@aiwg/cli 2026.10.0 → 2026.10.3

package/dist/src/mcp/tools/worker-shell-control.mjs

@@ -0,0 +1,258 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { setTimeout as delay } from 'node:timers/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { getPackageRoot } from '../../channel/manager.mjs';
+
+const execFileAsync = promisify(execFile);
+const uncertain = () => ({ termination: 'uncertain', exitCode: null });
+const unitProperties = ['LoadState', 'ActiveState', 'Result', 'ExecMainStatus', 'ExecMainCode', 'MainPID'];
+
+// tools/ stays at the package root in both source and dist layouts.
+function loadSystemdClientModule() {
+  return import(pathToFileURL(path.join(getPackageRoot(),
+    'tools/ralph-external/lib/systemd-client.mjs')).href);
+}
+
+/** Run systemctl through the canonical hardened boundary: the absolute client
+ * resolved from the conductor PATH with a loader-filtered environment
+ * (manager connection preserved, nothing else inherited). Throws when the
+ * client is unavailable so pollers retry until deadline/cancellation and
+ * stop/kill report `{ ok: false }` — a bare inherited-env `systemctl` is
+ * never executed. */
+async function execCanonicalSystemctl(exec, args, options) {
+  const { resolveSystemdClient, buildSystemdClientEnv } = await loadSystemdClientModule();
+  return exec(resolveSystemdClient('systemctl'), args,
+    { ...options, env: buildSystemdClientEnv({ envNames: [] }) });
+}
+
+/** Parse only explicit stop proof. Missing/unknown properties are observation
+ * failures, never evidence of termination. A collected unit has no exit result. */
+export function parseShellUnitStatus(stdout) {
+  const fields = Object.fromEntries(String(stdout).split('\n').filter(line => line.includes('='))
+    .map(line => { const at = line.indexOf('='); return [line.slice(0, at), line.slice(at + 1)]; }));
+  if (fields.LoadState === 'not-found' && fields.ActiveState === 'inactive' && fields.MainPID === '0') {
+    return { termination: 'confirmed', exitCode: null };
+  }
+  if (!['loaded', 'error', 'masked'].includes(fields.LoadState)
+    || !['active', 'activating', 'deactivating', 'reloading', 'inactive', 'failed'].includes(fields.ActiveState)
+    || !fields.Result || !/^\d+$/.test(fields.ExecMainStatus ?? '') || !/^\d+$/.test(fields.ExecMainCode ?? '')
+    || !/^\d+$/.test(fields.MainPID ?? '')) {
+    throw new Error('worker status unavailable: missing or invalid systemd properties');
+  }
+  if (!['inactive', 'failed'].includes(fields.ActiveState) || fields.MainPID !== '0') return uncertain();
+  const signaled = ['2', '3'].includes(fields.ExecMainCode);
+  return { termination: 'confirmed', exitCode: fields.Result === 'success' && !signaled
+    ? Number(fields.ExecMainStatus) : Number(fields.ExecMainStatus) || 1,
+  ...(signaled ? { signalCode: Number(fields.ExecMainStatus) } : {}) };
+}
+
+export async function waitForUnitTermination(unit, deadlineMs, { signal, pollIntervalMs = 2000,
+  exec = execFileAsync, sleep = (ms, abortSignal) => delay(ms, undefined, { signal: abortSignal }),
+  clock = Date.now } = {}) {
+  if (typeof unit !== 'string' || !/^[A-Za-z0-9:_.@-]+$/.test(unit)) throw new Error('Worker isolation requires a unit-safe unit name');
+  const deadline = clock() + deadlineMs;
+  while (!signal?.aborted && clock() < deadline) {
+    try {
+      const { stdout } = await execCanonicalSystemctl(exec,
+        ['--user', 'show', unit, ...unitProperties.flatMap(name => ['-p', name])],
+        // Probes have a usable floor; the caller's AbortSignal bounds the
+        // overall grace/deadline even when a probe is still in flight.
+        { timeout: Math.max(1000, Math.min(10000, deadline - clock())), signal });
+      if (signal?.aborted) return uncertain();
+      const outcome = parseShellUnitStatus(stdout);
+      if (outcome.termination === 'confirmed') return outcome;
+    } catch (error) {
+      // systemctl may return nonzero for a collected unit while still showing
+      // its complete not-found/inactive properties. Never infer from stderr.
+      if (!signal?.aborted && Number.isInteger(error.code) && /^LoadState=not-found$/m.test(error.stdout ?? '')) {
+        try {
+          const outcome = parseShellUnitStatus(error.stdout);
+          if (outcome.termination === 'confirmed') return outcome;
+        } catch { /* incomplete proof; retry below */ }
+      }
+      // Retry transient status failures until deadline/cancellation.
