@svenroth-ai/shipwright 0.27.0 → 0.28.0

package/server/dist/core/cli-child-spawn.js

@@ -0,0 +1,146 @@
+/*
+ * cli-child-spawn.ts — shared spawn wrapper for the short-lived CLI
+ * bridges (`triage-cli-runner.ts`, `codex-oracle-runner.ts`). Both wrap
+ * `uv run --no-project --python ">=3.11" <script>` and previously carried
+ * byte-identical `execFile(..., { timeout }, cb)` implementations —
+ * factored out here so a fix lands once instead of twice, and so the two
+ * copies can't re-diverge.
+ *
+ * Required-CI PR-review finding on PR #466: `execFile`'s own `timeout`
+ * option only signals the IMMEDIATE child (`uv`); if `uv run` has already
+ * forked a Python grandchild by the time it fires, Node does not reap that
+ * grandchild on Windows. Accepted as low-severity for triage-cli-runner.ts
+ * (fires only on a user click) but NOT for codex-oracle-runner.ts, which
+ * fires every 60s per stalled task indefinitely — the same theoretical gap
+ * at a much higher exposure rate. Fixed here by driving our OWN timer that
+ * tree-kills the whole process group instead of relying on Node's
+ * single-process kill — reusing `preview-child-lifecycle.ts`'s `treeKill`
+ * (win32 `taskkill /t /f`, POSIX `kill(-pid)`) rather than adding the
+ * `tree-kill` npm package, which `decision_log.md` records as a
+ * deliberately pruned dependency.
+ *
+ * `execFile` is replaced with `spawn` (matching `preview-session-manager.
+ * ts`'s own spawn call) because `execFile`'s TypeScript surface has no
+ * `detached` option at all — and `detached: platform !== "win32"` is
+ * load-bearing, not incidental: POSIX `treeKill` signals the process
+ * GROUP via a negative pid, which only exists if the child led its own
+ * group at spawn time. Without it `kill(-pid)` ESRCHes and silently
+ * degrades to a single-process kill — the exact case this module exists
+ * to close. stdout/stderr are accumulated manually and truncated (not
+ * errored) past the 1MB cap — a truncated JSON payload still fails the
+ * caller's `JSON.parse` the same way an old `maxBuffer` error used to,
+ * without adding a distinct overflow error path to keep in sync.
+ *
+ * `error.killed` is NOT how a timeout is detected here (unlike the old
+ * per-file implementations) — our tree-kill goes around `child.kill()`
+ * entirely (an external `taskkill` process, or a raw `process.kill(-pid)`),
+ * so `ChildProcess#killed` never flips true for it. An explicit `timedOut`
+ * flag, set the instant our timer fires, is the only correct signal.
+ */
+import { spawn } from "node:child_process";
+import { treeKill as realTreeKill } from "./preview-child-lifecycle.js";
+const MAX_BUFFER_CHARS = 1024 * 1024;
+// Every real child this process has spawned via `createCliChildSpawn` and
+// has not yet seen exit — index.ts's shutdown() tree-kills whatever remains
+// here, mirroring the existing `previewManager.killAll()` / `ptyManager.
+// killAll()` precedent (a stalled-task tick can leave one in flight; the
+// 30s-per-call timeout alone is not a shutdown guarantee, since a hard
+// process.exit() can fire well inside that window).
+const trackedChildren = new Set();
+/** Tree-kill every currently in-flight CLI child. Best-effort, synchronous
+ *  (matches `PreviewSessionManager.killAll()` / `PtyManager.killAll()`).
+ *  `treeKillFn` is injectable — tests exercise the registry without a real
+ *  platform-dependent `taskkill`/`process.kill` side effect. */
+export function killAllTrackedCliChildren(treeKillFn = realTreeKill) {
+    for (const child of trackedChildren) {
+        try {
+            treeKillFn(child, "SIGKILL");
+        }
+        catch {
+            // best-effort — nothing more to do for an already-dead child
+        }
+    }
+    trackedChildren.clear();
+}
+function appendBounded(current, chunk) {
+    const next = current + chunk;
+    return next.length > MAX_BUFFER_CHARS ? next.slice(0, MAX_BUFFER_CHARS) : next;
+}
+// Local PR-review preflight finding, round 2 (PR #466): the tree-kill call
+// on timeout is fire-and-forget — an external `taskkill` process (win32) or
+// a raw `process.kill(-pid)` (POSIX) — and neither GUARANTEES a `close`
+// event follows (an unresponsive process, a `taskkill` that itself failed
+// silently). Without a second bound, a failed kill would leave the
+// returned promise pending and the child in `trackedChildren` forever,
+// defeating the "bounded" half of "bounded/reaped subprocess strategy".
+const KILL_GRACE_MS = 5000;
+export function createCliChildSpawn(deps = {}) {
+    const spawnFn = deps.spawnFn ?? spawn;
+    const treeKillFn = deps.treeKillFn ?? realTreeKill;
+    const platform = deps.platform ?? process.platform;
+    return (bin, args, options) => new Promise((resolve) => {
+        let timedOut = false;
+        let settled = false;
+        let stdout = "";
+        let stderr = "";
+        let timer;
+        let killGraceTimer;
+        const child = spawnFn(bin, args, {
+            windowsHide: true,
+            env: options.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            // See module header — spawn/kill must agree on whether a
+            // process group exists.
+            detached: platform !== "win32",
+        });
+        trackedChildren.add(child);
+        child.stdout?.setEncoding("utf-8");
+        child.stderr?.setEncoding("utf-8");
+        child.stdout?.on("data", (chunk) => {
+            stdout = appendBounded(stdout, chunk);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr = appendBounded(stderr, chunk);
+        });
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (killGraceTimer)
+                clearTimeout(killGraceTimer);
+            trackedChildren.delete(child);
+            resolve(result);
+        };
+        child.once("error", (err) => {
+            finish({
+                code: -1,
+                stdout,
+                stderr,
+                spawnError: typeof err.code === "string" ? err.code : "spawn_error",
+            });
+        });
+        child.once("close", (code) => {
+            if (timedOut)
+                return finish({ code: 124, stdout, stderr, spawnError: "timeout" });
+            return finish({ code: code ?? 1, stdout, stderr });
+        });
+        timer = setTimeout(() => {
+            timedOut = true;
+            try {
+                treeKillFn(child, "SIGKILL", { platform });
+            }
+            catch {
+                // best-effort — the grace timer below bounds the promise
+                // regardless of whether the kill itself threw or was ignored.
+            }
+            killGraceTimer = setTimeout(() => {
+                finish({ code: 124, stdout, stderr, spawnError: "timeout" });
+            }, KILL_GRACE_MS);
+            killGraceTimer.unref?.();
+        }, options.timeoutMs);
+        timer.unref?.();
+    });
+}
+export const defaultCliChildSpawn = createCliChildSpawn();
+//# sourceMappingURL=cli-child-spawn.js.map

