@vibesdotdev/code-sessions 0.0.0-stage → 1.0.0-rc.1

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,166 @@
-# Temporary Holding Version
+# @vibesdotdev/code-sessions
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Runtime-owned client package for code-session management. Public, MIT.
+
+`code-sessions` owns the `runtime/client` descriptor with id `code-sessions`.
+Consumers resolve it with `getVibesClient<CodeSessionsClient>('code-sessions', runtime)`
+and call `list`, `get`, `getOwned`, `create`, `prepare`, `link`, `run`, `push`,
+`createPullRequest`, `delete`, and `getStartOptions`. Persisted session data is
+owned by `apps/platform-web` at `/api/code-sessions`; this package is the
+canonical cross-surface client, not the data store. The hosted transcript run
+bridge and the consumer-to-cloud transcript proxy live in the premium overlay
+`@vibesdotdev/code-sessions-premium`.
+`get` is display-safe only; authorization decisions must use `getOwned`.
+
+## Surfaces
+
+- `code-sessions`: runtime client, API types and response schemas, typed
+  failures (`CapabilityError` code and reason), and the docs descriptor.
+- `@vibesdotdev/code-sessions/svelte`: in-package component surface for session lists, create
+  dialog, cards, transcript command output, SvelteKit list/detail loader
+  helpers, and browser route-action helpers consumed by HQ surfaces.
+- `@vibesdotdev/code-sessions/tui`: in-package Studio TUI inspect route for platform
+  code-session records, capability, host, workspace, checkout, preview, auth,
+  and service recovery state.
+- `agent-execution/src/code-session`: `agent/code-session` execution kind and
+  consumer host implementation.
+- `@vibesdotdev/integrations-cloudflare` `./agent-execution/code-session`:
+  cloud sandbox execution adapter.
+- `apps/platform-web`: owner-scoped session persistence and `/api/code-sessions`
+  HTTP routes.
+- `apps/chat-web`: Build-mode projection that binds a platform code session to
+  `chat_rooms.metadata.buildSession`. Its browser helper calls the app-local
+  `/api/build/sessions` projection route; its server routes use
+  `CodeSessionsClient` to talk to platform-web.
+
+## Request-Scoped Use
+
+Server routes must not mutate the shared runtime client. Resolve the runtime client,
+then fork it for the incoming request:
+
+```ts
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+import type { CodeSessionsClient } from '@vibesdotdev/code-sessions/api';
+
+const base = await getVibesClient<CodeSessionsClient>('code-sessions', event.locals.runtime);
+const client = base.forRequest({
+  origin: await serviceOrigin(event.locals.runtime, 'platform'),
+  token: event.locals.sessionToken,
+  fetch: event.fetch
+});
+```
+
+HTTP options accept callable web fetch, including native fetch, request-scoped SvelteKit fetch and Chat transports. The schema-derived SSR adapter uses the same contract; Bun-specific static methods are not required.
+
+`createSsrCodeSessionsClient(...)` is a convenience wrapper over the same
+public override path for server-only helpers.
+
+## Verification
+
+```bash
+bun run --cwd code-sessions test
+bun run --cwd code-sessions check
+bun run --cwd code-sessions build
+```
+
+For chat-web projection changes, also run the focused Build route tests and
+`apps/chat-web` check.
+
+The real cloud lifecycle probe is intentionally manual because local success
+requires seeded paid entitlement plus either a reachable Sandbox Bridge
+(`SANDBOX_API_URL`) or a real Cloudflare `SANDBOX` binding. Direct Vite can only
+collect blocker evidence; for the real workerd path, start the dedicated PM
+preset first:
+
+```bash
+bun run vibes pm preset start code-session-lifecycle-workerd
+CHAT_E2E_APP_ORIGIN=https://chat.vibes.local \
+CHAT_E2E_AUTH_ORIGIN=https://auth.vibes.local \
+CHAT_E2E_ACCOUNT_ORIGIN=https://account.vibes.local \
+CHAT_E2E_PLATFORM_ORIGIN=https://platform.vibes.local \
+bun run --cwd apps/chat-web probe:code-session:lifecycle --require-workerd-preset --prime-billing
+```
+
+Use `--allow-blocked` when collecting diagnostic evidence on a local stack that
+is expected to be missing the `SANDBOX` binding. Use `--prime-billing` on local
+seeded personas when the account billing fixture has not yet created an active
+plan subscription for that persona. The dev billing fixture must sync account
+plan features and clear the subscription cache; otherwise the probe can fail at
+Build-mode entitlement before it reaches platform session creation.
+Use `--require-workerd-preset` for acceptance evidence so the probe first proves
+the `d1-migrate-dev` task has passed, the dedicated workerd app processes are
