@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/external/file/write.d.ts

@@ -0,0 +1,20 @@
+import type { Hono } from "hono";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+export interface MarkdownWriteDeps {
+    getProjectById?: (id: string) => ExternalRouteProjectView | undefined;
+    /**
+     * Injectable `lstat` for the symlink-escape guard (F09), defaulting to
+     * node:fs `lstatSync`. This is a deliberate test seam: file symlinks
+     * cannot be created without elevation (admin / Developer Mode) on Windows
+     * dev hosts, so the guard's rejection branch would otherwise be untestable
+     * there. A fake that reports `isSymbolicLink() === true` gives
+     * deterministic, cross-platform coverage; Linux CI additionally exercises
+     * the real-symlink path end-to-end.
+     */
+    lstatSync?: (path: string) => {
+        isSymbolicLink(): boolean;
+        isFile(): boolean;
+    };
+}
+export declare function registerMarkdownWrite(app: Hono, deps: MarkdownWriteDeps): void;
+//# sourceMappingURL=write.d.ts.map

package/server/dist/external/file/write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../../src/external/file/write.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAYjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAQtE,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,cAAc,IAAI,OAAO,CAAC;QAAC,MAAM,IAAI,OAAO,CAAA;KAAE,CAAC;CAChF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA+J9E"}

