@cueloop/daemon 0.1.0-alpha.7 → 0.1.0-alpha.71

package/src/herdr-tab-store.ts

@@ -0,0 +1,66 @@
+/**
+ * herdr adapter scratch, kept out of the core session record: the tab cueloop
+ * opened to render each review, keyed by session id. One JSON map, atomic write.
+ * The core `Thread` never mentions herdr; this side-store is the whole
+ * leak boundary.
+ */
+
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import * as v from "valibot";
+import { herdrTabsPath } from "./paths";
+
+/** The tab and its root pane: pane id checks liveness, tab id focuses it. */
+export interface HerdrTabHandle {
+  tabId: string;
+  paneId: string;
+}
+
+const HerdrTabHandleSchema = v.object({
+  tabId: v.string(),
+  paneId: v.string(),
+});
+const HerdrTabsSchema = v.record(v.string(), v.unknown());
+
+export class HerdrTabStore {
+  private tabs = new Map<string, HerdrTabHandle>();
+  private readonly path: string;
+
+  constructor(home: string) {
+    this.path = herdrTabsPath(home);
+    this.load();
+  }
+
+  private load(): void {
+    try {
+      const parsed = v.parse(HerdrTabsSchema, JSON.parse(readFileSync(this.path, "utf8")));
+
+      for (const [sessionId, value] of Object.entries(parsed)) {
+        const handle = v.safeParse(HerdrTabHandleSchema, value);
+
+        if (handle.success) this.tabs.set(sessionId, handle.output);
+      }
+    } catch {
+      // absent, unreadable, or malformed: start empty - a stale tab just reopens on resubmit
+    }
+  }
+
+  private persist(): void {
+    const tempPath = this.path + ".tmp";
+
+    writeFileSync(tempPath, JSON.stringify(Object.fromEntries(this.tabs), null, 2));
+    renameSync(tempPath, this.path);
+  }
+
+  get(sessionId: string): HerdrTabHandle | null {
+    return this.tabs.get(sessionId) ?? null;
+  }
+
+  set(sessionId: string, handle: HerdrTabHandle): void {
+    this.tabs.set(sessionId, handle);
+    this.persist();
+  }
+
+  delete(sessionId: string): void {
+    if (this.tabs.delete(sessionId)) this.persist();
+  }
+}

package/src/index.ts

@@ -1,9 +1,8 @@
-export * from "./api";
-export * from "./review";
-export * from "./errors";
-export * from "./validate";
-export * from "./store";
-export * from "./server";
-export * from "./protocol";
-export * from "./paths";
-export { DaemonClient, DaemonClientError, type ConnectOptions } from "./client";
+/**
+ * The daemon's public surface. Consumers reach the client and the review
+ * helpers through the ./client and ./review subpaths; this barrel carries
+ * only the two names imported bare: the server and the home-dir resolver.
+ */
+
+export { DaemonServer, type DaemonOptions } from "./server";
+export { cueloopHome } from "./paths";