+running and healthy, local resources are ready, and no conflicting dev stack
+process is active; omit it only for direct-Vite blocker diagnostics.
+
+The package-level Cloudflare adapter path is covered by the integrations repo
+tests at `integrations/cloudflare/src/agent-execution/code-session/cloudflare/__tests__/`
+(`plugin.test.ts`, `sandbox-git-runner.test.ts`). Those prove adapter behavior
+against a fake bridge, not a live chat/platform lifecycle.
+
+Command execution is owned by platform-web's
+`POST /api/code-sessions/[id]/run` route and surfaced through
+`CodeSessionsClient.run(...)`. Chat-web Build mode binds rooms to sessions; it
+does not own a separate execution endpoint.
+
+Current acceptance gaps are tracked in [SPEC.md](./SPEC.md). Studio now has a
+`/code-sessions` route with runtime-backed create (environment/workspace
+selectors from `getStartOptions()`), list/detail inspect, route-owned
+transcript command-run, and confirmed selected-session delete actions. The
+workerd-stack probe covers chat-web/platform-web create/list/get/run/delete
+plus metadata cleanup from the live session record, and the human Chat Build
+proof covers visible create/bind, Studio inspect, and Chat unbind. The
+remaining route gaps are interactive terminal attach controls plus a Chat
+Build user-visible teardown/delete path; API teardown remains cleanup until
+Chat exposes that control.
+
+## Consumer composition and clock lifecycle
+
+Universal/browser/cloud hosts compose the root `codeSessionsPlugin`. Trusted consumer
+workers compose `codeSessionsConsumerPlugin` from
+`@vibesdotdev/code-sessions/consumer/plugin`; it includes the universal plugin and
+adds the original workspace-binding and catalog implementations. Their kinds,
+descriptors and renderer exposures remain canonical. TUI hosts additionally compose
+`@vibesdotdev/code-sessions/tui/plugin`.
+
+The TUI plugin registers `runtime/client:code-sessions.tui`. Asynchronous state
+`init` resolves the client through `getVibesClient` and awaits `ensureLoaded`;
+synchronous `reduce` and
+`dispose` use `tryGetVibesClient` after activation. The runtime client owns each
+mount's actions and in-flight create deduplication independently. Disposing a
+mount removes its actions and suppresses pending state updates; runtime disposal
+releases all mounts. The implementation remains on the consumer TUI subpath;
+the state descriptor imports only kinds and schemas. Composed-runtime tests
+exercise the real state and clients with external execution and HTTP fixtures.
+
+The registered `runtime/client:code-sessions.clock` owns shared subscriptions and
+one lifecycle interval per runtime. The Svelte `sharedNow()` adapter activates it
+asynchronously before synchronous client access and publishes ticks into reactive
+cells. The final unsubscribe stops the interval; runtime disposal stops it and
+clears subscriptions. SSR starts no effect or timer; SSR and finite runtimes refresh on
+subscription without starting an interval.
+
+Request schemas live in `src/schemas/`; existing type and preparation imports
+remain available. Malformed preparation refuses with `INVALID_INPUT /
+preparation-input-invalid`; other malformed mutations and identifiers refuse with
+`INVALID_INPUT / code-session-request-invalid`, before dispatch or mutation.
+Service assertions refuse with `service-identity-invalid`, retaining
+`service-owner-required` and `service-organization-empty` for blank identities.
+Diagnostics contain no caller values. Existing `workspace-path-requires-local`,
+`local-host-target-required` and `repository-required` refusals remain.
+Service clients refuse `create`, `link`, `run`, `push`, `createPullRequest`,
+`delete`, and standard reads (`list`, `get`, `getOwned`, `getStartOptions`)
+with `INVALID_INPUT / service-client-preparation-only` before local resolution,
+execution, record mutation, or non-prepare HTTP dispatch. Request forks retain
+this restriction. Failures contain no caller values; owner-verified `prepare`
+continues to use fresh service credentials and its existing typed refusals.
+
+Preparation requires a valid `{ result: preparedSession }` response.
+
+`getOwned` consults only the platform: absence (404) and signed-out callers (401)
+return null; typed transport and invalid-response failures propagate. It never
+authorizes from process-local records.
+
+Verification: `bun run check` checks every source and test TS/TSX file and Svelte
+components; `bun run test` uses in-process fixtures; `bun run build` emits production
+core and Svelte artifacts separately. Rules and lint also apply.

