@wjarka/cezarion 0.16.0 → 0.17.0

package/dist/server/app-type.d.ts

@@ -1,21 +1,6 @@
 import type { createApp } from './server.ts';
 /**
- * The service's HTTP contract, as a type.
- *
- * This is the whole boundary between the cezar service and a typed consumer: Hono infers an
- * app's endpoint table from the app's *type*, and `hc<AppType>` turns that table into a client
- * whose paths, request bodies and response shapes are checked at compile time. No hand-written
- * mirror, no schema to author twice — the routes ARE the contract.
- *
- * Only routes registered through a **chained** builder appear here — a loose `api.get(…)`
- * statement discards its return value and with it the accumulated route type. Every family in
- * `server.ts` is now chained and mounted into the versioned table, so this type covers the whole
- * `/api/v1` surface; `versioned-surface.test.ts` fails on any route that escapes it. A new route
- * added as a link in its family's chain widens this type automatically — nothing here needs
- * updating, and nothing here should be hand-written.
- *
- * Type-only by construction: importing this module pulls in no runtime code (`import type`
- * disappears at build), which is what lets a browser bundle consume it without dragging
- * `node:*` in.
+ * Type-only HTTP route table inferred from chained versioned family builders. Loose
+ * registrations discard accumulated route types. This module must introduce no runtime imports.
  */
 export type AppType = ReturnType<typeof createApp>;

package/dist/server/archive-on-merge.d.ts

@@ -0,0 +1,35 @@
+import type { ArchivePullRequestIdentity, MergedPullRequest } from '../contract/index.js';
+import type { RunStore } from '../runs/store.ts';
+export interface ArchiveProject {
+    id: string;
+    root: string;
+    status?: string;
+}
+export interface ArchiveOnMergeDeps {
+    projects(): Promise<readonly ArchiveProject[]>;
+    enabled(project: ArchiveProject): Promise<boolean>;
+    repository(project: ArchiveProject): Promise<string | undefined>;
+    withStore<T>(project: ArchiveProject, work: (store: RunStore, isActive: (id: string) => boolean, current: () => boolean) => Promise<T>): Promise<T | undefined>;
+    lookup(root: string, identities: ArchivePullRequestIdentity[], signal: AbortSignal): Promise<MergedPullRequest[]>;
+}
+/** One browser-independent workspace poller. Never builds a manager or recovers a run. */
+export declare class ArchiveOnMergeCoordinator {
+    private readonly deps;
+    private readonly interval;
+    private timer?;
+    private busy;
+    private stopped;
+    private generation;
+    private abort?;
+    private projectCursor;
+    private readonly cursors;
+    private readonly pending;
+    private readonly failures;
+    constructor(deps: ArchiveOnMergeDeps, interval?: number);
+    start(): void;
+    stop(): void;
+    /** A saved preference invalidates lookups already in flight, even if changed back quickly. */
+    invalidate(): void;
+    tick(): Promise<void>;
+    private tickProject;
+}