package/src/interruptible-wait.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, test } from "bun:test";
+import { ABORTED, pollUntilResolved, raceAbort } from "./interruptible-wait";
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (cause: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+
+  return { promise, resolve, reject };
+}
+
+describe("raceAbort", () => {
+  test("without a signal the promise passes straight through", async () => {
+    expect(await raceAbort(Promise.resolve("value"), undefined)).toBe("value");
+  });
+
+  test("resolves to the value when the promise settles before any abort", async () => {
+    const controller = new AbortController();
+
+    expect(await raceAbort(Promise.resolve(7), controller.signal)).toBe(7);
+  });
+
+  test("an already-aborted signal returns ABORTED without waiting", async () => {
+    const controller = new AbortController();
+
+    controller.abort();
+
+    expect(await raceAbort(new Promise<never>(() => {}), controller.signal)).toBe(ABORTED);
+  });
+
+  test("a signal that fires during the wait returns ABORTED", async () => {
+    const controller = new AbortController();
+    const pending = deferred<number>();
+    const raced = raceAbort(pending.promise, controller.signal);
+
+    controller.abort();
+
+    expect(await raced).toBe(ABORTED);
+  });
+
+  test("a rejection propagates the original error unchanged", async () => {
+    const controller = new AbortController();
+    const original = new Error("daemon socket closed");
+    let caught: unknown;
+
+    try {
+      await raceAbort(Promise.reject(original), controller.signal);
+    } catch (error) {
+      caught = error;
+    }
+
+    expect(caught).toBe(original);
+  });
+
+  test("a rejection that lands after an abort is swallowed, not surfaced", async () => {
+    const controller = new AbortController();
+    const pending = deferred<number>();
+    const raced = raceAbort(pending.promise, controller.signal);
+
+    controller.abort();
+    const result = await raced;
+
+    pending.reject(new Error("late daemon error"));
+    await Bun.sleep(10);
+
+    expect(result).toBe(ABORTED);
+  });
+});
+
+describe("pollUntilResolved", () => {
+  test("returns the first non-null attempt", async () => {
+    expect(await pollUntilResolved(() => Promise.resolve("done"), undefined)).toBe("done");
+  });
+
+  test("keeps polling past null attempts until one resolves", async () => {
+    let calls = 0;
+    const attempt = () => {
+      calls++;
+
+      return Promise.resolve(calls < 3 ? null : "third");
+    };
+
+    expect(await pollUntilResolved(attempt, undefined)).toBe("third");
+    expect(calls).toBe(3);
+  });
+
+  test("an already-aborted signal returns null before any attempt", async () => {
+    const controller = new AbortController();
+    let calls = 0;
+
+    controller.abort();
+    const result = await pollUntilResolved(() => {
+      calls++;
+
+      return Promise.resolve("value");
+    }, controller.signal);
+
+    expect(result).toBeNull();
+    expect(calls).toBe(0);
+  });
+
+  test("a signal that fires during a chunk returns null", async () => {
+    const controller = new AbortController();
+    const pending = deferred<string | null>();
+    const polling = pollUntilResolved(() => pending.promise, controller.signal);
+
+    controller.abort();
+
+    expect(await polling).toBeNull();
+  });
+
+  test("a rejected attempt propagates the original error", async () => {
+    const original = new Error("attempt failed");
+    let caught: unknown;
+
+    try {
+      await pollUntilResolved(() => Promise.reject(original), undefined);
+    } catch (error) {
+      caught = error;
+    }
+
+    expect(caught).toBe(original);
+  });
+});

package/src/interruptible-wait.ts

@@ -0,0 +1,66 @@
+import { Cause, Effect, Exit } from "effect";
+
+export const ABORTED: unique symbol = Symbol("aborted");
+
+const whenSignalAborts = (signal: AbortSignal): Effect.Effect<void> =>
+  Effect.callback<void>((resume) => {
+    if (signal.aborted) {
+      resume(Effect.void);
+
+      return;
+    }
+    const onAbort = () => resume(Effect.void);
+
+    signal.addEventListener("abort", onAbort, { once: true });
+
+    return Effect.sync(() => signal.removeEventListener("abort", onAbort));
+  });
+
+const fromSettledPromise = <T>(start: () => Promise<T>): Effect.Effect<T, unknown> =>
+  Effect.callback<T, unknown>((resume) => {
+    start().then(
+      (value) => resume(Effect.succeed(value)),
+      (cause: unknown) => resume(Effect.fail(cause)),
+    );
+  });
+
+async function runToPromise<T>(effect: Effect.Effect<T, unknown>): Promise<T> {
+  const exit = await Effect.runPromiseExit(effect);
+
+  if (Exit.isSuccess(exit)) return exit.value;
+
+  throw Cause.squash(exit.cause);
+}
+
+export function raceAbort<T>(
+  promise: Promise<T>,
+  signal: AbortSignal | undefined,
+): Promise<T | typeof ABORTED> {
+  if (!signal) return promise;
+  if (signal.aborted) {
+    promise.catch(() => {});
+
+    return Promise.resolve(ABORTED);
+  }
+
+  return runToPromise(
+    Effect.raceFirst(
+      fromSettledPromise(() => promise),
+      whenSignalAborts(signal).pipe(Effect.as<T | typeof ABORTED>(ABORTED)),
+    ),
+  );
+}
+
+export function pollUntilResolved<T>(
+  attempt: () => Promise<T | null>,
+  signal: AbortSignal | undefined,
+): Promise<T | null> {
+  if (signal?.aborted) return Promise.resolve(null);
+  const loop = Effect.repeat(fromSettledPromise(attempt), {
+    until: (result): result is T => result !== null,
+  });
+
+  if (!signal) return runToPromise(loop);
+
+  return runToPromise(Effect.raceFirst(loop, whenSignalAborts(signal).pipe(Effect.as(null))));
+}

package/src/main.ts

@@ -2,9 +2,12 @@
 
 import { DaemonServer } from "./server";
 
