@svenroth-ai/shipwright 0.27.0 → 0.29.0

package/server/dist/core/campaign-worktree-root.js

@@ -0,0 +1,76 @@
+/*
+ * campaign-worktree-root.ts — where a campaign's loop state actually lives.
+ *
+ * A campaign runs in its OWN worktree, `<main_root>/.worktrees/campaign-<slug>`
+ * (monorepo `campaign-worktree.md`), keyed by the campaign slug so a resumed
+ * campaign re-enters the same directory. That worktree — not the main root —
+ * holds the campaign's `.shipwright/loop_state.json`, and it is the cwd every
+ * git call of `loop_claim.py` (batch-base resolution, ancestry asserts) must
+ * run in. The main root's own `loop_state.json` is not a worktree campaign's
+ * state and is never read for one.
+ *
+ * Legacy campaigns (no such worktree) fall back to the project root, exactly
+ * as they behaved before campaigns got worktrees.
+ *
+ * Read-only and tolerant: any fs error resolves to the fallback, never throws.
+ */
+import { readdirSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+import { isWithin } from "./campaign-paths.js";
+const SLUG_PATTERN = /^[A-Za-z0-9._-]{1,128}$/;
+const WORKTREE_PREFIX = "campaign-";
+/** `<root>/.shipwright/loop_state.json`. */
+export function loopStatePathFor(root) {
+    return path.join(root, ".shipwright", "loop_state.json");
+}
+/** realpath of a directory under `<projectRoot>/.worktrees`, or null. */
+function safeWorktreeDir(projectRoot, name) {
+    try {
+        const parent = realpathSync(path.join(projectRoot, ".worktrees"));
+        // `.worktrees` itself may be a symlink out of the project: it must resolve inside.
+        if (!isWithin(realpathSync(projectRoot), parent))
+            return null;
+        const candidate = path.join(parent, name);
+        if (!statSync(candidate).isDirectory())
+            return null;
+        const real = realpathSync(candidate);
+        return isWithin(parent, real) && real !== parent ? real : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The state root for one campaign: its worktree when present (realpath-guarded
+ * inside `<projectRoot>/.worktrees`), else the project root.
+ */
+export function resolveCampaignStateRoot(projectRoot, slug) {
+    const fallback = { root: projectRoot, worktree: false };
+    if (!SLUG_PATTERN.test(slug) || slug.includes(".."))
+        return fallback;
+    const real = safeWorktreeDir(projectRoot, WORKTREE_PREFIX + slug);
+    return real ? { root: real, worktree: true } : fallback;
+}
+/** Every existing campaign worktree under the project, as `{ slug, root }`. */
+export function listCampaignWorktrees(projectRoot) {
+    let entries;
+    try {
+        entries = readdirSync(path.join(projectRoot, ".worktrees"));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of entries) {
+        if (!name.startsWith(WORKTREE_PREFIX))
+            continue;
+        const slug = name.slice(WORKTREE_PREFIX.length);
+        if (!slug || !SLUG_PATTERN.test(slug) || slug.includes(".."))
+            continue;
+        const real = safeWorktreeDir(projectRoot, name);
+        if (real)
+            out.push({ slug, root: real });
+    }
+    return out;
+}
+//# sourceMappingURL=campaign-worktree-root.js.map

package/server/dist/core/campaign-worktree-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign-worktree-root.js","sourceRoot":"","sources":["../../src/core/campaign-worktree-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAC/C,MAAM,eAAe,GAAG,WAAW,CAAC;AASpC,4CAA4C;AAC5C,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAC3D,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,WAAmB,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;QAClE,mFAAmF;QACnF,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB,EAAE,IAAY;IACxE,MAAM,QAAQ,GAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrE,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAA0C,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACvE,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/server/dist/core/claim-record-lock.d.ts

