@quantiya/codevibe-core 2.0.92 → 2.0.93

package/dist/substrate-launch/fallback-ladder.d.ts

@@ -1,12 +1,14 @@
 import type { DockerSubstrateDeps } from "../substrate/docker";
+import type { BubblewrapDeps } from "../substrate/bwrap";
 import type { SandboxExecDeps } from "../substrate/sandbox-exec";
 import type { CommandRunner, Substrate } from "../substrate/types";
-/** Which rung of the §6 Q2 ladder was selected. */
-export type SubstrateTier = "docker" | "sandbox_exec" | "reduced_trust";
+import { resolveSpawnSweepHelper } from "../local-executor/spawn-sweep-binary";
+/** Which rung of the ladder was selected. */
+export type SubstrateTier = "docker" | "sandbox_exec" | "bubblewrap" | "reduced_trust";
 /**
- * The ladder's result. A `substrate` is present for the two real tiers; the
- * `reduced_trust` tier has `substrate: null` (the LE takes the legacy path +
- * the prominent badge).
+ * The ladder's result. A `substrate` is present for the real tiers; the `reduced_trust` tier has `substrate: null` —
+ * no confinement is possible for this spawn on this host, which WORKSPACE-HARDENING-DESIGN §6.4 turns into a refusal
+ * (or a one-time opt-in), never a silent unconfined run.
  */
 export type SubstrateSelection = {
     tier: "docker";
@@ -19,16 +21,33 @@ export type SubstrateSelection = {
     /** Coarse egress (loopback-only) — reduced-trust BADGE per §3.1. */
     reducedTrust: true;
     reducedTrustReason: string;
+} | {
+    tier: "bubblewrap";
+    substrate: Substrate;
+    /** §6.2: the broker tier (no network) is strict; the pasta tier (open egress) is coarse. */
+    reducedTrust: boolean;
+    reducedTrustReason?: string;
+    /** §6.2: `loopback` = the broker tier (fd-3 relay); `open` = the pasta tier. */
+    networkPosture: "loopback" | "open";
 } | {
     tier: "reduced_trust";
     substrate: null;
-    /** No substrate — the moat is OFF this session (legacy path). */
+    /** No substrate — the moat is OFF (§6.4: refuse, or run only with the user's opt-in). */
     reducedTrust: true;
     reducedTrustReason: string;
 };
+/**
+ * WORKSPACE-HARDENING-DESIGN §6.2 "Tier order on Linux" — what the spawn is, because the Linux tier depends on it:
+ * Claude/Codex → Docker when `docker version` succeeds, else the bubblewrap tier; agy → the bubblewrap tier under
+ * pasta; reviewer seats → the bubblewrap tier (§8.2, never Docker); anything else → §6.4.
+ */
+export interface LadderRequest {
+    agent: "CLAUDE" | "CODEX" | "ANTIGRAVITY" | "GEMINI";
+    role: "implementor" | "reviewer";
+}
 /** Injectable deps for the ladder (so it is testable without a real daemon). */
 export interface FallbackLadderDeps {
-    /** Process layer for the `docker version` probe (default real). */
+    /** Process layer for the `docker version` / bubblewrap probes (default real). */
     runner?: CommandRunner;
     /** Platform override (default `process.platform`). */
     platform?: NodeJS.Platform;
@@ -36,14 +55,92 @@ export interface FallbackLadderDeps {
     dockerDeps?: DockerSubstrateDeps;
     /** Deps forwarded to the chosen SandboxExecSubstrate. */
     sandboxExecDeps?: SandboxExecDeps;
+    /** Deps forwarded to the chosen BubblewrapSubstrate. */
+    bubblewrapDeps?: BubblewrapDeps;
     /** Substrate factory overrides (tests inject stubs). */
     makeDocker?: (deps?: DockerSubstrateDeps) => Substrate;
     makeSandboxExec?: (deps?: SandboxExecDeps) => Substrate;
+    makeBubblewrap?: (deps?: BubblewrapDeps) => Substrate;
+    /** §6.5 probe override (tests); default {@link probeBubblewrapTier}, once per session. */
+    probeBubblewrap?: (runner: CommandRunner) => Promise<BubblewrapAvailability>;
+}
+/**
+ * §6.5 session-start checks for the bubblewrap tier. `broker` = what both tiers need (bubblewrap ≥ 0.9, a user
+ * namespace it can actually create, `setpriv`, `bash`, the shipped spawn-sweep helper answering `--selftest`); `open`
+ * = the broker tier's needs plus `pasta` running. A failed check names itself, so the §6.4 message can say how to
+ * fix it.
+ */
+export interface BubblewrapAvailability {
+    broker: {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    };
+    open: {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    };
+}
+export interface ProbeBubblewrapDeps {
+    /** The packaged sweep helper (default `resolveSpawnSweepHelper`; tests inject it). */
+    resolveHelper?: typeof resolveSpawnSweepHelper;
+    /** §6.2 isolation self-check (default: the cached real check). */
+    checkIsolation?: (runner: CommandRunner) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
 }
 /**
- * Resolve the §6 Q2 ladder. Returns the chosen substrate + tier, or the
- * reduced-trust sentinel. NEVER throws for "no substrate available" — that is a
- * VALID (reduced-trust) outcome the LE surfaces with a badge; it throws only on
- * a programming error.
+ * §6.2 — the isolation self-check, cached beside the tier checks in `~/.codevibe/substrate-checks/` by the pasta
+ * binary's SHA-256 and the host's IPv6 state (stable fields). A cached failure stays a failure until either changes.
+ */
+export declare function cachedIsolationCheck(runner: CommandRunner, cacheDir?: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export declare function probeBubblewrapTier(runner: CommandRunner, deps?: ProbeBubblewrapDeps): Promise<BubblewrapAvailability>;
+/** @internal tests */
+export declare function _resetBubblewrapProbeForTests(): void;
+/**
+ * Resolve the ladder for one spawn. Returns the chosen substrate + tier, or the reduced-trust sentinel with the reason
+ * no confinement is possible (§6.4). NEVER throws for "no substrate available"; it throws only on a programming error.
+ */
+export declare function selectSubstrate(deps?: FallbackLadderDeps, request?: LadderRequest): Promise<SubstrateSelection>;
+/** §6.1 A-WEB (Hendry 2026-10-31): why a web-browsing turn cannot be confined — shared by the preflight and the engage. */
+export declare function webTurnUnconfinableReason(agent: string): string;
+/**
+ * WORKSPACE-HARDENING-DESIGN §6.4 — can an implementor of this agent be confined on this machine? Asked before a task
+ * starts: a task whose agent cannot be confined does not start, and the user is told why and offered to run it
+ * unconfined this once. The same rules as the spawn-time engage: a web-browsing turn cannot be confined (§6.1 A-WEB),
+ * Gemini is refused (§6.3), and otherwise the ladder decides (on Linux after the §6.5 session-start checks).
+ */
+export declare function confinementPreflight(input: {
+    agentKind: LadderRequest["agent"];
+    webTurn: boolean;
+}, deps?: FallbackLadderDeps): Promise<{
+    confinable: true;
+    tier: "docker" | "sandbox_exec" | "bubblewrap";
+} | {
+    confinable: false;
+    reason: string;
+}>;
+/**
+ * §6.4 — the Linux bubblewrap tier's parts of the tier self-test cache key: the seccomp program's SHA-256 (it reaches
+ * bubblewrap through a file descriptor, so it is not in the argv), `bwrap --version`, the resolved `setpriv` and `bash`
+ * paths (both tiers start under the `setpriv` prefix and end in the `bash` step), and for an open-egress mode the
+ * pasta binary's SHA-256.
  */
-export declare function selectSubstrate(deps?: FallbackLadderDeps): Promise<SubstrateSelection>;
+export declare function linuxTierSelfTestKeyParts(open: boolean, runner?: CommandRunner): Promise<{
+    filterSha256: string;
+    bwrapVersion: string;
+    setprivPath: string;
+    bashPath: string;
+    pastaSha256?: string;
+}>;

