@svenroth-ai/shipwright 0.26.0 → 0.28.0

package/server/dist/core/codex-models-probe.js

@@ -0,0 +1,103 @@
+/*
+ * codex-models-probe — the "codex debug models" catalog PROBE
+ * (iterate-2026-09-19-codex-model-catalog, follow-up to shipwright#471/#473).
+ *
+ * Replaces the withdrawn hardcoded model-slug enum (shipwright#771) with a
+ * live probe of the Codex CLI's own catalog, so the New Iterate combobox
+ * never lags the provider's own model lineup. Reuses `defaultRunShim` from
+ * `readiness-probe-run.ts` — `codex` installs as a Windows `.cmd` PATHEXT
+ * shim (no `codex.exe`), which `execFile(cmd, args, {shell:false})` cannot
+ * invoke directly (see that module's own doc comment); `defaultRunShim`
+ * already solves this for the readiness probe's `codex --version` check, and
+ * this is the same binary.
+ *
+ * Runs with NO extra flags — deliberately not `--bundled` ("skip refresh,
+ * dump only the catalog shipped with this binary"): empirically, `--bundled`
+ * returns a visibly OLDER catalog (verified during this iterate's Confidence
+ * Calibration — missing a newly-listed model, carrying stale entries the
+ * refreshed call no longer lists). The whole point of this probe is to stay
+ * ahead of a hand-maintained list, so the default (refreshing) invocation is
+ * the only one that serves that goal.
+ *
+ * Verified during this iterate: `codex debug models` requires NO
+ * authentication (re-ran with an empty `CODEX_HOME` — no `auth.json` — and
+ * it still exited 0 with the full catalog), so this probe has no
+ * auth-specific degraded path to handle.
+ */
+import { CODEX_MODEL_SLUG_PATTERN } from "../external/launch/parse-body.js";
+import { defaultRunShim } from "./readiness-probe-run.js";
+/**
+ * Run `codex debug models` and reduce its raw catalog (which also carries
+ * per-model reasoning-level metadata and multi-KB prompt text this codebase
+ * has no use for) down to the `{slug, display_name}` pairs a launch-form
+ * combobox needs. Never throws.
+ *
+ * Filters to entries that are objects with a `slug` matching the existing
+ * `CODEX_MODEL_SLUG_PATTERN` (the same syntactic gate `parse-body.ts` applies
+ * to a launch request — imported directly here since this is an intra-server
+ * import, not the cross-package case DO-NOT #7 forbids) and a non-empty
+ * string `display_name`, with `visibility === "list"` (excludes
+ * internal/reserved entries like `codex-auto-review`). A single malformed
+ * entry is dropped, not fatal to the rest of the list — this is untrusted
+ * external-process output whose shape this codebase does not control.
+ * (external review fix, both reviewers, 2026-09-19 architecture review.)
+ *
+ * Gates on `result.code === 0`, NOT `result.ok` — `readiness-probe-run.ts`'s
+ * shared `ok` heuristic (`!error && /\d+\.\d+/.test(stdout+stderr)`) was
+ * written for `--version` probes and requires a dotted version number
+ * somewhere in the output. A real catalog containing only integer-suffixed
+ * slugs (no dotted version anywhere in the JSON) would trip that heuristic to
+ * `false` despite a clean exit and fully valid JSON — exactly the false
+ * `unavailable` gap `RunResult.code`'s own doc comment already names `code`
+ * as the fix for (code-review finding, 2026-09-19). `code` can be `null` on
+ * ENOENT/timeout, hence the strict `=== 0`.
+ *
+ * De-duplicates on `slug`, first-wins — the CLI's own catalog shape is
+ * untrusted external-process output (same reasoning as the per-entry
+ * shape checks above), and a duplicate slug would otherwise reach the
+ * client as two `<option>`s sharing one React key (doubt-review finding,
+ * 2026-09-19).
+ */
+export async function runCodexModelsProbe(deps) {
+    const run = deps.run ?? defaultRunShim;
+    let result;
+    try {
+        result = await run("codex", ["debug", "models"]);
+    }
+    catch {
+        // `defaultRunShim`/`defaultRun` never reject (execFile's callback always
+        // resolves a RunResult) — this guards a rejecting `run` override, so the
+        // "never throws" contract this docstring promises actually holds for any
+        // caller's `deps.run`, not just the two shipped implementations
+        // (external code-review finding, 2026-09-19).
+        return { ok: false, models: [] };
+    }
+    if (result.code !== 0)
+        return { ok: false, models: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout);
+    }
+    catch {
+        return { ok: false, models: [] };
+    }
+    const rawModels = parsed?.models;
+    if (!Array.isArray(rawModels))
+        return { ok: false, models: [] };
+    const bySlug = new Map();
+    for (const entry of rawModels) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const { slug, display_name, visibility } = entry;
+        if (visibility !== "list")
+            continue;
+        if (typeof slug !== "string" || !CODEX_MODEL_SLUG_PATTERN.test(slug))
+            continue;
+        if (typeof display_name !== "string" || display_name.trim() === "")
+            continue;
+        if (!bySlug.has(slug))
+            bySlug.set(slug, { slug, display_name });
+    }
+    return { ok: true, models: [...bySlug.values()] };
+}
+//# sourceMappingURL=codex-models-probe.js.map

