@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/mission-context/fs-read.d.ts

@@ -0,0 +1,47 @@
+export interface BoundedRead {
+    text: string;
+    /** mtime of the bytes actually read — safe to use as a cache key. */
+    mtimeMs: number;
+    sizeBytes: number;
+}
+/**
+ * Read `absolute` as UTF-8, refusing anything larger than `maxBytes`.
+ *
+ * Returns null for: missing, unreadable, not-a-regular-file, or over the cap.
+ * The caller distinguishes those cases by its own prior checks — this function
+ * deliberately collapses them, because from the reader's point of view they are
+ * all "no usable content".
+ *
+ * The path MUST already have passed pathGuard + realPathGuard; this closes the
+ * size/mtime race, it is not a substitute for the traversal guards.
+ */
+export declare function readBoundedFile(absolute: string, maxBytes: number): BoundedRead | null;
+export type BoundedReadOrUnchanged = {
+    changed: true;
+    text: string;
+    mtimeMs: number;
+    sizeBytes: number;
+} | {
+    changed: false;
+    mtimeMs: number;
+    sizeBytes: number;
+};
+/**
+ * Open ONCE; `fstat`; if `(mtimeMs, sizeBytes)` still matches `known`, return
+ * WITHOUT reading the bytes (`changed: false`); otherwise read them
+ * (`changed: true`).
+ *
+ * This lets an mtime-keyed cache skip re-reading (and re-parsing) a large file
+ * that has not moved, while keeping the same single-descriptor discipline as
+ * `readBoundedFile`: the fstat that decides "unchanged" and the read that
+ * follows a change both come from the ONE fd, so there is no stat-then-read path
+ * race to reintroduce the TOCTOU that `fs-read.ts` exists to close (CodeQL
+ * js/file-system-race). Returns null on the same "no usable content" cases.
+ *
+ * The path MUST already have passed pathGuard + realPathGuard.
+ */
+export declare function readBoundedFileIfChanged(absolute: string, maxBytes: number, known: {
+    mtimeMs: number;
+    sizeBytes: number;
+} | null): BoundedReadOrUnchanged | null;
+//# sourceMappingURL=fs-read.d.ts.map

package/server/dist/core/mission-context/fs-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-read.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/fs-read.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAuBtF;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GACnD,sBAAsB,GAAG,IAAI,CAuB/B"}

package/server/dist/core/mission-context/fs-read.js

@@ -0,0 +1,104 @@
+/*
+ * core/mission-context/fs-read.ts — ATOMIC bounded file read.
+ *
+ * Closes a genuine TOCTOU (CodeQL `js/file-system-race`, 4 HIGH alerts on the
+ * S1 PR). Every reader in this module previously did:
+ *
+ *     const st = statSync(path);          // check
+ *     if (st.size > CAP) return null;
+ *     return readFileSync(path, "utf-8"); // …then re-open by PATH
+ *
+ * Between the check and the read the path can be swapped, so the size cap was
+ * advisory: a file that statted small could be read large. The mtime used for
+ * cache keys had the same gap — it could describe a different file than the
+ * bytes actually returned.
+ *
+ * The fix is to open ONCE and answer every question from that single
+ * descriptor: `fstatSync(fd)` describes exactly the bytes `readFileSync(fd)`
+ * returns, so size, mtime and content can no longer disagree.
+ */
+import { closeSync, fstatSync, openSync, readFileSync } from "node:fs";
+/**
+ * Read `absolute` as UTF-8, refusing anything larger than `maxBytes`.
+ *
+ * Returns null for: missing, unreadable, not-a-regular-file, or over the cap.
+ * The caller distinguishes those cases by its own prior checks — this function
+ * deliberately collapses them, because from the reader's point of view they are
+ * all "no usable content".
+ *
+ * The path MUST already have passed pathGuard + realPathGuard; this closes the
+ * size/mtime race, it is not a substitute for the traversal guards.
+ */
+export function readBoundedFile(absolute, maxBytes) {
+    let fd;
+    try {
+        fd = openSync(absolute, "r");
+        const st = fstatSync(fd);
+        // A directory or device would otherwise read as garbage / block.
+        if (!st.isFile())
+            return null;
+        if (st.size > maxBytes)
+            return null;
+        // Reading FROM THE DESCRIPTOR is the load-bearing part: the bytes cannot
+        // belong to a different file than the one just fstat-ed.
+        const text = readFileSync(fd, "utf-8");
+        return { text, mtimeMs: st.mtimeMs, sizeBytes: st.size };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                /* already closed / invalid — nothing useful to do */
+            }
+        }
+    }
+}
+/**
+ * Open ONCE; `fstat`; if `(mtimeMs, sizeBytes)` still matches `known`, return
+ * WITHOUT reading the bytes (`changed: false`); otherwise read them
+ * (`changed: true`).
+ *
+ * This lets an mtime-keyed cache skip re-reading (and re-parsing) a large file
+ * that has not moved, while keeping the same single-descriptor discipline as
+ * `readBoundedFile`: the fstat that decides "unchanged" and the read that
+ * follows a change both come from the ONE fd, so there is no stat-then-read path
+ * race to reintroduce the TOCTOU that `fs-read.ts` exists to close (CodeQL
+ * js/file-system-race). Returns null on the same "no usable content" cases.
+ *
+ * The path MUST already have passed pathGuard + realPathGuard.
+ */
+export function readBoundedFileIfChanged(absolute, maxBytes, known) {
+    let fd;
+    try {
+        fd = openSync(absolute, "r");
+        const st = fstatSync(fd);
+        if (!st.isFile())
+            return null;
+        if (st.size > maxBytes)
+            return null;
+        if (known && known.mtimeMs === st.mtimeMs && known.sizeBytes === st.size) {
+            return { changed: false, mtimeMs: st.mtimeMs, sizeBytes: st.size };
+        }
+        const text = readFileSync(fd, "utf-8");
+        return { changed: true, text, mtimeMs: st.mtimeMs, sizeBytes: st.size };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                /* already closed / invalid — nothing useful to do */
+            }
+        }
+    }
+}
+//# sourceMappingURL=fs-read.js.map

