@svenroth-ai/shipwright 0.27.0 → 0.29.0

package/server/dist/core/custom-profile-loader.js

@@ -0,0 +1,225 @@
+/*
+ * custom-profile-loader.ts — turns a stack-profile NAME into a runnable
+ * Preview profile, including the user's OWN profiles (project / user source)
+ * that the bundled-snapshot loader (`profile-loader.ts`) cannot see.
+ *
+ * The shipwright resolver is the authority on WHICH file a name means and
+ * whether it is valid (`validateStackProfile`, same bridge as Settings) — the
+ * lookup order is never re-implemented here. A custom profile file is
+ * UNTRUSTED input (a cloned repo can ship `.shipwright/profiles/x.json`), so:
+ *   - it must lie inside `<project>/.shipwright/profiles` or
+ *     `~/.shipwright/profiles` after realpath (path.relative, not startsWith);
+ *   - it is read ONCE and only an allowlist of fields is copied (no env / cwd);
+ *   - a PROJECT-source command must be a bare runner name from an allowlist
+ *     (no path, no inline-eval flag) — a repo-relative binary never runs;
+ *   - spawn stays `shell:false` through `preview-session-manager` only.
+ * Bundled profiles keep their sync loader; when the resolver is unavailable
+ * they fall back to it, so Preview for bundled stacks never regresses.
+ */
+import { closeSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { contained, projectCommandRefusal, userCommandRefusal } from "./custom-profile-command-policy.js";
+import { isProfileNameShape, validateStackProfile } from "./stack-profiles.js";
+import { userProfilesDir } from "./stack-profiles-create.js";
+export { projectCommandRefusal, userCommandRefusal };
+export const POSITIVE_TTL_MS = 15_000;
+export const NEGATIVE_TTL_MS = 30_000;
+const MAX_WAITING = 8;
+const BUSY = "profile resolver busy";
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Copy ONLY the fields Preview uses; refuse anything malformed. */
+function allowlisted(raw) {
+    if (!isObject(raw))
+        return null;
+    const dev = raw.dev_server;
+    if (!isObject(dev) || typeof dev.command !== "string" || !dev.command.trim())
+        return null;
+    const port = dev.port;
+    if (typeof port !== "number" || !Number.isInteger(port) || port < 1024 || port > 65535)
+        return null;
+    const out = { command: dev.command, port };
+    if (typeof dev.ready_path === "string" && dev.ready_path.startsWith("/"))
+        out.ready_path = dev.ready_path;
+    if (dev.host === "127.0.0.1" || dev.host === "localhost")
+        out.host = dev.host;
+    const t = dev.ready_timeout_seconds;
+    if (typeof t === "number" && Number.isInteger(t) && t >= 1 && t <= 600)
+        out.ready_timeout_seconds = t;
+    const frontend = isObject(raw.stack) ? raw.stack.frontend : undefined;
+    return { dev_server: out, stack: { frontend: frontend ?? undefined } };
+}
+export function createPreviewProfileResolver(deps) {
+    const validate = deps.validate ?? validateStackProfile;
+    const now = deps.now ?? (() => Date.now());
+    const home = deps.homeDir ?? os.homedir();
+    const cache = new Map();
+    const inFlight = new Map();
+    const max = deps.maxConcurrent ?? 2;
+    let running = 0;
+    const waiters = [];
+    async function slot(fn) {
+        // Hand the slot straight to the next waiter (no decrement), so a newcomer can never
+        // slip in between the release and the wake-up and exceed the cap.
+        // A stuck resolver must not queue the hot actions endpoint without bound: past a
+        // short queue the lookup degrades (no Preview for now) instead of waiting.
