@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/path-guard.js

@@ -0,0 +1,147 @@
+/*
+ * path-guard.ts — pure traversal guard shared by the tree + file routes
+ * (section 04a, spec § 5.1).
+ *
+ * Rationale: a naive `resolved.startsWith(projectRoot)` check is UNSAFE on
+ * two axes (plan § 4.2, § 7 O8):
+ *   1. sibling-prefix trap — "/projects/repo-ab/secret" starts with
+ *      "/projects/repo-a", so startsWith would let the user escape a
+ *      same-parent sibling project.
+ *   2. Windows case-insensitivity + drive-letter semantics — path.resolve
+ *      can land on a different drive without any leading "..".
+ *
+ * The contract below uses `path.resolve` → `path.relative` and rejects
+ * whenever the resulting relative path starts with ".." as its own segment
+ * (not as a substring — otherwise a legitimate ".." inside a filename
+ * like "..rc.json" would be rejected too; path.relative never produces
+ * such output but the check is still segment-wise for correctness).
+ *
+ * Windows drive-hop attempts are caught via the `absolute_input` branch
+ * (e.g. "D:\\stuff" is absolute by isAbsolute, and on POSIX "/etc/passwd"
+ * trips the same branch).
+ */
+import path from "node:path";
+import { realpathSync } from "node:fs";
+/**
+ * Check whether `relpath` resolves safely under `projectRoot`.
+ *
+ * @param projectRoot Absolute path to the project directory.
+ * @param relpath     User-supplied path. May be "" or "." to mean root.
+ */
+export function pathGuard(projectRoot, relpath) {
+    // Normalize the input. An empty string or "." both mean "project root".
+    const input = relpath ?? "";
+    // 0. Reject null-byte injection. Node's fs layer rejects these with a
+    //    generic ERR_INVALID_ARG_VALUE; catching at the guard boundary gives
+    //    a consistent "traversal"-class error code to the UI.
+    if (input.indexOf("\0") !== -1) {
+        return { ok: false, reason: "traversal" };
+    }
+    // 1. Reject absolute input — prevents /etc/passwd, D:\stuff, C:/foo
+    //    regardless of platform. path.isAbsolute on win32 treats both "/foo"
+    //    and "C:\\foo" as absolute; on POSIX only "/foo".
+    //
+    //    We also check path.win32.isAbsolute explicitly so a POSIX-configured
+    //    test run still rejects "D:\\stuff" as absolute_input — the guard
+    //    must be safe on both hosts. Likewise path.posix.isAbsolute catches
+    //    "/etc/passwd" on a Windows host.
+    if (input.length > 0 &&
+        (path.isAbsolute(input) ||
+            path.win32.isAbsolute(input) ||
+            path.posix.isAbsolute(input))) {
+        return { ok: false, reason: "absolute_input" };
+    }
+    // 2. Resolve the input against the project root. path.resolve normalizes
+    //    "./a/../b" → "b", resolves "..", and on Windows keeps drive letters.
+    const resolvedRoot = path.resolve(projectRoot);
+    const resolved = path.resolve(resolvedRoot, input);
+    // 3. Windows drive-letter change check. On POSIX this is a no-op. On
+    //    Windows, if path.resolve produced a path on a different drive than
+    //    the project root (possible if the input used "\\\\?\\" UNC-style
+    //    prefixes that slipped past isAbsolute), reject.
+    if (process.platform === "win32") {
+        const rootDrive = resolvedRoot.slice(0, 2).toLowerCase();
+        const resolvedDrive = resolved.slice(0, 2).toLowerCase();
+        if (rootDrive.endsWith(":") &&
+            resolvedDrive.endsWith(":") &&
+            rootDrive !== resolvedDrive) {
+            return { ok: false, reason: "drive_change" };
+        }
+    }
+    // 4. The actual traversal check: compute path.relative and ensure the
+    //    result does NOT escape the root. Escape manifests as:
+    //      - rel === ".."                         (exact-match upward)
+    //      - rel starts with ".." + path.sep      (upward-then-deeper)
+    //    We explicitly check path.sep AND "/" because on Windows path.relative
+    //    can return "..\\foo" but a POSIX-style "../foo" is also a valid
+    //    traversal expression.
+    const rel = path.relative(resolvedRoot, resolved);
+    if (rel === ".." ||
+        rel.startsWith(".." + path.sep) ||
+        rel.startsWith("../")) {
+        return { ok: false, reason: "traversal" };
+    }
+    // 5. Defense in depth: if path.relative returned an absolute path, the
+    //    resolved target is on a completely different root. Treat as
+    //    traversal.
+    if (path.isAbsolute(rel)) {
+        return { ok: false, reason: "drive_change" };
+    }
+    return { ok: true, absolute: resolved };
+}
+/**
+ * Follow-up guard that resolves symlinks on disk and re-verifies the result
+ * still lands under the project root. Must be called AFTER `pathGuard` and
+ * ONLY when the path is known to exist (i.e. after a successful stat).
+ *
+ * Rationale (plan § 7 O8 "Symlink escape"):
+ *   path.resolve / path.relative operate on strings, not on the filesystem.
+ *   A malicious project could contain `config -> /etc`, and a request for
+ *   `config/passwd` would pass the string-only pathGuard because the
+ *   textual relative path is "config/passwd". `fs.realpathSync` resolves
+ *   the symlink to `/etc/passwd`, which a re-application of path.relative
+ *   against the project root will reject as a traversal.
+ *
+ * On ENOENT (symlink target missing), we return `symlink_escape` as well —
+ * safer to refuse than to silently succeed when realpath can't verify.
+ * Callers should NOT gate on this failure for the "path doesn't exist"
+ * case — they should have already stat()-ed first.
+ *
+ * Returns the realpath-resolved absolute path on success (the caller may
+ * prefer to read from the realpath rather than the possibly-symlinked
+ * guard.absolute, though in practice fs reads against either produce the
+ * same bytes as long as both land under the root).
+ */
+export function realPathGuard(projectRoot, absoluteInsideRoot) {
+    const resolvedRoot = path.resolve(projectRoot);
+    let realRoot;
+    let realTarget;
+    try {
+        realRoot = realpathSync(resolvedRoot);
+        realTarget = realpathSync(absoluteInsideRoot);
+    }
+    catch {
+        // If either side can't be realpath'd (permissions, race), refuse
+        // rather than proceed with the unverified path.
+        return { ok: false, reason: "symlink_escape" };
+    }
+    // Re-apply the traversal check against the realpath results.
+    if (process.platform === "win32") {
+        const rootDrive = realRoot.slice(0, 2).toLowerCase();
+        const targetDrive = realTarget.slice(0, 2).toLowerCase();
+        if (rootDrive.endsWith(":") &&
+            targetDrive.endsWith(":") &&
+            rootDrive !== targetDrive) {
+            return { ok: false, reason: "symlink_escape" };
+        }
+    }
+    const rel = path.relative(realRoot, realTarget);
+    if (rel === ".." ||
+        rel.startsWith(".." + path.sep) ||
+        rel.startsWith("../") ||
+        path.isAbsolute(rel)) {
+        return { ok: false, reason: "symlink_escape" };
+    }
+    return { ok: true, absolute: realTarget };
+}
+//# sourceMappingURL=path-guard.js.map

