@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/external/actions/upload.js

@@ -0,0 +1,141 @@
+/*
+ * external/actions/upload.ts — POST /api/projects/:id/actions-upload.
+ *
+ * Replaces `<project.path>/.shipwright-webui/actions.json` with a JSON body validated
+ * against the actions schema. Iterate iterate-20260430-actions-upload-ui
+ * (FR-01.27).
+ *
+ * Validation pipeline (rejects with 4xx on first failure):
+ *   1. Project resolvable + has a filesystem path.
+ *   2. Raw body ≤ ACTIONS_UPLOAD_MAX_BYTES.
+ *   3. Body parses as JSON.
+ *   4. checkContractVersion (fail-soft: warns once, never blocks).
+ *   5. validateActionsSchema returns no errors.
+ *
+ * Atomic write: writeFileSync to a sibling tmp path, then renameSync.
+ * Cache: clearActionsCacheForProject() so the next GET /actions reflects
+ * the new file.
+ *
+ * CLAUDE.md DO-NOT regression guard #10: realPathGuard is mandatory on
+ * the destination dir before any write.
+ */
+import { existsSync, mkdirSync, writeFileSync, unlinkSync, renameSync, } from "node:fs";
+import { join } from "node:path";
+import { realPathGuard } from "../../core/path-guard.js";
+import { clearActionsCacheForProject, } from "../../core/project-actions-loader.js";
+import { validateActionsSchema, } from "../../core/actions-schema-validator.js";
+import { checkContractVersion, ACTIONS_SCHEMA_VERSION, } from "../../core/contract-version.js";
+import { ACTIONS_UPLOAD_MAX_BYTES, dryRunTemplate } from "./_helpers.js";
+export function registerActionsUpload(app, deps) {
+    const { getProjectById } = deps;
+    app.post("/api/projects/:id/actions-upload", async (c) => {
+        const id = c.req.param("id");
+        const project = getProjectById?.(id);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId: id }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId: id }, 400);
+        }
+        // Pre-buffer DoS guard — reject before reading the body when the
+        // declared Content-Length already exceeds the cap.
+        const declaredLength = Number(c.req.header("content-length") ?? "");
+        if (Number.isFinite(declaredLength) &&
+            declaredLength > ACTIONS_UPLOAD_MAX_BYTES) {
+            return c.json({
+                error: "payload_too_large",
+                maxBytes: ACTIONS_UPLOAD_MAX_BYTES,
+                size: declaredLength,
+            }, 413);
+        }
+        const raw = await c.req.text();
+        if (raw.length > ACTIONS_UPLOAD_MAX_BYTES) {
+            return c.json({
+                error: "payload_too_large",
+                maxBytes: ACTIONS_UPLOAD_MAX_BYTES,
+                size: raw.length,
+            }, 413);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            return c.json({ error: "invalid_json", detail: String(err).slice(0, 200) }, 400);
+        }
+        // Schema validation requires a structured object — guard against
+        // null / array / scalar before the validator dereferences fields.
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return c.json({ error: "invalid_json", detail: "expected JSON object at top level" }, 400);
+        }
+        // Fail-soft: emits a one-shot warn on console for newer-than-known
+        // schemaVersion, but does not block the upload.
+        checkContractVersion({
+            artefact: ".shipwright-webui/actions.json (upload)",
+            path: project.path,
+            declared: parsed.schemaVersion,
+            knownMax: ACTIONS_SCHEMA_VERSION,
+            fieldName: "schemaVersion",
+        });
+        const errors = validateActionsSchema(parsed);
+        if (errors.length > 0) {
+            return c.json({ error: "schema_validation_failed", errors }, 400);
+        }
+        // Placeholder dry-run — same check the GET /actions route runs against
+        // the loader output.
+        const phaseIds = parsed.phases.map((p) => p.id);
+        for (const action of parsed.actions) {
+            if (!action.command_template)
+                continue;
+            // iterate-2026-06-14-actions-config-ux — pass slash_command so a custom
+            // {task.initial_prompt} action dry-runs without throwing UnknownActionError
+            // → 500 (FR-01.37 fixed get.ts but missed this upload path). try/catch
+            // mirrors get.ts defense-in-depth: a crashing validator returns a typed
+            // 500, never an unhandled throw.
+            try {
+                const errCandidate = dryRunTemplate(action.command_template, action.id, phaseIds, action.slash_command);
+                if (errCandidate) {
+                    return c.json({
+                        error: "invalid_placeholder",
+                        placeholder: errCandidate.placeholder,
+                        actionId: errCandidate.actionId,
+                        template: errCandidate.template,
+                    }, 400);
+                }
+            }
+            catch {
+                return c.json({ error: "template_validation_failed", actionId: action.id }, 500);
+            }
+        }
+        const dir = join(project.path, ".shipwright-webui");
+        const file = join(dir, "actions.json");
+        const tmp = join(dir, `actions.json.tmp-${process.pid}-${Date.now()}`);
+        try {
+            mkdirSync(dir, { recursive: true });
+            const guard = realPathGuard(project.path, dir);
+            if (!guard.ok) {
+                return c.json({ error: "path_unsafe", reason: guard.reason, path: dir }, 400);
+            }
+            writeFileSync(tmp, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
+            renameSync(tmp, file);
+        }
+        catch (err) {
+            // Best-effort tmp cleanup — ignore if it is already gone.
+            try {
+                if (existsSync(tmp))
+                    unlinkSync(tmp);
+            }
+            catch {
+                /* swallow */
+            }
+            return c.json({
+                error: "upload_write_failed",
+                detail: String(err).slice(0, 200),
+                path: file,
+            }, 500);
+        }
+        clearActionsCacheForProject(project.path);
+        return c.json({ path: file, written: true });
+    });
+}
+//# sourceMappingURL=upload.js.map

