./apikey-bootstrap";
 export type { ApiKeyBootstrapInput } from "./apikey-bootstrap";
+export { assertReviewerVendorCredential, reviewerProviderFor, withReviewerCredentialPreflight, ReviewerCredentialMissingError, REVIEWER_CREDENTIAL_MISSING, } from "./reviewer-credential-preflight";
+export type { ReviewerCredentialStore } from "./reviewer-credential-preflight";
 export { scrubLeEnvOrReexec, buildScrubbedLeEnv, findCredShapedKeys, isCredShapedEnvKey, LE_ENV_SCRUBBED_MARKER, } from "./le-env-scrub";
 export type { LeEnvScrubDeps } from "./le-env-scrub";
 export { Cp7AuditWriter, CP7_CANONICAL_FORM_VERSION, GENESIS_PREV_HASH, canonicalJson, canonicalEntryBytes, computeEntryHash, verifyChain, } from "../local-executor/cp7-audit-writer";

package/dist/substrate-launch/reviewer-credential-preflight.d.ts

@@ -0,0 +1,50 @@
+import type { VendorProvider } from "../credential-broker";
+/**
+ * Typed marker for the missing-credential failure so the loop can surface the
+ * remediation on the user-facing NOTIFICATION channel (Stage-2 r2 Codex MED-1)
+ * without string-matching. Identified by `name` (survives bundling) — callers
+ * check `err.name === REVIEWER_CREDENTIAL_MISSING` rather than instanceof.
+ */
+export declare const REVIEWER_CREDENTIAL_MISSING = "ReviewerCredentialMissingError";
+export declare class ReviewerCredentialMissingError extends Error {
+    name: string;
+}
+/**
+ * The minimal store surface the preflight needs (structurally satisfied by
+ * `KeychainVendorKeyStore`); narrow so tests can stub it without keychain IO.
+ */
+export interface ReviewerCredentialStore {
+    getVendorKey(provider: VendorProvider): Promise<string | null>;
+    getVendorOAuthBundle(provider: VendorProvider): Promise<unknown | null>;
+}
+/**
+ * Map a reviewer agent kind (lowercase, as the loop's engager input carries it)
+ * to its broker vendor provider. Non-Trusted agents (gemini/antigravity) have
+ * no broker provider — they never sandbox, so the preflight is a no-op for
+ * them (the loop pre-routes them to legacy+badge before engaging anyway).
+ */
+export declare function reviewerProviderFor(agent: string): VendorProvider | null;
+/**
+ * Throw (fail-closed) when a Trusted reviewer is about to substrate-engage but
+ * no vendor credential exists for its provider. The message is the user-facing
+ * remediation — it propagates verbatim through the loop's engage-failure
+ * ESCALATE (`spawnOneSeat`) and the Wave-B fall-through WARN.
+ */
+export declare function assertReviewerVendorCredential(agent: string, store: ReviewerCredentialStore): Promise<void>;
+/**
+ * Wrap a reviewer substrate engager with the credential preflight, ordered
+ * AFTER tier selection (Stage-2 r2 Codex MED-2): the underlying engage runs
+ * first, and the credential check applies ONLY when the ladder actually chose
+ * the `substrate` (broker) mode — a `reduced_trust` selection never consults
+ * credentials, preserving the pre-flip legacy-plus-badge fallback on hosts
+ * with no establishable sandbox tier. On substrate + missing credential the
+ * engaged substrate is torn down and the actionable
+ * `ReviewerCredentialMissingError` propagates (fail-closed, no ambient
+ * fallback).
+ */
+export declare function withReviewerCredentialPreflight<I extends {
+    agent: string;
+}, R extends {
+    mode: string;
+    teardown: () => Promise<void>;
+}>(engage: (input: I) => Promise<R>, store: ReviewerCredentialStore): (input: I) => Promise<R>;

package/dist/test-publication-authority-setup.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tool-activity/replay-cursor.d.ts

