@svenroth-ai/shipwright 0.27.0 → 0.28.0

package/server/dist/core/codex-thread-discovery.js

@@ -0,0 +1,169 @@
+/*
+ * core/codex-thread-discovery.ts — Codex Light §4's missing piece: how a
+ * fresh Codex launch's `threadId` actually gets captured. v1 launches Codex
+ * as a plain interactive TUI in a pty (§2.2) — there is no app-server call
+ * (deferred to Stage 2) and no `--session-id`-equivalent flag Codex accepts
+ * at the top level (`codex --help`, verified live against an installed
+ * Codex CLI: no such flag exists), so the id must be DISCOVERED after the
+ * fact, filename-first — the exact pattern CLAUDE.md rule 3 already uses
+ * for Claude's own JSONL discovery.
+ *
+ * Verified live (2026-09-16, codex-cli 0.147.0) against a real installed
+ * Codex CLI: every session — interactive or subagent — writes a rollout
+ * file to `~/.codex/sessions/<local-YYYY>/<local-MM>/<local-DD>/rollout-
+ * <local-ISO-with-dashes-for-colons>-<thread-id>.jsonl`, whose FIRST line
+ * is always `{"type":"session_meta","payload":{"id":"<thread-id>","cwd":
+ * "<abs-path>",...}}` — the thread id is in the filename AND the first
+ * line's payload, mirroring the filename-first + first-line-sanity-check
+ * shape Claude's own discovery already uses. `cwd` is the launch working
+ * directory verbatim (OS-native separators), letting us match a rollout
+ * file to the task that spawned it without Codex ever needing to accept a
+ * caller-supplied id.
+ *
+ * Consumed by `CodexTaskWatcher` (`codex-task-watcher.ts`): on every tick,
+ * a live Codex task with no `threadId` yet gets one discovery attempt;
+ * `null` is not an error (the rollout file may not have flushed to disk
+ * yet, or Codex may still be starting up) — the caller just retries next
+ * tick. Once found, `threadId` is patched onto the task record and the
+ * §4 resume branch (`runtime-chokepoint.ts`'s `resume = Boolean(task.
+ * threadId)`) starts working on the task's next launch.
+ *
+ * Known, accepted limitation (doubt-review, disposition: documented, not
+ * fixed): matching is purely (cwd, launch-time window) — there is no
+ * possession/identity proof tying a candidate rollout file to THIS
+ * webui-spawned pty specifically. An operator manually running `codex` in
+ * the same project directory, in another terminal, within the same
+ * discovery window would produce an indistinguishable rollout file; if it
+ * happens to be the earliest unclaimed match, it gets bound to the wrong
+ * task (and, once `threadId` is set, discovery never re-runs for that
+ * task, so the mistake is not self-correcting). Accepted because it needs
+ * an external actor deliberately racing the exact window, has no
+ * destructive blast radius (a wrong `threadId` just makes `codex resume`
+ * on the Resume button open the wrong-but-still-real thread, not corrupt
+ * anything), and there is no stronger signal Codex's CLI exposes to
+ * disambiguate against in v1.
+ */
+import fsPromises from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+const ROLLOUT_RE = /^rollout-(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2})-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/;
+/**
+ * Disposition (doubt-review, low-severity, accepted not fixed): if a
+ * rollout file's first `session_meta` JSON line ever exceeds this many
+ * bytes, `JSON.parse` on the truncated head throws, the candidate is
+ * skipped, and — with no larger-buffer retry — that task's discovery
+ * fails identically on every later tick (permanent, not degrading: the
+ * `resume` branch never fires and every "Resume" click silently
+ * relaunches fresh). Accepted because the verified real `session_meta`
+ * line (module header) is compact, and 4KB is a generous margin over it;
+ * revisit with a retry-on-parse-failure if a future Codex CLI version
+ * ever grows this payload.
