@cleocode/adapters 2026.6.14 → 2026.6.17

package/dist/index.js

@@ -11274,6 +11274,22 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // ── selfimprove query: probe (T11988 — seeded-code-regression scenario) ────────
+      // Pure read-only op that returns `{ probe: 'ok', version: probeVersion() }`.
+      // The `probe-helper.ts` intentionally ships with `probeVersion()` returning `2`
+      // (should be `1`) so the seeded-code-regression scenario replay diverges from its
+      // golden (`version: 1`) and gives the fix-gen LLM stage a real, patchable bug.
+      {
+        gateway: "query",
+        domain: "selfimprove",
+        operation: "probe",
+        description: 'selfimprove.probe (query) \u2014 returns { probe: "ok", version: 1 } (health/version probe). Used by the seeded-code-regression scenario to validate the fix-gen pipeline (T11988).',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
       // ── selfimprove mutate: run (T11889 / T11889-D — the self-dogfooding loop) ──
       // Boots ONE sandbox → replays the named canned scenario → diffs result
       // envelopes vs the golden → on a regression emits ONE leased `selfimprove_dhq`
@@ -11887,6 +11903,31 @@ var init_operations_registry = __esm({
             cli: { positional: true }
           }
         ]
+      },
+      // T11995 — Janitor MVP: orphan process reaper + stale scope/lock/debris sweep
+      {
+        gateway: "mutate",
+        domain: "admin",
+        operation: "janitor.run",
+        description: "admin.janitor.run (mutate) \u2014 run the janitor sweep: reap orphan processes, stop dead cleo-owned scopes, reclaim stale locks, prune tmp debris",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Report planned actions without mutating anything."
+          },
+          {
+            name: "gracePeriodMs",
+            type: "number",
+            required: false,
+            description: "Minimum age (ms) of an unregistered process before reap eligibility (default: 600000)."
+          }
+        ]
       }
     ];
   }
@@ -42786,6 +42827,188 @@ var init_install = __esm({
   }
 });
 