+        if (running >= max && waiters.length >= MAX_WAITING)
+            throw new Error(BUSY);
+        if (running >= max)
+            await new Promise((r) => waiters.push(r));
+        else
+            running++;
+        try {
+            return await fn();
+        }
+        finally {
+            const next = waiters.shift();
+            if (next)
+                next();
+            else
+                running--;
+        }
+    }
+    function readCustom(source, file, projectPath) {
+        const base = source === "project" ? path.join(projectPath, ".shipwright", "profiles") : userProfilesDir({ homeDir: home });
+        let realBase;
+        let real;
+        try {
+            // the folder itself must not be a symlink out of the project / home
+            if (lstatSync(base).isSymbolicLink())
+                return { profile: null, reason: "profiles folder is a symlink" };
+            realBase = realpathSync(base);
+            // an ancestor symlink (e.g. `.shipwright` -> elsewhere) must not relocate the folder
+            const anchor = source === "project" ? projectPath : home;
+            if (!contained(realpathSync(anchor), realBase)) {
+                return { profile: null, reason: "profiles folder resolves outside its allowed location" };
+            }
+            real = realpathSync(file);
+        }
+        catch {
+            return { profile: null, reason: "profile file unreadable" };
+        }
+        if (!contained(realBase, real))
+            return { profile: null, reason: "profile file is outside the profiles folder" };
+        let raw;
+        try {
+            // one descriptor for the type check AND the read - no check-then-act window
+            const fd = openSync(real, "r");
+            try {
+                if (!fstatSync(fd).isFile())
+                    return { profile: null, reason: "profile is not a regular file" };
+                raw = JSON.parse(readFileSync(fd, "utf-8"));
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch {
+            return { profile: null, reason: "profile file is not readable JSON" };
+        }
+        const profile = allowlisted(raw);
+        if (!profile)
+            return { profile: null, reason: "profile has no usable dev_server" };
+        const command = profile.dev_server?.command ?? "";
+        const refusal = source === "project" ? projectCommandRefusal(command) : userCommandRefusal(command, projectPath);
+        if (refusal)
+            return { profile: null, reason: refusal };
+        return { profile };
+    }
+    async function lookup(name, projectPath) {
+        const bundled = () => ({ profile: deps.bundled(name) });
+        if (!isProfileNameShape(name))
+            return { value: bundled(), ttl: POSITIVE_TTL_MS };
+        // (The resolver keys a profile on its FILE NAME - a file whose "name" differs is
+        // invalid - so probing `<name>.json` is exactly its lookup, not a second opinion.)
+        // Fast path: with no `<name>.json` in either custom folder nothing can shadow the
+        // bundled profile, so a resolver process (uv start-up, on a hot endpoint) is
+        // pointless - skip it. This only decides WHETHER to ask the resolver; which file a
+        // name means is still always the resolver's answer.
+        const candidates = [path.join(userProfilesDir({ homeDir: home }), `${name}.json`)];
+        if (projectPath)
+            candidates.push(path.join(projectPath, ".shipwright", "profiles", `${name}.json`));
+        if (!candidates.some((c) => existsSync(c)))
+            return { value: bundled(), ttl: POSITIVE_TTL_MS };
+        const out = await slot(() => validate({ name, projectRoot: projectPath || undefined }, deps.stack));
+        // Resolver unavailable / newer contract / crash => behave exactly as before.