package/dist/server/archive-on-merge.js

@@ -0,0 +1,202 @@
+import { pullRequestKey } from '../runs/pull-requests.js';
+/** One browser-independent workspace poller. Never builds a manager or recovers a run. */
+export class ArchiveOnMergeCoordinator {
+    deps;
+    interval;
+    timer;
+    busy = false;
+    stopped = false;
+    generation = 0;
+    abort;
+    projectCursor = 0;
+    cursors = new Map();
+    pending = new Map();
+    failures = new Map();
+    constructor(deps, interval = 60_000) {
+        this.deps = deps;
+        this.interval = interval;
+    }
+    start() {
+        if (this.timer || this.busy)
+            return;
+        this.stopped = false;
+        const poll = async () => {
+            await this.tick();
+            if (!this.stopped) {
+                this.timer = setTimeout(poll, this.interval);
+                this.timer.unref?.();
+            }
+        };
+        this.timer = setTimeout(poll, 0);
+        this.timer.unref?.();
+    }
+    stop() {
+        this.stopped = true;
+        this.invalidate();
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = undefined;
+    }
+    /** A saved preference invalidates lookups already in flight, even if changed back quickly. */
+    invalidate() { this.generation++; this.abort?.abort(); this.pending.clear(); }
+    async tick() {
+        if (this.busy || this.stopped)
+            return;
+        this.busy = true;
+        const generation = this.generation;
+        const abort = new AbortController();
+        this.abort = abort;
+        const timeout = setTimeout(() => abort.abort(), 30_000);
+        timeout.unref?.();
+        const current = () => !this.stopped && generation === this.generation && !abort.signal.aborted;
+        try {
+            const projects = (await this.deps.projects()).filter(project => project.status !== 'missing');
+            const ids = new Set(projects.map(project => project.id));
+            for (const id of this.cursors.keys())
+                if (!ids.has(id)) {
+                    this.cursors.delete(id);
+                    this.failures.delete(id);
+                }
+            for (const [key, state] of this.pending)
+                if (!ids.has(state.projectId))
+                    this.pending.delete(key);
+            if (!projects.length || !current())
+                return;
+            // Four projects per tick avoids a minute per unopened project. Each project remains bounded.
+            for (let i = 0; i < Math.min(4, projects.length) && current(); i++) {
+                const project = projects[this.projectCursor++ % projects.length];
+                await this.tickProject(project, abort.signal, current);
+            }
+        }
+        catch {
+            // A registry outage leaves tasks visible until the next bounded poll.
+        }
+        finally {
+            clearTimeout(timeout);
+            this.abort = undefined;
+            this.busy = false;
+        }
+    }
+    async tickProject(project, signal, current) {
+        let roots = [];
+        try {
+            if ((this.failures.get(project.id)?.nextAt ?? 0) > Date.now() || !await this.deps.enabled(project) || !current())
+                return;
+            const repoBase = await this.deps.repository(project);
+            const snapshots = await this.deps.withStore(project, async (store, isActive, valid) => {
+                if (!current() || !valid())
+                    return [];
+                const out = [];
+                // Finish admitted large sets before moving the page cursor. Revalidate even when
+                // a run stopped being a candidate so stale entries cannot hold capacity forever.
+                for (const [key, state] of this.pending) {
+                    if (state.projectId !== project.id)
+                        continue;
+                    await store.prepareArchiveOnMerge(state.rootId);
+                    if (!current() || !valid())
+                        return [];
+                    const snapshot = store.archiveOnMergeSnapshot(state.rootId, repoBase, isActive);
+                    if (!snapshot)
+                        this.pending.delete(key);
+                    else
+                        out.push(snapshot);
+                    if (out.length === 4)
+                        return out;
+                }
+                if (out.length)
+                    return out;
+                const page = store.listArchiveOnMergeCandidates(this.cursors.get(project.id) ?? 0, 64);
+                this.cursors.set(project.id, page.length === 64 ? page.at(-1).seq : 0);
+                for (const candidate of page) {
+                    if (!store.hasArchiveOnMergeAssociations(candidate.id))
+                        continue;
+                    await store.prepareArchiveOnMerge(candidate.id);
+                    if (!current() || !valid())
+                        break;
+                    const snapshot = store.archiveOnMergeSnapshot(candidate.id, repoBase, isActive);
+                    if (snapshot)
+                        out.push(snapshot);
+                    if (out.length === 4) {
+                        this.cursors.set(project.id, candidate.seq);
+                        break;
+                    }
+                }
+                return out;
+            });
+            if (!snapshots?.length || !current())
+                return;
+            roots = snapshots.map(snapshot => snapshot.rootId);
+            const requests = new Map();
+            for (const snapshot of snapshots) {
+                const key = `${project.id}:${snapshot.rootId}`;
+                let state = this.pending.get(key);
+                if (!state || state.token !== snapshot.token) {
+                    if (!state && this.pending.size >= 32)
+                        continue;
+                    state = { projectId: project.id, rootId: snapshot.rootId, token: snapshot.token, offset: 0, merged: new Map() };
+                    this.pending.set(key, state);
+                }
+                // Large merge sets progress across ticks; never truncate a set into archive authority.
+                for (const pr of snapshot.pullRequests.slice(state.offset, state.offset + 64))
+                    requests.set(pullRequestKey(pr), pr);
+            }
+            if (!requests.size)
+                return;
+            const observed = await this.deps.lookup(project.root, [...requests.values()], signal);
+            if (!current())
+                return;
+            const observedByKey = new Map(observed.map(pr => [pullRequestKey(pr), pr]));
+            for (const snapshot of snapshots) {
+                const key = `${project.id}:${snapshot.rootId}`, state = this.pending.get(key);
+                if (!state)
+                    continue;
+                for (const pr of snapshot.pullRequests.slice(state.offset, state.offset + 64)) {
+                    const observation = observedByKey.get(pullRequestKey(pr));
+                    if (observation)
+                        state.merged.set(pullRequestKey(pr), observation);
+                }
+                state.offset += 64;
+                if (state.offset < snapshot.pullRequests.length)
+                    continue;
+                state.offset = 0;
+                if (state.merged.size !== snapshot.pullRequests.length) {
+                    const missing = snapshot.pullRequests.find(pr => !state.merged.has(pullRequestKey(pr)));
+                    if (missing)
+                        await this.deps.withStore(project, async (store, _active, valid) => {
+                            if (current() && valid())
+                                store.archiveMergeBlocker(snapshot, missing, repoBase);
+                        });
+                    this.pending.delete(key);
+                    continue;
+                }
+                await this.deps.withStore(project, async (store, isActive, valid) => {
+                    if (!await this.deps.enabled(project) || !current() || !valid())
+                        return;
+                    const registered = (await this.deps.projects()).some(p => p.id === project.id && p.root === project.root && p.status !== 'missing');
+                    if (!registered || !current() || !valid())
+                        return;
+                    if (await this.deps.repository(project) !== repoBase || !current() || !valid())
+                        return;
+                    await store.prepareArchiveOnMerge(snapshot.rootId);
+                    if (!current() || !valid())
+                        return;
+                    store.archiveAfterMerge(snapshot, [...state.merged.values()], repoBase, isActive);
+                });
+                this.pending.delete(key);
+            }
+            this.failures.delete(project.id);
+        }
+        catch {
+            if (current()) {
+                await this.deps.withStore(project, async (store, _active, valid) => {
+                    if (current() && valid())
+                        for (const id of roots)
+                            store.setArchiveBlocker(id, { message: 'Could not confirm PR merge status. Check GitHub or archive manually.' });
+                }).catch(() => undefined);
+                const count = Math.min(5, (this.failures.get(project.id)?.count ?? 0) + 1);
+                this.failures.set(project.id, { count, nextAt: Date.now() + Math.min(900_000, this.interval * 2 ** (count - 1)) });
+            }
+        }
+    }
+}
+//# sourceMappingURL=archive-on-merge.js.map