package/server/dist/core/cli-child-spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-child-spawn.js","sourceRoot":"","sources":["../../src/core/cli-child-spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAwBrC,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAgB,CAAC;AAEhD;;;gEAGgE;AAChE,MAAM,UAAU,yBAAyB,CAAC,aAAkC,YAAY;IACtF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IACD,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,UAAU,mBAAmB,CAAC,OAA0B,EAAE;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEnD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,KAAoC,CAAC;QACzC,IAAI,cAAyD,CAAC;QAE9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE;YAC/B,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,yDAAyD;YACzD,wBAAwB;YACxB,QAAQ,EAAE,QAAQ,KAAK,OAAO;SAC/B,CAAC,CAAC;QACH,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE3B,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAQ,EAAE;YACnD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,cAAc;gBAAE,YAAY,CAAC,cAAc,CAAC,CAAC;YACjD,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YACjD,MAAM,CAAC;gBACL,IAAI,EAAE,CAAC,CAAC;gBACR,MAAM;gBACN,MAAM;gBACN,UAAU,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;aACpE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,QAAQ;gBAAE,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YAClF,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBACH,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;gBACzD,8DAA8D;YAChE,CAAC;YACD,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC/B,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,CAAC,EAAE,aAAa,CAAC,CAAC;YAClB,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3B,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAoB,mBAAmB,EAAE,CAAC"}