+ */
+const HEAD_BYTES = 4096;
+export function codexSessionsRoot(deps) {
+    return path.join(deps.homeDir(), ".codex", "sessions");
+}
+function normalizeCwd(p) {
+    return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+/** The launch day plus a one-day hedge either side, against a local-midnight folder-boundary race. */
+function dayFolders(since) {
+    const days = [-1, 0, 1].map((offset) => {
+        const d = new Date(since.getTime());
+        d.setDate(d.getDate() + offset);
+        const y = String(d.getFullYear());
+        const m = String(d.getMonth() + 1).padStart(2, "0");
+        const day = String(d.getDate()).padStart(2, "0");
+        return path.join(y, m, day);
+    });
+    return [...new Set(days)];
+}
+function parseFilenameTimestamp(stamp) {
+    // "2026-09-16T07-32-17" -> "2026-09-16T07:32:17" (local — no zone suffix,
+    // matching how `new Date()` already parses a zone-less ISO string: local).
+    const iso = stamp.replace(/T(\d{2})-(\d{2})-(\d{2})$/, "T$1:$2:$3");
+    const t = new Date(iso).getTime();
+    return Number.isNaN(t) ? 0 : t;
+}
+/**
+ * Best-effort, filename-first discovery of the thread id a fresh Codex
+ * launch produced. Returns `null` (not an error) when nothing matches yet.
+ */
+export async function discoverCodexThreadId(args, deps) {
+    const since = new Date(args.sinceIso);
+    if (Number.isNaN(since.getTime()))
+        return null;
+    const sinceMs = since.getTime() - 5_000; // small clock-skew grace
+    const wantCwd = normalizeCwd(args.cwd);
+    const root = codexSessionsRoot(deps);
+    const candidates = [];
+    for (const folder of dayFolders(since)) {
+        const dir = path.join(root, folder);
+        let names;
+        try {
+            names = await deps.readdir(dir);
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            const m = ROLLOUT_RE.exec(name);
+            if (!m)
+                continue;
+            const threadId = m[2];
+            if (args.excludeThreadIds?.has(threadId))
+                continue;
+            const ts = parseFilenameTimestamp(m[1]);
+            if (ts < sinceMs)
+                continue;
+            candidates.push({ ts, threadId, file: path.join(dir, name) });
+        }
+    }
+    candidates.sort((a, b) => a.ts - b.ts);
+    for (const candidate of candidates) {
+        let head;
+        try {
+            head = await deps.readHead(candidate.file, HEAD_BYTES);
+        }
+        catch {
+            continue;
+        }
+        const firstLine = head.split("\n", 1)[0];
+        let parsed;
+        try {
+            parsed = JSON.parse(firstLine);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed || typeof parsed !== "object")
+            continue;
+        if (parsed.type !== "session_meta")
+            continue;
+        const payload = parsed.payload;
+        if (!payload || typeof payload !== "object")
+            continue;
+        const id = payload.id;
+        const cwd = payload.cwd;
+        if (typeof id === "string" && typeof cwd === "string" && normalizeCwd(cwd) === wantCwd) {
+            return id;
+        }
+    }
+    return null;
+}
+export const defaultCodexThreadDiscoveryDeps = {
+    readdir: (dir) => fsPromises.readdir(dir),
+    readHead: async (filePath, maxBytes) => {
+        const fh = await fsPromises.open(filePath, "r");
+        try {
+            const buf = Buffer.alloc(maxBytes);
+            const { bytesRead } = await fh.read(buf, 0, maxBytes, 0);
+            return buf.toString("utf-8", 0, bytesRead);
+        }
+        finally {
+            await fh.close();
+        }
+    },
+    homeDir: () => os.homedir(),
+};
+//# sourceMappingURL=codex-thread-discovery.js.map

package/server/dist/core/codex-thread-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-thread-discovery.js","sourceRoot":"","sources":["../../src/core/codex-thread-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,MAAM,UAAU,GACd,sIAAsI,CAAC;AACzI;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,MAAM,UAAU,iBAAiB,CAAC,IAA+C;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,sGAAsG;AACtG,SAAS,UAAU,CAAC,KAAW;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAUD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA+B,EAC/B,IAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAyB;IAClE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,UAAU,GAAqD,EAAE,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACnD,MAAM,EAAE,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,EAAE,GAAG,OAAO;gBAAE,SAAS;YAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAEvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,IAAK,MAAkC,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QAC1E,MAAM,OAAO,GAAI,MAAkC,CAAC,OAAO,CAAC;QAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,EAAE,GAAI,OAAmC,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAI,OAAmC,CAAC,GAAG,CAAC;QACrD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YACvF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAA6B;IACvE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;IACzC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACzD,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC"}

package/server/dist/core/codextender-auth-file-sweep.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Default reclamation age (10 min) — deliberately much shorter than
+ * `snapshot-tmp-sweep.ts`'s 1h default: this file holds a LIVE credential,
+ * not just terminal cell-state, and a normal launch's own cleanup deletes it
+ * within seconds of the `claude` invocation exiting.