+        if (out.status !== "ok")
+            return { value: bundled(), ttl: NEGATIVE_TTL_MS };
+        const report = out.report;
+        if (!report.valid)
+            return { value: { profile: null, reason: "the resolver reports this profile as invalid" }, ttl: NEGATIVE_TTL_MS };
+        if (!("source" in report) || typeof report.path !== "string")
+            return { value: { profile: null, reason: "unexpected resolver answer" }, ttl: NEGATIVE_TTL_MS };
+        if (report.source === "bundled")
+            return { value: bundled(), ttl: POSITIVE_TTL_MS };
+        if (report.source !== "project" && report.source !== "user")
+            return { value: { profile: null, reason: `unsupported profile source “${report.source}”` }, ttl: NEGATIVE_TTL_MS };
+        if (report.source === "project" && !projectPath)
+            return { value: { profile: null, reason: "no project path" }, ttl: NEGATIVE_TTL_MS };
+        const value = readCustom(report.source, report.path, projectPath);
+        return { value, file: report.path, ttl: value.profile ? POSITIVE_TTL_MS : NEGATIVE_TTL_MS };
+    }
+    function stillFresh(entry) {
+        if (now() - entry.at > entry.ttl)
+            return false;
+        if (!entry.file)
+            return true;
+        try {
+            return lstatSync(entry.file).mtimeMs === entry.mtimeMs;
+        }
+        catch {
+            return false; // deleted => re-resolve
+        }
+    }
+    return {
+        /** `fresh` bypasses the cache (spawn re-resolves right before it runs). Never throws. */
+        async resolve(name, projectPath, opts = {}) {
+            const key = `${projectPath}\0${name}`;
+            const hit = cache.get(key);
+            if (!opts.fresh && hit && stillFresh(hit))
+                return hit.value;
+            const started = now();
+            const pending = inFlight.get(key);
+            if (!opts.fresh && pending)
+                return pending;
+            let p;
+            p = (async () => {
+                try {
+                    const r = await lookup(name, projectPath);
+                    let mtimeMs;
+                    if (r.file) {
+                        try {
+                            mtimeMs = lstatSync(r.file).mtimeMs;
+                        }
+                        catch {
+                            mtimeMs = undefined;
+                        }
+                    }
+                    const newer = cache.get(key);
+                    if (!newer || newer.at <= started)
+                        cache.set(key, { at: now(), ttl: r.ttl, file: r.file, mtimeMs, value: r.value });
+                    return r.value;
+                }
+                catch (err) {
+                    const value = { profile: null, reason: err instanceof Error ? err.message.slice(0, 200) : "lookup failed" };
+                    // an overloaded resolver is transient - do not hide Preview for a whole TTL
+                    if (!(err instanceof Error && err.message === BUSY))
+                        cache.set(key, { at: now(), ttl: NEGATIVE_TTL_MS, value });
+                    return value;
+                }
+                finally {
+                    if (inFlight.get(key) === p)
+                        inFlight.delete(key);
+                }
+            })();
+            inFlight.set(key, p);
+            return p;
+        },
+        clear() {
+            cache.clear();
+        },
+    };
+}
+//# sourceMappingURL=custom-profile-loader.js.map

package/server/dist/core/custom-profile-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-profile-loader.js","sourceRoot":"","sources":["../../src/core/custom-profile-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5G,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE1G,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAyB,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;AAqBrD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,IAAI,GAAG,uBAAuB,CAAC;AAErC,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,GAAG,GAAsD,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAC1G,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;QAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAC9E,MAAM,CAAC,GAAG,GAAG,CAAC,qBAAqB,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG;QAAE,GAAG,CAAC,qBAAqB,GAAG,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,oBAAoB,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqG,CAAC;IAC3H,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,UAAU,IAAI,CAAI,EAAoB;QACzC,oFAAoF;QACpF,kEAAkE;QAClE,iFAAiF;QACjF,2EAA2E;QAC3E,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,OAAO,IAAI,GAAG;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC/D,OAAO,EAAE,CAAC;QACf,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI;gBAAE,IAAI,EAAE,CAAC;;gBACZ,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,MAA0B,EAAE,IAAY,EAAE,WAAmB;QAC/E,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3H,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,oEAAoE;YACpE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;YACvG,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC9B,qFAAqF;YACrF,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;YAC5F,CAAC;YACD,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