package/server/dist/core/codex-models-probe.d.ts

@@ -0,0 +1,46 @@
+import { type RunFn } from "./readiness-probe-run.js";
+export interface CodexModelCatalogEntry {
+    slug: string;
+    display_name: string;
+}
+export interface CodexModelsProbeResult {
+    ok: boolean;
+    models: CodexModelCatalogEntry[];
+}
+export interface CodexModelsProbeDeps {
+    run?: RunFn;
+}
+/**
+ * Run `codex debug models` and reduce its raw catalog (which also carries
+ * per-model reasoning-level metadata and multi-KB prompt text this codebase
+ * has no use for) down to the `{slug, display_name}` pairs a launch-form
+ * combobox needs. Never throws.
+ *
+ * Filters to entries that are objects with a `slug` matching the existing
+ * `CODEX_MODEL_SLUG_PATTERN` (the same syntactic gate `parse-body.ts` applies
+ * to a launch request — imported directly here since this is an intra-server
+ * import, not the cross-package case DO-NOT #7 forbids) and a non-empty
+ * string `display_name`, with `visibility === "list"` (excludes
+ * internal/reserved entries like `codex-auto-review`). A single malformed
+ * entry is dropped, not fatal to the rest of the list — this is untrusted
+ * external-process output whose shape this codebase does not control.
+ * (external review fix, both reviewers, 2026-09-19 architecture review.)
+ *
+ * Gates on `result.code === 0`, NOT `result.ok` — `readiness-probe-run.ts`'s
+ * shared `ok` heuristic (`!error && /\d+\.\d+/.test(stdout+stderr)`) was
+ * written for `--version` probes and requires a dotted version number
+ * somewhere in the output. A real catalog containing only integer-suffixed
+ * slugs (no dotted version anywhere in the JSON) would trip that heuristic to
+ * `false` despite a clean exit and fully valid JSON — exactly the false
+ * `unavailable` gap `RunResult.code`'s own doc comment already names `code`
+ * as the fix for (code-review finding, 2026-09-19). `code` can be `null` on
+ * ENOENT/timeout, hence the strict `=== 0`.
+ *
+ * De-duplicates on `slug`, first-wins — the CLI's own catalog shape is
+ * untrusted external-process output (same reasoning as the per-entry
+ * shape checks above), and a duplicate slug would otherwise reach the
+ * client as two `<option>`s sharing one React key (doubt-review finding,
+ * 2026-09-19).
+ */
+export declare function runCodexModelsProbe(deps: CodexModelsProbeDeps): Promise<CodexModelsProbeResult>;
+//# sourceMappingURL=codex-models-probe.d.ts.map

package/server/dist/core/codex-models-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-models-probe.d.ts","sourceRoot":"","sources":["../../src/core/codex-models-probe.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAkB,KAAK,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAmCrG"}

