@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/backends/cli-utils.js

@@ -1,6 +1,6 @@
 import { execFileSync, spawn } from "node:child_process";
 import { accessSync, constants, existsSync, readFileSync, unlinkSync } from "node:fs";
-import { delimiter, join } from "node:path";
+import { delimiter, join, normalize } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";
 /**
@@ -17,7 +17,15 @@ export async function runLineCommand(options) {
     const stdoutLines = [];
     const stderrLines = [];
     return await new Promise((resolve, reject) => {
-        const child = spawn(options.command, options.args, {
+        // Windows: resolve bare names via PATHEXT and route `.cmd`/`.bat` batch
+        // shims through an explicit, hand-escaped `cmd.exe` wrapper. POSIX is left
+        // exactly as-is. `win` is null when no rewrite is needed (POSIX always, or
+        // an unresolvable bare name that should ENOENT naturally). See
+        // {@link resolveWin32Invocation}.
+        const win = process.platform === "win32"
+            ? resolveWin32Invocation(options.command, options.args)
+            : null;
+        const child = spawn(win?.command ?? options.command, win?.args ?? options.args, {
             cwd: options.cwd,
             env: options.env,
             stdio: ["pipe", "pipe", "pipe"],
@@ -29,11 +37,14 @@ export async function runLineCommand(options) {
             // (`auth-recovery` device-auth/login flows go through bespoke
             // spawn calls, not this helper), so the new process-group identity
             // is invisible to them. Windows has no process groups; we rely on
-            // taskkill /T below to walk the parent-pid chain instead, and
-            // hide the helper console window so background CLI calls don't
-            // flash one on screen.
+            // taskkill /T below to walk the parent-pid chain instead (the chain
+            // includes the cmd.exe wrapper above), and hide the helper console
+            // window so background CLI calls don't flash one on screen.
             detached: process.platform !== "win32",
             windowsHide: true,
+            // The cmd.exe wrapper's args are already escaped for cmd.exe; tell Node
+            // not to re-quote them. Inert/false on POSIX and the direct-.exe path.
+            windowsVerbatimArguments: win?.windowsVerbatimArguments ?? false,
         });
         let timedOut = false;
         let settled = false;
@@ -191,10 +202,10 @@ export async function runLineCommand(options) {
  *   escalate to SIGKILL — without this, a Gemini subprocess (or a
  *   grandchild) that catches SIGTERM and is mid-network-call leaves
  *   `runLineCommand` hanging on `child.once("close")` indefinitely.
- *   Observed 2026-04-29: an 18m delegated_proxy.invoke that should have
- *   timed out at 240s (cli-utils.ts:99) because the abort signal landed
- *   but the gemini grandchild ignored SIGTERM until the upstream HTTP
- *   request unblocked.
+ *   Observed: a long-running delegated_proxy.invoke that should have
+ *   timed out at its abort deadline kept going because the gemini
+ *   grandchild ignored SIGTERM until the upstream HTTP request
+ *   unblocked.
  * - **Windows**: no process groups; `taskkill /T /F /PID <pid>` walks
  *   the parent-pid chain to terminate descendants. `/F` is forced
  *   because Windows console apps don't honor a graceful close — Node
@@ -209,10 +220,9 @@ export async function runLineCommand(options) {
  * stdio EOF arrives — so a surviving grandchild leaves runLineCommand's
  * Promise stuck indefinitely. Forcibly destroying our read ends EOFs the
  * readline interfaces locally so close fires as soon as the kernel reaps
- * the (already-SIGKILLed) parent. Observed 2026-05-01: 5×
- * delegated_proxy.invoke rows in the 10–18m range despite the 240s wall
- * clock — every one was Gemini's google-workspace extension grandchild
- * outliving the parent.
+ * the (already-SIGKILLed) parent. Observed: long-running
+ * delegated_proxy.invoke rows despite the wall-clock — Gemini's
+ * google-workspace extension grandchild outlives the parent.
  *
  * The fall-through to `child.kill("SIGTERM")` covers two narrow races:
  * (1) the process already exited between our pid check and the syscall,
@@ -308,7 +318,6 @@ function killTree(child) {
  * but if the child catches and ignores SIGTERM, escalate to SIGKILL after
  * `gracePeriodMs` so the parent's `child.once("close")` listener actually
  * fires. Same hang motivation as {@link killTree}'s SIGKILL escalation
- * (see file-history note for the 2026-04-29 18m delegated_proxy.invoke).
