@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/mission-context/types.d.ts

@@ -0,0 +1,198 @@
+import type { DecisionsArtifact, ReviewArtifact, TestsArtifact } from "./types-slice2.js";
+import type { CampaignProgressArtifact, CampaignRunbookArtifact, PhaseArtifact, SubIterateArtifact } from "./types-slice3.js";
+/** Bump when a field is removed or re-typed; additive fields do not bump. */
+export declare const MISSION_CONTEXT_SCHEMA_VERSION: 1;
+/**
+ * The §4 ordered scenario table, first-match-wins. `custom_actions` is the
+ * only scenario that HIDES the Mission tab; `plain` covers scenarios 1 + 4
+ * (plain / pure) and carries live narration but no artifact rail.
+ */
+export type MissionScenario = "custom_actions" | "iterate" | "pipeline" | "campaign" | "plain";
+/** CONTRACT §6 artifact state model. Hide-empty hides ONLY the two "absent" states. */
+export type ArtifactState = "available" | "not_applicable" | "not_yet_created" | "unavailable" | "error";
+/**
+ * Every artifact kind on the rail.
+ *
+ * The §6 SIX (spec · requirement · tests · review · decisions · commit) describe
+ * an ITERATE and are unchanged. S3 adds four kinds that belong to the other two
+ * scenarios and are never emitted for an iterate: `phase` (a pipeline phase
+ * task) and the three campaign kinds. They are separate kinds rather than
+ * reused ones precisely because a campaign's progress is not an iterate's
+ * "tests", and pretending otherwise is how a rail starts lying.
+ */
+export type ArtifactKind = "spec" | "requirement" | "tests" | "review" | "decisions" | "commit" | "phase" | "campaign_runbook" | "campaign_progress" | "sub_iterate";
+export interface ArtifactBase {
+    kind: ArtifactKind;
+    /** Rail label — plain language, never a filename. */
+    label: string;
+    state: ArtifactState;
+    /** The non-expert business summary (TOP region of the right panel). */
+    summary: string | null;
+    /** Short rail receipt; null renders NO receipt line (honest empty). */
+    receipt: string | null;
+    /**
+     * Why the state is not `available`. Display-safe prose — NEVER a raw
+     * filesystem path (that would leak the read-root layout to the client).
+     */
+    note?: string;
+}
+/** A Markdown document rendered by the client's SmartViewer `DocumentMarkdown`. */
+export interface SpecArtifact extends ArtifactBase {
+    kind: "spec";
+    detail: {
+        type: "document";
+        /**
+         * OPAQUE id for the artifact-detail endpoint. The client NEVER builds a
+         * `/file?path=` itself — that would duplicate the path rules and let the
+         * descriptor and the file read drift (CONTRACT §5.2, Review-2 GPT #9).
+         */
+        documentId: string;
+        /** Display title (basename), safe to show — not a path. */
+        title: string;
+    } | null;
+}
+/**
+ * One requirement row. BOTH ids are kept: `originalFrId` is what the run
+ * actually recorded (finer provenance, deliberately preserved), `displayFrId`
+ * is its surviving parent after Fold-Map resolution (CONTRACT §3.1 / §6).
+ */
+export interface FrRow {
+    originalFrId: string;
+    displayFrId: string;
+    /** Capability name from the spec table; null when the id resolves to neither. */
+    name: string | null;
+    /** Area code (TSK, TRM, …); null when unknown. */
+    area: string | null;
+    /** Plain-language capability description from the adopted requirements row. */
+    description?: string | null;
+    /** Safe in-document anchor for this requirement's adopted-spec source. */
+    sourceAnchor?: string | null;
+    /** `mapped from FR-01.44` — set ONLY when the fold actually moved the id. */
+    mappedFrom: string | null;
+}
+/**
+ * `planned` — mid-run, derived from the spec's intent. NEVER labelled
+ * new/changed/technical before Finalize (CONTRACT §6 mid-run column).
+ * `finalized` — post-Finalize, from the run record.
+ * `unresolved` — a source existed but yielded no usable FR ids.