;QAChH,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,4EAA4E;YAC5E,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;gBAC/F,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACnF,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACjH,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,WAAmB;QACrD,MAAM,OAAO,GAAG,GAAyB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACjF,iFAAiF;QACjF,mFAAmF;QACnF,kFAAkF;QAClF,6EAA6E;QAC7E,mFAAmF;QACnF,oDAAoD;QACpD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;QACnF,IAAI,WAAW;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;QACpG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAAI,SAAS,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpG,6EAA6E;QAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,8CAA8C,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACrI,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAC9J,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACnF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAChL,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACtI,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IAC9F,CAAC;IAED,SAAS,UAAU,CAAC,KAAmE;QACrF,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wBAAwB;QACxC,CAAC;IACH,CAAC;IAED,OAAO;QACL,yFAAyF;QACzF,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,WAAmB,EAAE,OAA4B,EAAE;YAC7E,MAAM,GAAG,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC;YAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC3C,IAAI,CAAiC,CAAC;YACtC,CAAC,GAAG,CAAC,KAAK,IAAmC,EAAE;gBAC7C,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oBAC1C,IAAI,OAA2B,CAAC;oBAChC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACX,IAAI,CAAC;4BACH,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;wBACtC,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO,GAAG,SAAS,CAAC;wBACtB,CAAC;oBACH,CAAC;oBACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,IAAI,OAAO;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;oBACpH,OAAO,CAAC,CAAC,KAAK,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;oBAC5G,4EAA4E;oBAC5E,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChH,OAAO,KAAK,CAAC;gBACf,CAAC;wBAAS,CAAC;oBACT,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;wBAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/server/dist/core/launcher-codex.d.ts

@@ -0,0 +1,61 @@
+import { type CopyCommandForms } from "./launcher.js";
+export interface CodexLaunchArgs {
+    cwd: string;
+    /** Defaults to "guided" when omitted (matches AutonomyToggle's own default). */
+    autonomy?: "guided" | "autonomous";
+    /** true → emit `codex resume <threadId>` instead of a fresh launch. */
+    resume?: boolean;
+    /** Required when `resume` is true — persisted at launch (§4). */
+    threadId?: string;
+    phase?: string;
+    description?: string;
+    /**
+     * §2.3 — whether the project's `AGENTS.md` already carries the Codex
+     * operating contract. When true AND `phase === "iterate"`, the prompt
+     * omits the SKILL.md pointer and the inlined model-pin/review-cascade
+     * text (AGENTS.md already covers both for that phase). Computed by the
+     * caller (a plain `existsSync` check) — this module stays pure.
+     */
+    hasAgentsMd?: boolean;
+    /**
+     * iterate-2026-09-17-codex-model-tier-parameterization — session-scoped
+     * override for Codex's own top-level model (one of the confirmed catalog
+     * slugs, validated by the caller). Emitted as a real `-c model=` CLI
+     * flag, never prose — it is layered on top of `~/.codex/config.toml` and
+     * any project config *before* Codex reads `AGENTS.md`, so it applies
+     * unconditionally on `hasAgentsMd` and doesn't depend on Codex's own
+     * instruction-following. Undefined → no flag, no behavior change.
+     */
+    implementationModel?: string;
+    /**
+     * iterate-2026-09-19-codex-reviewer-fields (shipwright#772) — session-
+     * scoped overrides for Codex's own review subagents. Unlike
+     * `implementationModel` these are NOT `-c` flags read by the top-level
+     * `codex` process itself; `run_codex_review` (invoked by Codex's shell
+     * tool mid-session) resolves `SHIPWRIGHT_CODEX_PLAN_REVIEW_MODEL` /
+     * `SHIPWRIGHT_CODEX_REVIEW_MODEL` from its OWN process env ahead of the
+     * project's `shipwright_model_config.json` fallback — so they're emitted
+     * here as an env-var prefix on the command line, ahead of `codex`, and
+     * reach that subprocess via `shell_environment_policy.inherit=all`
+     * (already unconditional above). Undefined → no prefix, no behavior
+     * change, same as `implementationModel`.
+     */
+    planReviewModel?: string;
+    reviewModel?: string;
+}
+export declare function buildCodexCommands(args: CodexLaunchArgs): CopyCommandForms;
+/**
+ * §2.3 — Codex's per-phase standing instructions live in prompt text this
+ * function composes, not a template file. For a project with no
+ * `AGENTS.md` (or a phase it doesn't cover), inline the model pins and
+ * review-cascade authorization directly rather than generating a file into
+ * someone else's repo. §5.4 — every prompt ends with an instruction to
+ * close with a structured `SHIPWRIGHT-STATUS` self-report, cross-checked
+ * against the oracle verdict by `CodexTaskWatcher`.