package/server/dist/core/codex-models-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-models-probe.js","sourceRoot":"","sources":["../../src/core/codex-models-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAc,MAAM,0BAA0B,CAAC;AAgBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAA0B;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC;IACvC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,gEAAgE;QAChE,8CAA8C;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAExD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,SAAS,GAAI,MAAsC,EAAE,MAAM,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAgC,CAAC;QAC5E,IAAI,UAAU,KAAK,MAAM;YAAE,SAAS;QACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QAC7E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC"}

package/server/dist/core/codex-oracle-runner.d.ts

@@ -0,0 +1,68 @@
+import { type RunFn } from "./readiness-probe.js";
+export declare const CODEX_ORACLE_TIMEOUT_MS = 30000;
+/** Verbatim mirror of `codex_completion_oracle.py`'s `verdict` field. */
+export type OracleVerdict = "done" | "not_done" | "delivery_pending" | "no_oracle";
+export interface OracleEvidence {
+    /**
+     * §5.1's correction — present only on an `iterate`-phase `delivery_pending`
+     * verdict. `"error"` = watch_pr_delivery.py's checks_failed/closed branch
+     * (a PR exists but its delivery failed — never re-poll forever). Absent or
+     * `"indeterminate"` = case 13 proper (CI/review/auto-merge still running,
+     * or the watcher itself produced no verdict) — safe to keep re-polling.
+     */
+    delivery_state?: "error" | "indeterminate";
+    [key: string]: unknown;
+}
+export interface OracleResult {
+    verdict: OracleVerdict;
+    phase: string;
+    session: string;
+    evidence: OracleEvidence;
+}
+export type OracleOutcome = {
+    kind: "ok";
+    result: OracleResult;
+} | {
+    kind: "engine-unavailable";
+    reason: string;
+    repairCommand: string;
+} | {
+    kind: "failed";
+    reason: string;
+};
+export interface OracleSpawnResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+    spawnError?: string;
+}
+export type OracleSpawnFn = (bin: string, args: string[], options: {
+    timeoutMs: number;
+    env: NodeJS.ProcessEnv;
+}) => Promise<OracleSpawnResult>;
+export declare const defaultSpawnOracle: OracleSpawnFn;
+export interface RunCodexOracleInput {
+    projectRoot: string;
+    phase: string;
+    session: string;
+    /** ISO-8601 with timezone — the §2.4 degradation-path floor. */
+    since?: string;
+}
+export interface CodexOracleDeps {
+    run?: RunFn;
+    spawn?: OracleSpawnFn;
+    existsFn?: (p: string) => boolean;
+    homeDir?: string;
+    scriptOverride?: string;
+    timeoutMs?: number;
+    baseEnv?: NodeJS.ProcessEnv;
+}
+/** Resolve the single cache-owned oracle CLI shipped with the Shipwright runtime. */
+export declare function resolveCodexOracleScript(deps?: Pick<CodexOracleDeps, "existsFn" | "homeDir" | "scriptOverride">): string | null;
+/**
+ * Run `codex_completion_oracle.py --project-root <root> --phase <p>
+ * --session <sid> [--since <iso>]` and parse its JSON verdict. Never
+ * throws for an oracle failure — only a programming error would reject.
+ */
+export declare function runCodexOracle(input: RunCodexOracleInput, deps?: CodexOracleDeps): Promise<OracleOutcome>;
+//# sourceMappingURL=codex-oracle-runner.d.ts.map

