@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/src/hosts/claude-events.ts

@@ -1,3 +1,4 @@
+import { isRecord } from "../value-guards";
 const MAX_EVENT_STREAM_BYTES = 8 * 1024 * 1024;
 
 export class ClaudeEventError extends Error {
@@ -9,26 +10,25 @@ export class ClaudeEventError extends Error {
 
 type Entry = Record<string, unknown>;
 
-function record(value: unknown): value is Entry {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
 function nonnegative(value: unknown): value is number {
   return typeof value === "number" && Number.isFinite(value) && value >= 0;
 }
 
 function validAssistant(value: Entry): boolean {
-  if (!record(value.message) || !Array.isArray(value.message.content))
+  if (!isRecord(value.message) || !Array.isArray(value.message.content))
     return false;
-  return value.message.content.every((block: unknown) => {
-    if (!record(block)) return false;
-    if (block.type !== "tool_use" || block.name !== "Skill") return true;
-    return (
-      record(block.input) &&
-      typeof block.input.skill === "string" &&
-      !!block.input.skill.split(":").at(-1)?.trim()
-    );
-  });
+  return value.message.content.every(validAssistantBlock);
+}
+
+function validAssistantBlock(block: unknown): boolean {
+  if (!isRecord(block)) return false;
+  if (block.type !== "tool_use" || block.name !== "Skill") return true;
+  return validSkillInput(block.input);
+}
+
+function validSkillInput(input: unknown): boolean {
+  if (!isRecord(input) || typeof input.skill !== "string") return false;
+  return !!input.skill.split(":").at(-1)?.trim();
 }
 
 function validResult(value: Entry): boolean {
@@ -41,7 +41,7 @@ function validResult(value: Entry): boolean {
 }
 
 function validEvent(value: unknown): value is Entry {
-  if (!record(value)) return false;
+  if (!isRecord(value)) return false;
   if (value.type === "result") return validResult(value);
   if (value.type === "assistant") return validAssistant(value);
   return typeof value.type === "string";
@@ -53,22 +53,20 @@ interface Usage {
 }
 
 function usage(value: unknown): Usage | null {
-  if (!record(value)) return null;
-  const input = value.input_tokens;
-  const output = value.output_tokens;
-  const cacheCreation = value.cache_creation_input_tokens ?? 0;
-  const cacheRead = value.cache_read_input_tokens ?? 0;
-  if (
-    !nonnegative(input) ||
-    !nonnegative(output) ||
-    !nonnegative(cacheCreation) ||
-    !nonnegative(cacheRead)
-  )
-    return null;
-  return {
-    inputTokens: input + cacheCreation + cacheRead,
-    outputTokens: output,
-  };
+  if (!isRecord(value)) return null;
+  const inputTokens = inputUsage(value);
+  if (inputTokens === null || !nonnegative(value.output_tokens)) return null;
+  return { inputTokens, outputTokens: value.output_tokens };
+}
+
+function inputUsage(value: Entry): number | null {
+  const counts = [
+    value.input_tokens,
+    value.cache_creation_input_tokens ?? 0,
+    value.cache_read_input_tokens ?? 0,
+  ];
+  if (!counts.every(nonnegative)) return null;
+  return counts.reduce((total, count) => total + count);
 }
 
