@ai-dev-methodologies/rlp-desk 0.11.1 → 0.12.0

package/src/node/cli/command-builder.mjs

@@ -1,3 +1,6 @@
+import { shellQuote } from '../util/shell-quote.mjs';
+import { OPUS_1M_BETA, isOpusModel } from '../constants.mjs';
+
 const CLAUDE_BIN = 'claude';
 const CODEX_BIN = 'codex';
 const CLAUDE_MODELS = new Set(['haiku', 'sonnet', 'opus']);
@@ -11,19 +14,36 @@ function assertTuiMode(mode, builderName) {
 export function buildClaudeCmd(mode, model, options = {}) {
   assertTuiMode(mode, 'buildClaudeCmd');
 
-  const parts = [
-    'DISABLE_OMC=1',
+  // v5.7 §4.9: auto-enable 1M-token context for Opus models. Long campaigns
+  // no longer silently truncate at 200K. Header is benign for non-Opus calls
+  // but we omit it there to keep the cmdline tidy.
+  const parts = ['DISABLE_OMC=1'];
+  if (isOpusModel(model)) {
+    parts.push(`ANTHROPIC_BETA=${shellQuote(OPUS_1M_BETA)}`);
+  }
+  parts.push(
     CLAUDE_BIN,
     '--model',
-    model,
+    shellQuote(model),
     '--mcp-config',
     '\'{"mcpServers":{}}\'',
     '--strict-mcp-config',
     '--dangerously-skip-permissions',
-  ];
+  );
+
+  // v5.7 §4.11.a: explicit --add-dir whitelist. With --dangerously-skip-permissions
+  // alone, claude CLI still surfaces TUI prompts for cwd-adjacent paths in some
+  // versions. Add the home rlp-desk tree (where Leader writes registry.jsonl
+  // and reads governance docs) plus the campaign cwd, so Worker has full
+  // authorized access without prompts.
+  if (options.addDirs && Array.isArray(options.addDirs)) {
+    for (const dir of options.addDirs) {
+      if (dir) parts.push('--add-dir', shellQuote(dir));
+    }
+  }
 
   if (options.effort !== undefined && options.effort !== '') {
-    parts.push('--effort', options.effort);
+    parts.push('--effort', shellQuote(options.effort));
   }
 
   return parts.join(' ');

package/src/node/constants.mjs

@@ -0,0 +1,19 @@
+// Shared runtime constants. Single-source for cross-module values.
+
+// Anthropic Claude API beta header that activates the 1M-token context window
+// for Opus models. Auto-prepended to every claude CLI invocation that uses
+// --model opus so long campaigns no longer silently truncate at 200K.
+//
+// Docs: https://docs.anthropic.com/en/docs/build-with-claude/context-windows
+// (search "1M context") — header rotates with each beta phase.
+export const OPUS_1M_BETA = 'context-1m-2025-08-07';
+
+// Model id that triggers Opus 1M auto-enable. Plain string match against the
+// --model value (post-shellQuote stripping). Bracketed form
+// 'claude-opus-4-7[1m]' is also Opus and benefits from this; pattern match
+// covers both.
+export function isOpusModel(model) {
+  if (!model) return false;
+  const m = String(model).toLowerCase();
+  return m === 'opus' || m.startsWith('claude-opus-');
+}

package/src/node/polling/signal-poller.mjs

@@ -3,6 +3,8 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { setTimeout as delay } from 'node:timers/promises';
 
+import { autoDismissPrompts } from '../runner/prompt-dismisser.mjs';
+
 const execFileAsync = promisify(execFile);
 const SHELL_COMMANDS = new Set(['', 'zsh', 'bash', 'sh']);
 
@@ -13,6 +15,35 @@ export class TimeoutError extends Error {
   }
 }
 
+// v5.7 §4.17 (Node parity): default-No prompt detected while polling. Caller
+// must write a BLOCKED `infra_failure` sentinel and abort — never auto-Enter,
+// never wait silently for the human.
+export class PromptBlockedError extends Error {
+  constructor(message, info = {}) {
+    super(message);
+    this.name = 'PromptBlockedError';
+    this.paneId = info.paneId;
+    this.category = info.category ?? 'infra_failure';
+    this.reason = info.reason ?? message;
+  }
+}
+
+// v5.7 §4.22 (E2E real-claude-CLI finding): Worker process exited (back to
+// shell prompt) but no signal/done-claim file was written. fresh-context +
+// file-based architecture is broken — Leader has no way to know what Worker
+// did. zsh runner has `handle_worker_exit_claude` for this; Node leader did
+// not. Throw a specific error so the campaign loop can write BLOCKED with a
+// descriptive reason instead of silent iter-timeout.
+export class WorkerExitedError extends Error {
+  constructor(message, info = {}) {
+    super(message);
+    this.name = 'WorkerExitedError';
+    this.paneId = info.paneId;
+    this.category = info.category ?? 'infra_failure';
+    this.reason = info.reason ?? message;
+  }
+}
+
 async function defaultReadFile(filePath) {
   return fs.readFile(filePath, 'utf8');
 }
@@ -29,6 +60,28 @@ async function defaultGetPaneCommand(paneId) {
   return stdout.trim();
 }
 
