@cueloop/daemon 0.1.0-alpha.9 → 0.1.0-alpha.91

package/src/main.ts

@@ -2,9 +2,12 @@
 
 import { DaemonServer } from "./server";
 
-const idleExitMs = process.env.CUELOOP_IDLE_EXIT_MS ? Number(process.env.CUELOOP_IDLE_EXIT_MS) : undefined;
+const idleExitMs = process.env.CUELOOP_IDLE_EXIT_MS
+  ? Number(process.env.CUELOOP_IDLE_EXIT_MS)
+  : undefined;
 const server = new DaemonServer({ idleExitMs });
 const path = server.start();
+
 if (path === null) {
   // another daemon already owns this home; the client will attach to it
   console.log("cueloop daemon already running for this home");

package/src/paths.ts

@@ -18,6 +18,35 @@ export function sessionsDir(home = cueloopHome()): string {
   return join(home, "sessions");
 }
 
+/** Thread files live here, one JSONL per thread, under a per-project bucket. */
+export function threadsDir(home = cueloopHome()): string {
+  return join(home, "threads");
+}
+
+/** A git commit is lowercase hex; anything else is not a real root commit. */
+const COMMIT_SHA = /^[0-9a-f]{7,64}$/;
+
+/**
+ * The per-project bucket for a workspace: its durable root-commit SHA, or a shared standalone bucket.
+ * A value that is not a commit SHA (including path-traversal segments an IPC caller could smuggle in)
+ * is refused to the standalone bucket, so a bucket name can never escape the threads directory.
+ */
+export function threadBucket(rootCommit: string | undefined, home = cueloopHome()): string {
+  const bucket =
+    rootCommit && COMMIT_SHA.test(rootCommit) ? rootCommit.slice(0, 12) : "_standalone";
+
+  return join(threadsDir(home), bucket);
+}
+
+/** Where the one-time migration parks the old whole-record JSON files, so a downgrade can still read them. */
+export function migratedSessionsDir(home = cueloopHome()): string {
+  return join(home, "sessions.migrated");
+}
+
+export function reportsDir(home = cueloopHome()): string {
+  return join(home, "reports");
+}
+
 export function pidPath(home = cueloopHome()): string {
   return join(home, "cueloop.pid");
 }
@@ -25,3 +54,23 @@ export function pidPath(home = cueloopHome()): string {
 export function lockPath(home = cueloopHome()): string {
   return join(home, "cueloop.lock");
 }
+
+/** The secret a connection presents to be the owner; written by the daemon, mode 0600. */
+export function ownerTokenPath(home = cueloopHome()): string {
+  return join(home, "owner.token");
+}
+
+/** Adapter scratch for Herdr handles; the disk name stays stable across tab and pane support. */
+export function herdrThreadSurfacesPath(home = cueloopHome()): string {
+  return join(home, "herdr-tabs.json");
+}
+
+/** Ghostty-native terminal IDs are adapter scratch, not Thread state. */
+export function ghosttyThreadSurfacesPath(home = cueloopHome()): string {
+  return join(home, "ghostty-thread-surfaces.json");
+}
+
+/** Harness bindings and Message deliveries, stored independently of Thread records. */
+export function harnessStatePath(home = cueloopHome()): string {
+  return join(home, "harness-state.json");
+}

package/src/pr-poller.test.ts

@@ -0,0 +1,102 @@
+import { describe, expect, test } from "bun:test";
+import { PrReviewPoller } from "./pr-poller";
+
+/** Build a poller whose head sha is controllable, with the timer effectively disabled. */
+function refs(baseSha: string, headSha: string) {
+  return { baseSha, headSha };
+}
+
+function makePoller(initialRefs: ReturnType<typeof refs> | null) {
+  let currentRefs = initialRefs;
+  const advanced: Array<{ sessionId: string; refs: ReturnType<typeof refs> }> = [];
+  const poller = new PrReviewPoller(
+    (sessionId, nextRefs) => advanced.push({ sessionId, refs: nextRefs }),
+    async () => currentRefs,
+    1_000_000,
+  );
+
+  return {
+    poller,
+    advanced,
+    setRefs: (next: ReturnType<typeof refs> | null) => {
+      currentRefs = next;
+    },
+  };
+}
+
+describe("PrReviewPoller", () => {
+  test("the first observation is a silent baseline", async () => {
+    const { poller, advanced } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([]);
+    poller.close();
+  });
+
+  test("a moved head fires once; an unchanged head stays quiet", async () => {
+    const { poller, advanced, setRefs } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+
+    setRefs(refs("base1", "sha2"));
+    await poller.refreshHead("s1");
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([{ sessionId: "s1", refs: refs("base1", "sha2") }]);
+    poller.close();
+  });
+
+  test("a persisted reviewed head exposes a move on the first check after restart", async () => {
+    const { poller, advanced } = makePoller(refs("base1", "sha2"));
+
+    poller.trackPr("s1", "https://github.com/org/repo/pull/1", refs("base1", "sha1"));
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([{ sessionId: "s1", refs: refs("base1", "sha2") }]);
+    poller.close();
+  });
+
+  test("a failed head read never fires and keeps the last baseline", async () => {
+    const { poller, advanced, setRefs } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+
+    setRefs(null);
+    await poller.refreshHead("s1");
+    setRefs(refs("base1", "sha2"));
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([{ sessionId: "s1", refs: refs("base1", "sha2") }]);
+    poller.close();
+  });
+
+  test("untrack stops further checks", async () => {
+    const { poller, advanced, setRefs } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+    poller.untrackPr("s1");
+
+    setRefs(refs("base1", "sha2"));
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([]);
+    poller.close();
+  });
+
+  test("a moved base fires while the head stays unchanged", async () => {
+    const { poller, advanced, setRefs } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+    setRefs(refs("base2", "sha1"));
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([{ sessionId: "s1", refs: refs("base2", "sha1") }]);
+    poller.close();
+  });
+});