package/server/dist/core/mission-context/fs-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-read.js","sourceRoot":"","sources":["../../../src/core/mission-context/fs-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AASvE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,QAAgB;IAChE,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACzB,iEAAiE;QACjE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAMD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,QAAgB,EAChB,KAAoD;IAEpD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/server/dist/core/mission-context/iterate-record.d.ts

@@ -0,0 +1,52 @@
+import { type RunProjection } from "../event-log-reader.js";
+export declare const EVENTS_FILE = "shipwright_events.jsonl";
+/** Facts from `iterates/<run_id>.json`. Every field is optional in the wild. */
+export interface IterateDoc {
+    specImpact: string | null;
+    affectedFrs: string[];
+    newFrs: string[];
+    /** The recorded spec path — used only as a HINT, never as a read path. */
+    specHint: string | null;
+    complexity: string | null;
+    changeType: string | null;
+    testsPassed: boolean | null;
+    mtimeMs: number;
+}
+/**
+ * Read the per-run agent-doc. The run_id is grammar-validated before it becomes
+ * a filename, and the read is pathGuard'ed against the project root.
+ */
+export declare function readIterateDoc(projectRoot: string, runId: string): IterateDoc | null;
+export type EventLookup = {
+    status: "found";
+    run: RunProjection;
+    mtimeMs: number;
+} | {
+    status: "absent";
+    mtimeMs: number;
+} | {
+    status: "unavailable";
+};
+/**
+ * Find the `work_completed` row for `runId`.
+ *
+ * `unavailable` is returned when the log itself cannot be read — distinct from
+ * `absent` ("the log is fine, this run simply is not in it yet", the normal
+ * mid-run state). The UI renders those two very differently and conflating them
+ * would turn an I/O fault into a confident "nothing exists".
+ *
+ * INDEXED (CONTRACT §5.2). The Mission tab polls once a second, and the log went
+ * quiescent the moment the run finalized — so re-reading and re-projecting all
+ * of `shipwright_events.jsonl` every poll was pure waste. Instead the full
+ * run_id → projection index is cached and rebuilt ONLY when the log's
+ * `(mtime, size)` fingerprint moves; an unchanged log costs one fstat and an
+ * O(1) `Map` lookup.
+ */
+export declare function findWorkCompleted(projectRoot: string, runId: string): EventLookup;
+/** Test-only: drop the module-level event-log index cache between cases. */
+export declare function _clearEventIndexCache(): void;
+/** Absolute path to the tracked event log (for sourceRev probing). */
+export declare function eventsPath(projectRoot: string): string;
+/** Absolute path to the per-run agent-doc (for sourceRev probing). */
+export declare function iterateDocPath(projectRoot: string, runId: string): string;
+//# sourceMappingURL=iterate-record.d.ts.map

