@svenroth-ai/shipwright 0.26.0 → 0.28.0

package/server/dist/core/codextender-auth-file-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-auth-file-sweep.d.ts","sourceRoot":"","sources":["../../src/core/codextender-auth-file-sweep.ts"],"names":[],"mappings":"AA8BA;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,QAAiB,CAAC;AAEtE,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC7C,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,8BAA8B,CAAC,CAoDzC"}

package/server/dist/core/codextender-auth-file-sweep.js

@@ -0,0 +1,97 @@
+/*
+ * codextender-auth-file-sweep.ts — bounded reclamation of orphaned
+ * `codextender-auth-*.tmp` credential files (PR-review round 10, iterate-
+ * 2026-09-23; Sven's own decision on the CI-BLOCKed design question).
+ *
+ * `writeCodextenderAuthTokenFile` (launcher-codextender.ts) writes the
+ * Codextender proxy's bearer token to a private `0o600` temp file once per
+ * launch; the generated command's cleanup suffix deletes it right after the
+ * `claude` invocation exits. If the command is never executed (copied out
+ * instead of auto-run), the pty is killed before the suffix runs, or launch
+ * fails before a command is ever returned to run, that delete step never
+ * fires and the file is stranded — the exact gap the required `PR Review`
+ * CI gate BLOCKed twice on. Mirrors `snapshot-tmp-sweep.ts`'s shape (same
+ * age-gated, best-effort, injectable-deps design) for the same reason: a
+ * live write's own cleanup runs within seconds, so anything older than the
+ * cutoff is provably orphaned — no active-task veto needed.
+ *
+ * Wired into the boot + periodic sweep in index.ts alongside the scrollback
+ * and snapshot-tmp sweeps. Unlike those two (scoped to the terminal
+ * scrollback dir), this one scans `os.tmpdir()` — where
+ * `writeCodextenderAuthTokenFile` actually writes — so `dir` is threaded
+ * through for testability rather than hardcoded.
+ */
+import * as fsAsync from "node:fs/promises";
+import * as path from "node:path";
+/** Matches `codextender-auth-<uuid>.tmp`. Bounded — ReDoS-safe. */
+const CODEXTENDER_AUTH_TMP_RE = /^codextender-auth-[0-9a-fA-F-]{36}\.tmp$/;
+/**
+ * Default reclamation age (10 min) — deliberately much shorter than
+ * `snapshot-tmp-sweep.ts`'s 1h default: this file holds a LIVE credential,
+ * not just terminal cell-state, and a normal launch's own cleanup deletes it
+ * within seconds of the `claude` invocation exiting.
+ */
+export const DEFAULT_CODEXTENDER_AUTH_TMP_MAX_AGE_MS = 10 * 60 * 1000;
+const defaultDeps = {
+    readdir: (dir) => fsAsync.readdir(dir),
+    stat: (p) => fsAsync.stat(p),
+    unlink: (p) => fsAsync.unlink(p),
+};
+/**
+ * Age-gated sweep of orphaned `codextender-auth-*.tmp` credential files.
+ * Best-effort: dir-read failure and per-file failures are non-fatal (they
+ * log a warn and never throw) — the same posture `sweepOrphanSnapshotTmp`
+ * takes, for the same reason (a sweep failure must never crash boot or the
+ * periodic timer).
+ */
+export async function sweepOrphanCodextenderAuthFiles(opts) {
+    const deps = { ...defaultDeps, ...opts.deps };
+    const now = opts.now ?? Date.now;
+    const logWarn = opts.logWarn ?? ((m) => console.warn(m));
+    const logInfo = opts.logInfo ?? ((m) => console.log(m));
+    const cutoff = now() - (opts.maxAgeMs ?? DEFAULT_CODEXTENDER_AUTH_TMP_MAX_AGE_MS);
+    const result = { deleted: 0, errors: 0, preserved: 0 };
+    let entries;
+    try {
+        entries = await deps.readdir(opts.dir);
+    }
+    catch (err) {
+        // ENOENT = dir not created yet (benign). Any other error (EACCES/EPERM/
+        // EIO) is a real operational failure that leaves credential files on
+        // disk — surface it so the gap stays visible; this function never throws.
+        if (err.code !== "ENOENT") {
+            logWarn(`[codextender-auth-sweep] readdir failed (${err.message}); orphan credential files may persist`);
+        }
+        return result;
+    }
+    for (const name of entries) {
+        if (!CODEXTENDER_AUTH_TMP_RE.test(name))
+            continue;
+        const full = path.join(opts.dir, name);
+        let mtimeMs;
+        try {
+            mtimeMs = (await deps.stat(full)).mtimeMs;
+        }
+        catch {
+            result.errors++;
+            continue;
+        }
+        if (mtimeMs >= cutoff) {
+            result.preserved++;
+            continue;
+        }
+        try {
+            await deps.unlink(full);
+            result.deleted++;
+        }
+        catch (err) {
+            result.errors++;
+            logWarn(`[codextender-auth-sweep] unlink failed for ${name}: ${err.message}`);
+        }
+    }
+    if (result.deleted > 0 || result.errors > 0) {
+        logInfo(`[codextender-auth-sweep] orphan sweep: deleted=${result.deleted} errors=${result.errors} preserved=${result.preserved}`);
+    }
+    return result;
+}
+//# sourceMappingURL=codextender-auth-file-sweep.js.map