package/server/dist/core/codex-models-probe.js

@@ -0,0 +1,103 @@
+/*
+ * codex-models-probe — the "codex debug models" catalog PROBE
+ * (iterate-2026-09-19-codex-model-catalog, follow-up to shipwright#471/#473).
+ *
+ * Replaces the withdrawn hardcoded model-slug enum (shipwright#771) with a
+ * live probe of the Codex CLI's own catalog, so the New Iterate combobox
+ * never lags the provider's own model lineup. Reuses `defaultRunShim` from
+ * `readiness-probe-run.ts` — `codex` installs as a Windows `.cmd` PATHEXT
+ * shim (no `codex.exe`), which `execFile(cmd, args, {shell:false})` cannot
+ * invoke directly (see that module's own doc comment); `defaultRunShim`
+ * already solves this for the readiness probe's `codex --version` check, and
+ * this is the same binary.
+ *
+ * Runs with NO extra flags — deliberately not `--bundled` ("skip refresh,
+ * dump only the catalog shipped with this binary"): empirically, `--bundled`
+ * returns a visibly OLDER catalog (verified during this iterate's Confidence
+ * Calibration — missing a newly-listed model, carrying stale entries the
+ * refreshed call no longer lists). The whole point of this probe is to stay
+ * ahead of a hand-maintained list, so the default (refreshing) invocation is
+ * the only one that serves that goal.
+ *
+ * Verified during this iterate: `codex debug models` requires NO
+ * authentication (re-ran with an empty `CODEX_HOME` — no `auth.json` — and
+ * it still exited 0 with the full catalog), so this probe has no
+ * auth-specific degraded path to handle.
+ */
+import { CODEX_MODEL_SLUG_PATTERN } from "../external/launch/parse-body.js";
+import { defaultRunShim } from "./readiness-probe-run.js";
+/**
+ * Run `codex debug models` and reduce its raw catalog (which also carries
+ * per-model reasoning-level metadata and multi-KB prompt text this codebase
+ * has no use for) down to the `{slug, display_name}` pairs a launch-form
+ * combobox needs. Never throws.
+ *
+ * Filters to entries that are objects with a `slug` matching the existing
+ * `CODEX_MODEL_SLUG_PATTERN` (the same syntactic gate `parse-body.ts` applies
+ * to a launch request — imported directly here since this is an intra-server
+ * import, not the cross-package case DO-NOT #7 forbids) and a non-empty
+ * string `display_name`, with `visibility === "list"` (excludes
+ * internal/reserved entries like `codex-auto-review`). A single malformed
+ * entry is dropped, not fatal to the rest of the list — this is untrusted
+ * external-process output whose shape this codebase does not control.
+ * (external review fix, both reviewers, 2026-09-19 architecture review.)
+ *
+ * Gates on `result.code === 0`, NOT `result.ok` — `readiness-probe-run.ts`'s
+ * shared `ok` heuristic (`!error && /\d+\.\d+/.test(stdout+stderr)`) was
+ * written for `--version` probes and requires a dotted version number
+ * somewhere in the output. A real catalog containing only integer-suffixed
+ * slugs (no dotted version anywhere in the JSON) would trip that heuristic to
+ * `false` despite a clean exit and fully valid JSON — exactly the false
+ * `unavailable` gap `RunResult.code`'s own doc comment already names `code`
+ * as the fix for (code-review finding, 2026-09-19). `code` can be `null` on
+ * ENOENT/timeout, hence the strict `=== 0`.
+ *
+ * De-duplicates on `slug`, first-wins — the CLI's own catalog shape is
+ * untrusted external-process output (same reasoning as the per-entry
+ * shape checks above), and a duplicate slug would otherwise reach the
+ * client as two `<option>`s sharing one React key (doubt-review finding,
+ * 2026-09-19).
+ */
+export async function runCodexModelsProbe(deps) {
+    const run = deps.run ?? defaultRunShim;
+    let result;
+    try {
+        result = await run("codex", ["debug", "models"]);
+    }
+    catch {
+        // `defaultRunShim`/`defaultRun` never reject (execFile's callback always
+        // resolves a RunResult) — this guards a rejecting `run` override, so the
+        // "never throws" contract this docstring promises actually holds for any
+        // caller's `deps.run`, not just the two shipped implementations
+        // (external code-review finding, 2026-09-19).
+        return { ok: false, models: [] };
+    }
+    if (result.code !== 0)
+        return { ok: false, models: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout);
+    }
+    catch {
+        return { ok: false, models: [] };
+    }
+    const rawModels = parsed?.models;
+    if (!Array.isArray(rawModels))
+        return { ok: false, models: [] };
+    const bySlug = new Map();
+    for (const entry of rawModels) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const { slug, display_name, visibility } = entry;
+        if (visibility !== "list")
+            continue;
+        if (typeof slug !== "string" || !CODEX_MODEL_SLUG_PATTERN.test(slug))
+            continue;
+        if (typeof display_name !== "string" || display_name.trim() === "")
+            continue;
+        if (!bySlug.has(slug))
+            bySlug.set(slug, { slug, display_name });
+    }
+    return { ok: true, models: [...bySlug.values()] };
+}
+//# sourceMappingURL=codex-models-probe.js.map

package/server/dist/core/codex-models-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-models-probe.js","sourceRoot":"","sources":["../../src/core/codex-models-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAc,MAAM,0BAA0B,CAAC;AAgBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAA0B;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC;IACvC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,gEAAgE;QAChE,8CAA8C;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAExD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,SAAS,GAAI,MAAsC,EAAE,MAAM,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAgC,CAAC;QAC5E,IAAI,UAAU,KAAK,MAAM;YAAE,SAAS;QACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QAC7E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC"}