  *
  * Note on `subprocess.killed` semantics: Node sets `killed=true` as soon
  * as `child.kill()` *sends* a signal — even if the child ignores it. So
@@ -366,6 +375,116 @@ export function findExecutable(command) {
     }
     return null;
 }
+// ── Windows `.cmd`/`.bat` shim launching ─────────────────────────────────
+//
+// On Windows with Node ≥ 22, spawning a resolved `.cmd`/`.bat` with the
+// default `shell: false` throws EINVAL (the CVE-2024-27980 "BatBadBut"
+// mitigation), and spawning a bare command name never consults PATHEXT (throws
+// ENOENT). npm-installed CLIs ship exactly these batch shims (`codex.cmd`,
+// `gemini.cmd`, `npm.cmd`, …), so every Codex/Gemini turn, auth-recovery probe,
+// and in-dashboard CLI install/verify that flows through `runLineCommand`
+// would crash on a Windows host.
+//
+// We therefore (win32-only) resolve a bare name to its absolute shim via
+// `findExecutable()` and, when the target is a batch shim, launch it through an
+// explicit `cmd.exe /d /s /c` wrapper. The naive `shell: true` shortcut is
+// UNSAFE here: callers pass arbitrary LLM prompts as discrete argv elements,
+// and under `shell: true` Node hands the joined line to cmd.exe whose metachar
+// parsing (`%VAR%`, `&`, `|`, `<`, `>`, `^`, embedded `"`, newlines) is NOT
+// neutralized by Node's quoting — turning a crash into prompt corruption and a
+// command-injection surface. Instead we escape every element for cmd.exe
+// ourselves and pass the pre-escaped line with `windowsVerbatimArguments: true`
+// so Node does not re-quote on top.
+//
+// The escaping below is replicated faithfully from the battle-tested
+// `cross-spawn` package (MIT, v7.0.6) and https://qntm.org/cmd: each argument
+// is first made safe for the MS C runtime argv parser (backslash / double-
+// quote rules, using cross-spawn's ReDoS-hardened regexes — our args are
+// arbitrary LLM prompts), then cmd.exe metacharacters are caret-escaped. The
+// caret-escaping is applied a *second* time only for `node_modules/.bin/*.cmd`
+// shims, whose extra cmd.exe re-invocation layer consumes one level of escaping
+// (a plain global shim like `npm.cmd` must NOT be double-escaped or its args
+// would be corrupted).
+/** cmd.exe metacharacters (space included) that require caret-escaping. */
+const WIN_CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+/**
+ * Matches a `node_modules/.bin/<name>.cmd` shim — the only case that needs
+ * double-escaped metachars (mirrors cross-spawn's `isCmdShimRegExp`).
+ */
+const WIN_CMD_BIN_SHIM = /node_modules[\\/]\.bin[\\/][^\\/]+\.cmd$/i;
+function escapeCmdCommand(command) {
+    // Command path: caret-escape metachars (spaces included) but do NOT wrap in
+    // quotes — matches cross-spawn, which relies on caret-escaped spaces here.
+    return command.replace(WIN_CMD_META, "^$1");
+}
+function escapeCmdArgument(arg, doubleEscapeMetaChars) {
+    let s = `${arg}`;
+    // 1. MS C runtime argv quoting (qntm.org/cmd, ReDoS-hardened): double up a
+    //    backslash run that precedes a double quote and escape the quote; double
+    //    up a trailing run (it ends up before the closing quote); wrap in quotes.
+    s = s.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"').replace(/(?=(\\+?)?)\1$/, "$1$1");
+    s = `"${s}"`;
+    // 2. Caret-escape cmd.exe metachars; a second pass only for node_modules/.bin
+    //    shims (their extra cmd layer consumes one level of ^-escaping).
+    s = s.replace(WIN_CMD_META, "^$1");
+    if (doubleEscapeMetaChars) {
+        s = s.replace(WIN_CMD_META, "^$1");
+    }
+    return s;
+}
+/**
+ * Build the `cmd.exe` argv that launches a `.cmd`/`.bat` shim with the given
+ * arguments, fully escaped against cmd.exe re-parsing. Pure (no filesystem),
+ * exported for unit testing of the escaping. Pair with
+ * `windowsVerbatimArguments: true` so Node passes the line verbatim.
+ */
+export function buildCmdShimArgs(shimPath, args) {
+    const doubleEscape = WIN_CMD_BIN_SHIM.test(shimPath);
+    const line = [
+        escapeCmdCommand(shimPath),
+        ...args.map((a) => escapeCmdArgument(a, doubleEscape)),
+    ].join(" ");
+    return ["/d", "/s", "/c", `"${line}"`];
+}
+/**
+ * Windows-only spawn rewrite for {@link runLineCommand}. Returns the
+ * substitute `{ command, args, windowsVerbatimArguments }`, or `null` when no
+ * rewrite is needed (so the caller spawns the original command unchanged, and
+ * an unresolvable bare name still ENOENTs naturally as before).
