@cspeach/cli 1.1.32 → 1.1.34

package/dist/tools/filesystem/glob.js

@@ -20,6 +20,7 @@ import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import { registerTool } from '../index.js';
 import { resolveSafePath, assertRealPathContained, PathOutsideRootError, isDenylistedPath, isReadOnlyProjectFile, isSeatReadOnlyFile, DENYLIST_DESCRIPTION, } from '../_filesystem-shared.js';
+import { credentialFileRisk, credentialSkipNote } from '../../agent/risk-gate.js';
 import { isReadOnlyRel, isWorkRel, teamWorkRoot, teamWorkTarget } from '../_team-work-path.js';
 const MAX_RESULTS = 500;
 const MAX_FILES_TRAVERSED = 10_000;
@@ -120,6 +121,7 @@ export async function globHandler(args, ctx) {
     const wantsCspeach = isCspeachPattern(args.pattern);
     const collected = [];
     let budget = MAX_FILES_TRAVERSED;
+    let credentialSkipped = 0;
     async function walk(dir, relPrefix, denyRoot = root) {
         if (budget <= 0 || collected.length >= MAX_RESULTS * 4)
             return;
@@ -162,6 +164,12 @@ export async function globHandler(args, ctx) {
                 const denylist = isDenylistedPath(abs, denyRoot);
                 if (denylist.blocked && !isReadOnlyProjectFile(abs, denyRoot))
                     continue;
+                // Security batch item 4, fix round 1 (F2) — credential files are not
+                // listed (same rule as the risk gate); one line says how many.
+                if (credentialFileRisk(ent.name)) {
+                    credentialSkipped++;
+                    continue;
+                }
                 let mtime = 0;
                 try {
                     const s = await fs.stat(abs);
@@ -221,17 +229,18 @@ export async function globHandler(args, ctx) {
     // Sort by mtime descending, cap at MAX_RESULTS
     collected.sort((a, b) => b.mtime - a.mtime);
     const sample = collected.slice(0, MAX_RESULTS).map((f) => f.relPath);
+    const skipNote = credentialSkipped > 0 ? `\n${credentialSkipNote(credentialSkipped)}` : '';
     if (sample.length === 0) {
         // A search for saved results that did not name `.cspeach/` gets the hint.
         const hint = !wantsCspeach && /\.json$/i.test(args.pattern)
             ? ' (saved CSPeach results live in .cspeach/ — search there with pattern ".cspeach/*.cspeach.json")'
             : '';
-        return { content: `no files match "${args.pattern}"${hint}` };
+        return { content: `no files match "${args.pattern}"${hint}${skipNote}` };
     }
     const truncated = collected.length > MAX_RESULTS;
-    const trailer = truncated
+    const trailer = (truncated
         ? `\n... (${collected.length - MAX_RESULTS} more matches — narrow the pattern)`
-        : '';
+        : '') + skipNote;
     return { content: sample.join('\n') + trailer };
 }
 registerTool({

package/dist/tools/filesystem/grep.js

@@ -23,6 +23,7 @@ import { registerTool } from '../index.js';
 import { resolveSafePath, assertRealPathContained, PathOutsideRootError, isDenylistedPath, DENYLIST_DESCRIPTION, } from '../_filesystem-shared.js';
 import { globToRegex } from './glob.js';
 import { teamWorkTarget } from '../_team-work-path.js';
+import { credentialFileRisk, credentialSkipNote } from '../../agent/risk-gate.js';
 const MAX_MATCHES = 250;
 const MAX_FILES_TRAVERSED = 10_000;
 const MAX_FILE_BYTES = 2_000_000;
@@ -69,6 +70,11 @@ export async function grepHandler(args, ctx) {
     const matches = [];
     const fileMatchCounts = new Map();
     let budget = MAX_FILES_TRAVERSED;
+    // Security batch item 4, fix round 1 (F2) — credential files (.npmrc,
+    // .git-credentials, .env* outside the denylist, *.pem, *.key) are never
+    // searched: grep would return their text with no card. Counted, and one
+    // line says so. Same rule as the risk gate, so the lists cannot drift.
