@svenroth-ai/shipwright 0.26.0 → 0.28.0

package/server/dist/external/launch/routes.js

@@ -4,6 +4,7 @@
  * The launch handler dispatches across branches in precedence order.
  * Each branch lives in its own file to keep this shell ≤ 300 LOC:
  *
+ *   (dispatch chain lives in ./branch-dispatch.ts)
  *   1. ./phase-task-branch.ts        — body.phaseTaskRef present
  *   2. ./campaign-branch.ts          — body.campaignSlug + fresh-start (FR-01.34)
  *   2.5 ./campaign-step-branch.ts    — body.campaignStep + fresh-start (FR-01.36)
@@ -19,7 +20,12 @@
  */
 import { Hono } from "hono";
 import { withLiveSession } from "../_shared/helpers.js";
-import { parseLaunchBody, applyPhaseTaskBranch, applyCampaignBranch, applyCampaignStepBranch, applyMasterRunBranch, applyActionSubstitutionBranch, applyLegacyFallbackBranch, } from "./_helpers.js";
+import { parseLaunchBody } from "./_helpers.js";
+import { dispatchLaunchBranches } from "./branch-dispatch.js";
+import { checkClaimHolderGate } from "./claim-holder-gate.js";
+import { commandsCarryPermissionPerimeter } from "./claim-permission-perimeter-assert.js";
+import { checkMixedLaunchIntents } from "./mixed-intents-guard.js";
+import { applyRuntimeChokepoint, resolveCodexIntegrationModeForLaunch, } from "./runtime-chokepoint.js";
 export function createLaunchRouter(deps) {
     const app = new Hono();
     const { store, ptyManager, getProjectById, runConfigReader, jsonlExistsOnDisk } = deps;
@@ -28,7 +34,7 @@ export function createLaunchRouter(deps) {
         const body = rawBody && typeof rawBody === "object" && !Array.isArray(rawBody)
             ? rawBody
             : {};
-        const task = store.get(c.req.param("id"));
+        let task = store.get(c.req.param("id"));
         if (!task)
             return c.json({ error: "Task not found" }, 404);
         // Section 03 (iterate 3) — O20 idempotency guard. Reject re-launch on
@@ -39,158 +45,123 @@ export function createLaunchRouter(deps) {
             return c.json({ error: "launch_invalid_state", state: task.state }, 409);
         }
         // iterate-2026-05-14 lead-foundation-task-schema (leadwright Phase 1).
-        // While a task is claimed the user-level launch route MUST step aside
-        // so user + daemon don't fight over the same session (stale SQLite
-        // lock, interleaved JSONL, double-running shells). External review
-        // HIGH-2: only `claimToken` triggers the 409.
-        if (typeof task.claimToken === "string" && task.claimToken.length > 0) {
-            console.warn(JSON.stringify({
-                level: "warn",
-                message: "task_claimed: launch refused while claimToken is set",
-                taskId: task.taskId,
-                claimedBy: task.claimedBy,
-                claimedAt: task.claimedAt,
-                claimPid: task.claimPid,
-            }));
-            return c.json({
-                error: "task_claimed",
-                claimedBy: task.claimedBy,
-                claimedAt: task.claimedAt,
-            }, 409);
+        // While a task is claimed the launch route MUST step aside for anyone
+        // but the claim HOLDER (FR-04.22/V5, iterate-2026-09-03-claim-holder-launch)
+        // — so a stranger and the daemon don't fight over the same session
+        // (stale SQLite lock, interleaved JSONL, double-running shells), while
+        // the holder itself can still (re)launch. External review HIGH-2: only
+        // `claimToken` triggers the 409.
+        //
+        // The in-memory row can be STALE — `load()` runs once at server boot
+        // (index.ts), so a foreign claim written to disk by the leadwright
+        // daemon only reaches this process's memory via its OWN persist(). A
+        // webui that has persisted nothing since the claim was written would
+        // otherwise see no claim at all (the normal case for an idle daemon
+        // with no browser open). Refresh this one row from disk first — never
+        // re-run `load()` (a guarded no-op after the first call).
+        const freshTask = await store.refreshRowFromDisk(task.taskId);
+        if (freshTask)
+            task = freshTask;
+        const bodyClaimToken = typeof body.claimToken === "string" ? body.claimToken : undefined;
+        const claimGate = checkClaimHolderGate(task, bodyClaimToken);
+        if (!claimGate.allowed) {
+            return c.json(claimGate.error, 409);
         }
+        // FR-04.22 (iterate-2026-09-06-claim-launch-permission-perimeter) —
+        // true only for the leadwright stage-2 executor (the ONE caller that
+        // ever proves it holds the CURRENT claim). Threaded into BOTH branches
+        // a claim-only `{ claimToken }` launch body can actually reach: the
+        // action-substitution branch (leadwright always sets `actionId` at
+        // task creation — a required field on its side — and parse-body.ts's
+        // once-set-always-used contract resolves it from the persisted task
+        // even though the launch body carries no `actionId` itself) and the
+        // legacy fallback (a task launched before ever having an actionId set).
