@svenroth-ai/shipwright 0.25.0 → 0.27.0

package/server/dist/terminal/pty-write-chunker.js

@@ -0,0 +1,234 @@
+/*
+ * pty-write-chunker.ts — UTF-8-safe chunking + same-task write serialization
+ * for a single pty.write() chokepoint (iterate-2026-09-05-terminal-large-
+ * command-chunked-pty-write, FR-01.28).
+ *
+ * WHY THIS MODULE EXISTS. A task's first launch bakes the full task prompt
+ * into the launch command as a `--session-id ... "<prompt>"` argument; a
+ * long prompt produces a multi-KB command, auto-typed into the embedded
+ * terminal in one shot. `PtyManager.write()` used to forward the whole
+ * burst to `entry.pty.write()` in a single call. On macOS, canonical-mode
+ * tty input queues (~1 KiB) hold an unterminated line unread until its
+ * trailing newline arrives, so one write() bigger than the queue blocks
+ * the Node main thread forever waiting for room a blocked event loop can
+ * never free — freezing every other session on the same process.
+ *
+ * This module owns two things that belong together:
+ *
+ *   1. CHUNKING — `chunkUtf8ForPtyWrite` splits a burst into sub-cap,
+ *      UTF-8-safe pieces (never splitting a multi-byte sequence across a
+ *      chunk boundary).
+ *   2. SERIALIZATION — `ChunkedPtyWriter` spaces those pieces out over
+ *      real scheduler ticks so the shell can drain its queue between
+ *      writes, and queues (never interleaves) a second same-task write
+ *      that arrives while a chunked burst is still draining — a keystroke,
+ *      the paste-image path, or a mouse report would otherwise splice
+ *      bytes into the middle of the still-draining first burst.
+ *
+ * Extracted from `pty-manager.ts` (which already carries an ADR-101 bloat
+ * exception) as a cohesive split, mirroring `backpressure-telemetry.ts`'s
+ * precedent: the concern only ever touches an entry's `pty.write()` call
+ * and its own busy/queue bookkeeping, never anything else `PtyManager`
+ * owns, so `ChunkedPtyWriteEntry` below is a narrow structural interface
+ * rather than a dependency on `PtyEntry` itself.
+ *
+ * Six review passes hardened this (unclamped chunk size, mid-drain
+ * interleaving, an unguarded mouse-report path, an uncapped pending queue,
+ * a mutually-recursive drain, a recursive scheduler callback — each fixed
+ * where found). Full history: the run-id's ADR.
+ */
+export const DEFAULT_PTY_WRITE_CHUNK_BYTES = 512;
+export const DEFAULT_PTY_WRITE_CHUNK_DELAY_MS = 5;
+/**
+ * Split `data` into chunks whose UTF-8 byte length is <= maxBytes, never
+ * splitting a multi-byte UTF-8 sequence across a chunk boundary. Exported
+ * for direct unit coverage.
+ */
+export function chunkUtf8ForPtyWrite(data, maxBytes) {
+    const buf = Buffer.from(data, "utf8");
+    if (buf.length === 0)
+        return [data];
+    // Code-review finding (2026-09-05): an unclamped maxBytes <= 0 never lets
+    // `start` advance below, spinning the while-loop forever — exactly the
+    // "whole main thread blocked" failure this chunking exists to eliminate,
+    // just triggered by a bad config value instead of an oversized burst. A
+    // UTF-8 code point is at most 4 bytes, so clamping the floor to 4
+    // guarantees both termination and that a chunk boundary always has room
+    // to land clear of a multi-byte sequence.
+    // External-review finding (2026-09-05, Tier-3): Math.max(4, NaN) is NaN,
+    // so a non-finite maxBytes (misconfiguration, not just <= 0) must also
+    // fall back rather than silently propagate NaN into subarray() below,
+    // which would clamp to an empty first chunk and drop the whole write.
+    const safeMaxBytes = Math.max(4, Number.isFinite(maxBytes) ? Math.floor(maxBytes) : DEFAULT_PTY_WRITE_CHUNK_BYTES);
+    const chunks = [];
+    let start = 0;
+    while (start < buf.length) {
+        let end = Math.min(start + safeMaxBytes, buf.length);
+        // Back off past continuation bytes (0b10xxxxxx) so a multi-byte UTF-8
+        // sequence is never split across a chunk boundary.
+        while (end > start && end < buf.length && (buf[end] & 0xc0) === 0x80) {
+            end--;
+        }
+        if (end === start) {
+            // No valid split point within safeMaxBytes — unreachable for
+            // well-formed UTF-8 given the >=4 floor above, but fail safe by
+            // forcing progress rather than looping forever on malformed input.
+            end = Math.min(start + safeMaxBytes, buf.length);
+        }
+        chunks.push(buf.subarray(start, end).toString("utf8"));
+        start = end;
+    }
+    return chunks;
+}
+/** Falls back to `fallback` for any non-finite or negative input. */
+function normalizeNonNegative(value, fallback) {
+    return value !== undefined && Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+/** Falls back to `fallback` for any non-finite or non-positive input. */
+function normalizePositive(value, fallback) {
+    return value !== undefined && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+/** Serializes and, when oversized, chunks writes to a single pty entry. */
+export class ChunkedPtyWriter {
+    ptyWriteChunkBytes;
+    ptyWriteChunkDelayMs;
+    scheduleChunkWrite;
+    pendingWriteBytesCap;
+    constructor(opts = {}) {
+        // External-review finding (2026-09-05, Tier-3, non-blocking, 2nd pass): a
+        // 0/negative/non-finite ptyWriteChunkBytes made the "at/under cap"
+        // fast-path check disagree with chunkUtf8ForPtyWrite's own 4-byte floor.
+        this.ptyWriteChunkBytes = normalizePositive(opts.ptyWriteChunkBytes, DEFAULT_PTY_WRITE_CHUNK_BYTES);
+        // External-review finding (2026-09-05, Tier-3, non-blocking): a
+        // non-finite/negative delay or cap produced "surprising" behavior
+        // (setTimeout clamping a bad delay; a NaN cap making every `>` comparison
+        // false, so the cap check would never fire and the queue could grow
+        // unboundedly). Normalized at construction so a misconfigured option
+        // degrades to the documented default instead of silently misbehaving.
+        this.ptyWriteChunkDelayMs = normalizeNonNegative(opts.ptyWriteChunkDelayMs, DEFAULT_PTY_WRITE_CHUNK_DELAY_MS);