package/server/dist/core/codextender-auth-file-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-auth-file-sweep.js","sourceRoot":"","sources":["../../src/core/codextender-auth-file-sweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,0CAA0C,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4BtE,MAAM,WAAW,GAAiC;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAAkC;IAElC,MAAM,IAAI,GAAiC,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,uCAAuC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAmC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAEvF,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CACL,4CAA6C,GAAa,CAAC,OAAO,wCAAwC,CAC3G,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,SAAS,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,8CAA8C,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CACL,kDAAkD,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,SAAS,EAAE,CACzH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/server/dist/core/codextender-proxy-probe.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `codextenderPort` is persisted/read as arbitrary JSON (PUT /api/settings
+ * accepts an unvalidated body; a hand-edited settings.json is untyped on
+ * disk too) before ever reaching here, so `port: number`'s compile-time
+ * type is not a runtime guarantee. Both probes below MUST reject anything
+ * outside a real TCP port before interpolating it into a URL — a value
+ * like `"4000@attacker.example"` would otherwise redirect the request via
+ * URL userinfo-authority confusion (PR-review BLOCK, iterate-2026-09-23
+ * fifth round). This is the enforcement point regardless of how an invalid
+ * value got in; `routes/settings.ts`'s PUT-time rejection (same finding)
+ * is defense-in-depth on top of it, not a substitute for it.
+ */
+export declare function isValidCodextenderPort(value: unknown): value is number;
+export interface CodextenderModelEntry {
+    slug: string;
+    display_name: string;
+    /** LiteLLM's declared context window for this alias (its `model_info.
+     *  max_input_tokens`), when the proxy's `/v1/models` response carries one.
+     *  Absent on an older/unpatched proxy — callers must treat that the same
+     *  as "unknown", never assume a number. */
+    max_input_tokens?: number;
+}
+export interface CodextenderProbeResult {
+    ok: boolean;
+    models: CodextenderModelEntry[];
+}
+export interface CodextenderProbeDeps {
+    /** Test seam — defaults to the real global `fetch`. */
+    fetchFn?: typeof fetch;
+    /** Probe timeout in ms. Default 1500 — short enough that a launch or a
+     *  datalist render never feels stuck on an unreachable proxy. */
+    timeoutMs?: number;
+    /** Test seam — defaults to `resolveCodextenderAuthToken()` (reads
+     *  `process.env.CODEXTENDER_AUTH_TOKEN`, no built-in fallback). */
+    authToken?: string;
+}
+/**
+ * `GET http://127.0.0.1:<port>/v1/models` with the configured Codextender
+ * master-key bearer token (`deps.authToken` or `resolveCodextenderAuthToken()`).
+ * Never throws — an unconfigured token, any network error, non-2xx status,
+ * timeout, or malformed body all resolve `{ok: false, models: []}` rather
+ * than rejecting, so callers never need a try/catch.
+ *
+ * LiteLLM's `/v1/models` response is OpenAI-shaped (`{"data": [{"id":
+ * "sol"}, ...]}`) — it carries no separate display name, so `display_name`
+ * is set to the same slug (matches `codex-models-probe.ts`'s
+ * `CodexModelCatalogEntry` shape for the client's shared consumer).
+ */
+export declare function probeCodextenderModels(port: number, deps?: CodextenderProbeDeps): Promise<CodextenderProbeResult>;
+/**
+ * Resolves the REAL context window for the Codextender alias a task is
+ * about to launch with, straight from the proxy's own `/v1/models` response
+ * (operator finding, 2026-09-26, live Codextender iterate test) — never a
+ * number hardcoded here a second time. Claude Code assumes a 200K context
+ * window for any model id it doesn't recognize (the Codex alias is one) and
+ * proactively over-compacts against that wrong, much-too-small ceiling; the
+ * fix is `launcher-codextender.ts` setting `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * from THIS value, so a change to codextender's own declared window (its
+ * `config.py` `model_info.max_input_tokens`) can never drift out of sync
+ * with what webui tells Claude Code — both repos read the same live number.
+ *
+ * Never throws, same contract as `probeCodextenderModels` — resolves
+ * `undefined` (not a guessed fallback) when the probe fails, the alias
+ * isn't in the response, or the response carries no usable
+ * `max_input_tokens` for it (an older/unpatched proxy). The caller's
+ * contract for `undefined` is "leave `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * unset", which is the conservative, safe default — Claude Code's own 200K
+ * fallback — rather than risking an inflated ceiling that starves
+ * compaction entirely.
+ */
+export declare function resolveCodextenderMaxContextTokens(port: number, model: string | undefined, deps?: CodextenderProbeDeps): Promise<number | undefined>;
+/**
+ * `GET http://127.0.0.1:<port>/health/liveliness` — no auth header
+ * required (confirmed live against a real local LiteLLM proxy). This is
+ * the AC8 pre-flight probe: it only needs to know the proxy process is up
+ * and answering, not what it serves. Never throws — same
+ * never-reject contract as `probeCodextenderModels`.
+ */
+export declare function probeCodextenderLiveness(port: number, deps?: CodextenderProbeDeps): Promise<boolean>;
+//# sourceMappingURL=codextender-proxy-probe.d.ts.map

