@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/external/_shared/helpers.js

@@ -0,0 +1,231 @@
+/*
+ * external/_shared/helpers.ts — types + constants + utilities shared
+ * across the 9 external/* sub-routers + the registration shell
+ * (server/src/external/routes.ts). Extracted from the historical
+ * monolithic routes.ts during the C2 split (campaign-C-C2).
+ *
+ * Public re-exports of `FILE_MAX_BYTES`, `MIME_BY_EXTENSION`,
+ * `sanitizeContentDispositionFilename`, `clearInboxDeriveCache`, and
+ * `ExternalRouteProjectView` are kept on the shell (./routes.ts) for
+ * back-compat with 14 sibling test files that import from `./routes.js`.
+ */
+import { UNASSIGNED_PROJECT_ID } from "../../core/sdk-sessions-store.js";
+// ---------------------------------------------------------------------------
+// Thresholds + caps
+// ---------------------------------------------------------------------------
+/** Iterate G — task is "active" while its JSONL was mutated this often. */
+export const ACTIVE_IDLE_THRESHOLD_MS = 120_000;
+/** Iterate G — task flips back to "active" if mtime moves within this window. */
+export const IDLE_REACTIVATE_THRESHOLD_MS = 5_000;
+/** Hard cap on user-assigned titles. CLI accepts more, but UI legibility
+ * (TaskBoard cards, terminal title bar) breaks past ~200 chars. */
+export const TITLE_MAX_LENGTH = 200;
+/**
+ * Hard cap on the task description / initial prompt. Originally 20,000
+ * (iterate-2026-05-18-edit-task-dialog) — generous headroom against a
+ * pathological payload, but far above the actual constraint: a task's
+ * description is embedded verbatim as a single-line positional argument
+ * in the launch command (`{task.initial_prompt}` /
+ * `core/actions-substitute.ts`), which the embedded terminal writes to
+ * the pty in one shot. Windows' interactive console line editor
+ * (cmd.exe and PowerShell's console host, both hosted via ConPTY here)
+ * has a well-known ~8,191-character ceiling for a single
+ * interactively-typed/pasted line — past that the line is silently
+ * truncated or the shell chokes on an unbalanced quote, so the command
+ * appears to paste cleanly but Claude never starts. Lowered to 6,000
+ * (iterate-2026-08-13-task-description-length-cap) to leave safe
+ * headroom under that ceiling once the slash command, `--plugin-dir`
+ * args, `--name`, `--session-id` and shell-quoting overhead are added
+ * alongside it — while still comfortably fitting real briefs (pasted
+ * errors, file references, triage findings).
+ */
+export const DESCRIPTION_MAX_LENGTH = 6_000;
+// ---------------------------------------------------------------------------
+// Live-session augmentation helpers (Iterate G ADR-095 + ADR-102).
+// ---------------------------------------------------------------------------
+/**
+ * ADR-095 — augment a serialized task with `liveSession`, derived from
+ * `ptyManager.get(taskId) !== undefined`. Defensive: handles undefined /
+ * null input (returns it unchanged) so callers that already 404'd can
+ * still pass-through. Returns a shallow clone.
+ */
+export function withLiveSession(task, ptyManager) {
+    if (!task)
+        return task;
+    return {
+        ...task,
+        liveSession: ptyManager.get(task.taskId) !== undefined,
+    };
+}
+/**
+ * ADR-102 — response-only override of `lastJsonlSeenMtimeMs` with a LIVE
+ * JSONL mtime. Not persisted — mirrors withLiveSession.
+ */
+export function withLiveJsonlMtime(task, liveMtimeMs) {
+    return liveMtimeMs != null
+        ? { ...task, lastJsonlSeenMtimeMs: liveMtimeMs }
+        : task;
+}
+// ---------------------------------------------------------------------------
+// Parameter parsing helpers
+// ---------------------------------------------------------------------------
+/** Safe positive-int parser for query params. */
+export function parseIntSafe(value, fallback) {
+    if (!value)
+        return fallback;
+    const n = Number.parseInt(value, 10);
+    return Number.isFinite(n) && n >= 0 ? n : fallback;
+}
+// ---------------------------------------------------------------------------
+// Project-id validation (Section 02 iterate 3)
+// ---------------------------------------------------------------------------
+/**
+ * Section 02 (iterate 3) — projectId validation.
+ *
+ * Returns a structured error body on rejection, or null when the id is
+ * acceptable. The reserved UNASSIGNED_PROJECT_ID sentinel is always
+ * valid (represents the synthesized bucket). If `getKnownProjectIds`
+ * is not wired, every non-sentinel id is rejected — the route demands
+ * explicit validation so a misconfigured server can't silently accept
+ * arbitrary strings.
+ */
+export function validateProjectIdOrError(candidate, getKnownProjectIds) {
+    if (candidate === UNASSIGNED_PROJECT_ID)
+        return null;
+    const known = getKnownProjectIds?.();
+    if (!known || !known.has(candidate)) {
+        return { error: "unknown_project_id", projectId: candidate };
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Description + tags / blockedBy normalization (PATCH + POST tasks parity)
+// ---------------------------------------------------------------------------
+/**