+        // phaseTaskRef/campaignSlug/campaignStep/masterRun are NEVER
+        // once-set-always-used (parse-body.ts: "Launch-body only (never
+        // persisted)"), so those branches structurally cannot fire for a
+        // `{ claimToken }`-only body and are left untouched. Every human/manual
+        // launch takes `claimGate.claimAuthorized === false` here, so its
+        // command string is unchanged byte-for-byte. See
+        // `./claim-executor-permissions.ts` for what gets armed and why.
+        const claimAuthorized = claimGate.claimAuthorized;
         // Parse + apply once-set-always-used (v0.4.1 fallback contract).
         const parseResult = parseLaunchBody(body, task);
         if ("error" in parseResult) {
             return c.json(parseResult.error, parseResult.status);
         }
         const parsed = parseResult;
-        // FR-01.34 — campaign autonomous launch is its own intent. Reject an
-        // EXPLICIT-body mix with actionId / phaseTaskRef (mirrors the existing
-        // phaseTaskRef+actionId rule). Checked on the raw body so a task's
-        // once-set-always-used persisted actionId never spuriously trips it.
-        if (typeof body.campaignSlug === "string" &&
-            body.campaignSlug.trim().length > 0 &&
-            (body.actionId !== undefined || body.phaseTaskRef !== undefined)) {
-            return c.json({
-                error: "mixed_launch_intents",
-                detail: "campaignSlug is mutually exclusive with actionId / phaseTaskRef",
-            }, 400);
-        }
-        // FR-01.36 — a single-sub-iterate launch is its own intent too. Reject a
-        // mix with actionId / phaseTaskRef / campaignSlug. Presence is the parsed
-        // (well-formed) campaignStep so a malformed body never trips it.
-        if (parsed.campaignStep &&
-            (body.actionId !== undefined ||
-                body.phaseTaskRef !== undefined ||
-                (typeof body.campaignSlug === "string" && body.campaignSlug.trim().length > 0))) {
-            return c.json({
-                error: "mixed_launch_intents",
-                detail: "campaignStep is mutually exclusive with actionId / phaseTaskRef / campaignSlug",
-            }, 400);
+        // FR-01.34 / FR-01.36 / webui-pipeline-convergence W2 — campaignSlug,
+        // campaignStep and masterRun are each their own launch intent, mutually
+        // exclusive with actionId / phaseTaskRef / each other. See
+        // ./mixed-intents-guard.ts.
+        const mixedIntents = checkMixedLaunchIntents(body, parsed);
+        if (mixedIntents) {
+            return c.json(mixedIntents.error, mixedIntents.status);
         }
-        // Campaign webui-pipeline-convergence W2 — a single-session master launch is
-        // its own intent. Reject a mix with any other explicit intent. Checked on
-        // the raw body (`parsed.masterRun` is derived from `body.masterRun`, which is
-        // never persisted) so a once-set-always-used field can't spuriously trip it.
-        if (Boolean(body.masterRun) &&
-            (body.actionId !== undefined ||
-                body.phaseTaskRef !== undefined ||
-                (typeof body.campaignSlug === "string" && body.campaignSlug.trim().length > 0) ||
-                body.campaignStep !== undefined)) {
-            return c.json({
-                error: "mixed_launch_intents",
-                detail: "masterRun is mutually exclusive with actionId / phaseTaskRef / campaignSlug / campaignStep",
-            }, 400);
-        }
-        // iterate-2026-05-18-fix-resume-description — a Resume click on a
-        // task whose Claude conversation was never established (no
-        // <uuid>.jsonl ever observed on disk → there is nothing to resume)
-        // is semantically a FRESH start. Route it through the substitution
-        // branch so the brief + slash command are injected exactly like a
-        // direct Launch. A genuine resume (JSONL on disk) stays on the
-        // description-free `--resume` shape.
-        const jsonlObserved = Boolean(task.firstJsonlObservedAt);
-        const effectivelyFreshStart = !parsed.resume || (!jsonlObserved && !parsed.dryRun);
-        // Branch 1 — phaseTaskRef (load-bearing security path).
-        const phaseResult = await applyPhaseTaskBranch({
+        const branchResult = await dispatchLaunchBranches({
             task,
             parsed,
             getProjectById,
             runConfigReader,
             jsonlExistsOnDisk,
+            listTasks: () => store.list(),
+            claimAuthorized,
         });
-        let branchResult = phaseResult;
-        // Branch 2 — campaign autonomous launch (FR-01.34). Command built
-        // server-side from a validated slug; null when no campaignSlug / a resume.
-        if (!branchResult) {
-            branchResult = applyCampaignBranch({
-                task,
-                parsed,
-                effectivelyFreshStart,
-                getProjectById,
-            });
-        }
-        // Branch 2.5 — single-sub-iterate launch (FR-01.36). Command built