package/dist/agent/coordinator.agent.descriptor.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Coordinator — the platform's system-owned decision agent for multi-step work.
+ *
+ * Given what was tried, what failed and why, it decides the next move for each
+ * item and answers in the exact shape the caller asks for.
+ *
+ * A sibling of `developer` (the writing agent): it reads, it never writes. A
+ * run's profile names the model (`agents.execution`); the descriptor inherits
+ * the user's default, as `developer` does, so it runs on consumer and cloud.
+ */
+export declare const coordinatorAgentDescriptor: {
+    id: string;
+    kind: "tools/agent/instance";
+    name: string;
+    description: string;
+    agentType: "custom" | "extraction" | "chat" | "task" | "assistant" | "react";
+    sourceType: "user" | "system";
+    version: string;
+    loopId: string;
+    configuration: {
+        [x: string]: unknown;
+        maxIterations?: number | undefined;
+        temperature?: number | undefined;
+        maxTokens?: number | undefined;
+        streaming?: boolean | undefined;
+        enableThinking?: boolean | undefined;
+        enableToolCalls?: boolean | undefined;
+        persistToolResults?: boolean | undefined;
+        memoryType?: "none" | "summary" | "buffer" | undefined;
+        memorySize?: number | undefined;
+        memoryProfileId?: string | undefined;
+        toolSelectionStrategy?: "user" | "auto" | "specified" | undefined;
+        effort?: "none" | "low" | "medium" | "high" | "max" | "xhigh" | undefined;
+        checkpointEnabled?: boolean | undefined;
+        enableSubagentCalls?: boolean | undefined;
+    };
+    isPublic: boolean;
+    enabled: boolean;
+    capabilityCeiling: "0" | "1" | "3" | "2a" | "2b";
+    systemAgentId?: string | null | undefined;
+    createdById?: string | null | undefined;
+    modelId?: string | null | undefined;
+    fallbacks?: {
+        providerId?: string | undefined;
+        modelId?: string | undefined;
+    }[] | undefined;
+    voice?: {
+        providerId: string;
+        voiceId: string;
+    } | undefined;
+    metadata?: Record<string, import("@vibesdotdev/kernel/bootstrap").JsonValue> | undefined;
+    presentation?: {
+        audiences: ("consumer" | "operator")[];
+    } | undefined;
+    promptId?: string | undefined;
+    promptTemplate?: string | null | undefined;
+    tools?: {
+        source: "custom" | "system";
+        toolId: string;
+        enabled: boolean;
+        order?: number | undefined;
+        hardware?: ("consumer" | "cloud")[] | undefined;
+    }[] | undefined;
+    hardware?: ("consumer" | "cloud")[] | undefined;
+    isDefault?: boolean | undefined;
+    tags?: string[] | undefined;
+};
+export default coordinatorAgentDescriptor;
+//# sourceMappingURL=coordinator.agent.descriptor.d.ts.map

package/dist/agent/coordinator.agent.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.agent.descriptor.d.ts","sourceRoot":"","sources":["../../src/agent/coordinator.agent.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CrC,CAAC;AAEH,eAAe,0BAA0B,CAAC"}