package/server/dist/core/mission-context/iterate-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iterate-record.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/iterate-record.ts"],"names":[],"mappings":"AAsCA,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAI7E,eAAO,MAAM,WAAW,4BAA4B,CAAC;AAMrD,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CA+BpF;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAa9B;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CA0CjF;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE"}

package/server/dist/core/mission-context/iterate-record.js

@@ -0,0 +1,156 @@
+/*
+ * core/mission-context/iterate-record.ts — the resolve-BY-RUN_ID join.
+ *
+ * Two sources carry a finalized iterate's facts, and BOTH are needed:
+ *
+ *   1. `.shipwright/agent_docs/iterates/<run_id>.json` — keyed by run_id, the
+ *      cleaner source. CONTRACT §5 calls it verified for
+ *      `{affected_frs,new_frs,spec_impact}` and it is — but MEASURED ON THIS
+ *      REPO 2026-07-18, only 1 of 59 such files actually carries those keys.
+ *   2. `work_completed` in `shipwright_events.jsonl` (`adr_id == run_id`) —
+ *      130 of 210 iterate-keyed rows carry `affected_frs`, 128 carry `tests`.
+ *
+ * So (2) is the PRIMARY path in practice and (1) is the preferred-when-present
+ * override, not the other way round. Getting this backwards would have shipped
+ * an empty Requirement artifact for ~98% of real runs.
+ *
+ * The field coverage above is the WEAKER of the two reasons, and it is the one
+ * that can improve — so do not let it talk you into flipping the order. The
+ * STRUCTURAL reason cannot: source (1) is a bounded 50-entry recency window
+ * (`append_iterate_entry` retention) that EVICTS, while (2) is append-only and
+ * never evicted. Upstream states this as a contract — shipwright
+ * `plugins/shipwright-iterate/skills/iterate/references/F5c.md`, "Consumer
+ * rule": anything that must show the FULL iterate history reads
+ * `shipwright_events.jsonl`, NOT this directory, which is a 50-run recency
+ * cache and not the historical record. Measured here 2026-07-21: 214 runs in
+ * the event log, 54 surviving agent-docs — 75% already evicted. Hence every
+ * read below is BY RUN_ID; nothing in webui may enumerate this directory.
+ *
+ * Absence vs unavailability is tracked deliberately: an events log that cannot
+ * be READ is `unavailable`, not "no run exists". A capped or failed scan that
+ * silently reports emptiness would fake absence (§5.2, Review-2 GPT #7).
+ */
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { readBoundedFile, readBoundedFileIfChanged } from "./fs-read.js";
+import { projectEventLog } from "../event-log-reader.js";
+import { pathGuard } from "../path-guard.js";
+import { isSafeRunId } from "./pointer.js";
+export const EVENTS_FILE = "shipwright_events.jsonl";
+/** Caps that bound a corrupt/huge source (CONTRACT §11 "bounded, not OOM"). */
+const MAX_RECORD_BYTES = 1024 * 1024;
+const MAX_EVENT_LOG_BYTES = 64 * 1024 * 1024;
+function asStringArray(v) {
+    return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+/**
+ * Read the per-run agent-doc. The run_id is grammar-validated before it becomes
+ * a filename, and the read is pathGuard'ed against the project root.
+ */
+export function readIterateDoc(projectRoot, runId) {
+    if (!isSafeRunId(runId))
+        return null;
+    const rel = [".shipwright", "agent_docs", "iterates", `${runId}.json`].join("/");
+    const guard = pathGuard(projectRoot, rel);
+    if (!guard.ok || !existsSync(guard.absolute))
+        return null;
+    // ONE atomic read — the mtime describes exactly the bytes parsed below
+    // (CodeQL js/file-system-race).
+    const read = readBoundedFile(guard.absolute, MAX_RECORD_BYTES);
+    if (!read)
+        return null;
+    const mtimeMs = read.mtimeMs;
+    let parsed;
+    try {
+        parsed = JSON.parse(read.text);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const o = parsed;
+    return {
+        specImpact: typeof o.spec_impact === "string" ? o.spec_impact : null,