package/server/dist/external/file/write.js

@@ -0,0 +1,172 @@
+/*
+ * external/file/write.ts — PUT /api/external/projects/:projectId/file.
+ *
+ * The FIRST project-file write surface (iterate-2026-06-03-smartviewer-markdown-editor,
+ * FR-01.34). Editing happens in the SmartViewer's TipTap rich-editor modal; the
+ * serialized Markdown is written back here. Deliberately narrow:
+ *
+ *   - `.md` / `.markdown` ONLY (extension allowlist) — checked BEFORE touching
+ *     the filesystem. This + the path-guard enforce the forbidden-path rules
+ *     for free: `shipwright_run_config.json` isn't `.md`; `~/.claude` JSONL is
+ *     outside the project root.
+ *   - Target must already EXIST (Phase 1 edits existing docs; no create/rename).
+ *   - Optimistic concurrency via a content-hash `If-Match` precondition — a stale
+ *     fingerprint (e.g. a Claude session edited the same file in the embedded
+ *     terminal) returns 409 instead of silently clobbering the change.
+ *   - Atomic write: tmp in the SAME dir + rename (mirrors actions/upload.ts).
+ *
+ * Authz: this app has no per-request auth by design — it is loopback-bound,
+ * project-scoped (`getProjectById`) and path-guarded, the same posture as the
+ * GET `/file` route and the WS loopback-Origin gate (CLAUDE.md rule 10 / 17).
+ *
+ * Status codes:
+ *   400 traversal / absolute / null-byte / missing path / missing If-Match / not-a-file
+ *   403 symlink_forbidden — the target's final path component is a symlink (F09)
+ *   404 missing project / missing target file
+ *   409 fingerprint_mismatch (If-Match != current content hash)
+ *   413 body over MARKDOWN_WRITE_MAX_BYTES (Content-Length precheck AND byte-accurate post-read)
+ *   415 extension not in the markdown allowlist
+ *   500 stat / read / write failure
+ */
+import { readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, lstatSync, } from "node:fs";
+import { dirname, extname, join } from "node:path";
+import { pathGuard, realPathGuard } from "../../core/path-guard.js";
+import { MARKDOWN_WRITE_MAX_BYTES, MARKDOWN_WRITE_EXTENSIONS, fileFingerprint, unquoteEtag, } from "./_helpers.js";
+export function registerMarkdownWrite(app, deps) {
+    const { getProjectById } = deps;
+    const lstat = deps.lstatSync ?? ((p) => lstatSync(p));
+    app.put("/api/external/projects/:projectId/file", async (c) => {
+        const projectId = c.req.param("projectId");
+        const project = getProjectById?.(projectId);
+        if (!project) {
+            return c.json({ error: "project_not_found", projectId }, 404);
+        }
+        if (!project.path) {
+            return c.json({ error: "project_path_unavailable", projectId }, 400);
+        }
+        const relpath = c.req.query("path");
+        if (!relpath || relpath.length === 0) {
+            return c.json({ error: "path_required" }, 400);
+        }
+        const guard = pathGuard(project.path, relpath);
+        if (!guard.ok) {
+            const err = guard.reason === "traversal" ? "path_traversal" : guard.reason;
+            return c.json({ error: err, detail: guard.reason }, 400);
+        }
+        // Extension allowlist BEFORE any filesystem access — the markdown-only
+        // write surface is the architectural boundary (review #6).
+        const ext = extname(guard.absolute).toLowerCase().slice(1);
+        if (!MARKDOWN_WRITE_EXTENSIONS.has(ext)) {
+            return c.json({ error: "not_markdown", extension: ext || null }, 415);
+        }
+        // Pre-buffer DoS guard — reject before reading the body when the declared
+        // Content-Length already exceeds the cap.
+        const declaredLength = Number(c.req.header("content-length") ?? "");
+        if (Number.isFinite(declaredLength) &&
+            declaredLength > MARKDOWN_WRITE_MAX_BYTES) {
+            return c.json({ error: "payload_too_large", maxBytes: MARKDOWN_WRITE_MAX_BYTES, size: declaredLength }, 413);
+        }
+        const body = await c.req.text();
+        // Byte-accurate cap — NOT string length (multi-byte UTF-8; review #5).
+        const byteLen = Buffer.byteLength(body, "utf8");
+        if (byteLen > MARKDOWN_WRITE_MAX_BYTES) {
+            return c.json({ error: "payload_too_large", maxBytes: MARKDOWN_WRITE_MAX_BYTES, size: byteLen }, 413);
+        }
+        // Target must already exist, must NOT be a symlink at its final path
+        // component, and must be a regular file. lstat does NOT follow the final
+        // component (statSync would), so a `.md`-named symlink is caught HERE.
+        //
+        // F09: the extension allowlist above is checked on the REQUEST path — the
+        // symlink's NAME. A within-root symlink whose target is a non-markdown
+        // file (`notes.md -> shipwright_run_config.json`, `-> package.json`,
+        // `-> scripts/<build-script>`) passes that allowlist AND the realpath
+        // CONTAINMENT check below (the target is inside the root), yet a follow-
+        // through write would land on the target — defeating the markdown-only
+        // write boundary and the read-only run-config invariant (DO-NOT #12),
+        // up to code-execution via a build-script / git-hook target. There is no
+        // legitimate write-through-symlink case on this Phase-1 edit-existing-doc
+        // surface, so we reject any final-component symlink outright with a
+        // distinct 403 (CLAUDE.md rule 10). realPathGuard below is retained as
+        // defense-in-depth for a PARENT-directory symlink that escapes the root.
+        let lst;
+        try {
+            lst = lstat(guard.absolute);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ENOENT") {
+                return c.json({ error: "not_found", path: relpath }, 404);
+            }
+            return c.json({ error: "file_stat_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        if (lst.isSymbolicLink()) {
+            return c.json({ error: "symlink_forbidden", path: relpath }, 403);
+        }
+        if (!lst.isFile()) {
+            return c.json({ error: "not_a_file", path: relpath }, 400);
+        }
+        // Defense-in-depth — realpath re-check catches a parent-directory symlink
+        // that escapes the root (the final component is already known non-symlink).
+        const realGuard = realPathGuard(project.path, guard.absolute);
+        if (!realGuard.ok) {
+            return c.json({ error: "path_traversal", detail: realGuard.reason }, 400);
+        }
+        // TOCTOU hardening (external review, F09): read + rename through the
+        // REQUESTED path, not the realpath. renameSync replaces the final
+        // directory entry and NEVER dereferences a symlink AT that entry, so even
+        // if the final component is swapped to a symlink in the window between the
+        // lstat check above and the rename below, the write lands on (replaces)
+        // the entry itself and can never redirect through the link to its target.
+        // realGuard above still gates containment (a parent-dir symlink escaping
+        // the root is rejected); for a valid non-symlink target it resolves to the
+        // same file, so this is behavior-preserving in the normal case.
+        const target = guard.absolute;
+        // Optimistic concurrency: hash the CURRENT on-disk bytes and compare to the
+        // caller's If-Match. Missing precondition is a hard 400 (never blind-write).
+        const ifMatch = c.req.header("if-match");
+        if (!ifMatch) {
+            return c.json({ error: "precondition_required" }, 400);
+        }
+        let current;
+        try {
+            current = readFileSync(target);
+        }
+        catch (err) {
+            // TOCTOU: the file may have been removed between statSync and here
+            // (external review #7) — treat a vanished target as 404, not 500.
+            const code = err?.code;
+            if (code === "ENOENT") {
+                return c.json({ error: "not_found", path: relpath }, 404);
+            }
+            return c.json({ error: "file_read_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        const currentFingerprint = fileFingerprint(current);
+        if (unquoteEtag(ifMatch) !== currentFingerprint) {
+            return c.json({ error: "fingerprint_mismatch", currentFingerprint }, 409);
+        }
+        // Atomic write: tmp in the SAME directory (cross-device rename + collision
+        // safety, review #3) then rename over the target.
+        const nextBuf = Buffer.from(body, "utf8");
+        const tmp = join(dirname(target), `.md-write.tmp-${process.pid}-${Date.now()}`);
+        try {
+            writeFileSync(tmp, nextBuf);
+            renameSync(tmp, target);
+        }
+        catch (err) {
+            try {
+                if (existsSync(tmp))
+                    unlinkSync(tmp);
+            }
+            catch {
+                /* swallow */
+            }
+            return c.json({ error: "write_failed", detail: String(err).slice(0, 200), path: relpath }, 500);
+        }
+        return c.json({
+            written: true,
+            fingerprint: fileFingerprint(nextBuf),
+            size: nextBuf.length,
+        });
+    });
+}
+//# sourceMappingURL=write.js.map