+ */
+export declare function buildCodexPrompt(args: {
+    phase?: string;
+    description?: string;
+    hasAgentsMd?: boolean;
+}): string;
+//# sourceMappingURL=launcher-codex.d.ts.map

package/server/dist/core/launcher-codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher-codex.d.ts","sourceRoot":"","sources":["../../src/core/launcher-codex.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,QAAQ,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACnC,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAM1E;AAwID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAgCT"}

package/server/dist/core/launcher-codex.js

@@ -0,0 +1,187 @@
+/*
+ * Codex CLI launch-command builder (Spec/codex-light-webui.md §2.1-§2.3).
+ *
+ * Sibling of `buildCopyCommands` (launcher.ts) — same three-shell
+ * `CopyCommandForms` output, same "webui never spawns a process, only
+ * builds a string" contract (CLAUDE.md rule 1 / rule 19). The launch
+ * chokepoint in `external/launch/routes.ts` calls this instead of
+ * `buildCopyCommands` whenever `runtimeForTask(task) === "codex"`.
+ *
+ * v1 launches Codex as a plain, live, interactive TUI in a pty (the same
+ * mechanism Claude uses today) — never the app-server protocol (§0/§2.2).
+ *
+ * Resume carries the same autonomy/env-inherit flags as a fresh launch
+ * (external-code-review finding, 2026-09-16): `codex resume --help`
+ * accepts `-c`/`--enable`/`--yolo` identically to the top-level command
+ * (verified live against the installed CLI) — §2.2's terse "Resume: `codex
+ * resume <threadId>`" example is abbreviated prose, not a CLI constraint,
+ * and §2.4's mitigation 1 plus AC4 both require it on every launch.
+ */
+import { qPs, qPsMultiline, qCmd, qPosix, toPosixPath } from "./shell-quote.js";
+import { buildCdPrefix } from "./launcher.js";
+export function buildCodexCommands(args) {
+    return {
+        powershell: renderCodex(args, qPs, "powershell"),
+        cmd: renderCodex(args, qCmd, "cmd"),
+        posix: renderCodex(args, qPosix, "posix"),
+    };
+}
+function renderCodex(args, q, shellForm) {
+    const cwd = shellForm === "posix" ? toPosixPath(args.cwd) : args.cwd;
+    const cdPrefix = buildCdPrefix(shellForm, args.cwd);
+    const envPrefix = buildReviewEnvPrefix(args, q, shellForm);
+    const autonomy = args.autonomy ?? "guided";
+    if (args.resume) {
+        if (!args.threadId) {
+            throw new Error("resume=true requires threadId");
+        }
+        // External-code-review finding (GLM MEDIUM, 2026-09-16): `codex resume
+        // --help` accepts the same `-c`/`--enable`/`--yolo` flags as a fresh
+        // launch (verified live against the installed CLI) — §2.2's literal
+        // "Resume: `codex resume <threadId>`" example is abbreviated prose, not
+        // a CLI constraint. Without these, a resumed Guided/Autonomous task
+        // silently lost both session-identity tracking (§2.4 mitigation 1) and
+        // AC4's "autonomy governs Codex on every launch" for the resume path.
+        const parts = ["codex", "resume"];
+        if (autonomy === "guided") {
+            parts.push("--enable", "default_mode_request_user_input");
+        }
+        parts.push("-c", q("shell_environment_policy.inherit=all"));
+        parts.push(...buildTuiAnimationFlags(q));
+        if (autonomy === "autonomous") {
+            parts.push("--yolo");
+        }
+        else {
+            parts.push("-c", q("approval_policy=on-request"));
+            parts.push("-c", q("approvals.reviewer=user"));
+        }
+        if (args.implementationModel) {
+            parts.push("-c", q(`model="${args.implementationModel}"`));
+        }
+        parts.push(q(args.threadId));
+        const cmd = parts.join(" ");
+        return cdPrefix + envPrefix + (shellForm === "powershell" ? "& " + cmd : cmd);
+    }
+    const parts = ["codex"];
+    // §3 mapping — "questions" row: only Guided gets the non-terminal
+    // clarifying-question mechanism (confirmed live, §3's confirmation test).
