@svenroth-ai/shipwright 0.27.0 → 0.29.0

package/server/dist/external/launch/claim-executor-template-arming.d.ts

@@ -0,0 +1,42 @@
+import { type CopyCommandForms } from "../../core/launcher.js";
+import type { ClaimExecutorLaunchOverrides } from "./claim-executor-permissions.js";
+export type ArmTemplateResult = {
+    ok: true;
+    commands: CopyCommandForms;
+} | {
+    ok: false;
+    detail: string;
+};
+/**
+ * True only when the RAW `command_template` (before any substitution)
+ * literally declares the `--session-id {task.uuid}` placeholder. This is
+ * the attacker-uncontrollable precondition for arming: `command_template`
+ * comes from project configuration (bundled defaults or a project's own
+ * `.shipwright-webui/actions.json`), never from the launch request body, so
+ * a caller cannot forge this check the way they could forge a coincidental
+ * match in the RENDERED output (see module header).
+ */
+export declare function templateDeclaresSessionIdAnchor(commandTemplate: string): boolean;
+/**
+ * Inserts `--tools <allow-list> --permission-mode <mode>` immediately after
+ * the substituted `--session-id <this task's sessionUuid>` token, on all
+ * three shell forms. The anchor is the task's own UUID rendered UNQUOTED —
+ * verified live (`actions-substitute.ts`'s `{task.uuid}` case returns the
+ * raw value, and its per-shell `q()` wrapping is applied only to
+ * user-derived placeholders, not this one; a debug probe against the real
+ * substitution engine confirmed `--session-id 11111111-...` with no quotes
+ * on posix, cmd AND powershell). The flags THEMSELVES still go through the
+ * matching shell's own quoter (`FLAG_QUOTERS`) — only the anchor is
+ * unquoted, matching the substitution engine's own convention for a
+ * server-generated UUID. The flags are inserted at the anchor's FIRST
+ * occurrence only when that occurrence is provably unique in the rendered
+ * string (checked via `indexOf` === `lastIndexOf`) — a custom project
+ * `command_template` can interpolate other placeholders (e.g.
+ * `{task.description}`) ahead of `{task.uuid}`, and a caller-supplied value
+ * that happens to contain this task's own UUID would otherwise let the
+ * flags land inside unrelated text while the real `--session-id` flag stays
+ * unarmed and the function still reported success. A non-unique anchor
+ * fails closed exactly like a missing one.
+ */
+export declare function armActionTemplatePermissionPerimeter(commands: CopyCommandForms, sessionUuid: string, overrides: ClaimExecutorLaunchOverrides): ArmTemplateResult;
+//# sourceMappingURL=claim-executor-template-arming.d.ts.map

package/server/dist/external/launch/claim-executor-template-arming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-executor-template-arming.d.ts","sourceRoot":"","sources":["../../../src/external/launch/claim-executor-template-arming.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAEpF,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQlC;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAEhF;AAID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,gBAAgB,EAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,4BAA4B,GACtC,iBAAiB,CA8BnB"}