-        // server-side from a validated { slug, stepId }; null when no campaignStep
-        // / a resume.
-        if (!branchResult) {
-            branchResult = applyCampaignStepBranch({
-                task,
-                parsed,
-                effectivelyFreshStart,
-                getProjectById,
-            });
-        }
-        // Branch 2.6 — single-session master launch (campaign
-        // webui-pipeline-convergence W2). Command built server-side (`/shipwright-run`)
-        // gated on a readable single_session run_config; null when no masterRun / a
-        // resume (→ legacy `--resume <masterUuid>`).
-        if (!branchResult) {
-            branchResult = await applyMasterRunBranch({
-                task,
-                parsed,
-                effectivelyFreshStart,
-                getProjectById,
-                runConfigReader,
-                listTasks: () => store.list(),
-                jsonlExistsOnDisk,
-            });
-        }
-        // Branch 3 — action substitution.
-        if (!branchResult) {
-            branchResult = applyActionSubstitutionBranch({
-                task,
-                parsed,
-                effectivelyFreshStart,
-                getProjectById,
-            });
-        }
-        // If a branch produced an error envelope, terminate.
-        if (branchResult && "error" in branchResult) {
+        // A branch that produced an error envelope terminates the handler.
+        if ("error" in branchResult) {
             return c.json(branchResult.error, branchResult.status);
         }
-        // Branch 4 — legacy fallback. Always populates.
-        let commands;
-        let taskUpdate;
-        if (branchResult) {
-            ({ commands, taskUpdate } = branchResult);
+        let { commands, taskUpdate } = branchResult;
+        // Fail-open notice from the single-sub-iterate branch (see _helpers.ts).
+        const readinessNotice = branchResult.readinessChecked === false ? { readinessChecked: false } : {};
+        // Codex Light (Spec/codex-light-webui.md §2.1) — the ONE chokepoint for
+        // all six launch branches above: overrides `commands`/`taskUpdate` with
+        // `buildCodexCommands` when this task's runtime is Codex, byte-identical
+        // pass-through otherwise. Also carries AC9's new-pipeline block. Must
+        // run before the permission-perimeter assertion below so a blocked
+        // pipeline launch never reaches it, and so a Codex override is present
+        // BY the time that assertion inspects `commands`.
+        const runtimeResult = await applyRuntimeChokepoint({
+            task,
+            parsed,
+            project: getProjectById?.(task.projectId),
+            commands,
+            taskUpdate,
+            codexIntegrationMode: resolveCodexIntegrationModeForLaunch(task, await deps.getCodexIntegrationMode?.()),
+            codextenderPort: await deps.getCodextenderPort?.(),
+        });
+        if ("error" in runtimeResult) {
+            return c.json(runtimeResult.error, runtimeResult.status);
         }
-        else {
-            ({ commands, taskUpdate } = applyLegacyFallbackBranch({
-                task,
-                parsed,
-                jsonlObserved,
-            }));
+        ({ commands, taskUpdate } = runtimeResult);
+        // FR-04.22 Stage-3 doubt review — a per-branch opt-in (only
+        // action-substitution-branch.ts and legacy-fallback-branch.ts take
+        // `claimAuthorized`) rests on an assumption about which body shapes
+        // leadwright sends today; it is not a code-enforced invariant against a
+        // FUTURE body that combines a valid `claimToken` with `phaseTaskRef` /
+        // `campaignSlug` / `campaignStep` / `masterRun` and reaches one of the
+        // four branches that never learned about claims. This centralized
+        // assertion is the actual enforcement: no matter which branch produced
+        // `commands`, a claim-authorized launch must carry the permission
+        // perimeter on every shell form, or the request is refused — never
+        // silently downgraded to an unrestricted command that looks armed
+        // because the caller held a claim.
+        if (claimAuthorized && !commandsCarryPermissionPerimeter(commands)) {
+            return c.json({
+                error: "claim_launch_permission_perimeter_missing",
+                detail: "claim-authorized launch resolved to a branch that did not arm the permission perimeter",
+            }, 409);
         }
         if (parsed.dryRun) {
             // Pure command-string build — no state mutation, no persist.
-            return c.json({ task: withLiveSession(task, ptyManager), commands });
+            return c.json({ task: withLiveSession(task, ptyManager), commands, ...readinessNotice });
         }
         const updated = store.patch(task.taskId, taskUpdate);
         await store.persist();
         return c.json({
             task: withLiveSession(updated, ptyManager),
             commands,
+            ...readinessNotice,
         });
     });
     return app;

