@amenophis1er/foreman 0.1.7 → 0.1.9

package/src/policy.test.ts

@@ -149,6 +149,31 @@ test('a file write under the root does not escape', () => {
   assert.ok(bashEscapesFolder('echo hi > /tmp/out.txt', FOLDER, [ROOT]), 'outside the root still prompts');
 });
 
+test('operators inside quotes are text: a perl program with => is not a redirect', () => {
+  // The exact shape that put an approval card in front of an in-folder edit:
+  // `=>/` inside the single-quoted program read as `>` + the path `/…`.
+  assert.equal(bashEscapesFolder(`perl -0pi -e 's/\\.filter\\(\\(\\[a, b\\]\\) =>/.filter(([a]) =>/' ${ROOT}/x.tsx`, FOLDER, [ROOT]), null);
+  assert.equal(bashEscapesFolder(`set -e; D=src/f; perl -0pi -e 's/ a,\\n b,/ a,/' $D/one.tsx; perl -0pi -e 's/x =>/y/' $D/two.tsx`, FOLDER, [ROOT]), null);
+  assert.equal(bashEscapesFolder('echo "a > b; c | d & e" && echo \'x>/etc/passwd\'', FOLDER, [ROOT]), null);
+  assert.equal(bashEscapesFolder(`git commit -m "fix: handle a > b" ${ROOT}`, FOLDER, [ROOT]), null);
+  // A real redirect next to a quoted one is still seen, with its real text.
+  assert.deepEqual(bashEscape('echo "x > y" > /tmp/out.txt', FOLDER), {
+    reason: 'echo "x > y" > /tmp/out.txt — redirects output outside the mission folder', path: '/tmp/out.txt', grant: '/tmp',
+  });
+  // Quoted paths still resolve: the mask touches operators, not text.
+  assert.ok(bashEscapesFolder('rm -rf "/opt/homebrew"', FOLDER, [ROOT]));
+  // A quoted path with spaces is one token now, so it resolves and is judged.
+  assert.equal(bashEscape(`echo hi > "/tmp/o u t.txt"`, FOLDER)!.path, '/tmp/o u t.txt');
+  assert.equal(bashEscapesFolder(`echo hi > "${ROOT}/o u t.txt"`, FOLDER, [ROOT]), null);
+});
+
+test('a shell -c body is analysed as a command, so quoting cannot hide a cd', () => {
+  assert.ok(bashEscapesFolder(`sh -c 'cd /tmp && npm install'`, FOLDER, [ROOT]));
+  assert.match(bashEscapesFolder(`bash -c "mkdir -p /tmp/x/y"`, FOLDER, [ROOT])!, /creates a path outside/);
+  assert.equal(bashEscapesFolder(`sh -c 'npm test && echo ok'`, FOLDER, [ROOT]), null);
+  assert.equal(bashEscape(`bash -c 'cd /tmp/x'`, FOLDER)!.grant, '/tmp/x');
+});
+
 test('bashEscape carries the offending path and the directory to grant', () => {
   // Directory-ish targets: the path itself is the grant.
   assert.deepEqual(bashEscape('cd /tmp/x && ls', FOLDER), {

package/src/policy.ts

@@ -153,15 +153,52 @@ const WRITE_VERBS: Record<string, { mode: ArgMode; opts?: string[]; does: string
 const FILE_OPTS = new Set(['-o', '--output', '-O', '--output-document']);
 /** Prefixes that merely wrap the real verb (`sudo rm`, `env FOO=1 mkdir`). */
 const WRAPPERS = new Set(['sudo', 'env', 'command', 'exec', 'nohup', 'time', 'nice', 'builtin']);
+/** Shells whose `-c` argument is a command in its own right. */
+const SHELLS = new Set(['sh', 'bash', 'zsh', 'dash']);
 /** Pseudo-devices: writing to them touches nothing on disk. */
 const DEV_SINKS = new Set(['/dev/null', '/dev/stdout', '/dev/stderr', '/dev/tty']);
 const URL_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
 /** `> f`, `>> f`, `2> f`, `&> f` — but not `2>&1` / `>&2` (fd duplication). */
 const REDIRECT_RE = /(?:&>>?|\d*>>?)(?!&)\s*(\S+)/g;
 
