@svenroth-ai/shipwright 0.27.0 → 0.29.0

package/server/dist/core/codex-terminal-signal-detect.js

@@ -0,0 +1,113 @@
+/*
+ * codex-terminal-signal-detect.ts — Codex Light §5.3 "Guided-mode approvals
+ * and structured errors": pure detectors over the visible-viewport text of
+ * a Codex-runtime embedded terminal, mirroring `terminal-prompt-detect.ts`'s
+ * shape (bottom-anchored, bounded, best-effort) but keyed to Codex's own
+ * strings instead of Claude's.
+ *
+ * Evidence: `codex-task-watcher.ts`'s module header previously scoped this
+ * detector OUT as "no verified plain-pty-TUI text pattern to build a
+ * detector from yet" — the spec's own §3 confirmation test only exercised
+ * `request_user_input` over the APP-SERVER protocol (Stage 2, not v1). That
+ * gap is now closed for the plain-pty case: the exact strings below were
+ * extracted directly from the real, installed `codex-cli 0.147.0` Windows
+ * binary (`@openai/codex-win32-x64`'s `codex.exe`, via a printable-string
+ * scan), the same evidence tier `codex-thread-discovery.ts` used for the
+ * rollout-file naming convention. One honest gap remains, smaller than that
+ * one: these strings are confirmed to exist verbatim in the binary, not
+ * (yet) observed in an actual rendered pty capture of a live approval
+ * dialog — ratatui box-drawing/wrapping around them is unverified. The
+ * detectors are therefore deliberately conservative (a short, literal
+ * heading match within a bottom-anchored recency window, no footer-shape
+ * assumptions) so a wrapped border cannot produce a false NEGATIVE beyond
+ * "missed this tick, the next poll on unchanged text still forms a false
+ * positive risk that a real capture might have avoided" — and the anchor
+ * strings are distinctive enough (only Codex's own approval elicitation or
+ * error footer would ever emit them) that a false POSITIVE is effectively
+ * impossible.
+ *
+ * Independent of the silence-timer/oracle loop (§5.3's own wording) — wired
+ * as an Inbox post-pass (`external/inbox/_codex.ts`), not into
+ * `CodexTaskWatcher.tick()`, exactly like `terminal_prompt`'s own
+ * `appendTerminalPrompts` post-pass.
+ */
+/** Recency window — how many trailing lines of visible text count as "the
+ *  current bottom-most content" for either signal. A live dialog or error
+ *  footer is always the last thing Codex printed; older scrollback above
+ *  this window is deliberately never scanned (an old, since-scrolled-past
+ *  approval/error must not resurrect itself as "still pending"). */
+const RECENCY_WINDOW_LINES = 40;
+/** Codex's two known approval-elicitation headings (command exec, patch
+ *  apply) — verified verbatim in the real codex.exe binary. */
+const APPROVAL_HEADING = /Allow Codex to (run `|apply proposed code changes\?)/i;
+/** Codex's generic turn-ending error footer — shown for a turn abort,
+ *  Ctrl-C interrupt, high load, rate limit, etc.; the one constant across
+ *  all of them. Verified verbatim in the real codex.exe binary. */
+const ERROR_FOOTER = /Something went wrong\??\s*Hit\s*`?\/feedback`?\s*to report the issue/i;
+const MAX_BLOCK_LINES = 24;
+/** Mirrors terminal-prompt-detect.ts's MAX_QUESTION_TEXT_LEN cap — keeps a
+ *  pathological viewport from leaking unbounded text into the Inbox. */
+const MAX_SIGNAL_TEXT_LEN = 4000;
+function isBlank(line) {
+    return line.trim().length === 0;
+}
+function recencyLines(visibleText) {
+    const lines = visibleText.split("\n");
+    const startIndex = Math.max(0, lines.length - RECENCY_WINDOW_LINES);
+    return { lines: lines.slice(startIndex), startIndex };
+}
+/** Collect a bounded block around the matched heading line — from the
+ *  heading down to the next blank-line gap or the hard cap, so the block
+ *  captures the command/heading plus its immediately-following option
+ *  list without pulling in unrelated scrollback. */
+function collectBlock(lines, headingIndex) {
+    const block = [];
+    let blankRun = 0;
+    for (let i = headingIndex; i < lines.length && block.length < MAX_BLOCK_LINES; i++) {
+        const line = lines[i];
+        if (isBlank(line)) {
+            blankRun++;
+            if (blankRun >= 2)
+                break;
+        }
+        else {
+            blankRun = 0;
+        }
+        block.push(line);
+    }
+    while (block.length > 0 && isBlank(block[block.length - 1]))
+        block.pop();
+    const text = block.join("\n");
+    return text.length > MAX_SIGNAL_TEXT_LEN ? text.slice(0, MAX_SIGNAL_TEXT_LEN) : text;
+}
+/** A pending Codex approval request (command exec or patch apply) in the
+ *  trailing text of a live embedded terminal, or `null`. */
+export function extractCodexApprovalPrompt(visibleText) {
+    if (!visibleText)
+        return null;
+    const { lines } = recencyLines(visibleText);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (APPROVAL_HEADING.test(lines[i])) {
+            return collectBlock(lines, i);
+        }
+    }
+    return null;
+}
+/** A Codex-reported structured error/turn-abort in the trailing text of a
+ *  live embedded terminal, or `null`. */
+export function extractCodexErrorText(visibleText) {
+    if (!visibleText)
+        return null;
+    const { lines } = recencyLines(visibleText);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (ERROR_FOOTER.test(lines[i])) {
+            // The error line itself is usually self-contained ("<cause>.
+            // Something went wrong? Hit `/feedback` ...") — a few lines of
+            // leading context in case the cause wrapped onto the prior line.
+            const from = Math.max(0, i - 2);
+            return collectBlock(lines, from);
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=codex-terminal-signal-detect.js.map