package/server/dist/external/launch/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/external/launch/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,GAE1B,MAAM,eAAe,CAAC;AAkBvB,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAC7E,IAAI,CAAC;IAEP,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,IAAI,GACR,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/D,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3D,sEAAsE;QACtE,8DAA8D;QAC9D,sEAAsE;QACtE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EACpD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,8CAA8C;QAC9C,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,sDAAsD;gBAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CACH,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC;QAE3B,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,qEAAqE;QACrE,IACE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACrC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACnC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,EAChE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,iEAAiE;aAC1E,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,IACE,MAAM,CAAC,YAAY;YACnB,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAC1B,IAAI,CAAC,YAAY,KAAK,SAAS;gBAC/B,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACjF,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,gFAAgF;aACzF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,6EAA6E;QAC7E,IACE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YACvB,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAC1B,IAAI,CAAC,YAAY,KAAK,SAAS;gBAC/B,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9E,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,EAClC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EACJ,4FAA4F;aAC/F,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,2DAA2D;QAC3D,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,+DAA+D;QAC/D,qCAAqC;QACrC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACzD,MAAM,qBAAqB,GACzB,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEvD,wDAAwD;QACxD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC;YAC7C,IAAI;YACJ,MAAM;YACN,cAAc;YACd,eAAe;YACf,iBAAiB;SAClB,CAAC,CAAC;QACH,IAAI,YAAY,GAA8B,WAAW,CAAC;QAE1D,kEAAkE;QAClE,2EAA2E;QAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,mBAAmB,CAAC;gBACjC,IAAI;gBACJ,MAAM;gBACN,qBAAqB;gBACrB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,mEAAmE;QACnE,2EAA2E;QAC3E,cAAc;QACd,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,uBAAuB,CAAC;gBACrC,IAAI;gBACJ,MAAM;gBACN,qBAAqB;gBACrB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,sDAAsD;QACtD,gFAAgF;QAChF,4EAA4E;QAC5E,6CAA6C;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,MAAM,oBAAoB,CAAC;gBACxC,IAAI;gBACJ,MAAM;gBACN,qBAAqB;gBACrB,cAAc;gBACd,eAAe;gBACf,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC7B,iBAAiB;aAClB,CAAC,CAAC;QACL,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,6BAA6B,CAAC;gBAC3C,IAAI;gBACJ,MAAM;gBACN,qBAAqB;gBACrB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,qDAAqD;QACrD,IAAI,YAAY,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC;QACb,IAAI,UAAiC,CAAC;QACtC,IAAI,YAAY,EAAE,CAAC;YACjB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,yBAAyB,CAAC;gBACpD,IAAI;gBACJ,MAAM;gBACN,aAAa;aACd,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,6DAA6D;YAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC;YAC1C,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/external/launch/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,oCAAoC,GACrC,MAAM,yBAAyB,CAAC;AAqBjC,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAC7E,IAAI,CAAC;IAEP,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,IAAI,GACR,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/D,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3D,sEAAsE;QACtE,8DAA8D;QAC9D,sEAAsE;QACtE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EACpD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,6EAA6E;QAC7E,mEAAmE;QACnE,uEAAuE;QACvE,uEAAuE;QACvE,iCAAiC;QACjC,EAAE;QACF,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,0DAA0D;QAC1D,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,SAAS;YAAE,IAAI,GAAG,SAAS,CAAC;QAEhC,MAAM,cAAc,GAClB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,wEAAwE;QACxE,6DAA6D;QAC7D,gEAAgE;QAChE,iEAAiE;QACjE,wEAAwE;QACxE,kEAAkE;QAClE,iDAAiD;QACjD,iEAAiE;QACjE,MAAM,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC;QAElD,iEAAiE;QACjE,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC;QAE3B,sEAAsE;QACtE,wEAAwE;QACxE,2DAA2D;QAC3D,4BAA4B;QAC5B,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC;YAChD,IAAI;YACJ,MAAM;YACN,cAAc;YACd,eAAe;YACf,iBAAiB;YACjB,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;YAC7B,eAAe;SAChB,CAAC,CAAC;QACH,mEAAmE;QACnE,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;QAC5C,yEAAyE;QACzE,MAAM,eAAe,GAAG,YAAY,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnG,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;YACjD,IAAI;YACJ,MAAM;YACN,OAAO,EAAE,cAAc,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;YACzC,QAAQ;YACR,UAAU;YACV,oBAAoB,EAAE,oCAAoC,CACxD,IAAI,EACJ,MAAM,IAAI,CAAC,uBAAuB,EAAE,EAAE,CACvC;YACD,eAAe,EAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QACD,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,CAAC;QAE3C,4DAA4D;QAC5D,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,uEAAuE;QACvE,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,mCAAmC;QACnC,IAAI,eAAe,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,2CAA2C;gBAClD,MAAM,EACJ,wFAAwF;aAC3F,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,6DAA6D;YAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC;YAC1C,QAAQ;YACR,GAAG,eAAe;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/external/launch/runtime-chokepoint-codextender.d.ts