package/server/dist/external/file/write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.js","sourceRoot":"","sources":["../../../src/external/file/write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,eAAe,EACf,WAAW,GACZ,MAAM,eAAe,CAAC;AAgBvB,MAAM,UAAU,qBAAqB,CAAC,GAAS,EAAE,IAAuB;IACtE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,GAAG,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/B,cAAc,GAAG,wBAAwB,EACzC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,EACxF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,wBAAwB,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,EACjF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,EAAE;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;QAE9B,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,kEAAkE;YAClE,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,2EAA2E;QAC3E,kDAAkD;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,iBAAiB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,GAAG,CAAC;oBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/inbox/_cache.d.ts

@@ -0,0 +1,48 @@
+export interface InboxDeriveCacheEntry {
+    /** Resolved on-disk path — lets us `stat()` directly on warm calls
+     *  instead of rescanning every subdir of ~/.claude/projects via
+     *  findByUuid (the actual hot-spot — the JSONL parse is cheap by
+     *  comparison). Falls back to findByUuid on stat failure. */
+    resolvedPath: string;
+    mtimeMs: number;
+    contentLength: number;
+    dismissedKey: string;
+    /**
+     * Cached inbox rows for this session. Discriminated union (iterate
+     * 2026-05-15 inbox-awaiting-user): `ask_tool` is an unanswered
+     * AskUserQuestion tool_use; `text_question` is a plain-text end-of-turn
+     * question detected by `detectAwaitingUserQuestion`. Text questions carry
+     * NO tool fields — they auto-clear on the next user turn (no dismiss).
+     */
+    entries: Array<{
+        kind: "ask_tool";
+        toolUseId: string;
+        toolName: string;
+        input: unknown;
+        taskTitle: string;
+    } | {
+        kind: "text_question";
+        questionId: string;
+        questionText: string;
+        taskTitle: string;
+    }>;
+    pendingIds: string[];
+}
+export declare const inboxDeriveCache: Map<string, InboxDeriveCacheEntry>;
+/**
+ * Negative-result cache for `findByUuid` misses (Phase A4). Sessions
+ * that haven't materialized on disk yet (e.g. `awaiting_external_start`
+ * tasks where the user hasn't pasted the launch command) previously
+ * triggered a full readdir scan across every subdirectory of
+ * `~/.claude/projects` on EVERY inbox call — the dominant latency
+ * source (60+ sessions × 216 subdir scans).
+ *
+ * With a short TTL we skip the scan for sessions we recently confirmed
+ * don't exist. The TTL is intentionally short so launch → discovery
+ * still converges quickly (~15 s worst case).
+ */
+export declare const NEGATIVE_RESULT_TTL_MS = 15000;
+export declare const inboxNegativeCache: Map<string, number>;
+/** Test helper — drops the per-session inbox caches. */
+export declare function clearInboxDeriveCache(): void;
+//# sourceMappingURL=_cache.d.ts.map

