@adhdev/daemon-core 0.9.82-rc.49 → 0.9.82-rc.490

package/src/launch.ts

@@ -16,7 +16,16 @@
  * adhdev launch --workspace /path — Open specific workspace
  */
 
-import { execSync, spawn, spawnSync } from 'child_process';
+import { exec, spawn, spawnSync } from 'child_process';
+
+async function execQuiet(command: string, options: any = {}): Promise<string> {
+    return new Promise((resolve) => {
+        exec(command, options, (error, stdout) => {
+            if (error) return resolve('');
+            resolve(stdout.toString());
+        });
+    });
+}
 import * as net from 'net';
 import * as os from 'os';
 import * as path from 'path';
@@ -76,11 +85,11 @@ function getIdePathCandidates(ideId: string): string[] {
     return getProviderLoader().getIdePathCandidates(ideId);
 }
 
-function getMacAppProcessPids(ideId: string): number[] {
+async function getMacAppProcessPids(ideId: string): Promise<number[]> {
     const appPaths = getIdePathCandidates(ideId);
     if (appPaths.length === 0) return [];
     try {
-        const output = execSync('ps axww -o pid=,args=', {
+        const output = await execQuiet('ps axww -o pid=,args=', {
             encoding: 'utf-8',
             timeout: 3000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -91,8 +100,8 @@ function getMacAppProcessPids(ideId: string): number[] {
     }
 }
 
-function killMacAppPathProcesses(ideId: string, signal: NodeJS.Signals): boolean {
-    const pids = getMacAppProcessPids(ideId);
+async function killMacAppPathProcesses(ideId: string, signal: NodeJS.Signals): Promise<boolean> {
+    const pids = (await getMacAppProcessPids(ideId));
     let signalled = false;
     for (const pid of pids) {
         try {
@@ -163,49 +172,49 @@ export async function killIdeProcess(ideId: string): Promise<boolean> {
         if (plat === 'darwin' && appName) {
  // macOS: graceful quit via osascript
             try {
-                execSync(`osascript -e 'tell application "${escapeForAppleScript(appName)}" to quit' 2>/dev/null`, {
+                await execQuiet(`osascript -e 'tell application "${escapeForAppleScript(appName)}" to quit' 2>/dev/null`, {
                     timeout: 5000,
                 });
             } catch {
-                try { execSync(`pkill -x "${appName}" 2>/dev/null`, { timeout: 5000 }); } catch { }
+                try { await execQuiet(`pkill -x "${appName}" 2>/dev/null`, { timeout: 5000 }); } catch { }
             }
-            killMacAppPathProcesses(ideId, 'SIGTERM');
+            await killMacAppPathProcesses(ideId, 'SIGTERM');
         } else if (plat === 'win32' && winProcesses) {
  // Windows: taskkill for each process name
             for (const proc of winProcesses) {
                 try {
-                    execSync(`taskkill /IM "${proc}" /F 2>nul`, { timeout: 5000 });
+                    await execQuiet(`taskkill /IM "${proc}" /F 2>nul`, { timeout: 5000 });
                 } catch { }
             }
  // Process name may differ, so also try via WMIC
             try {
                 const exeName = winProcesses[0].replace('.exe', '');
-                execSync(`powershell -Command "Get-Process -Name '${exeName}' -ErrorAction SilentlyContinue | Stop-Process -Force"`, {
+                await execQuiet(`powershell -Command "Get-Process -Name '${exeName}' -ErrorAction SilentlyContinue | Stop-Process -Force"`, {
                     timeout: 10000,
                 });
             } catch { }
         } else {
-            try { execSync(`pkill -f "${ideId}" 2>/dev/null`); } catch { }
+            try { await execQuiet(`pkill -f "${ideId}" 2>/dev/null`); } catch { }
         }
 
  // Wait for process kill (max 15 seconds)
         for (let i = 0; i < 30; i++) {
             await new Promise(r => setTimeout(r, 500));
-            if (!isIdeRunning(ideId)) return true;
+            if (!(await isIdeRunning(ideId))) return true;
         }
 