package/dist/server/archive-on-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-on-merge.js","sourceRoot":"","sources":["../../src/server/archive-on-merge.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAY1D,0FAA0F;AAC1F,MAAM,OAAO,yBAAyB;IAWP,IAAI;IAAuC,QAAQ;IAVxE,KAAK,CAA6C;IAClD,IAAI,GAAG,KAAK,CAAC;IACb,OAAO,GAAG,KAAK,CAAC;IAChB,UAAU,GAAG,CAAC,CAAC;IACf,KAAK,CAA+B;IACpC,aAAa,GAAG,CAAC,CAAC;IACT,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC7C,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEjF,YAA6B,IAAwB,EAAmB,QAAQ,GAAG,MAAM;oBAA5D,IAAI;wBAAuC,QAAQ;IAAY,CAAC;IAE7F,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAAC,CAAC;QAC5F,CAAC,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,8FAA8F;IAC9F,UAAU,KAAW,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEpF,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACxD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/F,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAC9F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;YAC9G,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO;YAC3C,6FAA6F;YAC7F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAC;gBAClE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QACnE,CAAC;IACH,CAAC;IACO,KAAK,CAAC,WAAW,CAAC,OAAuB,EAAE,MAAmB,EAAE,OAAsB;QAC5F,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO;YACzH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;gBACpF,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE;oBAAE,OAAO,EAAE,CAAC;gBACtC,MAAM,GAAG,GAA6B,EAAE,CAAC;gBACzC,iFAAiF;gBACjF,iFAAiF;gBACjF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACxC,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE;wBAAE,SAAS;oBAC7C,MAAM,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAChD,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE;wBAAE,OAAO,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBAChF,IAAI,CAAC,QAAQ;wBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;wBACnC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACxB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;wBAAE,OAAO,GAAG,CAAC;gBACnC,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM;oBAAE,OAAO,GAAG,CAAC;gBAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxE,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;oBAC7B,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC;wBAAE,SAAS;oBACjE,MAAM,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;oBAChD,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE;wBAAE,MAAM;oBAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBAChF,IAAI,QAAQ;wBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;wBAAC,MAAM;oBAAC,CAAC;gBAC/E,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO;YAC7C,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsC,CAAC;YAC/D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC/C,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;oBAC7C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE;wBAAE,SAAS;oBAChD,KAAK,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChJ,CAAC;gBACD,uFAAuF;gBACvF,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,OAAO;YAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO;YACvB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC9E,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;oBAC9E,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC1D,IAAI,WAAW;wBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;gBACrE,CAAC;gBACD,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;gBACnB,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM;oBAAE,SAAS;gBAC1D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjB,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;oBACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBACxF,IAAI,OAAO;wBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;4BAC9E,IAAI,OAAO,EAAE,IAAI,KAAK,EAAE;gCAAE,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;wBACnF,CAAC,CAAC,CAAC;oBACH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAC,SAAS;gBACrC,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;oBAClE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE;wBAAE,OAAO;oBACxE,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;oBACpI,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE;wBAAE,OAAO;oBAClD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE;wBAAE,OAAO;oBACvF,MAAM,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACnD,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE;wBAAE,OAAO;oBACnC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACpF,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,OAAO,EAAE,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;oBACjE,IAAI,OAAO,EAAE,IAAI,KAAK,EAAE;wBAAE,KAAK,MAAM,EAAE,IAAI,KAAK;4BAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,sEAAsE,EAAE,CAAC,CAAC;gBACrK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrH,CAAC;QACH,CAAC;IACH,CAAC;CAEF"}