+/**
+ * Shell operators inside quotes are text, not operators. The redirect scan
+ * and the segment split below work on the raw string, so a perl program in
+ * single quotes — `perl -pi -e 's/x =>/y/' f` — read as `>` followed by the
+ * path `/y/`, which resolved to the filesystem root and put an approval card
+ * in front of an ordinary in-folder edit. Operators inside a quoted region
+ * are swapped for private-use characters before the scan and swapped back by
+ * `bare()`, so tokens still carry their real text. Spaces inside quotes are
+ * masked too, so a quoted string is one token: `sh -c '…'` bodies and paths
+ * with spaces both come through whole. Quoting rules followed:
+ * single quotes take everything literally; double quotes honour backslash;
+ * a backslash outside quotes escapes the next character.
+ */
+const MASK: Record<string, string> = { '>': '\uE001', '<': '\uE002', '|': '\uE003', ';': '\uE004', '&': '\uE005', '\n': '\uE006', ' ': '\uE007', '\t': '\uE008' };
+const UNMASK_RE = /[\uE001-\uE008]/g;
+const UNMASK: Record<string, string> = Object.fromEntries(Object.entries(MASK).map(([k, v]) => [v, k]));
+function maskQuoted(command: string): string {
+  let out = '';
+  let quote: '"' | "'" | null = null;
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (quote === null) {
+      if (c === '\\' && i + 1 < command.length) { out += c + command[++i]; continue; }
+      if (c === '"' || c === "'") quote = c;
+      out += c;
+      continue;
+    }
+    if (quote === '"' && c === '\\' && i + 1 < command.length) { out += c + command[++i]; continue; }
+    if (c === quote) { quote = null; out += c; continue; }
+    out += MASK[c] ?? c;
+  }
+  return out;
+}
+const unmask = (s: string): string => s.replace(UNMASK_RE, (ch) => UNMASK[ch] ?? ch);
+
 /** Strips one layer of matching quotes and shell grouping punctuation. */
 function bare(token: string): string {
-  let t = token.replace(/^[(\\]+|[)]+$/g, '');
+  let t = unmask(token).replace(/^[(\\]+|[)]+$/g, '');
   if ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))) t = t.slice(1, -1);
   return t;
 }
@@ -266,7 +303,7 @@ export function bashEscape(
   // appended to while we walk, and one command must see one consistent view.
   const roots = [root, ...extraRoots];
   const outside = (p: string): boolean => !DEV_SINKS.has(p) && !underAnyRoot(p, roots);
-  const label = (seg: string): string => (seg.length > 80 ? seg.slice(0, 77) + '…' : seg);
+  const label = (raw: string): string => { const seg = unmask(raw); return seg.length > 80 ? seg.slice(0, 77) + '…' : seg; };
   const hit = (segment: string, does: string, p: string, isDir: boolean): BashEscape => ({
     reason: `${label(segment)} — ${does} outside the mission folder`,
     path: p,
@@ -275,7 +312,7 @@ export function bashEscape(
 
   let cwd = root; // virtual cwd, so `cd sub && rm -rf ../../x` resolves correctly
 
-  const segments = command
+  const segments = maskQuoted(command)
     .split(/&&|\|\||;|\n|\|(?!\|)|(?<![&>\d])&(?![&>])/)
     .map((s) => s.trim())
     .filter(Boolean);
@@ -295,6 +332,19 @@ export function bashEscape(
     const args = words.slice(i + 1);
     const flagless = args.filter((a) => !a.startsWith('-'));
 
+    // `sh -c '…'`: the quoted body is a command of its own, run from the
+    // current virtual cwd. Analysed as one, so quoting cannot hide a `cd /tmp`
+    // — masking made the body opaque to the split above, and this is where it
+    // is looked at instead.
+    if (SHELLS.has(verb)) {
+      const c = args.indexOf('-c');
+      if (c >= 0 && c + 1 < args.length) {
+        const inner = bashEscape(args[c + 1], cwd, roots);
+        if (inner) return { ...inner, reason: `${label(segment)} — ${inner.reason.replace(/^.*? — /, '')}` };
+      }
+      continue;
+    }
+
     if (verb === 'cd' || verb === 'pushd') {
       const target = flagless[0] ?? '~'; // bare `cd` goes home
       const p = asPath(target, cwd) ?? path.resolve(cwd, target);

package/src/preflight.ts

@@ -21,6 +21,7 @@ import { defaultInstance, describeInstance, effectiveConfigDir } from './instanc
 import { discoverOllama, ollamaHost } from './ollama.js';
 import { serveHint, tailnetUrl, type Tailnet } from './tailscale.js';
 import { codexHome, codexModels, readCodexAuth } from './codex.js';
+import { browserCheck } from './browser.js';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
@@ -116,12 +117,17 @@ async function checkAuth(): Promise<Check> {
   const name = 'Credentials';
   const { mode, source, account } = await detectAuth();
 
