@chatcode/cco-market 1.45.1

package/src/log.ts

@@ -0,0 +1,206 @@
+/**
+ * Event log for issue reports: what the market did and how it failed,
+ * exportable as plain text from `/dsh-market/logs`.
+ *
+ * Privacy: entries are sanitized on write — the home directory collapses to
+ * `~`, and common credential shapes (API keys, GitHub/npm tokens, bearer
+ * headers) are masked. The in-memory buffer dies with the process and holds
+ * at most {@link MAX_ENTRIES} entries; a process that also configures a
+ * persistent sink appends every event there, capped at
+ * {@link PERSISTENT_MAX_BYTES}, because the failures worth reporting most —
+ * the ones that only appear after a restart — used to take their story with
+ * them when the process died (#341).
+ */
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { homedir } from 'node:os'
+
+export type LogLevel = 'info' | 'warn' | 'error'
+
+interface LogEntry {
+  at: string
+  level: LogLevel
+  event: string
+  detail: string
+}
+
+const MAX_ENTRIES = 200
+const DETAIL_MAX = 600
+const PERSISTENT_MAX_BYTES = 256 * 1024
+
+const entries: LogEntry[] = []
+let persistentFile: string | null = null
+/** Bytes in the sink file, tracked so the cap holds without a stat per event. */
+let persistentBytes = 0
+
+function sanitize(text: string): string {
+  return text
+    .replaceAll(homedir(), '~')
+    // Log-injection guard: control characters (newlines above all) would
+    // forge extra lines in the exported log file. The #98 routes pass
+    // user-supplied names into logEvent (bundle-order order entries, trial
+    // messages), so strip them at the single choke point (issue #98
+    // analysis: log filtering).
+    .replace(/[\u0000-\u001f\u007f]/g, '')
+    .replace(/sk-[A-Za-z0-9_-]{8,}/g, 'sk-***')
+    .replace(/gh[pousr]_[A-Za-z0-9]{16,}/g, 'gh*_***')
+    .replace(/npm_[A-Za-z0-9]{16,}/g, 'npm_***')
+    .replace(/bearer\s+\S+/gi, 'Bearer ***')
+    .replace(/(authorization|token|apikey|api-key|password)(["':=\s]+)\S+/gi, '$1$2***')
+}
+
+/**
+ * Append one event, sanitized and truncated.
+ * @param level - severity for the export listing.
+ * @param event - short machine-ish event name (e.g. `install`, `hot-mount`).
+ * @param detail - free-form context; credentials and home paths are masked.
+ */
+export function logEvent(level: LogLevel, event: string, detail: string): void {
+  const entry = {
+    at: new Date().toISOString(),
+    level,
+    event,
+    detail: sanitize(detail).slice(0, DETAIL_MAX),
+  }
+  entries.push(entry)
+  if (entries.length > MAX_ENTRIES) entries.splice(0, entries.length - MAX_ENTRIES)
+  if (persistentFile === null) return
+  try {
+    const line = `${JSON.stringify(entry)}\n`
+    appendFileSync(persistentFile, line)
+    persistentBytes += line.length
+    // Trimming only on mount left the cap unenforced for the life of a
+    // process: 20k events grew the file to 3.2 MB in a measurement, and a
+    // retry loop is exactly the situation that both logs hardest and never
+    // restarts. Re-trim in place once the ceiling is crossed.
+    if (persistentBytes > PERSISTENT_MAX_BYTES) trimPersistentLog(persistentFile)
+  } catch {
+    // Only append failures reach this: a read-only or full disk. The
+    // in-memory log still serves this session's export; persistence
+    // disables itself so one bad write cannot break every future event.
+    persistentFile = null
+  }
+}
+
+/**
+ * Rewrite the sink keeping only its newest half, and resync the byte count.
+ * @param file - the sink file to trim in place.
+ */
+function trimPersistentLog(file: string): void {
+  const lines = readFileSync(file, 'utf8').split('\n').filter(line => line !== '')
+  const kept: string[] = []
+  let bytes = 0
+  for (let index = lines.length - 1; index >= 0 && bytes <= PERSISTENT_MAX_BYTES / 2; index -= 1) {
+    kept.unshift(`${lines[index]!}\n`)
+    bytes += lines[index]!.length + 1
+  }
+  writeFileSync(file, kept.join(''))
+  persistentBytes = bytes
+}
+
+/**
+ * Append events to a profile-owned file, or stop doing so.
