@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/src/host-diagnostics.ts

@@ -0,0 +1,319 @@
+import type { HostResult } from "./evaluation/types";
+import type { RuntimeRole } from "./runtime/state";
+import {
+  diagnosticSecrets,
+  redactDiagnosticText,
+} from "./host-diagnostic-redaction";
+
+const MAX_TEXT_BYTES = 64 * 1024;
+interface ProcessDiagnostic {
+  code: number | null;
+  out: string;
+  stderr: Uint8Array;
+  stderrTruncated: boolean;
+  signal: string | null;
+  durationMs: number;
+  stdoutTruncated?: boolean;
+  reason: "exit" | "timeout" | "cancelled" | "error" | "spawn";
+}
+
+export type ProcessFailureReason = ProcessDiagnostic["reason"];
+
+export class HostDiagnosticPersistenceError extends Error {
+  constructor(persistenceCause: unknown, hostCause: unknown) {
+    super("host diagnostic persistence failed", {
+      cause: new AggregateError(
+        [hostCause, persistenceCause],
+        "host and persistence failures",
+      ),
+    });
+  }
+}
+
+export function rethrowDiagnosticPersistenceError(cause: unknown): void {
+  if (cause instanceof HostDiagnosticPersistenceError) throw cause;
+}
+
+/** Drain observers capture only a prefix; completion records actual native termination. */
+export class HostProcessDiagnostics {
+  readonly stdout = new DiagnosticStream();
+  readonly stderr = new DiagnosticStream();
+  private started = performance.now();
+  constructor(private diagnostics?: HostDiagnostics) {}
+  recordUnstarted(): void {
+    if (!this.diagnostics) return;
+    this.diagnostics.process({
+      code: null,
+      signal: null,
+      durationMs: performance.now() - this.started,
+      out: "",
+      stderr: new Uint8Array(),
+      stderrTruncated: false,
+      reason: "spawn",
+    });
+  }
+  async record(
+    process: { exited: Promise<number | null>; signalCode?: string | null },
+    reason: ProcessFailureReason = "exit",
+  ): Promise<void> {
+    if (!this.diagnostics) return;
+    this.diagnostics.process({
+      code: await process.exited,
+      signal: process.signalCode ?? null,
+      durationMs: performance.now() - this.started,
+      out: this.stdout.bytes().toString("utf8"),
+      stdoutTruncated: this.stdout.truncated,
+      stderr: this.stderr.bytes(),
+      stderrTruncated: this.stderr.truncated,
+      reason,
+    });
+  }
+}
+
+function boundedText(bytes: Uint8Array, secrets: string[]) {
+  const redacted = Buffer.from(
+    redactDiagnosticText(
+      Buffer.from(bytes.subarray(0, MAX_TEXT_BYTES)).toString("utf8"),
+      secrets,
+    ),
+  );
+  return {
+    text: new TextDecoder().decode(redacted.subarray(0, MAX_TEXT_BYTES), {
+      stream: true,
+    }),
+    truncated:
+      bytes.byteLength > MAX_TEXT_BYTES || redacted.byteLength > MAX_TEXT_BYTES,
+  };
+}
+
+/** Keep a byte-bounded prefix while the owning transport continues draining. */
+export class DiagnosticStream {
+  private chunks: Uint8Array[] = [];
+  private size = 0;
+  truncated = false;
+  add(bytes: Uint8Array): void {
+    const retained = bytes.subarray(0, Math.max(0, MAX_TEXT_BYTES - this.size));
+    if (retained.byteLength) this.chunks.push(Buffer.from(retained));
+    this.size += retained.byteLength;
+    this.truncated ||= retained.byteLength !== bytes.byteLength;
+  }
+  bytes(): Buffer {
+    return Buffer.concat(this.chunks);
+  }
+}
+
+function errorCode(cause: Error): { code?: string | number } {
+  if (!("code" in cause)) return {};
+  const code: unknown = cause.code;
+  return typeof code === "string" || typeof code === "number" ? { code } : {};
+}
+
+function errorEvidence(
+  cause: unknown,
+  secrets: string[],
+): Record<string, unknown> {