package/dist/agent/coordinator.agent.descriptor.js

@@ -0,0 +1,60 @@
+/**
+ * Coordinator — the platform's system-owned decision agent for multi-step work.
+ *
+ * Given what was tried, what failed and why, it decides the next move for each
+ * item and answers in the exact shape the caller asks for.
+ *
+ * A sibling of `developer` (the writing agent): it reads, it never writes. A
+ * run's profile names the model (`agents.execution`); the descriptor inherits
+ * the user's default, as `developer` does, so it runs on consumer and cloud.
+ */
+import { AIAgentInstanceDescriptorSchema } from '@vibesdotdev/ai-schemas/agents/schemas/descriptor';
+import { AI_AGENT_PRIMARY_LOOP_ID } from '@vibesdotdev/ai-schemas/agents/constants';
+import { coordinatorAgentSystemPrompt } from "./coordinator.system-prompt.js";
+export const coordinatorAgentDescriptor = AIAgentInstanceDescriptorSchema.parse({
+    id: 'coordinator',
+    name: 'Coordinator',
+    description: 'Decides what happens to work that failed: rework with specific learnings, widen what a fix may touch, or escalate. Reads; never edits.',
+    agentType: 'chat',
+    loopId: AI_AGENT_PRIMARY_LOOP_ID,
+    sourceType: 'system',
+    version: '1.0.0',
+    configuration: {
+        temperature: 0.1,
+        streaming: true,
+        enableToolCalls: true,
+        enableThinking: false,
+        memoryType: 'buffer',
+        memorySize: 100,
+        toolSelectionStrategy: 'auto',
+        effort: 'high',
+        checkpointEnabled: true
+    },
+    promptTemplate: coordinatorAgentSystemPrompt,
+    // Read-only: inspection, search, the workspace's own checks and rules; no write, run or forge mutation.
+    tools: [
+        { source: 'system', toolId: 'file-read', enabled: true, order: 1 },
+        { source: 'system', toolId: 'git', enabled: true, order: 2 },
+        { source: 'system', toolId: 'workspace-search', enabled: true, order: 3, hardware: ['consumer'] },
+        { source: 'system', toolId: 'workspace-atlas', enabled: true, order: 4, hardware: ['consumer'] },
+        { source: 'system', toolId: 'workspace-fs', enabled: true, order: 5, hardware: ['consumer'] },
+        { source: 'system', toolId: 'workspace-lsp', enabled: true, order: 6, hardware: ['consumer'] },
+        { source: 'system', toolId: 'workspace-rules', enabled: true, order: 7, hardware: ['consumer'] },
+        { source: 'system', toolId: 'forge-read-file', enabled: true, order: 9 },
+        { source: 'system', toolId: 'forge-pr-get', enabled: true, order: 10 },
+        { source: 'system', toolId: 'forge-pr-files', enabled: true, order: 11 },
+        { source: 'system', toolId: 'docs', enabled: true, order: 12 },
+        { source: 'system', toolId: 'search', enabled: true, order: 13 },
+        { source: 'system', toolId: 'knowledge-search', enabled: true, order: 14 },
+        { source: 'system', toolId: 'reasoning', enabled: true, order: 15 },
+        { source: 'system', toolId: 'tool-help', enabled: true, order: 16 },
+        { source: 'system', toolId: 'tool-search', enabled: true, order: 17 }
+    ],
+    capabilityCeiling: '2b',
+    hardware: ['consumer', 'cloud'],
+    isPublic: true,
+    enabled: true,
+    tags: ['coordinator', 'coordinate', 'planning', 'default']
+});
+export default coordinatorAgentDescriptor;
+//# sourceMappingURL=coordinator.agent.descriptor.js.map

package/dist/agent/coordinator.agent.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.agent.descriptor.js","sourceRoot":"","sources":["../../src/agent/coordinator.agent.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC,KAAK,CAAC;IAC/E,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wIAAwI;IACrJ,SAAS,EAAE,MAAM;IACjB,MAAM,EAAE,wBAAwB;IAChC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;IAChB,aAAa,EAAE;QACd,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,GAAG;QACf,qBAAqB,EAAE,MAAM;QAC7B,MAAM,EAAE,MAAM;QACd,iBAAiB,EAAE,IAAI;KACvB;IACD,cAAc,EAAE,4BAA4B;IAC5C,wGAAwG;IACxG,KAAK,EAAE;QACN,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;QAClE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;QAC5D,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;QACjG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;QAChG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;QAC7F,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;QAC9F,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;QAChG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;QACxE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACtE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACxE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9D,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAChE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1E,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACnE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACnE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;KACrE;IACD,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC;CAC1D,CAAC,CAAC;AAEH,eAAe,0BAA0B,CAAC"}