 export interface ClaudeEventSummary {
@@ -87,42 +85,79 @@ export function summarizeClaudeEvents(
 ): ClaudeEventSummary {
   if (Buffer.byteLength(stream, "utf8") > MAX_EVENT_STREAM_BYTES)
     throw new ClaudeEventError("Claude event stream exceeds 8 MiB");
+  const { results, malformed } = parseResultEvents(stream);
+  return resultSummary(results, malformed, exitCode);
+}
+
+function parseResultEvents(stream: string) {
   const results: Entry[] = [];
   let malformed = false;
   for (const line of stream.split("\n")) {
     if (!line.trim()) continue;
     try {
-      const event: unknown = JSON.parse(line);
-      if (!validEvent(event)) malformed = true;
-      else if (event.type === "result") results.push(event);
+      const event = parseValidEvent(line);
+      if (event.type === "result") results.push(event);
     } catch {
       malformed = true;
     }
   }
-  const final = results.at(-1);
+  return { results, malformed };
+}
+
+function parseValidEvent(line: string): Entry {
+  const event: unknown = JSON.parse(line);
+  if (!validEvent(event)) throw new ClaudeEventError("Malformed Claude event");
+  return event;
+}
+
+function summarizeUsage(results: Entry[], malformed: boolean) {
   const usages = results.map((result) => usage(result.usage));
+  const validUsages = usages.filter((value): value is Usage => value !== null);
   const usageComplete =
-    !malformed && results.length > 0 && usages.every(Boolean);
-  const costs = results.map((result) => result.total_cost_usd);
+    !malformed && results.length > 0 && validUsages.length === usages.length;
   return {
-    complete:
-      !malformed &&
-      exitCode === 0 &&
-      results.length > 0 &&
-      results.every(
-        (result) => result.subtype === "success" && result.is_error === false,
-      ),
-    finalMessage: typeof final?.result === "string" ? final.result : null,
     inputTokens: usageComplete
-      ? usages.reduce((total, value) => total + value!.inputTokens, 0)
+      ? validUsages.reduce((total, value) => total + value.inputTokens, 0)
       : null,
     outputTokens: usageComplete
-      ? usages.reduce((total, value) => total + value!.outputTokens, 0)
+      ? validUsages.reduce((total, value) => total + value.outputTokens, 0)
       : null,
-    costUsd:
-      !malformed && results.length && costs.every(nonnegative)
-        ? costs.reduce((total, value) => total + (value as number), 0)
-        : null,
     usageComplete,
   };
 }
+
+function measuredCost(results: Entry[], malformed: boolean): number | null {
+  const costs = results.map((result) => result.total_cost_usd);
+  if (malformed || results.length === 0 || !costs.every(nonnegative))
+    return null;
+  return costs.reduce((total, value) => total + value, 0);
+}
+
+function resultSummary(
+  results: Entry[],
+  malformed: boolean,
+  exitCode: number,
+): ClaudeEventSummary {
+  const final = results.at(-1);
+  return {
+    complete: completedResults(results, malformed, exitCode),
+    finalMessage: typeof final?.result === "string" ? final.result : null,
+    costUsd: measuredCost(results, malformed),
+    ...summarizeUsage(results, malformed),
+  };
+}
+
+function completedResults(
+  results: Entry[],
+  malformed: boolean,
+  exitCode: number,
+): boolean {
+  return (
+    !malformed &&
+    exitCode === 0 &&
+    results.length > 0 &&
+    results.every(
+      (result) => result.subtype === "success" && result.is_error === false,
+    )
+  );
+}

package/src/hosts/claude-keychain.ts

@@ -0,0 +1,59 @@
+import { existsSync } from "node:fs";
+
+const MAX_CREDENTIAL_BYTES = 1024 * 1024;
+
+function keychainProcess() {
+  if (process.platform !== "darwin" || !existsSync("/usr/bin/security"))
+    throw new Error("Claude keychain credential is unavailable");
+  const account = process.env.USER ?? process.env.LOGNAME;
+  return Bun.spawn(
+    [
+      "/usr/bin/security",
+      "find-generic-password",
+      "-s",
+      "Claude Code-credentials",
+      ...(account ? ["-a", account] : []),
+      "-w",
+    ],
+    { stdout: "pipe", stderr: "ignore" },
+  );
+}
+
+async function boundedCredentialStream(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+): Promise<Buffer> {
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > MAX_CREDENTIAL_BYTES)
+      throw new Error("Claude credential exceeds the size limit");
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks);
+}
+
+export async function keychainCredential(): Promise<Buffer> {
+  const proc = keychainProcess();
+  const timer = setTimeout(() => {
+    proc.kill("SIGKILL");
+  }, 10_000);
+  const reader = proc.stdout.getReader();
+  try {
+    const credential = await boundedCredentialStream(reader);
+    if ((await proc.exited) !== 0)
+      throw new Error("Claude keychain credential is unavailable");
+    return credential;
+  } catch (error) {
+    proc.kill("SIGKILL");
+    await proc.exited;
+    throw new Error("Claude keychain credential is unavailable", {
+      cause: error,
+    });
+  } finally {
+    clearTimeout(timer);
+    reader.releaseLock();
+  }
+}

package/src/hosts/claude-native-goal.ts

@@ -18,12 +18,7 @@ function goalAttachment(event: RecordValue) {
   if (event.isSidechain === true || event.type !== "attachment") return [];
   const attachment = record(event.attachment);
   if (attachment.type !== "goal_status") return [];
-  const characters =
-    typeof attachment.condition === "string"
-      ? [...attachment.condition].length
-      : 0;
-  if (!characters || characters > 4000 || typeof attachment.met !== "boolean")
-    throw new Error("Malformed native goal attachment");
+  const characters = goalCharacters(attachment);
   return [
     {
       status: attachmentStatus(attachment),
@@ -33,6 +28,16 @@ function goalAttachment(event: RecordValue) {
   ];
 }
 