@@ -0,0 +1,30 @@
+interface VendoredClaimRecordLockContract {
+    contractVersion: number;
+    lockPathSuffix: string;
+    staleMs: number;
+    realpath: boolean;
+}
+export declare const CLAIM_RECORD_LOCK_CONTRACT: VendoredClaimRecordLockContract;
+/**
+ * `proper-lockfile` options carrying the contract's `stale` / `realpath`
+ * fixings explicitly. Never sets `lockfilePath` — the lock marker must stay
+ * `proper-lockfile`'s own `<canonical-target>${lockPathSuffix}`, which is
+ * what a peer holding a different path string to the same file resolves to
+ * as well (contract `lockPathDescription`). Enforced structurally: an
+ * `extra.lockfilePath` is dropped rather than forwarded, so this invariant
+ * does not rely on every caller remembering not to pass one.
+ */
+export declare function claimRecordLockOptions<T extends Record<string, unknown>>(extra: T): Omit<T, "lockfilePath"> & {
+    stale: number;
+    realpath: boolean;
+};
+export interface LockRetryConfig {
+    retries?: number;
+    minTimeout?: number;
+    maxTimeout?: number;
+    factor?: number;
+}
+/** Acquire a `proper-lockfile` lock on `path` under the FR-04.28 contract. */
+export declare function lockClaimRecordFile(path: string, retries?: number | LockRetryConfig): Promise<() => Promise<void>>;
+export {};
+//# sourceMappingURL=claim-record-lock.d.ts.map

package/server/dist/core/claim-record-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-record-lock.d.ts","sourceRoot":"","sources":["../../src/core/claim-record-lock.ts"],"names":[],"mappings":"AAkDA,UAAU,+BAA+B;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AA2BD,eAAO,MAAM,0BAA0B,EAAE,+BAKxC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,KAAK,EAAE,CAAC,GACP,IAAI,CAAC,CAAC,EAAE,cAAc,CAAC,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAOhE;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,eAAmB,GACpC,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAE9B"}

package/server/dist/core/claim-record-lock.js

@@ -0,0 +1,90 @@
+/*
+ * claim-record-lock.ts — FR-04.28 claim-record lock fixings, applied
+ * EXPLICITLY at both of this repo's shared-file lock sites so agreement
+ * with leadwright survives a `proper-lockfile` upstream default change.
+ *
+ * leadwright writes two files this repo also writes: `sdk-sessions.json`
+ * (this module's consumer, via `index.ts`'s `lockPath`) and
+ * `decisions-proposed.md` (`external/org/decisions-lock.ts`). Both call
+ * sites import the SAME constant below rather than retyping numbers, so
+ * they cannot drift from each other even if one is edited without the
+ * other. `index.ts`'s `lockPath` local is also reused for two files
+ * leadwright does NOT touch — `projects.json` and `settings.json` — so a
+ * future `contractVersion` bump changing `staleMs`/`realpath` widens to
+ * those too, not just `sdk-sessions.json`; harmless today only because the
+ * contract's values equal `proper-lockfile`'s own defaults (code-review
+ * finding).
+ *
+ * `core/triage-lock.ts` and `external/org/beat-register-release-core.ts`
+ * are two OTHER `proper-lockfile` call sites nearby that are deliberately
+ * NOT wired to this module (doubt-review finding) — do not migrate them
+ * for "consistency": `triage-lock.ts` sets `lockfilePath` on purpose (to
+ * dodge a Python-owned sidecar lock), which `claimRecordLockOptions` would
+ * silently strip; `beat-register-release-core.ts` hand-mirrors a
+ * DIFFERENT leadwright contract (`lib/file-locks.ts`) with its own
+ * deliberately much longer `stale: 300_000`, and folding it into this
+ * module would silently shrink that window 30x.
+ *
+ * The contract itself is vendored, byte-for-byte, at
+ * `../vendor/leadwright/claim-record-lock-contract.json` — a copy of
+ * leadwright's `schemas/claim-record-lock-contract.json` (generated there
+ * from `lib/claim-contract.ts`'s `CLAIM_RECORD_LOCK_CONTRACT`, leadwright
+ * PR #55, commit 3d24a46). This repo has no build-time or runtime
+ * dependency on the leadwright checkout — the vendored copy is the whole
+ * of the coupling, and it is deliberately weak: nothing here fails loud
+ * when leadwright bumps `contractVersion`. `claim-record-lock.test.ts`
+ * pins today's `contractVersion` (1) against the vendored file, so a
+ * future re-copy that changes the value fails that pin until a human
+ * reviews the bump and updates it deliberately — the same ratchet shape
+ * this repo already uses for the Semgrep suppression set (CLAUDE.md rule
+ * 31). Short of that: re-copying the file is a human's job, on being told
+ * (by leadwright's own changelog, an ADR, or this comment) that the
+ * upstream contract changed. Do not add a script or CI job that fetches
+ * it live — that would be the cross-repo build dependency the iterate
+ * spec for this change explicitly rules out.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as lockfile from "proper-lockfile";
+const here = dirname(fileURLToPath(import.meta.url));
+const vendoredContractPath = join(here, "..", "vendor", "leadwright", "claim-record-lock-contract.json");
+let vendoredContract;
+try {
+    vendoredContract = JSON.parse(readFileSync(vendoredContractPath, "utf-8"));
+}
+catch (err) {
+    // Named explicitly (external review finding): a missing/malformed
+    // vendored copy would otherwise surface as an opaque ENOENT/JSON-parse
+    // error at whichever entry point first imports this module.
+    throw new Error(`claim-record-lock.ts: failed to read the vendored FR-04.28 contract at ` +
+        `${vendoredContractPath} — ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+}
+export const CLAIM_RECORD_LOCK_CONTRACT = {
+    contractVersion: vendoredContract.contractVersion,
+    lockPathSuffix: vendoredContract.lockPathSuffix,
+    staleMs: vendoredContract.staleMs,
+    realpath: vendoredContract.realpath,
+};
+/**
+ * `proper-lockfile` options carrying the contract's `stale` / `realpath`
+ * fixings explicitly. Never sets `lockfilePath` — the lock marker must stay
+ * `proper-lockfile`'s own `<canonical-target>${lockPathSuffix}`, which is
+ * what a peer holding a different path string to the same file resolves to
+ * as well (contract `lockPathDescription`). Enforced structurally: an
+ * `extra.lockfilePath` is dropped rather than forwarded, so this invariant
+ * does not rely on every caller remembering not to pass one.
+ */
+export function claimRecordLockOptions(extra) {
+    const { lockfilePath: _dropped, ...rest } = extra;
+    return {
+        ...rest,
+        stale: CLAIM_RECORD_LOCK_CONTRACT.staleMs,
+        realpath: CLAIM_RECORD_LOCK_CONTRACT.realpath,
+    };
+}
+/** Acquire a `proper-lockfile` lock on `path` under the FR-04.28 contract. */
+export async function lockClaimRecordFile(path, retries = 3) {
+    return lockfile.lock(path, claimRecordLockOptions({ retries }));
+}
+//# sourceMappingURL=claim-record-lock.js.map

