@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/src/hosts/native-controls.ts

@@ -1,5 +1,7 @@
-import type { codexNativeCallObservation } from "./codex-native-calls";
+import { isRecord, isUnknownArray } from "../value-guards";
 import { summarizeClaudeEvents } from "./claude-events";
+import type { codexNativeCallObservation } from "./codex-native-calls";
+import type { ExecCallReceipt } from "./codex-exec-controls";
 
 const MAX_CALLS = 128;
 type Call = { ordinal: number; namespace: string; name: string };
@@ -12,15 +14,18 @@ export interface NativeControlObservation {
     method: "native_control_calls";
     calls: Call[];
     acceptedAgentCount: number | null;
+    directAcceptedAgentCount?: number;
+    coverage?: {
+      nativeCalls: NativeControlObservation["completeness"];
+      execInspection: "complete" | "partial";
+      acceptedAgents: "direct_native_calls";
+    };
     submittedExecCalls: number | null;
+    execCalls?: ExecCallReceipt[];
     truncated: boolean | null;
   };
 }
 
-function record(value: unknown): value is Entry {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
 function label(value: unknown, max: number): value is string {
   return (
     typeof value === "string" &&
@@ -33,10 +38,11 @@ function label(value: unknown, max: number): value is string {
 export function codexNativeControls(
   observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
 ): NativeControlObservation {
-  const complete = observation.completeness === "complete";
+  const complete =
+    observation.completeness === "complete" && inspectedExecCalls(observation);
   return {
     id: "sevro.host.native-controls",
-    completeness: observation.completeness,
+    completeness: controlCompleteness(observation.completeness, complete),
     data: {
       method: "native_control_calls",
       calls: observation.data.toolCalls.map(({ ordinal, namespace, name }) => ({
@@ -47,11 +53,137 @@ export function codexNativeControls(
       acceptedAgentCount: complete
         ? observation.data.acceptedSpawns.length
         : null,
-      submittedExecCalls: complete ? observation.data.submittedExecCalls : null,
-      truncated: complete ? false : null,
+      directAcceptedAgentCount: observation.data.acceptedSpawns.length,
+      coverage: {
+        nativeCalls: observation.completeness,
+        execInspection: inspectedExecCalls(observation)
+          ? "complete"
+          : "partial",
+        acceptedAgents: "direct_native_calls",
+      },
+      ...nativeCounts(observation),
+      ...execEvidence(observation.data.execCalls),
     },
   };
 }
+function nativeCounts(
+  observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
+) {
+  const complete = observation.completeness === "complete";
+  return {
+    submittedExecCalls: complete ? observation.data.submittedExecCalls : null,
+    truncated: complete ? false : null,
+  };
+}
+function controlCompleteness(
+  source: NativeControlObservation["completeness"],
+  complete: boolean,
+): NativeControlObservation["completeness"] {
+  return source === "complete" && !complete ? "partial" : source;
+}
+function execEvidence(receipts: ExecCallReceipt[] | undefined) {
+  return receipts ? { execCalls: receipts } : {};
+}
+
+function inspectedExecCalls(
+  observation: Awaited<ReturnType<typeof codexNativeCallObservation>>,
+): boolean {
+  const receipts = observation.data.execCalls ?? [];
+  const submissions = observation.data.toolCalls.filter(
+    (call) => call.name === "exec",
+  );
+  if (
+    submissions.length !== observation.data.submittedExecCalls ||
+    receipts.length !== submissions.length
+  )
+    return false;
+  return receipts.every(
+    (receipt, index) =>
+      receipt.completeness === "complete" &&
+      receipt.ordinal === submissions[index]?.ordinal,
+  );
+}
+
+const MALFORMED = Symbol("malformed native control event");
+
+function controlEvent(line: string): unknown {
+  try {
+    return JSON.parse(line) as unknown;
+  } catch {
+    return MALFORMED;
+  }
+}
+
+function assistantBlocks(event: unknown): unknown[] | null | typeof MALFORMED {
+  if (event === MALFORMED) return MALFORMED;
+  if (!assistantEvent(event)) return null;
+  const content = isRecord(event.message) ? event.message.content : null;
+  return isUnknownArray(content) ? content : MALFORMED;
+}
+
+function nativeBlock(value: unknown): Entry | null {
+  const types = ["text", "thinking", "redacted_thinking", "tool_use"];
+  return isRecord(value) && types.includes(String(value.type)) ? value : null;
+}
+
+function toolIdentity(
+  block: Entry,
+  ids: Set<string>,
+): { id: string; name: string } | null {
+  if (!label(block.id, 128) || !label(block.name, 256) || ids.has(block.id))
+    return null;
+  return { id: block.id, name: block.name };
+}
+
+class ClaudeNativeControls {
+  readonly calls: Call[] = [];
+  readonly ids = new Set<string>();
+  malformed = false;
+  truncated = false;
+
+  parse(stream: string): void {
+    for (const line of stream.split("\n")) {
+      if (!line.trim()) continue;
+      if (!this.observeLine(line)) break;
+    }
+  }
+
+  private observeLine(line: string): boolean {
+    const blocks = assistantBlocks(controlEvent(line));
+    if (blocks === null) return true;
+    if (blocks === MALFORMED) {
+      this.malformed = true;
+      return true;
+    }
+    for (const block of blocks) if (!this.observeBlock(block)) return false;
+    return true;
+  }
+
+  private observeBlock(value: unknown): boolean {
+    const block = nativeBlock(value);
+    if (!block) {
+      this.malformed = true;
+      return true;
+    }
+    if (block.type !== "tool_use") return true;
+    const identity = toolIdentity(block, this.ids);
+    if (!identity) {
+      this.malformed = true;
+      return true;
+    }
+    this.ids.add(identity.id);
+    if (this.calls.length >= MAX_CALLS) {
+      this.truncated = true;
+      return false;
+    }
+    this.calls.push({
+      ordinal: this.calls.length,
+      namespace: "claude",
+      name: identity.name,
+    });
+    return true;
+  }
+}
 