+        // Code-review finding 3: unref so a lone pending chunk-write timer can't
+        // hold the process open a beat past graceful shutdown.
+        this.scheduleChunkWrite = opts.scheduleChunkWrite ?? ((cb, ms) => { setTimeout(cb, ms).unref?.(); });
+        this.pendingWriteBytesCap = normalizeNonNegative(opts.pendingWriteBytesCap, 1_048_576);
+    }
+    /**
+     * Write `data` to `entry`, chunking it if oversized and queuing it
+     * (rather than executing immediately) if a chunked write for this same
+     * entry is already draining.
+     */
+    write(entry, data) {
+        if (entry.chunkWriteBusy) {
+            const queue = (entry.pendingWrites ??= []);
+            const queuedBytes = entry.pendingWritesBytes ?? 0;
+            const dataBytes = Buffer.byteLength(data, "utf8");
+            // Doubt-review finding (2026-09-05): the queue itself must not become
+            // an unbounded-memory vector. Failing safe means dropping the NEW
+            // write whole (never truncating/corrupting an already-queued item).
+            if (queuedBytes + dataBytes > this.pendingWriteBytesCap) {
+                // eslint-disable-next-line no-console
+                console.warn(`[pty-write-chunker] pendingWrites cap exceeded for a chunked write in flight — dropping a queued write (${dataBytes} bytes)`);
+                return;
+            }
+            queue.push(data);
+            entry.pendingWritesBytes = queuedBytes + dataBytes;
+            return;
+        }
+        this.deliverOrChunk(entry, data);
+    }
+    /**
+     * External-review finding (2026-09-05, Tier-3, BLOCKING, 2nd pass): a
+     * synchronous `scheduleChunkWrite` (a public, injectable option) used to
+     * make `writeNext` recurse into itself once per chunk — same stack-depth
+     * bug as `drainPendingWrites` above, different call site. Trampoline fix:
+     * `step`'s own `for(;;)` loop advances through chunks; a synchronous
+     * reentrant call is caught by `running` and just flags "keep going" for
+     * that loop, while a genuinely async call finds `running` already false
+     * and re-enters fresh, preserving the real event-loop yield.
+     */
+    deliverOrChunk(entry, data) {
+        if (Buffer.byteLength(data, "utf8") <= this.ptyWriteChunkBytes) {
+            entry.pty.write(data);
+            this.drainPendingWrites(entry);
+            return;
+        }
+        entry.chunkWriteBusy = true;
+        const chunks = chunkUtf8ForPtyWrite(data, this.ptyWriteChunkBytes);
+        let i = 0;
+        let running = false;
+        let scheduledSynchronously = false;
+        const step = () => {
+            if (running) {
+                // Reentrant synchronous call from inside scheduleChunkWrite below —
+                // do not recurse; tell the in-progress loop to keep going instead.
+                scheduledSynchronously = true;
+                return;
+            }
+            running = true;
+            try {
+                for (;;) {
+                    // The task may have been closed/killed mid-flight.
+                    if (entry.tornDown) {
+                        entry.chunkWriteBusy = false;
+                        // Doubt-review finding (2026-09-05): any writes still queued
+                        // behind a torn-down burst are intentionally DROPPED here (not
+                        // delivered, not logged) — there is nothing left to deliver
+                        // them to.
+                        return;
+                    }
+                    entry.pty.write(chunks[i]);
+                    i++;
+                    if (i >= chunks.length) {
+                        entry.chunkWriteBusy = false;
+                        this.drainPendingWrites(entry);
+                        return;
+                    }
+                    scheduledSynchronously = false;
+                    this.scheduleChunkWrite(step, this.ptyWriteChunkDelayMs);
+                    if (!scheduledSynchronously)
+                        return; // async scheduler — its own later call continues this
+                    // else: scheduler invoked step() synchronously (caught by the
+                    // `running` guard above) — loop again ourselves instead.
+                }
+            }
+            finally {
+                running = false;
+            }
+        };
+        step();
+    }
+    /**
+     * Delivers (or re-chunks) queued writes once the entry is free.
+     *
+     * External-review finding (2026-09-05, Tier-3, BLOCKING): this used to
+     * call `deliverOrChunk`, which for a small write calls straight back into
+     * `drainPendingWrites` — mutual recursion with one stack frame per queued
+     * write. `pendingWriteBytesCap` bounds bytes, not COUNT, so a client
+     * flooding thousands of tiny writes during a burst's drain window could
+     * exceed the call stack and crash the whole process with an uncaught
+     * `RangeError` — the exact "frozen/dead server" failure this fix exists
+     * to eliminate, now reachable via the very flooding scenario the cap was
+     * added to guard against. Small queued writes are now delivered directly
+     * in an iterative loop (no re-entry into `deliverOrChunk`), so stack depth
+     * stays O(1) regardless of queue length. An oversized queued write still
+     * hands off to `deliverOrChunk`'s async chunked path (which sets
+     * `chunkWriteBusy` and returns after scheduling — not a recursive call),
+     * and the loop stops there; that path's own completion calls
+     * `drainPendingWrites` again to continue the queue.
+     */
+    drainPendingWrites(entry) {
+        while (!entry.chunkWriteBusy) {
+            const next = entry.pendingWrites?.shift();
+            if (next === undefined)
+                return;
+            const nextBytes = Buffer.byteLength(next, "utf8");
+            entry.pendingWritesBytes = Math.max(0, (entry.pendingWritesBytes ?? 0) - nextBytes);
+            if (nextBytes <= this.ptyWriteChunkBytes) {
+                entry.pty.write(next);
+                continue;
+            }
+            this.deliverOrChunk(entry, next);
+            return;
+        }
+    }
+}
+//# sourceMappingURL=pty-write-chunker.js.map

