@quantiya/codevibe-core 2.0.76 → 2.0.78

package/dist/orchestration-shell/context-store.d.ts

@@ -403,6 +403,63 @@ export declare const WORKSPACE_TREE_FINGERPRINT_TIMEOUT_MS = 3000;
 export declare function probeWorkspaceTreeFingerprint(workspaceRoot: string, options?: {
     timeoutMs?: number;
 }): Promise<WorkspaceTreeFingerprintProbe>;
+/** Budget of the git-free walk below; past it the probe fails (fail closed). */
+export declare const ADVISORY_WALK_FINGERPRINT_TIMEOUT_MS = 10000;
+/** Entry cap of the git-free walk below; past it the probe fails (fail closed). */
+export declare const ADVISORY_WALK_FINGERPRINT_MAX_ENTRIES = 200000;
+export type AdvisoryWorkspaceFingerprintProbe = {
+    kind: 'fingerprint';
+    method: 'git' | 'walk';
+    value: string;
+    entries: number;
+    durationMs: number;
+} | {
+    kind: 'probe-failed';
+    method: 'git' | 'walk' | 'marker';
+    reason: string;
+    durationMs: number;
+};
+/**
+ * The before/after fingerprint of a read-only advisory turn (`@agent` /
+ * `@all`), which fails closed when the two differ or cannot be taken.
+ *
+ * Inside a git repository (a `.git` entry or git-directory shape in the workspace
+ * or any ancestor that git accepts, or a repository-locating GIT_* variable) this
+ * is {@link probeWorkspaceTreeFingerprint}, unchanged. A folder that is not a
+ * repository — no `.git` at all, a `.git` that git rejects (git's own "not a git
+ * repository" failure), or no `git` binary (ENOENT; the macOS shim without the
+ * command-line tools is a git failure, so that case fails closed) — is walked
+ * instead; with no `.git` marker `git` is never run — 2.0 workspaces are git-free,
+ * and on a Mac without the command-line tools `/usr/bin/git` opens an install
+ * dialog. A marker check that cannot conclude refuses the turn. Core 2.0.77 used
+ * the git probe for every folder, so every advisory turn outside a repository
+ * failed closed before any agent ran.
+ *
+ * The walk records the root's mode and each entry's relative path, type and mode; for files and
+ * symlinks also size, mtime (rounded to the nearest second) and inode, and a symlink's target.
+ * ctime is left out and mtime is coarse on purpose: in an iCloud-synced folder
+ * the sync client moves ctime and file flags without changing content, and a
+ * file downloaded again because the agent read it comes back with its mtime off
+ * by nanoseconds; without git's content index the walk cannot tell those apart
+ * from edits, so they would fail the turn. The cost is that a same-size in-place
+ * rewrite whose new mtime rounds to the same whole second as the old one (up to
+ * half a second either side of it), or whose mtime is put back, goes unseen; the agents are read-only by their own
+ * invocations, and this check is the backstop. Symlinks are not followed. A
+ * subfolder or entry that cannot be read is recorded with its error code (so
+ * changes inside it go unseen), but a root that cannot be listed fails the
+ * probe. A deadline races the asynchronous work — a stalled `readdir` or `lstat`
+ * cannot hold the turn, though the stalled call itself keeps its libuv worker
+ * until the OS answers — and an entry cap is applied while a folder is read; past
+ * either it is `probe-failed`. The final sort and hash are synchronous and cannot
+ * be interrupted: if they run past the deadline, the result is `probe-failed`
+ * (`timeout`) when they finish, never a late success. The method is part of the value,
+ * so a `.git` that appears during the turn also reads as a change. Never
+ * throws.
+ */
+export declare function probeAdvisoryWorkspaceFingerprint(workspaceRoot: string, options?: {
+    timeoutMs?: number;
+    maxEntries?: number;
+}): Promise<AdvisoryWorkspaceFingerprintProbe>;
 /**
  * Hash the generation inputs (§4.2 conjunct (d)). A `StructuralSummary` is a
  * pure function of `tree content × generation inputs`; this hashes the