+function goalCharacters(attachment: RecordValue): number {
+  const characters =
+    typeof attachment.condition === "string"
+      ? Array.from(attachment.condition).length
+      : 0;
+  if (!characters || characters > 4000 || typeof attachment.met !== "boolean")
+    throw new Error("Malformed native goal attachment");
+  return characters;
+}
+
 function attachmentStatus(attachment: RecordValue): string {
   if (attachment.failed === true) return "blocked";
   if (!attachment.met) return "active";
@@ -59,12 +64,7 @@ export function claudeNativeGoalEvidence(
   sessionId: string,
 ) {
   const events = records(transcript);
-  for (const event of events) {
-    if (event.sessionId && event.sessionId !== sessionId)
-      throw new Error("Foreign native session record");
-  }
-  if (!events.some((event) => event.sessionId === sessionId))
-    throw new Error("Original native session not retained");
+  requireBoundSession(events, sessionId);
   requireSuccessfulResult(stream, sessionId);
   const goals = events.flatMap(goalAttachment);
   return {
@@ -75,6 +75,15 @@ export function claudeNativeGoalEvidence(
   };
 }
 
+function requireBoundSession(events: RecordValue[], sessionId: string): void {
+  for (const event of events) {
+    if (event.sessionId && event.sessionId !== sessionId)
+      throw new Error("Foreign native session record");
+  }
+  if (!events.some((event) => event.sessionId === sessionId))
+    throw new Error("Original native session not retained");
+}
+
 async function sessionPaths(
   path: string,
   sessionId: string,
@@ -88,7 +97,7 @@ async function sessionPaths(
     throw new Error("Native transcript tree contains a symlink");
   return (
     await Promise.all(
-      entries.map((entry) =>
+      entries.map(async (entry) =>
         entry.isDirectory()
           ? sessionPaths(join(path, entry.name), sessionId, bound)
           : basename(entry.name) === `${sessionId}.jsonl`
@@ -109,26 +118,8 @@ export async function observeClaudeNativeGoal(
   data: Record<string, unknown>;
 }> {
   try {
-    const initializations = records(stream).filter(
-      (event) => event.type === "system" && event.subtype === "init",
-    );
-    const ids = new Set(initializations.map((event) => event.session_id));
-    const id = [...ids][0];
-    if (
-      ids.size !== 1 ||
-      typeof id !== "string" ||
-      !/^[a-f0-9-]{36}$/i.test(id)
-    )
-      throw new Error("Missing or ambiguous original Claude session");
-    const paths = await sessionPaths(join(configRoot, "projects"), id);
-    if (paths.length !== 1)
-      throw new Error("Missing or ambiguous native transcript");
-    const entry = await lstat(paths[0]!);
-    if (!entry.isFile() || entry.size > 8 * 1024 * 1024)
-      throw new Error("Native transcript is unsafe or oversized");
-    const bytes = await readFile(paths[0]!);
-    if (bytes.length > 8 * 1024 * 1024)
-      throw new Error("Native transcript exceeds limit");
+    const id = originalSessionId(stream);
+    const bytes = await nativeTranscript(configRoot, id);
     return {
       id: "sevro.host.native-goal",
       completeness: "complete",
@@ -152,3 +143,36 @@ export async function observeClaudeNativeGoal(
     };
   }
 }
+
+function originalSessionId(stream: string): string {
+  const initializations = records(stream).filter(
+    (event) => event.type === "system" && event.subtype === "init",
+  );
+  const ids = new Set(initializations.map((event) => event.session_id));
+  const [id] = ids;
+  if (ids.size !== 1 || typeof id !== "string" || !/^[a-f0-9-]{36}$/i.test(id))
+    throw new Error("Missing or ambiguous original Claude session");
+  return id;
+}
+
+async function nativeTranscript(
+  configRoot: string,
+  id: string,
+): Promise<Buffer> {
+  const paths = await sessionPaths(join(configRoot, "projects"), id);
+  const path = uniqueTranscriptPath(paths);
+  const entry = await lstat(path);
+  if (!entry.isFile() || entry.size > 8 * 1024 * 1024)
+    throw new Error("Native transcript is unsafe or oversized");
+  const bytes = await readFile(path);
+  if (bytes.length > 8 * 1024 * 1024)
+    throw new Error("Native transcript exceeds limit");
+  return bytes;
+}
+
+function uniqueTranscriptPath(paths: string[]): string {
+  const [path] = paths;
+  if (paths.length !== 1 || path === undefined)
+    throw new Error("Missing or ambiguous native transcript");
+  return path;
+}