package/server/dist/external/inbox/_cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_cache.d.ts","sourceRoot":"","sources":["../../../src/external/inbox/_cache.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,qBAAqB;IACpC;;;iEAG6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,EAAE,KAAK,CACV;QACE,IAAI,EAAE,UAAU,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,GACD;QACE,IAAI,EAAE,eAAe,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;KACnB,CACJ,CAAC;IACF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,gBAAgB,oCAA2C,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,kBAAkB,qBAA4B,CAAC;AAE5D,wDAAwD;AACxD,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}

package/server/dist/external/inbox/_cache.js

@@ -0,0 +1,46 @@
+/*
+ * external/inbox/_cache.ts — per-session inbox derive cache + negative-result
+ * cache. Extracted from the historical routes.ts during the C2 split.
+ *
+ * Iterate 3 remediation — Phase A4 (BUG 3 fix, 2026-04-20).
+ *
+ * `/api/external/inbox` used to re-parse the entire JSONL for every
+ * tracked task on every request (9–10 s latency against 216 sessions
+ * observed in UAT). The cache below memoizes the derived pending set
+ * keyed by `(sessionUuid, mtimeMs, dismissedKey, contentLength)`.
+ *
+ * - mtimeMs change (new events written) busts the cache naturally.
+ * - dismissedKey busts the cache when the user dismisses an entry so
+ *   the next inbox call reflects the reduced pending set.
+ * - contentLength captures the `lastProcessedByteOffset` we persist to
+ *   the store, so callers see a coherent pair.
+ *
+ * Pattern mirrors `core/project-actions-loader.ts:52-68`. No explicit
+ * invalidation needed; the key tuple naturally covers all cases.
+ *
+ * Module-scoped singletons — shared between the shell (which used to
+ * own them) and the inbox/routes.ts handlers. Sibling test files
+ * continue to import `clearInboxDeriveCache` from `./routes.js` via the
+ * shell's re-export.
+ */
+export const inboxDeriveCache = new Map();
+/**
+ * Negative-result cache for `findByUuid` misses (Phase A4). Sessions
+ * that haven't materialized on disk yet (e.g. `awaiting_external_start`
+ * tasks where the user hasn't pasted the launch command) previously
+ * triggered a full readdir scan across every subdirectory of
+ * `~/.claude/projects` on EVERY inbox call — the dominant latency
+ * source (60+ sessions × 216 subdir scans).
+ *
+ * With a short TTL we skip the scan for sessions we recently confirmed
+ * don't exist. The TTL is intentionally short so launch → discovery
+ * still converges quickly (~15 s worst case).
+ */
+export const NEGATIVE_RESULT_TTL_MS = 15_000;
+export const inboxNegativeCache = new Map();
+/** Test helper — drops the per-session inbox caches. */
+export function clearInboxDeriveCache() {
+    inboxDeriveCache.clear();
+    inboxNegativeCache.clear();
+}
+//# sourceMappingURL=_cache.js.map

package/server/dist/external/inbox/_cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_cache.js","sourceRoot":"","sources":["../../../src/external/inbox/_cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAoCH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAiC,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5D,wDAAwD;AACxD,MAAM,UAAU,qBAAqB;IACnC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACzB,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/server/dist/external/inbox/_derive.d.ts

@@ -0,0 +1,56 @@
+import { SessionWatcher } from "../../core/session-watcher.js";
+import { SdkSessionsStore } from "../../core/sdk-sessions-store.js";
+export type AggregatedEntry = {
+    kind: "ask_tool";
+    taskId: string;
+    sessionUuid: string;
+    taskTitle: string;
+    toolUseId: string;
+    toolName: string;
+    input: unknown;
+    bestEffort: true;
+} | {
+    kind: "text_question";
+    taskId: string;
+    sessionUuid: string;
+    taskTitle: string;
+    questionId: string;
+    questionText: string;
+    bestEffort: true;
+} | {
+    kind: "terminal_prompt";
+    taskId: string;
+    sessionUuid: string;
+    taskTitle: string;
+    promptText: string;
+    bestEffort: true;
+};
+/**
+ * Walk every task in the store, return cached entries on a warm hit
+ * (mtime + dismissed unchanged), otherwise re-read the JSONL +
+ * re-derive. Persists `inbox.pendingToolUseIds` + `lastProcessedByteOffset`
+ * to the store when they drift. Returns the aggregated rows + a flag
+ * telling the caller whether to persist.
+ */
+export declare function deriveInboxFromJsonl(args: {
+    store: SdkSessionsStore;
+    watcher: SessionWatcher;
+}): Promise<{
+    entries: AggregatedEntry[];
+    storeDirty: boolean;
+}>;
+/**
+ * Phase 2 post-pass (iterate-2026-05-18-inbox-terminal-prompts) —
+ * `terminal_prompt`: a waiting picker is on-screen in the embedded
+ * terminal but never appears in the JSONL. Detect it from the live
+ * @xterm/headless mirror. Precedence:
+ *   ask_tool > terminal_prompt > text_question.
+ */
+export declare function appendTerminalPrompts(out: AggregatedEntry[], args: {
+    store: SdkSessionsStore;
+    ptyManager: {
+        get(taskId: string): unknown;
+        peekTerminalText?(taskId: string): string | null;
+    };
+}): void;
+//# sourceMappingURL=_derive.d.ts.map

