@quantiya/codevibe-core 2.0.71 → 2.0.73

package/dist/session-resume/shell-resume.d.ts

@@ -0,0 +1,34 @@
+import type { RelaunchRequest } from './relaunch';
+import { type ResumeEntryDeps } from './resume-entry';
+export declare const RESUME_DESKTOP_ONLY = "/resume works on the desktop only.";
+export declare const RESUME_RUNNING_WORK = "Finish or cancel the running work first \u2014 /status shows it.";
+export declare const RESUME_NEEDS_PAID_TIER = "Resuming a session needs CodeVibe Pro or Max.";
+export declare const RESUME_CANCELLED = "Resume cancelled. This session continues.";
+export type ShellResumeOutcome = 
+/** Print and keep this session running (an empty text prints nothing). */
+{
+    kind: 'message';
+    text: string;
+}
+/** End this session through `/exit`, then relaunch as the resume of P. */
+ | {
+    kind: 'switch';
+    request: RelaunchRequest;
+};
+/** Step 1's first checks, before anything is read (a phone, Free, running work). */
+export declare function shellResumePreCheck(args: {
+    origin: 'keyboard' | 'mobile';
+    paidTier: boolean;
+    hasRunningWork(): boolean;
+}): string | null;
+export declare function runShellResume(args: {
+    /** `/resume <id>`; null opens the picker (or lists without a terminal). */
+    id: string | null;
+    origin: 'keyboard' | 'mobile';
+    /** Pro or Max. */
+    paidTier: boolean;
+    hasRunningWork(): boolean;
+    ownSessionId: string;
+    /** Entry-point deps built for this shell (`ownSessionId` set; in-shell picker and choice). */
+    deps: ResumeEntryDeps;
+}): Promise<ShellResumeOutcome>;

package/dist/session-resume/source-choice.d.ts

@@ -0,0 +1,37 @@
+/**
+ * P61 §8.1 — which copy of P's context a resume reads, and whether this
+ * process may write P's directory. Pure over what the caller has already
+ * established: the resume lock, P's owner record here, a read-only read of
+ * P's local log, and whether P ran on this computer.
+ */
+import type { ContextItem, ReadOnlyContextLogResult } from '../orchestration-shell/context-items';
+import type { OwnerRecordState } from './local-records';
+/** Why a resume on the computer where P ran uses the hosted copy (the §8.1 fallback-reason table). */
+export type HostedFallbackReason = 'keychain-unavailable' | 'local-log-absent' | 'unreadable-local-log';
+export type ResumeSourceChoice = {
+    source: 'local';
+    items: ContextItem[];
+    tail: {
+        seq: string;
+        itemSha256: string;
+    } | null;
+    /** P's owner is finished or dead: this resumer is P's sole post-mortem writer and drains P's outbox (best effort). */
+    postMortemWriter: boolean;
+} | {
+    source: 'hosted';
+    /** Null when P ran on another computer. */
+    fallbackReason: HostedFallbackReason | null;
+}
+/** Every local line unsealed but the chain did not verify: refused, no fallback. */
+ | {
+    source: 'refuse-integrity';
+}
+/** P's own process is still closing here (§8.1 copy). */
+ | {
+    source: 'still-closing';
+};
+export declare function chooseResumeSource(args: {
+    ownerState: OwnerRecordState;
+    ranHere: boolean;
+    local: ReadOnlyContextLogResult;
+}): ResumeSourceChoice;