+ * iterate-2026-05-18-edit-task-dialog — shared description normalization
+ * for POST /tasks + PATCH /tasks/:id so create and edit enforce
+ * identical rules (external review HIGH/MED — create/edit parity).
+ * `null` / `undefined` / whitespace-only → cleared (value `undefined`);
+ * a real string is trimmed; over-length → a structured error.
+ */
+export function normalizeDescription(raw) {
+    if (raw === null || raw === undefined)
+        return { ok: true, value: undefined };
+    if (typeof raw !== "string") {
+        return { ok: false, error: "description must be a string" };
+    }
+    if (raw.length > DESCRIPTION_MAX_LENGTH) {
+        return {
+            ok: false,
+            error: `description exceeds ${DESCRIPTION_MAX_LENGTH} characters`,
+        };
+    }
+    const trimmed = raw.trim();
+    return { ok: true, value: trimmed.length > 0 ? trimmed : undefined };
+}
+/**
+ * iterate-2026-08-16-v1-lead-fields-tag-filter — poFeedback normalization.
+ * Structurally mirrors `normalizeDescription` (same trim + cap rule, same
+ * `DESCRIPTION_MAX_LENGTH` constant per the assignment) but is NOT built by
+ * parameterizing that function — `normalizeDescription`'s exact error
+ * string is pinned by `routes.description-length-cap.test.ts` + spec.md.
+ */
+export function normalizePoFeedback(raw) {
+    if (raw === null || raw === undefined)
+        return { ok: true, value: undefined };
+    if (typeof raw !== "string") {
+        return { ok: false, error: "poFeedback must be a string" };
+    }
+    if (raw.length > DESCRIPTION_MAX_LENGTH) {
+        return {
+            ok: false,
+            error: `poFeedback exceeds ${DESCRIPTION_MAX_LENGTH} characters`,
+        };
+    }
+    const trimmed = raw.trim();
+    return { ok: true, value: trimmed.length > 0 ? trimmed : undefined };
+}
+/**
+ * D22 / F27 — canonical task-title validation, shared by PATCH /tasks/:id
+ * (setting a title), POST /tasks, and POST /tasks/:id/fork so all three
+ * enforce the SAME rule set with identical error strings. Mirrors the
+ * launcher's `normalizeTitle` contract: embedded CR/LF break the
+ * single-line `--name` copy-paste flow (uncaught throw → 500 on the next
+ * launch), so they are rejected up-front instead.
+ *
+ * Non-string / newline → "title cannot contain newlines" (PATCH also maps
+ * a non-string title here). Trims to empty → "title cannot be empty".
+ * Over TITLE_MAX_LENGTH → "title exceeds N characters". Otherwise the
+ * trimmed value. Create/fork keep their own synthesized-default fallback
+ * for an ABSENT / blank title and only call this for a provided one.
+ */
+export function normalizeTitle(raw) {
+    if (typeof raw !== "string" || /[\r\n]/.test(raw)) {
+        return { ok: false, error: "title cannot contain newlines" };
+    }
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        return { ok: false, error: "title cannot be empty" };
+    }
+    if (trimmed.length > TITLE_MAX_LENGTH) {
+        return { ok: false, error: `title exceeds ${TITLE_MAX_LENGTH} characters` };
+    }
+    return { ok: true, value: trimmed };
+}
+/**
+ * iterate-2026-05-18-edit-task-dialog — normalize a `tags` / `blockedBy`
+ * PATCH array: keep strings only, trim, drop empties, dedupe (order
+ * preserved). Caller-supplied non-array input is rejected upstream.
+ */
+export function normalizeStringArray(raw) {
+    const out = [];
+    for (const x of raw) {
+        if (typeof x !== "string")
+            continue;
+        const t = x.trim();
+        if (t.length === 0 || out.includes(t))
+            continue;
+        out.push(t);
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Lead-foundation create-time fields (iterate-2026-05-14)
+// ---------------------------------------------------------------------------
+/**
+ * iterate-2026-05-14 lead-foundation-task-schema — leadwright Phase 1,
+ * widened 2026-08-16 (+leadParentTaskId, triage-v1-v4a.md Item 1b).
+ *
+ * Read + soft-drop the 6 user-creatable leadwright fields from a create
+ * or launch body. Mirrors `validateExternalTask`'s per-field tolerance:
+ * malformed shapes are filtered out, the rest survive. Daemon-owned
+ * fields (including `poFeedback` — PATCH-only) are NOT read here.
+ */
+export function readLeadCreateFields(body) {
+    const out = {};
+    if (typeof body.domain === "string" && body.domain.length > 0) {
+        out.domain = body.domain;
+    }
+    if (typeof body.leadParentTaskId === "string" && body.leadParentTaskId.length > 0) {
+        out.leadParentTaskId = body.leadParentTaskId;
+    }
+    if (body.priority === "P0" ||
+        body.priority === "P1" ||
+        body.priority === "P2" ||
+        body.priority === "P3") {
+        out.priority = body.priority;
+    }
+    if (body.complexityHint === "small" ||
+        body.complexityHint === "medium" ||
+        body.complexityHint === "large") {
+        out.complexityHint = body.complexityHint;
+    }
+    if (Array.isArray(body.tags)) {
+        out.tags = body.tags.filter((x) => typeof x === "string");
+    }
+    if (Array.isArray(body.blockedBy)) {
+        out.blockedBy = body.blockedBy.filter((x) => typeof x === "string");
+    }
+    return out;
+}
+//# sourceMappingURL=helpers.js.map