package/server/dist/core/claim-record-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-record-lock.js","sourceRoot":"","sources":["../../src/core/claim-record-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAS5C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,oBAAoB,GAAG,IAAI,CAC/B,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,YAAY,EACZ,iCAAiC,CAClC,CAAC;AAEF,IAAI,gBAAiD,CAAC;AACtD,IAAI,CAAC;IACH,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAC3B,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CACT,CAAC;AACvC,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,kEAAkE;IAClE,uEAAuE;IACvE,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CACb,yEAAyE;QACvE,GAAG,oBAAoB,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACjF,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAoC;IACzE,eAAe,EAAE,gBAAgB,CAAC,eAAe;IACjD,cAAc,EAAE,gBAAgB,CAAC,cAAc;IAC/C,OAAO,EAAE,gBAAgB,CAAC,OAAO;IACjC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;CACpC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAQ;IAER,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAuC,CAAC;IACpF,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,0BAA0B,CAAC,OAAO;QACzC,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;KAC9C,CAAC;AACJ,CAAC;AASD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,UAAoC,CAAC;IAErC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/server/dist/core/cli-child-spawn.d.ts

@@ -0,0 +1,28 @@
+import { spawn } from "node:child_process";
+import { treeKill as realTreeKill } from "./preview-child-lifecycle.js";
+export interface CliChildSpawnResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+    spawnError?: string;
+}
+export type CliChildSpawnFn = (bin: string, args: string[], options: {
+    timeoutMs: number;
+    env: NodeJS.ProcessEnv;
+}) => Promise<CliChildSpawnResult>;
+export interface CliChildSpawnDeps {
+    /** Injected for tests — a fake `spawn`. */
+    spawnFn?: typeof spawn;
+    /** Injected for tests — a fake `treeKill`. */
+    treeKillFn?: typeof realTreeKill;
+    /** Injected for tests — overrides `process.platform`. */
+    platform?: NodeJS.Platform;
+}
+/** Tree-kill every currently in-flight CLI child. Best-effort, synchronous
+ *  (matches `PreviewSessionManager.killAll()` / `PtyManager.killAll()`).
+ *  `treeKillFn` is injectable — tests exercise the registry without a real
+ *  platform-dependent `taskkill`/`process.kill` side effect. */
+export declare function killAllTrackedCliChildren(treeKillFn?: typeof realTreeKill): void;
+export declare function createCliChildSpawn(deps?: CliChildSpawnDeps): CliChildSpawnFn;
+export declare const defaultCliChildSpawn: CliChildSpawnFn;
+//# sourceMappingURL=cli-child-spawn.d.ts.map