package/server/dist/external/actions/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../../src/external/actions/upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EACL,UAAU,EACV,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,2BAA2B,GAE5B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,GAEtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzE,MAAM,UAAU,qBAAqB,CACnC,GAAS,EACT,IAEC;IAED,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAEhC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,EAAE,EACpD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,mDAAmD;QACnD,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/B,cAAc,GAAG,wBAAwB,EACzC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,cAAc;aACrB,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,wBAAwB;gBAClC,IAAI,EAAE,GAAG,CAAC,MAAM;aACjB,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAC5D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,kEAAkE;QAClE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,mCAAmC,EAAE,EACtE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,gDAAgD;QAChD,oBAAoB,CAAC;YACnB,QAAQ,EAAE,yCAAyC;YACnD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,MAAM,CAAC,aAAa;YAC9B,QAAQ,EAAE,sBAAsB;YAChC,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAkB,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,uEAAuE;QACvE,qBAAqB;QACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAAE,SAAS;YACvC,wEAAwE;YACxE,4EAA4E;YAC5E,uEAAuE;YACvE,wEAAwE;YACxE,iCAAiC;YACjC,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,cAAc,CACjC,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,EAAE,EACT,QAAQ,EACR,MAAM,CAAC,aAAa,CACrB,CAAC;gBACF,IAAI,YAAY,EAAE,CAAC;oBACjB,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,KAAK,EAAE,qBAAqB;wBAC5B,WAAW,EAAE,YAAY,CAAC,WAAW;wBACrC,QAAQ,EAAE,YAAY,CAAC,QAAQ;wBAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;qBAChC,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,EAC5D,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EACzD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YACpE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0DAA0D;YAC1D,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,GAAG,CAAC;oBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACjC,IAAI,EAAE,IAAI;aACX,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/compliance/routes.d.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import { type ComplianceReadResult } from "../../core/compliance-reader.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface ComplianceRouterDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+    readCompliance?: (projectPath: string) => Promise<ComplianceReadResult>;
+}
+export declare function createComplianceRouter(deps: ComplianceRouterDeps): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/server/dist/external/compliance/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/compliance/routes.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACzE;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,CA2BvE"}

