@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/campaign-types.d.ts

@@ -0,0 +1,101 @@
+import type { CampaignLifecycleStatus } from "./campaign-status-json.js";
+export type CampaignStepStatus = "pending" | "in_progress" | "complete" | "failed" | "escalated";
+export type { CampaignLifecycleStatus };
+export interface CampaignStep {
+    id: string;
+    slug: string;
+    title: string;
+    status: CampaignStepStatus;
+    /**
+     * Where THIS step's `status` came from.
+     *
+     * Per-step, not per-campaign, because the claim it qualifies is per-step. A
+     * campaign can legitimately mix: `status.json` lists S1 but not S2, so S1's
+     * status is live and S2's comes from the plan table. A campaign-level flag
+     * would report "live" for both and drop the disclosure on exactly the unit
+     * that needed it (external plan review, openai HIGH #5).
+     */
+    statusSource: "status_json" | "campaign_md" | "events" | "default";
+    /** Project-root-relative, POSIX-separated path to the sub-iterate spec.
+     *  Null when the file is missing, escapes the root, or holds shell-hostile
+     *  chars (so the copy-launch command is never malformed). */
+    specPath: string | null;
+    commit: string | null;
+    branch: string | null;
+    /** Forward-compat plan-first/risk marker read from the sub-iterate spec's
+     *  optional frontmatter (`plan_first`/`risk`). False for every campaign that
+     *  exists today (the producer writes no frontmatter); the autonomous-launch
+     *  guardrail surfaces it the day a producer emits one. See
+     *  `campaign-parse.ts parseSpecFrontmatter`. */
+    planFirst: boolean;
+}
+/**
+ * WHERE this campaign's per-unit facts came from, and whether getting them cost
+ * us something.
+ *
+ * The fallback chain (`status.json` → the `campaign.md` table → `pending`) is
+ * genuinely useful and stays. What it must stop doing is being SILENT: a
+ * consumer that renders "S2 is running now" from a hand-maintained Markdown
+ * table, because the live status file was torn, is making a claim it cannot
+ * support, and today nothing on the wire lets it know.
+ */
+export interface CampaignProvenance {
+    /**
+     * `status_json`  — at least one unit's status came from the live status file.
+     * `campaign_md`  — every status came from the plan document's table.
+     * `events`       — reconstructed from the tracked event log because the
+     *                  campaign directory is absent (a fresh clone). Completed
+     *                  units only, so `total == done` says nothing about units
+     *                  that never completed.
+     * `none`         — no unit statuses were resolved from any source.
+     */
+    statusSource: "status_json" | "campaign_md" | "events" | "none";
+    /**
+     * True when a source EXISTED and could not be read (a torn/malformed
+     * `status.json`, an unreadable `campaign.md`). NOT set merely because a file
+     * is absent — an absent status file is an ordinary legacy campaign.
+     *
+     * Kept as the single "should this be qualified at all" switch; WHICH source
+     * failed is the pair of fields below, because a disclosure that names the
+     * wrong file is itself a false statement (external code review, openai #4).
+     */
+    degraded: boolean;
+    /** `status.json`: read fine · not there at all · there and unusable. */
+    statusJsonState: "ok" | "absent" | "unreadable";
+    /** `campaign.md` existed and could not be read. */
+    campaignMdUnreadable: boolean;
+}
+export interface Campaign {
+    slug: string;
+    intent: string;
+    branchStrategy: string | null;
+    expandsTriage: string | null;
+    /** Producer-owned lifecycle status; null when the producer hasn't written
+     *  one yet (legacy → consumers fall back to done/total). */
+    status: CampaignLifecycleStatus | null;
+    /** Where the per-unit facts came from, and whether a read degraded. */
+    provenance: CampaignProvenance;
+    steps: CampaignStep[];
+    done: number;
+    total: number;
+    /** First step whose status is not complete (the step the campaign is blocked
+     *  on, incl. a failed/escalated step that needs a re-run). Null when all
+     *  complete. */
+    nextPending: {
+        id: string;
+        specPath: string | null;
+    } | null;
+    /**
+     * True when an autonomous run is currently attached to this campaign — a live
+     * `loop_state.json` `in_progress` unit, OR a `status.json` step `in_progress`.
+     * Populated by `routes/campaigns.ts` (this reader leaves it undefined). The
+     * launch CTAs disable/relabel on it to prevent spawning a SECOND orchestrator
+     * on the same campaign. Optional for deploy-skew safety. See `core/campaign-loop-state.ts`.
+     */
+    attachedRun?: boolean;
+    /** Reconstructed purely from tracked events.jsonl when the campaign dir is absent (a clone): completed subs only, total==done, specPath null. Set by `core/campaign-events.ts`. */
+    derivedFromEvents?: boolean;
+    /** True when an operator manually dismissed this campaign from the board (a webui-owned quittance, NOT a producer status). Set by `routes/campaigns.ts` from `core/dismissed-campaigns-store.ts`; optional for deploy-skew. */
+    dismissed?: boolean;
+}
+//# sourceMappingURL=campaign-types.d.ts.map

