@svenroth-ai/shipwright 0.24.7-next.0 → 0.25.0

package/server/dist/test/python-spawn-guard-util.js

@@ -0,0 +1,124 @@
+/*
+ * Shared source-scan helpers for the python-spawn drift guards
+ * (no-direct-python-spawn.test.ts + no-indirect-python-spawn.test.ts,
+ * iterate-2026-08-26-grade-uv-run). Split out once the guard grew past one
+ * check per file — mirrors the walk + comment-strip convention of
+ * no-cross-package-imports.test.ts, but factored so the two guard files don't
+ * duplicate it between themselves.
+ */
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+// server/src/test/ → server/src
+export const SERVER_SRC = resolve(__dirname, "..");
+export function walk(dir, acc = []) {
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        const st = statSync(full);
+        if (st.isDirectory()) {
+            if (entry === "node_modules" || entry === "dist")
+                continue;
+            walk(full, acc);
+        }
+        else if (st.isFile() &&
+            entry.endsWith(".ts") &&
+            !entry.endsWith(".d.ts") &&
+            !entry.endsWith(".test.ts")) {
+            acc.push(full);
+        }
+    }
+    return acc;
+}
+/** `file` relative to server/src, forward-slash normalized — full-path
+ *  match, never a bare basename (a bare basename would let a same-named file
+ *  dropped anywhere else in the tree inherit an allowance it was never
+ *  granted). */
+export function relToServerSrc(file) {
+    return relative(SERVER_SRC, file).split("\\").join("/");
+}
+export function readSource(file) {
+    return readFileSync(file, "utf-8");
+}
+/** Strip block/line comments while preserving line breaks and string
+ *  contents, so a doc-comment mentioning these patterns never false-positives
+ *  while a real `"python3"` spawn literal still matches. */
+export function stripCommentsPreserveLines(src) {
+    let out = "";
+    let i = 0;
+    let inBlock = false;
+    let inLine = false;
+    let inString = null;
+    let escape = false;
+    while (i < src.length) {
+        const ch = src[i];
+        const next = src[i + 1];
+        if (inBlock) {
+            if (ch === "*" && next === "/") {
+                out += "  ";
+                i += 2;
+                inBlock = false;
+                continue;
+            }
+            out += ch === "\n" ? "\n" : " ";
+            i++;
+            continue;
+        }
+        if (inLine) {
+            if (ch === "\n") {
+                out += "\n";
+                inLine = false;
+            }
+            else {
+                out += " ";
+            }
+            i++;
+            continue;
+        }
+        if (inString) {
+            out += ch;
+            if (escape) {
+                escape = false;
+            }
+            else if (ch === "\\") {
+                escape = true;
+            }
+            else if (ch === inString) {
+                inString = null;
+            }
+            i++;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            out += "  ";
+            i += 2;
+            inBlock = true;
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            out += "  ";
+            i += 2;
+            inLine = true;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === "`") {
+            inString = ch;
+            out += ch;
+            i++;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+export function indexToLine(src, index) {
+    let line = 1;
+    for (let i = 0; i < index; i++) {
+        if (src[i] === "\n")
+            line++;
+    }
+    return line;
+}
+//# sourceMappingURL=python-spawn-guard-util.js.map

package/server/dist/test/python-spawn-guard-util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-spawn-guard-util.js","sourceRoot":"","sources":["../../src/test/python-spawn-guard-util.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,gCAAgC;AAChC,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAEnD,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IAClD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,MAAM;gBAAE,SAAS;YAC3D,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClB,CAAC;aAAM,IACL,EAAE,CAAC,MAAM,EAAE;YACX,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YACrB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxB,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC3B,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;gBAGgB;AAChB,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;4DAE4D;AAC5D,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/B,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,OAAO,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAChC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,GAAG,IAAI,IAAI,CAAC;gBACZ,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,GAAG,CAAC;YACb,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,QAAQ,GAAG,EAAqB,CAAC;YACjC,GAAG,IAAI,EAAE,CAAC;YACV,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,KAAa;IACpD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/server/dist/types/org.d.ts