package/server/dist/external/inbox/_derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_derive.d.ts","sourceRoot":"","sources":["../../../src/external/inbox/_derive.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAO/D,OAAO,EACL,gBAAgB,EAEjB,MAAM,kCAAkC,CAAC;AAS1C,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CAClB,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC;CAClB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;CAClB,CAAC;AAEN;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;CACzB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC,CAyH/D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EAAE,EACtB,IAAI,EAAE;IACJ,KAAK,EAAE,gBAAgB,CAAC;IACxB,UAAU,EAAE;QACV,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7B,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;KAClD,CAAC;CACH,GACA,IAAI,CA2CN"}

package/server/dist/external/inbox/_derive.js

@@ -0,0 +1,231 @@
+/*
+ * external/inbox/_derive.ts — JSONL cold-path derive + terminal_prompt
+ * post-pass for the inbox aggregator. Extracted from the historical
+ * routes.ts to keep `routes.ts` (the inbox shell) ≤ 300 LOC.
+ *
+ * Discriminated union: `ask_tool` > `terminal_prompt` > `text_question`.
+ */
+import { stat } from "node:fs/promises";
+import { parseSessionJsonl } from "../../core/session-parser.js";
+import { deriveSessionInbox, DEFAULT_USER_BLOCKING_TOOLS, } from "../../core/inbox-derive.js";
+import { extractTerminalPrompt } from "../../core/terminal-prompt-detect.js";
+import { inboxDeriveCache, inboxNegativeCache, NEGATIVE_RESULT_TTL_MS, } from "./_cache.js";
+/**
+ * Walk every task in the store, return cached entries on a warm hit
+ * (mtime + dismissed unchanged), otherwise re-read the JSONL +
+ * re-derive. Persists `inbox.pendingToolUseIds` + `lastProcessedByteOffset`
+ * to the store when they drift. Returns the aggregated rows + a flag
+ * telling the caller whether to persist.
+ */
+export async function deriveInboxFromJsonl(args) {
+    const { store, watcher } = args;
+    const out = [];
+    let storeDirty = false;
+    for (const task of store.list()) {
+        // Skip tasks the user has explicitly closed or whose session is
+        // unrecoverable — they cannot grow new pending interactions.
+        if (task.state === "done" || task.state === "launch_failed")
+            continue;
+        const dismissedKey = task.inbox.dismissedToolUseIds
+            .slice()
+            .sort()
+            .join(",");
+        const cached = inboxDeriveCache.get(task.sessionUuid);
+        // Warm-path fastpath (Phase A4): avoid the full findByUuid readdir
+        // scan over every subdir of ~/.claude/projects by stat-ing the
+        // previously resolved path directly.
+        if (cached && (await tryWarmHit(task, cached, dismissedKey, out))) {
+            continue;
+        }
+        // Cold path — either no cache entry, or the cached mtime is stale,
+        // or the cached file is gone. Do the full scan.
+        const negUntil = inboxNegativeCache.get(task.sessionUuid);
+        const nowMs = Date.now();
+        if (negUntil !== undefined && negUntil > nowMs)
+            continue;
+        const loc = await watcher.findByUuid(task.sessionUuid);
+        if (!loc) {
+            inboxNegativeCache.set(task.sessionUuid, nowMs + NEGATIVE_RESULT_TTL_MS);
+            continue;
+        }
+        inboxNegativeCache.delete(task.sessionUuid);
+        // Cold / stale — re-read + re-derive.
+        let content = "";
+        try {
+            const chunk = await watcher.readChunk({
+                sessionUuid: task.sessionUuid,
+                fromByte: 0,
+                expectFingerprint: null,
+                location: loc, // resolved just above — don't walk the projects dir twice
+            });
+            if (chunk.status === "ok")
+                content = chunk.chunk.content;
+        }
+        catch {
+            continue;
+        }
+        const parsed = parseSessionJsonl(content);
+        const result = deriveSessionInbox({
+            events: parsed.events,
+            allowlist: DEFAULT_USER_BLOCKING_TOOLS,
+            dismissed: new Set(task.inbox.dismissedToolUseIds),
+        });
+        const cacheEntries = [];
+        for (const e of result.pending) {
+            cacheEntries.push({
+                kind: "ask_tool",
+                toolUseId: e.toolUseId,
+                toolName: e.toolName,
+                input: e.input,
+                taskTitle: task.title,
+            });
+            out.push({
+                kind: "ask_tool",
+                taskId: task.taskId,
+                sessionUuid: task.sessionUuid,
+                taskTitle: task.title,
+                toolUseId: e.toolUseId,
+                toolName: e.toolName,
+                input: e.input,
+                bestEffort: true,
+            });
+        }
+        if (result.textQuestion) {
+            cacheEntries.push({
+                kind: "text_question",
+                questionId: result.textQuestion.questionId,