package/server/dist/core/campaign-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign-types.d.ts","sourceRoot":"","sources":["../../src/core/campaign-types.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,aAAa,GACb,UAAU,GACV,QAAQ,GACR,WAAW,CAAC;AAKhB,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;;;;OAQG;IACH,YAAY,EAAE,aAAa,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnE;;iEAE6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;oDAIgD;IAChD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;OAQG;IACH,YAAY,EAAE,aAAa,GAAG,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChE;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,eAAe,EAAE,IAAI,GAAG,QAAQ,GAAG,YAAY,CAAC;IAChD,mDAAmD;IACnD,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;gEAC4D;IAC5D,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvC,uEAAuE;IACvE,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;oBAEgB;IAChB,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mLAAmL;IACnL,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+NAA+N;IAC/N,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}

package/server/dist/core/campaign-types.js

@@ -0,0 +1,10 @@
+/*
+ * campaign-types.ts — the shapes `campaign-store.ts` produces.
+ *
+ * Split out when `CampaignProvenance` pushed the store past the 300-LOC rule.
+ * A cohesive split along the obvious seam: this file declares WHAT a campaign
+ * is, `campaign-store.ts` decides how to READ one off disk. The store re-exports
+ * everything here, so no consumer's import site moved.
+ */
+export {};
+//# sourceMappingURL=campaign-types.js.map

package/server/dist/core/campaign-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign-types.js","sourceRoot":"","sources":["../../src/core/campaign-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/server/dist/core/campaign-write.d.ts

@@ -0,0 +1,13 @@
+import type { CampaignLifecycleStatus } from "./campaign-status-json.js";
+export type CampaignWriteErrorCode = "no_writable_status_target" | "campaign_write_failed";
+export declare class CampaignWriteError extends Error {
+    readonly code: CampaignWriteErrorCode;
+    constructor(code: CampaignWriteErrorCode, message: string);
+}
+/**
+ * Set the campaign-level lifecycle `status`. Writes status.json if present,
+ * else the campaign.md frontmatter; throws `no_writable_status_target` when
+ * neither exists. Caller MUST hold the campaign-dir lock.
+ */
+export declare function setCampaignStatus(campaignDir: string, status: CampaignLifecycleStatus): void;
+//# sourceMappingURL=campaign-write.d.ts.map

package/server/dist/core/campaign-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign-write.d.ts","sourceRoot":"","sources":["../../src/core/campaign-write.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,MAAM,MAAM,sBAAsB,GAC9B,2BAA2B,GAC3B,uBAAuB,CAAC;AAE5B,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAgFD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,uBAAuB,GAC9B,IAAI,CAqBN"}