package/server/dist/core/codex-oracle-runner.d.ts

@@ -0,0 +1,68 @@
+import { type RunFn } from "./readiness-probe.js";
+export declare const CODEX_ORACLE_TIMEOUT_MS = 30000;
+/** Verbatim mirror of `codex_completion_oracle.py`'s `verdict` field. */
+export type OracleVerdict = "done" | "not_done" | "delivery_pending" | "no_oracle";
+export interface OracleEvidence {
+    /**
+     * §5.1's correction — present only on an `iterate`-phase `delivery_pending`
+     * verdict. `"error"` = watch_pr_delivery.py's checks_failed/closed branch
+     * (a PR exists but its delivery failed — never re-poll forever). Absent or
+     * `"indeterminate"` = case 13 proper (CI/review/auto-merge still running,
+     * or the watcher itself produced no verdict) — safe to keep re-polling.
+     */
+    delivery_state?: "error" | "indeterminate";
+    [key: string]: unknown;
+}
+export interface OracleResult {
+    verdict: OracleVerdict;
+    phase: string;
+    session: string;
+    evidence: OracleEvidence;
+}
+export type OracleOutcome = {
+    kind: "ok";
+    result: OracleResult;
+} | {
+    kind: "engine-unavailable";
+    reason: string;
+    repairCommand: string;
+} | {
+    kind: "failed";
+    reason: string;
+};
+export interface OracleSpawnResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+    spawnError?: string;
+}
+export type OracleSpawnFn = (bin: string, args: string[], options: {
+    timeoutMs: number;
+    env: NodeJS.ProcessEnv;
+}) => Promise<OracleSpawnResult>;
+export declare const defaultSpawnOracle: OracleSpawnFn;
+export interface RunCodexOracleInput {
+    projectRoot: string;
+    phase: string;
+    session: string;
+    /** ISO-8601 with timezone — the §2.4 degradation-path floor. */
+    since?: string;
+}
+export interface CodexOracleDeps {
+    run?: RunFn;
+    spawn?: OracleSpawnFn;
+    existsFn?: (p: string) => boolean;
+    homeDir?: string;
+    scriptOverride?: string;
+    timeoutMs?: number;
+    baseEnv?: NodeJS.ProcessEnv;
+}
+/** Resolve the single cache-owned oracle CLI shipped with the Shipwright runtime. */
+export declare function resolveCodexOracleScript(deps?: Pick<CodexOracleDeps, "existsFn" | "homeDir" | "scriptOverride">): string | null;
+/**
+ * Run `codex_completion_oracle.py --project-root <root> --phase <p>
+ * --session <sid> [--since <iso>]` and parse its JSON verdict. Never
+ * throws for an oracle failure — only a programming error would reject.
+ */
+export declare function runCodexOracle(input: RunCodexOracleInput, deps?: CodexOracleDeps): Promise<OracleOutcome>;
+//# sourceMappingURL=codex-oracle-runner.d.ts.map

package/server/dist/core/codex-oracle-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oracle-runner.d.ts","sourceRoot":"","sources":["../../src/core/codex-oracle-runner.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAiD,KAAK,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAGjG,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAEnF,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,eAAe,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KACnD,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,eAAO,MAAM,kBAAkB,EAAE,aAAoC,CAAC;AAEtE,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC7B;AAED,qFAAqF;AACrF,wBAAgB,wBAAwB,CACtC,IAAI,GAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,SAAS,GAAG,gBAAgB,CAAM,GAC1E,MAAM,GAAG,IAAI,CAWf;AAQD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,aAAa,CAAC,CAuExB"}