package/server/dist/core/codex-terminal-signal-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-terminal-signal-detect.js","sourceRoot":"","sources":["../../src/core/codex-terminal-signal-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;oEAIoE;AACpE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;+DAC+D;AAC/D,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AAEjF;;mEAEmE;AACnE,MAAM,YAAY,GAAG,uEAAuE,CAAC;AAE7F,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B;wEACwE;AACxE,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED;;;oDAGoD;AACpD,SAAS,YAAY,CAAC,KAAe,EAAE,YAAoB;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,QAAQ,EAAE,CAAC;YACX,IAAI,QAAQ,IAAI,CAAC;gBAAE,MAAM;QAC3B,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED;4DAC4D;AAC5D,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;yCACyC;AACzC,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,6DAA6D;YAC7D,+DAA+D;YAC/D,iEAAiE;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/server/dist/core/codex-thread-discovery.d.ts

@@ -0,0 +1,21 @@
+export interface CodexThreadDiscoveryDeps {
+    readdir: (dir: string) => Promise<string[]>;
+    /** Reads just the head of a file — rollout files can be large, but `session_meta` is always the very first line. */
+    readHead: (filePath: string, maxBytes: number) => Promise<string>;
+    homeDir: () => string;
+}
+export declare function codexSessionsRoot(deps: Pick<CodexThreadDiscoveryDeps, "homeDir">): string;
+export interface DiscoverCodexThreadIdArgs {
+    cwd: string;
+    /** ISO-8601 — only rollout files at/after this instant are considered. */
+    sinceIso: string;
+    /** Skip these thread ids — already claimed by another task this process knows about. */
+    excludeThreadIds?: ReadonlySet<string>;
+}
+/**
+ * Best-effort, filename-first discovery of the thread id a fresh Codex
+ * launch produced. Returns `null` (not an error) when nothing matches yet.
+ */
+export declare function discoverCodexThreadId(args: DiscoverCodexThreadIdArgs, deps: CodexThreadDiscoveryDeps): Promise<string | null>;
+export declare const defaultCodexThreadDiscoveryDeps: CodexThreadDiscoveryDeps;
+//# sourceMappingURL=codex-thread-discovery.d.ts.map

package/server/dist/core/codex-thread-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-thread-discovery.d.ts","sourceRoot":"","sources":["../../src/core/codex-thread-discovery.ts"],"names":[],"mappings":"AAkDA,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,oHAAoH;IACpH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,EAAE,MAAM,MAAM,CAAC;CACvB;AAkBD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,wBAAwB,EAAE,SAAS,CAAC,GAAG,MAAM,CAEzF;AA2BD,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,EAC/B,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqDxB;AAED,eAAO,MAAM,+BAA+B,EAAE,wBAa7C,CAAC"}