package/src/pr-poller.ts

@@ -0,0 +1,73 @@
+/**
+ * Polls each open PR review for new commits. A remote PR has no push signal, so
+ * this checks its base/head pair on an interval and only exposes refresh when
+ * either side moved. Best-effort: a missing or failing gh keeps the last refs.
+ */
+
+import { prRefs, type PullRequestRefs } from "./gh";
+
+/** One cheap refs check per interval; the expensive full-diff pull happens only on a move. */
+const PR_POLL_INTERVAL_MS = 30_000;
+
+interface PrPoll {
+  pr: string;
+  /** Last refs seen; null until the baseline check lands, so the first observation never fires. */
+  lastRefs: PullRequestRefs | null;
+  timer: ReturnType<typeof setInterval>;
+}
+
+export class PrReviewPoller {
+  private readonly polls = new Map<string, PrPoll>();
+
+  constructor(
+    private readonly onPrAdvance: (sessionId: string, refs: PullRequestRefs) => void,
+    private readonly refs: (pr: string) => Promise<PullRequestRefs | null> = prRefs,
+    private readonly intervalMs: number = PR_POLL_INTERVAL_MS,
+  ) {}
+
+  /** Start polling a PR review. Idempotent per session; the persisted reviewed head is the baseline. */
+  trackPr(sessionId: string, pr: string, reviewedRefs: PullRequestRefs | null = null): void {
+    if (this.polls.has(sessionId)) return;
+    const timer = setInterval(() => void this.refreshHead(sessionId), this.intervalMs);
+    // the poll timer must not by itself keep the daemon alive against idle-exit
+    timer.unref?.();
+    this.polls.set(sessionId, { pr, lastRefs: reviewedRefs, timer });
+    void this.refreshHead(sessionId);
+  }
+
+  /** Check the PR refs once; fire onPrAdvance only when they moved off a known baseline. */
+  async refreshHead(sessionId: string): Promise<void> {
+    const poll = this.polls.get(sessionId);
+
+    if (!poll) return;
+    const refs = await this.refs(poll.pr).catch(() => null);
+
+    if (refs === null) return;
+    // the await yields; re-read so an untrack during the call is honoured
+    const current = this.polls.get(sessionId);
+
+    if (!current) return;
+    if (current.lastRefs === null) {
+      current.lastRefs = refs;
+
+      return;
+    }
+    if (refs.baseSha === current.lastRefs.baseSha && refs.headSha === current.lastRefs.headSha)
+      return;
+    current.lastRefs = refs;
+    this.onPrAdvance(sessionId, refs);
+  }
+
+  untrackPr(sessionId: string): void {
+    const poll = this.polls.get(sessionId);
+
+    if (!poll) return;
+    clearInterval(poll.timer);
+    this.polls.delete(sessionId);
+  }
+
+  close(): void {
+    for (const poll of this.polls.values()) clearInterval(poll.timer);
+    this.polls.clear();
+  }
+}