package/server/dist/external/launch/claim-executor-template-arming.js

@@ -0,0 +1,121 @@
+/*
+ * external/launch/claim-executor-template-arming.ts — FR-04.22 permission
+ * perimeter for the ACTION-TEMPLATE launch path (iterate-2026-09-06-claim-
+ * launch-permission-perimeter, Stage-1 review follow-up).
+ *
+ * `action-substitution-branch.ts` builds its command via
+ * `substitutePlaceholders(action.command_template, ...)` — a completely
+ * separate rendering path from `core/launcher.ts`'s `buildCopyCommands`/
+ * `LaunchArgs`, so `launcher-permission-flags.ts`'s argv-level flags never
+ * reach it. Spec review (Stage 1) proved this branch, not the legacy
+ * fallback, is the one leadwright's real tasks actually hit: leadwright's
+ * `CreateExternalTaskBody.actionId` is a REQUIRED field
+ * (`webui-client.ts`), persisted onto the task
+ * (`external/tasks/create.ts`), and `parse-body.ts`'s once-set-always-used
+ * contract means a claim-only `{ claimToken }` launch body still resolves
+ * `parsed.actionId` from that persisted value — so
+ * `applyActionSubstitutionBranch` fires, not the legacy fallback.
+ *
+ * `command_template` is a project-configurable string (bundled defaults in
+ * `config/default-actions.json`, or a project's own `actions.json` via
+ * `loadActionsForProject`) — NOT a fixed shape this module can trust
+ * blindly. Every bundled template starts `--session-id {task.uuid} ...`,
+ * but a custom project template is not guaranteed to. FAIL CLOSED: if the
+ * expected `--session-id <this task's own uuid>` anchor is not found,
+ * verbatim, in a rendered shell form, this module refuses to arm rather
+ * than silently returning an unrestricted command that LOOKS armed because
+ * the caller asked for arming (the exact "looks compliant, isn't" failure
+ * mode this whole card exists to close).
+ *
+ * Stage-3 doubt review found the rendered-output anchor search alone is not
+ * enough: a template that never emits the literal `--session-id {task.uuid}`
+ * placeholder at all could still coincidentally contain a UNIQUE occurrence
+ * of `--session-id <this task's uuid>` inside a substituted, caller-supplied
+ * placeholder (e.g. `{task.description?}`, settable in the very same
+ * claim-authorized launch body) — arming would then splice the flags inside
+ * quoted user text, not a real CLI flag, and still report success. Callers
+ * MUST call `templateDeclaresSessionIdAnchor` on the RAW (pre-substitution)
+ * `command_template` first and refuse to arm if it returns false — that
+ * check is immune to request-supplied content because the template comes
+ * from project configuration, not the launch body.
+ *
+ * The doubt review also found a template can independently re-declare
+ * `--tools`/`--permission-mode` via its own `{task.parameters?}` (a
+ * project's custom parameter schema may set `cli_flag: "--tools"` — the
+ * allowlist regex in `types/action-schema.ts` permits it), which could
+ * override or conflict with the injected flags depending on Claude CLI's
+ * duplicate-flag precedence. This module therefore also fails closed if the
+ * rendered command already contains either flag BEFORE arming.
+ */
+import { qPs, qCmd, qPosix } from "../../core/launcher.js";
+const FLAG_QUOTERS = {
+    powershell: qPs,
+    cmd: qCmd,
+    posix: qPosix,
+};
+/**
+ * True only when the RAW `command_template` (before any substitution)
+ * literally declares the `--session-id {task.uuid}` placeholder. This is
+ * the attacker-uncontrollable precondition for arming: `command_template`
+ * comes from project configuration (bundled defaults or a project's own
+ * `.shipwright-webui/actions.json`), never from the launch request body, so
+ * a caller cannot forge this check the way they could forge a coincidental
+ * match in the RENDERED output (see module header).
+ */
+export function templateDeclaresSessionIdAnchor(commandTemplate) {
+    return commandTemplate.includes("--session-id {task.uuid}");
+}
+const CONFLICTING_FLAG_PATTERN = /(^|\s)(--tools|--permission-mode)(\s|$)/;
+/**
+ * Inserts `--tools <allow-list> --permission-mode <mode>` immediately after
+ * the substituted `--session-id <this task's sessionUuid>` token, on all
+ * three shell forms. The anchor is the task's own UUID rendered UNQUOTED —
+ * verified live (`actions-substitute.ts`'s `{task.uuid}` case returns the
+ * raw value, and its per-shell `q()` wrapping is applied only to
+ * user-derived placeholders, not this one; a debug probe against the real
+ * substitution engine confirmed `--session-id 11111111-...` with no quotes
+ * on posix, cmd AND powershell). The flags THEMSELVES still go through the
+ * matching shell's own quoter (`FLAG_QUOTERS`) — only the anchor is
+ * unquoted, matching the substitution engine's own convention for a
+ * server-generated UUID. The flags are inserted at the anchor's FIRST
+ * occurrence only when that occurrence is provably unique in the rendered
+ * string (checked via `indexOf` === `lastIndexOf`) — a custom project
+ * `command_template` can interpolate other placeholders (e.g.
+ * `{task.description}`) ahead of `{task.uuid}`, and a caller-supplied value
+ * that happens to contain this task's own UUID would otherwise let the
+ * flags land inside unrelated text while the real `--session-id` flag stays
+ * unarmed and the function still reported success. A non-unique anchor
+ * fails closed exactly like a missing one.
+ */
+export function armActionTemplatePermissionPerimeter(commands, sessionUuid, overrides) {
+    const armed = {};
+    for (const shellForm of Object.keys(FLAG_QUOTERS)) {
+        const q = FLAG_QUOTERS[shellForm];
+        const marker = `--session-id ${sessionUuid}`;
+        const source = commands[shellForm];
+        const idx = source.indexOf(marker);
+        if (idx === -1) {
+            return {
+                ok: false,
+                detail: `no '--session-id ${sessionUuid}' anchor found in the ${shellForm} command form — cannot arm the permission perimeter`,
+            };
+        }
+        if (idx !== source.lastIndexOf(marker)) {
+            return {
+                ok: false,
+                detail: `'--session-id ${sessionUuid}' anchor is not unique in the ${shellForm} command form — cannot safely arm the permission perimeter`,
+            };
+        }
+        if (CONFLICTING_FLAG_PATTERN.test(source)) {
+            return {
+                ok: false,
+                detail: `the ${shellForm} command form already contains a --tools or --permission-mode flag before arming — refusing to risk a duplicate/conflicting flag`,
+            };
+        }
+        const insertAt = idx + marker.length;
+        const flags = ` --tools ${q(overrides.toolsAllowlist.join(","))} --permission-mode ${q(overrides.permissionMode)}`;
+        armed[shellForm] = source.slice(0, insertAt) + flags + source.slice(insertAt);
+    }
+    return { ok: true, commands: armed };
+}
+//# sourceMappingURL=claim-executor-template-arming.js.map

package/server/dist/external/launch/claim-executor-template-arming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-executor-template-arming.js","sourceRoot":"","sources":["../../../src/external/launch/claim-executor-template-arming.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAyB,MAAM,wBAAwB,CAAC;AAOlF,MAAM,YAAY,GAA0D;IAC1E,UAAU,EAAE,GAAG;IACf,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,MAAM;CACd,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,eAAuB;IACrE,OAAO,eAAe,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,wBAAwB,GAAG,yCAAyC,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oCAAoC,CAClD,QAA0B,EAC1B,WAAmB,EACnB,SAAuC;IAEvC,MAAM,KAAK,GAA8B,EAAE,CAAC;IAC5C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAkC,EAAE,CAAC;QACnF,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,gBAAgB,WAAW,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,oBAAoB,WAAW,yBAAyB,SAAS,qDAAqD;aAC/H,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB,WAAW,iCAAiC,SAAS,4DAA4D;aAC3I,CAAC;QACJ,CAAC;QACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO,SAAS,kIAAkI;aAC3J,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;QACnH,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAyB,EAAE,CAAC;AAC3D,CAAC"}