+async function defaultCapturePane(paneId) {
+  // v5.7 §4.21 (E2E real-claude-CLI finding): claude v2.x trust prompt is
+  // ~30+ lines tall when the pane wraps narrowly. -S -10 missed the question
+  // header ("Quick safety check / Is this a project you trust?") so PROMPT_RE
+  // never matched and the unknown-prompt fast-fail BLOCKed instead of
+  // auto-dismissing. -50 covers the full prompt with margin for typical
+  // pane heights.
+  const { stdout } = await execFileAsync('tmux', [
+    'capture-pane',
+    '-t',
+    paneId,
+    '-p',
+    '-S',
+    '-50',
+  ]);
+  return stdout;
+}
+
+async function defaultSendKeys(paneId, key) {
+  await execFileAsync('tmux', ['send-keys', '-t', paneId, key]);
+}
+
 function isMissingFileError(error) {
   return error?.code === 'ENOENT';
 }
@@ -71,11 +124,41 @@ export async function pollForSignal(
     timeoutMs = 5000,
     readFile = defaultReadFile,
     getPaneCommand = defaultGetPaneCommand,
+    capturePane = defaultCapturePane,
+    sendKeys = defaultSendKeys,
+    log = () => {},
   } = {},
 ) {
   const deadline = Date.now() + timeoutMs;
+  let pendingBlock = null;
+  // v5.7 §4.22: track whether the worker process was ever observed running.
+  // Used to detect "worker started, did some work, then exited without
+  // writing signal/done-claim" — fresh-context architecture violation.
+  let seenWorkerRunning = false;
 
   while (!deadlineExceeded(deadline)) {
+    // v5.7 §4.13.b: auto-dismiss mid-execution permission prompts before
+    // checking the signal file. Without this, Worker hangs on TUI prompts
+    // even with --dangerously-skip-permissions (Bug 4).
+    // v5.7 §4.17 (Node parity): default-No prompts must NOT be auto-Entered;
+    // they raise a PromptBlockedError so the caller writes BLOCKED and aborts.
+    if (paneId) {
+      await autoDismissPrompts(paneId, {
+        capturePane,
+        sendKeys,
+        log,
+        onDefaultNoBlock: (info) => {
+          pendingBlock = info;
+        },
+      }).catch(() => {});
+      if (pendingBlock) {
+        throw new PromptBlockedError(
+          `Default-No prompt on pane ${pendingBlock.paneId}: ${pendingBlock.reason}`,
+          pendingBlock,
+        );
+      }
+    }
+
     try {
       const rawContent = await readFile(signalFile);
       const parsed = JSON.parse(rawContent);
@@ -89,9 +172,42 @@ export async function pollForSignal(
       }
 
       return parsed;
-    } catch (error) {
-      if (!isMissingFileError(error) && !isJsonParseError(error)) {
-        throw error;
+    } catch (signalError) {
+      if (!isMissingFileError(signalError) && !isJsonParseError(signalError)) {
+        throw signalError;
+      }
+      // Signal file missing OR partial JSON. v5.7 §4.22: parity with zsh
+      // `handle_worker_exit_claude` — if Worker pane process is back to
+      // shell, the worker exited without writing artifacts. Stop polling
+      // immediately and surface a WorkerExitedError so the campaign loop
+      // can write BLOCKED with reason `worker_exited_without_artifacts`.
+      //
+      // IMPORTANT: only run the pane-exit check on ENOENT (signal file
+      // entirely missing). A SyntaxError means the file EXISTS but the
+      // Worker is mid-write (atomic-rename race) — checking pane state
+      // here would race against the imminent successful read. Skip the
+      // check; next iteration's read will succeed.
+      if (paneId && isMissingFileError(signalError)) {
+        try {
+          const currentCommand = await getPaneCommand(paneId);
+          if (SHELL_COMMANDS.has(currentCommand)) {
+            if (seenWorkerRunning) {
+              throw new WorkerExitedError(
+                `Worker pane ${paneId} exited (now '${currentCommand || 'shell'}') without writing signal at ${signalFile} — fresh-context contract violated`,
+                {
+                  paneId,
+                  category: 'infra_failure',
+                  reason: 'worker_exited_without_artifacts',
+                },
+              );
+            }
+          } else if (currentCommand) {
+            seenWorkerRunning = true;
+          }
+        } catch (commandError) {
+          if (commandError instanceof WorkerExitedError) throw commandError;
+          // Other tmux lookup errors: don't end the loop early.
+        }
       }
     }