@quantiya/codevibe-core 2.0.76 → 2.0.77

package/dist/local-executor/authority.d.ts

@@ -58,4 +58,50 @@ export declare function safeReadFile(scope: AuthorityScope, p: string, options?:
  */
 export declare function mergeAuthorityScope(base: AuthorityScope, incoming: AuthorityScope): AuthorityScope;
 export declare function enforceNetwork(scope: AuthorityScope): void;
+/**
+ * Normalizes an argv array into canonical forms for security validation:
+ * - Splits `--flag=value` into `['--flag', 'value']`
+ * - Converts camelCase CLI option names (e.g. `--allowedTools`) to kebab-case (`--allowed-tools`)
+ * - Normalizes aliases like `--allow-dangerously-skip-permissions` to `--dangerously-skip-permissions`
+ */
+export declare function normalizeArgv(argv: readonly string[]): string[];
+/**
+ * Vendor M8 parser from Claude Code CLI (2.1.306) for permission rules.
+ * Accepts bare tool names ("Read", "Grep", "Glob") or tool calls ("Read(//path/**)").
+ * Extracts toolName and rawContent without mangling parentheses or commas inside the path.
+ */
+export declare function parseToolRuleM8(rule: string): {
+    toolName: string;
+    rawContent?: string;
+} | null;
+/**
+ * Exact vendor `Bu` tokenizer from Claude Code CLI (2.1.306).
+ * Splits allowed-tools CLI arguments by comma or space outside parentheses.
+ * Note: uses boolean flag `o` rather than integer depth, so internal parentheses
+ * followed by comma or space will split! (R11-F1)
+ */
+export declare function vendorBu(e: readonly string[]): string[];
+/**
+ * Parse comma-separated tool rules where target patterns inside parentheses may contain
+ * commas, tool names, nested parentheses, spaces, or other characters (R4-F7, R5-F6, R7-F4, R8-F2, R9-F2, R9-F3, R10-F1, R11-F1).
+ * Matches Claude Code CLI 2.1.306's vendor `Bu` tokenizer logic.
+ * Returns an array of trimmed individual rule strings, or null if syntax is invalid.
+ */
+export declare function parseAllowedToolsRules(value: string | readonly string[]): string[] | null;
+/**
+ * Strictly verifies whether an argv is a permitted read-only advisory invocation for Claude.
+ * Used by LocalExecutor to enforce confinement on requireConfined advisory turns (R7-F1, R8-F1, R8-F2, R9-F1, R9-F2, R9-F3, R10-F1, R10-F2).
+ */
+export declare function isStrictReadOnlyAdvisoryClaude(argv: readonly string[]): boolean;
+/**
+ * Extracts and normalizes the config key from a Codex -c or --config argument (R10-F3, R11-F3, R12-F2).
+ * Handles -ckey=value, -c=key=value, --config key=value, --config="key=value", quotes, and leading '='.
+ */
+export declare function extractConfigKey(cfg: string): string;
+export declare function isProtectedCodexConfigKey(key: string): boolean;
+/**
+ * Strictly verifies whether an argv is a permitted read-only advisory invocation for Codex.
+ * Used by LocalExecutor to enforce confinement on requireConfined advisory turns (R7-F1, R8-F1, R9-F1, R10-F3, R11-F3, R12-F1, R12-F2).
+ */
+export declare function isStrictReadOnlyAdvisoryCodex(argv: readonly string[]): boolean;
 export declare function enforceCommand(scope: AuthorityScope, argv: string[]): void;

package/dist/local-executor/implementor-argv.d.ts

@@ -1,4 +1,4 @@
-import type { AuthorityScope } from './authority';
+import { type AuthorityScope } from './authority';
 import type { AgentKind } from './types';
 /** Read-only "plan" vs write "execute" authority for the implementor. */
 export type ImplementorMode = 'plan' | 'execute';
@@ -29,6 +29,38 @@ export interface ImplementorArgvPlan {
  * because broad advisory turns should have no file-inspection tools at all.
  */
 export declare function buildClaudeNoToolsPlanArgv(): ImplementorArgvPlan;
+/**
+ * Helper to escape literal characters in paths so gitignore-style glob pattern matching
+ * does not interpret literal `*`, `?`, `[`, `]` in directory/file names as wildcards (R4-F3).
+ */
+export declare function escapeClaudePathGlob(p: string): string;
+/**
+ * Helper to format absolute paths for Claude Code CLI permission rules.
+ * Claude Code interprets a single leading slash as relative to the primary working directory;
+ * filesystem-absolute rules require a double leading slash (`//`).
+ */
+export declare function formatClaudePermissionPath(p: string): string;
+/**
+ * Preserves exact path glob patterns for Claude Code CLI permission rules (R8-F4, R9-F2).
+ * Retained for backwards-compatibility; path permissions are passed via structured `--settings`
+ * where rules are preserved verbatim without comma-to-wildcard broadening.
+ */
+export declare function sanitizeClaudeAllowedToolsPattern(p: string): string;
+/**
+ * Dedicated plan argv for Claude during read-only advisory turns where repository
+ * tools are permitted (R1-F2, R2-F2).
+ *
+ * Confines Claude strictly to `Read,Grep,Glob` via BOTH `--tools` and `--allowed-tools`.
+ * When `workdir` is provided, scopes the allowed read targets explicitly to `workdir`
+ * (including its resolved symlink target) and any explicit attachments (R2-F2, R3-F3, R4-F3).
+ * Uses filesystem-absolute `//` anchor syntax required by Claude Code CLI (R3-F3).
+ * Escapes literal path components (`*`, `?`, `[`, `]`) before appending intentional `/**` wildcards (R4-F3).
+ * Enforces `--settings` with `permissions.defaultMode: 'dontAsk'` and scoped `allow` list
+ * to remove ambient permissive grants and establish an exclusive read boundary (R3-F2, R4-F2).
+ * Enforces `--strict-mcp-config` to eliminate ambient MCP servers from enabling
+ * unintended mutations or unconfined execution during advisory turns.
+ */
+export declare function buildClaudeReadOnlyAdvisoryPlanArgv(workdir?: string, attachments?: readonly string[]): ImplementorArgvPlan;
 /**
  * D9 — the ONE shared `CODEVIBE_AGY_MODEL` resolver used by BOTH
  * `buildImplementorArgv` (the spawned argv) and `agyImplementorAllowlistEntries`