package/src/hosts/claude-process.ts

@@ -0,0 +1,111 @@
+import {
+  awaitHostProcess,
+  MAX_EVENT_BYTES,
+  HostProcessInterruption,
+} from "./process-lifecycle";
+import {
+  captureBoundedText,
+  terminateOwnedProcessGroup,
+} from "../process-lifecycle";
+import {
+  HostProcessDiagnostics,
+  type HostDiagnostics,
+} from "../host-diagnostics";
+
+const MAX_STDERR_BYTES = 64 * 1024;
+
+function stop(proc: Bun.Subprocess): void {
+  if (process.platform !== "win32") {
+    terminateOwnedProcessGroup(proc, { fallbackError: "propagate" });
+    return;
+  }
+  try {
+    proc.kill("SIGKILL");
+  } catch {
+    proc.kill("SIGKILL");
+  }
+}
+
+interface ClaudeProcessOptions {
+  diagnostics?: HostDiagnostics;
+  argv: string[];
+  cwd: string;
+  env: Record<string, string>;
+  timeoutMs: number;
+  signal?: AbortSignal;
+}
+
+function requireClaudeProcess(options: ClaudeProcessOptions): void {
+  if (options.signal?.aborted) throw new Error("Claude run cancelled");
+}
+
+function spawnClaudeProcess(
+  options: ClaudeProcessOptions,
+  capture: HostProcessDiagnostics,
+) {
+  try {
+    return Bun.spawn(options.argv, {
+      cwd: options.cwd,
+      env: options.env,
+      detached: process.platform !== "win32",
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+  } catch (cause) {
+    capture.recordUnstarted();
+    throw cause;
+  }
+}
+
+function claudeCompletion(
+  proc: ReturnType<typeof spawnClaudeProcess>,
+  capture: HostProcessDiagnostics,
+) {
+  const stdout = captureBoundedText(proc.stdout, {
+    limit: MAX_EVENT_BYTES,
+    overflow: "reject",
+    exceeded: () => new Error("Claude process output exceeds its limit"),
+    observe: (bytes) => {
+      capture.stdout.add(bytes);
+    },
+  });
+  const stderr = captureBoundedText(proc.stderr, {
+    limit: MAX_STDERR_BYTES,
+    overflow: "reject",
+    exceeded: () => new Error("Claude process output exceeds its limit"),
+    observe: (bytes) => {
+      capture.stderr.add(bytes);
+    },
+  });
+  const completed = Promise.all([stdout, stderr, proc.exited]).then(
+    ([out, err, code]) => ({ out, err, code }),
+  );
+  return { completed, drains: [stdout, stderr] };
+}
+
+function claudeInterruptionReason(cause: unknown) {
+  return cause instanceof HostProcessInterruption ? cause.reason : "error";
+}
+
+export async function runClaudeProcess(
+  options: ClaudeProcessOptions,
+): Promise<{ code: number; out: string; err: string }> {
+  requireClaudeProcess(options);
+  const capture = new HostProcessDiagnostics(options.diagnostics);
+  const proc = spawnClaudeProcess(options, capture);
+  const { completed, drains } = claudeCompletion(proc, capture);
+  try {
+    const result = await awaitHostProcess(proc, completed, {
+      ...options,
+      host: "Claude",
+      stop,
+    });
+    await capture.record(proc);
+    return result;
+  } catch (cause) {
+    await Promise.allSettled(drains);
+    await capture.record(proc, claudeInterruptionReason(cause));
+    throw cause;
+  }
+}