package/server/dist/external/launch/claim-holder-gate.d.ts

@@ -25,6 +25,7 @@ export declare const CLAIM_LAUNCH_WINDOW_MS: number;
 export declare const CLAIM_CLOCK_SKEW_TOLERANCE_MS: number;
 export type ClaimGateResult = {
     allowed: true;
+    claimAuthorized: boolean;
 } | {
     allowed: false;
     error: Record<string, unknown>;
@@ -37,6 +38,14 @@ export type ClaimGateResult = {
  * envelope — `claimExpired: true` distinguishes "right token, too old" from
  * a foreign/absent token (trap: an expired claim must read differently from
  * someone else's).
+ *
+ * `claimAuthorized` (iterate-2026-09-06-claim-launch-permission-perimeter,
+ * FR-04.22 follow-up) distinguishes the TWO shapes of `allowed: true`: "no
+ * claim was ever on record" (an ordinary human/manual launch) vs. "the
+ * caller proved it holds the CURRENT, unexpired claim" (leadwright's stage-2
+ * executor). The launch route uses this — not a second, independently
+ * re-derived token-match check — to decide whether to arm the executor's
+ * permission perimeter, so the two conditions can never drift apart.
  */
 export declare function checkClaimHolderGate(task: ExternalTask, bodyClaimToken: string | undefined): ClaimGateResult;
 //# sourceMappingURL=claim-holder-gate.d.ts.map

package/server/dist/external/launch/claim-holder-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claim-holder-gate.d.ts","sourceRoot":"","sources":["../../../src/external/launch/claim-holder-gate.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,QAAgB,CAAC;AAE3D,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEvD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,eAAe,CAqCjB"}
+{"version":3,"file":"claim-holder-gate.d.ts","sourceRoot":"","sources":["../../../src/external/launch/claim-holder-gate.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,QAAgB,CAAC;AAE3D,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,eAAe,CAqCjB"}

package/server/dist/external/launch/claim-holder-gate.js

@@ -52,10 +52,18 @@ export const CLAIM_CLOCK_SKEW_TOLERANCE_MS = 5 * 60 * 1000;
  * envelope — `claimExpired: true` distinguishes "right token, too old" from
  * a foreign/absent token (trap: an expired claim must read differently from
  * someone else's).
+ *
+ * `claimAuthorized` (iterate-2026-09-06-claim-launch-permission-perimeter,
+ * FR-04.22 follow-up) distinguishes the TWO shapes of `allowed: true`: "no
+ * claim was ever on record" (an ordinary human/manual launch) vs. "the
+ * caller proved it holds the CURRENT, unexpired claim" (leadwright's stage-2
+ * executor). The launch route uses this — not a second, independently
+ * re-derived token-match check — to decide whether to arm the executor's
+ * permission perimeter, so the two conditions can never drift apart.
  */
 export function checkClaimHolderGate(task, bodyClaimToken) {
     if (typeof task.claimToken !== "string" || task.claimToken.length === 0) {
-        return { allowed: true };
+        return { allowed: true, claimAuthorized: false };
     }
     const tokenMatches = bodyClaimToken !== undefined && bodyClaimToken === task.claimToken;
     const claimedAtMs = task.claimedAt ? Date.parse(task.claimedAt) : NaN;
@@ -64,7 +72,7 @@ export function checkClaimHolderGate(task, bodyClaimToken) {
         age >= -CLAIM_CLOCK_SKEW_TOLERANCE_MS &&
         age <= CLAIM_LAUNCH_WINDOW_MS;
     if (tokenMatches && withinWindow) {
-        return { allowed: true };
+        return { allowed: true, claimAuthorized: true };
     }
     console.warn(JSON.stringify({
         level: "warn",

package/server/dist/external/launch/claim-holder-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"claim-holder-gate.js","sourceRoot":"","sources":["../../../src/external/launch/claim-holder-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAM3D;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAkB,EAClB,cAAkC;IAElC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,YAAY,GAChB,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,IAAI,CAAC,UAAU,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IACrC,MAAM,YAAY,GAChB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,GAAG,IAAI,CAAC,6BAA6B;QACrC,GAAG,IAAI,sBAAsB,CAAC;IAEhC,IAAI,YAAY,IAAI,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;KACzD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAA4B;QACrC,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IACF,IAAI,YAAY;QAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"claim-holder-gate.js","sourceRoot":"","sources":["../../../src/external/launch/claim-holder-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAM3D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAkB,EAClB,cAAkC;IAElC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,YAAY,GAChB,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,IAAI,CAAC,UAAU,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IACrC,MAAM,YAAY,GAChB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,GAAG,IAAI,CAAC,6BAA6B;QACrC,GAAG,IAAI,sBAAsB,CAAC;IAEhC,IAAI,YAAY,IAAI,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,sDAAsD;QAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;KACzD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAA4B;QACrC,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IACF,IAAI,YAAY;QAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC"}

package/server/dist/external/launch/claim-permission-perimeter-assert.d.ts

@@ -0,0 +1,3 @@
+import type { CopyCommandForms } from "../../core/launcher.js";
+export declare function commandsCarryPermissionPerimeter(commands: CopyCommandForms): boolean;
+//# sourceMappingURL=claim-permission-perimeter-assert.d.ts.map

package/server/dist/external/launch/claim-permission-perimeter-assert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-permission-perimeter-assert.d.ts","sourceRoot":"","sources":["../../../src/external/launch/claim-permission-perimeter-assert.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAMT"}