+ */
+export declare const DEFAULT_CODEXTENDER_AUTH_TMP_MAX_AGE_MS: number;
+export interface CodextenderAuthFileSweepDeps {
+    readdir: (dir: string) => Promise<string[]>;
+    stat: (p: string) => Promise<{
+        mtimeMs: number;
+    }>;
+    unlink: (p: string) => Promise<void>;
+}
+export interface CodextenderAuthFileSweepOpts {
+    dir: string;
+    /** Reclaim tmp files whose mtime is older than this. Default 10 min. */
+    maxAgeMs?: number;
+    deps?: Partial<CodextenderAuthFileSweepDeps>;
+    /** Injected for tests. Defaults to Date.now. */
+    now?: () => number;
+    logWarn?: (msg: string) => void;
+    logInfo?: (msg: string) => void;
+}
+export interface CodextenderAuthFileSweepResult {
+    /** stale credential files unlinked. */
+    deleted: number;
+    /** stat/unlink failures (kept going). */
+    errors: number;
+    /** files younger than the cutoff, left in place (still in use). */
+    preserved: number;
+}
+/**
+ * Age-gated sweep of orphaned `codextender-auth-*.tmp` credential files.
+ * Best-effort: dir-read failure and per-file failures are non-fatal (they
+ * log a warn and never throw) — the same posture `sweepOrphanSnapshotTmp`
+ * takes, for the same reason (a sweep failure must never crash boot or the
+ * periodic timer).
+ */
+export declare function sweepOrphanCodextenderAuthFiles(opts: CodextenderAuthFileSweepOpts): Promise<CodextenderAuthFileSweepResult>;
+//# sourceMappingURL=codextender-auth-file-sweep.d.ts.map

package/server/dist/core/codextender-auth-file-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-auth-file-sweep.d.ts","sourceRoot":"","sources":["../../src/core/codextender-auth-file-sweep.ts"],"names":[],"mappings":"AA8BA;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,QAAiB,CAAC;AAEtE,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC7C,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,8BAA8B,CAAC,CAoDzC"}

package/server/dist/core/codextender-auth-file-sweep.js

@@ -0,0 +1,97 @@
+/*
+ * codextender-auth-file-sweep.ts — bounded reclamation of orphaned
+ * `codextender-auth-*.tmp` credential files (PR-review round 10, iterate-
+ * 2026-09-23; Sven's own decision on the CI-BLOCKed design question).
+ *
+ * `writeCodextenderAuthTokenFile` (launcher-codextender.ts) writes the
+ * Codextender proxy's bearer token to a private `0o600` temp file once per
+ * launch; the generated command's cleanup suffix deletes it right after the
+ * `claude` invocation exits. If the command is never executed (copied out
+ * instead of auto-run), the pty is killed before the suffix runs, or launch
+ * fails before a command is ever returned to run, that delete step never
+ * fires and the file is stranded — the exact gap the required `PR Review`
+ * CI gate BLOCKed twice on. Mirrors `snapshot-tmp-sweep.ts`'s shape (same
+ * age-gated, best-effort, injectable-deps design) for the same reason: a
+ * live write's own cleanup runs within seconds, so anything older than the
+ * cutoff is provably orphaned — no active-task veto needed.
+ *
+ * Wired into the boot + periodic sweep in index.ts alongside the scrollback
+ * and snapshot-tmp sweeps. Unlike those two (scoped to the terminal
+ * scrollback dir), this one scans `os.tmpdir()` — where
+ * `writeCodextenderAuthTokenFile` actually writes — so `dir` is threaded
+ * through for testability rather than hardcoded.