package/server/dist/core/codex-oracle-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oracle-runner.d.ts","sourceRoot":"","sources":["../../src/core/codex-oracle-runner.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAiD,KAAK,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAGjG,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAEnF,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,eAAe,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KACnD,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,eAAO,MAAM,kBAAkB,EAAE,aAAoC,CAAC;AAEtE,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC7B;AAED,qFAAqF;AACrF,wBAAgB,wBAAwB,CACtC,IAAI,GAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,SAAS,GAAG,gBAAgB,CAAM,GAC1E,MAAM,GAAG,IAAI,CAWf;AAQD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,aAAa,CAAC,CAuExB"}

package/server/dist/core/codex-oracle-runner.js

@@ -0,0 +1,124 @@
+/*
+ * core/codex-oracle-runner.ts — the injection-safe bridge to `shared/
+ * scripts/tools/codex_completion_oracle.py` (Codex Light §1.7).
+ *
+ * Mirrors `triage-cli-runner.ts`'s spawn discipline verbatim (same reason:
+ * `uv run --no-project --python ">=3.11"` so the script always runs in a
+ * Python that actually satisfies its own floor, never whichever of
+ * python3/python/py answers `--version` first — see that module's header
+ * for the incident this avoids). `--no-project` matters here too: the
+ * oracle script has no `pyproject.toml` of its own (it's a plain module
+ * under `shared/scripts/tools/`), so an ambient one discovered by walking
+ * up from the SPAWNING PROCESS's cwd must never get silently activated.
+ *
+ * Unlike `grade-runner.ts` / `triage-cli-runner.ts`, the oracle CLI prints
+ * its JSON payload on EVERY exit code (0-3 all carry a verdict; there is no
+ * "non-JSON means engine trouble" branch) — see `codex_completion_oracle.py`
+ * `main()`. This wrapper therefore always attempts to parse stdout first and
+ * only falls back to an engine-unavailable/failed outcome when uv/the
+ * script itself couldn't be resolved or spawned at all.
+ *
+ * Required-CI PR-review finding (PR #466): the spawn pattern was a
+ * verbatim mirror of `triage-cli-runner.ts` (already in production), but
+ * the CADENCE is new — this runs every 60s tick for as long as a task
+ * stays stalled, where the triage call site fires once per user-initiated
+ * transition. `execFile`'s own `timeout` only SIGTERMs the immediate `uv`
+ * child; if `uv run` had already forked a Python grandchild, Node would
+ * not reap that process tree on Windows by default. Fixed (not merely
+ * accepted) via `cli-child-spawn.ts`'s shared tree-kill-on-timeout
+ * wrapper, shared with `triage-cli-runner.ts` so the two can't re-diverge.
+ */
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { defaultCliChildSpawn } from "./cli-child-spawn.js";
+import { READINESS_REPAIR_COMMAND, shipwrightCacheRoot } from "./readiness-probe.js";
+import { resolveUv } from "./uv-runner.js";
+export const CODEX_ORACLE_TIMEOUT_MS = 30_000;
+export const defaultSpawnOracle = defaultCliChildSpawn;
+/** Resolve the single cache-owned oracle CLI shipped with the Shipwright runtime. */
+export function resolveCodexOracleScript(deps = {}) {
+    const exists = deps.existsFn ?? existsSync;
+    if (deps.scriptOverride)
+        return exists(deps.scriptOverride) ? deps.scriptOverride : null;
+    const candidate = path.join(shipwrightCacheRoot(deps.homeDir ?? os.homedir()), "shared", "scripts", "tools", "codex_completion_oracle.py");
+    return exists(candidate) ? candidate : null;
+}
+function cleanStderr(stderr) {
+    return stderr.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).pop() ?? "";
+}
+const ENGINE_UNAVAILABLE_REASON = "The Codex completion oracle isn't installed.";
+/**
+ * Run `codex_completion_oracle.py --project-root <root> --phase <p>
+ * --session <sid> [--since <iso>]` and parse its JSON verdict. Never
+ * throws for an oracle failure — only a programming error would reject.
+ */
+export async function runCodexOracle(input, deps = {}) {
+    const script = resolveCodexOracleScript(deps);
+    if (!script) {
+        return { kind: "engine-unavailable", reason: ENGINE_UNAVAILABLE_REASON, repairCommand: READINESS_REPAIR_COMMAND };
+    }
