@claudexor/control-api 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 joi-lab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,7 @@
+# @claudexor/control-api
+
+Internal package of [Claudexor](https://github.com/razzant/claudexor) — Loopback HTTP+SSE control surface for GUI/service clients: token-auth, Host/Origin guard, live run event stream with Last-Event-ID replay. Runner injected (no second scheduler).
+
+Published as part of the Claudexor toolchain; it follows the monorepo's
+lockstep version and has no separate semver contract. Use the `claudexor`
+CLI (or `@claudexor/cli`) as the supported entry point.

package/dist/artifact-paths.d.ts

@@ -0,0 +1,3 @@
+export declare function safeArtifactPath(root: string, requested: string): string | null;
+export declare function safeArtifactRoot(root: string): string | null;
+//# sourceMappingURL=artifact-paths.d.ts.map

package/dist/artifact-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-paths.d.ts","sourceRoot":"","sources":["../src/artifact-paths.ts"],"names":[],"mappings":"AASA,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa/E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D"}

package/dist/artifact-paths.js

@@ -0,0 +1,36 @@
+/**
+ * Path-confinement guards for run-artifact reads: every artifact fetch must
+ * resolve INSIDE the run/artifact root, symlinks are refused (a symlinked
+ * artifact could read arbitrary host files into an HTTP response), and `..`
+ * traversal is structurally impossible.
+ */
+import { existsSync, lstatSync, realpathSync } from "node:fs";
+import { normalize, resolve, sep } from "node:path";
+export function safeArtifactPath(root, requested) {
+    if (requested.includes("\0"))
+        return null;
+    const parts = requested.split(/[\\/]+/).filter(Boolean);
+    if (parts.includes(".."))
+        return null;
+    const base = safeArtifactRoot(root);
+    if (!base)
+        return null;
+    const clean = normalize(parts.join(sep));
+    const abs = resolve(base, clean);
+    if (!existsSync(abs))
+        return null;
+    const lst = lstatSync(abs);
+    if (lst.isSymbolicLink())
+        return null;
+    const real = realpathSync(abs);
+    return real === base || real.startsWith(base + sep) ? real : null;
+}
+export function safeArtifactRoot(root) {
+    if (!root || !existsSync(root))
+        return null;
+    const st = lstatSync(root);
+    if (st.isSymbolicLink() || !st.isDirectory())
+        return null;
+    return realpathSync(root);
+}
+//# sourceMappingURL=artifact-paths.js.map

package/dist/artifact-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-paths.js","sourceRoot":"","sources":["../src/artifact-paths.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAiB;IAC9D,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,cAAc,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/candidates.d.ts

@@ -0,0 +1,3 @@
+import { ControlCandidate, type DecisionRecord } from "@claudexor/schema";
+export declare function candidatesFor(runDir: string, decision: DecisionRecord | null): ControlCandidate[];
+//# sourceMappingURL=candidates.d.ts.map

package/dist/candidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidates.d.ts","sourceRoot":"","sources":["../src/candidates.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAA6B,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAkBrG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,gBAAgB,EAAE,CA2CjG"}