package/server/dist/external/compliance/routes.js

@@ -0,0 +1,46 @@
+/*
+ * external/compliance/routes.ts — read-only observer of
+ * `<project.path>/.shipwright/compliance/dashboard.md`.
+ *
+ * Owns: GET /api/external/projects/:projectId/compliance
+ *
+ * WebUI never writes the dashboard (CLAUDE.md rule 12 spirit — the
+ * shipwright-compliance plugin owns every mutation). No POST/PATCH/PUT/DELETE
+ * handler exists; Hono 404s undeclared method-on-known-path.
+ *
+ * Response shapes (discriminated on `status`):
+ *   { status: "ok", grade, score, verdict, generatedAt,
+ *     controlVerdictMarkdown, ciSecurityMarkdown }
+ *   { status: "missing" }
+ *   { status: "invalid", reason }
+ *
+ * The grade + verdict feed the badge/tooltip; the two markdown slices feed the
+ * detail modal (rendered client-side with react-markdown + remark-gfm).
+ */
+import { Hono } from "hono";
+import { readCompliance as defaultReadCompliance, } from "../../core/compliance-reader.js";
+export function createComplianceRouter(deps) {
+    const app = new Hono();
+    const { getProjectById } = deps;
+    const reader = deps.readCompliance ?? ((p) => defaultReadCompliance(p));
+    app.get("/api/external/projects/:projectId/compliance", async (c) => {
+        const projectId = c.req.param("projectId");
+        const project = getProjectById?.(projectId);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId }, 400);
+        }
+        const result = await reader(project.path);
+        if (result.status === "ok") {
+            return c.json({ status: "ok", ...result.data });
+        }
+        if (result.status === "missing") {
+            return c.json({ status: "missing" });
+        }
+        return c.json({ status: "invalid", reason: result.reason });
+    });
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/server/dist/external/compliance/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/external/compliance/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EACL,cAAc,IAAI,qBAAqB,GAExC,MAAM,iCAAiC,CAAC;AAQzC,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAChC,MAAM,MAAM,GACV,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,GAAG,CAAC,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/external/design-review/__tests__/_helpers.d.ts

@@ -0,0 +1,16 @@
+import { Hono } from "hono";
+import type { ExternalRouteProjectView } from "../../_shared/helpers.js";
+import type { RunConfigReadResult } from "../../../core/run-config-reader.js";
+import type { RunConfigV2, PhaseTask } from "../../../types/run-config-v2.js";
+export declare const PROJECT_ID = "p-test";
+export declare function phaseTask(over: Partial<PhaseTask>): PhaseTask;
+export declare function runConfig(phase_tasks: PhaseTask[]): RunConfigV2;
+export declare const okDesignReader: () => Promise<RunConfigReadResult>;
+/** The exact bytes the emitted viewer's exportFeedback() produces (em-dash,
+ *  Round 1) — the contract shape the Option-B reader parses. */
+export declare const VIEWER_MD: string;
+export declare function makeApp(dir: string, opts?: {
+    reader?: (p: string) => Promise<RunConfigReadResult>;
+    project?: ExternalRouteProjectView | null;
+}): Hono;
+//# sourceMappingURL=_helpers.d.ts.map

package/server/dist/external/design-review/__tests__/_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../../../src/external/design-review/__tests__/_helpers.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE9E,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAe7D;AAED,wBAAgB,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,WAAW,CAgB/D;AAED,eAAO,MAAM,cAAc,QAAO,OAAO,CAAC,mBAAmB,CAKzD,CAAC;AAEL;gEACgE;AAChE,eAAO,MAAM,SAAS,QAgCV,CAAC;AAEb,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrD,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;CACtC,GACL,IAAI,CAeN"}