@@ -0,0 +1,20 @@
+import type { CopyCommandForms } from "../../core/launcher.js";
+import type { ExternalTask } from "../../core/sdk-sessions-store.js";
+import type { ParsedLaunchBody } from "./parse-body.js";
+import type { RuntimeChokepointBlocked, RuntimeChokepointOk } from "./runtime-chokepoint.js";
+export declare function applyCodextenderChokepoint(args: {
+    task: ExternalTask;
+    parsed: ParsedLaunchBody;
+    commands: CopyCommandForms;
+    taskUpdate: Partial<ExternalTask>;
+    codextenderPort: number;
+    checkCodextenderProxyAvailable: () => Promise<boolean>;
+    getCodextenderAuthToken: () => string | undefined;
+    /** Test seam — defaults to a real probe of the proxy's `/v1/models` for
+     *  the selected alias's `max_input_tokens` (operator finding,
+     *  2026-09-26: Claude Code assumes a 200K context window for any model id
+     *  it doesn't recognize and over-compacts against that wrong ceiling).
+     *  `model` is the same value passed to `buildCodextenderCommands`. */
+    getCodextenderMaxContextTokens: (model: string | undefined) => Promise<number | undefined>;
+}): Promise<RuntimeChokepointOk | RuntimeChokepointBlocked>;
+//# sourceMappingURL=runtime-chokepoint-codextender.d.ts.map