package/server/dist/core/codex-thread-discovery.js

@@ -0,0 +1,169 @@
+/*
+ * core/codex-thread-discovery.ts — Codex Light §4's missing piece: how a
+ * fresh Codex launch's `threadId` actually gets captured. v1 launches Codex
+ * as a plain interactive TUI in a pty (§2.2) — there is no app-server call
+ * (deferred to Stage 2) and no `--session-id`-equivalent flag Codex accepts
+ * at the top level (`codex --help`, verified live against an installed
+ * Codex CLI: no such flag exists), so the id must be DISCOVERED after the
+ * fact, filename-first — the exact pattern CLAUDE.md rule 3 already uses
+ * for Claude's own JSONL discovery.
+ *
+ * Verified live (2026-09-16, codex-cli 0.147.0) against a real installed
+ * Codex CLI: every session — interactive or subagent — writes a rollout
+ * file to `~/.codex/sessions/<local-YYYY>/<local-MM>/<local-DD>/rollout-
+ * <local-ISO-with-dashes-for-colons>-<thread-id>.jsonl`, whose FIRST line
+ * is always `{"type":"session_meta","payload":{"id":"<thread-id>","cwd":
+ * "<abs-path>",...}}` — the thread id is in the filename AND the first
+ * line's payload, mirroring the filename-first + first-line-sanity-check
+ * shape Claude's own discovery already uses. `cwd` is the launch working
+ * directory verbatim (OS-native separators), letting us match a rollout
+ * file to the task that spawned it without Codex ever needing to accept a
+ * caller-supplied id.
+ *
+ * Consumed by `CodexTaskWatcher` (`codex-task-watcher.ts`): on every tick,
+ * a live Codex task with no `threadId` yet gets one discovery attempt;
+ * `null` is not an error (the rollout file may not have flushed to disk
+ * yet, or Codex may still be starting up) — the caller just retries next
+ * tick. Once found, `threadId` is patched onto the task record and the
+ * §4 resume branch (`runtime-chokepoint.ts`'s `resume = Boolean(task.
+ * threadId)`) starts working on the task's next launch.
+ *
+ * Known, accepted limitation (doubt-review, disposition: documented, not
+ * fixed): matching is purely (cwd, launch-time window) — there is no
+ * possession/identity proof tying a candidate rollout file to THIS
+ * webui-spawned pty specifically. An operator manually running `codex` in
+ * the same project directory, in another terminal, within the same
+ * discovery window would produce an indistinguishable rollout file; if it
+ * happens to be the earliest unclaimed match, it gets bound to the wrong
+ * task (and, once `threadId` is set, discovery never re-runs for that
+ * task, so the mistake is not self-correcting). Accepted because it needs
+ * an external actor deliberately racing the exact window, has no
+ * destructive blast radius (a wrong `threadId` just makes `codex resume`
+ * on the Resume button open the wrong-but-still-real thread, not corrupt
+ * anything), and there is no stronger signal Codex's CLI exposes to
+ * disambiguate against in v1.
+ */
+import fsPromises from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+const ROLLOUT_RE = /^rollout-(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2})-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/;
+/**
+ * Disposition (doubt-review, low-severity, accepted not fixed): if a
+ * rollout file's first `session_meta` JSON line ever exceeds this many
+ * bytes, `JSON.parse` on the truncated head throws, the candidate is
+ * skipped, and — with no larger-buffer retry — that task's discovery
+ * fails identically on every later tick (permanent, not degrading: the
+ * `resume` branch never fires and every "Resume" click silently
+ * relaunches fresh). Accepted because the verified real `session_meta`
+ * line (module header) is compact, and 4KB is a generous margin over it;
+ * revisit with a retry-on-parse-failure if a future Codex CLI version