-const idleExitMs = process.env.CUELOOP_IDLE_EXIT_MS ? Number(process.env.CUELOOP_IDLE_EXIT_MS) : undefined;
+const idleExitMs = process.env.CUELOOP_IDLE_EXIT_MS
+  ? Number(process.env.CUELOOP_IDLE_EXIT_MS)
+  : undefined;
 const server = new DaemonServer({ idleExitMs });
 const path = server.start();
+
 if (path === null) {
   // another daemon already owns this home; the client will attach to it
   console.log("cueloop daemon already running for this home");

package/src/paths.ts

@@ -18,6 +18,35 @@ export function sessionsDir(home = cueloopHome()): string {
   return join(home, "sessions");
 }
 
+/** Thread files live here, one JSONL per thread, under a per-project bucket. */
+export function threadsDir(home = cueloopHome()): string {
+  return join(home, "threads");
+}
+
+/** A git commit is lowercase hex; anything else is not a real root commit. */
+const COMMIT_SHA = /^[0-9a-f]{7,64}$/;
+
+/**
+ * The per-project bucket for a workspace: its durable root-commit SHA, or a shared standalone bucket.
+ * A value that is not a commit SHA (including path-traversal segments an IPC caller could smuggle in)
+ * is refused to the standalone bucket, so a bucket name can never escape the threads directory.
+ */
+export function threadBucket(rootCommit: string | undefined, home = cueloopHome()): string {
+  const bucket =
+    rootCommit && COMMIT_SHA.test(rootCommit) ? rootCommit.slice(0, 12) : "_standalone";
+
+  return join(threadsDir(home), bucket);
+}
+
+/** Where the one-time migration parks the old whole-record JSON files, so a downgrade can still read them. */
+export function migratedSessionsDir(home = cueloopHome()): string {
+  return join(home, "sessions.migrated");
+}
+
+export function reportsDir(home = cueloopHome()): string {
+  return join(home, "reports");
+}
+
 export function pidPath(home = cueloopHome()): string {
   return join(home, "cueloop.pid");
 }
@@ -25,3 +54,13 @@ export function pidPath(home = cueloopHome()): string {
 export function lockPath(home = cueloopHome()): string {
   return join(home, "cueloop.lock");
 }
+
+/** The secret a connection presents to be the owner; written by the daemon, mode 0600. */
+export function ownerTokenPath(home = cueloopHome()): string {
+  return join(home, "owner.token");
+}
+
+/** Adapter scratch: herdr tab handles keyed by session id, kept out of the core session record. */
+export function herdrTabsPath(home = cueloopHome()): string {
+  return join(home, "herdr-tabs.json");
+}