package/server/dist/core/codex-oracle-runner.js

@@ -0,0 +1,124 @@
+/*
+ * core/codex-oracle-runner.ts — the injection-safe bridge to `shared/
+ * scripts/tools/codex_completion_oracle.py` (Codex Light §1.7).
+ *
+ * Mirrors `triage-cli-runner.ts`'s spawn discipline verbatim (same reason:
+ * `uv run --no-project --python ">=3.11"` so the script always runs in a
+ * Python that actually satisfies its own floor, never whichever of
+ * python3/python/py answers `--version` first — see that module's header
+ * for the incident this avoids). `--no-project` matters here too: the
+ * oracle script has no `pyproject.toml` of its own (it's a plain module
+ * under `shared/scripts/tools/`), so an ambient one discovered by walking
+ * up from the SPAWNING PROCESS's cwd must never get silently activated.
+ *
+ * Unlike `grade-runner.ts` / `triage-cli-runner.ts`, the oracle CLI prints
+ * its JSON payload on EVERY exit code (0-3 all carry a verdict; there is no
+ * "non-JSON means engine trouble" branch) — see `codex_completion_oracle.py`
+ * `main()`. This wrapper therefore always attempts to parse stdout first and
+ * only falls back to an engine-unavailable/failed outcome when uv/the
+ * script itself couldn't be resolved or spawned at all.
+ *
+ * Required-CI PR-review finding (PR #466): the spawn pattern was a
+ * verbatim mirror of `triage-cli-runner.ts` (already in production), but
+ * the CADENCE is new — this runs every 60s tick for as long as a task
+ * stays stalled, where the triage call site fires once per user-initiated
+ * transition. `execFile`'s own `timeout` only SIGTERMs the immediate `uv`
+ * child; if `uv run` had already forked a Python grandchild, Node would
+ * not reap that process tree on Windows by default. Fixed (not merely
+ * accepted) via `cli-child-spawn.ts`'s shared tree-kill-on-timeout
+ * wrapper, shared with `triage-cli-runner.ts` so the two can't re-diverge.
+ */
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { defaultCliChildSpawn } from "./cli-child-spawn.js";
+import { READINESS_REPAIR_COMMAND, shipwrightCacheRoot } from "./readiness-probe.js";
+import { resolveUv } from "./uv-runner.js";
+export const CODEX_ORACLE_TIMEOUT_MS = 30_000;
+export const defaultSpawnOracle = defaultCliChildSpawn;
+/** Resolve the single cache-owned oracle CLI shipped with the Shipwright runtime. */
+export function resolveCodexOracleScript(deps = {}) {
+    const exists = deps.existsFn ?? existsSync;
+    if (deps.scriptOverride)
+        return exists(deps.scriptOverride) ? deps.scriptOverride : null;
+    const candidate = path.join(shipwrightCacheRoot(deps.homeDir ?? os.homedir()), "shared", "scripts", "tools", "codex_completion_oracle.py");
+    return exists(candidate) ? candidate : null;
+}
+function cleanStderr(stderr) {
+    return stderr.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).pop() ?? "";
+}
+const ENGINE_UNAVAILABLE_REASON = "The Codex completion oracle isn't installed.";
+/**
+ * Run `codex_completion_oracle.py --project-root <root> --phase <p>
+ * --session <sid> [--since <iso>]` and parse its JSON verdict. Never
+ * throws for an oracle failure — only a programming error would reject.
+ */
+export async function runCodexOracle(input, deps = {}) {
+    const script = resolveCodexOracleScript(deps);
+    if (!script) {
+        return { kind: "engine-unavailable", reason: ENGINE_UNAVAILABLE_REASON, repairCommand: READINESS_REPAIR_COMMAND };
+    }
+    const uv = await resolveUv({ run: deps.run, homeDir: deps.homeDir, baseEnv: deps.baseEnv });
+    if (!uv) {
+        return {
+            kind: "engine-unavailable",
+            reason: "uv isn't installed — the Codex completion oracle needs it to run in a managed Python 3.11+.",
+            repairCommand: READINESS_REPAIR_COMMAND,
+        };
+    }
+    const spawn = deps.spawn ?? defaultSpawnOracle;
+    const args = [
+        "run",
+        "--no-project",
+        "--python",
+        ">=3.11",
+        script,
+        "--project-root",
+        input.projectRoot,
+        "--phase",
+        input.phase,
+        "--session",
+        input.session,
+        ...(input.since ? ["--since", input.since] : []),
+    ];
+    const result = await spawn(uv.bin, args, {
+        timeoutMs: deps.timeoutMs ?? CODEX_ORACLE_TIMEOUT_MS,
+        env: uv.env,
+    });
+    if (result.code === -1) {
+        return { kind: "engine-unavailable", reason: "uv couldn't start on this machine.", repairCommand: READINESS_REPAIR_COMMAND };
+    }
+    // Every other exit (0-3 documented, anything else a crash) prints JSON on
+    // stdout per the script's own contract — try to parse before giving up.
+    try {
+        const payload = JSON.parse(result.stdout);
+        if ((payload.verdict === "done" ||
+            payload.verdict === "not_done" ||
+            payload.verdict === "delivery_pending" ||
+            payload.verdict === "no_oracle") &&
+            typeof payload.phase === "string" &&
+            typeof payload.session === "string" &&
+            payload.evidence &&
+            typeof payload.evidence === "object") {
+            return {
+                kind: "ok",
+                result: {
+                    verdict: payload.verdict,
+                    phase: payload.phase,
+                    session: payload.session,
+                    evidence: payload.evidence,
+                },
+            };
+        }
+    }
+    catch {
+        /* fall through to the failed branch below */
+    }
+    return {
+        kind: "failed",
+        reason: result.spawnError === "timeout"
+            ? "The completion oracle took too long and was stopped."
+            : cleanStderr(result.stderr) || "The completion oracle returned an unrecognised response.",
+    };
+}
+//# sourceMappingURL=codex-oracle-runner.js.map