+        affectedFrs: asStringArray(o.affected_frs),
+        newFrs: asStringArray(o.new_frs),
+        specHint: typeof o.spec === "string" ? o.spec : null,
+        complexity: typeof o.complexity === "string" ? o.complexity : null,
+        changeType: typeof o.type === "string" ? o.type : null,
+        testsPassed: typeof o.tests_passed === "boolean" ? o.tests_passed : null,
+        mtimeMs,
+    };
+}
+/** Per-log run_id index, keyed by the log's absolute path. */
+const eventIndexCache = new Map();
+const EVENT_INDEX_CAP = 32;
+/**
+ * Find the `work_completed` row for `runId`.
+ *
+ * `unavailable` is returned when the log itself cannot be read — distinct from
+ * `absent` ("the log is fine, this run simply is not in it yet", the normal
+ * mid-run state). The UI renders those two very differently and conflating them
+ * would turn an I/O fault into a confident "nothing exists".
+ *
+ * INDEXED (CONTRACT §5.2). The Mission tab polls once a second, and the log went
+ * quiescent the moment the run finalized — so re-reading and re-projecting all
+ * of `shipwright_events.jsonl` every poll was pure waste. Instead the full
+ * run_id → projection index is cached and rebuilt ONLY when the log's
+ * `(mtime, size)` fingerprint moves; an unchanged log costs one fstat and an
+ * O(1) `Map` lookup.
+ */
+export function findWorkCompleted(projectRoot, runId) {
+    const guard = pathGuard(projectRoot, EVENTS_FILE);
+    if (!guard.ok)
+        return { status: "unavailable" };
+    if (!existsSync(guard.absolute))
+        return { status: "absent", mtimeMs: 0 };
+    // Read the bytes ONLY when the fingerprint changed. Still one atomic
+    // descriptor (open→fstat→maybe-read), so the mtime that keys the index
+    // describes exactly the bytes it was built from (CodeQL js/file-system-race).
+    const cached = eventIndexCache.get(guard.absolute) ?? null;
+    const read = readBoundedFileIfChanged(guard.absolute, MAX_EVENT_LOG_BYTES, cached ? { mtimeMs: cached.mtimeMs, sizeBytes: cached.sizeBytes } : null);
+    if (!read)
+        return { status: "unavailable" };
+    let entry;
+    if (read.changed) {
+        // (Re)build the FULL run_id index in ONE scan. `projectEventLog` already
+        // keeps only the winning `work_completed` per adr_id, so indexing its `runs`
+        // yields exactly what the old per-call `{ runId }` filter returned — for
+        // every run at once, so any later poll for the same log is a map lookup.
+        const index = new Map();
+        for (const r of projectEventLog(read.text.split(/\r?\n/)).runs) {
+            index.set(r.runId, r);
+        }
+        entry = { mtimeMs: read.mtimeMs, sizeBytes: read.sizeBytes, index };
+        if (eventIndexCache.size >= EVENT_INDEX_CAP)
+            eventIndexCache.clear();
+        eventIndexCache.set(guard.absolute, entry);
+    }
+    else if (cached) {
+        entry = cached; // fingerprint unchanged — serve the cached index verbatim
+    }
+    else {
+        // Unreachable: `changed: false` is only returned when a prior fingerprint
+        // was supplied, which happens only when `cached` exists. Kept total and
+        // fail-safe rather than assert.
+        return { status: "unavailable" };
+    }
+    const run = entry.index.get(runId) ?? null;
+    return run
+        ? { status: "found", run, mtimeMs: entry.mtimeMs }
+        : { status: "absent", mtimeMs: entry.mtimeMs };
+}
+/** Test-only: drop the module-level event-log index cache between cases. */
+export function _clearEventIndexCache() {
+    eventIndexCache.clear();
+}
+/** Absolute path to the tracked event log (for sourceRev probing). */
+export function eventsPath(projectRoot) {
+    return path.join(projectRoot, EVENTS_FILE);
+}
+/** Absolute path to the per-run agent-doc (for sourceRev probing). */
+export function iterateDocPath(projectRoot, runId) {
+    return path.join(projectRoot, ".shipwright", "agent_docs", "iterates", `${runId}.json`);
+}
+//# sourceMappingURL=iterate-record.js.map