package/server/dist/core/path-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-guard.js","sourceRoot":"","sources":["../../src/core/path-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAYvC;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB,EAAE,OAAe;IAC5D,wEAAwE;IACxE,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,CAAC;IAE5B,sEAAsE;IACtE,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,oEAAoE;IACpE,yEAAyE;IACzE,sDAAsD;IACtD,EAAE;IACF,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,sCAAsC;IACtC,IACE,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAC/B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAEnD,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACzD,IACE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvB,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3B,SAAS,KAAK,aAAa,EAC3B,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,2DAA2D;IAC3D,mEAAmE;IACnE,mEAAmE;IACnE,2EAA2E;IAC3E,qEAAqE;IACrE,2BAA2B;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAElD,IACE,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EACrB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,uEAAuE;IACvE,iEAAiE;IACjE,gBAAgB;IAChB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,kBAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAgB,CAAC;IACrB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACtC,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,gDAAgD;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACzD,IACE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,SAAS,KAAK,WAAW,EACzB,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,IACE,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EACpB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC5C,CAAC"}

package/server/dist/core/pr-status.d.ts

@@ -0,0 +1,47 @@
+import { spawnSync } from "node:child_process";
+export type PrState = "open" | "merged" | "closed" | "draft" | "unknown";
+export interface PrStatus {
+    state: PrState;
+    merged: boolean;
+}
+export interface PrUrlParts {
+    owner: string;
+    repo: string;
+    number: number;
+}
+export declare function validatePrUrl(url: unknown): PrUrlParts | null;
+export interface ResolveGhBinDeps {
+    platform?: string;
+    spawnSync?: typeof spawnSync;
+    existsSync?: (p: string) => boolean;
+}
+/**
+ * Resolve an absolute path to the `gh` binary via `where`/`which`
+ * (shell:false). Returns null when gh is not on PATH — the caller then
+ * degrades to { state: "unknown" }. Unlike the claude CLI (a `.cmd` shim),
+ * gh ships as a real `.exe` on Windows, so no shell:true invocation is
+ * ever needed.
+ */
+export declare function resolveGhBin(deps?: ResolveGhBinDeps): string | null;
+export interface GhRunResult {
+    exitCode: number;
+    stdout: string;
+}
+export type GhRunner = (bin: string, args: string[]) => Promise<GhRunResult>;
+export interface FetchPrStatusDeps {
+    run?: GhRunner;
+    resolveBin?: () => string | null;
+    now?: () => number;
+    ttlMs?: number;
+}
+/**
+ * Look up (and cache) a PR's open/merged status. `url` MUST already be
+ * validated by `validatePrUrl` at the route boundary; this function does
+ * not re-validate (it only ever runs gh with the url as a separate argv
+ * member, so an unvalidated url cannot inject — but the route gate is the
+ * documented contract).
+ */
+export declare function fetchPrStatus(url: string, deps?: FetchPrStatusDeps): Promise<PrStatus>;
+/** Test-only: reset the module-level TTL cache between cases. */
+export declare function _clearPrStatusCache(): void;
+//# sourceMappingURL=pr-status.d.ts.map

package/server/dist/core/pr-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-status.d.ts","sourceRoot":"","sources":["../../src/core/pr-status.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAY,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAIzD,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAOD,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAQ7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IAC7B,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,gBAAqB,GAAG,MAAM,GAAG,IAAI,CAuBvE;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAsB7E,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA+BD;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/server/dist/core/pr-status.js