package/server/dist/core/codextender-proxy-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-proxy-probe.d.ts","sourceRoot":"","sources":["../../src/core/codextender-proxy-probe.ts"],"names":[],"mappings":"AAmCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAOtE;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB;;;+CAG2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,qBAAqB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;qEACiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;uEACmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsBD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAmCjC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM7B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/server/dist/core/codextender-proxy-probe.js

@@ -0,0 +1,179 @@
+/*
+ * codextender-proxy-probe — HTTP probes of the local Codextender (LiteLLM)
+ * proxy (Codextender integration spec Part B.3/B.5, re-verified live
+ * 2026-09-23).
+ *
+ * Two distinct endpoints, deliberately not collapsed into one probe:
+ *  - `probeCodextenderLiveness` -> `GET /health/liveliness`, no auth
+ *    header. This is the AC8 pre-flight check (`runtime-chokepoint.ts`'s
+ *    `checkCodextenderProxyAvailable` default, and its fork-route
+ *    equivalent in `external/tasks/fork.ts`) — a launch/fork only needs to
+ *    know the proxy is UP, not what it serves.
+ *  - `probeCodextenderModels` -> `GET /v1/models`, WITH
+ *    `Authorization: Bearer <token>` where `<token>` comes from
+ *    `process.env.CODEXTENDER_AUTH_TOKEN` (`resolveCodextenderAuthToken()`
+ *    in `launcher-codextender.ts` — no built-in default, PR-review BLOCK,
+ *    iterate-2026-09-23) — an unconfigured token degrades this probe to
+ *    `{ok: false}` the same as an unreachable proxy, rather than sending a
+ *    baked-in value. Confirmed live against a real local LiteLLM proxy: an
+ *    unauthenticated `/v1/models` request returns `500` (a LiteLLM quirk,
+ *    not a clean 401), so omitting the header makes every probe look like
+ *    a hard failure regardless. Backs the cached `/api/codextender-models`
+ *    route (`routes/codextender-models.ts`), which wraps this probe in a
+ *    TTL cache mirroring `codex-models.ts`'s shape.
+ *
+ * Deliberately no CLI shell-out (unlike `codex-models-probe.ts`) — the
+ * proxy already speaks these two endpoints natively (LiteLLM's own
+ * built-in routes), so plain HTTP GETs are both the cheapest check and the
+ * datalist's real source.
+ */
+import { DEFAULT_CODEXTENDER_MODEL_ALIAS, resolveCodextenderAuthToken, } from "./launcher-codextender.js";
+/**
+ * `codextenderPort` is persisted/read as arbitrary JSON (PUT /api/settings
+ * accepts an unvalidated body; a hand-edited settings.json is untyped on
+ * disk too) before ever reaching here, so `port: number`'s compile-time
+ * type is not a runtime guarantee. Both probes below MUST reject anything
+ * outside a real TCP port before interpolating it into a URL — a value
+ * like `"4000@attacker.example"` would otherwise redirect the request via
+ * URL userinfo-authority confusion (PR-review BLOCK, iterate-2026-09-23
+ * fifth round). This is the enforcement point regardless of how an invalid
+ * value got in; `routes/settings.ts`'s PUT-time rejection (same finding)
+ * is defense-in-depth on top of it, not a substitute for it.
+ */
+export function isValidCodextenderPort(value) {
+    return (typeof value === "number" &&
+        Number.isInteger(value) &&
+        value >= 1 &&
+        value <= 65535);
+}
+/**
+ * PR-review preflight BLOCK (round 14, 2026-09-26) — `max_input_tokens`
+ * lives under each entry's `model_info` object (LiteLLM's own extension to
+ * the OpenAI-shaped `/v1/models` list; codextender's operator finding
+ * describes its config as declaring the value "in its LiteLLM
+ * `model_info`"), NOT as a flat, top-level field on the entry. A flat
+ * `entry.max_input_tokens` is checked too, purely as a forward-compatible
+ * fallback in case a future LiteLLM/codextender version flattens it — the
+ * nested form is the one actually confirmed, so it takes precedence.
+ */
+function extractMaxInputTokens(entry) {
+    const modelInfo = entry.model_info;
+    const nested = modelInfo && typeof modelInfo === "object"
+        ? modelInfo.max_input_tokens
+        : undefined;
+    const raw = nested ?? entry.max_input_tokens;
+    return typeof raw === "number" && Number.isInteger(raw) && raw > 0 ? raw : undefined;
+}
+/**
+ * `GET http://127.0.0.1:<port>/v1/models` with the configured Codextender