package/dist/session-resume/successor-carry-over.d.ts

@@ -0,0 +1,54 @@
+/**
+ * P61 INV-5 (design §8.5) for an interrupted resume found at a resume entry
+ * point (§6.2 step 2): S's shell starts, and S's create is replayed, only on a
+ * verified local carry-over that ends in its marker for P.
+ *
+ * S's log is first classified with the read-only reader (B-8), so nothing in
+ * S's directory changes on the way to a refusal. When the log cannot show the
+ * marker, the three INV-5 cases apply:
+ * - keychain unavailable: fail closed with the §8.1 keychain copy;
+ * - P still inside its window: S's log is set aside (exact-path rename to the
+ *   shipped `log.jsonl.unrecoverable-<ms>` shape, never deleted) and the
+ *   carry-over is rebuilt from P as a fresh log, re-verified and re-sealed;
+ * - otherwise: fail closed with the applicable §8.1 copy.
+ * The rebuild runs under P's resume lock, as S's recorded owner (INV-1).
+ */
+import type { ContextItem, ReadOnlyContextLogResult } from '../orchestration-shell/context-items';
+import { type ResumeChosenDeps } from './resume-chosen';
+import { type ResumeLedgerRecord } from './resume-ledger';
+/** Why S's log does not show a verified carry-over ending in its marker. */
+export type SuccessorLogFailure = 'absent' | 'integrity' | 'unreadable' | 'no-marker';
+export type SuccessorLogState = {
+    kind: 'verified';
+    items: ContextItem[];
+    marker: ContextItem;
+} | {
+    kind: 'keychain-unavailable';
+} | {
+    kind: 'unverifiable';
+    reason: SuccessorLogFailure;
+};
+/** Classify a read-only read of S's log against the ledger's sealed marker. */
+export declare function classifySuccessorLog(read: ReadOnlyContextLogResult, marker: ResumeLedgerRecord['marker']): SuccessorLogState;
+export type SuccessorRebuildResult = {
+    kind: 'rebuilt';
+    record: ResumeLedgerRecord;
+    items: ContextItem[];
+    marker: ContextItem;
+    warnings: string[];
+} | {
+    kind: 'refused';
+    text: string;
+} | {
+    kind: 'cancelled';
+};
+/** INV-5's second and third cases. The caller holds P's lock and has taken over S's owner record. */
+export declare function rebuildSuccessorCarryOver(args: {
+    record: ResumeLedgerRecord;
+    reason: SuccessorLogFailure;
+    /** The targeted resume in a terminal; any other replay never prompts. */
+    interactive: boolean;
+    chosen: ResumeChosenDeps;
+    /** Rename S's log aside by exact path, if it exists. */
+    setAsideSuccessorLog(successorSessionId: string): Promise<void>;
+}): Promise<SuccessorRebuildResult>;

package/dist/session-resume/will-retire.d.ts

@@ -0,0 +1,24 @@
+/**
+ * P61 `willRetire` (SESSION-RESUME-DESIGN.md §6.2 step 3): the shared
+ * definition of a row this launch retires. The `--continue` comparison and the
+ * pre-listing retire both evaluate it on the same step-1 `listSessions` read,
+ * so they can never disagree (C2-F5).
+ */
+import { type SessionFreshnessFields } from '../appsync/session-freshness';
+import type { OwnerRecordState } from './local-records';
+/** The plain-launch orphan threshold the pre-listing sweep shares (`cli.ts` sweep). */
+export declare const PRE_LISTING_STALE_THRESHOLD_MS: number;
+export interface RetireCandidateRow extends SessionFreshnessFields {
+    sessionId: string;
+    agentType: string;
+    status: string;
+}
+export interface WillRetireContext {
+    nowMs: number;
+    /** The session running in this process, never retired. */
+    ownSessionId?: string;
+    /** This computer's owner-record state for the row's session. */
+    ownerState: OwnerRecordState;
+    staleThresholdMs?: number;
+}
+export declare function willRetire(row: RetireCandidateRow, ctx: WillRetireContext): boolean;

package/dist/tool-activity/ledger.d.ts

@@ -212,6 +212,11 @@ export declare class ToolActivityLedger {
     markTerminal(clientEventId: string, invocationIds?: string[]): Promise<void>;
     /** Retirement is permanent replay suppression, not delivery/quota settlement. */
     markRetired(clientEventId: string, invocationIds: string[]): Promise<void>;
+    /** One durable mutation per bounded retirement page, not per window. */
+    markRetiredWindows(windows: readonly {
+        clientEventId: string;
+        invocationIds: string[];
+    }[]): Promise<void>;
     /** R2 keeps a window settlement independently of occurrence remapping/pruning. */
     markSettled(clientEventId: string, invocationIds: string[], disposition: 'acked' | 'terminal', requireDirectorySync?: boolean): Promise<void>;
     /**