+ *
+ * - Bare name → resolved to its absolute path via PATHEXT (`findExecutable`).
+ * - Resolved `.cmd`/`.bat` → launched through a hand-escaped
+ *   `cmd.exe /d /s /c` wrapper (verbatim args).
+ * - Resolved `.exe`/`.com`/extensionless → spawned directly (`shell:false` is
+ *   safe for these); the only change vs. today is bare-name → absolute
+ *   resolution, which also closes the bare-name PATHEXT ENOENT.
+ */
+export function resolveWin32Invocation(command, args) {
+    const hasPathSeparator = /[\\/]/.test(command);
+    // A pathed command is normalized (forward slashes → native, matching
+    // cross-spawn, which otherwise ENOENTs on posix-style paths); a bare name is
+    // resolved through PATH/PATHEXT.
+    const resolved = hasPathSeparator ? normalize(command) : findExecutable(command);
+    if (!resolved) {
+        // Unresolvable bare name: leave it to spawn so the ENOENT surfaces as the
+        // child "error" event exactly as it does today.
+        return null;
+    }
+    if (/\.(?:cmd|bat)$/i.test(resolved)) {
+        return {
+            command: process.env.ComSpec || "cmd.exe",
+            args: buildCmdShimArgs(resolved, args),
+            windowsVerbatimArguments: true,
+        };
+    }
+    if (resolved === command) {
+        // Already an absolute/pathed non-batch target; nothing to rewrite.
+        return null;
+    }
+    // Bare name resolved to an absolute .exe/.com (or extensionless): spawn it
+    // directly. Node's standard argv quoting is correct for non-batch targets.
+    return { command: resolved, args, windowsVerbatimArguments: false };
+}
 /**
  * Lazy CLI path resolver with TTL-based revalidation (roadmap §9.4).
  *
@@ -461,4 +580,3 @@ export function isPlausibleAnthropicApiKey(raw) {
     // charset but strict on the prefix to reject environmental garbage.
     return /^sk-ant-[A-Za-z0-9_-]{20,}$/.test(key);
 }
-//# sourceMappingURL=cli-utils.js.map

package/dist/core/backends/codex-core.d.ts

@@ -1,6 +1,6 @@
 import { type AgentResult, type BackendModel } from "@aitne/shared";
 import type { AgentConfig } from "../../config.js";
-import type { AgentExecuteParams, AgentResumeParams, AuthCheckResult, DelegatedTaskInvokeParams, DelegatedTaskResultRaw, DelegatedToolInvokeParams, DelegatedToolResult, IAgentCore, McpSessionContext, StagedAttachment, StreamCallbacks } from "../agent-core.js";
+import type { AgentExecuteParams, AgentResumeParams, AuthCheckResult, DelegatedTaskInvokeParams, DelegatedTaskResultRaw, DelegatedToolInvokeParams, DelegatedToolResult, IAgentCore, McpSessionContext, ReadSensitiveTokenManager, StagedAttachment, StreamCallbacks } from "../agent-core.js";
 import { PriceFetcher } from "./price-fetcher.js";
 export declare const CODEX_PROBE_TOOLS_PROMPT: string;
 export declare class CodexCore implements IAgentCore {
@@ -8,8 +8,20 @@ export declare class CodexCore implements IAgentCore {
     private readonly priceFetcher;
     readonly backendId: "codex";
     private readonly cliPathCache;
+    /** Legacy shared read token injected into the Codex subprocess env. */
+    private readToken;
+    /** Scoped token manager preferred over the legacy shared read token. */
+    private readTokenManager;
     private get cliPath();
     constructor(config: AgentConfig, priceFetcher?: PriceFetcher);
+    /** Set the per-daemon-boot read token for subprocess-local daemon API auth. */
+    setReadToken(token: string): void;
+    setReadTokenManager(manager: ReadSensitiveTokenManager): void;
+    /** Resolve the env-injected read token: per-scope token if a manager is wired,
+     *  otherwise the legacy shared token. Returns `undefined` when neither is set
+     *  (production wires both at startup via index.ts; tests typically wire neither).
+     */
+    private issueReadToken;
     private mcpContext;
     setMcpContext(context: McpSessionContext): void;
     private materializeMcp;
@@ -124,4 +136,3 @@ export declare const CODEX_ARGV_BUDGET_BYTES = 120000;
  * Pure function — unit-testable without a CLI subprocess.
  */
 export declare function buildCodexImageArgs(staged: StagedAttachment[] | undefined, budgetBytes: number): string[];
-//# sourceMappingURL=codex-core.d.ts.map