package/server/dist/core/campaign-write.js

@@ -0,0 +1,128 @@
+/*
+ * campaign-write.ts — the ONLY WebUI write to campaign lifecycle state.
+ *
+ * Sets a campaign's top-level lifecycle `status` (the `draft → active` flip
+ * behind the Triage "Start Campaign" action). A deliberate, narrow relaxation
+ * of the "WebUI is read-only on campaign state" rule — the same operator-write
+ * established write pattern (ADR-101/106): caller holds the lock; this
+ * module just does the read-modify-write of a single field.
+ *
+ * Write target mirrors the READ precedence in `pickLifecycle` (status.json
+ * top-level `status` wins, else `campaign.md` frontmatter), so a write always
+ * lands where the next read looks:
+ *   - `status.json` exists → JSON.parse, set top-level `status`, re-serialize.
+ *   - else `campaign.md` has a frontmatter block → replace/insert `status:`
+ *     INSIDE the leading `---…---` block only (never the body).
+ *   - neither → `CampaignWriteError("no_writable_status_target")` (the route
+ *     maps it to 422) — we never blindly create/append, which could corrupt.
+ *
+ * All writes are atomic (temp file + rename) so a crash mid-write can't leave a
+ * half-written status.json / campaign.md (external review HIGH #2 / #1).
+ */
+import { existsSync, readFileSync, writeFileSync, renameSync } from "node:fs";
+import path from "node:path";
+export class CampaignWriteError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "CampaignWriteError";
+    }
+}
+const VALID_LIFECYCLE = new Set([
+    "draft",
+    "active",
+    "complete",
+]);
+/** Write `content` to `file` atomically (same-dir temp + rename). */
+function atomicWrite(file, content) {
+    const tmp = `${file}.tmp-${process.pid}`;
+    writeFileSync(tmp, content, "utf-8");
+    renameSync(tmp, file);
+}
+/** Set status.json top-level `status` when status.json exists. */
+function writeStatusJson(campaignDir, status) {
+    const p = path.join(campaignDir, "status.json");
+    if (!existsSync(p))
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(p, "utf-8"));
+    }
+    catch {
+        throw new CampaignWriteError("campaign_write_failed", "status.json is not valid JSON; refusing to rewrite");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new CampaignWriteError("campaign_write_failed", "status.json is not a JSON object; refusing to rewrite");
+    }
+    parsed.status = status;
+    atomicWrite(p, JSON.stringify(parsed, null, 2) + "\n");
+    return true;
+}
+/**
+ * Set the `status:` key INSIDE the leading `---…---` frontmatter block of
+ * campaign.md (never the body). Tolerates CRLF + an existing `status:` line.
+ * Returns false when there is no frontmatter block to write into.
+ */
+function writeFrontmatterStatus(campaignDir, status) {
+    const p = path.join(campaignDir, "campaign.md");
+    if (!existsSync(p))
+        return false;
+    const md = readFileSync(p, "utf-8");
+    // Capture the leading frontmatter block: opening `---<eol>`, body, closing `<eol>---`.
+    const m = md.match(/^(---[ \t]*\r?\n)([\s\S]*?)(\r?\n---[ \t]*)(\r?\n|$)/);
+    if (!m)
+        return false; // no frontmatter block — refuse (route → 422)
+    const open = m[1];
+    const body = m[2];
+    const close = m[3];
+    const after = m[4];
+    // Only treat this as YAML frontmatter (not a leading `---` thematic break
+    // wrapping prose) if the block has at least one TOP-LEVEL `key:` line. A
+    // prose block fenced by `---` has none → refuse (route → 422) rather than
+    // splice `status:` into the middle of prose (review MEDIUM #1).
+    if (!/^[A-Za-z0-9_-]+[ \t]*:/m.test(body))
+        return false;
+    const eol = open.includes("\r\n") ? "\r\n" : "\n";
+    const lines = body.split(/\r?\n/);
+    let found = false;
+    const rewritten = lines.map((ln) => {
+        // Column-0 anchor: only the TOP-LEVEL `status:` (the lifecycle field
+        // `pickLifecycle` reads) is rewritten — an indented `status:` nested under
+        // another mapping is left byte-intact (review MEDIUM #2).
+        if (/^status[ \t]*:/.test(ln)) {
+            found = true;
+            return `status: ${status}`;
+        }
+        return ln;
+    });
+    if (!found)
+        rewritten.push(`status: ${status}`);
+    const newBlock = open + rewritten.join(eol) + close + after;
+    const newMd = md.slice(0, m.index ?? 0) + newBlock + md.slice((m.index ?? 0) + m[0].length);
+    atomicWrite(p, newMd);
+    return true;
+}
+/**
+ * Set the campaign-level lifecycle `status`. Writes status.json if present,
+ * else the campaign.md frontmatter; throws `no_writable_status_target` when
+ * neither exists. Caller MUST hold the campaign-dir lock.
+ */
+export function setCampaignStatus(campaignDir, status) {
+    if (!VALID_LIFECYCLE.has(status)) {
+        throw new CampaignWriteError("campaign_write_failed", `invalid lifecycle status: ${String(status)}`);
+    }
+    try {
+        if (writeStatusJson(campaignDir, status))
+            return;
+        if (writeFrontmatterStatus(campaignDir, status))
+            return;
+    }
+    catch (err) {
+        if (err instanceof CampaignWriteError)
+            throw err;
+        throw new CampaignWriteError("campaign_write_failed", `campaign status write failed: ${String(err).slice(0, 200)}`);
+    }
+    throw new CampaignWriteError("no_writable_status_target", "campaign has neither a status.json nor a campaign.md frontmatter block to write the status into");
+}
+//# sourceMappingURL=campaign-write.js.map