package/server/dist/external/_shared/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/external/_shared/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAgB,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEvF,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAElD;mEACmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAe5C,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAO,EACP,UAA4C;IAI5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAa,CAAC;IAChC,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS;KAC9C,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAO,EACP,WAA+B;IAE/B,OAAO,WAAW,IAAI,IAAI;QACxB,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE;QAChD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,KAAyB,EAAE,QAAgB;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAiB,EACjB,kBAAmD;IAEnD,IAAI,SAAS,KAAK,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAY;IAEZ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC7E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB,sBAAsB,aAAa;SAClE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAY;IAEZ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC7E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,sBAAsB,sBAAsB,aAAa;SACjE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAY;IAEZ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,gBAAgB,aAAa,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAc;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS;QAChD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAQhE,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC/C,CAAC;IACD,IACE,IAAI,CAAC,QAAQ,KAAK,IAAI;QACtB,IAAI,CAAC,QAAQ,KAAK,IAAI;QACtB,IAAI,CAAC,QAAQ,KAAK,IAAI;QACtB,IAAI,CAAC,QAAQ,KAAK,IAAI,EACtB,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,CAAC;IACD,IACE,IAAI,CAAC,cAAc,KAAK,OAAO;QAC/B,IAAI,CAAC,cAAc,KAAK,QAAQ;QAChC,IAAI,CAAC,cAAc,KAAK,OAAO,EAC/B,CAAC;QACD,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,GAAI,IAAI,CAAC,IAAkB,CAAC,MAAM,CACxC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,SAAS,GAAI,IAAI,CAAC,SAAuB,CAAC,MAAM,CAClD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/external/actions/_helpers.d.ts

@@ -0,0 +1,15 @@
+import { InvalidPlaceholderError } from "../../core/actions-substitute.js";
+/**
+ * 256 KB cap on `.shipwright-webui/actions.json` upload payloads. The bundled default
+ * is ~5 KB; 256 KB is generous for any legitimate per-project override and
+ * tight enough to refuse accidental binary uploads or copy-paste of huge
+ * files.
+ */
+export declare const ACTIONS_UPLOAD_MAX_BYTES: number;
+/**
+ * Dry-run the substitute pipeline against a template using placeholder-
+ * allowlist-safe values; returns the first placeholder failure, or null.
+ * Shared between the GET /actions route and unit tests.
+ */
+export declare function dryRunTemplate(template: string, actionId: string, phaseIds: string[], slashCommand?: string): InvalidPlaceholderError | null;
+//# sourceMappingURL=_helpers.d.ts.map