+ * master-key bearer token (`deps.authToken` or `resolveCodextenderAuthToken()`).
+ * Never throws — an unconfigured token, any network error, non-2xx status,
+ * timeout, or malformed body all resolve `{ok: false, models: []}` rather
+ * than rejecting, so callers never need a try/catch.
+ *
+ * LiteLLM's `/v1/models` response is OpenAI-shaped (`{"data": [{"id":
+ * "sol"}, ...]}`) — it carries no separate display name, so `display_name`
+ * is set to the same slug (matches `codex-models-probe.ts`'s
+ * `CodexModelCatalogEntry` shape for the client's shared consumer).
+ */
+export async function probeCodextenderModels(port, deps = {}) {
+    if (!isValidCodextenderPort(port))
+        return { ok: false, models: [] };
+    const authToken = deps.authToken ?? resolveCodextenderAuthToken();
+    if (!authToken)
+        return { ok: false, models: [] };
+    const fetchFn = deps.fetchFn ?? fetch;
+    const timeoutMs = deps.timeoutMs ?? 1500;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchFn(`http://127.0.0.1:${port}/v1/models`, {
+            signal: controller.signal,
+            headers: { Authorization: `Bearer ${authToken}` },
+        });
+        if (!res.ok)
+            return { ok: false, models: [] };
+        const body = await res.json();
+        const rawModels = body?.data;
+        if (!Array.isArray(rawModels))
+            return { ok: false, models: [] };
+        const models = [];
+        for (const entry of rawModels) {
+            if (!entry || typeof entry !== "object")
+                continue;
+            const id = entry.id;
+            if (typeof id !== "string" || id.trim() === "")
+                continue;
+            const maxInputTokens = extractMaxInputTokens(entry);
+            models.push({
+                slug: id,
+                display_name: id,
+                ...(maxInputTokens !== undefined ? { max_input_tokens: maxInputTokens } : {}),
+            });
+        }
+        return { ok: true, models };
+    }
+    catch {
+        return { ok: false, models: [] };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Resolves the REAL context window for the Codextender alias a task is
+ * about to launch with, straight from the proxy's own `/v1/models` response
+ * (operator finding, 2026-09-26, live Codextender iterate test) — never a
+ * number hardcoded here a second time. Claude Code assumes a 200K context
+ * window for any model id it doesn't recognize (the Codex alias is one) and
+ * proactively over-compacts against that wrong, much-too-small ceiling; the
+ * fix is `launcher-codextender.ts` setting `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * from THIS value, so a change to codextender's own declared window (its
+ * `config.py` `model_info.max_input_tokens`) can never drift out of sync
+ * with what webui tells Claude Code — both repos read the same live number.
+ *
+ * Never throws, same contract as `probeCodextenderModels` — resolves
+ * `undefined` (not a guessed fallback) when the probe fails, the alias
+ * isn't in the response, or the response carries no usable
+ * `max_input_tokens` for it (an older/unpatched proxy). The caller's
+ * contract for `undefined` is "leave `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * unset", which is the conservative, safe default — Claude Code's own 200K
+ * fallback — rather than risking an inflated ceiling that starves
+ * compaction entirely.
+ */
+export async function resolveCodextenderMaxContextTokens(port, model, deps = {}) {
+    const alias = model?.trim() || DEFAULT_CODEXTENDER_MODEL_ALIAS;
+    const result = await probeCodextenderModels(port, deps);
+    if (!result.ok)
+        return undefined;
+    const entry = result.models.find((m) => m.slug === alias);
+    return entry?.max_input_tokens;
+}
+/**
+ * `GET http://127.0.0.1:<port>/health/liveliness` — no auth header
+ * required (confirmed live against a real local LiteLLM proxy). This is
+ * the AC8 pre-flight probe: it only needs to know the proxy process is up
+ * and answering, not what it serves. Never throws — same
+ * never-reject contract as `probeCodextenderModels`.
+ */
+export async function probeCodextenderLiveness(port, deps = {}) {
+    if (!isValidCodextenderPort(port))
+        return false;
+    const fetchFn = deps.fetchFn ?? fetch;
+    const timeoutMs = deps.timeoutMs ?? 1500;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchFn(`http://127.0.0.1:${port}/health/liveliness`, {
+            signal: controller.signal,
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=codextender-proxy-probe.js.map