package/server/dist/core/campaign-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign-write.js","sourceRoot":"","sources":["../../src/core/campaign-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IADX,YACW,IAA4B,EACrC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAwB;QAIrC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,OAAO;IACP,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AAEH,qEAAqE;AACrE,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,kEAAkE;AAClE,SAAS,eAAe,CAAC,WAAmB,EAAE,MAAc;IAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACA,MAAkC,CAAC,MAAM,GAAG,MAAM,CAAC;IACpD,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,WAAmB,EAAE,MAAc;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACpC,uFAAuF;IACvF,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,8CAA8C;IACpE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACjC,qEAAqE;QACrE,2EAA2E;QAC3E,0DAA0D;QAC1D,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,WAAW,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,SAAS,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5F,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAmB,EACnB,MAA+B;IAE/B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,6BAA6B,MAAM,CAAC,MAAM,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO;QACjD,IAAI,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,iCAAiC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,kBAAkB,CAC1B,2BAA2B,EAC3B,iGAAiG,CAClG,CAAC;AACJ,CAAC"}

package/server/dist/core/cascade-delete-project-tasks.d.ts

@@ -0,0 +1,14 @@
+import type { SdkSessionsStore } from "./sdk-sessions-store.js";
+export interface CascadeDeleteProjectTasksDeps {
+    store: SdkSessionsStore;
+    ptyKillBestEffort?: (taskId: string) => Promise<void>;
+    scrollbackClearBestEffort?: (taskId: string) => Promise<void>;
+    snapshotClearBestEffort?: (taskId: string) => Promise<void>;
+}
+/**
+ * Remove every task whose `projectId === projectId`. Persists once (not
+ * per-task) iff at least one task was removed, then runs the best-effort
+ * scrollback + snapshot cleanup. Returns the number of tasks removed.
+ */
+export declare function cascadeDeleteProjectTasks(projectId: string, deps: CascadeDeleteProjectTasksDeps): Promise<number>;
+//# sourceMappingURL=cascade-delete-project-tasks.d.ts.map

package/server/dist/core/cascade-delete-project-tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade-delete-project-tasks.d.ts","sourceRoot":"","sources":["../../src/core/cascade-delete-project-tasks.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,gBAAgB,CAAC;IAIxB,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,yBAAyB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uBAAuB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,MAAM,CAAC,CA6CjB"}