package/src/project-files.test.ts

@@ -0,0 +1,124 @@
+/** Read-only repo introspection: the tracked file tree and safe, bounded file reads. */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { listProjectFiles, readProjectFile } from "./project-files";
+
+function git(args: string[], cwd: string): void {
+  const result = Bun.spawnSync(["git", ...args], { cwd, stdout: "ignore", stderr: "ignore" });
+
+  if (result.exitCode !== 0) throw new Error(`git ${args.join(" ")} failed in ${cwd}`);
+}
+
+let repo: string;
+
+beforeEach(() => {
+  repo = mkdtempSync(join(tmpdir(), "cueloop-project-files-"));
+  git(["init", "-q", "-b", "main"], repo);
+  git(["config", "user.email", "t@t"], repo);
+  git(["config", "user.name", "t"], repo);
+});
+
+afterEach(() => {
+  rmSync(repo, { recursive: true, force: true });
+});
+
+describe("listProjectFiles", () => {
+  test("returns the tracked files sorted ascending", async () => {
+    // Given a repo whose files are committed out of alphabetical order
+    writeFileSync(join(repo, "z.ts"), "export const z = 1;\n");
+    writeFileSync(join(repo, "a.ts"), "export const a = 1;\n");
+    writeFileSync(join(repo, "m.ts"), "export const m = 1;\n");
+    git(["add", "."], repo);
+    git(["commit", "-qm", "init"], repo);
+
+    // When the tracked files are listed
+    const files = await listProjectFiles(repo);
+
+    // Then every tracked path comes back in ascending order
+    expect(files).toEqual(["a.ts", "m.ts", "z.ts"]);
+  });
+
+  test("returns [] for a directory that is not a git repo", async () => {
+    // Given a plain directory with a file but no git repo
+    const plain = mkdtempSync(join(tmpdir(), "cueloop-project-files-plain-"));
+
+    writeFileSync(join(plain, "a.ts"), "export const a = 1;\n");
+    try {
+      // When the tracked files are listed
+      const files = await listProjectFiles(plain);
+
+      // Then nothing comes back and no error is thrown
+      expect(files).toEqual([]);
+    } finally {
+      rmSync(plain, { recursive: true, force: true });
+    }
+  });
+
+  test("returns [] when there is no repoRoot", async () => {
+    expect(await listProjectFiles(undefined)).toEqual([]);
+  });
+});
+
+describe("readProjectFile", () => {
+  test("reads a repo-relative file as UTF-8", async () => {
+    // Given a committed file with known contents
+    writeFileSync(join(repo, "a.ts"), "export const a = 1;\n");
+    git(["add", "."], repo);
+    git(["commit", "-qm", "init"], repo);
+
+    // When it is read by its repo-relative path
+    const contents = await readProjectFile(repo, "a.ts");
+
+    // Then its exact bytes come back
+    expect(contents).toBe("export const a = 1;\n");
+  });
+
+  test("returns null for a path that escapes the repo via ../", async () => {
+    // Given a secret file just outside the repo root
+    const secret = join(repo, "..", "outside-secret.txt");
+
+    writeFileSync(secret, "top secret\n");
+    try {
+      // When a traversal path tries to reach it
+      const contents = await readProjectFile(repo, "../outside-secret.txt");
+
+      // Then the read is refused
+      expect(contents).toBeNull();
+    } finally {
+      rmSync(secret, { force: true });
+    }
+  });
+
+  test("returns null for a missing file", async () => {
+    expect(await readProjectFile(repo, "nope.ts")).toBeNull();
+  });
+
+  test("returns null for a directory (not a regular file)", async () => {
+    // Given a directory inside the repo
+    mkdirSync(join(repo, "src"));
+
+    // When the directory path is read
+    const contents = await readProjectFile(repo, "src");
+
+    // Then it is refused
+    expect(contents).toBeNull();
+  });
+
+  test("returns null for a file larger than the cap", async () => {
+    // Given a file just over one megabyte
+    writeFileSync(join(repo, "big.bin"), "x".repeat(1024 * 1024 + 1));
+
+    // When it is read
+    const contents = await readProjectFile(repo, "big.bin");
+
+    // Then it is refused for exceeding the size cap
+    expect(contents).toBeNull();
+  });
+
+  test("returns null when there is no repoRoot", async () => {
+    expect(await readProjectFile(undefined, "a.ts")).toBeNull();
+  });
+});