+    }
+    if (signal?.aborted) return uncertain();
+    try { await sleep(Math.min(pollIntervalMs, Math.max(0, deadline - clock())), signal); }
+    catch { return uncertain(); }
+  }
+  return { ...uncertain(), timedOut: !signal?.aborted };
+}
+
+/** Retain uncertain workers with bounded polling. POSIX groups cannot contain
+ * setsid/setpgid escapees; Windows proves only direct-child close. Sweep once
+ * after leader reap to limit (not eliminate) the PGID reuse race. */
+export function buildShellStopControl(launch, { waitForUnit = waitForUnitTermination,
+  stopUnit = defaultStopShellUnit, killUnit = defaultKillShellUnit, graceMs,
+  onConfirmed, platform = process.platform, recheckMaxAttempts = 6, recheckDelayMs = 250 }) {
+  let closed = false;
+  let exitCode = null;
+  let signalCode = null;
+  let confirmed;
+  let stopTask;
+  let delivery;
+  let stopped = false;
+  let recheckTimer;
+  let rechecks = 0;
+  let disposed = false;
+  let groupSwept = false;
+  let resolveClose;
+  const probes = new Set();
+  const child = launch.child;
+  const ownedGroup = platform !== 'win32' && launch.ownedGroup && child?.pid;
+  const closeProof = new Promise(resolve => { resolveClose = resolve; });
+
+  function groupGone() {
+    if (!ownedGroup) return true;
+    try { process.kill(-child.pid, 0); return false; } catch (error) { return error.code === 'ESRCH'; }
+  }
+  function confirm(outcome) {
+    if (confirmed) return confirmed;
+    confirmed = { ...outcome, stopped };
+    clearTimeout(recheckTimer);
+    for (const probe of probes) probe.abort();
+    child?.removeListener('close', onClose);
+    child?.removeListener('error', onError);
+    resolveClose(confirmed);
+    // Registry/cleanup extension failures must not escape an event handler.
+    try { Promise.resolve(onConfirmed?.(confirmed)).catch(() => {}); } catch { /* confirmed proof remains valid */ }
+    return confirmed;
+  }
+  function onClose(code, signal) {
+    closed = true;
+    exitCode = code;
+    signalCode = signal ?? child?.signalCode ?? null;
+    if (launch.mode === 'systemd-unit') return; // systemd-run close is not cgroup stop proof
+    if (groupGone()) confirm({ termination: 'confirmed', exitCode, signalCode });
+    else void control.stop(); // descendants outlived their leader
+  }
+  function onError() {
+    // A pid-bearing child error is an observation failure, not a deadline.
+    // ENOENT has no pid and cannot have started a worker.
+    if (!child?.pid && launch.mode !== 'systemd-unit') confirm({ termination: 'confirmed', exitCode: null });
+  }
+  child?.once('close', onClose);
+  child?.on('error', onError);
+
+  async function bounded(operation, ms) {
+    const abort = new AbortController();
+    probes.add(abort);
+    let timer;
+    let onAbort;
+    try {
+      return await Promise.race([Promise.resolve().then(() => operation(abort.signal)), new Promise(resolve => {
+        onAbort = () => resolve(confirmed ?? uncertain());
+        abort.signal.addEventListener('abort', onAbort, { once: true });
+        timer = setTimeout(() => resolve({ ...uncertain(), timedOut: true }), Math.max(0, ms));
+      })]);
+    } catch { return uncertain(); }
+    finally {
+      clearTimeout(timer);
+      abort.signal.removeEventListener('abort', onAbort);
+      probes.delete(abort);
+      abort.abort(); // cancel a losing poll or execFile, including its sleep
+    }
+  }
+  async function waitStopped(ms) {
+    if (confirmed) return confirmed;
+    if (launch.mode === 'systemd-unit') {
+      const outcome = await bounded(signal => waitForUnit(launch.unit, ms, { signal }), ms);
+      return outcome.termination === 'confirmed' ? confirm(outcome) : outcome;
+    }
+    if (closed && groupGone()) return confirm({ termination: 'confirmed', exitCode, signalCode });
+    return bounded(() => closeProof, ms);
+  }
+  function recheck() {
+    if (confirmed || disposed || recheckTimer || rechecks >= recheckMaxAttempts
+      || (launch.mode !== 'systemd-unit' && !ownedGroup)) return;
+    recheckTimer = setTimeout(async () => {
+      recheckTimer = undefined;
+      rechecks++;
+      await waitStopped(launch.mode === 'systemd-unit' ? Math.max(1000, graceMs) : Math.max(25, graceMs));
+      recheck();
+    }, Math.min(8000, recheckDelayMs * 2 ** rechecks));
+    recheckTimer.unref?.();
+  }
+  async function signal(signalName, budgetMs) {
+    if (confirmed) return true;
+    try {
+      if (launch.mode === 'systemd-unit') {
+        const result = await bounded(abortSignal => (signalName === 'SIGTERM' ? stopUnit : killUnit)(launch.unit,
+          { signal: abortSignal, timeout: Math.max(1, budgetMs) }), budgetMs);
+        return !!result.ok;
+      }
+      if (ownedGroup) {
+        if ((closed || child.exitCode != null || child.signalCode != null) && groupSwept) return false;
+        if (signalName === 'SIGKILL') groupSwept = true;
+        process.kill(-child.pid, signalName);
+        return true;
+      }
+      return !closed && !!child?.kill(signalName);
+    } catch { return false; }
+  }
+  const control = {
+    dispose: () => {
+      disposed = true;
+      clearTimeout(recheckTimer);
+      for (const probe of probes) probe.abort();
+      // Keep close/error listeners for late proof and EventEmitter safety.