package/server/dist/core/cascade-delete-project-tasks.js

@@ -0,0 +1,68 @@
+/*
+ * cascade-delete-project-tasks.ts —
+ * iterate-2026-07-06-project-delete-cascades-tasks.
+ *
+ * When a project is deleted (DELETE /api/projects/:id) every task that
+ * belonged to it must be removed too. Otherwise those tasks keep a dangling
+ * projectId and ProjectManager.getAll() perpetually synthesizes a phantom
+ * "Unassigned" row for them — one the client can neither clear nor filter,
+ * because the dangling id never equals the reserved "unassigned" sentinel
+ * (so the row also shows a count of 0). The load-time O26 normalization in
+ * sdk-sessions-store.ts only self-heals stale references on the NEXT server
+ * restart; this closes the runtime gap.
+ *
+ * Behaviour mirrors the single-task DELETE cascade in
+ * external/tasks/lifecycle.ts: drop the store row, then best-effort clear the
+ * scrollback + cell-state snapshot (both may hold secrets — the delete is the
+ * authoritative privacy boundary, ADR-068-A1 + ADR-087 MEDIUM-B1). The
+ * on-disk Claude JSONL under ~/.claude is NOT touched (webui is a read-only
+ * observer of that directory).
+ */
+/**
+ * Remove every task whose `projectId === projectId`. Persists once (not
+ * per-task) iff at least one task was removed, then runs the best-effort
+ * scrollback + snapshot cleanup. Returns the number of tasks removed.
+ */
+export async function cascadeDeleteProjectTasks(projectId, deps) {
+    const { store, ptyKillBestEffort, scrollbackClearBestEffort, snapshotClearBestEffort, } = deps;
+    const doomed = store.list().filter((t) => t.projectId === projectId);
+    if (doomed.length === 0)
+        return 0;
+    for (const t of doomed) {
+        store.delete(t.taskId);
+    }
+    await store.persist();
+    // Side-file cleanup runs AFTER the authoritative store mutation. Each call
+    // is independently best-effort: a failure to clear one task's scrollback
+    // must not abort the rest or reject the cascade.
+    for (const t of doomed) {
+        // D01/F01 — kill the live pty BEFORE this task's clears so its
+        // last-detach flush / kill-finalize cannot resurrect the wiped files.
+        if (ptyKillBestEffort) {
+            try {
+                await ptyKillBestEffort(t.taskId);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+        if (scrollbackClearBestEffort) {
+            try {
+                await scrollbackClearBestEffort(t.taskId);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+        if (snapshotClearBestEffort) {
+            try {
+                await snapshotClearBestEffort(t.taskId);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    return doomed.length;
+}
+//# sourceMappingURL=cascade-delete-project-tasks.js.map

package/server/dist/core/cascade-delete-project-tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade-delete-project-tasks.js","sourceRoot":"","sources":["../../src/core/cascade-delete-project-tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAcH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,IAAmC;IAEnC,MAAM,EACJ,KAAK,EACL,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,GACxB,GAAG,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,2EAA2E;IAC3E,yEAAyE;IACzE,iDAAiD;IACjD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,+DAA+D;QAC/D,sEAAsE;QACtE,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,IAAI,yBAAyB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,IAAI,uBAAuB,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC"}