package/dist/server/capabilities.d.ts

@@ -9,12 +9,6 @@
  * hosted mode — the UI hides every local-machine affordance and the open-in-*
  * endpoints 409.
  *
- * `followups` (spec 007, #444, #471): the global follow-up inbox is **opt-in**
- * via `CEZ_FOLLOWUPS=1` and off by default. Off, agents are never told to write
- * `todos.json` (they get `HANDOFF_ONLY_INSTRUCTIONS` and an empty
- * `CEZ_TODOS_FILE`), the Inbox nav item is gone and the inbox endpoints refuse.
- * The per-task handoff journal is independent and runs either way.
- *
  * `singleProject` (spec 2026-07-21-cez-single-project): the workspace is
  * deliberately constrained to the launch project when `CEZ_SINGLE_PROJECT=1`.
  * Like the other opt-in capabilities, activation is strict: no other spelling
@@ -25,7 +19,7 @@
  * `Automations` nav item is gone everywhere it is rendered, the
  * `/automations*` endpoints refuse, and the workspace scheduler never polls
  * GitHub — the flag removes the behavior, not only the UI. Activation is
- * strict, like the two capabilities above. Nothing on disk is touched:
+ * strict, like the capabilities above. Nothing on disk is touched:
  * definitions, receipts and high-watermarks survive the flag being off, so
  * unsetting it and restarting restores the feature wholesale.
  *
@@ -55,17 +49,11 @@ export declare function isLoopbackHost(host: string | undefined): boolean;
  *  loopback" once the value arrives over the wire (#426). */
 export declare function isLoopbackHostHeader(host: string | null | undefined): boolean;
 /** `CEZ_REMOTE=1` or a non-loopback bind host ⇒ hosted mode (no local handoff).
- *  `CEZ_FOLLOWUPS=1` ⇒ the follow-up inbox exists (#471).
  *  `CEZ_AUTOMATIONS=1` ⇒ GitHub automations exist (#801).
  *  `CEZ_PREVIEW=1` ⇒ live preview exists (#781); same boot-time-flag caveat as `automations`.
+ *  `CEZ_VOICE=1` plus `TYPESAFE_API_KEY` (or `CEZ_DRY_RUN=1`) ⇒ voice mode exists; same caveat.
  *
- *  Read per request — cheap, and tests/ops can flip `CEZ_REMOTE` live. `followups` is honest
- *  per request too, but flipping it ON at runtime is only half a switch: the per-dataDir
- *  todos watch (step 2.3) is created by an SSE subscription, so connections opened while the
- *  flag was off never subscribed and get no live inbox updates until they reconnect. Hence
- *  the UI's "set CEZ_FOLLOWUPS=1 and restart cezar" wording — treat it as a boot-time flag.
- *
- *  `automations` carries the same caveat and for the same reason: the workspace scheduler is
+ *  Read per request. The automations flag is a boot-time setting: the workspace scheduler is
  *  started once, on the server's `listening` event, so flipping the flag on afterwards gates
  *  the routes open without ever starting the poller. Boot-time flag, same wording. */
 export declare function resolveCapabilities(env?: NodeJS.ProcessEnv, bindHost?: string): Capabilities;