+ */
+import * as fsAsync from "node:fs/promises";
+import * as path from "node:path";
+/** Matches `codextender-auth-<uuid>.tmp`. Bounded — ReDoS-safe. */
+const CODEXTENDER_AUTH_TMP_RE = /^codextender-auth-[0-9a-fA-F-]{36}\.tmp$/;
+/**
+ * Default reclamation age (10 min) — deliberately much shorter than
+ * `snapshot-tmp-sweep.ts`'s 1h default: this file holds a LIVE credential,
+ * not just terminal cell-state, and a normal launch's own cleanup deletes it
+ * within seconds of the `claude` invocation exiting.
+ */
+export const DEFAULT_CODEXTENDER_AUTH_TMP_MAX_AGE_MS = 10 * 60 * 1000;
+const defaultDeps = {
+    readdir: (dir) => fsAsync.readdir(dir),
+    stat: (p) => fsAsync.stat(p),
+    unlink: (p) => fsAsync.unlink(p),
+};
+/**
+ * Age-gated sweep of orphaned `codextender-auth-*.tmp` credential files.
+ * Best-effort: dir-read failure and per-file failures are non-fatal (they
+ * log a warn and never throw) — the same posture `sweepOrphanSnapshotTmp`
+ * takes, for the same reason (a sweep failure must never crash boot or the
+ * periodic timer).
+ */
+export async function sweepOrphanCodextenderAuthFiles(opts) {
+    const deps = { ...defaultDeps, ...opts.deps };
+    const now = opts.now ?? Date.now;
+    const logWarn = opts.logWarn ?? ((m) => console.warn(m));
+    const logInfo = opts.logInfo ?? ((m) => console.log(m));
+    const cutoff = now() - (opts.maxAgeMs ?? DEFAULT_CODEXTENDER_AUTH_TMP_MAX_AGE_MS);
+    const result = { deleted: 0, errors: 0, preserved: 0 };
+    let entries;
+    try {
+        entries = await deps.readdir(opts.dir);
+    }
+    catch (err) {
+        // ENOENT = dir not created yet (benign). Any other error (EACCES/EPERM/
+        // EIO) is a real operational failure that leaves credential files on
+        // disk — surface it so the gap stays visible; this function never throws.
+        if (err.code !== "ENOENT") {
+            logWarn(`[codextender-auth-sweep] readdir failed (${err.message}); orphan credential files may persist`);
+        }
+        return result;
+    }
+    for (const name of entries) {
+        if (!CODEXTENDER_AUTH_TMP_RE.test(name))
+            continue;
+        const full = path.join(opts.dir, name);
+        let mtimeMs;
+        try {
+            mtimeMs = (await deps.stat(full)).mtimeMs;
+        }
+        catch {
+            result.errors++;
+            continue;
+        }
+        if (mtimeMs >= cutoff) {
+            result.preserved++;
+            continue;
+        }
+        try {
+            await deps.unlink(full);
+            result.deleted++;
+        }
+        catch (err) {
+            result.errors++;
+            logWarn(`[codextender-auth-sweep] unlink failed for ${name}: ${err.message}`);
+        }
+    }
+    if (result.deleted > 0 || result.errors > 0) {
+        logInfo(`[codextender-auth-sweep] orphan sweep: deleted=${result.deleted} errors=${result.errors} preserved=${result.preserved}`);
+    }
+    return result;
+}
+//# sourceMappingURL=codextender-auth-file-sweep.js.map

package/server/dist/core/codextender-auth-file-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-auth-file-sweep.js","sourceRoot":"","sources":["../../src/core/codextender-auth-file-sweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,0CAA0C,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4BtE,MAAM,WAAW,GAAiC;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAAkC;IAElC,MAAM,IAAI,GAAiC,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,uCAAuC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAmC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAEvF,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CACL,4CAA6C,GAAa,CAAC,OAAO,wCAAwC,CAC3G,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,SAAS,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,8CAA8C,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CACL,kDAAkD,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,SAAS,EAAE,CACzH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/server/dist/core/codextender-proxy-probe.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `codextenderPort` is persisted/read as arbitrary JSON (PUT /api/settings
+ * accepts an unvalidated body; a hand-edited settings.json is untyped on
+ * disk too) before ever reaching here, so `port: number`'s compile-time
+ * type is not a runtime guarantee. Both probes below MUST reject anything
+ * outside a real TCP port before interpolating it into a URL — a value
+ * like `"4000@attacker.example"` would otherwise redirect the request via
+ * URL userinfo-authority confusion (PR-review BLOCK, iterate-2026-09-23
+ * fifth round). This is the enforcement point regardless of how an invalid
+ * value got in; `routes/settings.ts`'s PUT-time rejection (same finding)
+ * is defense-in-depth on top of it, not a substitute for it.