package/dist/agent/coordinator.prompt.descriptor.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Coordinator agent system prompt, projected onto `prompts/manifest`: the role's
+ * identity and its instructions (how it decides, what it may never instruct).
+ * The native tool loop resolves it by the agent's id.
+ */
+export declare const coordinatorPromptManifest: {
+    id: string;
+    version: string;
+    name: string;
+    description: string;
+    type: "system";
+    category: "development";
+    tags: string[];
+    scope: "builtin";
+    isPublic: boolean;
+    generator: "static";
+    content: string;
+    metadata: {
+        author: string;
+        source: string;
+    };
+};
+export declare const coordinatorPromptManifestDescriptor: {
+    id: string;
+    kind: "prompts/manifest";
+    owner: string;
+    manifest: {
+        id: string;
+        version: string;
+        name: string;
+        description: string;
+        type: "system" | "workflow" | "specialist" | "tool" | "extraction";
+        tags: string[];
+        scope: "user" | "shared" | "builtin" | "project";
+        isPublic: boolean;
+        content: string;
+        generator: "static" | "template" | "dynamic";
+        category?: "custom" | "generation" | "extraction" | "development" | "knowledge" | "chat" | "analysis" | "validation" | undefined;
+        ownerId?: string | undefined;
+        projectId?: string | undefined;
+        sections?: {
+            key: string;
+            title: string;
+            content: string;
+            order: number;
+            collapsible: boolean;
+            conditional?: string | undefined;
+        }[] | undefined;
+        contentPath?: string | undefined;
+        tools?: string[] | undefined;
+        contextRequired?: string[] | undefined;
+        modelConfig?: {
+            model?: string | undefined;
+            temperature?: number | undefined;
+            maxTokens?: number | undefined;
+            topP?: number | undefined;
+            stopSequences?: string[] | undefined;
+        } | undefined;
+        knowledgeBaseIds?: string[] | undefined;
+        dependencies?: string[] | undefined;
+        composedWith?: string[] | undefined;
+        inject?: "tools"[] | undefined;
+        arguments?: {
+            name: string;
+            description: string;
+            type: "string" | "number" | "boolean" | "file" | "select" | "multiselect" | "text" | "json";
+            required: boolean;
+            default?: unknown;
+            options?: {
+                label: string;
+                value: string;
+                description?: string | undefined;
+            }[] | undefined;
+            validation?: string | undefined;
+            placeholder?: string | undefined;
+        }[] | undefined;
+        templateEngine?: "handlebars" | "mustache" | "native" | undefined;
+        transform?: {
+            inputSchema?: Record<string, unknown> | undefined;
+            transformPath?: string | undefined;
+            transformSpread?: {
+                spreadFrom?: ("data" | "user" | "project" | "session")[] | undefined;
+                assigns?: Record<string, {
+                    literal: import("@vibesdotdev/kernel/bootstrap").JsonValue;
+                } | {
+                    path: string;
+                }> | undefined;
+            } | undefined;
+        } | undefined;
+        versions?: {
+            version: string;
+            createdAt: string;
+            changelog?: string | undefined;
+            parentVersion?: string | undefined;
+            author?: string | undefined;
+        }[] | undefined;
+        currentVersion?: {
+            version: string;
+            createdAt: string;
+            changelog?: string | undefined;
+            parentVersion?: string | undefined;
+            author?: string | undefined;
+        } | undefined;
+        metadata?: {
+            author?: string | undefined;
+            license?: string | undefined;
+            source?: string | undefined;
+            related?: string[] | undefined;
+            custom?: Record<string, unknown> | undefined;
+        } | undefined;
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+    };
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    config?: unknown;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+};
+export default coordinatorPromptManifestDescriptor;
+//# sourceMappingURL=coordinator.prompt.descriptor.d.ts.map

package/dist/agent/coordinator.prompt.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.prompt.descriptor.d.ts","sourceRoot":"","sources":["../../src/agent/coordinator.prompt.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAgBrC,CAAC;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAE9C,CAAC;AAEH,eAAe,mCAAmC,CAAC"}

package/dist/agent/coordinator.prompt.descriptor.js

@@ -0,0 +1,29 @@
+/**
+ * Coordinator agent system prompt, projected onto `prompts/manifest`: the role's
+ * identity and its instructions (how it decides, what it may never instruct).
+ * The native tool loop resolves it by the agent's id.
+ */
+import { definePromptManifestDescriptor } from '@vibesdotdev/ai-schemas';
+import { coordinatorAgentSystemPrompt } from "./coordinator.system-prompt.js";
+export const coordinatorPromptManifest = {
+    id: 'coordinator',
+    version: '1.1.0',
+    name: 'Coordinator Agent',
+    description: 'System prompt for the read-only coordinator: how it decides rework, scope or escalation, and what it may never instruct',
+    type: 'system',
+    category: 'development',
+    tags: ['coordinator', 'coordinate', 'agent', 'system'],
+    scope: 'builtin',
+    isPublic: false,
+    generator: 'static',
+    content: coordinatorAgentSystemPrompt,
+    metadata: {
+        author: 'vibes',
+        source: 'code-sessions/src/agent/coordinator.system-prompt.ts'
+    }
+};
+export const coordinatorPromptManifestDescriptor = definePromptManifestDescriptor(coordinatorPromptManifest, {
+    owner: 'code-sessions'
+});
+export default coordinatorPromptManifestDescriptor;
+//# sourceMappingURL=coordinator.prompt.descriptor.js.map