package/dist/server/capabilities.js

@@ -9,12 +9,6 @@
  * hosted mode — the UI hides every local-machine affordance and the open-in-*
  * endpoints 409.
  *
- * `followups` (spec 007, #444, #471): the global follow-up inbox is **opt-in**
- * via `CEZ_FOLLOWUPS=1` and off by default. Off, agents are never told to write
- * `todos.json` (they get `HANDOFF_ONLY_INSTRUCTIONS` and an empty
- * `CEZ_TODOS_FILE`), the Inbox nav item is gone and the inbox endpoints refuse.
- * The per-task handoff journal is independent and runs either way.
- *
  * `singleProject` (spec 2026-07-21-cez-single-project): the workspace is
  * deliberately constrained to the launch project when `CEZ_SINGLE_PROJECT=1`.
  * Like the other opt-in capabilities, activation is strict: no other spelling
@@ -25,7 +19,7 @@
  * `Automations` nav item is gone everywhere it is rendered, the
  * `/automations*` endpoints refuse, and the workspace scheduler never polls
  * GitHub — the flag removes the behavior, not only the UI. Activation is
- * strict, like the two capabilities above. Nothing on disk is touched:
+ * strict, like the capabilities above. Nothing on disk is touched:
  * definitions, receipts and high-watermarks survive the flag being off, so
  * unsetting it and restarting restores the feature wholesale.
  *
@@ -34,7 +28,6 @@
  * legacy `CEZ_HIDE_TOKEN_METRICS=1` remains the master hide-all switch. None
  * changes collection, persistence, events, or API run records.
  */
-import { followupsEnabled } from '../handoff.js';
 /** Every IPv4 address in 127.0.0.0/8, anchored. Anchoring is load-bearing: a
  *  `startsWith('127.')` test also matches attacker-controlled *hostnames* like
  *  `127.0.0.1.evil.com`, which is exactly the DNS-rebinding bypass #426 is
@@ -121,17 +114,11 @@ export function isLoopbackHostHeader(host) {
     return isLoopbackName(normalizeHostname(host));
 }
 /** `CEZ_REMOTE=1` or a non-loopback bind host ⇒ hosted mode (no local handoff).
- *  `CEZ_FOLLOWUPS=1` ⇒ the follow-up inbox exists (#471).
  *  `CEZ_AUTOMATIONS=1` ⇒ GitHub automations exist (#801).
  *  `CEZ_PREVIEW=1` ⇒ live preview exists (#781); same boot-time-flag caveat as `automations`.
+ *  `CEZ_VOICE=1` plus `TYPESAFE_API_KEY` (or `CEZ_DRY_RUN=1`) ⇒ voice mode exists; same caveat.
  *
- *  Read per request — cheap, and tests/ops can flip `CEZ_REMOTE` live. `followups` is honest
- *  per request too, but flipping it ON at runtime is only half a switch: the per-dataDir
- *  todos watch (step 2.3) is created by an SSE subscription, so connections opened while the
- *  flag was off never subscribed and get no live inbox updates until they reconnect. Hence
- *  the UI's "set CEZ_FOLLOWUPS=1 and restart cezar" wording — treat it as a boot-time flag.
- *
- *  `automations` carries the same caveat and for the same reason: the workspace scheduler is
+ *  Read per request. The automations flag is a boot-time setting: the workspace scheduler is
  *  started once, on the server's `listening` event, so flipping the flag on afterwards gates
  *  the routes open without ever starting the poller. Boot-time flag, same wording. */
 export function resolveCapabilities(env = process.env, bindHost) {
@@ -140,12 +127,12 @@ export function resolveCapabilities(env = process.env, bindHost) {
     const costMetrics = !hideAllUsage && env.CEZ_HIDE_COST !== '1';
     return {
         localHandoff: env.CEZ_REMOTE !== '1' && isLoopbackHost(bindHost),
-        // Deliberately not re-derived here: RunManager enforces the same predicate,
-        // and two spellings of "is the inbox on" would eventually disagree.
-        followups: followupsEnabled(env),
         singleProject: env.CEZ_SINGLE_PROJECT === '1',
         automations: env.CEZ_AUTOMATIONS === '1',
         preview: env.CEZ_PREVIEW === '1',
+        // Boot-time flag, like `automations`. The key is read here only as present or absent; the
+        // fake engine under CEZ_DRY_RUN needs none.
+        voice: env.CEZ_VOICE === '1' && (!!env.TYPESAFE_API_KEY || env.CEZ_DRY_RUN === '1'),
         tokenMetrics: tokenUsageMetrics && costMetrics,
         tokenUsageMetrics,
         costMetrics,