+  return errorChain(cause, secrets, new Set());
+}
+
+function errorChain(
+  cause: unknown,
+  secrets: string[],
+  seen: Set<Error>,
+): Record<string, unknown> {
+  if (!(cause instanceof Error))
+    return {
+      name: "NonError",
+      message: redactDiagnosticText(String(cause).slice(0, 8192), secrets),
+    };
+  if (seen.has(cause) || seen.size === 8) return { truncated: true };
+  seen.add(cause);
+  return {
+    ...errorDetails(cause, secrets),
+    ...(cause.cause === undefined
+      ? {}
+      : { cause: errorChain(cause.cause, secrets, seen) }),
+  };
+}
+
+function errorDetails(cause: Error, secrets: string[]) {
+  return {
+    name: redactDiagnosticText(cause.name.slice(0, 200), secrets),
+    message: redactDiagnosticText(cause.message.slice(0, 8192), secrets),
+    stack: redactDiagnosticText(cause.stack?.slice(0, 8192) ?? "", secrets),
+    ...errorCode(cause),
+  };
+}
+
+export function diagnosticStage(
+  diagnostics: HostDiagnostics | undefined,
+  stage: string,
+): void {
+  if (diagnostics) diagnostics.stage = stage;
+}
+
+/** A cleanup exception must not replace an already captured host/persistence failure. */
+export async function cleanupNativeState(
+  diagnostics: HostDiagnostics | undefined,
+  cleanup: () => Promise<void>,
+): Promise<void> {
+  beginNativeCleanup(diagnostics);
+  try {
+    await cleanup();
+  } catch (cause) {
+    if (!diagnostics?.failureCaptured) throw cause;
+    console.warn(
+      "native state cleanup failed; original host failure preserved",
+    );
+  }
+}
+
+function beginNativeCleanup(diagnostics: HostDiagnostics | undefined): void {
+  if (diagnostics && !diagnostics.failureCaptured)
+    diagnosticStage(diagnostics, "cleanup");
+}
+
+export function diagnosticConfiguration(enabled: boolean | undefined) {
+  return enabled ? { "sevro.host.retain-diagnostics": true } : {};
+}
+
+export function createHostDiagnostics(
+  host: "codex" | "claude",
+  enabled: boolean | undefined,
+  request: {
+    runtimeRole?: RuntimeRole;
+    retainHostDiagnostics?: (bytes: Uint8Array) => Promise<void>;
+  },
+): HostDiagnostics | undefined {
+  return enabled
+    ? new HostDiagnostics(
+        host,
+        request.runtimeRole,
+        request.retainHostDiagnostics,
+      )
+    : undefined;
+}
+
+export async function readDiagnosticCredentials(
+  diagnostics: HostDiagnostics | undefined,
+  path: string | undefined,
+): Promise<void> {
+  if (diagnostics && path) await diagnostics.readCredentials(path);
+}
+
+export function diagnosticCredentialEnvironment(
+  diagnostics: HostDiagnostics | undefined,
+  environment: Record<string, string>,
+  names: readonly string[],
+): void {
+  if (diagnostics) diagnostics.registerCredentials(environment, names);
+}
+
+export async function retainReturnedHostFailure(
+  diagnostics: HostDiagnostics | undefined,
+  result: HostResult,
+  message: string,
+): Promise<void> {
+  if (diagnostics && result.executionFailed)
+    await diagnostics.retain(result, diagnostics.failure ?? new Error(message));
+}
+
+export async function diagnoseHostRequest(
+  diagnostics: HostDiagnostics | undefined,
+  execute: () => Promise<HostResult>,
+): Promise<HostResult> {
+  try {
+    return await execute();
+  } catch (cause) {
+    if (cause instanceof HostDiagnosticPersistenceError) throw cause;
+    if (!diagnostics) throw cause;
+    const result: HostResult = {
+      finalMessage: null,
+      complete: false,
+      executionFailed: true,
+      actualCondition: "passive",
+    };
+    await diagnostics.retain(result, cause);
+    return result;
+  }
+}
+
+/** Private failure evidence, independent of native sessions and transcript access. */