@@ -0,0 +1,157 @@
+/*
+ * core/pr-status.ts — resolve a GitHub PR's open/merged state for the
+ * transcript PrLinkCard (iterate-2026-05-30-pr-card-status, AC3/AC4).
+ *
+ * This is the ONLY external-network reach in webui. It runs
+ *   gh pr view <url> --json state,mergedAt,isDraft
+ * with shell:false (the url is a separate argv member — NEVER interpolated
+ * into a shell line) AFTER validating it is a github.com pull URL. Results
+ * are cached in-memory (60 s TTL) so the 1 s transcript poll does not
+ * hammer GitHub. Every failure mode (gh missing / unauth / offline /
+ * non-zero exit / malformed json / timeout) collapses to
+ * { state: "unknown" }; the card then renders no badge.
+ *
+ * Security: mirrors the ADR-044 #9 spawn discipline — shell:false, no
+ * user string ever reaches a shell. validatePrUrl is the io-boundary gate.
+ */
+import { execFile, spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { platform } from "node:os";
+// https://github.com/<owner>/<repo>/pull/<n>  — owner/repo restricted to
+// GitHub-legal path chars; an optional trailing /…, ?…, #… is tolerated.
+const PR_URL_RE = /^https:\/\/github\.com\/([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+)\/pull\/(\d+)(?:[/?#].*)?$/;
+export function validatePrUrl(url) {
+    if (typeof url !== "string" || url.length === 0 || url.length > 400)
+        return null;
+    if (url.includes("\0"))
+        return null;
+    const m = PR_URL_RE.exec(url);
+    if (!m)
+        return null;
+    const number = Number.parseInt(m[3], 10);
+    if (!Number.isFinite(number) || number <= 0)
+        return null;
+    return { owner: m[1], repo: m[2], number };
+}
+/**
+ * Resolve an absolute path to the `gh` binary via `where`/`which`
+ * (shell:false). Returns null when gh is not on PATH — the caller then
+ * degrades to { state: "unknown" }. Unlike the claude CLI (a `.cmd` shim),
+ * gh ships as a real `.exe` on Windows, so no shell:true invocation is
+ * ever needed.
+ */
+export function resolveGhBin(deps = {}) {
+    const isWin = (deps.platform ?? platform()) === "win32";
+    const sync = deps.spawnSync ?? spawnSync;
+    const exists = deps.existsSync ?? existsSync;
+    try {
+        const lookup = isWin ? "where" : "which";
+        const r = sync(lookup, ["gh"], { encoding: "utf-8", shell: false });
+        if (r.error)
+            return null;
+        const lines = (r.stdout ?? "")
+            .split(/\r?\n/)
+            .map((l) => l.trim())
+            .filter(Boolean)
+            .filter((l) => !/^INFO:/i.test(l)); // drop Windows `where`'s not-found notice
+        let first = lines[0] ?? null;
+        if (isWin) {
+            const exe = lines.find((l) => /\.exe$/i.test(l));
+            if (exe)
+                first = exe;
+        }
+        if (first && exists(first))
+            return first;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+const defaultRunner = (bin, args) => new Promise((resolve) => {
+    execFile(bin, args, { timeout: 6000, windowsHide: true, maxBuffer: 1024 * 1024 }, (err, stdout) => {
+        if (err) {
+            const code = typeof err.code === "number"
+                ? err.code
+                : 1;
+            resolve({ exitCode: code, stdout: stdout ?? "" });
+        }
+        else {
+            resolve({ exitCode: 0, stdout: stdout ?? "" });
+        }
+    });
+});
+const cache = new Map();
+const DEFAULT_TTL_MS = 60_000;
+const CACHE_CAP = 256;
+function mapGhJson(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { state: "unknown", merged: false };
+    }
+    const state = (parsed.state ?? "").toUpperCase();
+    if (state === "MERGED" || parsed.mergedAt) {
+        return { state: "merged", merged: true };
+    }
+    if (state === "CLOSED") {
+        return { state: "closed", merged: false };
+    }
+    if (state === "OPEN") {
+        return { state: parsed.isDraft ? "draft" : "open", merged: false };
+    }
