@askexenow/exe-os 0.9.227 → 0.9.229

package/dist/chunk-NFB4N53K.js

@@ -0,0 +1,159 @@
+import {
+  EXE_AI_DIR
+} from "./chunk-TNTFEWU5.js";
+
+// src/lib/worker-gate.ts
+import { readdirSync, writeFileSync, unlinkSync, mkdirSync, existsSync, readFileSync } from "fs";
+import path from "path";
+var WORKER_PID_DIR = path.join(EXE_AI_DIR, "worker-pids");
+var MAX_CONCURRENT_WORKERS = 3;
+function tryAcquireWorkerSlot() {
+  try {
+    mkdirSync(WORKER_PID_DIR, { recursive: true });
+    const reservationId = `res-${process.pid}-${Date.now()}`;
+    const reservationPath = path.join(WORKER_PID_DIR, `${reservationId}.pid`);
+    writeFileSync(reservationPath, String(process.pid));
+    const files = readdirSync(WORKER_PID_DIR);
+    let alive = 0;
+    for (const f of files) {
+      if (!f.endsWith(".pid")) continue;
+      if (f.startsWith("res-")) {
+        const resParts = f.replace(".pid", "").split("-");
+        const resPid = parseInt(resParts[1] ?? "", 10);
+        if (!isNaN(resPid) && resPid > 0) {
+          try {
+            process.kill(resPid, 0);
+            alive++;
+          } catch {
+            try {
+              unlinkSync(path.join(WORKER_PID_DIR, f));
+            } catch {
+            }
+          }
+        } else {
+          alive++;
+        }
+        continue;
+      }
+      const dashIdx = f.lastIndexOf("-");
+      const pid = parseInt(f.slice(dashIdx + 1).replace(".pid", ""), 10);
+      if (isNaN(pid)) continue;
+      try {
+        process.kill(pid, 0);
+        alive++;
+      } catch {
+        try {
+          unlinkSync(path.join(WORKER_PID_DIR, f));
+        } catch {
+        }
+      }
+    }
+    if (alive >= MAX_CONCURRENT_WORKERS) {
+      try {
+        unlinkSync(reservationPath);
+      } catch {
+      }
+      return false;
+    }
+    try {
+      unlinkSync(reservationPath);
+    } catch {
+    }
+    return true;
+  } catch {
+    return true;
+  }
+}
+function registerWorkerPid(pid) {
+  try {
+    mkdirSync(WORKER_PID_DIR, { recursive: true });
+    writeFileSync(path.join(WORKER_PID_DIR, `worker-${pid}.pid`), String(pid));
+  } catch {
+  }
+}
+function cleanupWorkerPid() {
+  try {
+    unlinkSync(path.join(WORKER_PID_DIR, `worker-${process.pid}.pid`));
+  } catch {
+  }
+}
+var BACKFILL_LOCK = path.join(WORKER_PID_DIR, "backfill.lock");
+function tryAcquireBackfillLock() {
+  try {
+    mkdirSync(WORKER_PID_DIR, { recursive: true });
+    if (existsSync(BACKFILL_LOCK)) {
+      try {
+        const pid = parseInt(
+          readFileSync(BACKFILL_LOCK, "utf8").trim(),
+          10
+        );
+        if (!isNaN(pid) && pid > 0) {
+          try {
+            process.kill(pid, 0);
+            return false;
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+    writeFileSync(BACKFILL_LOCK, String(process.pid));
+    return true;
+  } catch {
+    return true;
+  }
+}
+function releaseBackfillLock() {
+  try {
+    unlinkSync(BACKFILL_LOCK);
+  } catch {
+  }
+}
+async function getTaskAwareCapacity() {
+  const { getClient } = await import("./lib/database.js");
+  const { sessionScopeFilter } = await import("./task-scope-DNQURKOQ.js");
+  const client = getClient();
+  const scope = sessionScopeFilter();
+  const result = await client.execute({
+    sql: `SELECT assigned_to, COUNT(*) as cnt
+          FROM tasks
+          WHERE status IN ('open', 'in_progress')${scope.sql}
+          GROUP BY assigned_to`,
+    args: [...scope.args]
+  });
+  const busyAgents = [];
+  let totalInProgress = 0;
+  for (const row of result.rows) {
+    const agent = String(row.assigned_to ?? "");
+    const count = Number(row.cnt ?? 0);
+    if (agent && count > 0) {
+      busyAgents.push(agent);
+      totalInProgress += count;
+    }
+  }
+  const idleAgents = [];
+  try {
+    const { listTmuxSessions } = await import("./lib/tmux-status.js");
+    const { isExeSession } = await import("./lib/tmux-routing.js");
+    const { baseAgentName } = await import("./lib/employees.js");
+    const liveSessions = listTmuxSessions().filter((s) => !isExeSession(s) && s.includes("-"));
+    const liveAgentNames = new Set(liveSessions.map((s) => baseAgentName(s.split("-")[0] ?? "")));
+    for (const name of liveAgentNames) {
+      if (name && !busyAgents.includes(name)) {
+        idleAgents.push(name);
+      }
+    }
+  } catch {
+  }
+  return { busyAgents, idleAgents, totalInProgress };
+}
+
+export {
+  MAX_CONCURRENT_WORKERS,
+  tryAcquireWorkerSlot,
+  registerWorkerPid,
+  cleanupWorkerPid,
+  tryAcquireBackfillLock,
+  releaseBackfillLock,
+  getTaskAwareCapacity
+};