package/server/dist/core/claude-bin-resolver.d.ts

@@ -0,0 +1,62 @@
+import { spawnSync } from "node:child_process";
+/**
+ * Resolve an absolute path to the claude CLI.
+ *
+ * iterate-2026-05-08 v0.8.8 AC-2 — multi-strategy lookup:
+ *
+ *   1. `SHIPWRIGHT_CLAUDE_BIN` env override (operator pin). Loud reject
+ *      if the path doesn't exist — falling back silently would mask
+ *      misconfiguration that the operator explicitly set.
+ *
+ *   2. Primary: `where claude` (Windows) / `which claude` (POSIX).
+ *      Inherits the launching shell's PATH. Prefers `.cmd` shim on
+ *      Windows when multiple results match.
+ *
+ *   3. Fallback: walk a curated list of known install paths. Catches
+ *      the common case where the launching shell's PATH did NOT include
+ *      `~/.local/bin/`, npm-global, winget shim — even though the binary
+ *      exists on disk. Empirically observed: tsx-watch reload after a
+ *      shell change, claude installed AFTER server start, and so on.
+ *
+ *   4. Returns null when nothing resolves. `/api/diagnostics` then
+ *      reports `claudeCli.supported = false` and the UI shows the
+ *      "Claude Code CLI not found" warning.
+ *
+ * Logs a structured stderr line on every fallback hit so production
+ * operators can diagnose PATH-drift in the server log without DevTools.
+ */
+export declare function resolveClaudeBin(): string | null;
+export interface ResolveClaudeBinDeps {
+    platform: NodeJS.Platform | string;
+    spawnSync: typeof spawnSync;
+    existsSync: (p: string) => boolean;
+    env: Record<string, string | undefined>;
+}
+/** Test-friendly variant of resolveClaudeBin — all environment hooks injectable. */
+export declare function resolveClaudeBinWith(deps: ResolveClaudeBinDeps): string | null;
+/**
+ * iterate-2026-05-08 v0.8.8 AC-3 — boot-time PATH self-heal.
+ *
+ * When the AC-2 fallback resolved a binary that lives in a directory
+ * NOT on `process.env.PATH`, prepend that directory so subsequent
+ * child processes (node-pty, preview-session-manager) inherit the
+ * augmented PATH. Common scenario: user installed claude into
+ * `~/.local/bin/`, opened the server from a shell that doesn't
+ * source the PATH-extending dotfile (e.g. PowerShell from a fresh
+ * Windows session).
+ *
+ * Idempotent — case-insensitive comparison on Windows, case-sensitive
+ * on POSIX. Loud-logs the prepend so production operators see PATH
+ * drift in the boot log.
+ */
+export interface SelfHealClaudePathDeps {
+    bin: string | null;
+    env: Record<string, string | undefined>;
+    platform: NodeJS.Platform | string;
+}
+export interface SelfHealResult {
+    augmented: boolean;
+    parentDir: string | null;
+}
+export declare function selfHealClaudePath(deps: SelfHealClaudePathDeps): SelfHealResult;
+//# sourceMappingURL=claude-bin-resolver.d.ts.map

package/server/dist/core/claude-bin-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-bin-resolver.d.ts","sourceRoot":"","sources":["../../src/core/claude-bin-resolver.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK/C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAOhD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;IACnC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACzC;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAkE9E;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,cAAc,CAmD/E"}