package/src/project-files.test.ts

@@ -0,0 +1,124 @@
+/** Read-only repo introspection: the tracked file tree and safe, bounded file reads. */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { listProjectFiles, readProjectFile } from "./project-files";
+
+function git(args: string[], cwd: string): void {
+  const result = Bun.spawnSync(["git", ...args], { cwd, stdout: "ignore", stderr: "ignore" });
+
+  if (result.exitCode !== 0) throw new Error(`git ${args.join(" ")} failed in ${cwd}`);
+}
+
+let repo: string;
+
+beforeEach(() => {
+  repo = mkdtempSync(join(tmpdir(), "cueloop-project-files-"));
+  git(["init", "-q", "-b", "main"], repo);
+  git(["config", "user.email", "t@t"], repo);
+  git(["config", "user.name", "t"], repo);
+});
+
+afterEach(() => {
+  rmSync(repo, { recursive: true, force: true });
+});
+
+describe("listProjectFiles", () => {
+  test("returns the tracked files sorted ascending", async () => {
+    // Given a repo whose files are committed out of alphabetical order
+    writeFileSync(join(repo, "z.ts"), "export const z = 1;\n");
+    writeFileSync(join(repo, "a.ts"), "export const a = 1;\n");
+    writeFileSync(join(repo, "m.ts"), "export const m = 1;\n");
+    git(["add", "."], repo);
+    git(["commit", "-qm", "init"], repo);
+
+    // When the tracked files are listed
+    const files = await listProjectFiles(repo);
+
+    // Then every tracked path comes back in ascending order
+    expect(files).toEqual(["a.ts", "m.ts", "z.ts"]);
+  });
+
+  test("returns [] for a directory that is not a git repo", async () => {
+    // Given a plain directory with a file but no git repo
+    const plain = mkdtempSync(join(tmpdir(), "cueloop-project-files-plain-"));
+
+    writeFileSync(join(plain, "a.ts"), "export const a = 1;\n");
+    try {
+      // When the tracked files are listed
+      const files = await listProjectFiles(plain);
+
+      // Then nothing comes back and no error is thrown
+      expect(files).toEqual([]);
+    } finally {
+      rmSync(plain, { recursive: true, force: true });
+    }
+  });
+
+  test("returns [] when there is no repoRoot", async () => {
+    expect(await listProjectFiles(undefined)).toEqual([]);
+  });
+});
+
+describe("readProjectFile", () => {
+  test("reads a repo-relative file as UTF-8", async () => {
+    // Given a committed file with known contents
+    writeFileSync(join(repo, "a.ts"), "export const a = 1;\n");
+    git(["add", "."], repo);
+    git(["commit", "-qm", "init"], repo);
+
+    // When it is read by its repo-relative path
+    const contents = await readProjectFile(repo, "a.ts");
+
+    // Then its exact bytes come back
+    expect(contents).toBe("export const a = 1;\n");
+  });
+
+  test("returns null for a path that escapes the repo via ../", async () => {
+    // Given a secret file just outside the repo root
+    const secret = join(repo, "..", "outside-secret.txt");
+
+    writeFileSync(secret, "top secret\n");
+    try {
+      // When a traversal path tries to reach it
+      const contents = await readProjectFile(repo, "../outside-secret.txt");
+
+      // Then the read is refused
+      expect(contents).toBeNull();
+    } finally {
+      rmSync(secret, { force: true });
+    }
+  });
+
+  test("returns null for a missing file", async () => {
+    expect(await readProjectFile(repo, "nope.ts")).toBeNull();
+  });
+
+  test("returns null for a directory (not a regular file)", async () => {
+    // Given a directory inside the repo
+    mkdirSync(join(repo, "src"));
+
+    // When the directory path is read
+    const contents = await readProjectFile(repo, "src");
+
+    // Then it is refused
+    expect(contents).toBeNull();
+  });
+
+  test("returns null for a file larger than the cap", async () => {
+    // Given a file just over one megabyte
+    writeFileSync(join(repo, "big.bin"), "x".repeat(1024 * 1024 + 1));
+
+    // When it is read
+    const contents = await readProjectFile(repo, "big.bin");
+
+    // Then it is refused for exceeding the size cap
+    expect(contents).toBeNull();
+  });
+
+  test("returns null when there is no repoRoot", async () => {
+    expect(await readProjectFile(undefined, "a.ts")).toBeNull();
+  });
+});

package/src/project-files.ts

@@ -0,0 +1,56 @@
+/** Read-only repo introspection for the Project panel: the tracked file tree and a file's contents. */
+
+import { stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+
+/** Ceiling on the returned tree; a pathological repo cannot flood the panel or the wire. */
+const MAX_FILES = 5000;
+/** Ceiling on a served file; the panel renders source, not multi-megabyte blobs. */
+const MAX_FILE_BYTES = 1024 * 1024;
+
+/** Tracked, repo-relative paths from `git ls-files`, sorted ascending and capped; [] on any failure or non-repo. */
+export async function listProjectFiles(repoRoot: string | undefined): Promise<string[]> {
+  if (repoRoot === undefined || repoRoot.length === 0) return [];
+  try {
+    const gitProcess = Bun.spawn(["git", "-C", repoRoot, "ls-files", "-z"], {
+      stdout: "pipe",
+      stderr: "ignore",
+    });
+    const stdout = await new Response(gitProcess.stdout).text();
+
+    if ((await gitProcess.exited) !== 0) return [];
+    const paths = stdout.split("\0").filter((path) => path.length > 0);
+
+    return paths.toSorted().slice(0, MAX_FILES);
+  } catch {
+    return [];
+  }
+}
+
+/** True when `candidate` resolves outside `root` (path traversal) or is `root` itself. */
+function escapesRoot(root: string, candidate: string): boolean {
+  const rel = relative(root, candidate);
+
+  return rel.length === 0 || rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel);
+}
+
+/** UTF-8 contents of `repoRoot/path`, or null: no repo, traversal escape, not a regular file, oversized, or any error. */
+export async function readProjectFile(
+  repoRoot: string | undefined,
+  path: string,
+): Promise<string | null> {
+  if (repoRoot === undefined || repoRoot.length === 0) return null;
+  const root = resolve(repoRoot);
+  const target = resolve(root, path);
+
+  if (escapesRoot(root, target)) return null;
+  try {
+    const stats = await stat(target);
+
+    if (!stats.isFile() || stats.size > MAX_FILE_BYTES) return null;
+
+    return await Bun.file(target).text();
+  } catch {
+    return null;
+  }
+}