+ */
+export type RequirementConfidence = "planned" | "finalized" | "unresolved";
+export type RequirementLifecycle = "discovering" | "planned" | "recorded" | "none";
+export interface RequirementArtifact extends ArtifactBase {
+    kind: "requirement";
+    detail: {
+        type: "requirements";
+        confidence: RequirementConfidence;
+        lifecycle?: RequirementLifecycle;
+        rows: FrRow[];
+        /** `none` / `modify` / `add` … as recorded; null when not yet known. */
+        specImpact: string | null;
+        sourceDocument?: {
+            documentId: string;
+            title: string;
+        } | null;
+    } | null;
+}
+/**
+ * Merge state. `merged` is a REAL observation (a squash commit carrying
+ * `(#NNN)` on origin/main); `pending` means "not found yet" and re-checks on a
+ * TTL; `unknown` means we could not check at all (no PR marker, no git).
+ * A `pr-link` alone NEVER renders "merged" (CONTRACT §5.3).
+ */
+export type MergeState = "merged" | "pending" | "unknown";
+export interface CommitArtifact extends ArtifactBase {
+    kind: "commit";
+    detail: {
+        type: "commit";
+        commit: string | null;
+        /** The run's plain-language summary line. */
+        message: string | null;
+        prNumber: number | null;
+        prUrl: string | null;
+        merge: MergeState;
+    } | null;
+}
+export type ArtifactDescriptor = SpecArtifact | RequirementArtifact | TestsArtifact | ReviewArtifact | DecisionsArtifact | CommitArtifact | PhaseArtifact | CampaignRunbookArtifact | CampaignProgressArtifact | SubIterateArtifact;
+export type { DecisionEntryView, DecisionsArtifact, ReviewArtifact, ReviewFinding, ReviewRow, ReviewStatus, ReviewType, TestChangeKind, TestFrRef, TestRow, TestsArtifact, } from "./types-slice2.js";
+export type { CampaignProgressArtifact, CampaignProgressDetail, CampaignRunbookArtifact, CampaignSubIterateRow, PhaseArtifact, PhaseDetail, SubIterateArtifact, SubIterateDetail, SubIterateSelection, } from "./types-slice3.js";
+/** Mirrors `../tests-gate.js`'s `GateState` locally, not by import — same
+ *  self-contained-mirror pattern as `run-data-types.ts`/`narrator-record.ts`. */
+export type GateState = "pass" | "fail" | "unknown";
+export interface MissionTests {
+    passed: number | null;
+    total: number | null;
+    /** Host-gated skip count, when the run recorded one; `null` when absent. */
+    skipped: number | null;
+    /** Pre-resolved verdict (`tests-gate.ts`) — consumers must not re-derive pass/fail. */
+    gate: GateState;
+}
+/**
+ * The resolver response. `missionTabVisible: false` occurs ONLY for a validated
+ * custom-actions project (§4 precedence 1) — a malformed or dual-mode actions
+ * file falls back to VISIBLE, because hiding a useful tab on an ambiguous file
+ * is the worse failure (Review-2 GPT #12).
+ */
+export interface MissionContext {
+    schemaVersion: typeof MISSION_CONTEXT_SCHEMA_VERSION;
+    scenario: MissionScenario;
+    missionTabVisible: boolean;
+    /** The ITERATE run id (`iterate-<date>-<slug>`) — never `task.runId`. */
+    runId: string | null;
+    /**
+     * Is this run IN FLIGHT right now? True only when the pointer validated, git
+     * still registers its worktree, the owning task is not terminal, AND the run
+     * has recorded no `work_completed` — either terminal fact ends live-ness even
+     * while the worktree survives. False for every other scenario.
+     *
+     * The client uses it for ONE decision: whether `not_yet_created` means "this
+     * run has no such artifact" (hide it) or "it has not been written YET" (show
+     * it as pending). An `unavailable` artifact NEVER becomes pending.
+     */
+    runLive: boolean;
+    artifacts: ArtifactDescriptor[];
+    /** Feeds the top-right Tests chip. Null when truly absent — never fabricated. */
+    tests: MissionTests | null;
+    /** Feeds the Serves chip: the FIRST fold-resolved `displayFrId`, or null. */
+    servesFrId: string | null;
+    /**
+     * Opaque revision fingerprint of the sources this response was built from.