package/dist/tool-activity/outbox.d.ts

@@ -3,7 +3,7 @@ import type { DesktopSyncSessionScope } from '../appsync/sync-operation-journal'
 import type { ToolSyncRetirementLocation } from '../appsync/sync-session-retirement';
 import { ToolActivityOutboxEnvelope } from './types';
 export interface ToolActivityOutboxOptions {
-    /** Plugin agent slug — `claude` | `codex` (the on-disk namespace). */
+    /** Plugin agent slug — `claude` | `codex` | `agy` (the on-disk namespace). */
     agent: string;
     logger: Logger;
     /** Override the root for tests; defaults to `~/.codevibe/<agent>/tool-activity-outbox`. */
@@ -17,7 +17,7 @@ export interface ListPendingResult {
     quarantined: string[];
 }
 /**
- * The durable outbox for ONE consolidated plugin (claude / codex). A pure
+ * The durable outbox for ONE consolidated plugin (claude / codex / agy). A pure
  * durability primitive: persist / list-and-validate / prune / enumerate. The
  * send orchestration (encrypt-at-send, retry, back-pressure, ack) lives in the
  * consolidator that owns this outbox.
@@ -60,6 +60,7 @@ export declare class ToolActivityOutbox {
      * No temp sweep, quarantine, generation rewrite or legacy window deletion. */
     withRetirementSources<T>(scope: DesktopSyncSessionScope, action: (sources: {
         windows: ToolActivityOutboxEnvelope[];
+        hasMore: boolean;
         markRetired(): Promise<void>;
         prune(): Promise<void>;
     }) => Promise<T>): Promise<T | null>;

package/dist/tool-activity/replay-cursor.d.ts

@@ -57,6 +57,19 @@ export declare const ReplayCursorStateSchema: z.ZodObject<{
     carryover: string;
 }>;
 export type ReplayCursorState = z.infer<typeof ReplayCursorStateSchema>;
+/** A first-host boundary captured before lifecycle/cloud awaits. This excludes
+ * pre-host history; it is NOT a delivery acknowledgement or a copied cursor. */
+export interface ToolReplayInitialBoundary {
+    byteOffset: number;
+    fileIdentity: {
+        dev: number;
+        ino: number;
+    };
+    size: number;
+}
+/** Capture a native boundary synchronously before lifecycle/cloud awaits.
+ * Existing partial records remain unread. Memory and reverse lookup are bounded. */
+export declare function captureToolReplayBoundary(filePath: string, initialOffset?: number): ToolReplayInitialBoundary;
 /** One framed transcript line with its byte span. */
 export interface ReplayFrame {
     line: string;
@@ -126,10 +139,11 @@ export declare class ToolReplayCursor {
     constructor(opts: ToolReplayCursorOptions);
     private filePath;
     /**
-     * Load the persisted cursor. An absent / unreadable / invalid file yields a
-     * FRESH cursor (rescan from 0) — losing it never skips an occurrence.
+     * Existing checkpoints win over a new hosting boundary. Without a boundary,
+     * the legacy recovery contract remains rescan-from0. A supplied boundary is
+     * used only for a truly absent cursor, never to hide existing corrupt state.
      */
-    load(): Promise<void>;
+    load(initialBoundary?: ToolReplayInitialBoundary, requireExisting?: boolean): Promise<void>;
     /** The current durable checkpoint (0 when fresh). */
     byteOffset(): number;
     /**