@@ -0,0 +1,115 @@
+import type { Staleness } from "../external/org/cron.js";
+import type { LeadOrgInfoReason } from "../external/org/org-chart-lookup.js";
+export interface OrgChartLeadView {
+    domain: string;
+    name: string;
+    reports_to: string | null;
+    manages: string[];
+    charter_path: string;
+}
+export interface OrgChartView {
+    version: number;
+    po: string;
+    leads: Record<string, OrgChartLeadView>;
+}
+export type UsageResponse = {
+    leadId: string;
+    measured: false;
+} | {
+    leadId: string;
+    measured: true;
+    costUsd: number;
+    runCount: number;
+    windowDays: number;
+    asOf: string;
+};
+export type CadenceUnresolvedReason = LeadOrgInfoReason | "invalid_cron";
+export type LastRunResponse = {
+    leadId: string;
+    measured: false;
+} | {
+    leadId: string;
+    measured: true;
+    lastRunAt: string;
+    sessionId: string;
+    staleness: Staleness | "unknown";
+    thresholdMs: number | null;
+    cadenceMs: number | null;
+    cadenceUnresolvedReason?: CadenceUnresolvedReason;
+};
+export interface BeatRegisterEntryView {
+    sessionId: string;
+    beatId: string;
+    leadId: string;
+    pid: number;
+    startedAt: string;
+    closedAt: string | null;
+}
+export type BeatRegisterHealthResponse = {
+    leadId: string;
+    status: "clear";
+} | {
+    leadId: string;
+    status: "open";
+    entry: BeatRegisterEntryView;
+} | {
+    leadId: string;
+    status: "fault";
+    reason: "duplicate-session-id";
+    sessionId: string;
+    entries: BeatRegisterEntryView[];
+};
+/** The Now block's four states (iterate spec AC-2) — "waiting on you" is
+ *  deliberately absent, see the iterate spec's Design Notes. */
+export type LeadNowState = {
+    state: "running";
+} | {
+    state: "resting";
+    lastRun: {
+        measured: false;
+    } | {
+        measured: true;
+        lastRunAt: string;
+    };
+} | {
+    state: "needs-attention";
+    reason: "duplicate-session";
+} | {
+    state: "not-measured";
+};
+export type LeadRoleView = {
+    measured: false;
+} | {
+    measured: true;
+    text: string;
+};
+export type LeadCadenceView = {
+    measured: false;
+} | {
+    measured: true;
+    text: string;
+    cron: string;
+};
+export interface LeadRosterEntry {
+    leadId: string;
+    domain: string;
+    name: string;
+    reportsTo: string | null;
+    role: LeadRoleView;
+    now: LeadNowState;
+    cadence: LeadCadenceView;
+    usage: UsageResponse;
+}
+export interface LeadsRosterResponse {
+    leads: LeadRosterEntry[];
+}
+export interface AuditLogEntry {
+    raw: string;
+    parsed: Record<string, unknown> | null;
+}
+export interface AuditLogPage {
+    entries: AuditLogEntry[];
+    total: number;
+    nextCursor: number | null;
+}
+//# sourceMappingURL=org.d.ts.map

package/server/dist/types/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../src/types/org.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAS7E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACzC;AAMD,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnC;IACE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAMN,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEzE,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnC;IACE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD,CAAC;AAMN,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAChE;IACE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC,CAAC;AAWN;gEACgE;AAChE,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IACE,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE;QAAE,QAAQ,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE,GACD;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACzD;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAE9B,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAQD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B"}

package/server/dist/types/org.js

@@ -0,0 +1,16 @@
+/*
+ * types/org.ts — canonical TS shapes for the leadwright org-directory route
+ * family (`/api/external/org/*`, and its plain-surface mirror `/api/org/*`,
+ * see `server/src/routes/org.ts`).
+ *
+ * `external/org/*.ts` import their response types from here instead of
+ * declaring them inline, so the secret-gated route and the browser-facing
+ * proxy can never drift on wire shape. Client-side mirrors (`client/src/lib/
+ * orgApi.ts`) are verbatim copies of these — same discipline as
+ * `triage.ts` / `action-schema.ts` (CLAUDE.md rule 7), guarded here by
+ * `org-schema-sync.test.ts`'s union-arm comparison (these are discriminated
+ * unions, not flat interfaces — the flat-interface field-name guard those
+ * two files use does not apply).
+ */
+export {};
+//# sourceMappingURL=org.js.map

package/server/dist/types/org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.js","sourceRoot":"","sources":["../../src/types/org.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipwright-command-center-server",
-  "version": "0.24.7-next.0",
+  "version": "0.25.0",
   "type": "module",
   "scripts": {
     "dev": "tsx watch --env-file-if-exists=../.env.local src/index.ts",