+ *
+ * Called once per mount with `<profile>/.dsh-market/log.ndjson` and with
+ * `null` on dispose. An oversized file is trimmed to its newest half on
+ * configure, so one long-lived profile cannot grow it without bound.
+ * @param file - the sink file, or null to disable persistence.
+ */
+export function configurePersistentLog(file: string | null): void {
+  persistentFile = file
+  if (file === null) return
+  try {
+    mkdirSync(dirname(file), { recursive: true })
+    persistentBytes = existsSync(file) ? statSync(file).size : 0
+    if (persistentBytes <= PERSISTENT_MAX_BYTES) return
+    trimPersistentLog(file)
+  } catch {
+    // Only configure-time filesystem failures reach this (the directory
+    // cannot be created, the file cannot be read or rewritten). The market
+    // must mount regardless; the session simply runs memory-only.
+    persistentFile = null
+  }
+}
+
+/**
+ * The newest persisted lines, for the export's prior-session section.
+ * @param file - the sink file to read.
+ * @param maxLines - how many trailing lines to return.
+ * @returns parsed-or-raw lines, newest last; empty when nothing is readable.
+ */
+export function readPersistentLog(file: string, maxLines = 80): string[] {
+  try {
+    return readFileSync(file, 'utf8').split('\n').filter(line => line !== '').slice(-maxLines)
+  } catch {
+    // Only a missing or unreadable file reaches this: there are no prior
+    // sessions to show, which is the empty answer.
+    return []
+  }
+}
+
+/**
+ * How to read the `at` fields, said once at the top.
+ *
+ * Every line is stamped in UTC and stays that way: this file is written to
+ * be attached to an issue, and a maintainer comparing two reporters' logs
+ * needs one clock, not each machine's. Localizing the lines would make the
+ * artifact worse at the only job it has.
+ *
+ * But the reader is looking at their own wall clock, and #449 is what that
+ * costs when nobody says so — a UTC+8 user saw `07:32` for something they
+ * watched happen at `15:32` and could not tell whether the log was skewed
+ * or their own machine was. So the offset is stated, with the arithmetic
+ * already done: "add 8h" is a fact they can use without converting
+ * anything, and it is the one line that turns the timestamps from
+ * suspicious into usable.
+ * @returns the note, or null when this machine is already on UTC.
+ */
+function timezoneNote(now = new Date()): string | null {
+  // getTimezoneOffset is minutes to ADD to local to reach UTC, so it is
+  // positive west of Greenwich — the opposite sign from how offsets are
+  // written. Negate it once here rather than at each use.
+  const minutes = -now.getTimezoneOffset()
+  if (minutes === 0) return null
+  const sign = minutes < 0 ? '-' : '+'
+  const abs = Math.abs(minutes)
+  const hh = String(Math.floor(abs / 60)).padStart(2, '0')
+  const mm = String(abs % 60).padStart(2, '0')
+  let zone = ''
+  try {
+    const named = Intl.DateTimeFormat().resolvedOptions().timeZone
+    zone = typeof named === 'string' && named !== '' ? ` (${named})` : ''
+  } catch { /* a runtime without full ICU still gets the offset */ }
+  const shift = mm === '00' ? `${String(Math.floor(abs / 60))}h` : `${String(Math.floor(abs / 60))}h${mm}m`
+  const direction = minutes < 0 ? 'subtract' : 'add'
+  return `timestamps: UTC — this machine is UTC${sign}${hh}:${mm}${zone}, so ${direction} ${shift} for local time`
+}
+
+/**
+ * The export document for bug reports.
+ * @param header - environment lines to prepend (version, platform — no paths).
+ * @returns plain text, newest entry last.
+ */
+export function exportLogs(header: Record<string, string>, snapshot: string[] = [], priorSessions: string[] = []): string {
+  const note = timezoneNote()
+  const head = [
+    ...Object.entries(header).map(([key, value]) => `${key}: ${sanitize(value)}`),
+    ...(note === null ? [] : [note]),
+  ]
+  const lines = entries.map(e => `${e.at} [${e.level}] ${e.event}: ${e.detail}`)
+  return [
+    '# ChatCode CLI Market log export',
+    ...head,
+    '',
+    // The state of the profile RIGHT NOW, which does not depend on anything
+    // having been recorded this session (#341). The buffer dies with the
+    // process, so the failures worth reporting most — the ones that only
+    // appear after a restart — were exactly the ones whose export said
+    // "(no events this session)". This part still answers.