package/server/dist/external/launch/claim-permission-perimeter-assert.js

@@ -0,0 +1,24 @@
+/*
+ * external/launch/claim-permission-perimeter-assert.ts — FR-04.22 Stage-3
+ * doubt-review follow-up (iterate-2026-09-06-claim-launch-permission-perimeter).
+ *
+ * `claimAuthorized` is threaded, opt-in, into only two of the six
+ * launch-precedence branches (action-substitution, legacy-fallback) because
+ * those are the only ones a `{ claimToken }`-only body can structurally
+ * reach today. That is an assumption about the CALLING daemon's current
+ * body shape, not a code-enforced invariant — a future body that combines a
+ * valid `claimToken` with `phaseTaskRef` / `campaignSlug` / `campaignStep` /
+ * `masterRun` would dispatch to one of the four branches that never learned
+ * about claims and get back a fully unrestricted command while still
+ * holding a valid claim.
+ *
+ * This is the centralized backstop: regardless of which branch produced
+ * `commands`, a claim-authorized launch must show the permission perimeter
+ * on every shell form or the request is refused (409) — never silently
+ * downgraded.
+ */
+export function commandsCarryPermissionPerimeter(commands) {
+    return Object.keys(commands).every((shellForm) => commands[shellForm].includes("--tools") &&
+        commands[shellForm].includes("--permission-mode"));
+}
+//# sourceMappingURL=claim-permission-perimeter-assert.js.map

package/server/dist/external/launch/claim-permission-perimeter-assert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-permission-perimeter-assert.js","sourceRoot":"","sources":["../../../src/external/launch/claim-permission-perimeter-assert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,UAAU,gCAAgC,CAC9C,QAA0B;IAE1B,OAAQ,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAmC,CAAC,KAAK,CACnE,CAAC,SAAS,EAAE,EAAE,CACZ,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CACpD,CAAC;AACJ,CAAC"}

package/server/dist/external/launch/legacy-fallback-branch.d.ts

@@ -5,6 +5,20 @@ export declare function applyLegacyFallbackBranch(args: {
     task: ExternalTask;
     parsed: ParsedLaunchBody;
     jsonlObserved: boolean;
+    /**
+     * FR-04.22 (iterate-2026-09-06-claim-launch-permission-perimeter) — true
+     * only when `checkClaimHolderGate` proved this caller holds the task's
+     * CURRENT, unexpired claim (leadwright's stage-2 executor). `undefined`/
+     * `false` (every human/manual launch) leaves the command byte-identical
+     * to before this field existed — verified by
+     * `legacy-fallback-branch.test.ts`'s own "manual launch unchanged"
+     * assertion on the produced command STRING, not just a 200 status. A
+     * leadwright-created task normally has `actionId` set and is armed
+     * through `action-substitution-branch.ts` instead (Stage-1 spec review
+     * finding) — this branch still needs the same wiring for a task launched
+     * before it ever had an actionId.
+     */
+    claimAuthorized?: boolean;
 }): {
     commands: CopyCommandForms;
     taskUpdate: Partial<ExternalTask>;

package/server/dist/external/launch/legacy-fallback-branch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legacy-fallback-branch.d.ts","sourceRoot":"","sources":["../../../src/external/launch/legacy-fallback-branch.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EAElB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;CAAE,CAgBpE"}
+{"version":3,"file":"legacy-fallback-branch.d.ts","sourceRoot":"","sources":["../../../src/external/launch/legacy-fallback-branch.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EAElB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;CAAE,CAiBpE"}

package/server/dist/external/launch/legacy-fallback-branch.js

@@ -10,8 +10,9 @@
  * JSONL on disk, `--resume` is the correct shape.
  */
 import { buildCopyCommands, } from "../../core/launcher.js";
+import { claimExecutorLaunchOverrides } from "./claim-executor-permissions.js";
 export function applyLegacyFallbackBranch(args) {
-    const { task, parsed, jsonlObserved } = args;
+    const { task, parsed, jsonlObserved, claimAuthorized } = args;
     const effectiveResume = parsed.resume && (task.actionId !== "new-plain" || jsonlObserved);
     const commands = buildCopyCommands({
         sessionUuid: task.sessionUuid,
@@ -19,6 +20,7 @@ export function applyLegacyFallbackBranch(args) {
         resume: effectiveResume,
         pluginDirs: task.pluginDirs,
         title: task.title,
+        ...(claimAuthorized ? claimExecutorLaunchOverrides() : {}),
     });
     const taskUpdate = {
         state: "awaiting_external_start",

package/server/dist/external/launch/legacy-fallback-branch.js.map

@@ -1 +1 @@
-{"version":3,"file":"legacy-fallback-branch.js","sourceRoot":"","sources":["../../../src/external/launch/legacy-fallback-branch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAOhC,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAC7C,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,aAAa,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,UAAU,GAA0B;QACxC,KAAK,EAAE,yBAA8C;QACrD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"legacy-fallback-branch.js","sourceRoot":"","sources":["../../../src/external/launch/legacy-fallback-branch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/E,MAAM,UAAU,yBAAyB,CAAC,IAkBzC;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC9D,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,aAAa,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,UAAU,GAA0B;QACxC,KAAK,EAAE,yBAA8C;QACrD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC"}

package/server/dist/external/launch/master-run-branch.js

@@ -118,9 +118,9 @@ export async function applyMasterRunBranch(args) {
     }
     const mode = resolveRunMode(cfg.config);
     if (mode !== "single_session") {
-        // multi_session (or a mode-less legacy config → multi_session) uses the
+        // multi_session (or a mode-less legacy config → standalone) uses the
         // per-phase Continue path, not a single master. Refuse rather than inject
-        // `/shipwright-run` into a multi-session run.
+        // `/shipwright-run` into a multi-session/standalone run.
         return {
             error: { error: "master_launch_wrong_mode", detail: mode },
             status: 400,