package/server/dist/core/cli-child-spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-child-spawn.d.ts","sourceRoot":"","sources":["../../src/core/cli-child-spawn.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAIxE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KACnD,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAElC,MAAM,WAAW,iBAAiB;IAChC,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,OAAO,YAAY,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAUD;;;gEAGgE;AAChE,wBAAgB,yBAAyB,CAAC,UAAU,GAAE,OAAO,YAA2B,GAAG,IAAI,CAS9F;AAgBD,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,iBAAsB,GAAG,eAAe,CAuEjF;AAED,eAAO,MAAM,oBAAoB,EAAE,eAAuC,CAAC"}

package/server/dist/core/cli-child-spawn.js

@@ -0,0 +1,146 @@
+/*
+ * cli-child-spawn.ts — shared spawn wrapper for the short-lived CLI
+ * bridges (`triage-cli-runner.ts`, `codex-oracle-runner.ts`). Both wrap
+ * `uv run --no-project --python ">=3.11" <script>` and previously carried
+ * byte-identical `execFile(..., { timeout }, cb)` implementations —
+ * factored out here so a fix lands once instead of twice, and so the two
+ * copies can't re-diverge.
+ *
+ * Required-CI PR-review finding on PR #466: `execFile`'s own `timeout`
+ * option only signals the IMMEDIATE child (`uv`); if `uv run` has already
+ * forked a Python grandchild by the time it fires, Node does not reap that
+ * grandchild on Windows. Accepted as low-severity for triage-cli-runner.ts
+ * (fires only on a user click) but NOT for codex-oracle-runner.ts, which
+ * fires every 60s per stalled task indefinitely — the same theoretical gap
+ * at a much higher exposure rate. Fixed here by driving our OWN timer that
+ * tree-kills the whole process group instead of relying on Node's
+ * single-process kill — reusing `preview-child-lifecycle.ts`'s `treeKill`
+ * (win32 `taskkill /t /f`, POSIX `kill(-pid)`) rather than adding the
+ * `tree-kill` npm package, which `decision_log.md` records as a
+ * deliberately pruned dependency.
+ *
+ * `execFile` is replaced with `spawn` (matching `preview-session-manager.
+ * ts`'s own spawn call) because `execFile`'s TypeScript surface has no
+ * `detached` option at all — and `detached: platform !== "win32"` is
+ * load-bearing, not incidental: POSIX `treeKill` signals the process
+ * GROUP via a negative pid, which only exists if the child led its own
+ * group at spawn time. Without it `kill(-pid)` ESRCHes and silently
+ * degrades to a single-process kill — the exact case this module exists
+ * to close. stdout/stderr are accumulated manually and truncated (not
+ * errored) past the 1MB cap — a truncated JSON payload still fails the
+ * caller's `JSON.parse` the same way an old `maxBuffer` error used to,
+ * without adding a distinct overflow error path to keep in sync.
+ *
+ * `error.killed` is NOT how a timeout is detected here (unlike the old
+ * per-file implementations) — our tree-kill goes around `child.kill()`
+ * entirely (an external `taskkill` process, or a raw `process.kill(-pid)`),
+ * so `ChildProcess#killed` never flips true for it. An explicit `timedOut`
+ * flag, set the instant our timer fires, is the only correct signal.
+ */
+import { spawn } from "node:child_process";
+import { treeKill as realTreeKill } from "./preview-child-lifecycle.js";
+const MAX_BUFFER_CHARS = 1024 * 1024;
+// Every real child this process has spawned via `createCliChildSpawn` and
+// has not yet seen exit — index.ts's shutdown() tree-kills whatever remains
+// here, mirroring the existing `previewManager.killAll()` / `ptyManager.
+// killAll()` precedent (a stalled-task tick can leave one in flight; the
+// 30s-per-call timeout alone is not a shutdown guarantee, since a hard
+// process.exit() can fire well inside that window).
+const trackedChildren = new Set();