package/server/dist/external/design-review/__tests__/_helpers.js

@@ -0,0 +1,92 @@
+/*
+ * design-review/__tests__/_helpers.ts — shared fixtures for the three
+ * design-gate handler test files (NOT a *.test.ts, so vitest won't collect it).
+ */
+import { Hono } from "hono";
+import { createDesignReviewRouter } from "../routes.js";
+export const PROJECT_ID = "p-test";
+export function phaseTask(over) {
+    return {
+        phaseTaskId: "ptk-design",
+        phase: "design",
+        splitId: null,
+        sessionUuid: "00000000-0000-4000-8000-000000000000",
+        version: 1,
+        status: "in_progress",
+        title: "Design",
+        slashCommand: "/shipwright-design",
+        prerequisites: [],
+        executionCount: 0,
+        createdAt: "2026-07-10T00:00:00Z",
+        ...over,
+    };
+}
+export function runConfig(phase_tasks) {
+    return {
+        schemaVersion: 2,
+        runId: "run-a1b2c3d4",
+        scope: "full_app",
+        autonomy: "guided",
+        mode: "single_session",
+        deploy_target: "none",
+        pipeline: ["project", "design", "plan", "build", "test", "changelog", "deploy"],
+        runConditions: {},
+        splits_frozen: [],
+        status: "in_progress",
+        completed_phase_task_ids: [],
+        phase_tasks,
+        created_at: "2026-07-10T00:00:00Z",
+    };
+}
+export const okDesignReader = () => Promise.resolve({
+    status: "ok",
+    config: runConfig([phaseTask({ phaseTaskId: "ptk-design" })]),
+    diagnostics: { droppedPhaseTaskIds: [], warnings: [] },
+});
+/** The exact bytes the emitted viewer's exportFeedback() produces (em-dash,
+ *  Round 1) — the contract shape the Option-B reader parses. */
+export const VIEWER_MD = [
+    "# Design Feedback — Round 1",
+    "",
+    "> Exported: 2026-07-10",
+    "",
+    "## Summary",
+    "",
+    "| Status | Count |",
+    "|--------|-------|",
+    "| Approved | 1 |",
+    "| Changes Requested | 1 |",
+    "| Rejected | 0 |",
+    "| Total Reviewed | 2 / 3 |",
+    "",
+    "## Core",
+    "",
+    "### #01 Dashboard — CHANGES",
+    "",
+    "**File:** screens/01-dashboard.html  ",
+    "**FRs:** FR-01.09",
+    "",
+    "Tighten the header spacing.",
+    "",
+    "---",
+    "",
+    "### #02 Settings — APPROVED",
+    "",
+    "**File:** screens/02-settings.html  ",
+    "**FRs:** FR-01.10",
+    "",
+    "---",
+    "",
+].join("\n");
+export function makeApp(dir, opts = {}) {
+    const project = opts.project === undefined
+        ? { id: PROJECT_ID, name: "test", path: dir }
+        : opts.project;
+    const app = new Hono();
+    app.route("/", createDesignReviewRouter({
+        getProjectById: (id) => (project && id === PROJECT_ID ? project : undefined),
+        readRunConfig: opts.reader ?? (async () => ({ status: "missing" })),
+    }));
+    return app;
+}
+//# sourceMappingURL=_helpers.js.map

package/server/dist/external/design-review/__tests__/_helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.js","sourceRoot":"","sources":["../../../../src/external/design-review/__tests__/_helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAKxD,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAEnC,MAAM,UAAU,SAAS,CAAC,IAAwB;IAChD,OAAO;QACL,WAAW,EAAE,YAAY;QACzB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,oBAAoB;QAClC,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,CAAC;QACjB,SAAS,EAAE,sBAAsB;QACjC,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,WAAwB;IAChD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,gBAAgB;QACtB,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;QAC/E,aAAa,EAAE,EAAkC;QACjD,aAAa,EAAE,EAAE;QACjB,MAAM,EAAE,aAAa;QACrB,wBAAwB,EAAE,EAAE;QAC5B,WAAW;QACX,UAAU,EAAE,sBAAsB;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,GAAiC,EAAE,CAC/D,OAAO,CAAC,OAAO,CAAC;IACd,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,SAAS,CAAC,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAC7D,WAAW,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;CACvD,CAAC,CAAC;AAEL;gEACgE;AAChE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,6BAA6B;IAC7B,EAAE;IACF,wBAAwB;IACxB,EAAE;IACF,YAAY;IACZ,EAAE;IACF,oBAAoB;IACpB,oBAAoB;IACpB,kBAAkB;IAClB,2BAA2B;IAC3B,kBAAkB;IAClB,4BAA4B;IAC5B,EAAE;IACF,SAAS;IACT,EAAE;IACF,6BAA6B;IAC7B,EAAE;IACF,uCAAuC;IACvC,mBAAmB;IACnB,EAAE;IACF,6BAA6B;IAC7B,EAAE;IACF,KAAK;IACL,EAAE;IACF,6BAA6B;IAC7B,EAAE;IACF,sCAAsC;IACtC,mBAAmB;IACnB,EAAE;IACF,KAAK;IACL,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,UAAU,OAAO,CACrB,GAAW,EACX,OAGI,EAAE;IAEN,MAAM,OAAO,GACX,IAAI,CAAC,OAAO,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,wBAAwB,CAAC;QACvB,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,aAAa,EACX,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAA+B,CAAC;KACrF,CAAC,CACH,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/external/design-review/feedback-write.d.ts