+     * The detail endpoint re-checks it so a document that changed since the
+     * context response returns `stale` rather than an unrelated body (§5.2).
+     */
+    sourceRev: string;
+}
+/**
+ * The typed durable association persisted onto the task (CONTRACT §5).
+ *
+ * REQUIRED, not optional: the pointer is pruned once the worktree is gone, so
+ * a session observed only after pruning could never be resolved again. Written
+ * ONCE, on the first valid LIVE resolve, as an idempotent compare-and-set under
+ * `proper-lockfile` — never a per-GET side-effect and NOT a cache.
+ *
+ * Deliberately NOT `task.runId`: that field means a pipeline run (`run-xxxxxxxx`)
+ * and overloading it would corrupt the pipeline join (external-review GPT #4).
+ */
+export interface MissionContextAssociation {
+    kind: "iterate";
+    runId: string;
+    observedAt: string;
+    /**
+     * WHERE the identity came from, kept because the two sources carry different
+     * strength: `iterate_active_pointer` is a live server observation,
+     * `transcript_run_id` is this session's own corroborated commit footer,
+     * recovered after the pointer was pruned (run-id-recovery.ts).
+     */
+    source: MissionContextAssociationSource;
+}
+export type MissionContextAssociationSource = "iterate_active_pointer" | "transcript_run_id";
+/**
+ * Type-guard used by the store loader to soft-drop a malformed persisted value.
+ *
+ * `runId` is held to the SAME strict grammar as a pointer-supplied one
+ * (`isSafeRunId`): a persisted association is read back from disk, where it can
+ * be edited by hand or corrupted, and it feeds the same path-building code.
+ * Defense in depth — the downstream guards hold regardless — but this is the
+ * natural place to enforce it (internal code review, MEDIUM).
+ */
+export declare function isMissionContextAssociation(v: unknown): v is MissionContextAssociation;
+//# sourceMappingURL=types.d.ts.map

package/server/dist/core/mission-context/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/types.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC1F,OAAO,KAAK,EACV,wBAAwB,EACxB,uBAAuB,EACvB,aAAa,EACb,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,6EAA6E;AAC7E,eAAO,MAAM,8BAA8B,EAAG,CAAU,CAAC;AAEzD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,SAAS,GACT,UAAU,GACV,UAAU,GACV,OAAO,CAAC;AAEZ,uFAAuF;AACvF,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,GACb,OAAO,CAAC;AAEZ;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,aAAa,GACb,OAAO,GACP,QAAQ,GACR,WAAW,GACX,QAAQ,GAER,OAAO,GAEP,kBAAkB,GAClB,mBAAmB,GACnB,aAAa,CAAC;AAElB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,aAAa,CAAC;IACrB,uEAAuE;IACvE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QACN,IAAI,EAAE,UAAU,CAAC;QACjB;;;;WAIG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB,2DAA2D;QAC3D,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,IAAI,CAAC;CACV;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,kDAAkD;IAClD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6EAA6E;IAC7E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAEnF,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,cAAc,CAAC;QACrB,UAAU,EAAE,qBAAqB,CAAC;QAClC,SAAS,CAAC,EAAE,oBAAoB,CAAC;QACjC,IAAI,EAAE,KAAK,EAAE,CAAC;QACd,wEAAwE;QACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,cAAc,CAAC,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KAC/D,GAAG,IAAI,CAAC;CACV;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,6CAA6C;QAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,KAAK,EAAE,UAAU,CAAC;KACnB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,uBAAuB,GACvB,wBAAwB,GACxB,kBAAkB,CAAC;AAEvB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,SAAS,EACT,YAAY,EACZ,UAAU,EACV,cAAc,EACd,SAAS,EACT,OAAO,EACP,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B;iFACiF;AACjF,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uFAAuF;IACvF,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,OAAO,8BAA8B,CAAC;IACrD,QAAQ,EAAE,eAAe,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;;;;;OASG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,iFAAiF;IACjF,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,6EAA6E;IAC7E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,MAAM,EAAE,+BAA+B,CAAC;CACzC;AAED,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,GAAG,mBAAmB,CAAC;AAO7F;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAWtF"}

package/server/dist/core/mission-context/types.js

@@ -0,0 +1,44 @@
+/*
+ * core/mission-context/types.ts — the versioned MissionContext contract
+ * (campaign 2026-07-18-mission-artifacts, Slice 1; CONTRACT §5 / §6).