package/dist/agent/coordinator.prompt.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.prompt.descriptor.js","sourceRoot":"","sources":["../../src/agent/coordinator.prompt.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,EAAE,EAAE,aAAa;IACjB,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,yHAAyH;IACtI,IAAI,EAAE,QAAiB;IACvB,QAAQ,EAAE,aAAsB;IAChC,IAAI,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC;IACtD,KAAK,EAAE,SAAkB;IACzB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,QAAiB;IAC5B,OAAO,EAAE,4BAA4B;IACrC,QAAQ,EAAE;QACT,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,sDAAsD;KAC9D;CACD,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,8BAA8B,CAAC,yBAAyB,EAAE;IAC5G,KAAK,EAAE,eAAe;CACtB,CAAC,CAAC;AAEH,eAAe,mCAAmC,CAAC"}

package/dist/agent/coordinator.system-prompt.d.ts

@@ -0,0 +1,3 @@
+/** The coordinator agent's system prompt: decides the next move for failed work, read-only. */
+export declare const coordinatorAgentSystemPrompt = "You are Coordinator, the decision maker for multi-step work inside a Vibes workspace.\n\nYou receive work items that failed or need a decision: what was attempted, by whom, what the checks and reviewers found, and what is allowed. You decide the next move for each one. You read; you never edit files or change state.\n\nCheck results and failures are information for you, not a stop: a participant can get things wrong, and finding it and routing it is your job.\n\nHow to decide:\n- Rework when a specific, actionable learning would let the next attempt succeed. Write the learning as an instruction the next participant can follow: what to change, where, and why the last attempt failed.\n- Propose additional paths only when evidence locates the cause there. Record their owner and required approval/custody; an allow list is scope, not permission to overwrite another participant\u2019s work.\n- Escalate when the same failure repeats without new information, when the fix needs a decision a participant cannot make, or when the cause is outside this work's scope. When the instructions or the definition of correct missed something, say what they should add.\n- For leftover changes, establish who made them and what work they belong to. Decide whether an authorized writer should clear, adopt and recheck, or rework them; name the exact paths and evidence in the rework instruction, or escalate missing authority. You remain read-only; never restore files yourself.\n- Use the evidence you were given and read the code to confirm it (workspace-search, file-read, git); do not guess.\n- Never instruct or accept removing a capability or feature unless the evidence shows it exists in a more canonical or more effective form elsewhere; otherwise rework to restore it, or escalate.\n- Never instruct anyone to weaken a check, skip a test, suppress a rule, hide a failure, or add a check fitted to one case.\n\nAnswer with only the exact shape the request asks for (for example a JSON array or object), with no prose around it.";
+//# sourceMappingURL=coordinator.system-prompt.d.ts.map

package/dist/agent/coordinator.system-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.system-prompt.d.ts","sourceRoot":"","sources":["../../src/agent/coordinator.system-prompt.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,eAAO,MAAM,4BAA4B,m/DAe4E,CAAC"}

package/dist/agent/coordinator.system-prompt.js

@@ -0,0 +1,18 @@
+/** The coordinator agent's system prompt: decides the next move for failed work, read-only. */
+export const coordinatorAgentSystemPrompt = `You are Coordinator, the decision maker for multi-step work inside a Vibes workspace.
+
+You receive work items that failed or need a decision: what was attempted, by whom, what the checks and reviewers found, and what is allowed. You decide the next move for each one. You read; you never edit files or change state.
+
+Check results and failures are information for you, not a stop: a participant can get things wrong, and finding it and routing it is your job.
+
+How to decide:
+- Rework when a specific, actionable learning would let the next attempt succeed. Write the learning as an instruction the next participant can follow: what to change, where, and why the last attempt failed.
+- Propose additional paths only when evidence locates the cause there. Record their owner and required approval/custody; an allow list is scope, not permission to overwrite another participant’s work.
+- Escalate when the same failure repeats without new information, when the fix needs a decision a participant cannot make, or when the cause is outside this work's scope. When the instructions or the definition of correct missed something, say what they should add.
+- For leftover changes, establish who made them and what work they belong to. Decide whether an authorized writer should clear, adopt and recheck, or rework them; name the exact paths and evidence in the rework instruction, or escalate missing authority. You remain read-only; never restore files yourself.
+- Use the evidence you were given and read the code to confirm it (workspace-search, file-read, git); do not guess.
+- Never instruct or accept removing a capability or feature unless the evidence shows it exists in a more canonical or more effective form elsewhere; otherwise rework to restore it, or escalate.
+- Never instruct anyone to weaken a check, skip a test, suppress a rule, hide a failure, or add a check fitted to one case.
+
+Answer with only the exact shape the request asks for (for example a JSON array or object), with no prose around it.`;
+//# sourceMappingURL=coordinator.system-prompt.js.map