package/server/dist/external/actions/_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../../src/external/actions/_helpers.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,uBAAuB,EAGxB,MAAM,kCAAkC,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAAE,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,uBAAuB,GAAG,IAAI,CA0BhC"}

package/server/dist/external/actions/_helpers.js

@@ -0,0 +1,48 @@
+/*
+ * external/actions/_helpers.ts — actions-route helpers extracted from the
+ * historical monolithic routes.ts.
+ */
+import { buildExternalLaunchCommand, InvalidPlaceholderError, UnknownPhaseError, } from "../../core/actions-substitute.js";
+/**
+ * 256 KB cap on `.shipwright-webui/actions.json` upload payloads. The bundled default
+ * is ~5 KB; 256 KB is generous for any legitimate per-project override and
+ * tight enough to refuse accidental binary uploads or copy-paste of huge
+ * files.
+ */
+export const ACTIONS_UPLOAD_MAX_BYTES = 256 * 1024;
+/**
+ * Dry-run the substitute pipeline against a template using placeholder-
+ * allowlist-safe values; returns the first placeholder failure, or null.
+ * Shared between the GET /actions route and unit tests.
+ */
+export function dryRunTemplate(template, actionId, phaseIds, slashCommand) {
+    const ctx = {
+        project: { id: "dry-run", path: "/tmp/dry-run" },
+        task: {
+            uuid: "00000000-0000-0000-0000-000000000000",
+            title: "dry run",
+            phase: phaseIds[0] ?? "dry-run-phase",
+            phase_label: "Dry Run",
+        },
+        pluginDirs: [],
+        allowedPhaseIds: new Set([...phaseIds, "dry-run-phase"]),
+        actionId,
+        // iterate-2026-06-11-custom-action-slash-command — pass the action's
+        // declared slash_command so a custom {task.initial_prompt} template
+        // dry-runs without throwing UnknownActionError (which the GET /actions
+        // route would otherwise surface as a 500). Builtin ids ignore it.
+        slashCommand,
+    };
+    try {
+        buildExternalLaunchCommand({ template, ctx });
+        return null;
+    }
+    catch (err) {
+        if (err instanceof InvalidPlaceholderError)
+            return err;
+        if (err instanceof UnknownPhaseError)
+            return null; // handled at launch time
+        throw err;
+    }
+}
+//# sourceMappingURL=_helpers.js.map

package/server/dist/external/actions/_helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.js","sourceRoot":"","sources":["../../../src/external/actions/_helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,kCAAkC,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,QAAgB,EAChB,QAAkB,EAClB,YAAqB;IAErB,MAAM,GAAG,GAAwB;QAC/B,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE;QAChD,IAAI,EAAE;YACJ,IAAI,EAAE,sCAAsC;YAC5C,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe;YACrC,WAAW,EAAE,SAAS;SACvB;QACD,UAAU,EAAE,EAAE;QACd,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,QAAQ;QACR,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,kEAAkE;QAClE,YAAY;KACb,CAAC;IACF,IAAI,CAAC;QACH,0BAA0B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAuB;YAAE,OAAO,GAAG,CAAC;QACvD,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;QAC5E,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/server/dist/external/actions/get.d.ts

@@ -0,0 +1,8 @@
+import type { Hono } from "hono";
+import type { PreviewProfile } from "../../core/preview-session-manager.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export declare function registerActionsGet(app: Hono, deps: {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+    loadProfile: (profileName: string) => PreviewProfile | null;
+}): void;
+//# sourceMappingURL=get.d.ts.map

package/server/dist/external/actions/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../src/external/actions/get.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAOjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE;IACJ,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;CAC7D,GACA,IAAI,CAsGN"}