+ * ever grows this payload.
+ */
+const HEAD_BYTES = 4096;
+export function codexSessionsRoot(deps) {
+    return path.join(deps.homeDir(), ".codex", "sessions");
+}
+function normalizeCwd(p) {
+    return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+/** The launch day plus a one-day hedge either side, against a local-midnight folder-boundary race. */
+function dayFolders(since) {
+    const days = [-1, 0, 1].map((offset) => {
+        const d = new Date(since.getTime());
+        d.setDate(d.getDate() + offset);
+        const y = String(d.getFullYear());
+        const m = String(d.getMonth() + 1).padStart(2, "0");
+        const day = String(d.getDate()).padStart(2, "0");
+        return path.join(y, m, day);
+    });
+    return [...new Set(days)];
+}
+function parseFilenameTimestamp(stamp) {
+    // "2026-09-16T07-32-17" -> "2026-09-16T07:32:17" (local — no zone suffix,
+    // matching how `new Date()` already parses a zone-less ISO string: local).
+    const iso = stamp.replace(/T(\d{2})-(\d{2})-(\d{2})$/, "T$1:$2:$3");
+    const t = new Date(iso).getTime();
+    return Number.isNaN(t) ? 0 : t;
+}
+/**
+ * Best-effort, filename-first discovery of the thread id a fresh Codex
+ * launch produced. Returns `null` (not an error) when nothing matches yet.
+ */
+export async function discoverCodexThreadId(args, deps) {
+    const since = new Date(args.sinceIso);
+    if (Number.isNaN(since.getTime()))
+        return null;
+    const sinceMs = since.getTime() - 5_000; // small clock-skew grace
+    const wantCwd = normalizeCwd(args.cwd);
+    const root = codexSessionsRoot(deps);
+    const candidates = [];
+    for (const folder of dayFolders(since)) {
+        const dir = path.join(root, folder);
+        let names;
+        try {
+            names = await deps.readdir(dir);
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            const m = ROLLOUT_RE.exec(name);
+            if (!m)
+                continue;
+            const threadId = m[2];
+            if (args.excludeThreadIds?.has(threadId))
+                continue;
+            const ts = parseFilenameTimestamp(m[1]);
+            if (ts < sinceMs)
+                continue;
+            candidates.push({ ts, threadId, file: path.join(dir, name) });
+        }
+    }
+    candidates.sort((a, b) => a.ts - b.ts);
+    for (const candidate of candidates) {
+        let head;
+        try {
+            head = await deps.readHead(candidate.file, HEAD_BYTES);
+        }
+        catch {
+            continue;
+        }
+        const firstLine = head.split("\n", 1)[0];
+        let parsed;
+        try {
+            parsed = JSON.parse(firstLine);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed || typeof parsed !== "object")
+            continue;
+        if (parsed.type !== "session_meta")
+            continue;
+        const payload = parsed.payload;
+        if (!payload || typeof payload !== "object")
+            continue;
+        const id = payload.id;
+        const cwd = payload.cwd;
+        if (typeof id === "string" && typeof cwd === "string" && normalizeCwd(cwd) === wantCwd) {
+            return id;
+        }
+    }
+    return null;
+}
+export const defaultCodexThreadDiscoveryDeps = {
+    readdir: (dir) => fsPromises.readdir(dir),
+    readHead: async (filePath, maxBytes) => {
+        const fh = await fsPromises.open(filePath, "r");
+        try {
+            const buf = Buffer.alloc(maxBytes);
+            const { bytesRead } = await fh.read(buf, 0, maxBytes, 0);
+            return buf.toString("utf-8", 0, bytesRead);
+        }
+        finally {
+            await fh.close();
+        }
+    },
+    homeDir: () => os.homedir(),
+};
+//# sourceMappingURL=codex-thread-discovery.js.map