package/dist/chunk-NGP6LSV2.js

@@ -0,0 +1,25 @@
+// src/lib/runtime-table.ts
+var RUNTIME_TABLE = {
+  codex: {
+    binary: "codex",
+    launchMode: "interactive",
+    autoApproveFlag: "--dangerously-bypass-approvals-and-sandbox",
+    inlineFlag: "--no-alt-screen",
+    apiKeyEnv: "OPENAI_API_KEY",
+    defaultModel: "gpt-5.5"
+  },
+  opencode: {
+    binary: "opencode",
+    launchMode: "exec",
+    autoApproveFlag: "--dangerously-skip-permissions",
+    inlineFlag: "",
+    apiKeyEnv: "ANTHROPIC_API_KEY",
+    defaultModel: "anthropic/claude-sonnet-4-6"
+  }
+};
+var DEFAULT_RUNTIME = "claude";
+
+export {
+  RUNTIME_TABLE,
+  DEFAULT_RUNTIME
+};

package/dist/chunk-NGVOA6ZQ.js

@@ -0,0 +1,84 @@
+// src/runtime/safety-checks.ts
+import path from "path";
+import os from "os";
+var HOME = os.homedir();
+var BYPASS_IMMUNE_PATTERNS = [
+  {
+    pattern: /\/\.git\/hooks\//,
+    reason: "Git hooks can execute arbitrary code"
+  },
+  {
+    pattern: /\/\.git\/config$/,
+    reason: "Git config can set hooks and command execution"
+  },
+  {
+    pattern: (p) => p.startsWith(path.join(HOME, ".claude")),
+    reason: "Claude configuration files are protected"
+  },
+  {
+    pattern: (p) => p.startsWith(path.join(HOME, ".exe-os")),
+    reason: "exe-os configuration files are protected"
+  },
+  {
+    pattern: /\/\.env($|\.)/,
+    reason: "Environment files may contain secrets"
+  },
+  {
+    pattern: /\/(credentials|secrets|tokens)\.(json|yaml|yml|toml|ini|conf)$/i,
+    reason: "Credential files are protected"
+  },
+  {
+    pattern: /(\.pem|\.key|\.p12|\.pfx|\.jks|id_rsa|id_ed25519)$/,
+    reason: "Private key files are protected"
+  },
+  {
+    pattern: (p) => {
+      const name = path.basename(p);
+      return [".bashrc", ".zshrc", ".profile", ".bash_profile", ".zprofile", ".zshenv"].includes(name);
+    },
+    reason: "Shell configuration files can execute arbitrary code on login"
+  },
+  {
+    pattern: (p) => p.startsWith("/etc/"),
+    reason: "System configuration directory is protected"
+  },
+  {
+    pattern: (p) => p.startsWith("/usr/") && !p.startsWith("/usr/local/"),
+    reason: "System binary directory is protected"
+  },
+  {
+    pattern: (p) => p === "/" || p === HOME,
+    reason: "Root and home directory direct modification is protected"
+  }
+];
+function checkPathSafety(filePath) {
+  const resolved = path.resolve(filePath);
+  for (const { pattern, reason } of BYPASS_IMMUNE_PATTERNS) {
+    const matches = typeof pattern === "function" ? pattern(resolved) : pattern.test(resolved);
+    if (matches) {
+      return { safe: false, reason, bypassImmune: true };
+    }
+  }
+  return { safe: true, bypassImmune: true };
+}
+function containsPathTraversal(filePath) {
+  return /(?:^|[\\/])\.\.(?:[\\/]|$)/.test(filePath);
+}
+function checkReadPathSafety(filePath) {
+  const resolved = path.resolve(filePath);
+  const credPatterns = BYPASS_IMMUNE_PATTERNS.filter(
+    (p) => typeof p.pattern !== "function" && (p.reason.includes("secrets") || p.reason.includes("Private key") || p.reason.includes("Credential"))
+  );
+  for (const { pattern, reason } of credPatterns) {
+    if (typeof pattern !== "function" && pattern.test(resolved)) {
+      return { safe: false, reason, bypassImmune: true };
+    }
+  }
+  return { safe: true, bypassImmune: true };
+}
+
+export {
+  checkPathSafety,
+  containsPathTraversal,
+  checkReadPathSafety
+};