package/dist/local-executor/index.d.ts

@@ -1,7 +1,8 @@
-export { AuthorityError, AuthorityRefusal, AuthorityRefusalCategory, AuthorityScope, FileNotFound, enforceCommand, enforceNetwork, enforceRead, enforceWrite, safeReadFile, safeWriteFile, } from './authority';
+export { AuthorityError, AuthorityRefusal, AuthorityRefusalCategory, AuthorityScope, FileNotFound, enforceCommand, enforceNetwork, enforceRead, enforceWrite, parseAllowedToolsRules, parseToolRuleM8, vendorBu, normalizeArgv, isStrictReadOnlyAdvisoryClaude, isStrictReadOnlyAdvisoryCodex, safeReadFile, safeWriteFile, } from './authority';
 export { spawnHealthProbe, spawnImplementor, spawnReviewer } from './spawn';
+export { reapMarkedProcessTree, PROCESS_TREE_MARKER_ENV, type ReapResult, type ReapOptions, } from './descendant-reaper';
 export { AgentKind, AuthorityAction, ClassBInbound, ExecutorError, FailureClass, FileChangeKind, GateDispatchPayload, GateDispatchReviewerSeat, HookEvent, ImplementorHandle, LocalExecutor, MergeGateDispatchPayload, ProbeHandle, ProcessExitedInfo, ProcessRole, ProcessSpawnedInfo, ReviewerHandle, ReviewerDispatchPayload, ReviseFeedbackPayload, ReviseSeatFinding, SignedEnvelope, SpawnArgs, SpawnArgsInvalid, SpawnHandleBase, TaskGroupHaltedPayload, TrackAssignedPayload, TrackConflictContext, } from './types';
-export { agyImplementorAllowlistEntries, agyWorkdirBriefPreamble, AGY_IMPLEMENTOR_PRINT_TIMEOUT, buildImplementorArgv, extractMcpServerConfig, setupAgyWebPlugin, stripAgyWebPlugin, stripClaudeWebArgs, stripCodexWebArgs, IMPLEMENTOR_COMMAND_ALLOWLIST, makeImplementorCommandScope, resolveAgyModel, type ImplementorArgvPlan, type ImplementorCaptureSurface, type ImplementorMode, } from './implementor-argv';
+export { agyImplementorAllowlistEntries, agyWorkdirBriefPreamble, AGY_IMPLEMENTOR_PRINT_TIMEOUT, buildClaudeNoToolsPlanArgv, buildClaudeReadOnlyAdvisoryPlanArgv, escapeClaudePathGlob, formatClaudePermissionPath, sanitizeClaudeAllowedToolsPattern, buildImplementorArgv, extractMcpServerConfig, setupAgyWebPlugin, stripAgyWebPlugin, stripClaudeWebArgs, stripCodexWebArgs, IMPLEMENTOR_COMMAND_ALLOWLIST, makeImplementorCommandScope, resolveAgyModel, type ImplementorArgvPlan, type ImplementorCaptureSurface, type ImplementorMode, } from './implementor-argv';
 export { verifyClassBEd25519, classBCanonicalForSigning, ed25519PublicKeyFromRaw, type ClassBCryptoVerifyResult, } from './class-b-verify';
 export { TrackRegistry, TrackProcess, trackKey } from './track-registry';
 export { EmitShellEventFn, HookBridge, HookBridgeDeps, } from './hook-bridge';

package/dist/local-executor/local-executor-impl.d.ts

@@ -112,6 +112,7 @@ export type SubstrateEngager = (input: {
      * applies whenever the row cannot be established).
      */
     requireConfined?: boolean;
+    writableWorkdir?: boolean;
     webBrowsingActive?: boolean;
     /** F-P46a-4 — the spawn's process-tree id, folded into the sandbox environment. */
     processTreeId?: string;