+    ...(snapshot.length > 0 ? ['## profile state', ...snapshot.map(line => sanitize(line)), ''] : []),
+    ...(priorSessions.length > 0 ? ['## previous sessions (persisted log)', ...priorSessions.map(line => sanitize(line)), ''] : []),
+    '## events this session',
+    ...(lines.length > 0 ? lines : ['(none — the buffer starts empty on every start)']),
+    '',
+  ].join('\n')
+}

package/src/ndjson.ts

@@ -0,0 +1,185 @@
+/**
+ * pnpm `--reporter=ndjson` progress parser (P1-6).
+ *
+ * pnpm's ndjson reporter is a bole stream on stdout: one JSON object per
+ * line, e.g.
+ *
+ *   {"time":...,"level":"debug","name":"pnpm:stage","prefix":"...","stage":"resolution_started"}
+ *   {"time":...,"level":"debug","name":"pnpm:progress","packageId":"...","status":"resolved"}
+ *   {"time":...,"level":"debug","name":"pnpm:fetching-progress","packageId":"...","status":"started","size":123}
+ *   {"time":...,"level":"debug","name":"pnpm:ignored-scripts","packageNames":["esbuild"]}
+ *   {"time":...,"level":"error","name":"pnpm","err":{"message":"..."}}
+ *
+ * Verified against real pnpm 11.16.0 output (2026-08). Older pnpm majors
+ * emit a different shape or nothing at all — callers fall back to human
+ * line parsing when `seen` stays false.
+ *
+ * The reducer is pure and unit-testable: `feed` mutates the tracker's
+ * internal snapshot, `snapshot` returns a serializable copy.
+ */
+
+export type ProgressPhase = 'resolving' | 'downloading' | 'linking' | 'building' | null
+
+export interface ProgressSnapshot {
+  phase: ProgressPhase
+  /** Distinct packages resolved/fetched so far. */
+  done: number
+  /** Package-count total; pnpm 11's stream carries no per-run total. */
+  total: number | null
+  /** Package being fetched/linked right now (its `packageId`), or null. */
+  currentPackage: string | null
+  /** Bytes downloaded for the current package, when known. */
+  downloaded: number | null
+  /** Total bytes for the current package, when known. */
+  size: number | null
+  /** True once any structured pnpm event was parsed (ndjson works). */
+  seen: boolean
+  /** Last fatal error message carried by the stream, if any. */
+  error: string | null
+  /**
+   * pnpm's own error CODE from that same event (`ERR_PNPM_…`), when it
+   * carried one. The code is the part that classifies reliably: the message
+   * is prose and gets reworded between pnpm releases (#244).
+   */
+  errorCode: string | null
+  /** Package names pnpm reported as having ignored build scripts. */
+  ignoredBuilds: string[]
+}
+
+export function emptyProgress(): ProgressSnapshot {
+  return {
+    phase: null,
+    done: 0,
+    total: null,
+    currentPackage: null,
+    downloaded: null,
+    size: null,
+    seen: false,
+    error: null,
+    errorCode: null,
+    ignoredBuilds: [],
+  }
+}
+
+export interface ProgressTracker {
+  readonly snapshot: ProgressSnapshot
+  feed(line: string): void
+  reset(): void
+}
+
+export function createProgressTracker(): ProgressTracker {
+  const snap = emptyProgress()
+  const seenPackages = new Set<string>()
+
+  function dedupe(packageId: unknown): void {
+    if (typeof packageId !== 'string' || packageId === '') return
+    if (!seenPackages.has(packageId)) {
+      seenPackages.add(packageId)
+      snap.done += 1
+    }
+  }
+
+  function feed(line: string): void {
+    let event: unknown
+    try {
+      event = JSON.parse(line)
+    } catch {
+      return // human fallback lines are handled by the caller
+    }
+    if (typeof event !== 'object' || event === null) return
+    const msg = event as Record<string, unknown>
+    const name = msg.name
+    if (typeof name !== 'string') return
+
+    if (name === 'pnpm:stage') {
+      const stage = msg.stage
+      if (stage === 'resolution_started') snap.phase = 'resolving'
+      else if (stage === 'resolution_done') snap.phase = 'downloading'