package/dist/candidates.js

@@ -0,0 +1,77 @@
+/**
+ * Candidate-card projection: attempts/<id>/attempt.yaml +
+ * reviews/<id>.yaml + the decision winner -> ControlCandidate[]. Pure
+ * artifact reads — the engine wrote the evidence; this only projects it.
+ */
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { ControlCandidate, ReviewFinding, isBlocking } from "@claudexor/schema";
+export function candidatesFor(runDir, decision) {
+    const attemptsDir = join(runDir, "attempts");
+    if (!existsSync(attemptsDir))
+        return [];
+    const out = [];
+    for (const attemptId of safeReaddir(attemptsDir)) {
+        const raw = readYamlMaybe(join(attemptsDir, attemptId, "attempt.yaml"));
+        if (!raw || typeof raw.attempt_id !== "string" || typeof raw.harness_id !== "string")
+            continue;
+        const review = readYamlMaybe(join(runDir, "reviews", `${attemptId}.yaml`));
+        const rawFindings = Array.isArray(review?.findings) ? review.findings : [];
+        // Blocking is the SCHEMA's judgment (isBlocking: accepted
+        // BLOCK/FIX_FIRST with evidence, or NEEDS_HUMAN) — never a projection-
+        // local severity list that can drift from the contract.
+        const blockers = rawFindings.filter((f) => {
+            const parsed = ReviewFinding.safeParse(f);
+            return parsed.success && isBlocking(parsed.data);
+        }).length;
+        const gates = Array.isArray(raw.gates) ? raw.gates : [];
+        const parsed = ControlCandidate.safeParse({
+            attemptId: raw.attempt_id,
+            harnessId: raw.harness_id,
+            label: typeof raw.label === "string" ? raw.label : null,
+            costUsd: typeof raw.cost_usd === "number" ? raw.cost_usd : 0,
+            costEstimated: raw.cost_estimated === true,
+            errored: raw.errored === true,
+            gatesPassed: gates.filter((g) => g.status === "passed").length,
+            gatesTotal: gates.length,
+            blockers,
+            reviewVerified: review?.review_verified === true,
+            finalReviewClean: review ? blockers === 0 : null,
+            winner: decision?.winner === raw.attempt_id,
+            diffstat: raw.diffstat && typeof raw.diffstat === "object"
+                ? {
+                    files: numberOr(raw.diffstat.files, 0),
+                    additions: numberOr(raw.diffstat.additions, 0),
+                    deletions: numberOr(raw.diffstat.deletions, 0),
+                }
+                : null,
+        });
+        if (parsed.success)
+            out.push(parsed.data);
+    }
+    // Stable order: labels (A, B, ...) then attempt ids — matches race lanes.
+    return out.sort((a, b) => (a.label ?? a.attemptId).localeCompare(b.label ?? b.attemptId));
+}
+function numberOr(v, fallback) {
+    return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : fallback;
+}
+function readYamlMaybe(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        return (parseYaml(readFileSync(path, "utf8")) ?? null);
+    }
+    catch {
+        return null;
+    }
+}
+function safeReaddir(dir) {
+    try {
+        return readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=candidates.js.map

package/dist/candidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidates.js","sourceRoot":"","sources":["../src/candidates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,EAAuB,MAAM,mBAAmB,CAAC;AAkBrG,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAA+B;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,aAAa,CAAa,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;YAAE,SAAS;QAC/F,MAAM,MAAM,GAAG,aAAa,CAAY,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,0DAA0D;QAC1D,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC,MAAM,CAAC;QACV,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,KAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC;YACxC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YACvD,OAAO,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5D,aAAa,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI;YAC1C,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI;YAC7B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC9D,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,QAAQ;YACR,cAAc,EAAE,MAAM,EAAE,eAAe,KAAK,IAAI;YAChD,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YAChD,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC,UAAU;YAC3C,QAAQ,EACN,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAC9C,CAAC,CAAC;oBACE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;oBACtC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;oBAC9C,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;iBAC/C;gBACH,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,0EAA0E;IAC1E,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,QAAgB;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAI,IAAY;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAa,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/daemon-server.d.ts