+  // Missing credentials are a warning, not a refusal to start. The dashboard
+  // is where a first-time user reads what to do and where a project gets an
+  // API key or an endpoint of its own; a server that will not come up until
+  // something is logged in leaves them with a terminal line and no next step.
+  // Missions cannot start meanwhile — dispatch checks the provider itself.
   if (mode === 'none') {
     return {
       name,
-      status: 'error',
-      detail: 'none found — no missions can run',
-      fix: 'Log in with Claude Code, or: export ANTHROPIC_API_KEY=sk-ant-...',
+      status: 'warn',
+      detail: 'none found — missions cannot start until a provider is set up',
+      fix: 'Sign in with Claude Code on this machine (claude, then /login) and restart · or export ANTHROPIC_API_KEY · or give a project an API key or endpoint in Settings → Provider',
     };
   }
 
@@ -142,8 +148,12 @@ async function checkAuth(): Promise<Check> {
   return { name, status: 'ok', detail: `${MODE_LABEL[mode]} — ${who}` };
 }
 
-function checkInstance(): Check {
-  return { name: 'Claude Code', status: 'ok', detail: describeInstance(defaultInstance()) };
+async function checkInstance(): Promise<Check> {
+  const detail = describeInstance(defaultInstance());
+  // A tick beside an install nobody is signed into contradicts the line
+  // above it; say so here too, and leave the fix to the Credentials row.
+  if ((await detectAuth()).mode === 'none') return { name: 'Claude Code', status: 'warn', detail: `${detail} · not signed in` };
+  return { name: 'Claude Code', status: 'ok', detail };
 }
 
 /**
@@ -204,7 +214,7 @@ async function checkCodex(): Promise<Check | null> {
   };
 }
 
-async function checkPort(port: number): Promise<Check> {
+async function checkPort(port: number, envVar: 'PORT' | 'FOREMAN_SERVICES_PORT' = 'PORT'): Promise<Check> {
   const name = `Port ${port}`;
   const inUse = await new Promise<boolean>((resolve) => {
     const probe = net.createServer();
@@ -213,12 +223,17 @@ async function checkPort(port: number): Promise<Check> {
     probe.listen(port, '127.0.0.1');
   });
 
+  // The main port taken is fatal: nothing can be served. The services port
+  // taken is a fact to report — the dashboard still works, and only the
+  // crew's exposed previews are off until the port is freed or moved.
+  // PORT + 1 is a guess, and a second Foreman (a dev server beside the
+  // installed one) is the likeliest thing sitting on it.
   return inUse
     ? {
         name,
-        status: 'error',
-        detail: 'already in use',
-        fix: `Another Foreman may be running. Stop it, or: PORT=${port + 1} npm start`,
+        status: envVar === 'PORT' ? 'error' : 'warn',
+        detail: envVar === 'PORT' ? 'already in use' : 'already in use — exposed dev servers will be unavailable',
+        fix: `Another Foreman may be running. Stop it, or: ${envVar}=${port + 1} npm start`,
       }
     : { name, status: 'ok', detail: 'free' };
 }
@@ -247,40 +262,8 @@ async function checkHome(root: string): Promise<Check> {
  * `npx playwright install chromium`).
  */
 async function checkBrowser(): Promise<Check> {
-  const name = 'Browser';
-  const want = (process.env.FOREMAN_BROWSER || 'chrome').toLowerCase();
-  const candidates: Record<string, string[]> = {
-    chrome: process.platform === 'darwin'
-      ? ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome', path.join(os.homedir(), 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome')]
-      : process.platform === 'win32'
-        ? [
-            path.join(process.env.ProgramFiles ?? 'C:\\Program Files', 'Google', 'Chrome', 'Application', 'chrome.exe'),
-            path.join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Google', 'Chrome', 'Application', 'chrome.exe'),
-            path.join(process.env.LOCALAPPDATA ?? '', 'Google', 'Chrome', 'Application', 'chrome.exe'),
-          ]
-        : ['/usr/bin/google-chrome', '/usr/bin/google-chrome-stable', '/opt/google/chrome/chrome', '/usr/bin/chromium', '/usr/bin/chromium-browser', '/snap/bin/chromium'],
-    msedge: process.platform === 'darwin' ? ['/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge']
-      : process.platform === 'win32' ? [path.join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Microsoft', 'Edge', 'Application', 'msedge.exe')]
-      : ['/usr/bin/microsoft-edge', '/usr/bin/microsoft-edge-stable'],
-    firefox: process.platform === 'darwin' ? ['/Applications/Firefox.app/Contents/MacOS/firefox'] : ['/usr/bin/firefox'],
-  };
-  let found: string | null = null;
-  if (want === 'chromium') {
-    // Playwright's own build, wherever the MCP's playwright-core says it lives.
-    try {
-      const req = createRequire(fileURLToPath(new URL('../node_modules/@playwright/mcp/cli.js', import.meta.url)));
-      const { chromium } = req('playwright-core') as { chromium: { executablePath(): string } };
-      const p = chromium.executablePath();
-      if (await exists(p)) found = p;
-    } catch { /* no playwright-core to ask */ }
-    return found
-      ? { name, status: 'ok', detail: `Playwright Chromium — ${found}` }
-      : { name, status: 'warn', detail: 'FOREMAN_BROWSER=chromium but Playwright Chromium is not installed; browser missions will fail', fix: 'npx playwright install chromium' };
-  }
-  for (const p of candidates[want] ?? []) if (await exists(p)) { found = p; break; }
-  return found
-    ? { name, status: 'ok', detail: `${want === 'chrome' ? 'Google Chrome' : want} — ${found}` }
-    : { name, status: 'warn', detail: `no ${want === 'chrome' ? 'Google Chrome' : want} found; missions with browser on will fail`, fix: 'Install Google Chrome, or: npx playwright install chromium && FOREMAN_BROWSER=chromium foreman' };
+  // One detection for the row and for the crew: see src/browser.ts.
+  return { name: 'Browser', ...(await browserCheck()) };
 }
 