package/dist/server/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/server/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD;;;0CAG0C;AAC1C,MAAM,WAAW,GAAG,4CAA4C,CAAC;AAEjE,kEAAkE;AAClE,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC;;;;;;YAMY;AACZ,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAgB,CAAC;IACrB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;oFAOoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACxD,IAAI,SAAS;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/E,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvF,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE7D,OAAO,EAAE,CAAC,CAAC,qCAAqC;AAClD,CAAC;AAED;0EAC0E;AAC1E,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;+CAC+C;AAC/C,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,WAAW,CAAC;AAC5F,CAAC;AAED;;;wEAGwE;AACxE,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;6DAG6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,IAA+B;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;sFAasF;AACtF,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,QAAiB;IACzF,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,KAAK,GAAG,CAAC;IACxD,MAAM,iBAAiB,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IAC5E,MAAM,WAAW,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC;IAC/D,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC;QAChE,4EAA4E;QAC5E,oEAAoE;QACpE,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAChC,aAAa,EAAE,GAAG,CAAC,kBAAkB,KAAK,GAAG;QAC7C,WAAW,EAAE,GAAG,CAAC,eAAe,KAAK,GAAG;QACxC,OAAO,EAAE,GAAG,CAAC,WAAW,KAAK,GAAG;QAChC,YAAY,EAAE,iBAAiB,IAAI,WAAW;QAC9C,iBAAiB;QACjB,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/server/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH;;;0CAG0C;AAC1C,MAAM,WAAW,GAAG,4CAA4C,CAAC;AAEjE,kEAAkE;AAClE,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC;;;;;;YAMY;AACZ,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAgB,CAAC;IACrB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;oFAOoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACxD,IAAI,SAAS;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/E,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvF,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE7D,OAAO,EAAE,CAAC,CAAC,qCAAqC;AAClD,CAAC;AAED;0EAC0E;AAC1E,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;+CAC+C;AAC/C,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,WAAW,CAAC;AAC5F,CAAC;AAED;;;wEAGwE;AACxE,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;6DAG6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,IAA+B;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;sFAOsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,QAAiB;IACzF,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,KAAK,GAAG,CAAC;IACxD,MAAM,iBAAiB,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IAC5E,MAAM,WAAW,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC;IAC/D,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC;QAChE,aAAa,EAAE,GAAG,CAAC,kBAAkB,KAAK,GAAG;QAC7C,WAAW,EAAE,GAAG,CAAC,eAAe,KAAK,GAAG;QACxC,OAAO,EAAE,GAAG,CAAC,WAAW,KAAK,GAAG;QAChC,0FAA0F;QAC1F,4CAA4C;QAC5C,KAAK,EAAE,GAAG,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC;QACnF,YAAY,EAAE,iBAAiB,IAAI,WAAW;QAC9C,iBAAiB;QACjB,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/server/checkout-progress.d.ts

@@ -0,0 +1,10 @@
+import type { CheckoutProgressEvent } from '../contract/index.js';
+/** Recovery cache for the clone and new-project dialogs, never an authority for the mutation's result. */
+export declare class CheckoutProgressCache {
+    private readonly now;
+    private readonly values;
+    constructor(now?: () => number);
+    private prune;
+    record(progress: CheckoutProgressEvent): void;
+    get(id: string): CheckoutProgressEvent | null;
+}

package/dist/server/checkout-progress.js

@@ -0,0 +1,27 @@
+/** Recovery cache for the clone and new-project dialogs, never an authority for the mutation's result. */
+export class CheckoutProgressCache {
+    now;
+    values = new Map();
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    prune() {
+        for (const [key, value] of this.values)
+            if (this.now() - value.at >= 5 * 60_000)
+                this.values.delete(key);
+    }
+    record(progress) {
+        if (!progress.checkoutId)
+            return;
+        this.prune();
+        this.values.delete(progress.checkoutId);
+        this.values.set(progress.checkoutId, { at: this.now(), progress: { ...progress, ...(progress.line ? { line: progress.line.slice(-4096) } : {}), ...(progress.error ? { error: progress.error.slice(-4096) } : {}), ...(progress.warning ? { warning: progress.warning.slice(0, 4096) } : {}) } });
+        while (this.values.size > 128)
+            this.values.delete(this.values.keys().next().value);
+    }
+    get(id) {
+        this.prune();
+        return this.values.get(id)?.progress ?? null;
+    }
+}
+//# sourceMappingURL=checkout-progress.js.map