+    if (autonomy === "guided") {
+        parts.push("--enable", "default_mode_request_user_input");
+    }
+    // §2.4 — required so `SHIPWRIGHT_SESSION_ID` survives Codex's own shell
+    // tool's environment filter (default: a `core` subset, not `all`).
+    parts.push("-c", q("shell_environment_policy.inherit=all"));
+    parts.push(...buildTuiAnimationFlags(q));
+    // §3 mapping — "approvals" row.
+    if (autonomy === "autonomous") {
+        parts.push("--yolo");
+    }
+    else {
+        parts.push("-c", q("approval_policy=on-request"));
+        parts.push("-c", q("approvals.reviewer=user"));
+    }
+    if (args.implementationModel) {
+        parts.push("-c", q(`model="${args.implementationModel}"`));
+    }
+    // Codex prompts are always multi-paragraph (model pins / SKILL.md pointer
+    // / description / SHIPWRIGHT-STATUS footer, blank-line-separated) — the
+    // PowerShell form needs the PSReadLine-multi-line-corruption-safe quoter
+    // (see qPsMultiline's doc comment); cmd/posix are unaffected, so they keep
+    // the plain per-shell quoter.
+    const promptText = buildCodexPrompt(args);
+    parts.push(shellForm === "powershell" ? qPsMultiline(promptText) : q(promptText));
+    const cmd = parts.join(" ");
+    void cwd; // cwd is already folded into cdPrefix; kept for symmetry with launcher.ts's per-shell renderers.
+    return cdPrefix + envPrefix + (shellForm === "powershell" ? "& " + cmd : cmd);
+}
+/**
+ * iterate-2026-09-19-codex-terminal-flicker (CLAUDE.md DO-NOT #32) —
+ * Codex's own TUI (not this webui) redraws its fixed-position input box
+ * every time transcript content changes above it, and does so OUTSIDE
+ * DECSET 2026 (Synchronized Output) — confirmed against a raw pty capture,
+ * independent of the webui entirely. During normal "thinking" turns this
+ * repeats roughly every 100ms via a terminal-title spinner plus periodic
+ * status-widget redraws (upstream: openai/codex#39268, #37706), so any
+ * terminal relaying Codex's raw output shows visible flicker.
+ * `-c tui.animations=false` (upstream config key; see openai/codex#45564,
+ * #46111) suppresses the decorative animation/spinner path entirely,
+ * eliminating the RECURRING flicker during a turn (verified empirically —
+ * zero title-spinner or status-redraw chunks with the flag set, vs. one
+ * every ~108ms without it). It does NOT touch the one-time startup box
+ * reflow (~9 redraws over ~0.2–2s as Codex resolves model/MCP state on
+ * launch) — that part is a separate, currently-unfixed upstream mechanism.
+ * Known trade-off (openai/codex#45564, upstream bug): the elapsed
+ * "Working Xs" counter freezes with animations off until the terminal is
+ * hidden/shown again — a frozen decorative counter is preferable to
+ * continuous flicker. Reversible via `SHIPWRIGHT_CODEX_TUI_ANIMATIONS=0`
+ * (mirrors `SHIPWRIGHT_TERMINAL_NO_FLICKER`'s opt-out contract in
+ * `terminal/spawn-env.ts`) for anyone who wants the elapsed timer back
+ * more than they want the flicker gone.
+ */
+function buildTuiAnimationFlags(q) {
+    if (process.env.SHIPWRIGHT_CODEX_TUI_ANIMATIONS === "0")
+        return [];
+    return ["-c", q("tui.animations=false")];
+}
+/**
+ * iterate-2026-09-19-codex-reviewer-fields — see `planReviewModel`/
+ * `reviewModel`'s doc comment on `CodexLaunchArgs` for why these are an
+ * env-var prefix rather than a `-c` flag. Empty when neither override is
+ * set, so an ordinary launch's command string is byte-identical to before
+ * this feature existed.