  // Force terminate retry
         if (plat === 'darwin' && appName) {
-            try { execSync(`pkill -9 -x "${appName}" 2>/dev/null`, { timeout: 5000 }); } catch { }
-            killMacAppPathProcesses(ideId, 'SIGKILL');
+            try { await execQuiet(`pkill -9 -x "${appName}" 2>/dev/null`, { timeout: 5000 }); } catch { }
+            await killMacAppPathProcesses(ideId, 'SIGKILL');
         } else if (plat === 'win32' && winProcesses) {
             for (const proc of winProcesses) {
-                try { execSync(`taskkill /IM "${proc}" /F 2>nul`); } catch { }
+                try { await execQuiet(`taskkill /IM "${proc}" /F 2>nul`); } catch { }
             }
         }
 
         await new Promise(r => setTimeout(r, 2000));
-        return !isIdeRunning(ideId);
+        return !(await isIdeRunning(ideId));
 
     } catch {
         return false;
@@ -213,15 +222,15 @@ export async function killIdeProcess(ideId: string): Promise<boolean> {
 }
 
 /** Check if IDE process is running */
-export function isIdeRunning(ideId: string): boolean {
+export async function isIdeRunning(ideId: string): Promise<boolean> {
     const plat = os.platform();
 
     try {
         if (plat === 'darwin') {
             const appName = getMacAppIdentifiers()[ideId];
-            if (!appName) return getMacAppProcessPids(ideId).length > 0;
+            if (!appName) return (await getMacAppProcessPids(ideId)).length > 0;
             try {
-                const result = execSync(`pgrep -x "${appName}" 2>/dev/null`, {
+                const result = await execQuiet(`pgrep -x "${appName}" 2>/dev/null`, {
                     encoding: 'utf-8',
                     timeout: 3000,
                 });
@@ -229,7 +238,7 @@ export function isIdeRunning(ideId: string): boolean {
             } catch { }
 
             try {
-                const result = execSync(
+                const result = await execQuiet(
                     `osascript -e 'tell application "System Events" to count (every process whose name is "${escapeForAppleScript(appName)}")'`,
                     {
                         encoding: 'utf-8',
@@ -240,21 +249,21 @@ export function isIdeRunning(ideId: string): boolean {
                 if (Number.parseInt(result.trim() || '0', 10) > 0) return true;
             } catch { }
 
-            return getMacAppProcessPids(ideId).length > 0;
+            return (await getMacAppProcessPids(ideId)).length > 0;
         } else if (plat === 'win32') {
             const winProcesses = getWinProcessNames()[ideId];
             if (!winProcesses) return false;
  // Check each process name
             for (const proc of winProcesses) {
                 try {
-                    const result = execSync(`tasklist /FI "IMAGENAME eq ${proc}" /NH 2>nul`, { encoding: 'utf-8' });
+                    const result = await execQuiet(`tasklist /FI "IMAGENAME eq ${proc}" /NH 2>nul`, { encoding: 'utf-8' });
                     if (result.includes(proc)) return true;
                 } catch { }
             }
  // Also check via PowerShell (when tasklist cannot find)
             try {
                 const exeName = winProcesses[0].replace('.exe', '');
-                const result = execSync(
+                const result = await execQuiet(
                     `powershell -Command "(Get-Process -Name '${exeName}' -ErrorAction SilentlyContinue).Count"`,
                     { encoding: 'utf-8', timeout: 5000 }
                 );
@@ -262,7 +271,7 @@ export function isIdeRunning(ideId: string): boolean {
             } catch { }
             return false;
         } else {
-            const result = execSync(`pgrep -f "${ideId}" 2>/dev/null`, { encoding: 'utf-8' });
+            const result = await execQuiet(`pgrep -f "${ideId}" 2>/dev/null`, { encoding: 'utf-8' });
             return result.trim().length > 0;
         }
     } catch {
@@ -271,14 +280,14 @@ export function isIdeRunning(ideId: string): boolean {
 }
 