package/server/dist/external/launch/master-run-branch.js.map

@@ -1 +1 @@
-{"version":3,"file":"master-run-branch.js","sourceRoot":"","sources":["../../../src/external/launch/master-run-branch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAU9D;;;;;;;yDAOyD;AACzD,MAAM,sBAAsB,GAAmC,IAAI,GAAG,CAAC;IACrE,yBAAyB;IACzB,QAAQ;IACR,MAAM;IACN,eAAe;CAChB,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,CAAe;IACvC,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAmB1C;IACC,MAAM,EACJ,IAAI,EACJ,MAAM,EACN,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,SAAS,EACT,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;IAE9D,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,UAAU,GACd,CAAC,IAAI,CAAC,oBAAoB;QAC1B,OAAO,CAAC,MAAM,iBAAiB,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,UAAU,CAAC;IACrE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,iBAAiB,CAAC;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,UAAU,EAAE;gBACV,KAAK,EAAE,yBAA8C;gBACrD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,0EAA0E;gBAC1E,uEAAuE;gBACvE,wEAAwE;gBACxE,mEAAmE;gBACnE,GAAG,CAAC,UAAU;oBACZ,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI,CAAC,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAExC,kEAAkE;IAClE,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE;gBACL,KAAK,EAAE,6BAA6B;gBACpC,MAAM,EAAE,wBAAwB;aACjC;YACD,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,kEAAkE;QAClE,OAAO;YACL,KAAK,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;YACnE,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,wEAAwE;QACxE,0EAA0E;QAC1E,8CAA8C;QAC9C,OAAO;YACL,KAAK,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE;YAC1D,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QACxB,CAAC,CAAC,eAAe,KAAK,IAAI;QAC1B,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAC9B,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK;QAC5B,gBAAgB,CAAC,CAAC,CAAC,CACtB,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YACxE,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAC;IACH,qEAAqE;IACrE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,UAAU,GAA0B;QACxC,KAAK,EAAE,yBAA8C;QACrD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,eAAe,EAAE,IAAI;QACrB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;KACxB,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"master-run-branch.js","sourceRoot":"","sources":["../../../src/external/launch/master-run-branch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAU9D;;;;;;;yDAOyD;AACzD,MAAM,sBAAsB,GAAmC,IAAI,GAAG,CAAC;IACrE,yBAAyB;IACzB,QAAQ;IACR,MAAM;IACN,eAAe;CAChB,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,CAAe;IACvC,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAmB1C;IACC,MAAM,EACJ,IAAI,EACJ,MAAM,EACN,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,SAAS,EACT,iBAAiB,GAClB,GAAG,IAAI,CAAC;IACT,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;IAE9D,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,UAAU,GACd,CAAC,IAAI,CAAC,oBAAoB;QAC1B,OAAO,CAAC,MAAM,iBAAiB,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,UAAU,CAAC;IACrE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,iBAAiB,CAAC;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,UAAU,EAAE;gBACV,KAAK,EAAE,yBAA8C;gBACrD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,0EAA0E;gBAC1E,uEAAuE;gBACvE,wEAAwE;gBACxE,mEAAmE;gBACnE,GAAG,CAAC,UAAU;oBACZ,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI,CAAC,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAExC,kEAAkE;IAClE,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE;gBACL,KAAK,EAAE,6BAA6B;gBACpC,MAAM,EAAE,wBAAwB;aACjC;YACD,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,kEAAkE;QAClE,OAAO;YACL,KAAK,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;YACnE,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,qEAAqE;QACrE,0EAA0E;QAC1E,yDAAyD;QACzD,OAAO;YACL,KAAK,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE;YAC1D,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QACxB,CAAC,CAAC,eAAe,KAAK,IAAI;QAC1B,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAC9B,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK;QAC5B,gBAAgB,CAAC,CAAC,CAAC,CACtB,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YACxE,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAC;IACH,qEAAqE;IACrE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,UAAU,GAA0B;QACxC,KAAK,EAAE,yBAA8C;QACrD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,eAAe,EAAE,IAAI;QACrB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;KACxB,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC"}

package/server/dist/external/launch/mixed-intents-guard.d.ts

@@ -0,0 +1,10 @@
+import type { ParsedLaunchBody } from "./parse-body.js";
+export interface MixedIntentsError {
+    error: {
+        error: "mixed_launch_intents";
+        detail: string;
+    };
+    status: 400;
+}
+export declare function checkMixedLaunchIntents(body: Record<string, unknown>, parsed: ParsedLaunchBody): MixedIntentsError | null;
+//# sourceMappingURL=mixed-intents-guard.d.ts.map

package/server/dist/external/launch/mixed-intents-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mixed-intents-guard.d.ts","sourceRoot":"","sources":["../../../src/external/launch/mixed-intents-guard.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE;QAAE,KAAK,EAAE,sBAAsB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,MAAM,EAAE,GAAG,CAAC;CACb;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,gBAAgB,GACvB,iBAAiB,GAAG,IAAI,CAgD1B"}