package/server/dist/core/codextender-proxy-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-proxy-probe.js","sourceRoot":"","sources":["../../src/core/codextender-proxy-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACvB,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,KAAK,CACf,CAAC;AACJ,CAAC;AA4BD;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,MAAM,MAAM,GACV,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QACxC,CAAC,CAAE,SAAqC,CAAC,gBAAgB;QACzD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC;IAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,OAA6B,EAAE;IAE/B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,2BAA2B,EAAE,CAAC;IAClE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,oBAAoB,IAAI,YAAY,EAAE;YAC9D,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAI,IAAkC,EAAE,IAAI,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAClD,MAAM,EAAE,GAAI,KAAiC,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACzD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAgC,CAAC,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,EAAE;gBACR,YAAY,EAAE,EAAE;gBAChB,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,IAAY,EACZ,KAAyB,EACzB,OAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,+BAA+B,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,gBAAgB,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,OAA6B,EAAE;IAE/B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,oBAAoB,IAAI,oBAAoB,EAAE;YACtE,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/server/dist/core/contract-version.d.ts

@@ -44,12 +44,27 @@ export declare const PROFILE_SCHEMA_VERSION = 1;
  * (it consumes `Object.values(requirements)` then inner `.id`/`.tests`), so v3
  * is a pure data-shape acknowledgement — no reader-logic change.
  *
+ * **v4** (shipwright monorepo campaign req3-04c-ac-identity-wave2, P3.2:
+ * "AC-scoped `@covers` tag grammar + test-traceability manifest v4") —
+ * additive AC-scoped test binding. A test link may carry an optional
+ * `ac_id` (e.g. `covers("FR-01.11/AC07")` → `"AC07"`), and a requirement
+ * node may carry an optional `acs` breakdown mirroring its own
+ * `tests`/`coverage` shape, scoped per AC. Both are OMITTED ENTIRELY when
+ * the requirement has no AC-scoped tag anywhere, so a repo with none of
+ * these tags yet emits a byte-identical v3-shaped body (only the
+ * `schema_version` const moves). This reader does not consume `ac_id` or
+ * `acs` — it still only reads `.id`/`.tests[<layer>][*].id/.layer/.resolved_from`,
+ * every one of which is unchanged and required in both v3 and v4 — so a
+ * v4 manifest with NO AC tags at all (a "v3-shaped bare FR tag" body) and
+ * one WITH AC tags both invert identically; frozen fixture in
+ * `traceability.v4-fixture.test.ts` pins both shapes.
+ *
  * A manifest declaring a HIGHER version is warned once (via
  * `checkContractVersion`) and still read best-effort — the inner shape the
  * reader consumes has been stable across the bumps seen so far, so an
  * ahead-of-us manifest still yields a useful index.
  */
-export declare const TRACEABILITY_SCHEMA_VERSION = 3;
+export declare const TRACEABILITY_SCHEMA_VERSION = 4;
 /**
  * Check a parsed artefact's declared version against the library's
  * known max. Logs one JSON warning per (artefact, path, version)