package/server/dist/core/mission-context/iterate-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iterate-record.js","sourceRoot":"","sources":["../../../src/core/mission-context/iterate-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,eAAe,EAAsB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAErD,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AACrC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAe7C,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAa;IAC/D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,CAAC,GAAG,MAAiC,CAAC;IAE5C,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACpE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;QAC1C,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;QAChC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACpD,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAClE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACtD,WAAW,EAAE,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QACxE,OAAO;KACR,CAAC;AACJ,CAAC;AAcD,8DAA8D;AAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC3D,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,KAAa;IAClE,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAEzE,qEAAqE;IACrE,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAG,wBAAwB,CACnC,KAAK,CAAC,QAAQ,EACd,mBAAmB,EACnB,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CACzE,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE5C,IAAI,KAAsB,CAAC;IAC3B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,yEAAyE;QACzE,6EAA6E;QAC7E,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QACpE,IAAI,eAAe,CAAC,IAAI,IAAI,eAAe;YAAE,eAAe,CAAC,KAAK,EAAE,CAAC;QACrE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC,CAAC,0DAA0D;IAC5E,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,wEAAwE;QACxE,gCAAgC;QAChC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAC3C,OAAO,GAAG;QACR,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QAClD,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACnD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAa;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;AAC1F,CAAC"}

package/server/dist/core/mission-context/merge-check.d.ts

@@ -0,0 +1,60 @@
+import type { MergeState } from "./types.js";
+import type { GitRunner } from "./worktree-roots.js";
+/**
+ * Validate a transcript-derived PR number. Accepts ONLY a run of ASCII digits
+ * with no sign, whitespace, separator or leading `+`; rejects 0 and anything
+ * above the bound. Returns null for everything else — the caller then reports
+ * `unknown`, never an unchecked value.
+ */
+export declare function validatePrNumber(v: unknown): number | null;
+export interface MergeCheckDeps {
+    git?: GitRunner;
+    now?: () => number;
+    pendingTtlMs?: number;
+    /** Default branch ref to check. Overridden in tests with a real fixture repo. */
+    ref?: string;
+}
+/**
+ * Is the PR's squash commit present on `origin/main`?
+ *
+ * `git log <ref> --grep=(#NNN) --fixed-strings -n 1 --format=%H` — every token
+ * is a separate argv member. `--fixed-strings` keeps the needle a literal so a
+ * PR number can never be read as a regex (belt-and-braces: it is already
+ * digits-only by the time it gets here).
+ *
+ * Returns `unknown` — never `pending` — when the check could not run at all
+ * (no PR number, git missing, ref absent). "We could not check" and "we
+ * checked and it is not there" are different facts and the UI shows them
+ * differently.
+ */
+export declare function checkSquashMerged(projectRoot: string, prNumber: unknown, deps?: MergeCheckDeps): Promise<MergeState>;
+/** Test-only: drop the module-level cache between cases. */
+export declare function _clearMergeCache(): void;
+export interface PrMarker {
+    number: number;
+    url: string;
+    owner: string;
+    repo: string;
+}
+export interface RepoSlug {
+    owner: string;
+    repo: string;
+}
+/**
+ * Parse `owner/repo` out of a git remote URL. Handles the https and scp-like
+ * SSH forms, with or without a trailing `.git`. Returns null for anything that
+ * is not a github remote — the caller then declines to verify.
+ */
+export declare function parseOriginSlug(remoteUrl: unknown): RepoSlug | null;
+/** Read (and memoize) the project's own `origin` slug. Arg-array git, shell:false. */
+export declare function readOriginSlug(projectRoot: string, git?: GitRunner): Promise<RepoSlug | null>;
+/** Test-only: reset the memoized origin slugs. */
+export declare function _clearOriginSlugCache(): void;
+/**
+ * The last PR marker in `transcript` that belongs to `expected`.
+ *
+ * `expected == null` (origin unknown / not github) → null: we cannot prove the
+ * marker is ours, so we decline rather than check a possibly-foreign number.
+ */
+export declare function extractPrMarker(transcript: string, expected: RepoSlug | null): PrMarker | null;
+//# sourceMappingURL=merge-check.d.ts.map

package/server/dist/core/mission-context/merge-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-check.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/merge-check.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAOrD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAO1D;AAuBD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,UAAU,CAAC,CAoDrB;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AA0BD,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAQnE;AAQD,sFAAsF;AACtF,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,SAAsB,GAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAa1B;AAED,kDAAkD;AAClD,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AASD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,GAAG,IAAI,GACxB,QAAQ,GAAG,IAAI,CAajB"}