+/** Tree-kill every currently in-flight CLI child. Best-effort, synchronous
+ *  (matches `PreviewSessionManager.killAll()` / `PtyManager.killAll()`).
+ *  `treeKillFn` is injectable — tests exercise the registry without a real
+ *  platform-dependent `taskkill`/`process.kill` side effect. */
+export function killAllTrackedCliChildren(treeKillFn = realTreeKill) {
+    for (const child of trackedChildren) {
+        try {
+            treeKillFn(child, "SIGKILL");
+        }
+        catch {
+            // best-effort — nothing more to do for an already-dead child
+        }
+    }
+    trackedChildren.clear();
+}
+function appendBounded(current, chunk) {
+    const next = current + chunk;
+    return next.length > MAX_BUFFER_CHARS ? next.slice(0, MAX_BUFFER_CHARS) : next;
+}
+// Local PR-review preflight finding, round 2 (PR #466): the tree-kill call
+// on timeout is fire-and-forget — an external `taskkill` process (win32) or
+// a raw `process.kill(-pid)` (POSIX) — and neither GUARANTEES a `close`
+// event follows (an unresponsive process, a `taskkill` that itself failed
+// silently). Without a second bound, a failed kill would leave the
+// returned promise pending and the child in `trackedChildren` forever,
+// defeating the "bounded" half of "bounded/reaped subprocess strategy".
+const KILL_GRACE_MS = 5000;
+export function createCliChildSpawn(deps = {}) {
+    const spawnFn = deps.spawnFn ?? spawn;
+    const treeKillFn = deps.treeKillFn ?? realTreeKill;
+    const platform = deps.platform ?? process.platform;
+    return (bin, args, options) => new Promise((resolve) => {
+        let timedOut = false;
+        let settled = false;
+        let stdout = "";
+        let stderr = "";
+        let timer;
+        let killGraceTimer;
+        const child = spawnFn(bin, args, {
+            windowsHide: true,
+            env: options.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            // See module header — spawn/kill must agree on whether a
+            // process group exists.
+            detached: platform !== "win32",
+        });
+        trackedChildren.add(child);
+        child.stdout?.setEncoding("utf-8");
+        child.stderr?.setEncoding("utf-8");
+        child.stdout?.on("data", (chunk) => {
+            stdout = appendBounded(stdout, chunk);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr = appendBounded(stderr, chunk);
+        });
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (killGraceTimer)
+                clearTimeout(killGraceTimer);
+            trackedChildren.delete(child);
+            resolve(result);
+        };
+        child.once("error", (err) => {
+            finish({
+                code: -1,
+                stdout,
+                stderr,
+                spawnError: typeof err.code === "string" ? err.code : "spawn_error",
+            });
+        });
+        child.once("close", (code) => {
+            if (timedOut)
+                return finish({ code: 124, stdout, stderr, spawnError: "timeout" });
+            return finish({ code: code ?? 1, stdout, stderr });
+        });
+        timer = setTimeout(() => {
+            timedOut = true;
+            try {
+                treeKillFn(child, "SIGKILL", { platform });
+            }
+            catch {
+                // best-effort — the grace timer below bounds the promise
+                // regardless of whether the kill itself threw or was ignored.
+            }
+            killGraceTimer = setTimeout(() => {
+                finish({ code: 124, stdout, stderr, spawnError: "timeout" });
+            }, KILL_GRACE_MS);
+            killGraceTimer.unref?.();
+        }, options.timeoutMs);
+        timer.unref?.();
+    });
+}
+export const defaultCliChildSpawn = createCliChildSpawn();
+//# sourceMappingURL=cli-child-spawn.js.map