+                questionText: result.textQuestion.questionText,
+                taskTitle: task.title,
+            });
+            out.push({
+                kind: "text_question",
+                taskId: task.taskId,
+                sessionUuid: task.sessionUuid,
+                taskTitle: task.title,
+                questionId: result.textQuestion.questionId,
+                questionText: result.textQuestion.questionText,
+                bestEffort: true,
+            });
+        }
+        // Persist the observed pending set so the next restart doesn't
+        // re-derive from scratch for UI latency.
+        const nextPending = result.pending.map((e) => e.toolUseId);
+        if (nextPending.join(",") !== task.inbox.pendingToolUseIds.join(",") ||
+            task.inbox.lastProcessedByteOffset !== content.length) {
+            store.patch(task.taskId, {
+                inbox: {
+                    pendingToolUseIds: nextPending,
+                    dismissedToolUseIds: task.inbox.dismissedToolUseIds,
+                    lastProcessedByteOffset: content.length,
+                },
+            });
+            storeDirty = true;
+        }
+        inboxDeriveCache.set(task.sessionUuid, {
+            resolvedPath: loc.path,
+            mtimeMs: loc.mtimeMs,
+            contentLength: content.length,
+            dismissedKey,
+            entries: cacheEntries,
+            pendingIds: nextPending,
+        });
+    }
+    return { entries: out, storeDirty };
+}
+/**
+ * Phase 2 post-pass (iterate-2026-05-18-inbox-terminal-prompts) —
+ * `terminal_prompt`: a waiting picker is on-screen in the embedded
+ * terminal but never appears in the JSONL. Detect it from the live
+ * @xterm/headless mirror. Precedence:
+ *   ask_tool > terminal_prompt > text_question.
+ */
+export function appendTerminalPrompts(out, args) {
+    const { store, ptyManager } = args;
+    if (!ptyManager.peekTerminalText)
+        return;
+    const peek = ptyManager.peekTerminalText.bind(ptyManager);
+    for (const task of store.list()) {
+        if (task.state === "done" || task.state === "launch_failed")
+            continue;
+        // ask_tool wins outright — never double-surface the same task.
+        if (out.some((e) => e.taskId === task.taskId && e.kind === "ask_tool")) {
+            continue;
+        }
+        let promptText = null;
+        try {
+            const visible = peek(task.taskId);
+            if (visible)
+                promptText = extractTerminalPrompt(visible);
+        }
+        catch (err) {
+            // Best-effort: a mirror read must never break the inbox. But a
+            // silent swallow hides real regressions (external code review
+            // openai-1) — log with task context before falling back.
+            promptText = null;
+            console.warn(JSON.stringify({
+                level: "warn",
+                message: "inbox terminal_prompt detection failed for task",
+                taskId: task.taskId,
+                error: String(err).slice(0, 200),
+            }));
+        }
+        if (!promptText)
+            continue;
+        // terminal_prompt supersedes a JSONL text_question for the same task.
+        const tqIdx = out.findIndex((e) => e.taskId === task.taskId && e.kind === "text_question");
+        if (tqIdx >= 0)
+            out.splice(tqIdx, 1);
+        out.push({
+            kind: "terminal_prompt",
+            taskId: task.taskId,
+            sessionUuid: task.sessionUuid,
+            taskTitle: task.title,
+            promptText,
+            bestEffort: true,
+        });
+    }
+}
+/**
+ * Helper for `deriveInboxFromJsonl`: returns true if the cached entries
+ * were emitted (warm-hit), false to fall through to the cold path.
+ */
+async function tryWarmHit(task, cached, dismissedKey, out) {
+    let currentMtime = null;
+    try {
+        const s = await stat(cached.resolvedPath);
+        currentMtime = s.mtimeMs;
+    }
+    catch {
+        return false;
+    }
+    if (currentMtime !== cached.mtimeMs || cached.dismissedKey !== dismissedKey) {
+        return false;
+    }
+    for (const e of cached.entries) {
+        if (e.kind === "text_question") {
+            out.push({
+                kind: "text_question",
+                taskId: task.taskId,
+                sessionUuid: task.sessionUuid,
+                taskTitle: e.taskTitle,
+                questionId: e.questionId,
+                questionText: e.questionText,
+                bestEffort: true,
+            });
+        }
+        else {
+            out.push({
+                kind: "ask_tool",
+                taskId: task.taskId,
+                sessionUuid: task.sessionUuid,
+                taskTitle: e.taskTitle,
+                toolUseId: e.toolUseId,
+                toolName: e.toolName,
+                input: e.input,
+                bestEffort: true,
+            });
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=_derive.js.map