 /** Detect currently open workspace path */
-function detectCurrentWorkspace(ideId: string): string | undefined {
+async function detectCurrentWorkspace(ideId: string): Promise<string | undefined> {
     const plat = os.platform();
 
     if (plat === 'darwin') {
         try {
             const appName = getMacAppIdentifiers()[ideId];
             if (!appName) return undefined;
-            const result = execSync(
+            const result = await execQuiet(
                 `lsof -c "${appName}" 2>/dev/null | grep cwd | head -1 | awk '{print $NF}'`,
                 { encoding: 'utf-8', timeout: 3000 }
             );
@@ -392,8 +401,8 @@ export async function launchWithCdp(options: LaunchOptions = {}): Promise<Launch
     }
 
  // 4. Check if IDE is currently running
-    const alreadyRunning = isIdeRunning(targetIde.id);
-    const workspace = options.workspace || (alreadyRunning ? detectCurrentWorkspace(targetIde.id) : undefined);
+    const alreadyRunning = await isIdeRunning(targetIde.id);
+    const workspace = options.workspace || (alreadyRunning ? await detectCurrentWorkspace(targetIde.id) : undefined);
 
  // 5. If IDE is running, terminate it
     if (alreadyRunning) {

package/src/logging/async-batch-writer.ts

@@ -0,0 +1,55 @@
+import * as fs from 'fs';
+
+export class AsyncBatchWriter {
+    // Maps filePath -> string buffer
+    private static buffers: Map<string, string[]> = new Map();
+    private static writePromises: Map<string, Promise<void>> = new Map();
+    private static flushTimer: NodeJS.Timeout | null = null;
+
+    /**
+     * Queues data to be written to a file asynchronously in a batch.
+     */
+    public static write(filePath: string, data: string) {
+        let buf = this.buffers.get(filePath);
+        if (!buf) {
+            buf = [];
+            this.buffers.set(filePath, buf);
+        }
+        buf.push(data);
+
+        if (!this.flushTimer) {
+            this.flushTimer = setTimeout(() => {
+                this.flushTimer = null;
+                this.flushAll();
+            }, 50);
+        }
+    }
+
+    private static async flushAll() {
+        const entries = Array.from(this.buffers.entries());
+        this.buffers.clear();
+
+        for (const [filePath, buffer] of entries) {
+            const dataToWrite = buffer.join('');
+            
+            const doWrite = async () => {
+                try {
+                    const prevPromise = this.writePromises.get(filePath);
+                    if (prevPromise) await prevPromise;
+                    await fs.promises.appendFile(filePath, dataToWrite, { encoding: 'utf-8', mode: 0o600 });
+                } catch {
+                    // Logging must never create secondary failures or late console noise.
+                }
+            };
+
+            const writePromise = doWrite();
+            this.writePromises.set(filePath, writePromise);
+            
+            writePromise.finally(() => {
+                if (this.writePromises.get(filePath) === writePromise) {
+                    this.writePromises.delete(filePath);
+                }
+            });
+        }
+    }
+}

package/src/logging/command-log.ts

@@ -15,11 +15,13 @@ import * as path from 'path';
 import * as os from 'os';
 
 // ─── Config ──────────────────────────────────
-const LOG_DIR = process.platform === 'win32'
-    ? path.join(process.env.LOCALAPPDATA || process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'adhdev', 'logs')
-    : process.platform === 'darwin'
-        ? path.join(os.homedir(), 'Library', 'Logs', 'adhdev')
-        : path.join(os.homedir(), '.local', 'share', 'adhdev', 'logs');
+// Command history lives under the unified ADHDev home (~/.adhdev/logs/) next to
+// the daemon log, on every platform. Honor ADHDEV_CONFIG_DIR for isolated homes.
+// Keep this in sync with logger.ts LOG_DIR.
+const ADHDEV_HOME = process.env.ADHDEV_CONFIG_DIR && process.env.ADHDEV_CONFIG_DIR.trim()
+    ? process.env.ADHDEV_CONFIG_DIR.trim()
+    : path.join(os.homedir(), '.adhdev');
+const LOG_DIR = path.join(ADHDEV_HOME, 'logs');
 
 const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5MB
 const MAX_DAYS = 7;

package/src/logging/debug-config.ts

@@ -20,6 +20,26 @@ export interface DebugRuntimeConfig {
 const NORMAL_TRACE_BUFFER_SIZE = 200
 const DEV_TRACE_BUFFER_SIZE = 1000
 