+      else if (stage === 'importing_started' || stage === 'importing_done') snap.phase = 'linking'
+      snap.seen = true
+      return
+    }
+
+    if (name === 'pnpm:progress') {
+      snap.seen = true
+      const status = msg.status
+      if (status === 'resolved') {
+        if (snap.phase === null) snap.phase = 'resolving'
+        dedupe(msg.packageId)
+      } else if (status === 'fetched' || status === 'found_in_store') {
+        snap.phase = 'downloading'
+        snap.currentPackage = typeof msg.packageId === 'string' ? msg.packageId : snap.currentPackage
+        dedupe(msg.packageId)
+      }
+      return
+    }
+
+    if (name === 'pnpm:fetching-progress') {
+      snap.seen = true
+      snap.phase = 'downloading'
+      if (typeof msg.packageId === 'string') snap.currentPackage = msg.packageId
+      if (typeof msg.size === 'number') snap.size = msg.size
+      if (typeof msg.downloaded === 'number') snap.downloaded = msg.downloaded
+      dedupe(msg.packageId)
+      return
+    }
+
+    if (name === 'pnpm:lifecycle') {
+      snap.seen = true
+      snap.phase = 'building'
+      const wd = typeof msg.wd === 'string' ? msg.wd : ''
+      const dep = typeof msg.depPath === 'string' ? msg.depPath : ''
+      const base = wd.split(/[\\/]/).filter(Boolean).pop()
+      snap.currentPackage = base ?? (dep !== '' ? dep : snap.currentPackage)
+      return
+    }
+
+    if (name === 'pnpm:stats') {
+      // added/removed counts land after the import pass — still linking.
+      if (msg.added !== undefined || msg.removed !== undefined) snap.phase = 'linking'
+      snap.seen = true
+      return
+    }
+
+    if (name === 'pnpm:ignored-scripts') {
+      snap.seen = true
+      if (Array.isArray(msg.packageNames)) {
+        for (const pkg of msg.packageNames) {
+          // pnpm's ndjson event reports version-qualified names (cloudflared@0.7.3);
+          // the approve-builds allowlist keys and node_modules lookups use bare
+          // package names, so strip the suffix (same rule as the human-line
+          // fallback in install.ts's parseIgnoredBuilds).
+          const at = typeof pkg === 'string' ? pkg.lastIndexOf('@') : -1
+          const bare = at > 0 ? pkg.slice(0, at) : pkg
+          if (typeof bare === 'string' && bare !== '' && !snap.ignoredBuilds.includes(bare)) snap.ignoredBuilds.push(bare)
+        }
+      }
+      return
+    }
+
+    if (name === 'pnpm' && msg.level === 'error') {
+      const err = (msg.err ?? {}) as Record<string, unknown>
+      const message = typeof err.message === 'string' ? err.message : ''
+      // Keep more than the old 400: ERR_PNPM_UNEXPECTED_STORE spends most of
+      // its message naming two absolute store paths, and truncating them is
+      // exactly the information a user needs to fix it by hand (#244).
+      if (message !== '') snap.error = message.slice(0, 2000)
+      if (typeof err.code === 'string' && err.code !== '') snap.errorCode = err.code
+      return
+    }
+  }
+
+  function reset(): void {
+    seenPackages.clear()
+    const fresh = emptyProgress()
+    Object.assign(snap, fresh)
+  }
+
+  return {
+    get snapshot(): ProgressSnapshot {
+      return { ...snap, ignoredBuilds: [...snap.ignoredBuilds] }
+    },
+    feed,
+    reset,
+  }
+}

package/src/net.ts

@@ -0,0 +1,106 @@
+/**
+ * Outbound HTTP for the market's own server-side calls.
+ *
+ * Node's global `fetch` ignores `HTTP_PROXY` / `HTTPS_PROXY` entirely
+ * (measured on Node 25: a request with an unreachable proxy configured still
+ * succeeds directly, and setting `NODE_USE_ENV_PROXY` at runtime changes
+ * nothing — it is read at startup). On a machine whose route out is a local
+ * proxy, that is not a slowdown but a different network: the catalog fetch
+ * took 9.9s direct on a reporter's machine, seconds from the 15s timeout,
+ * while their proxy sat unused a millisecond away.