+export class HostDiagnostics {
+  stage = "preparation";
+  failure: unknown;
+  failureCaptured = false;
+  private processes: Record<string, unknown>[] = [];
+  private processesDropped = 0;
+  private secrets: string[] = [];
+  constructor(
+    private host: "codex" | "claude",
+    private role: RuntimeRole = "candidate",
+    private persist?: (bytes: Uint8Array) => Promise<void>,
+  ) {}
+
+  async readCredentials(path: string): Promise<void> {
+    this.secrets.push(...(await diagnosticSecrets(path)));
+  }
+
+  registerCredentials(
+    environment: Record<string, string>,
+    names: readonly string[],
+  ): void {
+    for (const name of names) {
+      const value = environment[name];
+      if (value) this.secrets.push(value);
+    }
+  }
+
+  process(result: ProcessDiagnostic): void {
+    const stdout = boundedText(Buffer.from(result.out), this.secrets);
+    const stderr = boundedText(result.stderr, this.secrets);
+    this.addProcess({
+      stage: this.stage,
+      code: result.code,
+      signal: result.signal,
+      durationMs: result.durationMs,
+      reason: result.reason,
+      stdout: stdout.text,
+      stdoutTruncated: stdout.truncated || result.stdoutTruncated === true,
+      stderr: stderr.text,
+      stderrTruncated: stderr.truncated || result.stderrTruncated,
+    });
+  }
+
+  private addProcess(receipt: Record<string, unknown>): void {
+    this.processes.push(receipt);
+    while (
+      this.processes.length > 32 ||
+      Buffer.byteLength(JSON.stringify(this.processes)) > 2 * 1024 * 1024
+    ) {
+      this.processes.shift();
+      this.processesDropped++;
+    }
+  }
+
+  async retain(result: HostResult, cause: unknown): Promise<void> {
+    this.failureCaptured = true;
+    const bytes = Buffer.from(
+      JSON.stringify({
+        format: "sevro.host-diagnostics.v1",
+        host: this.host,
+        role: this.role,
+        stage: this.stage,
+        error: errorEvidence(cause, this.secrets),
+        processes: this.processes,
+        processesDropped: this.processesDropped,
+      }),
+    );
+    if (this.persist) {
+      try {
+        await this.persist(bytes);
+      } catch (persistenceCause) {
+        throw new HostDiagnosticPersistenceError(persistenceCause, cause);
+      }
+      return;
+    }
+    result.artifacts ??= [];
+    result.artifacts.push({ id: "sevro.host.diagnostics", bytes });
+  }
+}

package/src/hosts/claude-continuation.ts

@@ -1,3 +1,4 @@
+import { isRecord } from "../value-guards";
 import { randomUUID } from "node:crypto";
 import { summarizeClaudeEvents } from "./claude-events";
 import { workspaceFingerprint } from "./workspace-fingerprint";
@@ -21,9 +22,15 @@ function boundResult(stream: string, session: string): boolean {
     const results = stream
       .split("\n")
       .filter((line) => line.trim())
-      .map((line) => JSON.parse(line))
-      .filter((entry) => entry?.type === "result");
-    return results.length === 1 && results[0].session_id === session;
+      .map((line): unknown => JSON.parse(line))
+      .filter(isRecord)
+      .filter((entry) => entry.type === "result");
+    const [result] = results;
+    return (
+      results.length === 1 &&
+      result !== undefined &&
+      result.session_id === session
+    );
   } catch {
     return false;
   }
@@ -59,10 +66,19 @@ export async function runClaudeTurns(options: {
     option: "--resume",
     id: sessionId,
   });
-  const followUpSummary = summarizeClaudeEvents(followUp.out, followUp.code);
-  const sessionResultsBound = boundResult(followUp.out, sessionId);
-  const bound = followUpSummary.complete && sessionResultsBound;