package/server/dist/core/cli-child-spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-child-spawn.js","sourceRoot":"","sources":["../../src/core/cli-child-spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAwBrC,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAgB,CAAC;AAEhD;;;gEAGgE;AAChE,MAAM,UAAU,yBAAyB,CAAC,aAAkC,YAAY;IACtF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IACD,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,UAAU,mBAAmB,CAAC,OAA0B,EAAE;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEnD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,KAAoC,CAAC;QACzC,IAAI,cAAyD,CAAC;QAE9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE;YAC/B,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,yDAAyD;YACzD,wBAAwB;YACxB,QAAQ,EAAE,QAAQ,KAAK,OAAO;SAC/B,CAAC,CAAC;QACH,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE3B,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAQ,EAAE;YACnD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,cAAc;gBAAE,YAAY,CAAC,cAAc,CAAC,CAAC;YACjD,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YACjD,MAAM,CAAC;gBACL,IAAI,EAAE,CAAC,CAAC;gBACR,MAAM;gBACN,MAAM;gBACN,UAAU,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;aACpE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,QAAQ;gBAAE,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YAClF,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBACH,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;gBACzD,8DAA8D;YAChE,CAAC;YACD,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC/B,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,CAAC,EAAE,aAAa,CAAC,CAAC;YAClB,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3B,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAoB,mBAAmB,EAAE,CAAC"}

package/server/dist/core/codex-models-probe.d.ts

@@ -0,0 +1,46 @@
+import { type RunFn } from "./readiness-probe-run.js";
+export interface CodexModelCatalogEntry {
+    slug: string;
+    display_name: string;
+}
+export interface CodexModelsProbeResult {
+    ok: boolean;
+    models: CodexModelCatalogEntry[];
+}
+export interface CodexModelsProbeDeps {
+    run?: RunFn;
+}
+/**
+ * Run `codex debug models` and reduce its raw catalog (which also carries
+ * per-model reasoning-level metadata and multi-KB prompt text this codebase
+ * has no use for) down to the `{slug, display_name}` pairs a launch-form
+ * combobox needs. Never throws.
+ *
+ * Filters to entries that are objects with a `slug` matching the existing
+ * `CODEX_MODEL_SLUG_PATTERN` (the same syntactic gate `parse-body.ts` applies
+ * to a launch request — imported directly here since this is an intra-server
+ * import, not the cross-package case DO-NOT #7 forbids) and a non-empty
+ * string `display_name`, with `visibility === "list"` (excludes
+ * internal/reserved entries like `codex-auto-review`). A single malformed
+ * entry is dropped, not fatal to the rest of the list — this is untrusted
+ * external-process output whose shape this codebase does not control.
+ * (external review fix, both reviewers, 2026-09-19 architecture review.)
+ *
+ * Gates on `result.code === 0`, NOT `result.ok` — `readiness-probe-run.ts`'s
+ * shared `ok` heuristic (`!error && /\d+\.\d+/.test(stdout+stderr)`) was
+ * written for `--version` probes and requires a dotted version number
+ * somewhere in the output. A real catalog containing only integer-suffixed
+ * slugs (no dotted version anywhere in the JSON) would trip that heuristic to
+ * `false` despite a clean exit and fully valid JSON — exactly the false
+ * `unavailable` gap `RunResult.code`'s own doc comment already names `code`
+ * as the fix for (code-review finding, 2026-09-19). `code` can be `null` on
+ * ENOENT/timeout, hence the strict `=== 0`.
+ *
+ * De-duplicates on `slug`, first-wins — the CLI's own catalog shape is
+ * untrusted external-process output (same reasoning as the per-entry
+ * shape checks above), and a duplicate slug would otherwise reach the
+ * client as two `<option>`s sharing one React key (doubt-review finding,
+ * 2026-09-19).
+ */
+export declare function runCodexModelsProbe(deps: CodexModelsProbeDeps): Promise<CodexModelsProbeResult>;
+//# sourceMappingURL=codex-models-probe.d.ts.map

package/server/dist/core/codex-models-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-models-probe.d.ts","sourceRoot":"","sources":["../../src/core/codex-models-probe.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAkB,KAAK,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAmCrG"}