package/server/dist/core/codex-oracle-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oracle-runner.js","sourceRoot":"","sources":["../../src/core/codex-oracle-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAc,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AA0C9C,MAAM,CAAC,MAAM,kBAAkB,GAAkB,oBAAoB,CAAC;AAoBtE,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CACtC,OAAyE,EAAE;IAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC;IAC3C,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EACjD,QAAQ,EACR,SAAS,EACT,OAAO,EACP,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,yBAAyB,GAAG,8CAA8C,CAAC;AAEjF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B,EAC1B,OAAwB,EAAE;IAE1B,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,yBAAyB,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAC;IACpH,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,6FAA6F;YACrG,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAC/C,MAAM,IAAI,GAAG;QACX,KAAK;QACL,cAAc;QACd,UAAU;QACV,QAAQ;QACR,MAAM;QACN,gBAAgB;QAChB,KAAK,CAAC,WAAW;QACjB,SAAS;QACT,KAAK,CAAC,KAAK;QACX,WAAW;QACX,KAAK,CAAC,OAAO;QACb,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,uBAAuB;QACpD,GAAG,EAAE,EAAE,CAAC,GAAG;KACZ,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,oCAAoC,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAC;IAC/H,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA0B,CAAC;QACnE,IACE,CAAC,OAAO,CAAC,OAAO,KAAK,MAAM;YACzB,OAAO,CAAC,OAAO,KAAK,UAAU;YAC9B,OAAO,CAAC,OAAO,KAAK,kBAAkB;YACtC,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC;YAClC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,OAAO,CAAC,QAAQ;YAChB,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE;oBACN,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAA0B;iBAC7C;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EACJ,MAAM,CAAC,UAAU,KAAK,SAAS;YAC7B,CAAC,CAAC,sDAAsD;YACxD,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,0DAA0D;KAC/F,CAAC;AACJ,CAAC"}

package/server/dist/core/codex-status-report.d.ts

@@ -0,0 +1,6 @@
+export interface ShipwrightStatusReport {
+    phase: string;
+    done: boolean;
+}
+export declare function parseShipwrightStatusReport(text: string): ShipwrightStatusReport | null;
+//# sourceMappingURL=codex-status-report.d.ts.map

package/server/dist/core/codex-status-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-status-report.d.ts","sourceRoot":"","sources":["../../src/core/codex-status-report.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;CACf;AAQD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAiBvF"}

package/server/dist/core/codex-status-report.js

@@ -0,0 +1,40 @@
+/*
+ * core/codex-status-report.ts — §5.4's structured self-report parser.
+ *
+ * Every Codex launch prompt (`launcher-codex.ts buildCodexPrompt`) ends
+ * with an instruction to close with a fenced ```SHIPWRIGHT-STATUS {json}```
+ * block. §5.4 (hard v1 scope, not an "Open item"): "Parsed from terminal
+ * scrollback, cross-checked against the oracle verdict: agreement raises
+ * confidence; disagreement always defers to the oracle. This gives
+ * `no_oracle` phases a real, if weaker, signal."
+ *
+ * Pure parser — no I/O. `CodexTaskWatcher` reads the terminal text (via
+ * `PtyManager.peekTerminalText`'s visible-viewport snapshot, the same
+ * mechanism `appendCodexTerminalSignals` already uses for approval-request
+ * detection) and hands it here.
+ */
+// Matches the exact fence `buildCodexPrompt` instructs Codex to emit. Global
+// so a viewport containing more than one report (e.g. an earlier nudge's
+// echoed instruction text plus a real closing report) is fully scanned —
+// the LAST well-formed match wins, since that's the most recent status.
+const FENCE_RE = /```SHIPWRIGHT-STATUS\s*\r?\n([\s\S]*?)```/g;
+export function parseShipwrightStatusReport(text) {
+    let match;
+    let last = null;
+    FENCE_RE.lastIndex = 0;
+    while ((match = FENCE_RE.exec(text)) !== null) {
+        try {
+            const parsed = JSON.parse(match[1].trim());
+            if (parsed && typeof parsed === "object" && typeof parsed.done === "boolean") {
+                const p = parsed;
+                last = { phase: typeof p.phase === "string" ? p.phase : "", done: p.done };
+            }
+        }
+        catch {
+            // Malformed block (truncated viewport, stray backticks in unrelated
+            // output) — skip it and keep scanning for an earlier well-formed one.
+        }
+    }
+    return last;
+}
+//# sourceMappingURL=codex-status-report.js.map