+ */
+function buildReviewEnvPrefix(args, q, shellForm) {
+    const entries = [];
+    if (args.planReviewModel) {
+        entries.push(["SHIPWRIGHT_CODEX_PLAN_REVIEW_MODEL", args.planReviewModel]);
+    }
+    if (args.reviewModel) {
+        entries.push(["SHIPWRIGHT_CODEX_REVIEW_MODEL", args.reviewModel]);
+    }
+    if (entries.length === 0)
+        return "";
+    if (shellForm === "powershell") {
+        return entries.map(([name, value]) => `$env:${name} = ${q(value)}; `).join("");
+    }
+    if (shellForm === "cmd") {
+        return entries.map(([name, value]) => `set ${q(`${name}=${value}`)} && `).join("");
+    }
+    return entries.map(([name, value]) => `${name}=${q(value)} `).join("");
+}
+/**
+ * §2.3 — Codex's per-phase standing instructions live in prompt text this
+ * function composes, not a template file. For a project with no
+ * `AGENTS.md` (or a phase it doesn't cover), inline the model pins and
+ * review-cascade authorization directly rather than generating a file into
+ * someone else's repo. §5.4 — every prompt ends with an instruction to
+ * close with a structured `SHIPWRIGHT-STATUS` self-report, cross-checked
+ * against the oracle verdict by `CodexTaskWatcher`.
+ */
+export function buildCodexPrompt(args) {
+    const { phase, hasAgentsMd } = args;
+    const agentsMdCoversPhase = Boolean(hasAgentsMd) && phase === "iterate";
+    const lines = [];
+    if (!hasAgentsMd) {
+        lines.push("Use gpt-5.6-terra with high reasoning for ordinary implementation and " +
+            "finalization, and gpt-5.6-sol with high reasoning for required review " +
+            "subagents.", "The review cascade (spec-reviewer, code-reviewer, doubt-reviewer) is " +
+            "requested by default for this session — spawn it without asking.");
+    }
+    if (phase && !agentsMdCoversPhase) {
+        // iterate-2026-09-19-codex-launch-phase-empty: the monorepo/plugin-cache
+        // layout is `plugins/shipwright-<phase>/skills/<phase>/SKILL.md` — the
+        // bare `shipwright-<phase>/...` form is not a resolvable path from a
+        // project root or a Codex plugin cache.
+        lines.push(`Read plugins/shipwright-${phase}/skills/${phase}/SKILL.md and execute it.`);
+    }
+    const description = args.description?.trim();
+    if (description) {
+        lines.push(description);
+    }
+    lines.push("When you finish this session's work, close your final message with a " +
+        'fenced block: ```SHIPWRIGHT-STATUS\n{"phase":"' +
+        (phase ?? "") +
+        '","done":true}\n``` (done:false if you could not complete it).');
+    return lines.join("\n\n");
+}
+//# sourceMappingURL=launcher-codex.js.map

package/server/dist/core/launcher-codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher-codex.js","sourceRoot":"","sources":["../../src/core/launcher-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAyB,MAAM,eAAe,CAAC;AA+CrE,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,OAAO;QACL,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC;QAChD,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;QACnC,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAqB,EACrB,CAAwB,EACxB,SAAyC;IAEzC,MAAM,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IACrE,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAE3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,KAAK,GAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,QAAQ,GAAG,SAAS,GAAG,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,OAAO,CAAC,CAAC;IAClC,kEAAkE;IAClE,0EAA0E;IAC1E,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IAC5D,CAAC;IACD,wEAAwE;IACxE,mEAAmE;IACnE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,gCAAgC;IAChC,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,GAAG,CAAC,CAAC,iGAAiG;IAC3G,OAAO,QAAQ,GAAG,SAAS,GAAG,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,sBAAsB,CAAC,CAAwB;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACnE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,IAAqB,EACrB,CAAwB,EACxB,SAAyC;IAEzC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,oCAAoC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,+BAA+B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAIhC;IACC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACpC,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CACR,wEAAwE;YACtE,wEAAwE;YACxE,YAAY,EACd,uEAAuE;YACrE,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClC,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,wCAAwC;QACxC,KAAK,CAAC,IAAI,CAAC,2BAA2B,KAAK,WAAW,KAAK,2BAA2B,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CACR,uEAAuE;QACrE,gDAAgD;QAChD,CAAC,KAAK,IAAI,EAAE,CAAC;QACb,gEAAgE,CACnE,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/server/dist/core/launcher-codextender-env.d.ts

@@ -0,0 +1,44 @@
+import { type CodextenderLaunchArgs } from "./launcher-codextender.js";
+export declare function writeCodextenderAuthTokenFile(token: string): string;
+/**
+ * Doubt-review/plan-review HIGH — PowerShell (`$env:X = ...;`) and cmd
+ * (`set X=Y &&`) mutate the CURRENT, persistent shell's environment (unlike
+ * the posix prefix form, which scopes to the one invocation it precedes).