+ */
+export declare function isValidCodextenderPort(value: unknown): value is number;
+export interface CodextenderModelEntry {
+    slug: string;
+    display_name: string;
+    /** LiteLLM's declared context window for this alias (its `model_info.
+     *  max_input_tokens`), when the proxy's `/v1/models` response carries one.
+     *  Absent on an older/unpatched proxy — callers must treat that the same
+     *  as "unknown", never assume a number. */
+    max_input_tokens?: number;
+}
+export interface CodextenderProbeResult {
+    ok: boolean;
+    models: CodextenderModelEntry[];
+}
+export interface CodextenderProbeDeps {
+    /** Test seam — defaults to the real global `fetch`. */
+    fetchFn?: typeof fetch;
+    /** Probe timeout in ms. Default 1500 — short enough that a launch or a
+     *  datalist render never feels stuck on an unreachable proxy. */
+    timeoutMs?: number;
+    /** Test seam — defaults to `resolveCodextenderAuthToken()` (reads
+     *  `process.env.CODEXTENDER_AUTH_TOKEN`, no built-in fallback). */
+    authToken?: string;
+}
+/**
+ * `GET http://127.0.0.1:<port>/v1/models` with the configured Codextender
+ * master-key bearer token (`deps.authToken` or `resolveCodextenderAuthToken()`).
+ * Never throws — an unconfigured token, any network error, non-2xx status,
+ * timeout, or malformed body all resolve `{ok: false, models: []}` rather
+ * than rejecting, so callers never need a try/catch.
+ *
+ * LiteLLM's `/v1/models` response is OpenAI-shaped (`{"data": [{"id":
+ * "sol"}, ...]}`) — it carries no separate display name, so `display_name`
+ * is set to the same slug (matches `codex-models-probe.ts`'s
+ * `CodexModelCatalogEntry` shape for the client's shared consumer).
+ */
+export declare function probeCodextenderModels(port: number, deps?: CodextenderProbeDeps): Promise<CodextenderProbeResult>;
+/**
+ * Resolves the REAL context window for the Codextender alias a task is
+ * about to launch with, straight from the proxy's own `/v1/models` response
+ * (operator finding, 2026-09-26, live Codextender iterate test) — never a
+ * number hardcoded here a second time. Claude Code assumes a 200K context
+ * window for any model id it doesn't recognize (the Codex alias is one) and
+ * proactively over-compacts against that wrong, much-too-small ceiling; the
+ * fix is `launcher-codextender.ts` setting `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * from THIS value, so a change to codextender's own declared window (its
+ * `config.py` `model_info.max_input_tokens`) can never drift out of sync
+ * with what webui tells Claude Code — both repos read the same live number.
+ *
+ * Never throws, same contract as `probeCodextenderModels` — resolves
+ * `undefined` (not a guessed fallback) when the probe fails, the alias
+ * isn't in the response, or the response carries no usable
+ * `max_input_tokens` for it (an older/unpatched proxy). The caller's
+ * contract for `undefined` is "leave `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * unset", which is the conservative, safe default — Claude Code's own 200K
+ * fallback — rather than risking an inflated ceiling that starves
+ * compaction entirely.
+ */
+export declare function resolveCodextenderMaxContextTokens(port: number, model: string | undefined, deps?: CodextenderProbeDeps): Promise<number | undefined>;
+/**
+ * `GET http://127.0.0.1:<port>/health/liveliness` — no auth header
+ * required (confirmed live against a real local LiteLLM proxy). This is
+ * the AC8 pre-flight probe: it only needs to know the proxy process is up
+ * and answering, not what it serves. Never throws — same
+ * never-reject contract as `probeCodextenderModels`.