package/server/dist/core/codex-status-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-status-report.js","sourceRoot":"","sources":["../../src/core/codex-status-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,QAAQ,GAAG,4CAA4C,CAAC;AAE9D,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,IAAI,KAA6B,CAAC;IAClC,IAAI,IAAI,GAAkC,IAAI,CAAC;IAC/C,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAQ,MAAkC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1G,MAAM,CAAC,GAAG,MAAiC,CAAC;gBAC5C,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAe,EAAE,CAAC;YACxF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/server/dist/core/codex-task-watcher-types.d.ts

@@ -0,0 +1,69 @@
+import type { ExternalTask } from "./sdk-sessions-store.js";
+import type { OracleOutcome, RunCodexOracleInput } from "./codex-oracle-runner.js";
+/** Settings default per §5 (min 5 — Settings enforces the floor, not this module). */
+export declare const DEFAULT_STALL_TIMEOUT_MS: number;
+/** §5.2 launch-confirmation window — distinct from, and shorter than, the
+ *  mid-task stall trigger above. */
+export declare const DEFAULT_LAUNCH_CONFIRM_TIMEOUT_MS: number;
+export type CodexWatcherNoticeKind = "nudge_sent" | "delivery_error" | "no_oracle_unresolved" | "launch_confirmation_failed";
+export interface CodexWatcherNotice {
+    taskId: string;
+    kind: CodexWatcherNoticeKind;
+    detail: string;
+    at: number;
+}
+export interface CodexTaskWatcherStore {
+    list(): ExternalTask[];
+    patch(taskId: string, patch: Partial<ExternalTask>): ExternalTask | undefined;
+    persist(): Promise<void>;
+}
+export interface CodexTaskWatcherPtyManager {
+    getLastDataAt(taskId: string): number | null;
+    attachCount(taskId: string): number;
+    write(taskId: string, data: string): void;
+}
+export interface CodexTaskWatcherDeps {
+    store: CodexTaskWatcherStore;
+    ptyManager: CodexTaskWatcherPtyManager;
+    getProjectById: (id: string) => {
+        path: string;
+    } | undefined;
+    runOracle: (input: RunCodexOracleInput) => Promise<OracleOutcome>;
+    /**
+     * §4 — best-effort, filename-first discovery of a fresh launch's thread
+     * id (`core/codex-thread-discovery.ts`). Optional: omitting it just means
+     * no task ever gets a `threadId`, i.e. `resume` never fires (§4's earlier,
+     * pre-discovery behavior) — tests that don't care about §4 can skip it.
+     */
+    discoverThreadId?: (args: {
+        cwd: string;
+        sinceIso: string;
+        excludeThreadIds?: ReadonlySet<string>;
+    }) => Promise<string | null>;
+    now?: () => number;
+    /**
+     * Settings-backed (`GlobalSettings.codexStallTimeoutMinutes`) — a plain
+     * number OR a (possibly async) getter, so a caller that re-reads
+     * settings.json can hand in `async () => (await readSettings())...` and
+     * have a live-edited Settings value take effect on the very next tick,
+     * without reconstructing the watcher (which would drop in-flight
+     * episode/notice state).
+     */
+    stallTimeoutMs?: number | (() => number | Promise<number>);
+    launchConfirmTimeoutMs?: number | (() => number | Promise<number>);
+    /**
+     * §5.4 — best-effort visible-viewport text for the self-report parser
+     * (`codex-status-report.ts`). Optional and best-effort by design, same
+     * as `PtyManager.peekTerminalText` itself: `null`/omitted just means no
+     * self-report signal is available (headless mirror disabled, no live
+     * entry) — the oracle-only classification path is unaffected either way.
+     */
+    peekTerminalText?: (taskId: string) => string | null;
+}
+export interface EpisodeState {
+    /** The `lastDataAt` value this episode "belongs to" — a newer value
+     *  means fresh output arrived, which starts a brand-new episode. */
+    lastSeenDataAt: number;
+    nudged: boolean;
+}
+//# sourceMappingURL=codex-task-watcher-types.d.ts.map