+ *
+ * `setGlobalDispatcher` from the `undici` PACKAGE cannot fix this, because
+ * `globalThis.fetch` runs on Node's INTERNAL copy of undici — a different
+ * instance. Verified: with a dispatcher installed, a global fetch still
+ * produced no CONNECT at a local proxy, while undici's own fetch produced
+ * `CONNECT awesome-dsh-plugin.com:443`.
+ *
+ * So the market calls undici's fetch with an explicit dispatcher. The scope
+ * is deliberate: only requests made by this module change, and the host's
+ * own networking is left exactly as the host configured it.
+ */
+
+import { EnvHttpProxyAgent, fetch as undiciFetch } from 'undici'
+
+/**
+ * The proxy this process would use for the catalog, if any.
+ *
+ * The standard variables mirror `EnvHttpProxyAgent`'s own resolution
+ * deliberately, rather than picking the order that reads best, because the
+ * same answer does two jobs: it decides whether to route through undici at
+ * all, and it is what the failure message CLAIMS was tried. A helper that
+ * named a proxy undici would not have used would put a false statement in
+ * every bug report. `npm_config_*` is an additional source on top of that:
+ * npm holds its proxy in its own config namespace (a machine set up with
+ * `npm config set proxy` has the proxy in `npm_config_proxy` and nowhere
+ * else), and undici does not read it — so it is resolved here and handed to
+ * the agent explicitly in `marketFetch`.
+ *
+ * Three details are undici's, not ours (env-http-proxy-agent.js):
+ *   - lowercase wins over uppercase (`https_proxy ?? HTTPS_PROXY`)
+ *   - an https request falls back to the http proxy when no https one is set
+ *   - the value is tested for truthiness, so `HTTPS_PROXY=` — which is how
+ *     people turn a proxy off — falls through instead of masking HTTP_PROXY
+ *
+ * Blank-is-unset is ours, and only widens that last one: undici would hand a
+ * whitespace-only value to `new URL()` and throw out of the constructor.
+ * Scheme-less host:port values are also common in Windows proxy fields and
+ * npm config; proxy agents require URLs, so those default to `http://`.
+ */
+export function configuredProxy(): string | null {
+  const { http, https } = proxyFromEnv()
+  return https ?? http
+}
+
+/**
+ * Proxy URLs resolved from the process environment, standard variables
+ * first and npm's own config (`npm_config_https_proxy` / `npm_config_proxy`)
+ * as the fallback. npm's config is the second source, not a preference: a
+ * standard variable always wins over npm's, and npm's https proxy falls
+ * back to npm's http proxy the same way undici's does.
+ */
+function proxyFromEnv(): { http: string | null; https: string | null } {
+  const pick = (raw: string | undefined): string | null => {
+    const value = raw?.trim()
+    if (value === undefined || value === '') return null
+    return /^[a-z][a-z\d+.-]*:\/\//iu.test(value) ? value : `http://${value}`
+  }
+  const https =
+    pick(process.env.https_proxy ?? process.env.HTTPS_PROXY) ??
+    pick(process.env.npm_config_https_proxy)
+  const http =
+    pick(process.env.http_proxy ?? process.env.HTTP_PROXY) ??
+    pick(process.env.npm_config_proxy)
+  return { http, https }
+}
+
+/**
+ * Built once and reused: an agent per request would drop connection reuse,
+ * and this one reads NO_PROXY as well, so a host that excludes its own
+ * registry mirror keeps being excluded.
+ */
+let agent: EnvHttpProxyAgent | null = null
+
+/**
+ * Fetch through the proxy this machine is configured to use.
+ *
+ * Falls back to the global fetch when no proxy is set, which keeps the
+ * ordinary case on the runtime's own path rather than routing it through a
+ * second HTTP stack for no reason.
+ */
+export async function marketFetch(
+  url: string,
+  init?: { signal?: AbortSignal; headers?: Record<string, string> },
+): Promise<Response> {
+  const { http, https } = proxyFromEnv()
+  if (http === null && https === null) return await fetch(url, init)
+  // Pass the resolved proxies explicitly. EnvHttpProxyAgent itself reads
+  // only http(s)_proxy out of the environment, so a proxy that lives in
+  // npm_config_* must be handed over directly — otherwise the agent would
+  // silently go direct while configuredProxy() claims a proxy was used.
+  agent ??= new EnvHttpProxyAgent({
+    httpProxy: http ?? undefined,
+    httpsProxy: https ?? undefined,
+  })
+  return await undiciFetch(url, { ...init, dispatcher: agent }) as unknown as Response
+}