 /** Observe all native labels without retaining arguments or interpreting policy. */
 export function claudeNativeControls(
@@ -59,66 +191,24 @@ export function claudeNativeControls(
   exitCode: number,
 ): NativeControlObservation {
   const summary = summarizeClaudeEvents(stream, exitCode);
-  const calls: Call[] = [];
-  const ids = new Set<string>();
-  let malformed = false;
-  let truncated = false;
-  lines: for (const line of stream.split("\n")) {
-    if (!line.trim()) continue;
-    let event: unknown;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      malformed = true;
-      continue;
-    }
-    if (!record(event) || event.type !== "assistant") continue;
-    const content = record(event.message) ? event.message.content : null;
-    if (!Array.isArray(content)) {
-      malformed = true;
-      continue;
-    }
-    for (const block of content) {
-      if (
-        !record(block) ||
-        !["text", "thinking", "redacted_thinking", "tool_use"].includes(
-          String(block.type),
-        )
-      ) {
-        malformed = true;
-        continue;
-      }
-      if (block.type !== "tool_use") continue;
-      if (
-        !label(block.id, 128) ||
-        !label(block.name, 256) ||
-        ids.has(block.id)
-      ) {
-        malformed = true;
-        continue;
-      }
-      ids.add(block.id);
-      if (calls.length >= MAX_CALLS) {
-        truncated = true;
-        break lines;
-      }
-      calls.push({
-        ordinal: calls.length,
-        namespace: "claude",
-        name: block.name,
-      });
-    }
-  }
+  const controls = new ClaudeNativeControls();
+  controls.parse(stream);
   return {
     id: "sevro.host.native-controls",
     completeness:
-      summary.complete && !malformed && !truncated ? "complete" : "partial",
+      summary.complete && !controls.malformed && !controls.truncated
+        ? "complete"
+        : "partial",
     data: {
       method: "native_control_calls",
-      calls,
+      calls: controls.calls,
       acceptedAgentCount: null,
       submittedExecCalls: null,
-      truncated,
+      truncated: controls.truncated,
     },
   };
 }
+
+function assistantEvent(value: unknown): value is Entry {
+  return isRecord(value) && value.type === "assistant";
+}