+ *
+ * The response is VERSIONED (`schemaVersion`) so a client built against an
+ * older shape can refuse rather than misread (external-review GPT #15).
+ *
+ * Two shapes are load-bearing and deliberately NOT collapsed:
+ *   - `ArtifactState` is FIVE states, not a boolean. "hide-empty" hides only
+ *     `not_applicable` + `not_yet_created`; an expected-but-unresolvable
+ *     artifact renders a compact "currently unavailable" so a data-integrity
+ *     problem never masquerades as "nothing exists" (CONTRACT §6).
+ *   - `ArtifactDescriptor` is a DISCRIMINATED union on `kind`. Not everything
+ *     is a Markdown file — the right panel renders a document, a requirement
+ *     table or commit metadata from the type, never from a guess (§7).
+ */
+import { isSafeRunId } from "./pointer.js";
+/** Bump when a field is removed or re-typed; additive fields do not bump. */
+export const MISSION_CONTEXT_SCHEMA_VERSION = 1;
+const ASSOCIATION_SOURCES = new Set([
+    "iterate_active_pointer",
+    "transcript_run_id",
+]);
+/**
+ * Type-guard used by the store loader to soft-drop a malformed persisted value.
+ *
+ * `runId` is held to the SAME strict grammar as a pointer-supplied one
+ * (`isSafeRunId`): a persisted association is read back from disk, where it can
+ * be edited by hand or corrupted, and it feeds the same path-building code.
+ * Defense in depth — the downstream guards hold regardless — but this is the
+ * natural place to enforce it (internal code review, MEDIUM).
+ */
+export function isMissionContextAssociation(v) {
+    if (!v || typeof v !== "object" || Array.isArray(v))
+        return false;
+    const o = v;
+    return (o.kind === "iterate" &&
+        isSafeRunId(o.runId) &&
+        typeof o.observedAt === "string" &&
+        o.observedAt.length > 0 &&
+        typeof o.source === "string" &&
+        ASSOCIATION_SOURCES.has(o.source));
+}
+//# sourceMappingURL=types.js.map

package/server/dist/core/mission-context/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/mission-context/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAS3C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AA8PzD,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAkC;IACxF,wBAAwB;IACxB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;QACpB,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACvB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAClC,CAAC;AACJ,CAAC"}

package/server/dist/core/mission-context/worktree-roots.d.ts

@@ -0,0 +1,103 @@
+/**
+ * A git invocation returning the process stdout.
+ *
+ * The union return type is deliberate: it lets a SYNC test double
+ * (`(args) => "…"`) satisfy the very same signature the ASYNC production runner
+ * implements, so no injection site had to change when git went async — every
+ * CALLER simply `await`s the result (awaiting a plain string is a no-op).
+ */
+export interface GitRunner {
+    (args: string[], cwd: string): string | Promise<string>;
+}
+/**
+ * Default git invocation: an ARGUMENT ARRAY with `shell: false`, run
+ * ASYNCHRONOUSLY (`execFile`, not `execFileSync`). The sync form blocked the
+ * single-threaded Hono event loop for the entire git call — up to the timeout —
+ * which stalled the embedded-terminal WS frames and the 1 s transcript poll, not
+ * merely the Mission tab that triggered it. No caller string is ever
+ * concatenated into a command line (ADR-044 #9 discipline).
+ */
+export declare const defaultGit: GitRunner;
+/**
+ * Every root this project may read from: the configured project root plus each
+ * worktree git itself reports. Returns just the project root when git is
+ * unavailable or the directory is not a repo — failing CLOSED (a smaller root
+ * set), never open.