package/dist/substrate-launch/index.d.ts

@@ -1,6 +1,6 @@
 export { engageSubstrate, providerForAgent, } from "./engage-substrate";
 export type { EngageSubstrateInput, EngageResult, SubstrateEngaged, ReducedTrustEngaged, } from "./engage-substrate";
-export { selectSubstrate } from "./fallback-ladder";
+export { confinementPreflight, linuxTierSelfTestKeyParts, selectSubstrate } from "./fallback-ladder";
 export type { SubstrateSelection, SubstrateTier, FallbackLadderDeps, } from "./fallback-ladder";
 export { buildSanitizedBaseEnv, assertNoAmbientCreds, SAFE_ENV_ALLOWLIST, SANDBOX_DEFAULT_PATH, } from "./sanitized-env";
 export type { SanitizedEnvInput } from "./sanitized-env";

package/dist/substrate-launch/task-folder.d.ts

@@ -0,0 +1,26 @@
+/** S2-C7: record the copy location the desktop resolved for this session (null clears it, and every task record). */
+export declare function setSessionCopyRoot(root: string | null): void;
+/** R2-F4: the start tried and could not resolve the session copy location — nothing falls back to the raw cache path. */
+export declare function markSessionCopyRootUnresolved(reason: string): void;
+/**
+ * R2-F4: `WorkspaceShadow.create` chose `root` for `taskId`'s copy — that task's folders live there. A session whose
+ * start could not resolve its location takes this one too.
+ */
+export declare function recordTaskCopyRoot(taskId: string, root: string): void;
+/** S2-C7: the copy location every per-task, per-spawn and advisory folder of this session lives in. */
+export declare function sessionCopyRoot(opts?: {
+    platform?: NodeJS.Platform;
+    homedir?: string;
+    xdgCacheHome?: string | undefined;
+}): string;
+export declare function taskFolderFor(taskId: string, opts?: {
+    platform?: NodeJS.Platform;
+    homedir?: string;
+    xdgCacheHome?: string | undefined;
+}): string;
+/** §8.1–§8.2: a review round's bundle (read-only to seats) and one private scratch folder per seat — siblings. */
+export declare function reviewRoundFolders(taskFolder: string, gateId: string): {
+    round: string;
+    bundle: string;
+    seat: (n: number) => string;
+};

