gitbroker 0.7.1 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d89c372f196a3cd8b81d057f63c8abcdafa765585fcde6abaa15dd8ec81c48bf
-  data.tar.gz: 473d304e0ed3fe9bafc232490e4be505b17b12b09c2cebf6b194d2547b108203
+  metadata.gz: b20e2186e4b0e888878382bcced5b98530f92b642b69a1e20cab0add06301e58
+  data.tar.gz: 0da49468966d94932958c778386e432dd00b4feb9c0ee3e0432380100f472bf4
 SHA512:
-  metadata.gz: c0d446a0a798acb225933b1cd4c1f31c3425112ac025a2bc684b468e47bc57869b56f892683a4c278cbbb788ac5cd7f5f56fa8286671c98d160d115d72313c4c
-  data.tar.gz: 3914718aa114dfe375b4783dfe9c6d5e0408d43d319c013e400f4628912e15984f937417043409b6dfd9b3766cb2e6c3ed7f2a74ae678cc52813a35f57560f81
+  metadata.gz: 4515180233432eabd09be57c026794ca06c1141f82bb41da8097cc8b76d80e47464c6aaf6bd27216dcd3f580d3872b0287d333a9dea1dadcb0b86592eea745df
+  data.tar.gz: '09ec99fb2e88657b6b80a0eaccd37f62be01d84cdd3c4f1fd4814a2fb27425ee1610cae031bd37805b009c65ee731599f2b00dd5ca8d4fb653b6ef7ed6d6f431'

data/lib/gitbroker/agents/claude.rb

@@ -6,9 +6,17 @@ module Gitbroker
     # credit pool pays for it (spec §2). Terminal: interactive `claude`.
     class Claude < Base
       PLUGIN_DIR = File.join(Gitbroker::ROOT, "plugin")
+      # A bare `Read` in --allowedTools means every file on the machine, so a prompt-injected agent could read
+      # ~/.aws/credentials. `Read(./**)` is the worktree only (Grep and Glob follow Read rules), the settings flag makes
+      # the file tools refuse anything outside the working directory in every mode (a symlink out of the worktree
+      # included), and the deny rules name the usual secrets. Either of the first two alone was verified to block
+      # reads outside the worktree, in Read, Grep and Glob.
+      SECRET_PATHS = %w[Read(~/.ssh/**) Read(//**/.aws/**) Read(~/.gnupg/**) Read(~/.config/**) Read(~/.netrc)
+                        Read(~/.git-credentials) Read(//**/.env)].freeze
       READ_ONLY_ARGS = [ "--permission-mode", "dontAsk", "--permission-prompts", "none",
-                         "--allowedTools", "Read,Grep,Glob,mcp__gitbroker__*",
-                         "--disallowedTools", "Bash,Edit,Write,NotebookEdit,WebFetch,WebSearch" ].freeze
+                         "--allowedTools", "Read(./**),mcp__gitbroker__*",
+                         "--disallowedTools", [ *%w[Bash Edit Write NotebookEdit WebFetch WebSearch], *SECRET_PATHS ].join(","),
+                         "--settings", { permissions: { blockReadsOutsideWorkingDirectories: true } }.to_json ].freeze
       READS = %w[Read NotebookRead].freeze
       EDITS = %w[Edit MultiEdit Write NotebookEdit].freeze
 

data/lib/gitbroker/cli.rb

@@ -26,7 +26,7 @@ module Gitbroker
                                             "Start companion" handler (`start` does this when needed)
         install-skill                       Install the gitbroker skills into ~/.claude/skills
         status                              Show pairing, configuration and the repositories found
-        clean                               Remove finished agent worktrees (keeps ones with uncommitted work)
+        clean                               Remove finished agent worktrees and stop their leftover processes (keeps worktrees with uncommitted work)
         install-hooks [--yes]               Show your own Claude Code sessions on your cards (asks first)
         uninstall-hooks                     Remove those hooks
         help                                Show this help
@@ -261,6 +261,8 @@ module Gitbroker
     # `git worktree remove` without --force refuses a worktree with modified or untracked files, so work is never lost.
     def clean
       worktree = Worktree.new(root: config.worktree_root)
+      stopped = Reaper.new(root: config.worktree_root).sweep!
+      @out.puts "Stopped #{stopped} leftover process#{"es" unless stopped == 1} (rubocop --server and the like)." if stopped.positive?
       worktree.list.each do |dir|
         git_dir = GitContext.git_dir(dir)
         repo_path = git_dir && File.dirname(GitContext.common_dir(git_dir))