@@ -1,5 +1,19 @@
 import { z } from 'zod';
 import type { Logger } from '../logger';
+/** Keep every ordinary replay read comfortably below Node/Buffer's platform limits. */
+export declare const DEFAULT_REPLAY_READ_BYTES: number;
+/**
+ * A JSONL record may be larger than the ordinary batch, so the reader extends in
+ * fixed-size chunks until it finds the terminating newline. This cap bounds the
+ * one-record memory cost without imposing any limit on the transcript FILE size.
+ */
+export declare const DEFAULT_REPLAY_MAX_FRAME_BYTES: number;
+export declare class ReplayFrameTooLargeError extends Error {
+    readonly startOffset: number;
+    readonly maxFrameBytes: number;
+    readonly code = "REPLAY_FRAME_TOO_LARGE";
+    constructor(startOffset: number, maxFrameBytes: number);
+}
 export declare const ReplayCursorStateSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     /** The transcript path this cursor tracks (a change ⇒ rescan from 0). */
@@ -23,8 +37,8 @@ export declare const ReplayCursorStateSchema: z.ZodObject<{
     carryover: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     version: 1;
-    byteOffset: number;
     canonicalPath: string;
+    byteOffset: number;
     fileIdentity: {
         dev: number;
         ino: number;
@@ -33,8 +47,8 @@ export declare const ReplayCursorStateSchema: z.ZodObject<{
     carryover: string;
 }, {
     version: 1;
-    byteOffset: number;
     canonicalPath: string;
+    byteOffset: number;
     fileIdentity: {
         dev: number;
         ino: number;
@@ -57,7 +71,7 @@ export interface ReplayFrame {
 }
 /** A pure read snapshot — no persisted state is mutated by {@link ToolReplayCursor.readFrames}. */
 export interface ReadFramesResult {
-    /** Complete lines from the checkpoint (or 0 after a rotation) to EOF. */
+    /** Complete lines in this bounded batch from the checkpoint (or 0 after a rotation). */
     frames: ReplayFrame[];
     /** True when the file rotated/truncated and was rescanned from 0. */
     rotated: boolean;
@@ -67,6 +81,14 @@ export interface ReadFramesResult {
     carryover: string;
     /** Byte offset just past the last COMPLETE line — the max checkpoint candidate. */
     endOfComplete: number;
+    /**
+     * True when this stat snapshot contains bytes beyond the bounded read. The
+     * caller may immediately run another batch after checkpointing this one.
+     * False at the snapshot EOF, including when EOF is an incomplete trailing line.
+     */
+    hasMore: boolean;
+    /** Bytes actually read from disk for this batch (diagnostics/tests). */
+    bytesRead: number;
     /** The identity + size captured AT read time — pass to {@link ToolReplayCursor.checkpoint} for a consistent snapshot. */
     fileIdentity: {
         dev: number;
@@ -81,6 +103,10 @@ export interface ToolReplayCursorOptions {
     canonicalPath: string;
     logger: Logger;
     root?: string;
+    /** Ordinary bounded batch size. Defaults to 4 MiB. */
+    readBytes?: number;
+    /** Maximum bytes allowed in one unterminated JSONL record. Defaults to 64 MiB. */
+    maxFrameBytes?: number;
 }
 /**
  * The durable tool-replay cursor for ONE session's transcript. Split into a PURE
@@ -94,6 +120,8 @@ export declare class ToolReplayCursor {
     private readonly canonicalPath;
     private readonly logger;
     private readonly rootDir;
+    private readonly readBytes;
+    private readonly maxFrameBytes;
     private state;
     constructor(opts: ToolReplayCursorOptions);
     private filePath;
@@ -105,11 +133,17 @@ export declare class ToolReplayCursor {
     /** The current durable checkpoint (0 when fresh). */
     byteOffset(): number;
     /**
-     * Read + byte-frame the transcript from the durable checkpoint (or 0 after a
-     * rotation) to EOF. PURE — persists nothing. Frames on `\n` (0x0A), an ASCII
-     * byte that never appears mid-UTF-8-char, so every complete-line boundary is a
-     * safe UTF-8 (and byte-offset) boundary; the trailing partial is returned as
-     * `carryover` and re-read next cycle.
+     * Read + byte-frame ONE BOUNDED transcript batch from the durable checkpoint
+     * (or 0 after a rotation). PURE — persists nothing. File positions are ordinary
+     * safe JS integers, so offsets above Node's signed 32-bit Buffer length remain
+     * valid; no allocation is based on `(fileSize - checkpoint)`.
+     *
+     * Frames on `\n` (0x0A), an ASCII byte that never appears mid-UTF-8-char, so
+     * every complete-line boundary is a safe UTF-8 (and byte-offset) boundary. If
+     * the ordinary batch contains no newline, fixed-size reads extend only until
+     * the first record terminator or `maxFrameBytes`. Thus transcript FILE size is
+     * unbounded while one malformed/huge JSONL RECORD has a controlled bound.
+     * The trailing partial is returned as `carryover` and re-read next cycle.
      */
     readFrames(): Promise<ReadFramesResult>;
     /**

package/dist/track-presentation.d.ts

@@ -0,0 +1,2 @@
+/** Convert the zero-based wire/persistence track index to its user-facing number. */
+export declare function displayTrackNumber(trackIndex: number): number;

package/dist/track-presentation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/encryption.d.ts