package/server/dist/core/codex-thread-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-thread-discovery.js","sourceRoot":"","sources":["../../src/core/codex-thread-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,MAAM,UAAU,GACd,sIAAsI,CAAC;AACzI;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,MAAM,UAAU,iBAAiB,CAAC,IAA+C;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,sGAAsG;AACtG,SAAS,UAAU,CAAC,KAAW;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAUD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA+B,EAC/B,IAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAyB;IAClE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,UAAU,GAAqD,EAAE,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACnD,MAAM,EAAE,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,EAAE,GAAG,OAAO;gBAAE,SAAS;YAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAEvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,IAAK,MAAkC,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QAC1E,MAAM,OAAO,GAAI,MAAkC,CAAC,OAAO,CAAC;QAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,EAAE,GAAI,OAAmC,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAI,OAAmC,CAAC,GAAG,CAAC;QACrD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YACvF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAA6B;IACvE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;IACzC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACzD,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC"}

package/server/dist/core/codextender-auth-file-sweep.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Default reclamation age (10 min) — deliberately much shorter than
+ * `snapshot-tmp-sweep.ts`'s 1h default: this file holds a LIVE credential,
+ * not just terminal cell-state, and a normal launch's own cleanup deletes it
+ * within seconds of the `claude` invocation exiting.
+ */
+export declare const DEFAULT_CODEXTENDER_AUTH_TMP_MAX_AGE_MS: number;
+export interface CodextenderAuthFileSweepDeps {
+    readdir: (dir: string) => Promise<string[]>;
+    stat: (p: string) => Promise<{
+        mtimeMs: number;
+    }>;
+    unlink: (p: string) => Promise<void>;
+}
+export interface CodextenderAuthFileSweepOpts {
+    dir: string;
+    /** Reclaim tmp files whose mtime is older than this. Default 10 min. */
+    maxAgeMs?: number;
+    deps?: Partial<CodextenderAuthFileSweepDeps>;
+    /** Injected for tests. Defaults to Date.now. */
+    now?: () => number;
+    logWarn?: (msg: string) => void;
+    logInfo?: (msg: string) => void;
+}
+export interface CodextenderAuthFileSweepResult {
+    /** stale credential files unlinked. */
+    deleted: number;
+    /** stat/unlink failures (kept going). */
+    errors: number;
+    /** files younger than the cutoff, left in place (still in use). */
+    preserved: number;
+}
+/**
+ * Age-gated sweep of orphaned `codextender-auth-*.tmp` credential files.
+ * Best-effort: dir-read failure and per-file failures are non-fatal (they
+ * log a warn and never throw) — the same posture `sweepOrphanSnapshotTmp`
+ * takes, for the same reason (a sweep failure must never crash boot or the
+ * periodic timer).
+ */
+export declare function sweepOrphanCodextenderAuthFiles(opts: CodextenderAuthFileSweepOpts): Promise<CodextenderAuthFileSweepResult>;
+//# sourceMappingURL=codextender-auth-file-sweep.d.ts.map

package/server/dist/core/codextender-auth-file-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-auth-file-sweep.d.ts","sourceRoot":"","sources":["../../src/core/codextender-auth-file-sweep.ts"],"names":[],"mappings":"AA8BA;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,QAAiB,CAAC;AAEtE,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC7C,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,8BAA8B,CAAC,CAoDzC"}