+    let credentialSkipped = 0;
     async function walk(dir, relPrefix) {
         if (budget <= 0 || matches.length >= MAX_MATCHES)
             return;
@@ -106,6 +112,10 @@ export async function grepHandler(args, ctx) {
                 const denylist = isDenylistedPath(abs, root);
                 if (denylist.blocked)
                     continue;
+                if (credentialFileRisk(ent.name)) {
+                    credentialSkipped++;
+                    continue;
+                }
                 let stat;
                 try {
                     stat = await fs.stat(abs);
@@ -158,13 +168,14 @@ export async function grepHandler(args, ctx) {
         }
     }
     await walk(realRoot, '');
+    const skipNote = credentialSkipped > 0 ? `\n${credentialSkipNote(credentialSkipped)}` : '';
     if (matches.length === 0) {
-        return { content: `no matches for /${args.pattern}/${args.case_insensitive ? 'i' : ''}` };
+        return { content: `no matches for /${args.pattern}/${args.case_insensitive ? 'i' : ''}${skipNote}` };
     }
     const truncated = matches.length >= MAX_MATCHES;
-    const trailer = truncated
+    const trailer = (truncated
         ? `\n... (cap of ${MAX_MATCHES} matches reached — narrow the pattern or use a glob filter)`
-        : '';
+        : '') + skipNote;
     if (outputMode === 'files_with_matches') {
         const files = [...new Set(matches.map((m) => m.file))];
         return { content: files.join('\n') + trailer };

package/dist/tools/tool-loading.js

@@ -1,4 +1,5 @@
 import { toAnthropicTools } from './index.js';
+import { profileForMode } from '../agent/connection-profile.js';
 /** The server-side tool search tool (probe P6: this exact name). */
 export const TOOL_SEARCH_TOOL = Object.freeze({
     type: 'tool_search_tool_regex_20251119',
@@ -105,25 +106,23 @@ export function modelAcceptsDeferredTools(model) {
     return DEFERRED_TOOL_MODELS.has(model.trim().toLowerCase().replace(/-\d{8}$/, ''));
 }
 /**
- * Mode precedence (ruling F13): AI-hub and local are always 'static' (their
- * wire has no deferred loading). Otherwise env `CSPEACH_TOOL_LOADING`
- * (`deferred` | `static`) wins; then managed uses the served value (default
- * 'static': only a proxy that serves tool_loading takes the new shapes);
- * BYOK uses the served value when it fetched one, else 'static'.
+ * Mode precedence (ruling F13), read from the connection profile since the
+ * Azure tenant mode (Task 1): 'static' profiles (AI-hub, local, azure v0) are
+ * always 'static'; otherwise env `CSPEACH_TOOL_LOADING` (`deferred` | `static`)
+ * wins; then 'served' profiles (managed, BYOK) use the served value (default
+ * 'static'); an unknown/fake mode ('env-only') stays 'static'.
  */
 export function resolveToolLoading(i) {
-    if (i.providerMode === 'ai-hub' || i.providerMode === 'local')
+    const rule = (i.profile ?? profileForMode(i.providerMode)).deferredTools;
+    if (rule === 'static')
         return 'static';
     const raw = i.env.CSPEACH_TOOL_LOADING?.trim().toLowerCase();
     if (raw === 'deferred' || raw === 'static')
         return raw;
     // Task 21 fix round (controller ruling): an old proxy serves no tool_loading
     // and adds none of the deferred-tool betas, so 'deferred' only when served.
-    if (i.providerMode === 'managed')
+    if (rule === 'served')
         return i.served ?? 'static';
-    if (i.providerMode === 'byok')
-        return i.served ?? 'static';
-    // Unknown/fake provider modes keep today's full list.
     return 'static';
 }
 /**

package/dist/usage/usage-queue.js

@@ -0,0 +1,323 @@
+/**
+ * Security batch item 3 — <CSPeach home>/usage-queue.jsonl: usage counts
+ * waiting to be sent. Capped at 1,000 lines or 1 MB (oldest dropped).