+ */
+export declare function readAllowedRoots(projectRoot: string, git?: GitRunner): Promise<string[]>;
+export interface AllowedRootsCacheDeps {
+    git?: GitRunner;
+    /** Injectable clock — real time in production, a fake in the TTL tests. */
+    now?: () => number;
+    ttlMs?: number;
+}
+/**
+ * `readAllowedRoots` behind a short per-projectRoot TTL cache.
+ *
+ * WHY (internal code review, perf). The resolver polls once a second, and
+ * `chosen.root` feeds the `rev` that keys the resolver's own response cache — so
+ * the root set must be computed BEFORE that cache-hit check, and the naive call
+ * spawned `git worktree list --porcelain` on every poll, cache hit or not. Here
+ * a cache hit is a `Map` lookup, not a process spawn.
+ *
+ * The DETAIL endpoint deliberately does NOT use this — its git re-validation of
+ * a minted capability must be point-in-time fresh, and it is a rare user click,
+ * not a 1 s poll, so the spawn there is not worth caching away.
+ */
+export declare function readAllowedRootsCached(projectRoot: string, deps?: AllowedRootsCacheDeps): Promise<string[]>;
+/** Test-only: drop the module-level root-set TTL cache between cases. */
+export declare function _clearRootsCache(): void;
+/**
+ * Choose the root a document should be read from.
+ *
+ * Mid-run the iterate spec lives in the WORKTREE; after Finalize the worktree is
+ * gone and the spec lives in the main root. So: prefer the pointer's
+ * `worktree_path` when — and only when — git confirms it is a registered
+ * worktree of THIS repo; otherwise fall back to the project root. A
+ * `worktree_path` that is not a member is not an error, it is simply not used
+ * (the post-Finalize / pruned case is the common one).
+ */
+export declare function chooseRoot(allowedRoots: string[], worktreePath: string | null | undefined): {
+    root: string;
+    isWorktree: boolean;
+};
+/** True when `worktreePath` is a git-registered worktree of this repo. */
+export declare function isRegisteredWorktree(allowedRoots: string[], worktreePath: string | null | undefined): boolean;
+export type ResolveDocResult = {
+    ok: true;
+    absolute: string;
+    mtimeMs: number;
+    sizeBytes: number;
+} | {
+    ok: false;
+    reason: "not_found" | "denied" | "not_a_file";
+};
+/** `resolveFirstDoc` additionally reports WHICH candidate matched. */
+export type ResolveFirstDocResult = {
+    ok: true;
+    absolute: string;
+    mtimeMs: number;
+    sizeBytes: number;
+    index: number;
+} | {
+    ok: false;
+    reason: "not_found" | "denied" | "not_a_file";
+};
+/** Hard cap on a rendered document — bounds a pathological/corrupt file (§11). */
+export declare const MAX_DOC_BYTES: number;
+/**
+ * Resolve `relParts` (already-validated, known-layout segments) inside `root`.
+ *
+ * Both guards run, in order: `pathGuard` on the string (traversal, absolute
+ * input, Windows drive-hop) and then `realPathGuard` on the on-disk path
+ * (symlink escape). Only after BOTH pass does the caller open the file.
+ */
+export declare function resolveDocIn(root: string, relParts: string[]): ResolveDocResult;
+/**
+ * Try each candidate layout in order and return the first that resolves.
+ * `denied` is NOT swallowed into "not found": a guard rejection is reported so
+ * the artifact can surface `unavailable` (a real integrity signal) instead of
+ * the softer `not_yet_created`.
+ */
+export declare function resolveFirstDoc(root: string, candidates: string[][]): ResolveFirstDocResult;
+//# sourceMappingURL=worktree-roots.d.ts.map

package/server/dist/core/mission-context/worktree-roots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-roots.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/worktree-roots.ts"],"names":[],"mappings":"AA+BA;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,SASxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,SAAsB,GAC1B,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAkBD,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,EAAE,EACtB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CASvC;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EAAE,EACtB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,OAAO,CAGT;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAA;CAAE,CAAC;AAEjE,sEAAsE;AACtE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,eAAO,MAAM,aAAa,QAAkB,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAiB/E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAAE,EAAE,GACrB,qBAAqB,CAcvB"}

package/server/dist/core/mission-context/worktree-roots.js

@@ -0,0 +1,201 @@
+/*
+ * core/mission-context/worktree-roots.ts — the allowed READ-ROOT set and the
+ * only document-resolution path (CONTRACT §5.1 c/d).