package/src/hosts/process-lifecycle.ts

@@ -0,0 +1,37 @@
+import { ProcessDeadline } from "../process-lifecycle";
+
+export const MAX_EVENT_BYTES = 8 * 1024 * 1024;
+export class HostProcessInterruption extends Error {
+  constructor(
+    host: string,
+    readonly reason: "timeout" | "cancelled",
+  ) {
+    super(`${host} run ${reason === "timeout" ? "timed out" : "cancelled"}`);
+  }
+}
+
+/** Race completion against the host deadline and cancellation, then release listeners. */
+export async function awaitHostProcess<T>(
+  proc: Bun.Subprocess,
+  completed: Promise<T>,
+  options: {
+    host: "Codex" | "Claude";
+    timeoutMs: number;
+    signal?: AbortSignal;
+    stop: (proc: Bun.Subprocess) => void;
+  },
+): Promise<T> {
+  const deadline = new ProcessDeadline({
+    ...options,
+    interruption: (reason) => new HostProcessInterruption(options.host, reason),
+  });
+  try {
+    return await deadline.wait(completed);
+  } catch (error) {
+    options.stop(proc);
+    await proc.exited;
+    throw error;
+  } finally {
+    deadline.dispose();
+  }
+}

package/src/hosts/protected-worktrees.ts

@@ -1,26 +1,63 @@
-import { lstat, realpath, stat } from "node:fs/promises";
+import { isMissingFile } from "../fixtures/tools";
+import { lstat, readdir, realpath, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join } from "node:path";
 
 async function containingRepository(root: string): Promise<string | null> {
   let directory = (await stat(root)).isDirectory() ? root : dirname(root);
-  while (true) {
-    try {
-      await lstat(join(directory, ".git"));
-      return directory;
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "ENOENT")
-        throw new Error("protected repository metadata is unreadable");
-    }
+  for (;;) {
+    if (await hasRepositoryMetadata(directory)) return directory;
     const parent = dirname(directory);
     if (parent === directory) return null;
     directory = parent;
   }
 }
 
+async function hasRepositoryMetadata(directory: string): Promise<boolean> {
+  try {
+    const path = join(directory, ".git");
+    const metadata = await lstat(path);
+    return !(await emptyTemporaryGitPlaceholder(directory, path, metadata));
+  } catch (cause) {
+    if (isMissingFile(cause)) return false;
+    throw new Error("protected repository metadata is unreadable", { cause });
+  }
+}
+
+async function emptyTemporaryGitPlaceholder(
+  directory: string,
+  path: string,
+  metadata: Awaited<ReturnType<typeof lstat>>,
+): Promise<boolean> {
+  // Codex's Linux sandbox can leave an empty mount placeholder at /tmp/.git.
+  return (
+    process.platform === "linux" &&
+    (directory === "/tmp" || directory === tmpdir()) &&
+    metadata.isDirectory() &&
+    (await readdir(path)).length === 0
+  );
+}
+
 /** Protect the primary checkout and linked worktrees without requiring Git. */
 export async function protectedWorktrees(root: string): Promise<string[]> {
   const repository = await containingRepository(root);
   if (!repository) return [];
+  const paths = listWorktreePaths(repository);
+  const existing: string[] = [];
+  for (const path of paths) {
+    try {
+      existing.push(await realpath(path));
+    } catch (error) {
+      if (!isMissingFile(error))
+        throw new Error("protected repository worktree is unreadable", {
+          cause: error,
+        });
+    }
+  }
+  return existing;
+}
+
+function listWorktreePaths(repository: string): string[] {
   const result = Bun.spawnSync(
     ["git", "-C", repository, "worktree", "list", "--porcelain", "-z"],
     {
@@ -41,16 +78,11 @@ export async function protectedWorktrees(root: string): Promise<string[]> {
     .split("\0")
     .filter((field) => field.startsWith("worktree "))
     .map((field) => field.slice(9));
+  validateWorktreePaths(paths);
+  return paths;
+}
+
+function validateWorktreePaths(paths: string[]): void {
   if (!paths.length || paths.some((path) => !isAbsolute(path)))
     throw new Error("protected repository worktree paths are invalid");
-  const existing: string[] = [];
-  for (const path of paths) {
-    try {
-      existing.push(await realpath(path));
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "ENOENT")
-        throw new Error("protected repository worktree is unreadable");
-    }
-  }
-  return existing;
 }