package/server/dist/terminal/pty-write-chunker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pty-write-chunker.js","sourceRoot":"","sources":["../../src/terminal/pty-write-chunker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAKH,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AACjD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,QAAgB;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,0CAA0C;IAC1C,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,6BAA6B,CACjF,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,sEAAsE;QACtE,mDAAmD;QACnD,OAAO,GAAG,GAAG,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtE,GAAG,EAAE,CAAC;QACR,CAAC;QACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAClB,6DAA6D;YAC7D,gEAAgE;YAChE,mEAAmE;YACnE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qEAAqE;AACrE,SAAS,oBAAoB,CAAC,KAAyB,EAAE,QAAgB;IACvE,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxF,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,KAAyB,EAAE,QAAgB;IACpE,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvF,CAAC;AAuDD,2EAA2E;AAC3E,MAAM,OAAO,gBAAgB;IACV,kBAAkB,CAAS;IAC3B,oBAAoB,CAAS;IAC7B,kBAAkB,CAAsB;IACxC,oBAAoB,CAAS;IAE9C,YAAY,OAA6B,EAAE;QACzC,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;QACpG,gEAAgE;QAChE,kEAAkE;QAClE,0EAA0E;QAC1E,oEAAoE;QACpE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC,IAAI,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;QAC9G,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAA2B,EAAE,IAAY;QAC7C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;YAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,IAAI,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACxD,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CACV,2GAA2G,SAAS,SAAS,CAC9H,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,KAAK,CAAC,kBAAkB,GAAG,WAAW,GAAG,SAAS,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CAAC,KAA2B,EAAE,IAAY;QAC9D,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/D,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,sBAAsB,GAAG,KAAK,CAAC;QACnC,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,OAAO,EAAE,CAAC;gBACZ,oEAAoE;gBACpE,mEAAmE;gBACnE,sBAAsB,GAAG,IAAI,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,SAAS,CAAC;oBACR,mDAAmD;oBACnD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;wBACnB,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;wBAC7B,6DAA6D;wBAC7D,+DAA+D;wBAC/D,4DAA4D;wBAC5D,WAAW;wBACX,OAAO;oBACT,CAAC;oBACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;oBAC5B,CAAC,EAAE,CAAC;oBACJ,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;wBACvB,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;wBAC7B,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;wBAC/B,OAAO;oBACT,CAAC;oBACD,sBAAsB,GAAG,KAAK,CAAC;oBAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;oBACzD,IAAI,CAAC,sBAAsB;wBAAE,OAAO,CAAC,sDAAsD;oBAC3F,8DAA8D;oBAC9D,yDAAyD;gBAC3D,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,kBAAkB,CAAC,KAA2B;QACpD,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO;YAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACpF,IAAI,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;IACH,CAAC;CACF"}