+ *
+ * Safe with several cspeach processes: every read-modify-write holds an
+ * exclusive lock file (O_EXCL create). The holder writes "<pid> <ms> <host>
+ * <token>"; a contender clears the lock at once when that pid is gone on this
+ * host, or when the lock is older than 10 s. A contender waits longer than
+ * the stale age, so an orphaned lock never drops a record (F5).
+ *
+ * The network send happens OUTSIDE the lock as a lease (F1): leaseBatch
+ * returns the oldest records WITHOUT removing them; ackBatch removes exactly
+ * those request ids once the proxy answered. A crash mid-send therefore
+ * resends the batch next time, and the proxy drops the repeat by request id.
+ *
+ * Each line carries a local-only `keyPrefix` (a short sha256 fingerprint of
+ * the seat's key, never the key or a piece of it). leaseBatch keeps only the
+ * current seat's lines, drops the rest, and strips the tag: it is never sent
+ * (F10).
+ */
+import { promises as fs } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+import { countedTokens } from '../connection/local-usage.js';
+/** The exact fields sent; anything else on a queue line stays on disk. */
+const RECORD_KEYS = [
+    'request_id', 'mode', 'skill', 'model', 'input_tokens', 'output_tokens',
+    'cache_read_tokens', 'cache_write_tokens', 'cli_version', 'session_id', 'at',
+];
+export const QUEUE_MAX_LINES = 1000;
+export const QUEUE_MAX_BYTES = 1_000_000;
+const LOCK_STALE_MS = 10_000;
+/** Longer than LOCK_STALE_MS: a holder that died is always outwaited (F5). */
+const LOCK_WAIT_MS = 15_000;
+/**
+ * Final review finding 6 — the rename retry runs while the lock is held, so it
+ * must give up before a contender may judge that lock stale (LOCK_STALE_MS):
+ * otherwise two writers are possible in the last seconds.
+ */
+const RENAME_WAIT_MS = 8_000;
+/** A queue temp file older than this is a crash leftover (a live write renames within ms). */
+const STALE_TMP_MS = 60_000;
+/** Pinned by tests: RENAME_WAIT_MS < LOCK_STALE_MS < LOCK_WAIT_MS. */
+export const QUEUE_TIMINGS = { LOCK_STALE_MS, LOCK_WAIT_MS, RENAME_WAIT_MS };
+const LOCK_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+export function usageQueuePath() {
+    return path.join(cspeachRoot(), 'usage-queue.jsonl');
+}
+const lockPath = () => `${usageQueuePath()}.lock`;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** The seat tag on a queue line: a fingerprint of the key, never the key. */
+export function keyPrefixFor(key) {
+    return createHash('sha256').update(`cspeach-usage-seat:${key}`).digest('hex').slice(0, 16);
+}
+/** True only when the lock's holder is provably gone (same host, pid not running). */
+function holderIsDead(content) {
+    const [pidText, , host] = content.trim().split(' ');
+    const pid = Number(pidText);
+    if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid)
+        return false;
+    if (host !== os.hostname())
+        return false;
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (err) {
+        return err.code === 'ESRCH';
+    }
+}
+/**
+ * Remove a lock judged dead or stale. Renamed to a unique name first (only one
+ * contender can win the rename); if what was renamed is not the lock that was
+ * judged (a fresh holder took over in between), it is put back.
+ */
+async function clearLock(lp, judged) {
+    const aside = `${lp}.${process.pid}.${randomUUID()}.stale`;
+    try {
+        await fs.rename(lp, aside);
+    }
+    catch {
+        return;
+    }
+    const got = await fs.readFile(aside, 'utf-8').catch(() => judged);
+    if (got !== judged)
+        await fs.link(aside, lp).catch(() => { });
+    await fs.rm(aside, { force: true }).catch(() => { });
+}
+async function withQueueLock(fn) {
+    const lp = lockPath();
+    await fs.mkdir(path.dirname(lp), { recursive: true });
+    const token = `${process.pid} ${Date.now()} ${os.hostname()} ${randomUUID()}`;
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    for (;;) {
+        try {
+            const h = await fs.open(lp, 'wx');
+            try {
+                await h.writeFile(token);
+            }
+            finally {
+                await h.close();
+            }
+            break;
+        }
+        catch (err) {
+            const code = err.code ?? '';
+            // F14 — on Windows a lock file being created or deleted by another
+            // process answers EPERM / EACCES / EBUSY instead of EEXIST: that is
+            // contention too, so wait and retry (never drop the record).