package/dist/agent/coordinator.system-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.system-prompt.js","sourceRoot":"","sources":["../../src/agent/coordinator.system-prompt.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;qHAeyE,CAAC"}

package/dist/agent/developer.agent.descriptor.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Developer — the platform's system-owned coding agent.
+ *
+ * The agent a person gets when they open Code mode and do not pick anyone. Until
+ * now that list offered a general chat agent, a customer's own org assistant, and
+ * the onboarding concierge — nobody whose job is writing code. Marshal is the
+ * shape this follows (a runtime-discovered, system-owned, public Chat agent whose
+ * identity lives on the descriptor so every surface behaves the same); the job is
+ * different.
+ *
+ * It lives in `code-sessions` because that package owns the code-session product
+ * surface. An agent whose whole purpose is to work inside a session belongs with
+ * the feature that owns sessions, the way Marshal belongs with `workboard` and
+ * Druid with `druid`.
+ */
+export declare const developerAgentDescriptor: {
+    id: string;
+    kind: "tools/agent/instance";
+    name: string;
+    description: string;
+    agentType: "custom" | "extraction" | "chat" | "task" | "assistant" | "react";
+    sourceType: "user" | "system";
+    version: string;
+    loopId: string;
+    configuration: {
+        [x: string]: unknown;
+        maxIterations?: number | undefined;
+        temperature?: number | undefined;
+        maxTokens?: number | undefined;
+        streaming?: boolean | undefined;
+        enableThinking?: boolean | undefined;
+        enableToolCalls?: boolean | undefined;
+        persistToolResults?: boolean | undefined;
+        memoryType?: "none" | "summary" | "buffer" | undefined;
+        memorySize?: number | undefined;
+        memoryProfileId?: string | undefined;
+        toolSelectionStrategy?: "user" | "auto" | "specified" | undefined;
+        effort?: "none" | "low" | "medium" | "high" | "max" | "xhigh" | undefined;
+        checkpointEnabled?: boolean | undefined;
+        enableSubagentCalls?: boolean | undefined;
+    };
+    isPublic: boolean;
+    enabled: boolean;
+    capabilityCeiling: "0" | "1" | "3" | "2a" | "2b";
+    systemAgentId?: string | null | undefined;
+    createdById?: string | null | undefined;
+    modelId?: string | null | undefined;
+    fallbacks?: {
+        providerId?: string | undefined;
+        modelId?: string | undefined;
+    }[] | undefined;
+    voice?: {
+        providerId: string;
+        voiceId: string;
+    } | undefined;
+    metadata?: Record<string, import("@vibesdotdev/kernel/bootstrap").JsonValue> | undefined;
+    presentation?: {
+        audiences: ("consumer" | "operator")[];
+    } | undefined;
+    promptId?: string | undefined;
+    promptTemplate?: string | null | undefined;
+    tools?: {
+        source: "custom" | "system";
+        toolId: string;
+        enabled: boolean;
+        order?: number | undefined;
+        hardware?: ("consumer" | "cloud")[] | undefined;
+    }[] | undefined;
+    hardware?: ("consumer" | "cloud")[] | undefined;
+    isDefault?: boolean | undefined;
+    tags?: string[] | undefined;
+};
+export default developerAgentDescriptor;
+//# sourceMappingURL=developer.agent.descriptor.d.ts.map

package/dist/agent/developer.agent.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer.agent.descriptor.d.ts","sourceRoot":"","sources":["../../src/agent/developer.agent.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4HnC,CAAC;AAEH,eAAe,wBAAwB,CAAC"}