package/server/dist/external/launch/runtime-chokepoint-codextender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-chokepoint-codextender.d.ts","sourceRoot":"","sources":["../../../src/external/launch/runtime-chokepoint-codextender.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAMxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE7F,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,8BAA8B,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,uBAAuB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAClD;;;;0EAIsE;IACtE,8BAA8B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC5F,GAAG,OAAO,CAAC,mBAAmB,GAAG,wBAAwB,CAAC,CA2C1D"}

package/server/dist/external/launch/runtime-chokepoint-codextender.js

@@ -0,0 +1,51 @@
+/*
+ * external/launch/runtime-chokepoint-codextender.ts — the launch
+ * chokepoint's Codextender-mode branch (Codextender integration Part
+ * B.3/B.6), split out of runtime-chokepoint.ts (2026-09-26, bloat
+ * anti-ratchet — mirrors the `fork.ts` split out of `lifecycle.ts` for the
+ * same "Codextender integration file-size cleanup" reason). A Codextender
+ * task drives ordinary `claude` underneath (via a local LiteLLM proxy), not
+ * the `codex` CLI, so it needs its own availability probe (the proxy's
+ * `/v1/models`, not `codex --version`) and reuses the already-built
+ * plain-Claude `commands` the chokepoint received, rather than
+ * `buildCodexCommands`.
+ */
+import { buildCodextenderCommands, CodextenderCwdMismatchError, } from "../../core/launcher-codextender.js";
+import { codextenderAuthTokenMissingError, codextenderCwdMismatchError, codextenderProxyUnreachableError, } from "./runtime-chokepoint-errors.js";
+export async function applyCodextenderChokepoint(args) {
+    const { task, parsed, commands, taskUpdate, codextenderPort, checkCodextenderProxyAvailable, getCodextenderAuthToken, getCodextenderMaxContextTokens, } = args;
+    if (!(await checkCodextenderProxyAvailable())) {
+        return { error: codextenderProxyUnreachableError(codextenderPort), status: 400 };
+    }
+    const codextenderAuthToken = getCodextenderAuthToken();
+    if (!codextenderAuthToken) {
+        return { error: codextenderAuthTokenMissingError(), status: 400 };
+    }
+    const maxContextTokens = await getCodextenderMaxContextTokens(parsed.codexImplementationModel);
+    let codextenderCommands;
+    try {
+        codextenderCommands = buildCodextenderCommands({
+            cwd: task.cwd,
+            baseUrl: `http://127.0.0.1:${codextenderPort}`,
+            model: parsed.codexImplementationModel,
+            authToken: codextenderAuthToken,
+            claudeCommands: commands,
+            maxContextTokens,
+        });
+    }
+    catch (err) {
+        if (!(err instanceof CodextenderCwdMismatchError))
+            throw err;
+        return { error: codextenderCwdMismatchError(), status: 500 };
+    }
+    return {
+        commands: codextenderCommands,
+        taskUpdate: {
+            ...taskUpdate,
+            state: "awaiting_external_start",
+            launchedAt: new Date().toISOString(),
+            codexIntegrationMode: "codextender",
+        },
+    };
+}
+//# sourceMappingURL=runtime-chokepoint-codextender.js.map