+// packages/adapters/src/providers/shared/agent-spawn-wrapper.ts
+import { spawnSync } from "node:child_process";
+import { readFileSync as readFileSync6 } from "node:fs";
+function hasSystemdRun() {
+  if (_systemdRunAvailable !== void 0) return _systemdRunAvailable;
+  if (process.platform !== "linux") {
+    _systemdRunAvailable = false;
+    return false;
+  }
+  const probe = spawnSync("systemd-run", ["--version"], { stdio: "ignore" });
+  _systemdRunAvailable = probe.status === 0;
+  return _systemdRunAvailable;
+}
+function readMemTotalBytes() {
+  if (process.platform !== "linux") return 32 * 1024 * 1024 * 1024;
+  try {
+    const raw = readFileSync6("/proc/meminfo", "utf8");
+    const m = raw.match(/^MemTotal:\s+(\d+)\s+kB/m);
+    if (m?.[1]) return parseInt(m[1], 10) * 1024;
+  } catch {
+  }
+  return 32 * 1024 * 1024 * 1024;
+}
+function buildAgentSpawnArgs(command, args, scopeId) {
+  if (!hasSystemdRun()) {
+    if (!_demotionLogged) {
+      _demotionLogged = true;
+      process.stderr.write(
+        "[cleo:agent-spawn-wrapper] systemd-run unavailable \u2014 falling back to plain pgid (detached) spawn; no cgroup containment\n"
+      );
+    }
+    return {
+      command: "sh",
+      args: ["-c", 'ulimit -c 0; exec "$@"', "sh", command, ...args],
+      ownership: {
+        mode: "pgid"
+        // pgid is populated after spawn; the caller patches it via the
+        // returned child.pid (which is the pgid leader when detached: true).
+      }
+    };
+  }
+  const totalBytes = readMemTotalBytes();
+  const maxStr = DEFAULT_MEMORY_MAX;
+  const counter = ++_scopeCounter;
+  const discriminator = scopeId ? scopeId.replace(/[^a-zA-Z0-9-]/g, "-").slice(0, 40) : String(counter);
+  const unitName = `cleo-agent-session-${discriminator}.scope`;
+  void totalBytes;
+  const wrapArgs = [
+    "--user",
+    "--scope",
+    `--slice=${CLEO_SLICE}`,
+    `--unit=${unitName}`,
+    "-p",
+    `MemoryMax=${maxStr}`,
+    "-p",
+    "MemorySwapMax=0",
+    // NOTE: ManagedOOMPreference=avoid is NOT set for agent sessions —
+    // only daemon/db scope classes (write-txn holders) get 'avoid'.
+    // See spawn-wrapper.ts OOM_AVOID_CLASSES and the module TSDoc for rationale.
+    "--",
+    "sh",
+    "-c",
+    'ulimit -c 0; exec "$@"',
+    "sh",
+    command,
+    ...args
+  ];
+  return {
+    command: "systemd-run",
+    args: wrapArgs,
+    ownership: {
+      mode: "systemd",
+      unitName
+      // pgid is populated after spawn; caller patches via child.pid.
+    }
+  };
+}
+var CLEO_SLICE, DEFAULT_MEMORY_MAX, _systemdRunAvailable, _demotionLogged, _scopeCounter;
+var init_agent_spawn_wrapper = __esm({
+  "packages/adapters/src/providers/shared/agent-spawn-wrapper.ts"() {
+    "use strict";
+    CLEO_SLICE = "cleo.slice";
+    DEFAULT_MEMORY_MAX = "32G";
+    _demotionLogged = false;
+    _scopeCounter = 0;
+  }
+});
+
+// packages/adapters/src/providers/claude-code/suite-reaper.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+async function reapAgentSuite(ownership) {
+  switch (ownership.mode) {
+    case "systemd":
+      await reapSystemdScope(ownership);
+      break;
+    case "pgid":
+      await reapPgidGroup(ownership);
+      break;
+    case "none":
+      process.stderr.write(
+        "[cleo:suite-reaper] containment mode=none \u2014 no reap performed; janitor (T11995) is the backstop\n"
+      );
+      break;
+    default: {
+      const _exhaustive = ownership.mode;
+      void _exhaustive;
+    }
+  }
+}
+async function reapSystemdScope(ownership) {
+  const { unitName, pgid } = ownership;
+  if (unitName) {
+    const stopResult = spawnSync2("systemctl", ["--user", "stop", unitName], {
+      stdio: "ignore",
+      timeout: 1e4
+    });
+    if (stopResult.error) {
+      process.stderr.write(
+        `[cleo:suite-reaper] systemctl stop failed (${stopResult.error.message}); falling back to pgid kill
+`
+      );
+    } else if (stopResult.status !== 0) {
+      spawnSync2("systemctl", ["--user", "reset-failed", unitName], {
+        stdio: "ignore",
+        timeout: 5e3
+      });
+      if (pgid !== void 0) {
+        await killPgidGracefully(pgid);
+      }
+      return;
+    } else {
+      spawnSync2("systemctl", ["--user", "reset-failed", unitName], {
+        stdio: "ignore",
+        timeout: 5e3
+      });
+      return;
+    }
+  }
+  if (pgid !== void 0) {
+    await killPgidGracefully(pgid);
+  }
+}
+async function reapPgidGroup(ownership) {
+  const { pgid } = ownership;
+  if (pgid === void 0) return;
+  await killPgidGracefully(pgid);
+}
+async function killPgidGracefully(pgid) {
+  try {
+    process.kill(-pgid, "SIGTERM");
+  } catch (err) {
+    if (isEsrch(err)) return;
+    process.stderr.write(`[cleo:suite-reaper] SIGTERM to pgid=${pgid} failed: ${String(err)}
+`);
+  }
+  await sleep(SIGTERM_GRACE_MS);
+  try {
+    process.kill(-pgid, "SIGKILL");
+  } catch (err) {
+    if (isEsrch(err)) return;
+    process.stderr.write(`[cleo:suite-reaper] SIGKILL to pgid=${pgid} failed: ${String(err)}
+`);
+  }
+}
+function isEsrch(err) {
+  if (typeof err === "object" && err !== null) {
+    const code = err["code"];
+    return code === "ESRCH";
+  }
+  return false;
+}
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+var SIGTERM_GRACE_MS;
+var init_suite_reaper = __esm({
+  "packages/adapters/src/providers/claude-code/suite-reaper.ts"() {
+    "use strict";
+    SIGTERM_GRACE_MS = 3e3;
+  }
+});
+
 // packages/adapters/src/providers/claude-code/spawn.ts
 import { exec, spawn as nodeSpawn } from "node:child_process";
 import { unlink, writeFile } from "node:fs/promises";
@@ -42795,6 +43018,8 @@ var init_spawn2 = __esm({
   "packages/adapters/src/providers/claude-code/spawn.ts"() {
     "use strict";
     init_src();
+    init_agent_spawn_wrapper();
+    init_suite_reaper();
     execAsync = promisify2(exec);
     ClaudeCodeSpawnProvider = class {
       /** Map of instance IDs to tracked process info. */
@@ -42842,15 +43067,17 @@ var init_spawn2 = __esm({
           }
           tmpFile = `/tmp/claude-spawn-${instanceId}.txt`;
           await writeFile(tmpFile, enrichedPrompt, "utf-8");
-          const args = [
+          const claudeArgs = [
             "--print",
             "--dangerously-skip-permissions",
             "--output-format",
             "json",
             tmpFile
           ];
+          const spawnBuild = buildAgentSpawnArgs("claude", claudeArgs, instanceId);
+          const isSystemd = spawnBuild.ownership.mode === "systemd";
           const spawnOpts = {
-            detached: true,
+            detached: !isSystemd,
             stdio: ["ignore", "pipe", "pipe"]
           };
           if (context.workingDirectory) {
@@ -42860,13 +43087,19 @@ var init_spawn2 = __esm({
           if (optionsEnv !== void 0 && Object.keys(optionsEnv).length > 0) {
             spawnOpts.env = { ...process.env, ...optionsEnv };
           }
-          const child = nodeSpawn("claude", args, spawnOpts);
+          const child = nodeSpawn(spawnBuild.command, spawnBuild.args, spawnOpts);
           child.unref();
+          const ownership = {
+            ...spawnBuild.ownership,
+            pid: child.pid,
+            pgid: spawnBuild.ownership.mode === "pgid" && child.pid !== void 0 ? child.pid : spawnBuild.ownership.pgid
+          };
           if (child.pid) {
             this.processMap.set(instanceId, {
               pid: child.pid,
               taskId: context.taskId,
-              startTime
+              startTime,
+              ownership
             });
           }
           const capturedTmpFile = tmpFile;
@@ -42882,7 +43115,10 @@ var init_spawn2 = __esm({
             taskId: context.taskId,
             providerId: "claude-code",
             status: "running",
-            startTime
+            startTime,
+            // T11998: surface the ownership handle in the result so callers can
+            // persist it or pass it to reapAgentSuite on session end.
+            ownership
           };
         } catch (error48) {
           console.error(`[ClaudeCodeSpawnProvider] Failed to spawn: ${getErrorMessage(error48)}`);
@@ -42921,7 +43157,9 @@ var init_spawn2 = __esm({
               taskId: tracked.taskId,
               providerId: "claude-code",
               status: "running",
-              startTime: tracked.startTime
+              startTime: tracked.startTime,
+              // T11998: propagate ownership handle so callers can reap the suite.
+              ownership: tracked.ownership
             });
           } catch {
             this.processMap.delete(instanceId);
@@ -42932,19 +43170,40 @@ var init_spawn2 = __esm({
       /**
        * Terminate a running spawn by instance ID.
        *
-       * Sends SIGTERM to the tracked process. If the process is not found
-       * or has already exited, this is a no-op.
+       * Uses the suite-reaper to kill the entire process tree (root claude CLI +
+       * all MCP grandchildren) via the containment handle recorded at spawn time.
+       * Falls back to a direct SIGTERM on the tracked PID for legacy entries
+       * that pre-date T11998 and lack an ownership handle.
+       *
+       * Idempotent: no-op if the instance is not found or has already exited.
        *
        * @param instanceId - ID of the spawn instance to terminate
+       * @task T11998
        */
       async terminate(instanceId) {
         const tracked = this.processMap.get(instanceId);
         if (!tracked) return;
+        this.processMap.delete(instanceId);
         try {
-          process.kill(tracked.pid, "SIGTERM");
+          await reapAgentSuite(tracked.ownership);
         } catch {
+          try {
+            process.kill(tracked.pid, "SIGTERM");
+          } catch {
+          }
         }
-        this.processMap.delete(instanceId);
+      }
+      /**
+       * Terminate all tracked spawn instances on session end.
+       *
+       * Called by the session lifecycle when a CLEO session ends, ensuring
+       * no orphaned agent suites (root process + MCP children) remain.
+       *
+       * @task T11998
+       */
+      async terminateAll() {
+        const instanceIds = [...this.processMap.keys()];
+        await Promise.allSettled(instanceIds.map((id) => this.terminate(id)));
       }
     };
   }
@@ -43234,7 +43493,7 @@ var init_adapter = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/statusline.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { join as join10 } from "node:path";
 function getClaudeSettingsPath() {
@@ -43244,7 +43503,7 @@ function checkStatuslineIntegration() {
   const settingsPath = getClaudeSettingsPath();
   if (!existsSync8(settingsPath)) return "no_settings";
   try {
-    const settings = JSON.parse(readFileSync6(settingsPath, "utf-8"));
+    const settings = JSON.parse(readFileSync7(settingsPath, "utf-8"));
     const statusLine = settings.statusLine;
     if (!statusLine?.type) return "not_configured";
     if (statusLine.type !== "command") return "custom_no_cleo";
@@ -43255,7 +43514,7 @@ function checkStatuslineIntegration() {
     const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir8()) : cmd;
     if (existsSync8(scriptPath)) {
       try {
-        const content = readFileSync6(scriptPath, "utf-8");
+        const content = readFileSync7(scriptPath, "utf-8");
         if (content.includes("context-state.json")) return "configured";
       } catch {
       }
@@ -43488,7 +43747,7 @@ var init_hooks2 = __esm({
 });
 