data/lib/gitbroker/daemon.rb

@@ -25,8 +25,8 @@ module Gitbroker
 
       new(scanner: config.repo_scanner, roots_changed: roots_changed(config), device_roots: config.device_roots, ignored_roots: config.ignored_roots,
           client_factory: -> { CableClient.new(url: config.cable_url, token: config.device_token, origin: config.server) },
-          task_runner_factory: ->(report) { TaskRunner.new(config:, report:, out:) }, out:, relay:, process_scanner:,
-          lifecycle: Lifecycle.new(dir: config.dir, server: config.server))
+          task_runner_factory: ->(report) { TaskRunner.new(config:, report:, out:) }, out:, relay:, process_scanner:, agent: config.agent,
+          lifecycle: Lifecycle.new(dir: config.dir, server: config.server), reaper: Reaper.new(root: config.worktree_root))
     end
 
     # The server's "roots" message: remember the folders in config.yml (so they survive a restart without the server) and
@@ -54,7 +54,7 @@ module Gitbroker
 
     def initialize(scanner:, client_factory:, task_runner_factory:, out: $stdout, sleeper: ->(seconds) { sleep(seconds) },
                    clock: -> { Time.now }, spawner: ->(&block) { Thread.new(&block) }, relay: nil, process_scanner: nil, lifecycle: nil,
-                   maintenance: Maintenance.new, roots_changed: nil, device_roots: [], ignored_roots: [])
+                   maintenance: Maintenance.new, roots_changed: nil, device_roots: [], ignored_roots: [], agent: "claude", reaper: nil)
       @scanner = scanner
       @device_roots = device_roots
       @ignored_roots = ignored_roots
@@ -69,6 +69,8 @@ module Gitbroker
       @process_scanner = process_scanner
       @lifecycle = lifecycle
       @maintenance = maintenance
+      @agent = agent
+      @reaper = reaper
       @repositories = []
       @running = Set.new
       @running_lock = Mutex.new
@@ -79,6 +81,7 @@ module Gitbroker
       @rejections = 0
       @relay&.start
       @lifecycle&.write_pid
+      sweep_strays
       until @stopping
         begin
           @client = @client_factory.call
@@ -121,7 +124,7 @@ module Gitbroker
         @rejections = 0
         rescan(client)
         client.perform("hello", "version" => VERSION, "platform" => Gitbroker.platform,
-                                "service" => @lifecycle ? @lifecycle.service_installed? : false)
+                                "service" => @lifecycle ? @lifecycle.service_installed? : false, "agent" => @agent)
         @out.puts "Connected. #{@repositories.size} repositories reported."
       end
       client.on_tick do
@@ -259,7 +262,16 @@ module Gitbroker
       ensure
         upgrade_now = @running_lock.synchronize { @running.delete(id) && @pending_upgrade && @running.empty? }
         upgrade if upgrade_now
+        sweep_strays
       end
     end
+
+    # Helpers an agent left in worktrees nobody works in (rubocop --server and the like). Only while no task runs here.
+    def sweep_strays
+      return unless @reaper && @running_lock.synchronize { @running.empty? }
+
+      stopped = @reaper.sweep!
+      @out.puts "Stopped #{stopped} leftover process#{"es" unless stopped == 1} in finished task worktrees." if stopped.positive?
+    end
   end
 end

data/lib/gitbroker/process_scanner.rb

@@ -44,6 +44,22 @@ module Gitbroker
       running + exited
     end
 
+    # pid => cwd for the given pids (lsof on macOS, /proc on Linux); a pid that vanished is left out.
+    def working_dirs(pids)
+      return {} if pids.empty?
+      return pids.to_h { [ _1, proc_cwd(_1) ] }.compact if @platform == "linux"
+
+      cwds = {}
+      pid = nil
+      @runner.capture("lsof", "-a", "-d", "cwd", "-Fn", "-p", pids.sort.join(",")).each_line do |line|
+        case line[0]
+        when "p" then pid = line[1..].to_i
+        when "n" then cwds[pid] = line[1..].chomp if pid
+        end
+      end
+      cwds
+    end
+
     private
 