package/server/dist/core/contract-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-version.d.ts","sourceRoot":"","sources":["../../src/core/contract-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;GAGG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAc7C;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAmDV;AAED,gEAAgE;AAChE,wBAAgB,cAAc,IAAI,IAAI,CAErC"}
+{"version":3,"file":"contract-version.d.ts","sourceRoot":"","sources":["../../src/core/contract-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;GAGG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAc7C;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAmDV;AAED,gEAAgE;AAChE,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/server/dist/core/contract-version.js

@@ -44,12 +44,27 @@ export const PROFILE_SCHEMA_VERSION = 1;
  * (it consumes `Object.values(requirements)` then inner `.id`/`.tests`), so v3
  * is a pure data-shape acknowledgement — no reader-logic change.
  *
+ * **v4** (shipwright monorepo campaign req3-04c-ac-identity-wave2, P3.2:
+ * "AC-scoped `@covers` tag grammar + test-traceability manifest v4") —
+ * additive AC-scoped test binding. A test link may carry an optional
+ * `ac_id` (e.g. `covers("FR-01.11/AC07")` → `"AC07"`), and a requirement
+ * node may carry an optional `acs` breakdown mirroring its own
+ * `tests`/`coverage` shape, scoped per AC. Both are OMITTED ENTIRELY when
+ * the requirement has no AC-scoped tag anywhere, so a repo with none of
+ * these tags yet emits a byte-identical v3-shaped body (only the
+ * `schema_version` const moves). This reader does not consume `ac_id` or
+ * `acs` — it still only reads `.id`/`.tests[<layer>][*].id/.layer/.resolved_from`,
+ * every one of which is unchanged and required in both v3 and v4 — so a
+ * v4 manifest with NO AC tags at all (a "v3-shaped bare FR tag" body) and
+ * one WITH AC tags both invert identically; frozen fixture in
+ * `traceability.v4-fixture.test.ts` pins both shapes.
+ *
  * A manifest declaring a HIGHER version is warned once (via
  * `checkContractVersion`) and still read best-effort — the inner shape the
  * reader consumes has been stable across the bumps seen so far, so an
  * ahead-of-us manifest still yields a useful index.
  */
-export const TRACEABILITY_SCHEMA_VERSION = 3;
+export const TRACEABILITY_SCHEMA_VERSION = 4;
 const warnedOnce = new Set();
 function warnKey(k) {
     return `${k.artefact}::${k.path}::${k.observedVersion}`;

package/server/dist/core/contract-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract-version.js","sourceRoot":"","sources":["../../src/core/contract-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAQ7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;AAErC,SAAS,OAAO,CAAC,CAAc;IAC7B,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAMpC;IACC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,GAAG,iBAAiB,EAAE,GACzE,KAAK,CAAC;IAER,uEAAuE;IACvE,sEAAsE;IACtE,gCAAgC;IAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,gEAAgE;QAChE,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,4BAA4B;gBACnC,QAAQ;gBACR,IAAI;gBACJ,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACxC,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,wBAAwB;gBAC/B,QAAQ;gBACR,IAAI;gBACJ,KAAK,EAAE,SAAS;gBAChB,QAAQ;gBACR,QAAQ;gBACR,IAAI,EACF,+DAA+D;oBAC/D,mEAAmE;aACtE,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc;IAC5B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"contract-version.js","sourceRoot":"","sources":["../../src/core/contract-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAQ7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;AAErC,SAAS,OAAO,CAAC,CAAc;IAC7B,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAMpC;IACC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,GAAG,iBAAiB,EAAE,GACzE,KAAK,CAAC;IAER,uEAAuE;IACvE,sEAAsE;IACtE,gCAAgC;IAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,gEAAgE;QAChE,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,4BAA4B;gBACnC,QAAQ;gBACR,IAAI;gBACJ,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACxC,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,wBAAwB;gBAC/B,QAAQ;gBACR,IAAI;gBACJ,KAAK,EAAE,SAAS;gBAChB,QAAQ;gBACR,QAAQ;gBACR,IAAI,EACF,+DAA+D;oBAC/D,mEAAmE;aACtE,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc;IAC5B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/server/dist/core/launcher-codex.d.ts