package/server/dist/external/actions/get.js

@@ -0,0 +1,96 @@
+/*
+ * external/actions/get.ts — GET /api/external/projects/:projectId/actions.
+ *
+ * Resolved actions schema for the project. Falls back to the bundled
+ * default when .shipwright-webui/actions.json is absent; returns diagnostics in-band
+ * when the user file exists but is malformed (O24 chip). Validates every
+ * command_template via the substitute dry-run; unknown placeholder → 400.
+ */
+import { loadActionsForProject } from "../../core/project-actions-loader.js";
+import { validateActionsSchema, } from "../../core/actions-schema-validator.js";
+import { dryRunTemplate } from "./_helpers.js";
+export function registerActionsGet(app, deps) {
+    const { getProjectById, loadProfile } = deps;
+    app.get("/api/external/projects/:projectId/actions", (c) => {
+        const projectId = c.req.param("projectId");
+        const project = getProjectById?.(projectId);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId }, 404);
+        }
+        const loaded = loadActionsForProject(project.path || "");
+        const actions = loaded.actions;
+        // Structural validation (5 O24 cases).
+        const schemaErrors = validateActionsSchema(actions);
+        if (schemaErrors.length > 0) {
+            const first = schemaErrors[0];
+            return c.json({
+                error: first.code,
+                errors: schemaErrors,
+                projectId,
+            }, 400);
+        }
+        // Placeholder-level dry-run validation per action template.
+        for (const a of actions.actions) {
+            if (!a.command_template)
+                continue;
+            const phaseIds = actions.phases.map((p) => p.id);
+            try {
+                const errCandidate = dryRunTemplate(a.command_template, a.id, phaseIds, a.slash_command);
+                if (errCandidate) {
+                    return c.json({
+                        error: "invalid_placeholder",
+                        placeholder: errCandidate.placeholder,
+                        actionId: errCandidate.actionId,
+                        template: errCandidate.template,
+                    }, 400);
+                }
+            }
+            catch {
+                // Defense-in-depth: a crashing template validator should fail
+                // the route rather than expose the raw stack trace.
+                return c.json({ error: "template_validation_failed", actionId: a.id }, 500);
+            }
+        }
+        // Resolve preview.enabled per plan.md § 2.1 precedence:
+        //   Step 1 — profile.stack.frontend present AND dev_server.command
+        //            present → true unless explicitly disabled below.
+        //   Step 2 — actions.preview.enabled:
+        //            "auto"  → follow Step 1.
+        //            true    → only honored if Step 1 also allowed it.
+        //            false   → force off regardless.
+        const profile = project.profile
+            ? loadProfile(project.profile)
+            : null;
+        const profileAllowsPreview = Boolean(profile?.stack?.frontend) &&
+            Boolean(profile?.dev_server?.command);
+        const actionsPref = actions.preview?.enabled;
+        let previewEnabled;
+        if (actionsPref === false) {
+            previewEnabled = false;
+        }
+        else if (actionsPref === true) {
+            previewEnabled = profileAllowsPreview;
+        }
+        else {
+            previewEnabled = profileAllowsPreview;
+        }
+        return c.json({
+            actions: actions.actions,
+            phases: actions.phases,
+            defaults: actions.defaults,
+            preview: {
+                enabled: previewEnabled,
+                command: profile?.dev_server?.command ?? null,
+                port: profile?.dev_server?.port ?? null,
+                ready_path: profile?.dev_server?.ready_path ?? null,
+                ready_timeout_seconds: profile?.dev_server?.ready_timeout_seconds ?? null,
+            },
+            diagnostics: loaded.diagnostics,
+            // FR-01.27 — Settings UI uses this to render the source-state badge
+            // (Custom / Bundled / Malformed). True iff the loader read
+            // `<project.path>/.shipwright-webui/actions.json` successfully.
+            fromUser: loaded.fromUser,
+        });
+    });
+}
+//# sourceMappingURL=get.js.map