+    const uv = await resolveUv({ run: deps.run, homeDir: deps.homeDir, baseEnv: deps.baseEnv });
+    if (!uv) {
+        return {
+            kind: "engine-unavailable",
+            reason: "uv isn't installed — the Codex completion oracle needs it to run in a managed Python 3.11+.",
+            repairCommand: READINESS_REPAIR_COMMAND,
+        };
+    }
+    const spawn = deps.spawn ?? defaultSpawnOracle;
+    const args = [
+        "run",
+        "--no-project",
+        "--python",
+        ">=3.11",
+        script,
+        "--project-root",
+        input.projectRoot,
+        "--phase",
+        input.phase,
+        "--session",
+        input.session,
+        ...(input.since ? ["--since", input.since] : []),
+    ];
+    const result = await spawn(uv.bin, args, {
+        timeoutMs: deps.timeoutMs ?? CODEX_ORACLE_TIMEOUT_MS,
+        env: uv.env,
+    });
+    if (result.code === -1) {
+        return { kind: "engine-unavailable", reason: "uv couldn't start on this machine.", repairCommand: READINESS_REPAIR_COMMAND };
+    }
+    // Every other exit (0-3 documented, anything else a crash) prints JSON on
+    // stdout per the script's own contract — try to parse before giving up.
+    try {
+        const payload = JSON.parse(result.stdout);
+        if ((payload.verdict === "done" ||
+            payload.verdict === "not_done" ||
+            payload.verdict === "delivery_pending" ||
+            payload.verdict === "no_oracle") &&
+            typeof payload.phase === "string" &&
+            typeof payload.session === "string" &&
+            payload.evidence &&
+            typeof payload.evidence === "object") {
+            return {
+                kind: "ok",
+                result: {
+                    verdict: payload.verdict,
+                    phase: payload.phase,
+                    session: payload.session,
+                    evidence: payload.evidence,
+                },
+            };
+        }
+    }
+    catch {
+        /* fall through to the failed branch below */
+    }
+    return {
+        kind: "failed",
+        reason: result.spawnError === "timeout"
+            ? "The completion oracle took too long and was stopped."
+            : cleanStderr(result.stderr) || "The completion oracle returned an unrecognised response.",
+    };
+}
+//# sourceMappingURL=codex-oracle-runner.js.map

package/server/dist/core/codex-oracle-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oracle-runner.js","sourceRoot":"","sources":["../../src/core/codex-oracle-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAc,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AA0C9C,MAAM,CAAC,MAAM,kBAAkB,GAAkB,oBAAoB,CAAC;AAoBtE,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CACtC,OAAyE,EAAE;IAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC;IAC3C,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EACjD,QAAQ,EACR,SAAS,EACT,OAAO,EACP,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,yBAAyB,GAAG,8CAA8C,CAAC;AAEjF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B,EAC1B,OAAwB,EAAE;IAE1B,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,yBAAyB,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAC;IACpH,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,6FAA6F;YACrG,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAC/C,MAAM,IAAI,GAAG;QACX,KAAK;QACL,cAAc;QACd,UAAU;QACV,QAAQ;QACR,MAAM;QACN,gBAAgB;QAChB,KAAK,CAAC,WAAW;QACjB,SAAS;QACT,KAAK,CAAC,KAAK;QACX,WAAW;QACX,KAAK,CAAC,OAAO;QACb,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,uBAAuB;QACpD,GAAG,EAAE,EAAE,CAAC,GAAG;KACZ,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,oCAAoC,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAC;IAC/H,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA0B,CAAC;QACnE,IACE,CAAC,OAAO,CAAC,OAAO,KAAK,MAAM;YACzB,OAAO,CAAC,OAAO,KAAK,UAAU;YAC9B,OAAO,CAAC,OAAO,KAAK,kBAAkB;YACtC,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC;YAClC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,OAAO,CAAC,QAAQ;YAChB,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE;oBACN,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAA0B;iBAC7C;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EACJ,MAAM,CAAC,UAAU,KAAK,SAAS;YAC7B,CAAC,CAAC,sDAAsD;YACxD,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,0DAA0D;KAC/F,CAAC;AACJ,CAAC"}