package/src/project-files.ts

@@ -0,0 +1,56 @@
+/** Read-only repo introspection for the Project panel: the tracked file tree and a file's contents. */
+
+import { stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+
+/** Ceiling on the returned tree; a pathological repo cannot flood the panel or the wire. */
+const MAX_FILES = 5000;
+/** Ceiling on a served file; the panel renders source, not multi-megabyte blobs. */
+const MAX_FILE_BYTES = 1024 * 1024;
+
+/** Tracked, repo-relative paths from `git ls-files`, sorted ascending and capped; [] on any failure or non-repo. */
+export async function listProjectFiles(repoRoot: string | undefined): Promise<string[]> {
+  if (repoRoot === undefined || repoRoot.length === 0) return [];
+  try {
+    const gitProcess = Bun.spawn(["git", "-C", repoRoot, "ls-files", "-z"], {
+      stdout: "pipe",
+      stderr: "ignore",
+    });
+    const stdout = await new Response(gitProcess.stdout).text();
+
+    if ((await gitProcess.exited) !== 0) return [];
+    const paths = stdout.split("\0").filter((path) => path.length > 0);
+
+    return paths.toSorted().slice(0, MAX_FILES);
+  } catch {
+    return [];
+  }
+}
+
+/** True when `candidate` resolves outside `root` (path traversal) or is `root` itself. */
+function escapesRoot(root: string, candidate: string): boolean {
+  const rel = relative(root, candidate);
+
+  return rel.length === 0 || rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel);
+}
+
+/** UTF-8 contents of `repoRoot/path`, or null: no repo, traversal escape, not a regular file, oversized, or any error. */
+export async function readProjectFile(
+  repoRoot: string | undefined,
+  path: string,
+): Promise<string | null> {
+  if (repoRoot === undefined || repoRoot.length === 0) return null;
+  const root = resolve(repoRoot);
+  const target = resolve(root, path);
+
+  if (escapesRoot(root, target)) return null;
+  try {
+    const stats = await stat(target);
+
+    if (!stats.isFile() || stats.size > MAX_FILE_BYTES) return null;
+
+    return await Bun.file(target).text();
+  } catch {
+    return null;
+  }
+}

package/src/protocol.ts

@@ -1,9 +1,11 @@
 /**
- * Wire protocol (#14): newline-delimited JSON over the unix socket.
+ * Wire protocol: newline-delimited JSON over the unix socket.
  * Requests: { id, method, params }  Responses: { id, result } | { id, error }
  * Events (push, after events.subscribe): { event, sessionId }
  */
 
+import * as v from "valibot";
+
 export interface Request {
   id: number;
   method: string;
@@ -19,22 +21,92 @@ export interface Response {
 export interface EventFrame {
   event: string;
   sessionId: string;
+  /** The history entry the change appended, when it appended one. */
+  entryId?: string;
 }
 
 export type Frame = Response | EventFrame;
 
+const RequestSchema = v.object({
+  id: v.number(),
+  method: v.string(),
+  params: v.optional(v.unknown()),
+});
+const ResponseSchema = v.object({
+  id: v.number(),
+  result: v.optional(v.unknown()),
+  error: v.optional(v.object({ code: v.string(), message: v.string() })),
+});
+const EventFrameSchema = v.object({
+  event: v.string(),
+  sessionId: v.string(),
+  entryId: v.optional(v.string()),
+});
+
+export function parseRequestFrame(line: string): Request {
+  return v.parse(RequestSchema, JSON.parse(line));
+}
+
+export function parseInboundFrame(line: string): Frame {
+  return v.parse(v.union([ResponseSchema, EventFrameSchema]), JSON.parse(line));
+}
+
 /** Incremental NDJSON splitter; tolerates partial writes. */
 export class LineBuffer {
-  private buf = "";
+  private buffered = "";
 
   push(chunk: string, onLine: (line: string) => void): void {
-    this.buf += chunk;
+    this.buffered += chunk;
     for (;;) {
-      const nl = this.buf.indexOf("\n");
-      if (nl === -1) return;
-      const line = this.buf.slice(0, nl).trim();
-      this.buf = this.buf.slice(nl + 1);
+      const newlineIndex = this.buffered.indexOf("\n");
+
+      if (newlineIndex === -1) return;
+      const line = this.buffered.slice(0, newlineIndex).trim();
+
+      this.buffered = this.buffered.slice(newlineIndex + 1);
       if (line) onLine(line);
     }
   }
 }
+
+/** The surface both Bun.listen and Bun.connect sockets satisfy. */
+interface WritableSocket {
+  write(data: Buffer): number;
+}
+
+/**
+ * Outbound writes honoring socket backpressure. A frame larger than the
+ * kernel buffer is written partially by the socket; the unwritten tail must
+ * wait for the drain callback or the frame truncates mid-line and the NDJSON
+ * stream corrupts for good. Frames never reorder: while a tail is pending,
+ * new writes append behind it.
+ */
+export class BackpressureWriter {
+  private pending: Buffer | null = null;
+
+  constructor(private socket: WritableSocket) {}
+
+  write(data: string): void {
+    const bytes = Buffer.from(data, "utf8");
+
+    if (this.pending) {
+      this.pending = Buffer.concat([this.pending, bytes]);
+
+      return;
+    }
+    const written = Math.max(0, this.socket.write(bytes));
+
+    if (written < bytes.length) this.pending = bytes.subarray(written);
+  }
+
+  /** Call from the socket's drain handler. */
+  drain(): void {
+    if (!this.pending) return;
+    const tail = this.pending;
+
+    this.pending = null;
+    const written = Math.max(0, this.socket.write(tail));
+
+    if (written < tail.length) this.pending = tail.subarray(written);
+  }
+}