-  const measured = initialFingerprint !== null && beforeFollowUp !== null;
+  return combinedTurns(
+    initial,
+    followUp,
+    sessionId,
+    initialFingerprint,
+    beforeFollowUp,
+  );
+}
+
+function combinedOutput(
+  initial: ClaudeProcessResult,
+  followUp: ClaudeProcessResult,
+) {
   const out = `${initial.out.trimEnd()}\n${followUp.out.trimStart()}`;
   const err = [initial.err.trimEnd(), followUp.err.trimStart()]
     .filter(Boolean)
@@ -72,6 +88,40 @@ export async function runClaudeTurns(options: {
     Buffer.byteLength(err, "utf8") > 64 * 1024
   )
     throw new Error("Claude combined process output exceeds its limit");
+  return { out, err };
+}
+
+function continuationObservation(
+  bound: boolean,
+  sessionId: string,
+  initialFingerprint: string | null,
+  beforeFollowUp: string | null,
+): Observation {
+  const measured = initialFingerprint !== null && beforeFollowUp !== null;
+  return {
+    id: "sevro.claude.continuation",
+    completeness: bound && measured ? "complete" : "partial",
+    data: {
+      method: "same_session_resume",
+      sessionId,
+      preFollowUpWorktreeUnchanged: measured
+        ? initialFingerprint === beforeFollowUp
+        : null,
+    },
+  };
+}
+
+function combinedTurns(
+  initial: ClaudeProcessResult,
+  followUp: ClaudeProcessResult,
+  sessionId: string,
+  initialFingerprint: string | null,
+  beforeFollowUp: string | null,
+): ClaudeTurns {
+  const followUpSummary = summarizeClaudeEvents(followUp.out, followUp.code);
+  const sessionResultsBound = boundResult(followUp.out, sessionId);
+  const bound = followUpSummary.complete && sessionResultsBound;
+  const { out, err } = combinedOutput(initial, followUp);
   return {
     code: bound ? 0 : followUp.code || 1,
     out,
@@ -79,16 +129,11 @@ export async function runClaudeTurns(options: {
     initialOut: initial.out,
     followUpOut: followUp.out,
     sessionResultsBound,
-    continuation: {
-      id: "sevro.claude.continuation",
-      completeness: bound && measured ? "complete" : "partial",
-      data: {
-        method: "same_session_resume",
-        sessionId,
-        preFollowUpWorktreeUnchanged: measured
-          ? initialFingerprint === beforeFollowUp
-          : null,
-      },
-    },
+    continuation: continuationObservation(
+      bound,
+      sessionId,
+      initialFingerprint,
+      beforeFollowUp,
+    ),
   };
 }

package/src/hosts/claude-credential.ts

@@ -1,4 +1,3 @@
-import { existsSync } from "node:fs";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -15,7 +14,9 @@ async function savedClaudeCredential(): Promise<string | undefined> {
     return path;
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
-    throw new Error("Claude saved credential is unreadable or unavailable");
+    throw new Error("Claude saved credential is unreadable or unavailable", {
+      cause: error,
+    });
   }
 }
 
@@ -29,19 +30,7 @@ export async function stageClaudeAuthentication(
   configRoot: string,
   sourceFile?: string,
 ) {
-  const environment: Record<string, string> = {};
-  if (sourceFile === undefined) {
-    for (const name of CLAUDE_AUTH_VARIABLES) {
-      const value = process.env[name];
-      if (value) {
-        if (Buffer.byteLength(value, "utf8") > MAX_CREDENTIAL_BYTES)
-          throw new Error(
-            "Claude environment credential exceeds the size limit",
-          );
-        environment[name] = value;
-      }
-    }
-  }
+  const environment = authenticationEnvironment(sourceFile);
   if (Object.keys(environment).length) {
     await mkdir(configRoot, { recursive: true, mode: 0o700 });
     return {
@@ -55,45 +44,23 @@ export async function stageClaudeAuthentication(