package/server/dist/external/actions/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../src/external/actions/get.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EACL,qBAAqB,GAEtB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,UAAU,kBAAkB,CAChC,GAAS,EACT,IAGC;IAED,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAE7C,GAAG,CAAC,GAAG,CAAC,2CAA2C,EAAE,CAAC,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,uCAAuC;QACvC,MAAM,YAAY,GAAkB,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,YAAY;gBACpB,SAAS;aACV,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,CAAC,gBAAgB;gBAAE,SAAS;YAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,cAAc,CACjC,CAAC,CAAC,gBAAgB,EAClB,CAAC,CAAC,EAAE,EACJ,QAAQ,EACR,CAAC,CAAC,aAAa,CAChB,CAAC;gBACF,IAAI,YAAY,EAAE,CAAC;oBACjB,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,KAAK,EAAE,qBAAqB;wBAC5B,WAAW,EAAE,YAAY,CAAC,WAAW;wBACrC,QAAQ,EAAE,YAAY,CAAC,QAAQ;wBAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;qBAChC,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,oDAAoD;gBACpD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,EACvD,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,mEAAmE;QACnE,8DAA8D;QAC9D,sCAAsC;QACtC,sCAAsC;QACtC,+DAA+D;QAC/D,6CAA6C;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;YAC7B,CAAC,CAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAEnB;YACX,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,oBAAoB,GACxB,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC;YACjC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;QAC7C,IAAI,cAAuB,CAAC;QAC5B,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,cAAc,GAAG,KAAK,CAAC;QACzB,CAAC;aAAM,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YAChC,cAAc,GAAG,oBAAoB,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,oBAAoB,CAAC;QACxC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE;gBACP,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,IAAI;gBAC7C,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,IAAI;gBACvC,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,IAAI;gBACnD,qBAAqB,EAAE,OAAO,EAAE,UAAU,EAAE,qBAAqB,IAAI,IAAI;aAC1E;YACD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,oEAAoE;YACpE,2DAA2D;YAC3D,gEAAgE;YAChE,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/actions/routes.d.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import type { PreviewProfile } from "../../core/preview-session-manager.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface ActionsRouterDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+    loadProfile: (profileName: string) => PreviewProfile | null;
+}
+export declare function createActionsRouter(deps: ActionsRouterDeps): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/server/dist/external/actions/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/actions/routes.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAOtE,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;CAC7D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAOjE"}

package/server/dist/external/actions/routes.js

@@ -0,0 +1,33 @@
+/*
+ * external/actions/routes.ts — actions catalog + actions.json read/write
+ * registration shell.
+ *
+ * Owns:
+ *   GET    /api/external/projects/:projectId/actions
+ *   POST   /api/projects/:id/actions-stub          (NOTE: not /api/external)
+ *   POST   /api/projects/:id/actions-upload        (NOTE: not /api/external)
+ *   DELETE /api/projects/:id/actions-upload        (NOTE: not /api/external)
+ *
+ * Path-prefix split (the only one in the API surface): the writable
+ * endpoints live under `/api/projects/...` deliberately — they aren't
+ * external-launch surface, they're per-project mutation, and the wizard
+ * + Settings UI both expect the shorter prefix. Preserved verbatim
+ * post-split (see _c2_api_baseline.json `note_path_prefix`).
+ *
+ * Per-endpoint handlers split into ./get.ts ./stub.ts ./upload.ts
+ * ./upload-delete.ts to keep each module ≤ 300 LOC.
+ */
+import { Hono } from "hono";
+import { registerActionsGet } from "./get.js";
+import { registerActionsStub } from "./stub.js";
+import { registerActionsUpload } from "./upload.js";
+import { registerActionsUploadDelete } from "./upload-delete.js";
+export function createActionsRouter(deps) {
+    const app = new Hono();
+    registerActionsGet(app, deps);
+    registerActionsStub(app, { getProjectById: deps.getProjectById });
+    registerActionsUpload(app, { getProjectById: deps.getProjectById });
+    registerActionsUploadDelete(app, { getProjectById: deps.getProjectById });
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/server/dist/external/actions/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/external/actions/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAOjE,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,mBAAmB,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,qBAAqB,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACpE,2BAA2B,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/external/actions/stub.d.ts

@@ -0,0 +1,6 @@
+import type { Hono } from "hono";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export declare function registerActionsStub(app: Hono, deps: {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+}): void;
+//# sourceMappingURL=stub.d.ts.map

package/server/dist/external/actions/stub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub.d.ts","sourceRoot":"","sources":["../../../src/external/actions/stub.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAIjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE;IACJ,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;CACvE,GACA,IAAI,CA2CN"}