package/server/dist/core/codex-status-report.d.ts

@@ -0,0 +1,6 @@
+export interface ShipwrightStatusReport {
+    phase: string;
+    done: boolean;
+}
+export declare function parseShipwrightStatusReport(text: string): ShipwrightStatusReport | null;
+//# sourceMappingURL=codex-status-report.d.ts.map

package/server/dist/core/codex-status-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-status-report.d.ts","sourceRoot":"","sources":["../../src/core/codex-status-report.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;CACf;AAQD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAiBvF"}

package/server/dist/core/codex-status-report.js

@@ -0,0 +1,40 @@
+/*
+ * core/codex-status-report.ts — §5.4's structured self-report parser.
+ *
+ * Every Codex launch prompt (`launcher-codex.ts buildCodexPrompt`) ends
+ * with an instruction to close with a fenced ```SHIPWRIGHT-STATUS {json}```
+ * block. §5.4 (hard v1 scope, not an "Open item"): "Parsed from terminal
+ * scrollback, cross-checked against the oracle verdict: agreement raises
+ * confidence; disagreement always defers to the oracle. This gives
+ * `no_oracle` phases a real, if weaker, signal."
+ *
+ * Pure parser — no I/O. `CodexTaskWatcher` reads the terminal text (via
+ * `PtyManager.peekTerminalText`'s visible-viewport snapshot, the same
+ * mechanism `appendCodexTerminalSignals` already uses for approval-request
+ * detection) and hands it here.
+ */
+// Matches the exact fence `buildCodexPrompt` instructs Codex to emit. Global
+// so a viewport containing more than one report (e.g. an earlier nudge's
+// echoed instruction text plus a real closing report) is fully scanned —
+// the LAST well-formed match wins, since that's the most recent status.
+const FENCE_RE = /```SHIPWRIGHT-STATUS\s*\r?\n([\s\S]*?)```/g;
+export function parseShipwrightStatusReport(text) {
+    let match;
+    let last = null;
+    FENCE_RE.lastIndex = 0;
+    while ((match = FENCE_RE.exec(text)) !== null) {
+        try {
+            const parsed = JSON.parse(match[1].trim());
+            if (parsed && typeof parsed === "object" && typeof parsed.done === "boolean") {
+                const p = parsed;
+                last = { phase: typeof p.phase === "string" ? p.phase : "", done: p.done };
+            }
+        }
+        catch {
+            // Malformed block (truncated viewport, stray backticks in unrelated
+            // output) — skip it and keep scanning for an earlier well-formed one.
+        }
+    }
+    return last;
+}
+//# sourceMappingURL=codex-status-report.js.map

package/server/dist/core/codex-status-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-status-report.js","sourceRoot":"","sources":["../../src/core/codex-status-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,QAAQ,GAAG,4CAA4C,CAAC;AAE9D,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,IAAI,KAA6B,CAAC;IAClC,IAAI,IAAI,GAAkC,IAAI,CAAC;IAC/C,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAQ,MAAkC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1G,MAAM,CAAC,GAAG,MAAiC,CAAC;gBAC5C,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAe,EAAE,CAAC;YACxF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/server/dist/core/codex-task-watcher-types.d.ts