@@ -0,0 +1,196 @@
+export { normalizeRunStartRequest } from "./run-start.js";
+import { AttachmentInput, type ControlPendingInteraction } from "@claudexor/schema";
+export interface DaemonRunRecord {
+    id: string;
+    state: string;
+    runId?: string;
+    taskId?: string;
+    runDir?: string;
+    error?: string;
+    params?: unknown;
+    createdAt?: string;
+    startedAt?: string;
+    finishedAt?: string;
+}
+export interface DaemonFacadeClient {
+    enqueue(params: unknown): Promise<{
+        id: string;
+        state: string;
+    }>;
+    status(id: string): Promise<DaemonRunRecord>;
+    list(): Promise<DaemonRunRecord[]>;
+    cancel(id: string): Promise<unknown>;
+}
+export interface DaemonControlApiOptions {
+    token: string;
+    daemon: DaemonFacadeClient;
+    host?: string;
+    port?: number;
+    pollMs?: number;
+    /** SSE comment-ping cadence so quiet phases are distinguishable from dead connections. */
+    heartbeatMs?: number;
+    runStartTimeoutMs?: number;
+    /**
+     * In-process run-event push source (the daemon's RunEventBus). The events
+     * FILE stays the canonical ordered log: a push only pokes the tailer so SSE
+     * latency drops from poll cadence to immediate, with the poll as fallback.
+     */
+    bus?: {
+        subscribe(listener: (event: {
+            run_id: string;
+        }) => void): () => void;
+    };
+    services?: {
+        harnesses?: () => Promise<unknown>;
+        /** Derived AgentCapabilityCatalog (GET /agent-capabilities). */
+        agentCapabilities?: () => Promise<unknown>;
+        /** Enumerable models for one harness (ADP4); thin projection over the adapter's optional models(). */
+        harnessModels?: (input: {
+            harnessId: string;
+        }) => Promise<unknown>;
+        createSetupJob?: (input: unknown) => Promise<unknown>;
+        listSetupJobs?: () => Promise<unknown>;
+        setupJobStatus?: (input: unknown) => Promise<unknown>;
+        cancelSetupJob?: (input: unknown) => Promise<unknown>;
+        confirmSetupJob?: (input: unknown) => Promise<unknown>;
+        settings?: () => Promise<unknown>;
+        updateSettings?: (patch: unknown) => Promise<unknown>;
+        listSecrets?: () => Promise<unknown>;
+        setSecret?: (input: unknown) => Promise<unknown>;
+        deleteSecret?: (name: string) => Promise<unknown>;
+        specQuestions?: (input: unknown) => Promise<unknown>;
+        specFreeze?: (input: unknown) => Promise<unknown>;
+        /** Live waiting_on_user state (daemon InteractionRegistry projections). */
+        pendingInteractions?: (runId: string) => ControlPendingInteraction[];
+        answerInteraction?: (runId: string, interactionId: string, answers: unknown) => {
+            status: string;
+            message?: string;
+        };
+        /** Thread/session SSOT (chat/session-first). */
+        createThread?: (input: unknown) => Promise<unknown>;
+        listThreads?: () => Promise<{
+            threads: unknown[];
+        }>;
+        threadDetail?: (id: string) => Promise<{
+            thread: unknown;
+            sessions: unknown[];
+            turns: unknown[];
+        }>;
+        /** Single-writer turn creation (run_id bound later by the daemon runner). */
+        createThreadTurn?: (id: string, prompt: string, opts: {
+            kind?: unknown;
+            parentRunId?: string | null;
+            planRunId?: string | null;
+            attachments?: AttachmentInput[];
+        }) => Promise<unknown>;
+        /** Rename / archive a thread or switch its sticky primary/pool. */
+        updateThread?: (id: string, patch: {
+            title?: string;
+            state?: string;
+            primaryHarness?: string | null;
+            eligibleHarnesses?: string[];
+        }) => Promise<unknown>;
+        /** Deliver an isolated thread's accumulated worktree diff to the project. */
+        applyThread?: (id: string, opts: {
+            mode: string;
+            branch?: string;
+            message?: string;
+        }) => Promise<unknown>;
+        /** Persist why a turn's run could not be enqueued (runless-turn honesty).
+         * `code` is the typed throw's machine code (null if none); `retryable`
+         * false marks refusals with no recorded job to replay. */
+        setTurnEnqueueError?: (turnId: string, message: string, code: string | null, retryable?: boolean) => void;
+        /** User-level trust: enumerate per-repo trust files (Settings projection). */
+        listTrust?: () => Promise<unknown>;
+        /** NARROW trust write: grant/revoke full access for ONE repo — the same
+         * user-level file `claudexor trust` owns; every other trust field stays
+         * CLI-only. */
+        updateTrust?: (input: {
+            repoRoot: string;
+            allowFullAccess: boolean;
+        }) => Promise<unknown>;
+    };
+}
+/**
+ * HTTP/SSE facade over the durable daemon. Canonical run/job state comes from the
+ * daemon (`jobs.json` over the unix-socket JSON-RPC API). This server is a live
+ * viewport only: POST/GET/cancel delegate to daemon, and event streams replay/tail
+ * the canonical `.claudexor/runs/<runId>/events.jsonl` file.
+ */
+export declare class DaemonControlApiServer {
+    private readonly opts;
+    private server?;
+    private readonly sseClients;
+    /** Per-thread turn submission chains (serialize head_run_id lineage updates). */
+    private readonly threadTurnChains;
+    constructor(opts: DaemonControlApiOptions);
+    start(): Promise<{
+        host: string;
+        port: number;
+    }>;
+    stop(): Promise<void>;
+    private tokenMatches;
+    private authorized;
+    /**
+     * ONE owner of the bad-request envelope: status from the typed error,
+     * message text, and the machine-readable `code` (e.g.
+     * inline_secret_rejected) when the error carries one.
+     */
+    private requestError;
+    private json;
+    private readBody;
+    private onRequest;
+    private handle;
+    private service;
+    /**
+     * Live setup-job lifecycle stream: emits a `status` event on every state or
+     * message transition until the job reaches a terminal state. Backed by
+     * polling the job service (the manager has no event bus), which is exactly
+     * what the previous one-shot stub forced every client to reimplement.
+     */
+    private streamSetupJobEvents;
+    private waitForRunStart;
+    private findRun;
+    /** Bound helper context for the extracted thread-turn write routes.
+     * Callers guard the required services (threadDetail/createThreadTurn)
+     * before routing here. */
+    private threadTurnRouteCtx;
+    /** Read a run's text artifact (e.g. final/plan.md) for the "Implement plan" turn. */
+    private readRunArtifactText;
+    private readonly summaryCache;
+    /**
+     * GET /runs is the app's main screen and used to re-read every artifact for
+     * every retained job on every poll (O(jobs x file size) sync I/O). Terminal
+     * runs change only when their artifacts change, so summaries are cached on a
+     * state+artifact-mtime fingerprint.
+     */
+    private summarizeRunCached;
+    /**
+     * Cached artifact projection + LIVE waiting_on_user overlay. Pending
+     * interactions are in-process daemon state, not an artifact, so they must
+     * never be frozen into the fingerprint cache.
+     */
+    private summarizeRunLive;
+    /**
+     * Degrade contract shared by GET /runs and the thread-detail turn cards:
+     * one unprojectable job record becomes a diagnostic row, never a 500 for
+     * the whole list/thread.
+     */
+    private summarizeRunOrDiagnostic;
+    private lastEventId;
+    private streamEvents;
+    /**
+     * Global live-only event multiplex (GET /events): every run's events as they
+     * happen, tagged with run_id, no replay. Documented asymmetry vs the per-run
+     * stream: reconnecting clients re-snapshot /runs first, then resume per-run
+     * streams (which DO replay via persisted seq) where they need gap-free state.
+     */
+    private streamGlobalEvents;
+    private pendingInteractionsFor;
+}
+/** A run's project root, taken from its TYPED scope — NOT by path-slicing the
+ *  runDir. Slicing on `.claudexor` would resolve a no-project run (whose run dir
+ *  is `~/.claudexor/runs/<id>`) to the user's HOME and let /produced list
+ *  `~/artifacts` (review-flagged). Null for scope `none` ⇒ no produced outputs. */
+export declare function producedRepoRoot(rec: DaemonRunRecord): string | null;
+//# sourceMappingURL=daemon-server.d.ts.map