+            if (code === 'EEXIST') {
+                try {
+                    const [content, st] = await Promise.all([fs.readFile(lp, 'utf-8'), fs.stat(lp)]);
+                    if (holderIsDead(content) || Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+                        await clearLock(lp, content);
+                        continue;
+                    }
+                }
+                catch { /* gone or busy: retry after the pause */ }
+            }
+            else if (!LOCK_CODES.has(code)) {
+                return undefined;
+            }
+            if (Date.now() > deadline)
+                return undefined;
+            await sleep(10 + Math.floor(Math.random() * 20));
+        }
+    }
+    await sweepStaleTemps();
+    try {
+        return await fn();
+    }
+    finally {
+        // Release only our own lock (it may have been cleared as stale meanwhile).
+        const now = await fs.readFile(lp, 'utf-8').catch(() => '');
+        if (now === token)
+            await fs.unlink(lp).catch(() => { });
+    }
+}
+/**
+ * Task 9 I3 — remove usage-queue.jsonl.<pid>.tmp files left by a crash.
+ * Runs under the queue lock; only our own temp names, only when older than
+ * STALE_TMP_MS (same rule as the skills cache). Never throws.
+ */
+async function sweepStaleTemps() {
+    const p = usageQueuePath();
+    const dir = path.dirname(p);
+    const prefix = `${path.basename(p)}.`;
+    try {
+        for (const f of await fs.readdir(dir)) {
+            if (!f.startsWith(prefix) || !/^\d+\.tmp$/.test(f.slice(prefix.length)))
+                continue;
+            const full = path.join(dir, f);
+            const st = await fs.stat(full).catch(() => null);
+            if (st && Date.now() - st.mtimeMs > STALE_TMP_MS)
+                await fs.rm(full, { force: true }).catch(() => { });
+        }
+    }
+    catch { /* no directory yet */ }
+}
+async function readLines() {
+    try {
+        return (await fs.readFile(usageQueuePath(), 'utf-8')).split('\n').filter((l) => l.trim().length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+async function writeLines(lines) {
+    const p = usageQueuePath();
+    if (lines.length === 0) {
+        await fs.rm(p, { force: true });
+        return;
+    }
+    const tmp = `${p}.${process.pid}.tmp`;
+    await fs.writeFile(tmp, lines.join('\n') + '\n', 'utf-8');
+    // F14 — a reader outside the lock (queueStats, doctor) can hold the file
+    // open on Windows for a moment: EPERM / EACCES / EBUSY is retried until a
+    // deadline, never treated as a lost write.