package/server/dist/core/codex-models-probe.js

@@ -0,0 +1,103 @@
+/*
+ * codex-models-probe — the "codex debug models" catalog PROBE
+ * (iterate-2026-09-19-codex-model-catalog, follow-up to shipwright#471/#473).
+ *
+ * Replaces the withdrawn hardcoded model-slug enum (shipwright#771) with a
+ * live probe of the Codex CLI's own catalog, so the New Iterate combobox
+ * never lags the provider's own model lineup. Reuses `defaultRunShim` from
+ * `readiness-probe-run.ts` — `codex` installs as a Windows `.cmd` PATHEXT
+ * shim (no `codex.exe`), which `execFile(cmd, args, {shell:false})` cannot
+ * invoke directly (see that module's own doc comment); `defaultRunShim`
+ * already solves this for the readiness probe's `codex --version` check, and
+ * this is the same binary.
+ *
+ * Runs with NO extra flags — deliberately not `--bundled` ("skip refresh,
+ * dump only the catalog shipped with this binary"): empirically, `--bundled`
+ * returns a visibly OLDER catalog (verified during this iterate's Confidence
+ * Calibration — missing a newly-listed model, carrying stale entries the
+ * refreshed call no longer lists). The whole point of this probe is to stay
+ * ahead of a hand-maintained list, so the default (refreshing) invocation is
+ * the only one that serves that goal.
+ *
+ * Verified during this iterate: `codex debug models` requires NO
+ * authentication (re-ran with an empty `CODEX_HOME` — no `auth.json` — and
+ * it still exited 0 with the full catalog), so this probe has no
+ * auth-specific degraded path to handle.
+ */
+import { CODEX_MODEL_SLUG_PATTERN } from "../external/launch/parse-body.js";
+import { defaultRunShim } from "./readiness-probe-run.js";
+/**
+ * Run `codex debug models` and reduce its raw catalog (which also carries
+ * per-model reasoning-level metadata and multi-KB prompt text this codebase
+ * has no use for) down to the `{slug, display_name}` pairs a launch-form
+ * combobox needs. Never throws.
+ *
+ * Filters to entries that are objects with a `slug` matching the existing
+ * `CODEX_MODEL_SLUG_PATTERN` (the same syntactic gate `parse-body.ts` applies
+ * to a launch request — imported directly here since this is an intra-server
+ * import, not the cross-package case DO-NOT #7 forbids) and a non-empty
+ * string `display_name`, with `visibility === "list"` (excludes
+ * internal/reserved entries like `codex-auto-review`). A single malformed
+ * entry is dropped, not fatal to the rest of the list — this is untrusted
+ * external-process output whose shape this codebase does not control.
+ * (external review fix, both reviewers, 2026-09-19 architecture review.)
+ *
+ * Gates on `result.code === 0`, NOT `result.ok` — `readiness-probe-run.ts`'s
+ * shared `ok` heuristic (`!error && /\d+\.\d+/.test(stdout+stderr)`) was
+ * written for `--version` probes and requires a dotted version number
+ * somewhere in the output. A real catalog containing only integer-suffixed
+ * slugs (no dotted version anywhere in the JSON) would trip that heuristic to
+ * `false` despite a clean exit and fully valid JSON — exactly the false
+ * `unavailable` gap `RunResult.code`'s own doc comment already names `code`
+ * as the fix for (code-review finding, 2026-09-19). `code` can be `null` on
+ * ENOENT/timeout, hence the strict `=== 0`.
+ *
+ * De-duplicates on `slug`, first-wins — the CLI's own catalog shape is
+ * untrusted external-process output (same reasoning as the per-entry
+ * shape checks above), and a duplicate slug would otherwise reach the
+ * client as two `<option>`s sharing one React key (doubt-review finding,
+ * 2026-09-19).
+ */
+export async function runCodexModelsProbe(deps) {
+    const run = deps.run ?? defaultRunShim;
+    let result;
+    try {
+        result = await run("codex", ["debug", "models"]);
+    }
+    catch {
+        // `defaultRunShim`/`defaultRun` never reject (execFile's callback always
+        // resolves a RunResult) — this guards a rejecting `run` override, so the
+        // "never throws" contract this docstring promises actually holds for any
+        // caller's `deps.run`, not just the two shipped implementations
+        // (external code-review finding, 2026-09-19).
+        return { ok: false, models: [] };
+    }
+    if (result.code !== 0)
+        return { ok: false, models: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout);
+    }
+    catch {
+        return { ok: false, models: [] };
+    }
+    const rawModels = parsed?.models;
+    if (!Array.isArray(rawModels))
+        return { ok: false, models: [] };
+    const bySlug = new Map();
+    for (const entry of rawModels) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const { slug, display_name, visibility } = entry;
+        if (visibility !== "list")
+            continue;
+        if (typeof slug !== "string" || !CODEX_MODEL_SLUG_PATTERN.test(slug))
+            continue;
+        if (typeof display_name !== "string" || display_name.trim() === "")
+            continue;
+        if (!bySlug.has(slug))
+            bySlug.set(slug, { slug, display_name });
+    }
+    return { ok: true, models: [...bySlug.values()] };
+}
+//# sourceMappingURL=codex-models-probe.js.map