@@ -0,0 +1,7 @@
+import { Hono } from "hono";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface DesignFeedbackWriteDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+}
+export declare function registerDesignFeedbackWrite(app: Hono, deps: DesignFeedbackWriteDeps): void;
+//# sourceMappingURL=feedback-write.d.ts.map

package/server/dist/external/design-review/feedback-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feedback-write.d.ts","sourceRoot":"","sources":["../../../src/external/design-review/feedback-write.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAkB5B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;CACvE;AAMD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CAkGN"}

package/server/dist/external/design-review/feedback-write.js

@@ -0,0 +1,126 @@
+/*
+ * external/design-review/feedback-write.ts —
+ * POST /api/external/projects/:projectId/design-feedback.
+ *
+ * The new (second) project-file write surface. The hosted viewer's Export posts
+ * its contract-shaped markdown to the WebUI host; the host POSTs it here and the
+ * server writes `.shipwright/designs/design-feedback-round{N}.md` into the
+ * worktree (AC2), with:
+ *
+ *   - N computed from the round files already on disk (AC3), NOT the body.
+ *   - the heading round integer normalized to N, every other byte preserved so
+ *     the monorepo Option-B reader still parses it (AC4).
+ *   - a contract guard (`looksLikeDesignFeedback`) — a non-feedback body is 400.
+ *   - `.md` fixed name, size-capped, exclusive create with retry so two tabs
+ *     racing the same N don't clobber a round (plan review R6).
+ *
+ * WebUI writes ONLY this transient scratch file (gitignored, monorepo #355) —
+ * never run_config, run_loop_state, or Claude JSONL.
+ *
+ * Status codes:
+ *   400 path/body missing · not_design_feedback · designs_dir_missing
+ *   404 project_not_found
+ *   409 round_write_contended (lost every exclusive-create retry)
+ *   413 body over the size cap
+ *   500 stat / write failure
+ */
+import { writeFileSync, unlinkSync, existsSync, statSync, readdirSync, } from "node:fs";
+import path from "node:path";
+import { realPathGuard } from "../../core/path-guard.js";
+import { computeNextRound, roundFileName, normalizeRoundHeading, looksLikeDesignFeedback, } from "../../core/design-feedback.js";
+import { MARKDOWN_WRITE_MAX_BYTES, fileFingerprint } from "../file/_helpers.js";
+/** Bounded retry for the two-tab same-N race: recompute N and re-attempt the
+ *  exclusive create. Small because contention is a narrow multi-tab edge. */
+const MAX_ROUND_ATTEMPTS = 8;
+export function registerDesignFeedbackWrite(app, deps) {
+    const { getProjectById } = deps;
+    app.post("/api/external/projects/:projectId/design-feedback", async (c) => {
+        const projectId = c.req.param("projectId");
+        const project = getProjectById?.(projectId);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId }, 400);
+        }
+        // Content-Length precheck before buffering.
+        const declaredLength = Number(c.req.header("content-length") ?? "");
+        if (Number.isFinite(declaredLength) && declaredLength > MARKDOWN_WRITE_MAX_BYTES) {
+            return c.json({ error: "payload_too_large", maxBytes: MARKDOWN_WRITE_MAX_BYTES, size: declaredLength }, 413);
+        }
+        const body = await c.req.text();
+        const byteLen = Buffer.byteLength(body, "utf8");
+        if (byteLen > MARKDOWN_WRITE_MAX_BYTES) {
+            return c.json({ error: "payload_too_large", maxBytes: MARKDOWN_WRITE_MAX_BYTES, size: byteLen }, 413);
+        }
+        if (!looksLikeDesignFeedback(body)) {
+            return c.json({ error: "not_design_feedback" }, 400);
+        }
+        // The designs dir must already exist (the design phase created it). Realpath
+        // it so a symlinked `.shipwright`/`designs` cannot redirect the write.
+        const designsRoot = path.join(project.path, ".shipwright", "designs");
+        let dirStat;
+        try {
+            dirStat = statSync(designsRoot);
+        }
+        catch {
+            return c.json({ error: "designs_dir_missing" }, 400);
+        }
+        if (!dirStat.isDirectory()) {
+            return c.json({ error: "designs_dir_missing" }, 400);
+        }
+        const realDir = realPathGuard(project.path, designsRoot);
+        if (!realDir.ok) {
+            return c.json({ error: "path_traversal", detail: realDir.reason }, 400);
+        }
+        const dir = realDir.absolute;
+        let lastRound = 0;
+        for (let attempt = 0; attempt < MAX_ROUND_ATTEMPTS; attempt++) {
+            let round;
+            try {
+                round = computeNextRound(readdirSync(dir));
+            }
+            catch (err) {
+                return c.json({ error: "readdir_failed", detail: String(err).slice(0, 200) }, 500);
+            }
+            lastRound = round;
+            const fileName = roundFileName(round);
+            const target = path.join(dir, fileName);
+            const normalized = normalizeRoundHeading(body, round);
+            const nextBuf = Buffer.from(normalized, "utf8");
+            // Exclusive create WITH content in ONE syscall (review #1): `wx` fails with
+            // EEXIST if another tab already claimed this round (→ recompute N + retry),
+            // and there is never a 0-byte round file on disk (O_EXCL create + the
+            // content write are the same open). O_EXCL also defeats a pre-planted
+            // symlink at the round name.
+            try {
+                writeFileSync(target, nextBuf, { flag: "wx" });
+            }
+            catch (err) {
+                const code = err?.code;
+                if (code === "EEXIST")
+                    continue; // another tab won this round; recompute
+                // Non-EEXIST failure: O_EXCL means any file at `target` is ours — best
+                // effort remove a partial before surfacing the error.
+                try {
+                    if (existsSync(target))
+                        unlinkSync(target);
+                }
+                catch {
+                    /* swallow */
+                }
+                return c.json({ error: "write_failed", detail: String(err).slice(0, 200) }, 500);
+            }
+            return c.json({
+                written: true,
+                round,
+                path: `.shipwright/designs/${fileName}`,
+                fingerprint: fileFingerprint(nextBuf),
+                size: nextBuf.length,
+            });
+        }
+        // Lost every retry — extreme contention. The client can re-POST.
+        return c.json({ error: "round_write_contended", lastRound }, 409);
+    });
+}
+//# sourceMappingURL=feedback-write.js.map