package/src/hosts/skill-hook-catalog.ts

@@ -0,0 +1,131 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir, realpath } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import type { Dirent } from "node:fs";
+import type { HookSkill } from "./skill-hook-handler";
+import { isRecord } from "../value-guards";
+
+const MAX_SKILLS = 128;
+const MAX_SKILL_BYTES = 1024 * 1024;
+const MAX_CATALOG_BYTES = 8 * 1024 * 1024;
+interface Catalog {
+  skills: HookSkill[];
+  complete: boolean;
+  bytes: number;
+}
+export interface SkillCatalogRoot {
+  directory: string;
+  boundary: string;
+  namespace?: string;
+}
+
+export async function codexSkillCatalogRoots(
+  workspace: string,
+  pluginRoots: string[],
+  nativeSkillRoots: SkillCatalogRoot[],
+): Promise<SkillCatalogRoot[]> {
+  const roots: SkillCatalogRoot[] = [
+    { directory: join(workspace, ".agents/skills"), boundary: workspace },
+    ...nativeSkillRoots,
+  ];
+  for (const root of pluginRoots) {
+    const manifest: unknown = JSON.parse(
+      await readFile(join(root, ".claude-plugin/plugin.json"), "utf8"),
+    );
+    if (!isRecord(manifest) || typeof manifest.name !== "string")
+      throw new Error("invalid skill catalog plugin manifest");
+    roots.push({
+      directory: join(root, "skills"),
+      boundary: root,
+      namespace: manifest.name,
+    });
+  }
+  return roots;
+}
+
+/** Snapshot only known skill mounts; shell syntax does not enter discovery. */
+export async function skillHookCatalog(roots: SkillCatalogRoot[]) {
+  const catalog: Catalog = { skills: [], complete: true, bytes: 0 };
+  for (const root of roots) await readRoot(root, catalog);
+  return { skills: catalog.skills, catalogComplete: catalog.complete };
+}
+
+async function readRoot(root: SkillCatalogRoot, catalog: Catalog) {
+  try {
+    await requireCatalogRoot(root);
+    const entries = await readdir(root.directory, { withFileTypes: true });
+    const directories = catalogDirectories(entries, catalog);
+    for (const entry of directories.sort((a, b) =>
+      a.name.localeCompare(b.name),
+    )) {
+      await readSkill(root, entry.name, catalog);
+    }
+  } catch (cause) {
+    if (!missing(cause)) catalog.complete = false;
+  }
+}
+
+function catalogDirectories(entries: Dirent[], catalog: Catalog): Dirent[] {
+  const directories: Dirent[] = [];
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) catalog.complete = false;
+    if (entry.isDirectory() && /^[A-Za-z0-9._-]+$/.test(entry.name))
+      directories.push(entry);
+  }
+  return directories;
+}
+
+async function requireCatalogRoot(root: SkillCatalogRoot) {
+  const expected = resolve(
+    await realpath(root.boundary),
+    relative(root.boundary, root.directory),
+  );
+  if ((await realpath(root.directory)) !== expected)
+    throw new Error("redirected skill catalog root");
+}
+
+function missing(cause: unknown): boolean {
+  return cause instanceof Error && "code" in cause && cause.code === "ENOENT";
+}
+
+async function readSkill(
+  root: SkillCatalogRoot,
+  name: string,
+  catalog: Catalog,
+) {
+  try {
+    const path = join(root.directory, name, "SKILL.md");
+    const file = await lstat(path);
+    if (!readableSkill(file)) {
+      catalog.complete = false;
+      return;
+    }
+    const bytes = await readFile(path);
+    if (bytes.length > MAX_SKILL_BYTES)
+      throw new Error("skill changed during catalog read");
+    addSkill(bytes, [root.namespace, name].filter(Boolean).join(":"), catalog);
+  } catch (cause) {
+    if (!missing(cause)) catalog.complete = false;
+  }
+}
+
+function readableSkill(file: Awaited<ReturnType<typeof lstat>>): boolean {
+  return file.isFile() && file.size <= MAX_SKILL_BYTES;
+}
+
+function addSkill(bytes: Buffer, invocation: string, catalog: Catalog) {
+  if (!bytes.length) return;
+  catalog.bytes += bytes.length;
+  if (
+    catalog.skills.length >= MAX_SKILLS ||
+    catalog.bytes > MAX_CATALOG_BYTES
+  ) {
+    catalog.complete = false;
+    return;
+  }
+  catalog.skills.push({
+    invocation,
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    body: bytes.toString("utf8"),
+  });
+}