package/dist/tool-activity/sync-transport.d.ts

@@ -23,9 +23,12 @@ export declare function retireToolActivityWindows(options: {
     writer: DurableDesktopSyncWriter;
     expectedSessionKeyGen: string;
     confirm(input: ConfirmDesktopSyncRetirementInput): Promise<SyncSessionRetirementReceipt>;
+    /** Terminal exit records the existing intent instead of pruning a backlog. */
+    deferIfPaged?: boolean;
 }): Promise<{
     windowsRemoved: number;
     operationsRemoved: number;
+    hasMore?: true;
 }>;
 /**
  * Shared metered tool transport. An existing ULID window maps deterministically

package/dist/types/session.d.ts

@@ -69,6 +69,8 @@ export interface Session {
      * which case the client stamps SESSION_KEY_GEN_ABSENT_SENTINEL.
      */
     sessionKeyGen?: string;
+    /** P61 — the predecessor this session resumed; selected only by the resume create. */
+    resumedFromSessionId?: string | null;
 }
 /**
  * GraphQL input for creating sessions
@@ -91,6 +93,19 @@ export interface CreateSessionInput {
      * User.orchestrationEnabledDefault (option 6a auto-populate).
      */
     orchestrationEnabled?: boolean;
+    /**
+     * P61 session resume: the ended CODEVIBE session this create continues.
+     * Idempotent (creationRequestId) CODEVIBE creates only; the backend claims
+     * the predecessor atomically with admission. Absent on every plain create.
+     */
+    resumedFromSessionId?: string;
+}
+/** P61 clean-exit tail of the context log (design §9.4). */
+export interface ContextTailInput {
+    /** The tail item's seq (canonical Crockford ULID). */
+    seq: string;
+    /** Lowercase SHA-256 hex of the tail item's plaintext JSON. */
+    itemSha256: string;
 }
 /**
  * GraphQL input for updating sessions
@@ -105,4 +120,56 @@ export interface UpdateSessionInput {
      * were retired by A6; current clients do not set this from the CLI.
      */
     orchestrationEnabled?: boolean;
+    /**
+     * P61 clean-exit fields (design §9.4). The backend stores them only on the
+     * owner's live→INACTIVE transition of a CODEVIBE session, write-once.
+     */
+    contextTail?: ContextTailInput;
+    contextTailIsResumeMarker?: boolean;
+    encryptedLastPrompt?: string;
+}
+/** P61 refusal reasons on ResumeDetails (design §9.2). */
+export type ResumeRefusalReason = 'NOT_ORCHESTRATION' | 'STILL_ACTIVE' | 'ALREADY_RESUMED' | 'WINDOW_CLOSED';
+/** P61 owner-only resume read contract (design §9.2). */
+export interface ResumeDetails {
+    sessionId: string;
+    agentType: AgentType;
+    status: SessionStatus;
+    createdAt: string;
+    lastHeartbeatAt: string | null;
+    /** Epoch seconds; null while live. */
+    expiresAt: number | null;
+    /** Epoch seconds; null until the live→INACTIVE transition. */
+    resumableUntil: number | null;
+    resumedFromSessionId: string | null;
+    resumedAs: {
+        successorSessionId: string;
+        claimedAt: string;
+    } | null;
+    resumable: boolean;
+    notResumableReason: ResumeRefusalReason | null;
+    /** Ciphertext, as on Session. */
+    projectPath: string;
+    encryptedLastPrompt: string | null;
+    encryptedKeys: EncryptedSessionKey[] | null;
+    sessionKeyGen: string | null;
+    creatorDeviceId: string | null;
+    contextTailSeq: string | null;
+    contextTailSha256: string | null;
+    contextTailIsResumeMarker: boolean | null;
+}
+export interface ResumableSessionPage {
+    items: ResumeDetails[];
+    nextToken: string | null;
+}
+/** A hosted ContextItem row: routing ids and ciphertext only (design §9.3). */
+export interface ContextItemRowWire {
+    seq: string;
+    taskId: string | null;
+    trackId: string | null;
+    ciphertext: string;
+}
+export interface ContextItemPage {
+    items: ContextItemRowWire[];
+    nextToken: string | null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.71",
+  "version": "2.0.73",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",