     # { "proc-<pid>" => { agent:, context: } }, one per (agent, cwd), only in GitHub checkouts outside `exclude`.
@@ -79,21 +95,6 @@ module Gitbroker
       {}
     end
 
-    def working_dirs(pids)
-      return {} if pids.empty?
-      return pids.to_h { [ _1, proc_cwd(_1) ] }.compact if @platform == "linux"
-
-      cwds = {}
-      pid = nil
-      @runner.capture("lsof", "-a", "-d", "cwd", "-Fn", "-p", pids.sort.join(",")).each_line do |line|
-        case line[0]
-        when "p" then pid = line[1..].to_i
-        when "n" then cwds[pid] = line[1..].chomp if pid
-        end
-      end
-      cwds
-    end
-
     def proc_cwd(pid)
       File.readlink(File.join(@proc_root, pid.to_s, "cwd"))
     rescue SystemCallError

data/lib/gitbroker/reaper.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+module Gitbroker
+  # Stops the processes an agent leaves behind in a task worktree. Tools such as `rubocop --server`, spring or a language
+  # server detach from the agent (their parent becomes launchd/init), so they outlive it and its process group, keep the
+  # worktree as their working directory and pile up for days. Only processes whose working directory is inside the
+  # worktree root are ever touched, and only by pid: a process is never found by name or killed by group.
+  class Reaper
+    GRACE = 3
+    POLL = 0.1
+    INIT = /\A(?:\S*\/)?(?:systemd|launchd)\b/
+
+    def initialize(root:, runner: Runner.new, platform: Gitbroker.platform, proc_root: "/proc", grace: GRACE,
+                   signal: Process.method(:kill), sleeper: ->(seconds) { sleep(seconds) })
+      @root = real(root)
+      @runner = runner
+      @scanner = ProcessScanner.new(runner:, platform:, proc_root:)
+      @grace = grace
+      @signal = signal
+      @sleeper = sleeper
+    end
+
+    # A task ended in `dir`: whatever still runs there is a stray. Returns how many processes were stopped.
+    def reap!(dir)
+      dir = real(dir)
+      return 0 unless inside?(dir, @root)
+
+      stop(processes.select { inside?(_1[:cwd], dir) }.map { _1[:pid] })
+    rescue Error, SystemCallError
+      0
+    end
+
+    # Worktrees nobody works in (no agent process inside): their orphaned helpers are strays. A worktree with a live
+    # agent (a terminal run the user is still in) is left alone. Call it only when no task is running here.
+    def sweep!
+      pids = processes.group_by { worktree_of(_1[:cwd]) }.flat_map do |dir, inside|
+        next [] if dir.nil? || inside.any? { ProcessScanner.agent_for(_1[:args]) }
+
+        inside.select { _1[:orphan] }.map { _1[:pid] }
+      end
+      stop(pids)
+    rescue Error, SystemCallError
+      0
+    end
+
+    private
+
+    # [{ pid:, args:, cwd:, orphan: }] for every process with a working directory under the worktree root.
+    def processes
+      table = @runner.run!("ps", "-Ao", "pid=,ppid=,args=").lines.filter_map do |line|
+        pid, ppid, args = line.strip.split(" ", 3)
+        next unless pid.to_s.match?(/\A\d+\z/) && ppid.to_s.match?(/\A\d+\z/) && pid.to_i > 1 && pid.to_i != Process.pid
+
+        { pid: pid.to_i, ppid: ppid.to_i, args: args.to_s }
+      end
+      args_of = table.to_h { [ _1[:pid], _1[:args] ] }
+      cwds = @scanner.working_dirs(table.map { _1[:pid] })
+      table.filter_map do |process|
+        cwd = cwds[process[:pid]]
+        next unless cwd && inside?(cwd, @root)
+
+        process.merge(cwd:, orphan: process[:ppid] == 1 || args_of[process[:ppid]].to_s.match?(INIT))
+      end
+    end
+
+    # <root>/<owner>-<repo>/pr-<n>-<kind>, whatever depth the process is working at.
+    def worktree_of(cwd)
+      return unless cwd.start_with?("#{@root}/")
+
+      owner_repo, pr = cwd.delete_prefix("#{@root}/").split("/", 3).first(2)
+      File.join(@root, owner_repo, pr) if pr
+    end
+
+    def stop(pids)
+      pids = pids.uniq.select { deliver("TERM", _1) }
+      return 0 if pids.empty?
+
+      (@grace / POLL).ceil.times do
+        break if pids.none? { alive?(_1) }
+
+        @sleeper.call(POLL)
+      end
+      pids.each { deliver("KILL", _1) if alive?(_1) }
+      pids.size
+    end
+
+    def deliver(name, pid)
+      @signal.call(name, pid)
+      true
+    rescue SystemCallError
+      false
+    end
+
+    def alive?(pid)
+      @signal.call(0, pid)
+      true
+    rescue Errno::EPERM
+      true
+    rescue SystemCallError
+      false
+    end
+
+    def inside?(path, dir) = path == dir || path.start_with?("#{dir}/")
+
+    def real(path)
+      File.realpath(path)
+    rescue SystemCallError
+      File.expand_path(path)
+    end
+  end
+end