package/server/dist/core/claude-bin-resolver.js

@@ -0,0 +1,208 @@
+/*
+ * claude-bin-resolver.ts — WHERE the Claude CLI is, and getting its parent dir
+ * onto PATH so child processes inherit it.
+ *
+ * Split out of cli-compat.ts (iterate-2026-07-31-win32-shell-spawn-remediation).
+ * That module is the CLI *version gate* — its own header says so — and had grown
+ * a second, unrelated concern: binary discovery, bolted on in v0.8.8. The two
+ * together carried the file 34 lines past the 300-line ceiling, where it sat as a
+ * grandfathered bloat-baseline entry; a security remediation needing a few lines
+ * there could not land without paying that debt down first.
+ *
+ * This is a PURE RELOCATION — not one line of logic changed in the move. The
+ * version gate keeps its own home, so CLAUDE.md architecture rule 10
+ * ("MIN_SUPPORTED_CLI is pinned in core/cli-compat.ts") still holds.
+ *
+ * The `[cli-compat]` prefix on the operator warnings below is LEFT ALONE on
+ * purpose. Those strings are observable output that production operators grep
+ * for in the boot log; renaming them would make this a behaviour change rather
+ * than a relocation, and would silently break anyone's existing log filter.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync as fsExistsSync } from "node:fs";
+import { platform } from "node:os";
+import path from "node:path";
+/**
+ * Resolve an absolute path to the claude CLI.
+ *
+ * iterate-2026-05-08 v0.8.8 AC-2 — multi-strategy lookup:
+ *
+ *   1. `SHIPWRIGHT_CLAUDE_BIN` env override (operator pin). Loud reject
+ *      if the path doesn't exist — falling back silently would mask
+ *      misconfiguration that the operator explicitly set.
+ *
+ *   2. Primary: `where claude` (Windows) / `which claude` (POSIX).
+ *      Inherits the launching shell's PATH. Prefers `.cmd` shim on
+ *      Windows when multiple results match.
+ *
+ *   3. Fallback: walk a curated list of known install paths. Catches
+ *      the common case where the launching shell's PATH did NOT include
+ *      `~/.local/bin/`, npm-global, winget shim — even though the binary
+ *      exists on disk. Empirically observed: tsx-watch reload after a
+ *      shell change, claude installed AFTER server start, and so on.
+ *
+ *   4. Returns null when nothing resolves. `/api/diagnostics` then
+ *      reports `claudeCli.supported = false` and the UI shows the
+ *      "Claude Code CLI not found" warning.
+ *
+ * Logs a structured stderr line on every fallback hit so production
+ * operators can diagnose PATH-drift in the server log without DevTools.
+ */
+export function resolveClaudeBin() {
+    return resolveClaudeBinWith({
+        platform: platform(),
+        spawnSync,
+        existsSync: fsExistsSync,
+        env: process.env,
+    });
+}
+/** Test-friendly variant of resolveClaudeBin — all environment hooks injectable. */
+export function resolveClaudeBinWith(deps) {
+    const isWin = deps.platform === "win32";
+    // (1) Env override — explicit operator pin.
+    const override = deps.env.SHIPWRIGHT_CLAUDE_BIN?.trim();
+    if (override) {
+        if (deps.existsSync(override))
+            return override;
+        // Loud reject — operator set this on purpose; falling back silently
+        // would hide the typo.
+        // eslint-disable-next-line no-console
+        console.warn(`[cli-compat] SHIPWRIGHT_CLAUDE_BIN=${override} does not exist; resolveClaudeBin returning null`);
+        return null;
+    }
+    // (2) Primary lookup via `where` / `which`. Wrapped in try so a
+    //     missing system binary (rare on Windows, possible on minimal
+    //     POSIX containers) doesn't preempt the curated fallback.
+    //
+    // External code review fix (gemini high): `where claude` on Windows
+    // emits `INFO: Could not find files for the given pattern(s).` to
+    // STDOUT (not stderr) when no match. Filter that out, otherwise the
+    // first-line fallback would parse the INFO line as a path and the
+    // existsSync check at the call-site would never run.
+    let primaryResult = null;
+    try {
+        const lookup = isWin ? "where" : "which";
+        const r = deps.spawnSync(lookup, ["claude"], { encoding: "utf-8", shell: false });
+        if (!r.error) {
+            const lines = (r.stdout ?? "")
+                .split(/\r?\n/)
+                .map((l) => l.trim())
+                .filter(Boolean)
+                .filter((l) => !/^INFO:/i.test(l)); // drop `where`'s "Could not find" notice
+            if (isWin) {
+                const dotCmd = lines.find((l) => /\.cmd$/i.test(l));
+                if (dotCmd)
+                    primaryResult = dotCmd;
+            }
+            primaryResult = primaryResult ?? lines[0] ?? null;
+            // Defense-in-depth: ensure the resolved path actually exists on