package/server/dist/external/launch/mixed-intents-guard.js

@@ -0,0 +1,49 @@
+/*
+ * external/launch/mixed-intents-guard.ts — the three `mixed_launch_intents`
+ * checks split out of routes.ts to keep that file ≤ 300 LOC. Each launch
+ * intent (campaignSlug / campaignStep / masterRun) is mutually exclusive
+ * with the others and with actionId / phaseTaskRef. Checked against the RAW
+ * body (never the parsed/once-set-always-used values) so a task's persisted
+ * `actionId` can never spuriously trip these — see routes.ts callers for
+ * the FR-01.34 / FR-01.36 / webui-pipeline-convergence W2 provenance.
+ */
+export function checkMixedLaunchIntents(body, parsed) {
+    if (typeof body.campaignSlug === "string" &&
+        body.campaignSlug.trim().length > 0 &&
+        (body.actionId !== undefined || body.phaseTaskRef !== undefined)) {
+        return {
+            error: {
+                error: "mixed_launch_intents",
+                detail: "campaignSlug is mutually exclusive with actionId / phaseTaskRef",
+            },
+            status: 400,
+        };
+    }
+    if (parsed.campaignStep &&
+        (body.actionId !== undefined ||
+            body.phaseTaskRef !== undefined ||
+            (typeof body.campaignSlug === "string" && body.campaignSlug.trim().length > 0))) {
+        return {
+            error: {
+                error: "mixed_launch_intents",
+                detail: "campaignStep is mutually exclusive with actionId / phaseTaskRef / campaignSlug",
+            },
+            status: 400,
+        };
+    }
+    if (Boolean(body.masterRun) &&
+        (body.actionId !== undefined ||
+            body.phaseTaskRef !== undefined ||
+            (typeof body.campaignSlug === "string" && body.campaignSlug.trim().length > 0) ||
+            body.campaignStep !== undefined)) {
+        return {
+            error: {
+                error: "mixed_launch_intents",
+                detail: "masterRun is mutually exclusive with actionId / phaseTaskRef / campaignSlug / campaignStep",
+            },
+            status: 400,
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=mixed-intents-guard.js.map

package/server/dist/external/launch/mixed-intents-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mixed-intents-guard.js","sourceRoot":"","sources":["../../../src/external/launch/mixed-intents-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,MAAM,UAAU,uBAAuB,CACrC,IAA6B,EAC7B,MAAwB;IAExB,IACE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QACrC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,EAChE,CAAC;QACD,OAAO;YACL,KAAK,EAAE;gBACL,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,iEAAiE;aAC1E;YACD,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,IACE,MAAM,CAAC,YAAY;QACnB,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC1B,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACjF,CAAC;QACD,OAAO;YACL,KAAK,EAAE;gBACL,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,gFAAgF;aACzF;YACD,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,IACE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QACvB,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC1B,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9E,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,EAClC,CAAC;QACD,OAAO;YACL,KAAK,EAAE;gBACL,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EACJ,4FAA4F;aAC/F;YACD,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/server/dist/external/launch/parse-body.d.ts

@@ -1,4 +1,18 @@
 import type { ExternalTask } from "../../core/sdk-sessions-store.js";
+/**
+ * iterate-2026-09-17-codex-model-tier-parameterization, revised
+ * 2026-09-18 after shipwright#771 — a closed, hand-maintained catalog enum
+ * was withdrawn in favor of the same posture shipwright's own
+ * `codex_review`/`codex_plan_review` config axis uses
+ * (`shared/scripts/lib/codex_review_transport.py`'s
+ * `_CODEX_MODEL_SLUG_PATTERN`): an unconditional SYNTACTIC allowlist, never
+ * a live-catalog-pinned enum. #771's own architecture review rejected
+ * catalog validation outright — "a standing dependency on an undocumented,
+ * already-shifting CLI subcommand ... not worth it" — the exact dependency
+ * `CODEX_IMPLEMENTATION_MODELS` (the withdrawn enum) had. Pattern mirrored
+ * verbatim so both repos reject/accept the same slug shapes.
+ */
+export declare const CODEX_MODEL_SLUG_PATTERN: RegExp;
 export interface ParsedLaunchBody {
     resume: boolean;
     dryRun: boolean;
@@ -26,6 +40,21 @@ export interface ParsedLaunchBody {
      *  single_session run_config + builds the fixed `/shipwright-run` command;
      *  this just surfaces the boolean intent. Launch-body only (never persisted). */
     masterRun: boolean;
+    /** iterate-2026-09-17-codex-model-tier-parameterization — session-scoped
+     *  Codex implementation-model override. Body-only (never persisted on the
+     *  task, and no once-set-always-used fallback), same "only for this
+     *  session" posture as Claude's review-model/plan-review-model. Deliberately
+     *  NOT routed through `userParams`/the action-schema `parameters` pipeline
+     *  — see the iterate spec's server-scope decision for why. */
+    codexImplementationModel: string | undefined;
+    /** iterate-2026-09-19-codex-reviewer-fields (shipwright#772) —
+     *  session-scoped Codex review-model overrides, same body-only /
+     *  never-persisted posture as `codexImplementationModel` above. Threaded
+     *  to `buildCodexCommands` as `SHIPWRIGHT_CODEX_PLAN_REVIEW_MODEL` /
+     *  `SHIPWRIGHT_CODEX_REVIEW_MODEL` env-var prefixes — `run_codex_review`
+     *  resolves those ahead of the project's `shipwright_model_config.json`. */
+    codexPlanReviewModel: string | undefined;
+    codexReviewModel: string | undefined;
 }
 /**
  * Parses the launch body into normalized fields + applies the

package/server/dist/external/launch/parse-body.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-body.d.ts","sourceRoot":"","sources":["../../../src/external/launch/parse-body.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC;IACzD,eAAe,EAAE,OAAO,CAAC;IACzB;;iFAE6E;IAC7E,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;iFAG6E;IAC7E,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC3D;;;qFAGiF;IACjF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,YAAY,GAEhB,gBAAgB,GAChB;IAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAmH5D"}
+{"version":3,"file":"parse-body.d.ts","sourceRoot":"","sources":["../../../src/external/launch/parse-body.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAsC,CAAC;AAE5E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC;IACzD,eAAe,EAAE,OAAO,CAAC;IACzB;;iFAE6E;IAC7E,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;iFAG6E;IAC7E,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC3D;;;qFAGiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;kEAK8D;IAC9D,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;gFAK4E;IAC5E,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,YAAY,GAEhB,gBAAgB,GAChB;IAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CA0J5D"}