 /** Where the phone can reach this. Says so plainly either way — the answer decides which links work. */
@@ -309,6 +292,8 @@ async function checkUi(distDir: string): Promise<Check> {
  */
 export async function preflight(opts: {
   port: number;
+  /** The second listener, for the crew's exposed dev servers — see services.ts. */
+  servicesPort: number;
   foremanHome: string;
   distDir: string;
   /** Detected by the server before preflight; null when not on a tailnet. */
@@ -321,6 +306,7 @@ export async function preflight(opts: {
     checkOllama(),
     checkCodex(),
     checkPort(opts.port),
+    checkPort(opts.servicesPort, 'FOREMAN_SERVICES_PORT'),
     checkBrowser(),
     checkHome(opts.foremanHome),
     checkUi(opts.distDir),

package/src/role-provider.test.ts

@@ -0,0 +1,55 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { reconcileRole } from './role-provider.js';
+
+const models = [
+  { id: 'fable' }, { id: 'opus' }, { id: 'sonnet' }, { id: 'haiku' },
+  { id: 'gemma4:12b', providerId: 'ollama-local' },
+  { id: 'gpt-5.5', providerId: 'codex-local' },
+  { id: 'kimi-k3', providerId: 'prov-abc' },
+];
+
+test('reconcileRole: a consistent pairing passes through untouched', () => {
+  assert.deepEqual(reconcileRole('director', 'fable', undefined, models), { providerId: undefined });
+  assert.deepEqual(reconcileRole('workers', 'gpt-5.5', 'codex-local', models), { providerId: 'codex-local' });
+  assert.deepEqual(reconcileRole('workers', 'gemma4:12b', 'ollama-local', models), { providerId: 'ollama-local' });
+});
+
+test('reconcileRole: an Anthropic alias on the Codex provider is corrected — the bug this exists for', () => {
+  const r = reconcileRole('director', 'fable', 'codex-local', models);
+  assert.equal(r.providerId, undefined);
+  assert.match(r.note ?? '', /fable is served by the project's provider, not codex-local/);
+});
+
+test('reconcileRole: a listed model moves to whichever provider lists it', () => {
+  assert.equal(reconcileRole('workers', 'gemma4:12b', undefined, models).providerId, 'ollama-local');
+  assert.equal(reconcileRole('workers', 'gpt-5.5', 'ollama-local', models).providerId, 'codex-local');
+  assert.equal(reconcileRole('director', 'kimi-k3', 'codex-local', models).providerId, 'prov-abc');
+  assert.equal(reconcileRole('director', 'FABLE', 'codex-local', models).providerId, undefined);
+});
+
+test('reconcileRole: a provider pin without a model is stale and dropped', () => {
+  const r = reconcileRole('director', undefined, 'codex-local', models);
+  assert.equal(r.providerId, undefined);
+  assert.match(r.note ?? '', /no model was chosen/);
+  assert.deepEqual(reconcileRole('director', undefined, undefined, models), { providerId: undefined });
+  assert.deepEqual(reconcileRole('director', '', '  ', models), { providerId: undefined });
+});
+
+test('reconcileRole: an unlisted model keeps its provider, unless it is a Claude id on a closed provider', () => {
+  // A custom endpoint's model the discovery call missed: trust the pairing.
+  assert.deepEqual(reconcileRole('workers', 'mystery-9b', 'prov-abc', models), { providerId: 'prov-abc' });
+  assert.deepEqual(reconcileRole('workers', 'mystery-9b', undefined, models), { providerId: undefined });
+  // A full claude-* id nobody listed still cannot go through Codex or Ollama.
+  const r = reconcileRole('director', 'claude-opus-4-1', 'codex-local', models);
+  assert.equal(r.providerId, undefined);
+  assert.match(r.note ?? '', /Anthropic model/);
+  assert.equal(reconcileRole('director', 'claude-opus-4-1', 'ollama-local', models).providerId, undefined);
+  // On a custom endpoint a claude-* id may be a real proxy route; left alone.
+  assert.equal(reconcileRole('director', 'claude-opus-4-1', 'prov-abc', models).providerId, 'prov-abc');
+});
+
+test('reconcileRole: works with an empty model list (discovery failed) by the closed-provider rule alone', () => {
+  assert.equal(reconcileRole('director', 'fable', 'codex-local', []).providerId, undefined);
+  assert.equal(reconcileRole('director', 'gpt-5.5', 'codex-local', []).providerId, 'codex-local');
+});