package/server/dist/external/launch/runtime-chokepoint-codextender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-chokepoint-codextender.js","sourceRoot":"","sources":["../../../src/external/launch/runtime-chokepoint-codextender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAI5C,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AAGxC,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAchD;IACC,MAAM,EACJ,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,8BAA8B,EAC9B,uBAAuB,EACvB,8BAA8B,GAC/B,GAAG,IAAI,CAAC;IAET,IAAI,CAAC,CAAC,MAAM,8BAA8B,EAAE,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,gCAAgC,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,oBAAoB,GAAG,uBAAuB,EAAE,CAAC;IACvD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC/F,IAAI,mBAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,mBAAmB,GAAG,wBAAwB,CAAC;YAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,oBAAoB,eAAe,EAAE;YAC9C,KAAK,EAAE,MAAM,CAAC,wBAAwB;YACtC,SAAS,EAAE,oBAAoB;YAC/B,cAAc,EAAE,QAAQ;YACxB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,2BAA2B,CAAC;YAAE,MAAM,GAAG,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,mBAAmB;QAC7B,UAAU,EAAE;YACV,GAAG,UAAU;YACb,KAAK,EAAE,yBAAyB;YAChC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,oBAAoB,EAAE,aAAa;SACpC;KACF,CAAC;AACJ,CAAC"}

package/server/dist/external/launch/runtime-chokepoint-errors.d.ts

@@ -0,0 +1,33 @@
+export declare function codextenderProxyUnreachableError(port: number): {
+    error: "codextender_proxy_unreachable";
+    detail: string;
+};
+/**
+ * PR-review BLOCK (iterate-2026-09-23-codextender-webui-integration,
+ * second round) — a hardcoded fallback bearer token read as an unsafe
+ * unconditional credential. `resolveCodextenderAuthToken()` now has no
+ * built-in default: a launch/fork attempted with none configured fails
+ * loud here instead of silently sending nothing (which `claude` would
+ * reject anyway once it tries to use `ANTHROPIC_BASE_URL`) or falling
+ * back to a baked-in value.
+ */
+export declare function codextenderAuthTokenMissingError(): {
+    error: "codextender_auth_token_missing";
+    detail: string;
+};
+export declare function codexCliNotFoundError(): {
+    error: "codex_cli_not_found";
+    detail: string;
+};
+/**
+ * Doubt-review HIGH (iterate-2026-09-23-codextender-webui-integration) —
+ * see `CodextenderCwdMismatchError`'s own doc comment in
+ * `core/launcher-codextender.ts` for why this can happen: a custom
+ * action's commands are built from `project.path`, not `task.cwd`, and the
+ * two can diverge for a worktree-based task.
+ */
+export declare function codextenderCwdMismatchError(): {
+    error: "codextender_cwd_mismatch";
+    detail: string;
+};
+//# sourceMappingURL=runtime-chokepoint-errors.d.ts.map

package/server/dist/external/launch/runtime-chokepoint-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-chokepoint-errors.d.ts","sourceRoot":"","sources":["../../../src/external/launch/runtime-chokepoint-errors.ts"],"names":[],"mappings":"AAcA,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM;;;EAS5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC;;;EAU/C;AAED,wBAAgB,qBAAqB;;;EAQpC;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B;;;EAQ1C"}

package/server/dist/external/launch/runtime-chokepoint-errors.js

@@ -0,0 +1,63 @@
+/*
+ * external/launch/runtime-chokepoint-errors.ts — the Codex-runtime error
+ * bodies shared between `runtime-chokepoint.ts` and `external/tasks/
+ * fork.ts` (fork cannot call the chokepoint per §2.1's correction, but the
+ * user-facing wording has no reason to drift between the two call sites).
+ *
+ * Split out of runtime-chokepoint.ts (2026-09-23 — that file crossed the
+ * 300-line guideline) so each file stays a single concern.
+ */
+import os from "node:os";
+import { installHint } from "../../core/readiness-install-hints.js";
+export function codextenderProxyUnreachableError(port) {
+    return {
+        error: "codextender_proxy_unreachable",
+        detail: `This task's runtime is Codex, and the Codex Integration Mode is ` +
+            `Codextender, but the local Codextender proxy at ` +
+            `127.0.0.1:${port} isn't reachable. Start the ` +
+            "Codextender proxy, or switch this task's runtime to Claude.",
+    };
+}
+/**
+ * PR-review BLOCK (iterate-2026-09-23-codextender-webui-integration,
+ * second round) — a hardcoded fallback bearer token read as an unsafe
+ * unconditional credential. `resolveCodextenderAuthToken()` now has no
+ * built-in default: a launch/fork attempted with none configured fails
+ * loud here instead of silently sending nothing (which `claude` would
+ * reject anyway once it tries to use `ANTHROPIC_BASE_URL`) or falling
+ * back to a baked-in value.
+ */
+export function codextenderAuthTokenMissingError() {
+    return {
+        error: "codextender_auth_token_missing",
+        detail: "This task's runtime is Codex, and the Codex Integration Mode is " +
+            "Codextender, but no CODEXTENDER_AUTH_TOKEN is set in the webui " +
+            "server's environment. Set it to the local Codextender proxy's " +
+            "configured master key (see the codextender README) and restart " +
+            "the server, or switch this task's runtime to Claude.",
+    };
+}
+export function codexCliNotFoundError() {
+    return {
+        error: "codex_cli_not_found",
+        detail: "This task's runtime is Codex, but the Codex CLI isn't installed " +
+            "on this machine. " + installHint("codex", os.platform()) +
+            ", or switch this task's runtime to Claude.",
+    };
+}
+/**
+ * Doubt-review HIGH (iterate-2026-09-23-codextender-webui-integration) —
+ * see `CodextenderCwdMismatchError`'s own doc comment in
+ * `core/launcher-codextender.ts` for why this can happen: a custom
+ * action's commands are built from `project.path`, not `task.cwd`, and the
+ * two can diverge for a worktree-based task.
+ */
+export function codextenderCwdMismatchError() {
+    return {
+        error: "codextender_cwd_mismatch",
+        detail: "This task's launch command was built from a different working " +
+            "directory than the task's own cwd — refusing to launch with an " +
+            "ambiguous working directory.",
+    };
+}
+//# sourceMappingURL=runtime-chokepoint-errors.js.map