package/server/dist/external/launch/parse-body.js

@@ -4,6 +4,20 @@
  * value ?? persisted task value (v0.4.1 fix).
  */
 import { PARAM_NAME_PATTERN } from "../../types/action-schema.js";
+/**
+ * iterate-2026-09-17-codex-model-tier-parameterization, revised
+ * 2026-09-18 after shipwright#771 — a closed, hand-maintained catalog enum
+ * was withdrawn in favor of the same posture shipwright's own
+ * `codex_review`/`codex_plan_review` config axis uses
+ * (`shared/scripts/lib/codex_review_transport.py`'s
+ * `_CODEX_MODEL_SLUG_PATTERN`): an unconditional SYNTACTIC allowlist, never
+ * a live-catalog-pinned enum. #771's own architecture review rejected
+ * catalog validation outright — "a standing dependency on an undocumented,
+ * already-shifting CLI subcommand ... not worth it" — the exact dependency
+ * `CODEX_IMPLEMENTATION_MODELS` (the withdrawn enum) had. Pattern mirrored
+ * verbatim so both repos reject/accept the same slug shapes.
+ */
+export const CODEX_MODEL_SLUG_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 /**
  * Parses the launch body into normalized fields + applies the
  * once-set-always-used contract (v0.4.1): body field falls back to the
@@ -97,6 +111,33 @@ export function parseLaunchBody(body, task) {
             campaignStep = { slug: s.trim(), stepId: id.trim() };
         }
     }
+    // iterate-2026-09-17-codex-model-tier-parameterization, revised for
+    // shipwright#771 — syntactic allowlist, not a catalog enum; trimmed first
+    // so an incidental leading/trailing space from a free-text field doesn't
+    // fail a slug that would otherwise match. An unrecognized shape fails
+    // closed (400), never silently dropped or coerced to undefined.
+    // Deliberately unconditional on task.runtime: a value irrelevant to a
+    // Claude-runtime task (runtime-chokepoint.ts never reads it for one) is
+    // still malformed-input-rejected rather than silently accepted, same
+    // fail-closed posture as every other field this function validates.
+    // Today's only caller (useNewIssueFormSubmit.ts) already gates on
+    // runtime === "codex" before ever setting this field.
+    const implementationModelResult = parseCodexModelSlugField(body.codexImplementationModel, "invalid_codex_implementation_model");
+    if ("error" in implementationModelResult)
+        return implementationModelResult;
+    const codexImplementationModel = implementationModelResult.value;
+    // iterate-2026-09-19-codex-reviewer-fields — same syntactic allowlist and
+    // fail-closed posture as codexImplementationModel above (see that field's
+    // comment); the value differs only in what it's used for downstream
+    // (an env-var prefix, not a `-c model=` CLI flag).
+    const planReviewModelResult = parseCodexModelSlugField(body.codexPlanReviewModel, "invalid_codex_plan_review_model");
+    if ("error" in planReviewModelResult)
+        return planReviewModelResult;
+    const codexPlanReviewModel = planReviewModelResult.value;
+    const reviewModelResult = parseCodexModelSlugField(body.codexReviewModel, "invalid_codex_review_model");
+    if ("error" in reviewModelResult)
+        return reviewModelResult;
+    const codexReviewModel = reviewModelResult.value;
     return {
         resume,
         dryRun,
@@ -110,6 +151,31 @@ export function parseLaunchBody(body, task) {
         campaignSlug,
         campaignStep,
         masterRun: Boolean(body.masterRun),
+        codexImplementationModel,
+        codexPlanReviewModel,
+        codexReviewModel,
     };
 }
+/**
+ * Shared validator for the three body-only Codex model-slug overrides
+ * (implementation / plan-review / review): absent → `{ value: undefined }`;
+ * present but malformed → the field's own error code, fail-closed (never
+ * silently dropped or coerced), matching `codexImplementationModel`'s
+ * original inline behavior verbatim.
+ */
+function parseCodexModelSlugField(raw, errorCode) {
+    if (raw === undefined)
+        return { value: undefined };
+    const trimmed = typeof raw === "string" ? raw.trim() : "";
+    if (!CODEX_MODEL_SLUG_PATTERN.test(trimmed)) {
+        return {
+            error: {
+                error: errorCode,
+                detail: `must match ${CODEX_MODEL_SLUG_PATTERN.source}`,
+            },
+            status: 400,
+        };
+    }
+    return { value: trimmed };
+}
 //# sourceMappingURL=parse-body.js.map