+ *
+ * WHY membership and not containment: a relocated worktree legitimately lives
+ * OUTSIDE the project root. VERIFIED 2026-07-17 — the test-traceability-retrofit
+ * iterate relocated its worktree to a sibling `C:\…\wt-traceability-retrofit`
+ * (keys `worktree_relocated_from` / `worktree_relocated_reason`) because the
+ * shared backfill scanner prunes any `.worktrees` path. So a containment test
+ * (`startsWith`, or "is it under projectRoot") would both FALSELY REJECT that
+ * legitimate worktree and FALSELY ACCEPT a hostile sibling directory.
+ *
+ * The authoritative answer comes from git itself:
+ *   git worktree list --porcelain      (arg-array, shell:false, cwd=projectRoot)
+ * A pointer's `worktree_path` is trusted ONLY when it is a MEMBER of that set.
+ *
+ * Document paths are then built from the KNOWN LAYOUT using the already
+ * grammar-validated run_id / slug — never from a pointer-supplied sub-path —
+ * and every read goes through `pathGuard` + `realPathGuard` against the CHOSEN
+ * root, so a symlink swapped in between the descriptor and the read (TOCTOU)
+ * still cannot escape.
+ */
+import { execFile } from "node:child_process";
+import { existsSync, statSync } from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+import { pathGuard, realPathGuard } from "../path-guard.js";
+import { samePath } from "./pointer.js";
+const execFileP = promisify(execFile);
+/**
+ * Default git invocation: an ARGUMENT ARRAY with `shell: false`, run
+ * ASYNCHRONOUSLY (`execFile`, not `execFileSync`). The sync form blocked the
+ * single-threaded Hono event loop for the entire git call — up to the timeout —
+ * which stalled the embedded-terminal WS frames and the 1 s transcript poll, not
+ * merely the Mission tab that triggered it. No caller string is ever
+ * concatenated into a command line (ADR-044 #9 discipline).
+ */
+export const defaultGit = async (args, cwd) => {
+    const { stdout } = await execFileP("git", args, {
+        cwd,
+        encoding: "utf-8",
+        timeout: 5000,
+        windowsHide: true,
+        maxBuffer: 4 * 1024 * 1024,
+    });
+    return stdout;
+};
+/**
+ * Every root this project may read from: the configured project root plus each
+ * worktree git itself reports. Returns just the project root when git is
+ * unavailable or the directory is not a repo — failing CLOSED (a smaller root
+ * set), never open.
+ */
+export async function readAllowedRoots(projectRoot, git = defaultGit) {
+    const roots = [path.resolve(projectRoot)];
+    let out;
+    try {
+        out = await git(["worktree", "list", "--porcelain"], projectRoot);
+    }
+    catch {
+        return roots;
+    }
+    for (const line of out.split(/\r?\n/)) {
+        if (!line.startsWith("worktree "))
+            continue;
+        const p = line.slice("worktree ".length).trim();
+        if (!p)
+            continue;
+        const resolved = path.resolve(p);
+        if (!roots.some((r) => samePath(r, resolved)))
+            roots.push(resolved);
+    }
+    return roots;
+}
+const rootsCache = new Map();
+/**
+ * A few seconds. Worktrees are created/removed only at iterate start/finalize,
+ * so this is far shorter than any real churn interval — a stale entry
+ * self-corrects on the very next poll and never escapes a guard (every read
+ * still re-runs pathGuard + realPathGuard + the doc fingerprint).
+ */
+const ROOTS_TTL_MS = 5_000;
+const ROOTS_CACHE_CAP = 128;
+/**
+ * `readAllowedRoots` behind a short per-projectRoot TTL cache.