+ */
+export declare function probeCodextenderLiveness(port: number, deps?: CodextenderProbeDeps): Promise<boolean>;
+//# sourceMappingURL=codextender-proxy-probe.d.ts.map

package/server/dist/core/codextender-proxy-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-proxy-probe.d.ts","sourceRoot":"","sources":["../../src/core/codextender-proxy-probe.ts"],"names":[],"mappings":"AAmCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAOtE;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB;;;+CAG2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,qBAAqB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;qEACiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;uEACmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsBD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAmCjC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM7B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/server/dist/core/codextender-proxy-probe.js

@@ -0,0 +1,179 @@
+/*
+ * codextender-proxy-probe — HTTP probes of the local Codextender (LiteLLM)
+ * proxy (Codextender integration spec Part B.3/B.5, re-verified live
+ * 2026-09-23).
+ *
+ * Two distinct endpoints, deliberately not collapsed into one probe:
+ *  - `probeCodextenderLiveness` -> `GET /health/liveliness`, no auth
+ *    header. This is the AC8 pre-flight check (`runtime-chokepoint.ts`'s
+ *    `checkCodextenderProxyAvailable` default, and its fork-route
+ *    equivalent in `external/tasks/fork.ts`) — a launch/fork only needs to
+ *    know the proxy is UP, not what it serves.
+ *  - `probeCodextenderModels` -> `GET /v1/models`, WITH
+ *    `Authorization: Bearer <token>` where `<token>` comes from
+ *    `process.env.CODEXTENDER_AUTH_TOKEN` (`resolveCodextenderAuthToken()`
+ *    in `launcher-codextender.ts` — no built-in default, PR-review BLOCK,
+ *    iterate-2026-09-23) — an unconfigured token degrades this probe to
+ *    `{ok: false}` the same as an unreachable proxy, rather than sending a
+ *    baked-in value. Confirmed live against a real local LiteLLM proxy: an
+ *    unauthenticated `/v1/models` request returns `500` (a LiteLLM quirk,
+ *    not a clean 401), so omitting the header makes every probe look like
+ *    a hard failure regardless. Backs the cached `/api/codextender-models`
+ *    route (`routes/codextender-models.ts`), which wraps this probe in a
+ *    TTL cache mirroring `codex-models.ts`'s shape.
+ *
+ * Deliberately no CLI shell-out (unlike `codex-models-probe.ts`) — the
+ * proxy already speaks these two endpoints natively (LiteLLM's own
+ * built-in routes), so plain HTTP GETs are both the cheapest check and the
+ * datalist's real source.
+ */
+import { DEFAULT_CODEXTENDER_MODEL_ALIAS, resolveCodextenderAuthToken, } from "./launcher-codextender.js";
+/**
+ * `codextenderPort` is persisted/read as arbitrary JSON (PUT /api/settings
+ * accepts an unvalidated body; a hand-edited settings.json is untyped on
+ * disk too) before ever reaching here, so `port: number`'s compile-time
+ * type is not a runtime guarantee. Both probes below MUST reject anything
+ * outside a real TCP port before interpolating it into a URL — a value
+ * like `"4000@attacker.example"` would otherwise redirect the request via
+ * URL userinfo-authority confusion (PR-review BLOCK, iterate-2026-09-23
+ * fifth round). This is the enforcement point regardless of how an invalid
+ * value got in; `routes/settings.ts`'s PUT-time rejection (same finding)
+ * is defense-in-depth on top of it, not a substitute for it.
+ */
+export function isValidCodextenderPort(value) {
+    return (typeof value === "number" &&
+        Number.isInteger(value) &&
+        value >= 1 &&
+        value <= 65535);
+}
+/**
+ * PR-review preflight BLOCK (round 14, 2026-09-26) — `max_input_tokens`
+ * lives under each entry's `model_info` object (LiteLLM's own extension to
+ * the OpenAI-shaped `/v1/models` list; codextender's operator finding
+ * describes its config as declaring the value "in its LiteLLM
+ * `model_info`"), NOT as a flat, top-level field on the entry. A flat
+ * `entry.max_input_tokens` is checked too, purely as a forward-compatible
+ * fallback in case a future LiteLLM/codextender version flattens it — the
+ * nested form is the one actually confirmed, so it takes precedence.