+    return { state: "unknown", merged: false };
+}
+/**
+ * Look up (and cache) a PR's open/merged status. `url` MUST already be
+ * validated by `validatePrUrl` at the route boundary; this function does
+ * not re-validate (it only ever runs gh with the url as a separate argv
+ * member, so an unvalidated url cannot inject — but the route gate is the
+ * documented contract).
+ */
+export async function fetchPrStatus(url, deps = {}) {
+    const now = deps.now ?? Date.now;
+    const ttl = deps.ttlMs ?? DEFAULT_TTL_MS;
+    const cached = cache.get(url);
+    if (cached && cached.expiresAt > now()) {
+        return cached.status;
+    }
+    const bin = (deps.resolveBin ?? (() => resolveGhBin()))();
+    let status;
+    if (!bin) {
+        status = { state: "unknown", merged: false };
+    }
+    else {
+        const run = deps.run ?? defaultRunner;
+        try {
+            // `--` end-of-options separator: even though validatePrUrl anchors the
+            // url to `https://github.com/…` (so it can never start with `-`), the
+            // separator guarantees gh treats the url as the positional <pr> and
+            // never as a flag — defense-in-depth if the validator is ever loosened.
+            const { exitCode, stdout } = await run(bin, [
+                "pr",
+                "view",
+                "--json",
+                "state,mergedAt,isDraft",
+                "--",
+                url,
+            ]);
+            status =
+                exitCode === 0 ? mapGhJson(stdout) : { state: "unknown", merged: false };
+        }
+        catch {
+            status = { state: "unknown", merged: false };
+        }
+    }
+    if (cache.size >= CACHE_CAP)
+        cache.clear(); // bounded — local tool, few PRs
+    cache.set(url, { status, expiresAt: now() + ttl });
+    return status;
+}
+/** Test-only: reset the module-level TTL cache between cases. */
+export function _clearPrStatusCache() {
+    cache.clear();
+}
+//# sourceMappingURL=pr-status.js.map

package/server/dist/core/pr-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-status.js","sourceRoot":"","sources":["../../src/core/pr-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAenC,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,SAAS,GACb,wFAAwF,CAAC;AAE3F,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAyB,EAAE;IACtD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,KAAK,OAAO,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAK,CAAyB,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,KAAK,GAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAY;aACvC,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;QAChF,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,IAAI,GAAG;gBAAE,KAAK,GAAG,GAAG,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,MAAM,aAAa,GAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC5C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,QAAQ,CACN,GAAG,EACH,IAAI,EACJ,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAC5D,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACd,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GACR,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ;gBAClD,CAAC,CAAE,GAAwB,CAAC,IAAI;gBAChC,CAAC,CAAC,CAAC,CAAC;YACR,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAcL,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,MAAuE,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAEzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;QACtC,IAAI,CAAC;YACH,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,wEAAwE;YACxE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE;gBAC1C,IAAI;gBACJ,MAAM;gBACN,QAAQ;gBACR,wBAAwB;gBACxB,IAAI;gBACJ,GAAG;aACJ,CAAC,CAAC;YACH,MAAM;gBACJ,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,gCAAgC;IAC5E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB;IACjC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/server/dist/core/preview-child-lifecycle.d.ts