+ *
+ * WHY (internal code review, perf). The resolver polls once a second, and
+ * `chosen.root` feeds the `rev` that keys the resolver's own response cache — so
+ * the root set must be computed BEFORE that cache-hit check, and the naive call
+ * spawned `git worktree list --porcelain` on every poll, cache hit or not. Here
+ * a cache hit is a `Map` lookup, not a process spawn.
+ *
+ * The DETAIL endpoint deliberately does NOT use this — its git re-validation of
+ * a minted capability must be point-in-time fresh, and it is a rare user click,
+ * not a 1 s poll, so the spawn there is not worth caching away.
+ */
+export function readAllowedRootsCached(projectRoot, deps = {}) {
+    const now = deps.now ?? Date.now;
+    const ttl = deps.ttlMs ?? ROOTS_TTL_MS;
+    const key = path.resolve(projectRoot);
+    const hit = rootsCache.get(key);
+    if (hit && hit.expiresAt > now())
+        return hit.roots;
+    // Cache the PROMISE, not just the resolved value: concurrent polls (or open
+    // tabs) that all miss during one spawn window then share ONE
+    // `git worktree list --porcelain` instead of each spawning their own
+    // (external code review, openai MEDIUM). `readAllowedRoots` never rejects — it
+    // catches internally and fails closed — so a rejected promise is never cached.
+    const pending = readAllowedRoots(projectRoot, deps.git);
+    if (rootsCache.size >= ROOTS_CACHE_CAP)
+        rootsCache.clear();
+    rootsCache.set(key, { roots: pending, expiresAt: now() + ttl });
+    return pending;
+}
+/** Test-only: drop the module-level root-set TTL cache between cases. */
+export function _clearRootsCache() {
+    rootsCache.clear();
+}
+/**
+ * Choose the root a document should be read from.
+ *
+ * Mid-run the iterate spec lives in the WORKTREE; after Finalize the worktree is
+ * gone and the spec lives in the main root. So: prefer the pointer's
+ * `worktree_path` when — and only when — git confirms it is a registered
+ * worktree of THIS repo; otherwise fall back to the project root. A
+ * `worktree_path` that is not a member is not an error, it is simply not used
+ * (the post-Finalize / pruned case is the common one).
+ */
+export function chooseRoot(allowedRoots, worktreePath) {
+    const projectRoot = allowedRoots[0];
+    if (!worktreePath)
+        return { root: projectRoot, isWorktree: false };
+    const member = allowedRoots.find((r) => samePath(r, worktreePath));
+    if (!member)
+        return { root: projectRoot, isWorktree: false };
+    // A registered-but-vanished worktree (pruned dir, stale git metadata) is
+    // unusable — fall back rather than fail the whole resolve.
+    if (!existsSync(member))
+        return { root: projectRoot, isWorktree: false };
+    return { root: member, isWorktree: !samePath(member, projectRoot) };
+}
+/** True when `worktreePath` is a git-registered worktree of this repo. */
+export function isRegisteredWorktree(allowedRoots, worktreePath) {
+    if (!worktreePath)
+        return false;
+    return allowedRoots.some((r) => samePath(r, worktreePath));
+}
+/** Hard cap on a rendered document — bounds a pathological/corrupt file (§11). */
+export const MAX_DOC_BYTES = 2 * 1024 * 1024;
+/**
+ * Resolve `relParts` (already-validated, known-layout segments) inside `root`.
+ *
+ * Both guards run, in order: `pathGuard` on the string (traversal, absolute
+ * input, Windows drive-hop) and then `realPathGuard` on the on-disk path
+ * (symlink escape). Only after BOTH pass does the caller open the file.
+ */
+export function resolveDocIn(root, relParts) {
+    const rel = relParts.join("/");
+    const guard = pathGuard(root, rel);
+    if (!guard.ok)
+        return { ok: false, reason: "denied" };
+    if (!existsSync(guard.absolute))
+        return { ok: false, reason: "not_found" };
+    const real = realPathGuard(root, guard.absolute);
+    if (!real.ok)
+        return { ok: false, reason: "denied" };
+    let st;
+    try {
+        st = statSync(real.absolute);
+    }
+    catch {
+        return { ok: false, reason: "not_found" };
+    }
+    if (!st.isFile())
+        return { ok: false, reason: "not_a_file" };
+    return { ok: true, absolute: real.absolute, mtimeMs: st.mtimeMs, sizeBytes: st.size };
+}
+/**
+ * Try each candidate layout in order and return the first that resolves.