 // packages/adapters/src/providers/cursor/install.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join16 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile3 } from "@cleocode/caamp";
 var CursorInstallProvider;
@@ -43546,7 +43805,7 @@ var init_install2 = __esm({
         const rulesPath = join16(process.cwd(), ".cursorrules");
         if (existsSync11(rulesPath)) {
           try {
-            const content = readFileSync7(rulesPath, "utf-8");
+            const content = readFileSync8(rulesPath, "utf-8");
             const injectionRef = `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`;
             if (content.includes(injectionRef) || content.includes("@.cleo/memory-bridge.md")) {
               return true;
@@ -43599,7 +43858,7 @@ var init_install2 = __esm({
         if (!existsSync11(rulesPath)) {
           return false;
         }
-        let content = readFileSync7(rulesPath, "utf-8");
+        let content = readFileSync8(rulesPath, "utf-8");
         const cursorRefs = [
           `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`,
           "@.cleo/memory-bridge.md"
@@ -43640,7 +43899,7 @@ var init_install2 = __esm({
           ""
         ].join("\n");
         if (existsSync11(mdcPath)) {
-          const existing = readFileSync7(mdcPath, "utf-8");
+          const existing = readFileSync8(mdcPath, "utf-8");
           if (existing === expectedContent) {
             return false;
           }
@@ -43716,7 +43975,7 @@ var init_install2 = __esm({
         let config2 = {};
         if (existsSync11(hooksJsonPath)) {
           try {
-            config2 = JSON.parse(readFileSync7(hooksJsonPath, "utf-8"));
+            config2 = JSON.parse(readFileSync8(hooksJsonPath, "utf-8"));
           } catch {
           }
         }
@@ -44050,7 +44309,7 @@ var init_hooks3 = __esm({
 });
 