package/server/dist/external/launch/parse-body.js.map

@@ -1 +1 @@
-{"version":3,"file":"parse-body.js","sourceRoot":"","sources":["../../../src/external/launch/parse-body.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AA6BlE;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,IAAkB;IAIlB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,4DAA4D;IAC5D,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QACjD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAClB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QAC3D,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QACxB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,WAAW;QAClB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACvB,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IACjE,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,YAAY,GAChB,IAAI,CAAC,QAAQ,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAC1D,CAAC,CAAE,IAAI,CAAC,QAAoC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC;IAE/C,kEAAkE;IAClE,IAAI,UAAwD,CAAC;IAC7D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IACE,IAAI,CAAC,UAAU,KAAK,IAAI;YACxB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACnC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAC9B,CAAC;YACD,OAAO;gBACL,KAAK,EAAE;oBACL,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,8BAA8B;iBACvC;gBACD,MAAM,EAAE,GAAG;aACZ,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CACjC,IAAI,CAAC,UAAqC,CAC3C,EAAE,CAAC;YACF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE;oBACpE,MAAM,EAAE,GAAG;iBACZ,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpD,OAAO;oBACL,KAAK,EAAE;wBACL,KAAK,EAAE,yBAAyB;wBAChC,MAAM,EAAE,aAAa,CAAC,4BAA4B;qBACnD;oBACD,MAAM,EAAE,GAAG;iBACZ,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,mFAAmF;IACnF,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAC;IAEhB,kEAAkE;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,wDAAwD;IACxD,IAAI,YAA0D,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,GAAI,OAAmC,CAAC,IAAI,CAAC;QACpD,MAAM,EAAE,GAAI,OAAmC,CAAC,MAAM,CAAC;QACvD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnG,YAAY,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,MAAM;QACN,QAAQ,EAAE,YAAY,IAAI,YAAY;QACtC,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,KAAK;QAC9B,UAAU,EAAE,cAAc,IAAI,IAAI,CAAC,UAAU;QAC7C,WAAW;QACX,QAAQ;QACR,UAAU;QACV,eAAe,EAAE,IAAI,CAAC,YAAY;QAClC,YAAY;QACZ,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;KACnC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"parse-body.js","sourceRoot":"","sources":["../../../src/external/launch/parse-body.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGlE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,mCAAmC,CAAC;AA2C5E;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,IAAkB;IAIlB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,4DAA4D;IAC5D,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QACjD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAClB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QAC3D,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QACxB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,WAAW;QAClB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACvB,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IACjE,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,YAAY,GAChB,IAAI,CAAC,QAAQ,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAC1D,CAAC,CAAE,IAAI,CAAC,QAAoC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC;IAE/C,kEAAkE;IAClE,IAAI,UAAwD,CAAC;IAC7D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IACE,IAAI,CAAC,UAAU,KAAK,IAAI;YACxB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACnC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAC9B,CAAC;YACD,OAAO;gBACL,KAAK,EAAE;oBACL,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,8BAA8B;iBACvC;gBACD,MAAM,EAAE,GAAG;aACZ,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CACjC,IAAI,CAAC,UAAqC,CAC3C,EAAE,CAAC;YACF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE;oBACpE,MAAM,EAAE,GAAG;iBACZ,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpD,OAAO;oBACL,KAAK,EAAE;wBACL,KAAK,EAAE,yBAAyB;wBAChC,MAAM,EAAE,aAAa,CAAC,4BAA4B;qBACnD;oBACD,MAAM,EAAE,GAAG;iBACZ,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,mFAAmF;IACnF,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAC;IAEhB,kEAAkE;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,wDAAwD;IACxD,IAAI,YAA0D,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,GAAI,OAAmC,CAAC,IAAI,CAAC;QACpD,MAAM,EAAE,GAAI,OAAmC,CAAC,MAAM,CAAC;QACvD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnG,YAAY,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,gEAAgE;IAChE,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,sDAAsD;IACtD,MAAM,yBAAyB,GAAG,wBAAwB,CACxD,IAAI,CAAC,wBAAwB,EAC7B,oCAAoC,CACrC,CAAC;IACF,IAAI,OAAO,IAAI,yBAAyB;QAAE,OAAO,yBAAyB,CAAC;IAC3E,MAAM,wBAAwB,GAAG,yBAAyB,CAAC,KAAK,CAAC;IAEjE,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,qBAAqB,GAAG,wBAAwB,CACpD,IAAI,CAAC,oBAAoB,EACzB,iCAAiC,CAClC,CAAC;IACF,IAAI,OAAO,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACnE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,KAAK,CAAC;IAEzD,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,IAAI,CAAC,gBAAgB,EACrB,4BAA4B,CAC7B,CAAC;IACF,IAAI,OAAO,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAC3D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC;IAEjD,OAAO;QACL,MAAM;QACN,MAAM;QACN,QAAQ,EAAE,YAAY,IAAI,YAAY;QACtC,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,KAAK;QAC9B,UAAU,EAAE,cAAc,IAAI,IAAI,CAAC,UAAU;QAC7C,WAAW;QACX,QAAQ;QACR,UAAU;QACV,eAAe,EAAE,IAAI,CAAC,YAAY;QAClC,YAAY;QACZ,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAClC,wBAAwB;QACxB,oBAAoB;QACpB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,GAAY,EACZ,SAAiB;IAIjB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE;gBACL,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,cAAc,wBAAwB,CAAC,MAAM,EAAE;aACxD;YACD,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/server/dist/external/launch/routes.d.ts

@@ -18,6 +18,9 @@ export interface LaunchRouterDeps {
      * per-router unit tests that don't wire a watcher default to "no JSONL".
      */
     jsonlExistsOnDisk?: (sessionUuid: string) => Promise<boolean>;
+    /** Codextender Part B.6 — fresh settings reads for the runtime chokepoint. */
+    getCodexIntegrationMode?: () => Promise<"light" | "codextender" | undefined>;
+    getCodextenderPort?: () => Promise<number | undefined>;
 }
 export declare function createLaunchRouter(deps: LaunchRouterDeps): Hono;
 //# sourceMappingURL=routes.d.ts.map

package/server/dist/external/launch/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/launch/routes.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EACL,gBAAgB,EAEjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AActE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,gBAAgB,CAAC;IACxB,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC7C,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAwN/D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/external/launch/routes.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAYtE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,gBAAgB,CAAC;IACxB,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC7C,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACtE,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;IAC7E,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACxD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAkK/D"}