package/dist/server/checkout-progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-progress.js","sourceRoot":"","sources":["../../src/server/checkout-progress.ts"],"names":[],"mappings":"AAEA,0GAA0G;AAC1G,MAAM,OAAO,qBAAqB;IAEH,GAAG;IADf,MAAM,GAAG,IAAI,GAAG,EAA2D,CAAC;IAC7F,YAA6B,GAAG,GAAG,IAAI,CAAC,GAAG;mBAAd,GAAG;IAAc,CAAC;IACvC,KAAK;QACX,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,CAAC,QAA+B;QACpC,IAAI,CAAC,QAAQ,CAAC,UAAU;YAAE,OAAO;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClS,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;IACtF,CAAC;IACD,GAAG,CAAC,EAAU;QACZ,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC/C,CAAC;CACF"}

package/dist/server/checkout.d.ts

@@ -10,6 +10,8 @@ export interface CheckoutProgressEvent {
     line?: string;
     /** Human-readable failure (present on `error`). */
     error?: string;
+    /** New-project flow only: on `done`, what did not finish (see `create-project.ts`). */
+    warning?: string;
 }
 export type CheckoutFailure = {
     ok: false;
@@ -68,24 +70,9 @@ export declare function parseRepoRef(input: string): RepoRef | null;
  */
 export declare function isValidCheckoutName(name: string): boolean;
 /**
- * Delete a partially-cloned checkout — the ONE destructive path in this module.
- *
- * Called only after `mkdir(target)` (non-recursive, so it succeeded only
- * because the directory did not exist and WE created it). Even with that proof
- * in hand, every one of these must hold or nothing is deleted:
- *
- * - `target` is still a real directory and NOT a symlink (`lstat`, not `stat`):
- *   between the mkdir and the failure, the directory could have been swapped
- *   for a link pointing anywhere.
- * - `projectsDir` and `target` both resolve (`realpath`), and the resolved
- *   target's PARENT is exactly the resolved checkout root. That is strict
- *   containment (nothing outside the root) *and* a depth limit (a direct child
- *   only, never the root itself, never a nested path).
- *
- * Any surprise — a vanished path, an unresolvable root, a `rm` that fails —
- * leaves the directory alone. Leaving a stray folder is a nuisance; deleting
- * the wrong one is unrecoverable, so every ambiguous case resolves toward "do
- * nothing".
+ * Remove only an attempt-owned real directory whose canonical parent is the checkout root.
+ * Refuse symlinks, the root itself and uncertain paths. Return false on any check or removal
+ * failure.
  */
 export declare function cleanupCheckout(projectsDir: string, target: string): Promise<boolean>;
 /** Injected so the tests can drive a fake clone without a network or a `gh`
@@ -100,6 +87,10 @@ export type CloneRunner = (ref: RepoRef, dir: string, onLine: (line: string) =>
 /** Kept pure so the SAML-safe transport choice is pinned without spawning a
  * real GitHub process in the unit suite. */
 export declare function ghCloneArgs(ref: RepoRef, dir: string): string[];
+/** PR #968: the `git config --local` argument lists that route github.com HTTPS
+ *  credentials through `gh`. Reset inherited helpers first, as gh setup-git does.
+ *  Shared with the new-project flow (`create-project.ts`). */
+export declare const GH_CREDENTIAL_HELPER_CONFIG: readonly (readonly string[])[];
 /**
  * `gh repo clone <validated HTTPS URL> <dir> -- --progress`.
  *
@@ -125,7 +116,7 @@ export interface CheckoutOptions {
     checkoutId?: string | undefined;
     signal?: AbortSignal | undefined;
     /** Test seam; defaults to `gh` (or the dry-run fake under `CEZ_DRY_RUN=1`). */
-    run?: CloneRunner;
+    run?: CloneRunner | undefined;
 }
 /**
  * Clone a GitHub repo into `<projectsDir>/<name>`, streaming progress.