package/src/protocol.ts

@@ -1,9 +1,11 @@
 /**
- * Wire protocol (#14): newline-delimited JSON over the unix socket.
+ * Wire protocol: newline-delimited JSON over the unix socket.
  * Requests: { id, method, params }  Responses: { id, result } | { id, error }
  * Events (push, after events.subscribe): { event, sessionId }
  */
 
+import * as v from "valibot";
+
 export interface Request {
   id: number;
   method: string;
@@ -19,22 +21,92 @@ export interface Response {
 export interface EventFrame {
   event: string;
   sessionId: string;
+  /** The history entry the change appended, when it appended one. */
+  entryId?: string;
 }
 
 export type Frame = Response | EventFrame;
 
+const RequestSchema = v.object({
+  id: v.number(),
+  method: v.string(),
+  params: v.optional(v.unknown()),
+});
+const ResponseSchema = v.object({
+  id: v.number(),
+  result: v.optional(v.unknown()),
+  error: v.optional(v.object({ code: v.string(), message: v.string() })),
+});
+const EventFrameSchema = v.object({
+  event: v.string(),
+  sessionId: v.string(),
+  entryId: v.optional(v.string()),
+});
+
+export function parseRequestFrame(line: string): Request {
+  return v.parse(RequestSchema, JSON.parse(line));
+}
+
+export function parseInboundFrame(line: string): Frame {
+  return v.parse(v.union([ResponseSchema, EventFrameSchema]), JSON.parse(line));
+}
+
 /** Incremental NDJSON splitter; tolerates partial writes. */
 export class LineBuffer {
-  private buf = "";
+  private buffered = "";
 
   push(chunk: string, onLine: (line: string) => void): void {
-    this.buf += chunk;
+    this.buffered += chunk;
     for (;;) {
-      const nl = this.buf.indexOf("\n");
-      if (nl === -1) return;
-      const line = this.buf.slice(0, nl).trim();
-      this.buf = this.buf.slice(nl + 1);
+      const newlineIndex = this.buffered.indexOf("\n");
+
+      if (newlineIndex === -1) return;
+      const line = this.buffered.slice(0, newlineIndex).trim();
+
+      this.buffered = this.buffered.slice(newlineIndex + 1);
       if (line) onLine(line);
     }
   }
 }
+
+/** The surface both Bun.listen and Bun.connect sockets satisfy. */
+interface WritableSocket {
+  write(data: Buffer): number;
+}
+
+/**
+ * Outbound writes honoring socket backpressure. A frame larger than the
+ * kernel buffer is written partially by the socket; the unwritten tail must
+ * wait for the drain callback or the frame truncates mid-line and the NDJSON
+ * stream corrupts for good. Frames never reorder: while a tail is pending,
+ * new writes append behind it.
+ */
+export class BackpressureWriter {
+  private pending: Buffer | null = null;
+
+  constructor(private socket: WritableSocket) {}
+
+  write(data: string): void {
+    const bytes = Buffer.from(data, "utf8");
+
+    if (this.pending) {
+      this.pending = Buffer.concat([this.pending, bytes]);
+
+      return;
+    }
+    const written = Math.max(0, this.socket.write(bytes));
+
+    if (written < bytes.length) this.pending = bytes.subarray(written);
+  }
+
+  /** Call from the socket's drain handler. */
+  drain(): void {
+    if (!this.pending) return;
+    const tail = this.pending;
+
+    this.pending = null;
+    const written = Math.max(0, this.socket.write(tail));
+
+    if (written < tail.length) this.pending = tail.subarray(written);
+  }
+}