package/dist/daemon-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-server.d.ts","sourceRoot":"","sources":["../src/daemon-server.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAGL,eAAe,EAkCf,KAAK,yBAAyB,EAsB/B,MAAM,mBAAmB,CAAC;AAK3B,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,GAAG,CAAC,EAAE;QAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;KAAE,CAAC;IAC/E,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,gEAAgE;QAChE,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,sGAAsG;QACtG,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACvD,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,2EAA2E;QAC3E,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACrE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACrH,gDAAgD;QAChD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,CAAA;SAAE,CAAC,CAAC;QACpD,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,MAAM,EAAE,OAAO,CAAC;YAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YAAC,KAAK,EAAE,OAAO,EAAE,CAAA;SAAE,CAAC,CAAC;QACnG,6EAA6E;QAC7E,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACvL,mEAAmE;QACnE,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACzJ,6EAA6E;QAC7E,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1G;;kEAE0D;QAC1D,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;QAC1G,8EAA8E;QAC9E,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC;;uBAEe;QACf,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,eAAe,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC3F,CAAC;CACH;AA6BD;;;;;GAKG;AACH,qBAAa,sBAAsB;IAMrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoC;gBAExC,IAAI,EAAE,uBAAuB;IAEpD,KAAK,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAYhD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAe3B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,UAAU;IAMlB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,IAAI;YAME,QAAQ;IAkBtB,OAAO,CAAC,SAAS;YAWH,MAAM;YAwwBN,OAAO;IAuBrB;;;;;OAKG;YACW,oBAAoB;YAuEpB,eAAe;YAcf,OAAO;IAMrB;;8BAE0B;IAC1B,OAAO,CAAC,kBAAkB;IAgB1B,qFAAqF;YACvE,mBAAmB;IAUjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0E;IAEvG;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAahC,OAAO,CAAC,WAAW;YAQL,YAAY;IAU1B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAsC1B,OAAO,CAAC,sBAAsB;CAO/B;AA6gBD;;;mFAGmF;AACnF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAGpE"}