package/server/dist/core/codextender-auth-file-sweep.js

@@ -0,0 +1,97 @@
+/*
+ * codextender-auth-file-sweep.ts — bounded reclamation of orphaned
+ * `codextender-auth-*.tmp` credential files (PR-review round 10, iterate-
+ * 2026-09-23; Sven's own decision on the CI-BLOCKed design question).
+ *
+ * `writeCodextenderAuthTokenFile` (launcher-codextender.ts) writes the
+ * Codextender proxy's bearer token to a private `0o600` temp file once per
+ * launch; the generated command's cleanup suffix deletes it right after the
+ * `claude` invocation exits. If the command is never executed (copied out
+ * instead of auto-run), the pty is killed before the suffix runs, or launch
+ * fails before a command is ever returned to run, that delete step never
+ * fires and the file is stranded — the exact gap the required `PR Review`
+ * CI gate BLOCKed twice on. Mirrors `snapshot-tmp-sweep.ts`'s shape (same
+ * age-gated, best-effort, injectable-deps design) for the same reason: a
+ * live write's own cleanup runs within seconds, so anything older than the
+ * cutoff is provably orphaned — no active-task veto needed.
+ *
+ * Wired into the boot + periodic sweep in index.ts alongside the scrollback
+ * and snapshot-tmp sweeps. Unlike those two (scoped to the terminal
+ * scrollback dir), this one scans `os.tmpdir()` — where
+ * `writeCodextenderAuthTokenFile` actually writes — so `dir` is threaded
+ * through for testability rather than hardcoded.
+ */
+import * as fsAsync from "node:fs/promises";
+import * as path from "node:path";
+/** Matches `codextender-auth-<uuid>.tmp`. Bounded — ReDoS-safe. */
+const CODEXTENDER_AUTH_TMP_RE = /^codextender-auth-[0-9a-fA-F-]{36}\.tmp$/;
+/**
+ * Default reclamation age (10 min) — deliberately much shorter than
+ * `snapshot-tmp-sweep.ts`'s 1h default: this file holds a LIVE credential,
+ * not just terminal cell-state, and a normal launch's own cleanup deletes it
+ * within seconds of the `claude` invocation exiting.
+ */
+export const DEFAULT_CODEXTENDER_AUTH_TMP_MAX_AGE_MS = 10 * 60 * 1000;
+const defaultDeps = {
+    readdir: (dir) => fsAsync.readdir(dir),
+    stat: (p) => fsAsync.stat(p),
+    unlink: (p) => fsAsync.unlink(p),
+};
+/**
+ * Age-gated sweep of orphaned `codextender-auth-*.tmp` credential files.
+ * Best-effort: dir-read failure and per-file failures are non-fatal (they
+ * log a warn and never throw) — the same posture `sweepOrphanSnapshotTmp`
+ * takes, for the same reason (a sweep failure must never crash boot or the
+ * periodic timer).
+ */
+export async function sweepOrphanCodextenderAuthFiles(opts) {
+    const deps = { ...defaultDeps, ...opts.deps };
+    const now = opts.now ?? Date.now;
+    const logWarn = opts.logWarn ?? ((m) => console.warn(m));
+    const logInfo = opts.logInfo ?? ((m) => console.log(m));
+    const cutoff = now() - (opts.maxAgeMs ?? DEFAULT_CODEXTENDER_AUTH_TMP_MAX_AGE_MS);
+    const result = { deleted: 0, errors: 0, preserved: 0 };
+    let entries;
+    try {
+        entries = await deps.readdir(opts.dir);
+    }
+    catch (err) {
+        // ENOENT = dir not created yet (benign). Any other error (EACCES/EPERM/
+        // EIO) is a real operational failure that leaves credential files on
+        // disk — surface it so the gap stays visible; this function never throws.
+        if (err.code !== "ENOENT") {
+            logWarn(`[codextender-auth-sweep] readdir failed (${err.message}); orphan credential files may persist`);
+        }
+        return result;
+    }
+    for (const name of entries) {
+        if (!CODEXTENDER_AUTH_TMP_RE.test(name))
+            continue;
+        const full = path.join(opts.dir, name);
+        let mtimeMs;
+        try {
+            mtimeMs = (await deps.stat(full)).mtimeMs;
+        }
+        catch {
+            result.errors++;
+            continue;
+        }
+        if (mtimeMs >= cutoff) {
+            result.preserved++;
+            continue;
+        }
+        try {
+            await deps.unlink(full);
+            result.deleted++;
+        }
+        catch (err) {
+            result.errors++;
+            logWarn(`[codextender-auth-sweep] unlink failed for ${name}: ${err.message}`);
+        }
+    }
+    if (result.deleted > 0 || result.errors > 0) {
+        logInfo(`[codextender-auth-sweep] orphan sweep: deleted=${result.deleted} errors=${result.errors} preserved=${result.preserved}`);
+    }
+    return result;
+}
+//# sourceMappingURL=codextender-auth-file-sweep.js.map