@@ -0,0 +1,61 @@
+import { type CopyCommandForms } from "./launcher.js";
+export interface CodexLaunchArgs {
+    cwd: string;
+    /** Defaults to "guided" when omitted (matches AutonomyToggle's own default). */
+    autonomy?: "guided" | "autonomous";
+    /** true → emit `codex resume <threadId>` instead of a fresh launch. */
+    resume?: boolean;
+    /** Required when `resume` is true — persisted at launch (§4). */
+    threadId?: string;
+    phase?: string;
+    description?: string;
+    /**
+     * §2.3 — whether the project's `AGENTS.md` already carries the Codex
+     * operating contract. When true AND `phase === "iterate"`, the prompt
+     * omits the SKILL.md pointer and the inlined model-pin/review-cascade
+     * text (AGENTS.md already covers both for that phase). Computed by the
+     * caller (a plain `existsSync` check) — this module stays pure.
+     */
+    hasAgentsMd?: boolean;
+    /**
+     * iterate-2026-09-17-codex-model-tier-parameterization — session-scoped
+     * override for Codex's own top-level model (one of the confirmed catalog
+     * slugs, validated by the caller). Emitted as a real `-c model=` CLI
+     * flag, never prose — it is layered on top of `~/.codex/config.toml` and
+     * any project config *before* Codex reads `AGENTS.md`, so it applies
+     * unconditionally on `hasAgentsMd` and doesn't depend on Codex's own
+     * instruction-following. Undefined → no flag, no behavior change.
+     */
+    implementationModel?: string;
+    /**
+     * iterate-2026-09-19-codex-reviewer-fields (shipwright#772) — session-
+     * scoped overrides for Codex's own review subagents. Unlike
+     * `implementationModel` these are NOT `-c` flags read by the top-level
+     * `codex` process itself; `run_codex_review` (invoked by Codex's shell
+     * tool mid-session) resolves `SHIPWRIGHT_CODEX_PLAN_REVIEW_MODEL` /
+     * `SHIPWRIGHT_CODEX_REVIEW_MODEL` from its OWN process env ahead of the
+     * project's `shipwright_model_config.json` fallback — so they're emitted
+     * here as an env-var prefix on the command line, ahead of `codex`, and
+     * reach that subprocess via `shell_environment_policy.inherit=all`
+     * (already unconditional above). Undefined → no prefix, no behavior
+     * change, same as `implementationModel`.
+     */
+    planReviewModel?: string;
+    reviewModel?: string;
+}
+export declare function buildCodexCommands(args: CodexLaunchArgs): CopyCommandForms;
+/**
+ * §2.3 — Codex's per-phase standing instructions live in prompt text this
+ * function composes, not a template file. For a project with no
+ * `AGENTS.md` (or a phase it doesn't cover), inline the model pins and
+ * review-cascade authorization directly rather than generating a file into
+ * someone else's repo. §5.4 — every prompt ends with an instruction to
+ * close with a structured `SHIPWRIGHT-STATUS` self-report, cross-checked
+ * against the oracle verdict by `CodexTaskWatcher`.
+ */
+export declare function buildCodexPrompt(args: {
+    phase?: string;
+    description?: string;
+    hasAgentsMd?: boolean;
+}): string;
+//# sourceMappingURL=launcher-codex.d.ts.map

package/server/dist/core/launcher-codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher-codex.d.ts","sourceRoot":"","sources":["../../src/core/launcher-codex.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,QAAQ,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACnC,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAM1E;AAwID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAgCT"}