+ */
+function extractMaxInputTokens(entry) {
+    const modelInfo = entry.model_info;
+    const nested = modelInfo && typeof modelInfo === "object"
+        ? modelInfo.max_input_tokens
+        : undefined;
+    const raw = nested ?? entry.max_input_tokens;
+    return typeof raw === "number" && Number.isInteger(raw) && raw > 0 ? raw : undefined;
+}
+/**
+ * `GET http://127.0.0.1:<port>/v1/models` with the configured Codextender
+ * master-key bearer token (`deps.authToken` or `resolveCodextenderAuthToken()`).
+ * Never throws — an unconfigured token, any network error, non-2xx status,
+ * timeout, or malformed body all resolve `{ok: false, models: []}` rather
+ * than rejecting, so callers never need a try/catch.
+ *
+ * LiteLLM's `/v1/models` response is OpenAI-shaped (`{"data": [{"id":
+ * "sol"}, ...]}`) — it carries no separate display name, so `display_name`
+ * is set to the same slug (matches `codex-models-probe.ts`'s
+ * `CodexModelCatalogEntry` shape for the client's shared consumer).
+ */
+export async function probeCodextenderModels(port, deps = {}) {
+    if (!isValidCodextenderPort(port))
+        return { ok: false, models: [] };
+    const authToken = deps.authToken ?? resolveCodextenderAuthToken();
+    if (!authToken)
+        return { ok: false, models: [] };
+    const fetchFn = deps.fetchFn ?? fetch;
+    const timeoutMs = deps.timeoutMs ?? 1500;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchFn(`http://127.0.0.1:${port}/v1/models`, {
+            signal: controller.signal,
+            headers: { Authorization: `Bearer ${authToken}` },
+        });
+        if (!res.ok)
+            return { ok: false, models: [] };
+        const body = await res.json();
+        const rawModels = body?.data;
+        if (!Array.isArray(rawModels))
+            return { ok: false, models: [] };
+        const models = [];
+        for (const entry of rawModels) {
+            if (!entry || typeof entry !== "object")
+                continue;
+            const id = entry.id;
+            if (typeof id !== "string" || id.trim() === "")
+                continue;
+            const maxInputTokens = extractMaxInputTokens(entry);
+            models.push({
+                slug: id,
+                display_name: id,
+                ...(maxInputTokens !== undefined ? { max_input_tokens: maxInputTokens } : {}),
+            });
+        }
+        return { ok: true, models };
+    }
+    catch {
+        return { ok: false, models: [] };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Resolves the REAL context window for the Codextender alias a task is
+ * about to launch with, straight from the proxy's own `/v1/models` response
+ * (operator finding, 2026-09-26, live Codextender iterate test) — never a
+ * number hardcoded here a second time. Claude Code assumes a 200K context
+ * window for any model id it doesn't recognize (the Codex alias is one) and
+ * proactively over-compacts against that wrong, much-too-small ceiling; the
+ * fix is `launcher-codextender.ts` setting `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * from THIS value, so a change to codextender's own declared window (its
+ * `config.py` `model_info.max_input_tokens`) can never drift out of sync
+ * with what webui tells Claude Code — both repos read the same live number.
+ *
+ * Never throws, same contract as `probeCodextenderModels` — resolves
+ * `undefined` (not a guessed fallback) when the probe fails, the alias
+ * isn't in the response, or the response carries no usable
+ * `max_input_tokens` for it (an older/unpatched proxy). The caller's
+ * contract for `undefined` is "leave `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * unset", which is the conservative, safe default — Claude Code's own 200K
+ * fallback — rather than risking an inflated ceiling that starves
+ * compaction entirely.
+ */
+export async function resolveCodextenderMaxContextTokens(port, model, deps = {}) {
+    const alias = model?.trim() || DEFAULT_CODEXTENDER_MODEL_ALIAS;
+    const result = await probeCodextenderModels(port, deps);
+    if (!result.ok)
+        return undefined;
+    const entry = result.models.find((m) => m.slug === alias);
+    return entry?.max_input_tokens;
+}
+/**
+ * `GET http://127.0.0.1:<port>/health/liveliness` — no auth header
+ * required (confirmed live against a real local LiteLLM proxy). This is
+ * the AC8 pre-flight probe: it only needs to know the proxy process is up
+ * and answering, not what it serves. Never throws — same
+ * never-reject contract as `probeCodextenderModels`.