+            // disk. `where` can sometimes return stale alias entries that
+            // no longer point at a real file (operator un-installed claude
+            // but kept the App Execution Alias entry).
+            if (primaryResult && !deps.existsSync(primaryResult)) {
+                primaryResult = null;
+            }
+        }
+    }
+    catch {
+        /* fall through to curated paths */
+    }
+    if (primaryResult)
+        return primaryResult;
+    // (3) Curated fallback paths. Per-platform, priority-ordered.
+    const candidates = curatedCandidates(isWin, deps.env);
+    for (const candidate of candidates) {
+        if (deps.existsSync(candidate)) {
+            // eslint-disable-next-line no-console
+            console.warn(`[cli-compat] resolved claude via fallback path: ${candidate} (PATH lookup empty — operator may want to add the parent dir to PATH OR set SHIPWRIGHT_CLAUDE_BIN)`);
+            return candidate;
+        }
+    }
+    return null;
+}
+export function selfHealClaudePath(deps) {
+    if (!deps.bin)
+        return { augmented: false, parentDir: null };
+    const isWin = deps.platform === "win32";
+    const sep = isWin ? ";" : ":";
+    // Use the explicit platform's path module — NOT the runner-native
+    // `path` default. The runner is POSIX on Linux CI, which silently
+    // mis-parses `C:\...` inputs as a single basename and returns "."
+    // from `dirname`. Empirically: the 4 win32 test cases below passed on
+    // Windows dev machines but failed on Ubuntu CI for 9 push-runs after
+    // v0.8.5 because of this exact gap.
+    const pathMod = isWin ? path.win32 : path.posix;
+    const parentDir = pathMod.dirname(deps.bin);
+    // External code review fix (openai medium): on Windows, environment
+    // variables are case-insensitive AND many process spawners expose the
+    // path variable as `Path` rather than `PATH`. If we always read+write
+    // `env.PATH`, we may be looking at an empty string while the real
+    // value lives at `Path` — and child processes that inherit `Path`
+    // would not see the prepended dir. Detect the existing key (any
+    // case) on Windows and update it in place.
+    let pathKey = "PATH";
+    if (isWin) {
+        for (const k of Object.keys(deps.env)) {
+            if (k.toLowerCase() === "path") {
+                pathKey = k;
+                break;
+            }
+        }
+    }
+    const currentPath = deps.env[pathKey] ?? "";
+    const entries = currentPath.length > 0 ? currentPath.split(sep) : [];
+    // Normalize both sides identically: strip trailing slashes/backslashes
+    // (`C:\foo\` vs `C:\foo`), and case-fold on Windows.
+    const stripTrailing = (s) => s.replace(/[\\/]+$/, "");
+    const norm = (s) => {
+        const t = stripTrailing(s);
+        return isWin ? t.toLowerCase() : t;
+    };
+    const parentNorm = norm(parentDir);
+    const alreadyPresent = entries.some((e) => norm(e) === parentNorm);
+    if (alreadyPresent) {
+        return { augmented: false, parentDir };
+    }
+    deps.env[pathKey] =
+        currentPath.length > 0 ? `${parentDir}${sep}${currentPath}` : parentDir;
+    // eslint-disable-next-line no-console
+    console.warn(`[cli-compat] PATH self-heal: prepended ${parentDir} into env.${pathKey} (claude resolved via fallback; child-process spawns inherit augmented PATH)`);
+    return { augmented: true, parentDir };
+}
+function curatedCandidates(isWin, env) {
+    if (isWin) {
+        const userProfile = env.USERPROFILE ?? "";
+        const appData = env.APPDATA ?? "";
+        const localAppData = env.LOCALAPPDATA ?? "";
+        const programFiles = env.ProgramFiles ?? "";
+        const c = [];
+        if (userProfile) {
+            c.push(path.join(userProfile, ".local", "bin", "claude.exe"));
+            c.push(path.join(userProfile, ".local", "bin", "claude.cmd"));
+        }
+        if (appData) {
+            // npm global install
+            c.push(path.join(appData, "npm", "claude.cmd"));
+            c.push(path.join(appData, "npm", "claude.exe"));
+        }
+        if (localAppData) {
+            // winget shim
+            c.push(path.join(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"));
+        }
+        if (programFiles) {
+            c.push(path.join(programFiles, "Claude Code", "claude.exe"));
+        }
+        return c;
+    }
+    // POSIX
+    const home = env.HOME ?? "";
+    const c = [];
+    if (home) {
+        c.push(path.posix.join(home, ".local", "bin", "claude"));
+        c.push(path.posix.join(home, ".npm-global", "bin", "claude"));
+    }
+    c.push("/usr/local/bin/claude");
+    c.push("/opt/homebrew/bin/claude"); // Apple Silicon Homebrew
+    return c;
+}
+//# sourceMappingURL=claude-bin-resolver.js.map