@@ -0,0 +1,77 @@
+import { spawn as realSpawn } from "node:child_process";
+export interface DrainedStdio {
+    /** The last ~maxChars of interleaved stdout+stderr (UTF-8 decoded). */
+    tail(): string;
+}
+interface DrainableChild {
+    stdout?: NodeJS.ReadableStream | null;
+    stderr?: NodeJS.ReadableStream | null;
+}
+/**
+ * Attach `data` listeners to stdout+stderr so the OS pipe is continuously
+ * drained (prevents the ~64KB pipe-buffer backpressure freeze, F11) while
+ * retaining only a bounded tail for diagnostics. A no-op on the null streams
+ * of a test fake-child.
+ */
+export declare function drainStdio(child: DrainableChild, maxChars?: number): DrainedStdio;
+export interface TreeKillDeps {
+    /** Overrides `process.platform` — lets tests exercise both branches. */
+    platform?: NodeJS.Platform;
+    /** Injected for tests — POSIX process-group signaller. */
+    processKill?: (pid: number, signal?: NodeJS.Signals | number) => void;
+    /** Injected for tests — win32 `taskkill` spawner. */
+    killSpawn?: typeof realSpawn;
+}
+interface KillableChild {
+    pid?: number;
+    kill(signal?: NodeJS.Signals | number): boolean;
+}
+/**
+ * Terminate a child AND its descendants. win32: `taskkill /T /F` (the
+ * `cmd.exe → npm.cmd → node` chain the D03 win32 spawn creates). POSIX: signal
+ * the whole process group via a negative pid (the child leads its own group
+ * because the manager spawns it `detached`). Falls back to a direct
+ * `child.kill` when no pid is available or the group signal throws.
+ */
+export declare function treeKill(child: KillableChild, signal?: NodeJS.Signals, deps?: TreeKillDeps): void;
+interface ExitableChild {
+    exitCode: number | null;
+    once(event: string, listener: (...args: unknown[]) => void): unknown;
+}
+/**
+ * Resolve once the child's `exit` event fires, or after `timeoutMs` as a
+ * bounded escape hatch. Lets a profile-change respawn wait for the old child
+ * to release its port before probing it again (F13).
+ */
+export declare function awaitExit(child: ExitableChild, timeoutMs?: number): Promise<void>;
+export declare function defaultProbePort(port: number): Promise<boolean>;
+/**
+ * Defense: a malicious profile file could set ready_path to something
+ * like `@evil.com/` which, when concatenated into the URL string, would
+ * redirect the readiness probe off-host. We build the URL via the URL
+ * constructor and assert the resolved host is 127.0.0.1 before fetching.
+ */
+export declare function buildReadyUrl(port: number, readyPath: string): URL | null;
+/**
+ * A dev-server port must be a positive integer inside the TCP range (F30). A
+ * missing / zero / non-integer port would otherwise skip the pre-spawn probe
+ * and leave the readiness poll hammering port 0 for the full timeout before it
+ * tree-kills the healthy dev server and misreports preview_timeout.
+ */
+export declare function isValidPort(port: unknown): port is number;
+/**
+ * Build the RETURNED preview URL (the one handed to window.open in the
+ * browser). Mirrors buildReadyUrl's host-pinning (F10): a malicious profile
+ * ready_path like "@evil.com/" — or an absolute "http://evil.com/" — must not
+ * smuggle a new authority into the string. We resolve the path through the URL
+ * constructor against a localhost origin and reject any host drift, preserving
+ * the historical host-only shape for a root path.
+ */
+export declare function buildPreviewUrl(port: number, readyPath: string): string;
+export declare function defaultProbeReady(args: {
+    port: number;
+    readyPath: string;
+    signal: AbortSignal;
+}): Promise<boolean>;
+export {};
+//# sourceMappingURL=preview-child-lifecycle.d.ts.map

package/server/dist/core/preview-child-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-child-lifecycle.d.ts","sourceRoot":"","sources":["../../src/core/preview-child-lifecycle.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAKxD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,IAAI,IAAI,MAAM,CAAC;CAChB;AAED,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,cAAc,EACrB,QAAQ,SAAqB,GAC5B,YAAY,CAiBd;AAED,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC;IACtE,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAED,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACjD;AAUD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,aAAa,EACpB,MAAM,GAAE,MAAM,CAAC,OAAmB,EAClC,IAAI,GAAE,YAAiB,GACtB,IAAI,CAqCN;AAED,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC;CACtE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,EACpB,SAAS,SAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAgBf;AAID,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAczE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAOzD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAcvE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnB"}