+    },
+    get pollingStopped() { return disposed || !!confirmed || rechecks >= recheckMaxAttempts; },
+    stop: async () => {
+      if (confirmed) return true;
+      if (stopTask) return delivery;
+      stopped = true;
+      const phaseMs = launch.mode === 'systemd-unit' ? Math.max(1000, graceMs) : graceMs;
+      let phaseEnd = Date.now() + phaseMs;
+      delivery = signal('SIGTERM', phaseMs);
+      stopTask = (async () => {
+        await delivery;
+        let outcome = await waitStopped(Math.max(0, phaseEnd - Date.now()));
+        if (outcome.termination !== 'confirmed') {
+          phaseEnd = Date.now() + phaseMs;
+          await signal('SIGKILL', phaseMs);
+          outcome = await waitStopped(Math.max(0, phaseEnd - Date.now()));
+        }
+        if (outcome.termination !== 'confirmed') recheck();
+        return outcome;
+      })().finally(() => { stopTask = undefined; });
+      return delivery;
+    },
+    stopAndConfirm: async () => {
+      await control.stop();
+      return confirmed ?? (stopTask ? await stopTask : uncertain());
+    },
+    wait: async deadlineMs => {
+      const deadline = Date.now() + deadlineMs;
+      let outcome;
+      do {
+        outcome = await waitStopped(Math.max(0, deadline - Date.now()));
+        if (confirmed) return confirmed;
+        // Observation failure alone never mandates a stop. Avoid a hot loop
+        // when an injected/failed observer returns immediately.
+        if (!outcome.timedOut) await Promise.race([closeProof, delay(Math.min(50, Math.max(0, deadline - Date.now())))]);
+      } while (!disposed && !outcome.timedOut && Date.now() < deadline);
+      if (disposed) return uncertain();
+      return { ...await control.stopAndConfirm(), timedOut: true };
+    },
+  };
+  // Only a recorded real close can be replayed; exitCode precedes stdio close.
+  if (launch.spawnObservation?.closed) onClose(launch.spawnObservation.exitCode, launch.spawnObservation.signalCode);
+  if (!child?.pid && !launch.unit && !launch.launched) confirm({ termination: 'confirmed', exitCode: null });
+  return control;
+}
+
+export async function defaultStopShellUnit(unit, { signal, timeout = 1000, exec = execFileAsync } = {}) {
+  try {
+    await execCanonicalSystemctl(exec, ['--user', '--no-block', 'stop', unit], { timeout, signal });
+    return { ok: true };
+  } catch { return { ok: false }; }
+}
+export async function defaultKillShellUnit(unit, { signal, timeout = 1000, exec = execFileAsync } = {}) {
+  try {
+    await execCanonicalSystemctl(exec, ['--user', 'kill', '--kill-who=all', '--signal=SIGKILL', unit], { timeout, signal });
+    return { ok: true };
+  } catch { return { ok: false }; }
+}

package/dist/src/mcp/tools/worker-stdin-runtime.mjs

@@ -0,0 +1,79 @@
+import { createHash } from 'node:crypto';
+import { mkdtemp, mkdir, writeFile, rm, readdir, lstat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+/** Sweep old private directories only for dead conductors; PID reuse retains
+ * them. Runtime files keep prompts out of git, but cannot isolate same-user workers. */
+export async function sweepWorkerStdin(root = tmpdir(), { staleMs = 86400000, now = Date.now(),
+  isAlive = pid => { try { process.kill(pid, 0); return true; } catch (error) { return error.code !== 'ESRCH'; } } } = {}) {
+  try {
+    for (const name of await readdir(root)) {
+      const match = /^aiwg-worker-stdin-(\d+)-[A-Za-z0-9]+$/.exec(name);
+      if (!match || isAlive(Number(match[1]))) continue;
+      const directory = path.join(root, name);
+      try {
+        const stat = await lstat(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || now - stat.mtimeMs < staleMs
+          || (process.getuid && (stat.uid !== process.getuid() || (stat.mode & 0o777) !== 0o700))) continue;
+        await rm(directory, { recursive: true, force: true });