package/server/dist/external/inbox/_derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_derive.js","sourceRoot":"","sources":["../../../src/external/inbox/_derive.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAM7E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,aAAa,CAAC;AA+BrB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAG1C;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,gEAAgE;QAChE,6DAA6D;QAC7D,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe;YAAE,SAAS;QAEtE,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB;aAChD,KAAK,EAAE;aACP,IAAI,EAAE;aACN,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEtD,mEAAmE;QACnE,+DAA+D;QAC/D,qCAAqC;QACrC,IAAI,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAClE,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,gDAAgD;QAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,KAAK;YAAE,SAAS;QAEzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,sBAAsB,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE5C,sCAAsC;QACtC,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC;gBACpC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,CAAC;gBACX,iBAAiB,EAAE,IAAI;gBACvB,QAAQ,EAAE,GAAG,EAAE,0DAA0D;aAC1E,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;gBAAE,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,2BAA2B;YACtC,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,YAAY,GAAqC,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU;gBAC1C,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,YAAY;gBAC9C,SAAS,EAAE,IAAI,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU;gBAC1C,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,YAAY;gBAC9C,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAED,+DAA+D;QAC/D,yCAAyC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3D,IACE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC,uBAAuB,KAAK,OAAO,CAAC,MAAM,EACrD,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;gBACvB,KAAK,EAAE;oBACL,iBAAiB,EAAE,WAAW;oBAC9B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB;oBACnD,uBAAuB,EAAE,OAAO,CAAC,MAAM;iBACxC;aACF,CAAC,CAAC;YACH,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAED,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,GAAG,CAAC,IAAI;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,YAAY;YACZ,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,WAAW;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAsB,EACtB,IAMC;IAED,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,gBAAgB;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe;YAAE,SAAS;QACtE,+DAA+D;QAC/D,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,OAAO;gBAAE,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,8DAA8D;YAC9D,yDAAyD;YACzD,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,iDAAiD;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACjC,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,sEAAsE;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,CAC9D,CAAC;QACF,IAAI,KAAK,IAAI,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU;YACV,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,IAAkB,EAClB,MAA6B,EAC7B,YAAoB,EACpB,GAAsB;IAEtB,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1C,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,KAAK,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/server/dist/external/inbox/routes.d.ts

@@ -0,0 +1,13 @@
+import { Hono } from "hono";
+import { SessionWatcher } from "../../core/session-watcher.js";
+import { SdkSessionsStore } from "../../core/sdk-sessions-store.js";
+export interface InboxRouterDeps {
+    store: SdkSessionsStore;
+    watcher: SessionWatcher;
+    ptyManager: {
+        get(taskId: string): unknown;
+        peekTerminalText?(taskId: string): string | null;
+    };
+}
+export declare function createInboxRouter(deps: InboxRouterDeps): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/server/dist/external/inbox/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/inbox/routes.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAKpE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE;QACV,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7B,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;KAClD,CAAC;CACH;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA0C7D"}