+/**
+ * ALWAYS-ON trace categories. These bypass the `collectDebugTrace` master switch
+ * (and category selection) so they are collected in production daemons where
+ * `--trace` is unset. They exist so mesh completion diagnostics — the FSM-transition
+ * and completion-gate snapshots that explain an early / missing agent:generating_completed
+ * notification — are retrievable via mesh_read_debug (chat_debug_bundle) without asking
+ * an operator to relaunch the daemon with tracing on.
+ *
+ * SAFETY: only add a category here after confirming every record() call site for it
+ * carries a content-free payload (statuses, epochs, timestamps, deltas, lengths, roles,
+ * enum-like reasons — never transcript / prompt / bubble text). Always-on collection makes
+ * such payloads unconditional, so a content-bearing field would leak into the ring buffer
+ * in production.
+ */
+export const ALWAYS_ON_TRACE_CATEGORIES: readonly string[] = ['completion-gate', 'fsm-transition']
+
+export function isAlwaysOnTraceCategory(category?: string | null): boolean {
+  return !!category && ALWAYS_ON_TRACE_CATEGORIES.includes(category)
+}
+
 const DEFAULT_CONFIG: DebugRuntimeConfig = {
   logLevel: 'info',
   collectDebugTrace: false,
@@ -68,6 +88,11 @@ export function resetDebugRuntimeConfig(): void {
 
 export function shouldCollectTraceCategory(category?: string | null): boolean {
   const config = currentConfig
+  // Always-on categories are collected regardless of the collectDebugTrace master switch
+  // and regardless of any explicit traceCategories selection (they form a superset on top of
+  // whatever the operator requested), so an explicit --trace / --trace-categories run still
+  // includes them with its existing behavior unchanged.
+  if (isAlwaysOnTraceCategory(category)) return true
   if (!config.collectDebugTrace) return false
   if (!category) return true
   if (config.traceCategories.length === 0) return true

package/src/logging/debug-trace.ts

@@ -1,4 +1,4 @@
-import { getDebugRuntimeConfig, shouldCollectTraceCategory } from './debug-config.js'
+import { getDebugRuntimeConfig, isAlwaysOnTraceCategory, shouldCollectTraceCategory } from './debug-config.js'
 
 export type DebugTraceLevel = 'debug' | 'info' | 'warn' | 'error'
 
@@ -80,7 +80,12 @@ export function createDebugTraceStore(options: DebugTraceStoreOptions): DebugTra
 
   return {
     record(event: DebugTraceEvent): DebugTraceEntry | null {
-      if (!options.enabled) return null
+      // The store's `enabled` flag mirrors collectDebugTrace (set by configureDebugTraceStore),
+      // so it is false on a production daemon. Always-on categories must still land in the ring
+      // even then — otherwise the second gate here would swallow what shouldCollectTraceCategory
+      // just admitted. They share the same fixed-capacity buffer, so heavy always-on traffic can
+      // evict older opt-in entries; that is accepted (no separate ring).
+      if (!options.enabled && !isAlwaysOnTraceCategory(event.category)) return null
       const entry = createEntry(event)
       entries.push(entry)
       if (entries.length > capacity) {