package/server/dist/external/design-review/feedback-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feedback-write.js","sourceRoot":"","sources":["../../../src/external/design-review/feedback-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,aAAa,EACb,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAOhF;6EAC6E;AAC7E,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,MAAM,UAAU,2BAA2B,CACzC,GAAS,EACT,IAA6B;IAE7B,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAEhC,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,4CAA4C;QAC5C,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,wBAAwB,EAAE,CAAC;YACjF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,EACxF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,wBAAwB,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,EACjF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;QAE7B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACrF,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAEhD,4EAA4E;YAC5E,4EAA4E;YAC5E,sEAAsE;YACtE,sEAAsE;YACtE,6BAA6B;YAC7B,IAAI,CAAC;gBACH,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;gBAClD,IAAI,IAAI,KAAK,QAAQ;oBAAE,SAAS,CAAC,wCAAwC;gBACzE,uEAAuE;gBACvE,sDAAsD;gBACtD,IAAI,CAAC;oBACH,IAAI,UAAU,CAAC,MAAM,CAAC;wBAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa;gBACf,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnF,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,IAAI;gBACb,KAAK;gBACL,IAAI,EAAE,uBAAuB,QAAQ,EAAE;gBACvC,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC;gBACrC,IAAI,EAAE,OAAO,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/design-review/gate.d.ts

@@ -0,0 +1,11 @@
+import { Hono } from "hono";
+import type { RunConfigReadResult } from "../../core/run-config-reader.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface DesignGateDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+    readRunConfig: (projectPath: string) => Promise<RunConfigReadResult>;
+}
+/** `.shipwright/designs/index.html` — the emitted review viewer. */
+export declare function viewerPath(projectPath: string): string;
+export declare function registerDesignGate(app: Hono, deps: DesignGateDeps): void;
+//# sourceMappingURL=gate.d.ts.map

package/server/dist/external/design-review/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/external/design-review/gate.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtE;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAqBxE"}