   };
 }
 
-async function keychainCredential(): Promise<Buffer> {
-  if (process.platform !== "darwin" || !existsSync("/usr/bin/security"))
-    throw new Error("Claude keychain credential is unavailable");
-  const account = process.env.USER ?? process.env.LOGNAME;
-  const proc = Bun.spawn(
-    [
-      "/usr/bin/security",
-      "find-generic-password",
-      "-s",
-      "Claude Code-credentials",
-      ...(account ? ["-a", account] : []),
-      "-w",
-    ],
-    { stdout: "pipe", stderr: "ignore" },
-  );
-  const timer = setTimeout(() => proc.kill("SIGKILL"), 10_000);
-  const reader = proc.stdout.getReader();
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  try {
-    while (true) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      size += value.byteLength;
-      if (size > MAX_CREDENTIAL_BYTES)
-        throw new Error("Claude credential exceeds the size limit");
-      chunks.push(value);
+function boundedEnvironmentCredential(value: string): string {
+  if (Buffer.byteLength(value, "utf8") > MAX_CREDENTIAL_BYTES)
+    throw new Error("Claude environment credential exceeds the size limit");
+  return value;
+}
+
+function authenticationEnvironment(sourceFile: string | undefined) {
+  const environment: Record<string, string> = {};
+  if (sourceFile === undefined) {
+    for (const name of CLAUDE_AUTH_VARIABLES) {
+      const value = process.env[name];
+      if (value) {
+        environment[name] = boundedEnvironmentCredential(value);
+      }
     }
-    if ((await proc.exited) !== 0)
-      throw new Error("Claude keychain credential is unavailable");
-    return Buffer.concat(chunks);
-  } catch {
-    proc.kill("SIGKILL");
-    await proc.exited;
-    throw new Error("Claude keychain credential is unavailable");
-  } finally {
-    clearTimeout(timer);
-    reader.releaseLock();
   }
+  return environment;
 }
 
 /** Copy only a bounded login credential into one private host state. */
@@ -105,21 +72,35 @@ export async function stageClaudeCredential(
   await mkdir(configRoot, { recursive: true, mode: 0o700 });
   let credential: Buffer;
   try {
-    if (sourceFile) {
-      if ((await stat(sourceFile)).size > MAX_CREDENTIAL_BYTES)
-        throw new Error("oversized credential");
-      credential = await readFile(sourceFile);
-    } else credential = await keychainCredential();
-  } catch {
-    throw new Error("Claude credential is unreadable or unavailable");
+    credential = await readCredential(sourceFile);
+  } catch (error) {
+    throw new Error("Claude credential is unreadable or unavailable", {
+      cause: error,
+    });
+  }
+  requireBoundedCredential(credential);
+  const target = join(configRoot, ".credentials.json");
+  await writeFile(target, credential, { flag: "wx", mode: 0o600 });
+  return target;
+}
+
+async function readCredential(sourceFile: string | undefined) {
+  if (!sourceFile) {
+    if (process.platform !== "darwin")
+      throw new Error("Claude keychain credential is unavailable");
+    const { keychainCredential } = await import("./claude-keychain");
+    return keychainCredential();
   }
+  if ((await stat(sourceFile)).size > MAX_CREDENTIAL_BYTES)
+    throw new Error("oversized credential");
+  return readFile(sourceFile);
+}
+
+function requireBoundedCredential(credential: Buffer): void {
   if (
     credential.byteLength === 0 ||
     credential.byteLength > MAX_CREDENTIAL_BYTES ||
     !credential.toString("utf8").trim()
   )
     throw new Error("Claude credential is empty or oversized");
-  const target = join(configRoot, ".credentials.json");
-  await writeFile(target, credential, { flag: "wx", mode: 0o600 });
-  return target;
 }