data/lib/gitbroker/task_runner.rb

@@ -16,7 +16,8 @@ module Gitbroker
 
     def initialize(config:, report:, worktree: Worktree.new(root: config.worktree_root), neutralizer: Neutralizer.new,
                    gh_check: GhCheck.new, launcher: Launcher.new(name: config.terminal), out: $stdout, grace: CANCEL_GRACE,
-                   progress_interval: PROGRESS_INTERVAL, run_script: RunScript.new(state_dir: config.state_dir))
+                   progress_interval: PROGRESS_INTERVAL, run_script: RunScript.new(state_dir: config.state_dir),
+                   reaper: Reaper.new(root: config.worktree_root))
       @config = config
       @report = report
       @worktree = worktree
@@ -27,6 +28,7 @@ module Gitbroker
       @grace = grace
       @progress_interval = progress_interval
       @run_script = run_script
+      @reaper = reaper
       @handles = {}
       @running = Set.new
       @cancelled = Set.new
@@ -74,6 +76,8 @@ module Gitbroker
         ensure
           files.cleanup!
         end
+        stopped = @reaper.reap!(dir)
+        say(id, "Stopped #{stopped} leftover process#{"es" unless stopped == 1} in #{dir}") if stopped.positive?
         if @worktree.remove!(dir, repo_path:)
           say(id, "Removed worktree #{dir}")
         else

data/lib/gitbroker/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Gitbroker
-  VERSION = "0.7.1"
+  VERSION = "0.8.0"
 end

data/lib/gitbroker.rb

@@ -34,6 +34,7 @@ module Gitbroker
   autoload :Login, File.expand_path("gitbroker/login", __dir__)
   autoload :Neutralizer, File.expand_path("gitbroker/neutralizer", __dir__)
   autoload :ProcessScanner, File.expand_path("gitbroker/process_scanner", __dir__)
+  autoload :Reaper, File.expand_path("gitbroker/reaper", __dir__)
   autoload :RepoScanner, File.expand_path("gitbroker/repo_scanner", __dir__)
   autoload :RunScript, File.expand_path("gitbroker/run_script", __dir__)
   autoload :Runner, File.expand_path("gitbroker/runner", __dir__)

data/plugin/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "gitbroker",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "Skills for working on Git Broker agent tasks: the gitbroker MCP tools, write rules and report_task."
 }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitbroker
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.8.0
 platform: ruby
 authors:
 - Yuri Sidorov (@newstler)
@@ -58,6 +58,7 @@ files:
 - lib/gitbroker/maintenance.rb
 - lib/gitbroker/neutralizer.rb
 - lib/gitbroker/process_scanner.rb
+- lib/gitbroker/reaper.rb
 - lib/gitbroker/repo_scanner.rb
 - lib/gitbroker/run_script.rb
 - lib/gitbroker/runner.rb