+ * `denied` is NOT swallowed into "not found": a guard rejection is reported so
+ * the artifact can surface `unavailable` (a real integrity signal) instead of
+ * the softer `not_yet_created`.
+ */
+export function resolveFirstDoc(root, candidates) {
+    let sawDenied = false;
+    for (let i = 0; i < candidates.length; i++) {
+        const r = resolveDocIn(root, candidates[i]);
+        // The INDEX is returned so the caller never has to re-infer which candidate
+        // matched by suffix-comparing a realpath against a pre-canonical path — a
+        // leaf-casing normalisation would silently pick candidates[0] and pair it
+        // with the OTHER file's fingerprint, leaving the node permanently
+        // unopenable behind a misleading "this document has changed"
+        // (internal code review, MEDIUM).
+        if (r.ok)
+            return { ...r, index: i };
+        if (r.reason === "denied")
+            sawDenied = true;
+    }
+    return { ok: false, reason: sawDenied ? "denied" : "not_found" };
+}
+//# sourceMappingURL=worktree-roots.js.map

package/server/dist/core/mission-context/worktree-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-roots.js","sourceRoot":"","sources":["../../../src/core/mission-context/worktree-roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAcxC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAc,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC9C,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;KAC3B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,MAAiB,UAAU;IAE3B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;AACtD;;;;;GAKG;AACH,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,eAAe,GAAG,GAAG,CAAC;AAS5B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAEnD,4EAA4E;IAC5E,6DAA6D;IAC7D,qEAAqE;IACrE,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,IAAI,IAAI,eAAe;QAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IAC3D,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB;IAC9B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,YAAsB,EACtB,YAAuC;IAEvC,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC7D,yEAAyE;IACzE,2DAA2D;IAC3D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAClC,YAAsB,EACtB,YAAuC;IAEvC,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;AAC7D,CAAC;AAWD,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAkB;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE3E,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAErD,IAAI,EAA+B,CAAC;IACpC,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,UAAsB;IAEtB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,kEAAkE;QAClE,6DAA6D;QAC7D,kCAAkC;QAClC,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS,GAAG,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnE,CAAC"}

package/server/dist/core/model-tier-config-reader.d.ts

@@ -0,0 +1,16 @@
+export declare const MODEL_TIER_ROLES: readonly ["plan_review", "review", "finalization", "execution"];
+export type ModelTierRole = (typeof MODEL_TIER_ROLES)[number];
+export type ModelTier = "opus" | "sonnet" | "haiku" | "inherit";
+export type ModelTierSource = "project_config" | "unset";
+export interface EffectiveModelTier {
+    tier: ModelTier;
+    source: ModelTierSource;
+}
+export interface ModelTierConfigReadResult {
+    tiers: Record<ModelTierRole, EffectiveModelTier>;
+    /** A safe, operator-facing warning; it never contains raw config content. */
+    warning?: "model_config_missing" | "model_config_unreadable" | "model_config_invalid";
+}
+export declare function resolveModelConfigRoot(projectPath: string): string | undefined;
+export declare function readModelTierConfig(projectPath: string): ModelTierConfigReadResult;
+//# sourceMappingURL=model-tier-config-reader.d.ts.map

package/server/dist/core/model-tier-config-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-tier-config-reader.d.ts","sourceRoot":"","sources":["../../src/core/model-tier-config-reader.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,gBAAgB,iEAKnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC9D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IACjD,6EAA6E;IAC7E,OAAO,CAAC,EAAE,sBAAsB,GAAG,yBAAyB,GAAG,sBAAsB,CAAC;CACvF;AAWD,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA2C9E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,yBAAyB,CA2BlF"}