package/server/dist/external/actions/stub.js

@@ -0,0 +1,51 @@
+/*
+ * external/actions/stub.ts — POST /api/projects/:id/actions-stub.
+ *
+ * Creates `<project.path>/.shipwright-webui/actions.json` as an empty structured stub.
+ * Only called from the wizard's "Custom" branch; idempotent (second call
+ * is a no-op). This is the ONLY write webui performs inside a user's
+ * project path that isn't gated by `realPathGuard`, because the
+ * destination filename is fixed AND the wizard already chose the project
+ * by id (path is server-controlled).
+ */
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+export function registerActionsStub(app, deps) {
+    const { getProjectById } = deps;
+    app.post("/api/projects/:id/actions-stub", (c) => {
+        const id = c.req.param("id");
+        const project = getProjectById?.(id);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId: id }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId: id }, 400);
+        }
+        const dir = join(project.path, ".shipwright-webui");
+        const file = join(dir, "actions.json");
+        try {
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true });
+            if (!existsSync(file)) {
+                const stub = {
+                    $schema: "https://shipwright.dev/schemas/actions.v1.json (see docs/actions.md)",
+                    schemaVersion: 1,
+                    defaults: { autonomy: "guided" },
+                    actions: [],
+                    phases: [],
+                    preview: { enabled: "auto" },
+                };
+                writeFileSync(file, JSON.stringify(stub, null, 2) + "\n", "utf-8");
+            }
+            return c.json({ path: file, created: true });
+        }
+        catch (err) {
+            return c.json({
+                error: "stub_write_failed",
+                detail: String(err).slice(0, 200),
+                path: file,
+            }, 500);
+        }
+    });
+}
+//# sourceMappingURL=stub.js.map

package/server/dist/external/actions/stub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub.js","sourceRoot":"","sources":["../../../src/external/actions/stub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,UAAU,mBAAmB,CACjC,GAAS,EACT,IAEC;IAED,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAEhC,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,EAAE,EACpD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG;oBACX,OAAO,EACL,sEAAsE;oBACxE,aAAa,EAAE,CAAC;oBAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;oBAChC,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,EAAE;oBACV,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;iBAC7B,CAAC;gBACF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACjC,IAAI,EAAE,IAAI;aACX,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/actions/upload-delete.d.ts

@@ -0,0 +1,6 @@
+import type { Hono } from "hono";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export declare function registerActionsUploadDelete(app: Hono, deps: {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+}): void;
+//# sourceMappingURL=upload-delete.d.ts.map

package/server/dist/external/actions/upload-delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-delete.d.ts","sourceRoot":"","sources":["../../../src/external/actions/upload-delete.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAMjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE;IACJ,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;CACvE,GACA,IAAI,CA0CN"}

package/server/dist/external/actions/upload-delete.js

@@ -0,0 +1,46 @@
+/*
+ * external/actions/upload-delete.ts — DELETE /api/projects/:id/actions-upload.
+ *
+ * Reset the project to the bundled default by removing
+ * `<project.path>/.shipwright-webui/actions.json`. Idempotent: returns
+ * `{removed: false}` when the file did not exist.
+ */
+import { existsSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { realPathGuard } from "../../core/path-guard.js";
+import { clearActionsCacheForProject } from "../../core/project-actions-loader.js";
+export function registerActionsUploadDelete(app, deps) {
+    const { getProjectById } = deps;
+    app.delete("/api/projects/:id/actions-upload", (c) => {
+        const id = c.req.param("id");
+        const project = getProjectById?.(id);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId: id }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId: id }, 400);
+        }
+        const file = join(project.path, ".shipwright-webui", "actions.json");
+        if (!existsSync(file)) {
+            clearActionsCacheForProject(project.path);
+            return c.json({ path: file, removed: false });
+        }
+        const guard = realPathGuard(project.path, file);
+        if (!guard.ok) {
+            return c.json({ error: "path_unsafe", reason: guard.reason, path: file }, 400);
+        }
+        try {
+            unlinkSync(file);
+        }
+        catch (err) {
+            return c.json({
+                error: "upload_unlink_failed",
+                detail: String(err).slice(0, 200),
+                path: file,
+            }, 500);
+        }
+        clearActionsCacheForProject(project.path);
+        return c.json({ path: file, removed: true });
+    });
+}
+//# sourceMappingURL=upload-delete.js.map

package/server/dist/external/actions/upload-delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-delete.js","sourceRoot":"","sources":["../../../src/external/actions/upload-delete.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAGnF,MAAM,UAAU,2BAA2B,CACzC,GAAS,EACT,IAEC;IAED,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAEhC,GAAG,CAAC,MAAM,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE;QACnD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,EAAE,EACpD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAC1D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACjC,IAAI,EAAE,IAAI;aACX,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/actions/upload.d.ts

@@ -0,0 +1,6 @@
+import type { Hono } from "hono";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export declare function registerActionsUpload(app: Hono, deps: {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+}): void;
+//# sourceMappingURL=upload.d.ts.map

package/server/dist/external/actions/upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/external/actions/upload.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAuBjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE;IACJ,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;CACvE,GACA,IAAI,CAqJN"}