 // packages/adapters/src/providers/opencode/install.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join23 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile6 } from "@cleocode/caamp";
 var OpenCodeInstallProvider;
@@ -44214,7 +44473,7 @@ var init_install3 = __esm({
         ].join("\n");
         if (existsSync17(pluginPath)) {
           try {
-            if (readFileSync10(pluginPath, "utf-8") === generated) {
+            if (readFileSync11(pluginPath, "utf-8") === generated) {
               return false;
             }
           } catch {
@@ -45769,7 +46028,7 @@ var GeminiCliHookProvider = class {
 
 // packages/adapters/src/providers/gemini-cli/install.ts
 init_paths2();
-import { existsSync as existsSync13, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "node:fs";
 import { join as join19 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile4 } from "@cleocode/caamp";
 var GeminiCliInstallProvider = class {
@@ -45818,7 +46077,7 @@ var GeminiCliInstallProvider = class {
     const geminiMdPath = join19(process.cwd(), "GEMINI.md");
     if (existsSync13(geminiMdPath)) {
       try {
-        const content = readFileSync8(geminiMdPath, "utf-8");
+        const content = readFileSync9(geminiMdPath, "utf-8");
         if (content.includes(instructionRef)) {
           return true;
         }
@@ -46041,7 +46300,7 @@ var KimiHookProvider = class {
 
 // packages/adapters/src/providers/kimi/install.ts
 init_paths2();
-import { existsSync as existsSync15, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync10 } from "node:fs";
 import { join as join21 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile5 } from "@cleocode/caamp";
 var KimiInstallProvider = class {
@@ -46090,7 +46349,7 @@ var KimiInstallProvider = class {
     const agentsMdPath = join21(process.cwd(), "AGENTS.md");
     if (existsSync15(agentsMdPath)) {
       try {
-        const content = readFileSync9(agentsMdPath, "utf-8");
+        const content = readFileSync10(agentsMdPath, "utf-8");
         if (content.includes(instructionRef)) {
           return true;
         }
@@ -46241,7 +46500,7 @@ init_opencode();
 init_hook_template_installer();
 
 // packages/adapters/src/registry.ts
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 import { dirname as dirname4, join as join28, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PROVIDER_IDS = ["claude-code", "opencode", "cursor", "pi"];
@@ -46251,7 +46510,7 @@ function getProviderManifests() {
   for (const providerId of PROVIDER_IDS) {
     try {
       const manifestPath = join28(baseDir, providerId, "manifest.json");
-      const raw = readFileSync11(manifestPath, "utf-8");
+      const raw = readFileSync12(manifestPath, "utf-8");
       manifests.push(JSON.parse(raw));
     } catch {
     }