package/src/logging/log-redactor.ts

@@ -0,0 +1,100 @@
+/**
+ * Log redactor — mask secrets before a raw daemon log line leaves the machine.
+ *
+ * Daemon logs can incidentally contain credentials: ADHDev API keys (adk_*),
+ * machine secrets (adm_*), provider keys (adp_*), bearer tokens, JWTs, TURN
+ * `username:credential` pairs, and `SECRET=...` style env dumps. The mesh
+ * `get_mesh_node_logs` command ships a log tail over P2P to the coordinator, so
+ * every line MUST pass through redactLogLine() first — otherwise a secret in a
+ * remote daemon's log is exfiltrated to whoever is driving the coordinator.
+ *
+ * Patterns are intentionally conservative: each masks the secret material while
+ * preserving enough surrounding shape that the line stays useful for debugging
+ * (e.g. `adk_••••1234`, `Bearer ••••redacted`). When in doubt, mask.
+ */
+
+const MASK = '••••redacted';
+
+/** Keep the last 4 chars of a token so logs stay correlatable without leaking it. */
+function maskKeepTail(token: string): string {
+    if (token.length <= 8) return MASK;
+    return `${MASK}${token.slice(-4)}`;
+}
+
+interface RedactionRule {
+    readonly name: string;
+    readonly pattern: RegExp;
+    readonly replace: (match: string, ...groups: string[]) => string;
+}
+
+// NOTE: order matters — more specific rules (key=value, Bearer, TURN) run before
+// the bare-token rules so the structured forms aren't half-masked by a greedy
+// generic rule.
+const RULES: RedactionRule[] = [
+    // `JWT_SECRET=...`, `TOKEN=...`, `API_KEY=...`, `password: ...` env/config dumps.
+    // Captures the key + delimiter and masks only the value.
+    {
+        name: 'key_value_secret',
+        pattern: /\b([A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL|CLIENT[_-]?SECRET)[A-Z0-9_]*)(\s*[:=]\s*)(["']?)([^\s"',;]+)\3/gi,
+        replace: (_m, key: string, delim: string, quote: string) => `${key}${delim}${quote}${MASK}${quote}`,
+    },
+    // Authorization: Bearer <token>
+    {
+        name: 'bearer_token',
+        pattern: /\b(Bearer\s+)([A-Za-z0-9._\-+/=]{8,})/g,
+        replace: (_m, prefix: string, token: string) => `${prefix}${maskKeepTail(token)}`,
+    },
+    // ADHDev credential prefixes: API key (adk_), machine secret (adm_), provider key (adp_).
+    {
+        name: 'adhdev_prefixed_secret',
+        pattern: /\b(ad[kmp]_)([A-Za-z0-9]{6,})/g,
+        replace: (_m, prefix: string, token: string) => `${prefix}${maskKeepTail(prefix + token)}`,
+    },
+    // JWT: three base64url segments separated by dots, header starts with eyJ.
+    {
+        name: 'jwt',
+        pattern: /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g,
+        replace: () => MASK,
+    },
+    // TURN credential: a long credential value following a `credential` key in
+    // any common shape — `credential: x`, `credential=x`, or `credential "x"`.
+    // Mask the credential value only, preserving the key + delimiter/quote.
+    {
+        name: 'turn_credential',
+        pattern: /\b(credential["']?\s*(?:[:=]\s*)?["']?)([^\s"',;]{6,})/gi,
+        replace: (_m, prefix: string) => `${prefix}${MASK}`,
+    },
+    // TURN REST username:credential of the form `<expiry-ts>:<base64hmac>`,
+    // where the hmac part is long base64. Mask the hmac.
+    {
+        name: 'turn_rest_pair',
+        pattern: /\b(\d{10,}:)([A-Za-z0-9+/]{20,}={0,2})\b/g,
+        replace: (_m, prefix: string) => `${prefix}${MASK}`,
+    },
+];
+
+/**
+ * Mask secrets in a single log line. Idempotent-ish: re-running over an
+ * already-masked line leaves the MASK token in place (it contains no secret
+ * shape). Never throws — a redaction failure must not crash the log path.
+ */
+export function redactLogLine(line: string): string {
+    if (!line) return line;
+    let out = line;
+    for (const rule of RULES) {
+        try {
+            out = out.replace(rule.pattern, rule.replace as (substring: string, ...args: any[]) => string);
+        } catch {
+            // A pathological line must never break log shipping — skip this rule.
+        }
+    }
+    return out;
+}
+
+/** Redact an array of log lines in place-safe fashion (returns a new array). */
+export function redactLogLines(lines: string[]): string[] {
+    return lines.map((line) => redactLogLine(line));
+}
+
+/** Exposed for tests/introspection: the rule names applied, in order. */
+export const LOG_REDACTION_RULE_NAMES: readonly string[] = RULES.map((r) => r.name);