@@ -55,4 +55,9 @@ export interface GrantSessionKeyInput {
     ephemeralPublicKey: string;
     /** SHA-256 of the exact registered public-key string used to wrap the key. */
     recipientPublicKeySha256: string;
+    /**
+     * Exact session-key generation used to produce `encryptedKey`, or the
+     * generation-absent sentinel for a legacy row.
+     */
+    expectedSessionKeyGen: string;
 }

package/dist/types/events.d.ts

@@ -95,6 +95,11 @@ export interface CreateEventInput {
     promptId?: string;
     timestamp?: string;
     isEncrypted?: boolean;
+    ownerToken?: string;
+    producerKind?: string;
+    mobileActionable?: boolean;
+    resolvedPromptId?: string;
+    resolutionAt?: string;
     clientEventId?: string;
     expectedSessionKeyGen?: string;
     encryptionVersion?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.7",
+  "version": "2.0.9",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -16,8 +16,8 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "emit-types": "tsc --emitDeclarationOnly",
-    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --packages=external --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && npm run verify-no-test-hooks",
-    "verify-no-test-hooks": "if grep -Elq 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT' dist/index.js dist/orchestration-shell/cli.js; then echo 'ERROR: a CODEVIBE_TEST_FORCE_* test hook leaked into a published bundle (prod-unreachability invariant)'; exit 1; fi; echo 'OK — no test-only hooks in published bundles'",
+    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --minify-syntax --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && npm run verify-no-test-hooks",
+    "verify-no-test-hooks": "if grep -ERl 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT|CODEVIBE_ANCHORED_PUBLICATION_AUTHORITY_ROOT|codevibe-anchored-publications-|cv-publication-authority-vitest-|codevibe\\.test\\.publication-authority-|setPublicationAuthorityRootForTestBuild|__CODEVIBE_TEST_BUILD__' dist; then echo 'ERROR: a test-only hook leaked into a published artifact (prod-unreachability invariant)'; exit 1; fi; echo 'OK — no test-only hooks in published artifacts'",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run build",
     "test": "vitest run",

package/dist/substrate/git-proxy.d.ts

@@ -1,35 +0,0 @@
-/**
- * A minimal synthetic `config` written into the proxy. Repository-format
- * version + bare=false ONLY — explicitly NO `[remote ...]`, NO `[credential]`,
- * NO `core.hooksPath`, NO `[user]` (which could carry a signing key path). This
- * is the credential-scrub: the real repo's config never enters the sandbox.
- */
-export declare const SCRUBBED_CONFIG: string;
-/**
- * Resolve the real parent `.git` directory for a worktree. In a worktree the
- * `<workdir>/.git` is a FILE: `gitdir: /abs/path/to/parent/.git/worktrees/<n>`.
- * The commit objects live in the parent repo's top-level `.git` (i.e. two
- * levels up from `worktrees/<n>`). For a NON-worktree checkout `<workdir>/.git`
- * is already the real dir. Returns the directory that holds `objects/` +
- * `refs/`.
- *
- * @returns the resolved real git-common-dir, or `null` if `<workdir>/.git` is
- *   absent/unreadable (the caller skips proxying — a non-git workdir is fine).
- */
-export declare function resolveGitCommonDir(workdir: string): Promise<string | null>;
-/**
- * Build a read-only, credential-scrubbed `.git` proxy at `destDir` from the
- * resolved git-common-dir. **[W2-min]** — copies only {@link COPIED_GIT_ENTRIES}
- * + a synthetic stripped {@link SCRUBBED_CONFIG}; NO remotes/creds/hooks/reflog.
- *
- * The substrate bind-mounts `destDir` READ-ONLY into the sandbox at
- * `<workdir>/.git`. Returns the proxy path on success, or `null` if `workdir`
- * is not a resolvable git checkout (the substrate then mounts only the worktree
- * with no `.git`, and git read commands simply report "not a repository" — no
- * ambient exposure either way).
- */
-export declare function buildScrubbedGitProxy(workdir: string, destDir: string): Promise<string | null>;
-export declare const __testing: {
-    COPIED_GIT_ENTRIES: readonly ["HEAD", "refs", "packed-refs", "objects"];
-    SCRUBBED_CONFIG: string;
-};