package/server/dist/types/org.d.ts

@@ -22,6 +22,12 @@ export type UsageResponse = {
     runCount: number;
     windowDays: number;
     asOf: string;
+    /** Optional — an older producer (pre leadwright#38) omits both.
+     *  A missing value must render as if it were absent, never as 0/false. */
+    unpricedCallsTotal?: number;
+    /** true = SOME sessions in this window measured, some didn't (a
+     *  partial total). Absent/false = every session in the window measured. */
+    anyNotMeasured?: boolean;
 };
 export type CadenceUnresolvedReason = LeadOrgInfoReason | "invalid_cron";
 export type LastRunResponse = {
@@ -103,6 +109,19 @@ export interface LeadRosterEntry {
 export interface LeadsRosterResponse {
     leads: LeadRosterEntry[];
 }
+export interface OrgThreadRoundView {
+    id: string;
+    question: string;
+    askedAt: string;
+    answer?: string;
+    answeredAt?: string;
+}
+export interface OrgThreadCardView {
+    cardId: string;
+    cardTitle: string;
+    rounds: OrgThreadRoundView[];
+}
+export type OrgThreadsResponse = Record<string, OrgThreadCardView[]>;
 export interface AuditLogEntry {
     raw: string;
     parsed: Record<string, unknown> | null;

package/server/dist/types/org.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../src/types/org.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAS7E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACzC;AAMD,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnC;IACE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAMN,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEzE,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnC;IACE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD,CAAC;AAMN,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAChE;IACE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC,CAAC;AAWN;gEACgE;AAChE,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IACE,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE;QAAE,QAAQ,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE,GACD;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACzD;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAE9B,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAQD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B"}
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../src/types/org.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAS7E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACzC;AAMD,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnC;IACE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;8EAC0E;IAC1E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;+EAC2E;IAC3E,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAMN,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEzE,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnC;IACE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD,CAAC;AAMN,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAChE;IACE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC,CAAC;AAWN;gEACgE;AAChE,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IACE,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE;QAAE,QAAQ,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE,GACD;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACzD;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAE9B,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAcD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAQrE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B"}

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipwright-command-center-server",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "type": "module",
   "scripts": {
     "dev": "tsx watch --env-file-if-exists=../.env.local src/index.ts",