+ * The embedded terminal is a long-lived pty shell, not spawned fresh per
+ * command, so without this suffix the proxy's `ANTHROPIC_BASE_URL` /
+ * `ANTHROPIC_AUTH_TOKEN` / `ANTHROPIC_MODEL` would silently outlive this one
+ * `claude` invocation and get inherited by whatever the user (or a later
+ * Relaunch-as-Claude/Codex-Light) types next in the same tab. Runs
+ * unconditionally after `rest` (cmd's `&`, PowerShell's/posix's `;` — none
+ * gated on `rest`'s own exit code, so cleanup still happens if `claude`
+ * exits non-zero). The temp token file is deleted here too, on all three
+ * shells — posix's env-scoping was already correct, but it still wrote the
+ * file to disk and must still remove it.
+ */
+export declare function buildCodextenderEnvCleanupSuffix(shellForm: "powershell" | "cmd" | "posix", q: (v: string) => string, tokenFilePath: string): string;
+/**
+ * Same three per-shell quoting forms `launcher-codex.ts`'s own
+ * `buildReviewEnvPrefix` uses (PowerShell `$env:X = ...;`, cmd
+ * `set X=Y &&`, posix `X=Y `) — reused as a pattern, not imported (that
+ * function is private to `launcher-codex.ts` and this module has no
+ * dependency on Codex-CLI concerns). `ANTHROPIC_AUTH_TOKEN` is the one
+ * exception to the uniform `name=value` shape — see
+ * `writeCodextenderAuthTokenFile`'s doc comment for why it's read back from
+ * `tokenFilePath` instead of written as a literal.
+ *
+ * `CLAUDE_CODE_MAX_CONTEXT_TOKENS` (operator finding, 2026-09-26) is NOT
+ * folded into the uniform `plainEntries` loop below — PR-review preflight
+ * BLOCK (round 13): when `maxContextTokens` is undefined we must actively
+ * UNSET the var, not merely omit assigning it, so an inherited value (from
+ * an earlier launch in this same long-lived pty, or from whatever spawned
+ * the webui server itself) can't silently reach `claude` and defeat the
+ * documented "unset = Claude Code's safe 200K default" fallback. Each shell
+ * has its own real unset idiom — PowerShell's is `$env:X = $null` (an empty
+ * string only blanks it, doesn't remove it), cmd's is `set "X="` — except
+ * posix, whose `NAME=value` prefix form only scopes an ASSIGNMENT to the one
+ * invocation it precedes and so can't drop an inherited export; see the
+ * posix branch below for why `unset` (as its own leading statement), not
+ * `env -u`, is what that branch uses instead.
+ */
+export declare function buildCodextenderEnvPrefix(args: CodextenderLaunchArgs, q: (v: string) => string, shellForm: "powershell" | "cmd" | "posix", tokenFilePath: string): string;
+//# sourceMappingURL=launcher-codextender-env.d.ts.map

package/server/dist/core/launcher-codextender-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher-codextender-env.d.ts","sourceRoot":"","sources":["../../src/core/launcher-codextender-env.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmC,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AA+BxG,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAenE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,YAAY,GAAG,KAAK,GAAG,OAAO,EACzC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EACxB,aAAa,EAAE,MAAM,GACpB,MAAM,CA4BR;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,qBAAqB,EAC3B,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EACxB,SAAS,EAAE,YAAY,GAAG,KAAK,GAAG,OAAO,EACzC,aAAa,EAAE,MAAM,GACpB,MAAM,CAiGR"}