package/src/role-provider.ts

@@ -0,0 +1,65 @@
+/**
+ * A role's provider, checked against its model at dispatch.
+ *
+ * A run carries, per role, a model and the provider that serves it. The two
+ * are picked together in every picker, but they travel separately — through
+ * settings files, drafts, older builds and resumes — and once they drift a
+ * mission fails on its first turn with an upstream 400 nobody chose: the
+ * Claude alias `fable` sent through the Codex gateway, say, which then
+ * answers that the model "is not supported when using Codex". Nothing was
+ * checking that the provider actually serves the model.
+ *
+ * This is that check. The model list is the authority: a model the machine
+ * offers is served by whichever provider lists it, and a role is corrected
+ * to that provider whatever it arrived with. A model the list does not know
+ * is left alone, except for the one pairing that can never work: an
+ * Anthropic model on a provider that only serves its own catalogue.
+ */
+import { ANTHROPIC_ALIASES } from './anthropic-models.js';
+
+export interface KnownModel {
+  id: string;
+  /** Absent means the project's own provider (Anthropic by default). */
+  providerId?: string;
+}
+
+/** Providers that serve exactly the models they list and nothing else. */
+const CLOSED_PROVIDERS = new Set(['codex-local', 'ollama-local']);
+
+export interface Reconciled {
+  providerId?: string;
+  /** Set when the pairing had to change; one sentence, for the transcript. */
+  note?: string;
+}
+
+const isAnthropic = (model: string) => ANTHROPIC_ALIASES.has(model) || /^claude-/i.test(model);
+
+/**
+ * The provider a role should run on, given what it was handed and what the
+ * machine offers. Returns the same provider id and no note when nothing is
+ * wrong, which is the common case.
+ */
+export function reconcileRole(
+  role: 'director' | 'workers', model: string | undefined, providerId: string | undefined, models: KnownModel[],
+): Reconciled {
+  const given = providerId?.trim() || undefined;
+  // No model means "inherit the project's default", which lives on the
+  // project's provider. A provider id left behind without a model is stale.
+  if (!model) {
+    return given ? { providerId: undefined, note: `${role}: no model was chosen, so the ${given} provider pin was dropped.` } : { providerId: undefined };
+  }
+  const want = model.trim().toLowerCase();
+  const known = models.find((m) => m.id.toLowerCase() === want);
+  if (known) {
+    const served = known.providerId || undefined;
+    if (served === given) return { providerId: given };
+    return {
+      providerId: served,
+      note: `${role}: ${model} is served by ${served ?? 'the project\'s provider'}, not ${given ?? 'the project\'s provider'}; corrected.`,
+    };
+  }
+  if (given && CLOSED_PROVIDERS.has(given) && isAnthropic(model)) {
+    return { providerId: undefined, note: `${role}: ${model} is an Anthropic model and ${given} cannot serve it; running it on the project's provider instead.` };
+  }
+  return { providerId: given };
+}