package/dist/orchestration-shell/index.d.ts

@@ -28,6 +28,7 @@ import { runShellResumeInShell } from '../session-resume/shell-resume-io';
 import type { ShellResumeOutcome } from '../session-resume/shell-resume';
 import { type RelaunchRequest } from '../session-resume/relaunch';
 export { executeGitStatusSummary } from './git-status-summary';
+export { probeWorkspaceTreeFingerprint } from './context-store';
 import { type ContinuationCliResult, type ContinuationCliDeps } from './slash-routes/continuation';
 import { loadReviewerWizardData } from './slash-routes/reviewers';
 import { createShellEventEmitter } from './emit-shell-event';
@@ -46,6 +47,7 @@ import type { LocalExecutor } from '../local-executor';
 import type { WorkItemInput, DisjointnessRejection, RevertManifestStore } from '../local-executor';
 import type { QuorumLoop } from './quorum-loop';
 import { type InvocationUsageSnapshot } from '../reviewer/token-usage';
+import { buildImplementorArgv } from '../local-executor/implementor-argv';
 import { ensureFreshContextStore } from './context-store';
 import type { EnsureFreshResult } from './context-store';
 import { contextItemOccurrence, type ContextDurabilityReceipt } from './context-items';
@@ -611,7 +613,22 @@ export declare function readOnlyAgentPrompt(args: {
     allowRepositoryTools: boolean;
     hasRetainedPage?: boolean;
 }): string;
+export declare function readOnlyAdvisoryAllowsRepositoryTools(_input: string): boolean;
+export declare function applyReadOnlyAdvisoryToolPolicy(agent: LocalExecutorAgentKind, plan: ReturnType<typeof buildImplementorArgv>, allowRepositoryTools: boolean, workingDir?: string, attachments?: readonly string[]): ReturnType<typeof buildImplementorArgv>;
 export declare const BRAINSTORM_PANEL_ADVISORY_TIMEOUT_MS = 1800000;
+/**
+ * [#637] The Claude CLI reports a usage-limit INSIDE its stdout result envelope
+ * (`{"type":"result","result":"You've reached your usage limit…"}`) — NOT on
+ * stderr (`classifyImplementorQuotaFailure`) and NOT as the `error`/`turn.failed`
+ * JSONL events `classifyFailureFromStdout` reads — so a real Claude quota-wall
+ * used to render the generic 'failed' label. Locate the result envelope
+ * (tolerates pre-envelope warning lines; never throws) and run the SAME closed
+ * usage-limit patterns (`classifyFailureMessage`) against its `result` field.
+ * FAILURE PATH ONLY: the caller invokes this exclusively on the exit!==0 /
+ * empty-output branch, so the parsed answer of a SUCCESSFUL run is never
+ * classified. Only the closed label is ever surfaced, never the raw text.
+ */
+export declare function classifyClaudeResultStdoutQuota(stdout: string): boolean;
 export declare function routeReadOnlyAgentMention(args: {
     store: OrchestrationStore;
     shellArgs: RunOrchestrationShellArgs;
@@ -1271,6 +1288,10 @@ export declare function resetTurnAuthoringStateForTests(): void;
  * on any exit path. Non-throwing (delete on a Map/Set never throws).
  */
 export declare function clearTurnAuthoringSessionState(sessionId: string): void;
+/**
+ * Returns the set of quota-walled agents for the given session.
+ */
+export declare function getBrainstormQuotaWalled(sessionId: string): ReadonlySet<BrainstormPanelActiveAgent>;
 /**
  * M7 (SHARED-CONTEXT-M7-ADDENDUM.md §3.1, DL-2) — `/rule <text>`: pin the text
  * verbatim (capped) as a durable `user_rule` decision with source `explicit`,

package/dist/structural-summary/git-marker.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `present` — `dir` (resolved as git resolves it) or an ancestor holds a `.git` entry, or may itself be a git directory
+ * (`HEAD` plus a `commondir` file or `objects` + `refs`: a bare repository); `absent` — at every level `.git` is
+ * missing and the folder is definitely not a git directory (`HEAD` missing or of another type, or `objects`/`refs`
+ * missing), so git cannot find a repository; `unknown` — the folder could not be resolved, or a level could not be
+ * checked (EACCES, EIO, …), so absence is not proven.
+ */
+export type GitMarkerState = 'present' | 'absent' | 'unknown';
+export declare function gitMarkerState(dir: string): Promise<GitMarkerState>;
+/**
+ * True when the environment can point git at a repository (or at parts of one) whatever the folder holds: `GIT_DIR`,
+ * `GIT_WORK_TREE`, `GIT_OBJECT_DIRECTORY`, `GIT_COMMON_DIR`. Callers then defer to git instead of the marker check.
+ */
+export declare function gitEnvSelectsRepository(): boolean;
+/**
+ * False only when git provably could not find a repository for `dir`: no repository-locating environment variable and
+ * the marker check is `absent`. `unknown` is true, so callers run git and keep exactly the answer they gave before.
+ */
+export declare function gitMayApply(dir: string): Promise<boolean>;

package/dist/substrate/sandbox-exec.d.ts

@@ -111,7 +111,12 @@ extraWriteDirs?: readonly string[],
  * file-authed model call reaches its vendor directly). See
  * {@link SubstrateSpec.networkPosture}.
  */
-networkPosture?: 'loopback' | 'open'): string;
+networkPosture?: 'loopback' | 'open', 
+/**
+ * When false, denies writes to the worktree, establishing a hard read-only boundary (R5-F1).
+ * Default true (writes permitted to workdir).
+ */
+writableWorkdir?: boolean): string;
 /**
  * A5 macOS `sandbox-exec` substrate (`egressFidelity: 'coarse'`). See file
  * header. NOT the default — the LE selects it as the macOS Docker-fallback.

package/dist/substrate/types.d.ts

@@ -134,6 +134,11 @@ export interface SubstrateSpec {
      * construction still compiles (absent → loopback, byte-identical profile).
      */
     networkPosture?: "loopback" | "open";
+    /**
+     * When false, the workdir is mounted/granted read-only (writes to workdir are denied).
+     * Default true (writes permitted to workdir).
+     */
+    writableWorkdir?: boolean;
 }
 /**
  * A structural `ChildProcess` subset. The LE widens its internal child

package/dist/substrate-launch/engage-substrate.d.ts

@@ -41,6 +41,11 @@ export interface EngageSubstrateInput {
      * legacy behavior for every existing caller.
      */
     requireConfined?: boolean;
+    /**
+     * When false, the workdir is mounted/granted read-only (writes to workdir are denied) (R5-F1).
+     * Default true (writes permitted to workdir).
+     */
+    writableWorkdir?: boolean;
     /** F-P46a-4 — the implementor spawn's process-tree id (descendant reaping marker). */
     processTreeId?: string;
     /** Ladder deps (injectable for tests). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.76",
+  "version": "2.0.78",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",