package/dist/server/checkout.js

@@ -2,28 +2,9 @@ import { execFile, spawn } from 'node:child_process';
 import { lstat, mkdir, realpath, rm, writeFile } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
 /**
- * `POST /api/projects/checkout` — the "Add project → Clone from GitHub" flow
- * (spec 2026-07-20-multi-project-workspace, step 4.3).
- *
- * The route itself (server.ts) owns the registry write; this module owns the
- * only two things that are genuinely dangerous about cloning on the operator's
- * behalf:
- *
- * 1. **Where the clone lands.** The target is always `<projectsDir>/<name>`
- *    with `name` a single, boring path segment. It is never a nested path,
- *    never `..`, never absolute — the checkout root is a root, not a starting
- *    point for traversal.
- * 2. **What cleanup may delete.** A failed clone must not leave a half-written
- *    directory behind (a later attempt would trip over it, and registering it
- *    would put a broken project in the sidebar). But "rm -rf the target" is a
- *    destructive path reached by a *network failure*, so it is guarded as
- *    tightly as `fs-browse.ts` guards containment — see `cleanupCheckout`.
- *
- * The load-bearing trick for (2) is that the target directory is created HERE,
- * with a non-recursive `mkdir`, before `gh` ever runs. That single syscall is
- * both the atomic existence check (EEXIST ⇒ 409, and we never touched what was
- * there) and the proof of ownership that authorizes cleanup: we only ever
- * delete a directory this operation is known to have created.
+ * Clone into one validated direct child of projectsDir. Reserve the directory with non-recursive
+ * mkdir before cloning; only guarded cleanup may remove a failed attempt. The route owns
+ * registration.
  */
 /** How long a clone may run before it is killed. Long enough for a large repo
  *  on a slow link, short enough that a hung `gh` (an auth prompt that will
@@ -93,24 +74,9 @@ export function isValidCheckoutName(name) {
     return name.length <= 128 && NAME_SEGMENT.test(name) && !name.includes('/') && !name.includes('\\');
 }
 /**
- * Delete a partially-cloned checkout — the ONE destructive path in this module.
- *
- * Called only after `mkdir(target)` (non-recursive, so it succeeded only
- * because the directory did not exist and WE created it). Even with that proof
- * in hand, every one of these must hold or nothing is deleted:
- *
- * - `target` is still a real directory and NOT a symlink (`lstat`, not `stat`):
- *   between the mkdir and the failure, the directory could have been swapped
- *   for a link pointing anywhere.
- * - `projectsDir` and `target` both resolve (`realpath`), and the resolved
- *   target's PARENT is exactly the resolved checkout root. That is strict
- *   containment (nothing outside the root) *and* a depth limit (a direct child
- *   only, never the root itself, never a nested path).
- *
- * Any surprise — a vanished path, an unresolvable root, a `rm` that fails —
- * leaves the directory alone. Leaving a stray folder is a nuisance; deleting
- * the wrong one is unrecoverable, so every ambiguous case resolves toward "do
- * nothing".
+ * Remove only an attempt-owned real directory whose canonical parent is the checkout root.
+ * Refuse symlinks, the root itself and uncertain paths. Return false on any check or removal
+ * failure.
  */
 export async function cleanupCheckout(projectsDir, target) {
     let realRoot;
@@ -147,14 +113,18 @@ export function ghCloneArgs(ref, dir) {
     return ['repo', 'clone', ref.cloneUrl, dir, '--', '--progress',
         '--config', 'url.https://github.com/.insteadOf=git@github.com:'];
 }
+/** PR #968: the `git config --local` argument lists that route github.com HTTPS
+ *  credentials through `gh`. Reset inherited helpers first, as gh setup-git does.
+ *  Shared with the new-project flow (`create-project.ts`). */
+export const GH_CREDENTIAL_HELPER_CONFIG = [
+    ['--replace-all', 'credential.https://github.com.helper', ''],
+    ['--add', 'credential.https://github.com.helper', '!gh auth git-credential'],
+];
 /** PR #968: gh injects credentials only for the clone command. Persist the
  * helper locally so subsequent raw git pushes (including task worktrees) use
- * the same OAuth grant. Reset inherited helpers first, as gh setup-git does. */
+ * the same OAuth grant. */
 async function persistGhCredentialHelper(dir) {
-    for (const args of [
-        ['--replace-all', 'credential.https://github.com.helper', ''],
-        ['--add', 'credential.https://github.com.helper', '!gh auth git-credential'],
-    ]) {
+    for (const args of GH_CREDENTIAL_HELPER_CONFIG) {
         const ok = await new Promise((resolvePromise) => {
             execFile('git', ['-C', dir, 'config', '--local', ...args], { timeout: 10_000 }, (err) => resolvePromise(!err));
         });