package/native/spawn-sweep.json

@@ -0,0 +1,8 @@
+{
+  "version": 1,
+  "coreRsSha": "d5841f2aec361083229dfd057cc4342e1f8eb1b6",
+  "targets": {
+    "linux-x64": { "sha256": "a3c90e8cc484ea99c2ed086aba5ed41b6ff6bda98cc14c4f05fad5f3a617c927", "versionId": "u2Yf4Fgxj9dDLGWVFSmkse9xHccG4.Cx" },
+    "linux-arm64": { "sha256": "a6cb98fa7d448fe6e5f78dfa0d5fde8e473191478c87deb9d2b58061110fc9ca", "versionId": "66SZgqKY6pLImVzc3j31ITtIft2UJkGf" }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.92",
+  "version": "2.0.93",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,19 +12,24 @@
     "dist/index.js",
     "dist/orchestration-shell/cli.js",
     "dist/orchestration-shell/web-extract-worker.js",
-    "bin"
+    "bin",
+    "dist/substrate/tier-relay.js",
+    "native/spawn-sweep.json",
+    "native/linux-x64/codevibe-spawn-sweep",
+    "native/linux-arm64/codevibe-spawn-sweep"
   ],
   "scripts": {
     "typecheck": "tsc --noEmit",
     "emit-types": "tsc -p tsconfig.types.json --emitDeclarationOnly",
-    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --minify-syntax --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && esbuild src/orchestration-shell/web/web-extract-worker.ts --bundle --platform=node --target=node18 --minify --packages=external --outfile=dist/orchestration-shell/web-extract-worker.js && npm run verify-no-test-hooks && npm run verify-no-test-types",
-    "verify-no-test-hooks": "if grep -ERl 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT|CODEVIBE_ANCHORED_PUBLICATION_AUTHORITY_ROOT|codevibe-anchored-publications-|cv-publication-authority-vitest-|codevibe\\.test\\.publication-authority-|setPublicationAuthorityRootForTestBuild|__CODEVIBE_TEST_BUILD__|_onBeforeLinkForTesting|_onBeforeSummariesLockForTesting|__codevibe_test_on_before_link|__codevibe_test_on_before_summaries_lock|simulatePostPublicationError' dist; then echo 'ERROR: a test-only hook leaked into a published artifact (prod-unreachability invariant)'; exit 1; fi; echo 'OK \u2014 no test-only hooks in published artifacts'",
+    "build": "rm -rf dist && npm run emit-types && esbuild src/index.ts --bundle --platform=node --target=node18 --minify --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/index.js && esbuild src/orchestration-shell/cli.ts --bundle --platform=node --target=node18 --minify-syntax --packages=external --define:__CODEVIBE_TEST_BUILD__=false --outfile=dist/orchestration-shell/cli.js --banner:js=\"#!/usr/bin/env node\" && esbuild src/orchestration-shell/web/web-extract-worker.ts --bundle --platform=node --target=node18 --minify --packages=external --outfile=dist/orchestration-shell/web-extract-worker.js && esbuild src/substrate/tier-relay-main.ts --bundle --platform=node --target=node18 --minify --outfile=dist/substrate/tier-relay.js && npm run verify-no-test-hooks && npm run verify-no-test-types",
+    "verify-no-test-hooks": "if grep -ERl 'CODEVIBE_TEST_FORCE_QUOTA_FAIL|CODEVIBE_TEST_FORCE_IMPLEMENTOR_AGENT|CODEVIBE_ANCHORED_PUBLICATION_AUTHORITY_ROOT|codevibe-anchored-publications-|cv-publication-authority-vitest-|codevibe\\.test\\.publication-authority-|setPublicationAuthorityRootForTestBuild|__CODEVIBE_TEST_BUILD__|_onBeforeLinkForTesting|_onBeforeSummariesLockForTesting|__codevibe_test_on_before_link|__codevibe_test_on_before_summaries_lock|simulatePostPublicationError' dist; then echo 'ERROR: a test-only hook leaked into a published artifact (prod-unreachability invariant)'; exit 1; fi; echo 'OK — no test-only hooks in published artifacts'",
     "verify-no-test-types": "if find dist -type f \\( -path '*/__tests__/*' -o -name '*.test.d.ts' -o -name 'test-publication-authority-setup.d.ts' \\) | grep -q .; then echo 'verify-no-test-types: test declarations present in dist (tsconfig.types.json must exclude test sources)' >&2; exit 1; fi",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run build",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:live": "QUORUM_LIVE_SMOKE=1 vitest run"
+    "test:live": "QUORUM_LIVE_SMOKE=1 vitest run",
+    "prepack": "node scripts/stage-spawn-sweep.mjs --s3"
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",