+ */
+export async function probeCodextenderLiveness(port, deps = {}) {
+    if (!isValidCodextenderPort(port))
+        return false;
+    const fetchFn = deps.fetchFn ?? fetch;
+    const timeoutMs = deps.timeoutMs ?? 1500;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchFn(`http://127.0.0.1:${port}/health/liveliness`, {
+            signal: controller.signal,
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=codextender-proxy-probe.js.map

package/server/dist/core/codextender-proxy-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-proxy-probe.js","sourceRoot":"","sources":["../../src/core/codextender-proxy-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACvB,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,KAAK,CACf,CAAC;AACJ,CAAC;AA4BD;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,MAAM,MAAM,GACV,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QACxC,CAAC,CAAE,SAAqC,CAAC,gBAAgB;QACzD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC;IAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,OAA6B,EAAE;IAE/B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,2BAA2B,EAAE,CAAC;IAClE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,oBAAoB,IAAI,YAAY,EAAE;YAC9D,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAI,IAAkC,EAAE,IAAI,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAClD,MAAM,EAAE,GAAI,KAAiC,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACzD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAgC,CAAC,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,EAAE;gBACR,YAAY,EAAE,EAAE;gBAChB,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,IAAY,EACZ,KAAyB,EACzB,OAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,+BAA+B,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,gBAAgB,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,OAA6B,EAAE;IAE/B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,oBAAoB,IAAI,oBAAoB,EAAE;YACtE,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/server/dist/core/contract-version.d.ts

@@ -44,12 +44,27 @@ export declare const PROFILE_SCHEMA_VERSION = 1;
  * (it consumes `Object.values(requirements)` then inner `.id`/`.tests`), so v3
  * is a pure data-shape acknowledgement — no reader-logic change.
  *
+ * **v4** (shipwright monorepo campaign req3-04c-ac-identity-wave2, P3.2:
+ * "AC-scoped `@covers` tag grammar + test-traceability manifest v4") —
+ * additive AC-scoped test binding. A test link may carry an optional
+ * `ac_id` (e.g. `covers("FR-01.11/AC07")` → `"AC07"`), and a requirement
+ * node may carry an optional `acs` breakdown mirroring its own
+ * `tests`/`coverage` shape, scoped per AC. Both are OMITTED ENTIRELY when
+ * the requirement has no AC-scoped tag anywhere, so a repo with none of
+ * these tags yet emits a byte-identical v3-shaped body (only the
+ * `schema_version` const moves). This reader does not consume `ac_id` or
+ * `acs` — it still only reads `.id`/`.tests[<layer>][*].id/.layer/.resolved_from`,
+ * every one of which is unchanged and required in both v3 and v4 — so a
+ * v4 manifest with NO AC tags at all (a "v3-shaped bare FR tag" body) and
+ * one WITH AC tags both invert identically; frozen fixture in
+ * `traceability.v4-fixture.test.ts` pins both shapes.
+ *
  * A manifest declaring a HIGHER version is warned once (via
  * `checkContractVersion`) and still read best-effort — the inner shape the
  * reader consumes has been stable across the bumps seen so far, so an
  * ahead-of-us manifest still yields a useful index.
  */
-export declare const TRACEABILITY_SCHEMA_VERSION = 3;
+export declare const TRACEABILITY_SCHEMA_VERSION = 4;
 /**
  * Check a parsed artefact's declared version against the library's
  * known max. Logs one JSON warning per (artefact, path, version)

package/server/dist/core/contract-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-version.d.ts","sourceRoot":"","sources":["../../src/core/contract-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;GAGG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAc7C;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAmDV;AAED,gEAAgE;AAChE,wBAAgB,cAAc,IAAI,IAAI,CAErC"}
+{"version":3,"file":"contract-version.d.ts","sourceRoot":"","sources":["../../src/core/contract-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;GAGG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAc7C;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAmDV;AAED,gEAAgE;AAChE,wBAAgB,cAAc,IAAI,IAAI,CAErC"}