+      } catch { /* best-effort stale cleanup must not prevent registration */ }
+    }
+  } catch { /* missing/inaccessible runtime root */ }
+}
+
+export async function prepareWorkerStdin(bytes, root = tmpdir()) {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const directory = await mkdtemp(path.join(root, `aiwg-worker-stdin-${process.pid}-`));
+  const stdinPath = path.join(directory, 'stdin');
+  let cleanupTask;
+  const cleanup = () => cleanupTask ??= rm(directory, { recursive: true, force: true }).catch(() => {
+    console.error('[worker-invoke] private stdin cleanup failed; retained for stale sweep');
+  });
+  try {
+    await writeFile(stdinPath, bytes, { flag: 'wx', mode: 0o600 });
+    return { stdinPath, cleanup };
+  } catch (error) {
+    await cleanup();
+    throw error;
+  }
+}
+
+export async function launchPreparedShellWorker(invocation, { allowDegraded, config, name, live, readers, thresholdOverlay,
+  memoryMaxGb, driver, servedRoot, isolation, spawn, spawnAsync, stdinRuntimeRoot },
+  { loadRalphExternal, readBoundedFile, importImpl, describeGateFailures }) {
+  let attempt;
+  let cleanup = () => Promise.resolve();
+  try {
+    const { planDirectWorkerLaunch } = await loadRalphExternal('session-launcher.mjs');
+    if (!Number.isFinite(memoryMaxGb) || memoryMaxGb <= 0) throw new Error('Worker isolation requires a positive memoryMaxGb ceiling');
+    const brief = await readBoundedFile(invocation.briefPath, 262144, servedRoot);
+    if (`sha256:${createHash('sha256').update(brief).digest('hex')}` !== invocation.briefDigest) {
+      throw new Error('Worker prompt digest changed');
+    }
+    const { workerStdinBytes } = await importImpl('serve/worker-stdin-frame.mjs');
+    let stdinPath;
+    const bytes = workerStdinBytes(invocation, brief, driver);
+    if (bytes !== null) {
+      ({ stdinPath, cleanup } = await prepareWorkerStdin(bytes, stdinRuntimeRoot));
+    }
+    const launch = await planDirectWorkerLaunch({ invocation, config, allowDegraded, name, live, readers,
+      thresholdOverlay, memoryMaxGb, stdinPath, ownedGroup: true, isolation,
+      spawn, spawnAsync, onSpawnAttempt: value => {
+        attempt = value;
+        value.child?.once('close', (exitCode, signalCode) => { Object.assign(value, { closed: true, exitCode, signalCode }); });
+      },
+    });
+    const launchAttempted = !!(attempt?.unit || attempt?.pid);
+    if (!launch.launched && !launchAttempted) await cleanup();
+    return { ...launch, launchAttempted, spawnObservation: attempt, ownedGroup: launch.mode === 'degraded' && !!launch.pid, cleanup,
+      diagnostic: launch.diagnostic ?? describeGateFailures(launch.failures) };
+  } catch (error) {
+    if (attempt?.unit || attempt?.pid) {
+      return { ...attempt, spawnObservation: attempt, ownedGroup: attempt.mode === 'degraded', launched: false, launchAttempted: true, cleanup, diagnostic: error.message };
+    }
+    error.workerNotLaunched = true;
+    await cleanup();
+    throw error;
+  }
+}

package/dist/src/memory/project-registry.js

@@ -9,7 +9,7 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
+import { boundedExecFileSync } from '../process/bounded-child-process.mjs';
 import { projectAiwgPath, resolveProjectAiwgDir } from '../config/project-artifacts.js';
 export function projectMemoryHome() {
     const override = process.env.AIWG_PROJECT_MEMORY_HOME;
@@ -248,7 +248,7 @@ function sanitizeProjectId(id) {
 }
 function discoverGitRemotes(cwd) {
     try {
-        const stdout = execFileSync('git', ['remote', '-v'], { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const stdout = boundedExecFileSync('git', ['remote', '-v'], 'quick', { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
         const remotes = stdout
             .split('\n')
             .map((line) => line.trim().split(/\s+/)[1])