@@ -0,0 +1,69 @@
+import type { ExternalTask } from "./sdk-sessions-store.js";
+import type { OracleOutcome, RunCodexOracleInput } from "./codex-oracle-runner.js";
+/** Settings default per §5 (min 5 — Settings enforces the floor, not this module). */
+export declare const DEFAULT_STALL_TIMEOUT_MS: number;
+/** §5.2 launch-confirmation window — distinct from, and shorter than, the
+ *  mid-task stall trigger above. */
+export declare const DEFAULT_LAUNCH_CONFIRM_TIMEOUT_MS: number;
+export type CodexWatcherNoticeKind = "nudge_sent" | "delivery_error" | "no_oracle_unresolved" | "launch_confirmation_failed";
+export interface CodexWatcherNotice {
+    taskId: string;
+    kind: CodexWatcherNoticeKind;
+    detail: string;
+    at: number;
+}
+export interface CodexTaskWatcherStore {
+    list(): ExternalTask[];
+    patch(taskId: string, patch: Partial<ExternalTask>): ExternalTask | undefined;
+    persist(): Promise<void>;
+}
+export interface CodexTaskWatcherPtyManager {
+    getLastDataAt(taskId: string): number | null;
+    attachCount(taskId: string): number;
+    write(taskId: string, data: string): void;
+}
+export interface CodexTaskWatcherDeps {
+    store: CodexTaskWatcherStore;
+    ptyManager: CodexTaskWatcherPtyManager;
+    getProjectById: (id: string) => {
+        path: string;
+    } | undefined;
+    runOracle: (input: RunCodexOracleInput) => Promise<OracleOutcome>;
+    /**
+     * §4 — best-effort, filename-first discovery of a fresh launch's thread
+     * id (`core/codex-thread-discovery.ts`). Optional: omitting it just means
+     * no task ever gets a `threadId`, i.e. `resume` never fires (§4's earlier,
+     * pre-discovery behavior) — tests that don't care about §4 can skip it.
+     */
+    discoverThreadId?: (args: {
+        cwd: string;
+        sinceIso: string;
+        excludeThreadIds?: ReadonlySet<string>;
+    }) => Promise<string | null>;
+    now?: () => number;
+    /**
+     * Settings-backed (`GlobalSettings.codexStallTimeoutMinutes`) — a plain
+     * number OR a (possibly async) getter, so a caller that re-reads
+     * settings.json can hand in `async () => (await readSettings())...` and
+     * have a live-edited Settings value take effect on the very next tick,
+     * without reconstructing the watcher (which would drop in-flight
+     * episode/notice state).
+     */
+    stallTimeoutMs?: number | (() => number | Promise<number>);
+    launchConfirmTimeoutMs?: number | (() => number | Promise<number>);
+    /**
+     * §5.4 — best-effort visible-viewport text for the self-report parser
+     * (`codex-status-report.ts`). Optional and best-effort by design, same
+     * as `PtyManager.peekTerminalText` itself: `null`/omitted just means no
+     * self-report signal is available (headless mirror disabled, no live
+     * entry) — the oracle-only classification path is unaffected either way.
+     */
+    peekTerminalText?: (taskId: string) => string | null;
+}
+export interface EpisodeState {
+    /** The `lastDataAt` value this episode "belongs to" — a newer value
+     *  means fresh output arrived, which starts a brand-new episode. */
+    lastSeenDataAt: number;
+    nudged: boolean;
+}
+//# sourceMappingURL=codex-task-watcher-types.d.ts.map

package/server/dist/core/codex-task-watcher-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-task-watcher-types.d.ts","sourceRoot":"","sources":["../../src/core/codex-task-watcher-types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEnF,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AACvD;oCACoC;AACpC,eAAO,MAAM,iCAAiC,QAAY,CAAC;AAE3D,MAAM,MAAM,sBAAsB,GAC9B,YAAY,GACZ,gBAAgB,GAChB,sBAAsB,GACtB,4BAA4B,CAAC;AAEjC,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,GAAG,SAAS,CAAC;IAC9E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC7C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,0BAA0B,CAAC;IACvC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC7D,SAAS,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClE;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;KACxC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,sBAAsB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B;wEACoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;CACjB"}