package/server/profiles/PROFILE_SCHEMA_VERSION

@@ -1 +1 @@
-1
+1

package/server/profiles/README.md

@@ -1,27 +1,27 @@
-# Bundled stack profiles
-
-This directory holds a **snapshot** of `shared/profiles/*.json` from the
-Shipwright monorepo. The WebUI ships this snapshot so it can run
-standalone — no Shipwright repo required at runtime.
-
-## Lookup order (see `server/src/core/profile-loader.ts::getProfilesDir`)
-
-1. `SHIPWRIGHT_PROFILES_DIR` — explicit user override (absolute path).
-2. `SHIPWRIGHT_MONOREPO_PATH` → `<path>/shared/profiles/` — dev-loop
-   helper: when you're iterating on the Shipwright monorepo itself and
-   want profile edits to take effect without re-syncing the snapshot.
-3. This directory (bundled snapshot) — the default when neither env
-   var is set.
-
-## Keeping the snapshot fresh
-
-The source of truth is `shipwright/shared/profiles/`. When profiles
-change upstream, re-run:
-
-```bash
-npm run sync-profiles    # (from webui/server/)
-```
-
-…or just copy the changed files manually. There is no automatic sync —
-the snapshot-vs-live drift is intentional so Shipwright and the WebUI
-can release independently.
+# Bundled stack profiles
+
+This directory holds a **snapshot** of `shared/profiles/*.json` from the
+Shipwright monorepo. The WebUI ships this snapshot so it can run
+standalone — no Shipwright repo required at runtime.
+
+## Lookup order (see `server/src/core/profile-loader.ts::getProfilesDir`)
+
+1. `SHIPWRIGHT_PROFILES_DIR` — explicit user override (absolute path).
+2. `SHIPWRIGHT_MONOREPO_PATH` → `<path>/shared/profiles/` — dev-loop
+   helper: when you're iterating on the Shipwright monorepo itself and
+   want profile edits to take effect without re-syncing the snapshot.
+3. This directory (bundled snapshot) — the default when neither env
+   var is set.
+
+## Keeping the snapshot fresh
+
+The source of truth is `shipwright/shared/profiles/`. When profiles
+change upstream, re-run:
+
+```bash
+npm run sync-profiles    # (from webui/server/)
+```
+
+…or just copy the changed files manually. There is no automatic sync —
+the snapshot-vs-live drift is intentional so Shipwright and the WebUI
+can release independently.

package/server/profiles/python-plugin-monorepo.json

@@ -1,35 +1,35 @@
-{
-  "name": "python-plugin-monorepo",
-  "description": "Python plugin monorepo (uv workspace). Library/framework with no deployable web server. Each subdirectory under plugins/ is its own pyproject.toml-managed package; shared/ holds cross-plugin scripts and profiles. No root dev server, no frontend.",
-  "version": "0.1.0",
-  "stack": {
-    "runtime": {
-      "python": "3.11+"
-    },
-    "frontend": {},
-    "backend": {}
-  },
-  "dev_server": null,
-  "services": [],
-  "testing": {
-    "unit": "pytest",
-    "command": "uv run pytest"
-  },
-  "linting": {
-    "tool": "ruff",
-    "command": "uv run ruff check"
-  },
-  "deploy": null,
-  "folder_structure": {
-    "plugins/": "Per-SDLC-phase Claude Code plugins (each with .claude-plugin/, hooks/, skills/, scripts/, tests/, pyproject.toml)",
-    "shared/": "Cross-plugin scripts, profiles, templates, prompts",
-    "docs/": "User-facing documentation (guide.md is canonical)",
-    "integration-tests/": "Cross-plugin integration tests",
-    "scripts/": "Top-level developer scripts (install.sh, update-marketplace.sh)"
-  },
-  "required_env_vars": {
-    "build": [],
-    "deploy": [],
-    "plugin": []
-  }
-}
+{
+  "name": "python-plugin-monorepo",
+  "description": "Python plugin monorepo (uv workspace). Library/framework with no deployable web server. Each subdirectory under plugins/ is its own pyproject.toml-managed package; shared/ holds cross-plugin scripts and profiles. No root dev server, no frontend.",
+  "version": "0.1.0",
+  "stack": {
+    "runtime": {
+      "python": "3.11+"
+    },
+    "frontend": {},
+    "backend": {}
+  },
+  "dev_server": null,
+  "services": [],
+  "testing": {
+    "unit": "pytest",
+    "command": "uv run pytest"
+  },
+  "linting": {
+    "tool": "ruff",
+    "command": "uv run ruff check"
+  },
+  "deploy": null,
+  "folder_structure": {
+    "plugins/": "Per-SDLC-phase Claude Code plugins (each with .claude-plugin/, hooks/, skills/, scripts/, tests/, pyproject.toml)",
+    "shared/": "Cross-plugin scripts, profiles, templates, prompts",
+    "docs/": "User-facing documentation (guide.md is canonical)",
+    "integration-tests/": "Cross-plugin integration tests",
+    "scripts/": "Top-level developer scripts (install.sh, update-marketplace.sh)"
+  },
+  "required_env_vars": {
+    "build": [],
+    "deploy": [],
+    "plugin": []
+  }
+}