package/server/dist/external/launch/runtime-chokepoint-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-chokepoint-errors.js","sourceRoot":"","sources":["../../../src/external/launch/runtime-chokepoint-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAEpE,MAAM,UAAU,gCAAgC,CAAC,IAAY;IAC3D,OAAO;QACL,KAAK,EAAE,+BAAwC;QAC/C,MAAM,EACJ,kEAAkE;YAClE,kDAAkD;YAClD,aAAa,IAAI,8BAA8B;YAC/C,6DAA6D;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,KAAK,EAAE,gCAAyC;QAChD,MAAM,EACJ,kEAAkE;YAClE,iEAAiE;YACjE,gEAAgE;YAChE,iEAAiE;YACjE,sDAAsD;KACzD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,KAAK,EAAE,qBAA8B;QACrC,MAAM,EACJ,kEAAkE;YAClE,mBAAmB,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzD,4CAA4C;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,KAAK,EAAE,0BAAmC;QAC1C,MAAM,EACJ,gEAAgE;YAChE,iEAAiE;YACjE,8BAA8B;KACjC,CAAC;AACJ,CAAC"}

package/server/dist/external/launch/runtime-chokepoint.d.ts

@@ -0,0 +1,120 @@
+import type { CopyCommandForms } from "../../core/launcher.js";
+import type { ExternalTask, Runtime } from "../../core/sdk-sessions-store.js";
+import type { ExternalRouteProjectView } from "../_shared/helpers.js";
+import type { ParsedLaunchBody } from "./parse-body.js";
+export type CodexIntegrationMode = "light" | "codextender";
+/**
+ * Plan-review HIGH fix (iterate-2026-09-23) — pin to the task's OWN stamped
+ * mode once one exists, falling back to the live global setting only on a
+ * task's very first Codex-runtime launch. Without this, a Resume straddling
+ * a post-first-launch mode flip would silently switch mechanisms mid-session
+ * (e.g. discard a real `codex` thread's history for a Codextender relaunch).
+ * Pure/IO-free so `routes.ts` can unit-test the choice directly.
+ */
+export declare function resolveCodexIntegrationModeForLaunch(task: ExternalTask, liveGlobalSetting: CodexIntegrationMode | undefined): CodexIntegrationMode | undefined;
+/**
+ * AC8 — "a task launched with a runtime whose CLI isn't installed fails at
+ * launch time with one actionable message ... independent of the readiness
+ * probe's own gate" (Spec/codex-light-webui.md §5.9, lines 789-792). The
+ * per-task toggle means readiness can no longer treat either CLI as globally
+ * required (the readiness fix lives in readiness-probe.ts), so THIS is where
+ * an all-Claude machine actually gets stopped before a launch it can't run.
+ * Not cached like /api/readiness's 15s TTL — a launch is a low-frequency,
+ * user-initiated action, so a fresh check here is worth the one extra
+ * process spawn for correctness at the moment that matters.
+ *
+ * `defaultRunShim`, not `defaultRun` — on Windows Codex CLI installs as a
+ * `.cmd` shim (no `codex.exe`), which `defaultRun` cannot spawn under
+ * `shell:false` (ENOENT even when Codex is genuinely installed and working).
+ * See `defaultRunShim`'s own doc comment (iterate-2026-09-16-codex-probe-
+ * win32-shim) for why this is a sibling probe rather than a `defaultRun` fix.
+ */
+export declare function isCodexCliAvailable(): Promise<boolean>;
+/** §2.1 — a plain field read on an already-loaded task, not a fallback chain. */
+export declare function runtimeForTask(task: ExternalTask): Runtime;
+/**
+ * ADR-309 generalized the `new-plain` JSONL-liveness special-case to every
+ * Codex-runtime task (a Codex Light task never writes a Claude `.jsonl`
+ * under any actionId). Codextender integration Part B.6 excludes
+ * Codextender mode from that generalization: it drives ordinary `claude`
+ * via the local proxy, so it DOES write a real `.jsonl` and the ordinary
+ * `!firstJsonlObservedAt` transcript-poll path is already authoritative for
+ * it, exactly like a plain Claude task. Shared by `ws-upgrade-handler.ts`
+ * and `external/transcript/routes.ts` — their own companion-fix comments
+ * point back here rather than re-typing the condition.
+ */
+export declare function isCodexNonCodextenderTask(task: ExternalTask): boolean;
+/**
+ * AC9 — a multi-phase single thread's "done" has no oracle row (§1.8); a
+ * `new-pipeline` launch for a Codex task is blocked here, not silently
+ * downgraded. Keys on `actionId === "new-pipeline"` (never `phase`, which
+ * a pipeline launch never submits — `useNewIssueFormSubmit.ts`).
+ *
+ * Codextender integration Part B.6 — AC9's rationale (no thread/app-server
+ * resume machinery, `codex-light-webui.md` §1.8) is specific to the real
+ * `codex` CLI; a Codextender task drives ordinary `claude` underneath, so it
+ * has the SAME pipeline/resume machinery a Claude-runtime task does. Bypass
+ * keys on the FRESH `codexIntegrationMode` param (not `task.
+ * codexIntegrationMode`), which is unset on a task's very first Codextender
+ * launch — reading the stale/absent task field would wrongly block it.
+ */
+export declare function isCodexNewPipelineBlocked(task: ExternalTask, parsed: ParsedLaunchBody, codexIntegrationMode?: CodexIntegrationMode): boolean;
+/**
+ * AC7 — "Campaign is 'Codex Light 2'" (deferred, still out of scope). The
+ * campaign/step/master-run branches each build their own fixed command
+ * server-side (`/shipwright-run`, `/shipwright-iterate "<specPath>"`, ...);
+ * without this check this chokepoint would silently DISCARD that command
+ * and override it with a generic `buildCodexCommands` resume/launch built
+ * from `phase`/`description` — a behavior mismatch, not the spec's
+ * required "block/explain". Keyed on the parsed body's own campaign-intent
+ * fields (never persisted on the task — parse-body.ts), so it fires
+ * exactly when a campaign launch surface (not an ordinary per-task
+ * Launch/Resume) is the caller, resume or fresh start alike.
+ *
+ * Codextender integration Part B.6 — same bypass rationale as
+ * `isCodexNewPipelineBlocked` above: AC7 is a real-`codex`-CLI limitation,
+ * not one Codextender (ordinary `claude` underneath) inherits.
+ */
+export declare function isCodexCampaignBlocked(task: ExternalTask, parsed: ParsedLaunchBody, codexIntegrationMode?: CodexIntegrationMode): boolean;
+export interface RuntimeChokepointOk {
+    commands: CopyCommandForms;
+    taskUpdate: Partial<ExternalTask>;
+}
+export interface RuntimeChokepointBlocked {
+    error: Record<string, unknown>;
+    status: 400 | 500;
+}
+/**
+ * The main-route half of §2.1. Returns the ORIGINAL `commands`/`taskUpdate`
+ * unchanged for a Claude-runtime task (byte-identical to before this
+ * feature existed); overrides with `buildCodexCommands` for a
+ * Codex-runtime one; blocks per AC9 for a Codex `new-pipeline` launch.
+ */
+export declare function applyRuntimeChokepoint(args: {
+    task: ExternalTask;
+    parsed: ParsedLaunchBody;
+    project: ExternalRouteProjectView | undefined;
+    commands: CopyCommandForms;
+    taskUpdate: Partial<ExternalTask>;
+    /** Codextender integration Part B.6 — a FRESH read of the global
+     *  `codexIntegrationMode` setting (never `task.codexIntegrationMode`,
+     *  which is unset on this task's very first Codextender launch). Absent
+     *  or `"light"` behaves exactly as before this feature existed. */
+    codexIntegrationMode?: CodexIntegrationMode;
+    /** The `codextenderPort` global setting; defaults to 4000 (matches the
+     *  `codextender` CLI's own default) when omitted. */
+    codextenderPort?: number;
+    /** Test seam — defaults to a real `codex --version` probe. */
+    checkCodexCliAvailable?: () => Promise<boolean>;
+    /** Test seam — defaults to a real `GET /health/liveliness` probe of the
+     *  Codextender proxy at `codextenderPort` (no auth required). */
+    checkCodextenderProxyAvailable?: () => Promise<boolean>;
+    /** Test seam — defaults to `resolveCodextenderAuthToken()` (reads
+     *  `process.env.CODEXTENDER_AUTH_TOKEN`, no built-in fallback). */
+    getCodextenderAuthToken?: () => string | undefined;
+    /** Test seam — defaults to a real probe of the proxy's `/v1/models` for
+     *  the selected alias's `max_input_tokens` (operator finding,
+     *  2026-09-26). `model` is the same value passed to `buildCodextenderCommands`. */
+    getCodextenderMaxContextTokens?: (model: string | undefined) => Promise<number | undefined>;
+}): Promise<RuntimeChokepointOk | RuntimeChokepointBlocked>;
+//# sourceMappingURL=runtime-chokepoint.d.ts.map