package/server/dist/core/codex-task-watcher-types.js

@@ -0,0 +1,12 @@
+/*
+ * core/codex-task-watcher-types.ts — types, deps interfaces, and tunable
+ * defaults for `CodexTaskWatcher` (`codex-task-watcher.ts`). Split out to
+ * keep the class file under the 300-line guideline; re-exported verbatim
+ * from `codex-task-watcher.ts` so every existing import site is unaffected.
+ */
+/** Settings default per §5 (min 5 — Settings enforces the floor, not this module). */
+export const DEFAULT_STALL_TIMEOUT_MS = 15 * 60 * 1000;
+/** §5.2 launch-confirmation window — distinct from, and shorter than, the
+ *  mid-task stall trigger above. */
+export const DEFAULT_LAUNCH_CONFIRM_TIMEOUT_MS = 90 * 1000;
+//# sourceMappingURL=codex-task-watcher-types.js.map

package/server/dist/core/codex-task-watcher-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-task-watcher-types.js","sourceRoot":"","sources":["../../src/core/codex-task-watcher-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,sFAAsF;AACtF,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD;oCACoC;AACpC,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/server/dist/core/codex-task-watcher.d.ts

@@ -0,0 +1,30 @@
+import { type CodexWatcherNotice, type CodexTaskWatcherDeps } from "./codex-task-watcher-types.js";
+export { DEFAULT_STALL_TIMEOUT_MS, DEFAULT_LAUNCH_CONFIRM_TIMEOUT_MS, type CodexWatcherNoticeKind, type CodexWatcherNotice, type CodexTaskWatcherStore, type CodexTaskWatcherPtyManager, type CodexTaskWatcherDeps, } from "./codex-task-watcher-types.js";
+export declare class CodexTaskWatcher {
+    private readonly deps;
+    private readonly episodes;
+    private readonly notices;
+    private readonly nowFn;
+    private readonly stallTimeoutMs;
+    private readonly launchConfirmTimeoutMs;
+    /** Reentrancy guard (doubt-review finding) — `index.ts`'s `setInterval`
+     *  never awaits the prior tick, and one tick can outlive 60s with a
+     *  handful of stalled tasks (N sequential up-to-30s oracle calls). Two
+     *  OVERLAPPING ticks would each build their own `claimedThreadIds` from
+     *  `store.list()` and miss the other's in-flight §4 discovery, risking
+     *  two tasks in the same cwd permanently claiming the same threadId (no
+     *  re-validation once set). Skipping an overlapping tick is always safe
+     *  — the next one 60s later just re-evaluates the same tasks. */
+    private ticking;
+    constructor(deps: CodexTaskWatcherDeps);
+    private resolveStallTimeoutMs;
+    private resolveLaunchConfirmTimeoutMs;
+    /** Ephemeral, in-memory Inbox feed — see the module header. */
+    snapshot(): CodexWatcherNotice[];
+    tick(): Promise<void>;
+    private checkTask;
+    private classify;
+    private setNotice;
+    private markDone;
+}
+//# sourceMappingURL=codex-task-watcher.d.ts.map

package/server/dist/core/codex-task-watcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-task-watcher.d.ts","sourceRoot":"","sources":["../../src/core/codex-task-watcher.ts"],"names":[],"mappings":"AA+CA,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAE1B,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,GAC1B,MAAM,+BAA+B,CAAC;AAUvC,qBAAa,gBAAgB;IAgBf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAfjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4C;IAC3E,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA4C;IACnF;;;;;;;qEAOiE;IACjE,OAAO,CAAC,OAAO,CAAS;gBAEK,IAAI,EAAE,oBAAoB;YAMzC,qBAAqB;YAIrB,6BAA6B;IAM3C,+DAA+D;IAC/D,QAAQ,IAAI,kBAAkB,EAAE;IAI1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAiCb,SAAS;YA2ET,QAAQ;IA+DtB,OAAO,CAAC,SAAS;YAQH,QAAQ;CAMvB"}