package/server/dist/external/design-review/gate.js

@@ -0,0 +1,39 @@
+/*
+ * external/design-review/gate.ts —
+ * GET /api/external/projects/:projectId/design-gate.
+ *
+ * Read-only observer that answers "is this run paused at the design
+ * orchestrator-approve gate, with mockups ready to review?" (AC1). Combines the
+ * single-session loop-state (`run-loop-state-reader.ts`) with the run-config
+ * (`readRunConfig`) and the on-disk viewer, all read-only. Never mutates.
+ *
+ * Response: { active, phaseTaskId, phase } (INACTIVE_DESIGN_GATE shape when not
+ * paused-at-design or the viewer is absent).
+ */
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { readLoopState, deriveDesignGate, INACTIVE_DESIGN_GATE, } from "../../core/run-loop-state-reader.js";
+/** `.shipwright/designs/index.html` — the emitted review viewer. */
+export function viewerPath(projectPath) {
+    return path.join(projectPath, ".shipwright", "designs", "index.html");
+}
+export function registerDesignGate(app, deps) {
+    const { getProjectById, readRunConfig } = deps;
+    app.get("/api/external/projects/:projectId/design-gate", async (c) => {
+        const projectId = c.req.param("projectId");
+        const project = getProjectById?.(projectId);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId }, 400);
+        }
+        const cfgResult = await readRunConfig(project.path);
+        const config = cfgResult.status === "ok" ? cfgResult.config : null;
+        const loopState = readLoopState(project.path);
+        const hasViewer = existsSync(viewerPath(project.path));
+        const gate = deriveDesignGate(loopState, config, hasViewer);
+        return c.json(gate ?? INACTIVE_DESIGN_GATE);
+    });
+}
+//# sourceMappingURL=gate.js.map

package/server/dist/external/design-review/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../src/external/design-review/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAS7C,oEAAoE;AACpE,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAS,EAAE,IAAoB;IAChE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/C,GAAG,CAAC,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,oBAAoB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/design-review/routes.d.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import type { RunConfigReadResult } from "../../core/run-config-reader.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface DesignReviewRouterDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+    readRunConfig: (projectPath: string) => Promise<RunConfigReadResult>;
+}
+export declare function createDesignReviewRouter(deps: DesignReviewRouterDeps): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/server/dist/external/design-review/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/design-review/routes.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAM3E"}

package/server/dist/external/design-review/routes.js

@@ -0,0 +1,25 @@
+/*
+ * external/design-review/routes.ts — the single-session design-gate mockup
+ * review surface (iterate-2026-07-10-design-gate-review-host, FR-01.45).
+ *
+ * Mounted by external/routes.ts. Three cohesive, read-mostly handlers:
+ *   - GET  /api/external/projects/:projectId/design-gate        (gate.ts)
+ *   - GET  /api/external/projects/:projectId/designs/:rest{.+}  (serve.ts)
+ *   - POST /api/external/projects/:projectId/design-feedback    (feedback-write.ts)
+ *
+ * The gate + serve handlers are read-only observers; the POST writes ONLY the
+ * transient `design-feedback-round{N}.md` scratch file (never run_config /
+ * run_loop_state / Claude JSONL).
+ */
+import { Hono } from "hono";
+import { registerDesignGate } from "./gate.js";
+import { registerDesignServe } from "./serve.js";
+import { registerDesignFeedbackWrite } from "./feedback-write.js";
+export function createDesignReviewRouter(deps) {
+    const app = new Hono();
+    registerDesignGate(app, deps);
+    registerDesignServe(app, deps);
+    registerDesignFeedbackWrite(app, deps);
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/server/dist/external/design-review/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/external/design-review/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AASlE,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,2BAA2B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/external/design-review/serve.d.ts

@@ -0,0 +1,10 @@
+import { Hono } from "hono";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface DesignServeDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+}
+/** Insert the bridge before the first <script> (so the override is defined
+ *  before the viewer script runs), else before </body>, else append. */
+export declare function injectFeedbackBridge(html: string): string;
+export declare function registerDesignServe(app: Hono, deps: DesignServeDeps): void;
+//# sourceMappingURL=serve.d.ts.map

package/server/dist/external/design-review/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/external/design-review/serve.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;CACvE;AA4DD;wEACwE;AACxE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUzD;AAcD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAsE1E"}