package/server/dist/core/codextender-auth-file-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-auth-file-sweep.js","sourceRoot":"","sources":["../../src/core/codextender-auth-file-sweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,0CAA0C,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4BtE,MAAM,WAAW,GAAiC;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAAkC;IAElC,MAAM,IAAI,GAAiC,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,uCAAuC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAmC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAEvF,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CACL,4CAA6C,GAAa,CAAC,OAAO,wCAAwC,CAC3G,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,SAAS,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,8CAA8C,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CACL,kDAAkD,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,SAAS,EAAE,CACzH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/server/dist/core/codextender-proxy-probe.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `codextenderPort` is persisted/read as arbitrary JSON (PUT /api/settings
+ * accepts an unvalidated body; a hand-edited settings.json is untyped on
+ * disk too) before ever reaching here, so `port: number`'s compile-time
+ * type is not a runtime guarantee. Both probes below MUST reject anything
+ * outside a real TCP port before interpolating it into a URL — a value
+ * like `"4000@attacker.example"` would otherwise redirect the request via
+ * URL userinfo-authority confusion (PR-review BLOCK, iterate-2026-09-23
+ * fifth round). This is the enforcement point regardless of how an invalid
+ * value got in; `routes/settings.ts`'s PUT-time rejection (same finding)
+ * is defense-in-depth on top of it, not a substitute for it.
+ */
+export declare function isValidCodextenderPort(value: unknown): value is number;
+export interface CodextenderModelEntry {
+    slug: string;
+    display_name: string;
+    /** LiteLLM's declared context window for this alias (its `model_info.
+     *  max_input_tokens`), when the proxy's `/v1/models` response carries one.
+     *  Absent on an older/unpatched proxy — callers must treat that the same
+     *  as "unknown", never assume a number. */
+    max_input_tokens?: number;
+}
+export interface CodextenderProbeResult {
+    ok: boolean;
+    models: CodextenderModelEntry[];
+}
+export interface CodextenderProbeDeps {
+    /** Test seam — defaults to the real global `fetch`. */
+    fetchFn?: typeof fetch;
+    /** Probe timeout in ms. Default 1500 — short enough that a launch or a
+     *  datalist render never feels stuck on an unreachable proxy. */
+    timeoutMs?: number;
+    /** Test seam — defaults to `resolveCodextenderAuthToken()` (reads
+     *  `process.env.CODEXTENDER_AUTH_TOKEN`, no built-in fallback). */
+    authToken?: string;
+}
+/**
+ * `GET http://127.0.0.1:<port>/v1/models` with the configured Codextender
+ * master-key bearer token (`deps.authToken` or `resolveCodextenderAuthToken()`).
+ * Never throws — an unconfigured token, any network error, non-2xx status,
+ * timeout, or malformed body all resolve `{ok: false, models: []}` rather
+ * than rejecting, so callers never need a try/catch.
+ *
+ * LiteLLM's `/v1/models` response is OpenAI-shaped (`{"data": [{"id":
+ * "sol"}, ...]}`) — it carries no separate display name, so `display_name`
+ * is set to the same slug (matches `codex-models-probe.ts`'s
+ * `CodexModelCatalogEntry` shape for the client's shared consumer).
+ */
+export declare function probeCodextenderModels(port: number, deps?: CodextenderProbeDeps): Promise<CodextenderProbeResult>;
+/**
+ * Resolves the REAL context window for the Codextender alias a task is
+ * about to launch with, straight from the proxy's own `/v1/models` response
+ * (operator finding, 2026-09-26, live Codextender iterate test) — never a
+ * number hardcoded here a second time. Claude Code assumes a 200K context
+ * window for any model id it doesn't recognize (the Codex alias is one) and
+ * proactively over-compacts against that wrong, much-too-small ceiling; the
+ * fix is `launcher-codextender.ts` setting `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * from THIS value, so a change to codextender's own declared window (its
+ * `config.py` `model_info.max_input_tokens`) can never drift out of sync
+ * with what webui tells Claude Code — both repos read the same live number.
+ *
+ * Never throws, same contract as `probeCodextenderModels` — resolves
+ * `undefined` (not a guessed fallback) when the probe fails, the alias
+ * isn't in the response, or the response carries no usable
+ * `max_input_tokens` for it (an older/unpatched proxy). The caller's
+ * contract for `undefined` is "leave `CLAUDE_CODE_MAX_CONTEXT_TOKENS`
+ * unset", which is the conservative, safe default — Claude Code's own 200K
+ * fallback — rather than risking an inflated ceiling that starves
+ * compaction entirely.
+ */
+export declare function resolveCodextenderMaxContextTokens(port: number, model: string | undefined, deps?: CodextenderProbeDeps): Promise<number | undefined>;
+/**
+ * `GET http://127.0.0.1:<port>/health/liveliness` — no auth header
+ * required (confirmed live against a real local LiteLLM proxy). This is
+ * the AC8 pre-flight probe: it only needs to know the proxy process is up
+ * and answering, not what it serves. Never throws — same
+ * never-reject contract as `probeCodextenderModels`.
+ */
+export declare function probeCodextenderLiveness(port: number, deps?: CodextenderProbeDeps): Promise<boolean>;
+//# sourceMappingURL=codextender-proxy-probe.d.ts.map

package/server/dist/core/codextender-proxy-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codextender-proxy-probe.d.ts","sourceRoot":"","sources":["../../src/core/codextender-proxy-probe.ts"],"names":[],"mappings":"AAmCA;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAOtE;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB;;;+CAG2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,qBAAqB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;qEACiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;uEACmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsBD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAmCjC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM7B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAgBlB"}