+    const deadline = Date.now() + RENAME_WAIT_MS;
+    for (let attempt = 0;; attempt++) {
+        try {
+            await fs.rename(tmp, p);
+            return;
+        }
+        catch (err) {
+            if (!LOCK_CODES.has(err.code ?? '') || Date.now() > deadline) {
+                await fs.rm(tmp, { force: true }).catch(() => { });
+                throw err;
+            }
+            await sleep(Math.min(20 * (attempt + 1), 200));
+        }
+    }
+}
+/** Newest lines kept: at most QUEUE_MAX_LINES and QUEUE_MAX_BYTES (newline included). */
+export function capLines(lines) {
+    let out = lines.slice(-QUEUE_MAX_LINES);
+    let bytes = out.reduce((n, l) => n + Buffer.byteLength(l) + 1, 0);
+    while (out.length > 0 && bytes > QUEUE_MAX_BYTES) {
+        bytes -= Buffer.byteLength(out[0]) + 1;
+        out = out.slice(1);
+    }
+    return out;
+}
+/** A line → the record (exactly RECORD_KEYS) and its seat tag; null when unreadable. */
+function parseLine(l) {
+    try {
+        const o = JSON.parse(l);
+        if (!o || typeof o !== 'object' || Array.isArray(o) || typeof o.request_id !== 'string')
+            return null;
+        const rec = Object.fromEntries(RECORD_KEYS.map((k) => [k, o[k]]));
+        return { rec, keyPrefix: typeof o.keyPrefix === 'string' ? o.keyPrefix : '' };
+    }
+    catch {
+        return null;
+    }
+}
+/** True when the record is in the queue, tagged with its seat. Never throws. */
+export async function enqueueUsage(rec, keyPrefix) {
+    try {
+        const line = JSON.stringify({ ...rec, keyPrefix });
+        return (await withQueueLock(async () => { await writeLines(capLines([...(await readLines()), line])); return true; })) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Up to `max` of the oldest records of this seat, NOT removed (F1). Lines
+ * that cannot be read and lines of another seat are dropped here (F10); the
+ * returned records never carry the seat tag. Never throws.
+ */
+export async function leaseBatch(max, keyPrefix) {
+    try {
+        return (await withQueueLock(async () => {
+            const lines = await readLines();
+            const keep = [];
+            const out = [];
+            for (const l of lines) {
+                const q = parseLine(l);
+                if (!q || q.keyPrefix !== keyPrefix)
+                    continue;
+                keep.push(l);
+                if (out.length < max)
+                    out.push(q.rec);
+            }
+            if (keep.length !== lines.length)
+                await writeLines(keep);
+            return out;
+        })) ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Remove the records with these request ids (the proxy answered for them). False when the queue could not be changed. */
+export async function ackBatch(requestIds) {
+    if (requestIds.length === 0)
+        return true;
+    const done = new Set(requestIds);
+    try {
+        return (await withQueueLock(async () => {
+            const lines = await readLines();
+            const keep = lines.filter((l) => { const q = parseLine(l); return q !== null && !done.has(q.rec.request_id); });
+            if (keep.length !== lines.length)
+                await writeLines(keep);
+            return true;
+        })) === true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function queueStats() {
+    try {
+        const text = await fs.readFile(usageQueuePath(), 'utf-8');
+        return { lines: text.split('\n').filter((l) => l.trim().length > 0).length, bytes: Buffer.byteLength(text) };
+    }
+    catch {
+        return { lines: 0, bytes: 0 };
+    }
+}
+/**
+ * Azure limit (D6) — the counted tokens (input + output + cache-write; cache
+ * reads excluded) of THIS seat's records still waiting in the queue: exactly
+ * the tokens the server's `used` does not hold yet. Only azure records count,
+ * as the server's `used` counts azure usage only. Reads without the lock,
+ * as queueStats does. No file → 0; any other read error throws, so the caller
+ * keeps its count. Unreadable lines, other seats' lines and other modes are skipped.
+ */
+export async function queuedTokens(keyPrefix) {
+    let text;
+    try {
+        text = await fs.readFile(usageQueuePath(), 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return 0;
+        throw err;
+    }
+    const n = (v) => (typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : 0);
+    let sum = 0;
+    for (const l of text.split('\n')) {
+        if (l.trim().length === 0)
+            continue;
+        const q = parseLine(l);
+        if (!q || q.keyPrefix !== keyPrefix || q.rec.mode !== 'azure')
+            continue;
+        sum += countedTokens({ input_tokens: n(q.rec.input_tokens), output_tokens: n(q.rec.output_tokens), cache_write_tokens: n(q.rec.cache_write_tokens) });
+    }
+    return sum;
+}
+/** Cheap when there is nothing to delete (no lock taken): called on every call while reporting is off. */
+export async function deleteUsageQueue() {
+    try {
+        await fs.access(usageQueuePath());
+    }
+    catch {
+        return;
+    }
+    await withQueueLock(async () => { await fs.rm(usageQueuePath(), { force: true }); }).catch(() => { });
+}