package/server/dist/core/codex-models-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-models-probe.js","sourceRoot":"","sources":["../../src/core/codex-models-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAc,MAAM,0BAA0B,CAAC;AAgBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAA0B;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC;IACvC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,gEAAgE;QAChE,8CAA8C;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAExD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,SAAS,GAAI,MAAsC,EAAE,MAAM,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAgC,CAAC;QAC5E,IAAI,UAAU,KAAK,MAAM;YAAE,SAAS;QACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QAC7E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC"}

package/server/dist/core/codex-oracle-runner.d.ts

@@ -0,0 +1,68 @@
+import { type RunFn } from "./readiness-probe.js";
+export declare const CODEX_ORACLE_TIMEOUT_MS = 30000;
+/** Verbatim mirror of `codex_completion_oracle.py`'s `verdict` field. */
+export type OracleVerdict = "done" | "not_done" | "delivery_pending" | "no_oracle";
+export interface OracleEvidence {
+    /**
+     * §5.1's correction — present only on an `iterate`-phase `delivery_pending`
+     * verdict. `"error"` = watch_pr_delivery.py's checks_failed/closed branch
+     * (a PR exists but its delivery failed — never re-poll forever). Absent or
+     * `"indeterminate"` = case 13 proper (CI/review/auto-merge still running,
+     * or the watcher itself produced no verdict) — safe to keep re-polling.
+     */
+    delivery_state?: "error" | "indeterminate";
+    [key: string]: unknown;
+}
+export interface OracleResult {
+    verdict: OracleVerdict;
+    phase: string;
+    session: string;
+    evidence: OracleEvidence;
+}
+export type OracleOutcome = {
+    kind: "ok";
+    result: OracleResult;
+} | {
+    kind: "engine-unavailable";
+    reason: string;
+    repairCommand: string;
+} | {
+    kind: "failed";
+    reason: string;
+};
+export interface OracleSpawnResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+    spawnError?: string;
+}
+export type OracleSpawnFn = (bin: string, args: string[], options: {
+    timeoutMs: number;
+    env: NodeJS.ProcessEnv;
+}) => Promise<OracleSpawnResult>;
+export declare const defaultSpawnOracle: OracleSpawnFn;
+export interface RunCodexOracleInput {
+    projectRoot: string;
+    phase: string;
+    session: string;
+    /** ISO-8601 with timezone — the §2.4 degradation-path floor. */
+    since?: string;
+}
+export interface CodexOracleDeps {
+    run?: RunFn;
+    spawn?: OracleSpawnFn;
+    existsFn?: (p: string) => boolean;
+    homeDir?: string;
+    scriptOverride?: string;
+    timeoutMs?: number;
+    baseEnv?: NodeJS.ProcessEnv;
+}
+/** Resolve the single cache-owned oracle CLI shipped with the Shipwright runtime. */
+export declare function resolveCodexOracleScript(deps?: Pick<CodexOracleDeps, "existsFn" | "homeDir" | "scriptOverride">): string | null;
+/**
+ * Run `codex_completion_oracle.py --project-root <root> --phase <p>
+ * --session <sid> [--since <iso>]` and parse its JSON verdict. Never
+ * throws for an oracle failure — only a programming error would reject.
+ */
+export declare function runCodexOracle(input: RunCodexOracleInput, deps?: CodexOracleDeps): Promise<OracleOutcome>;
+//# sourceMappingURL=codex-oracle-runner.d.ts.map

package/server/dist/core/codex-oracle-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-oracle-runner.d.ts","sourceRoot":"","sources":["../../src/core/codex-oracle-runner.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAiD,KAAK,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAGjG,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAEnF,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,eAAe,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KACnD,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,eAAO,MAAM,kBAAkB,EAAE,aAAoC,CAAC;AAEtE,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC7B;AAED,qFAAqF;AACrF,wBAAgB,wBAAwB,CACtC,IAAI,GAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,SAAS,GAAG,gBAAgB,CAAM,GAC1E,MAAM,GAAG,IAAI,CAWf;AAQD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,aAAa,CAAC,CAuExB"}