@gajae-code/coding-agent 0.11.6 → 0.11.7

package/src/extensibility/plugins/marketplace/fetcher.ts

@@ -5,10 +5,14 @@
  */
 
 import * as fs from "node:fs/promises";
+import * as http from "node:http";
+import * as https from "node:https";
+import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
 import { isEnoent, logger } from "@gajae-code/utils";
 import * as git from "../../../utils/git";
+import { isPrivateOrSpecialAddress, validatePublicHttpUrl } from "../../../web/insane/url-guard";
 
 import type { MarketplaceCatalog, MarketplaceSourceType } from "./types";
 import { isValidNameSegment } from "./types";
@@ -194,6 +198,192 @@ export function parseMarketplaceCatalog(content: string, filePath: string): Mark
 
 /** Relative path from a marketplace root to its catalog file. */
 const CATALOG_RELATIVE_PATH = path.join(".claude-plugin", "marketplace.json");
+const URL_FETCH_TIMEOUT_MS = 60_000;
+const URL_FETCH_MAX_REDIRECTS = 5;
+const URL_FETCH_MAX_HEADER_BYTES = 16 * 1024;
+/** Direct JSON catalogs are metadata; 2 MiB leaves ample room without permitting unbounded buffering. */
+const URL_FETCH_MAX_BYTES = 2 * 1024 * 1024;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+function withAbortSignal<T>(operation: Promise<T>, signal: AbortSignal): Promise<T> {
+	if (signal.aborted) return Promise.reject(signal.reason);
+	const deferred = Promise.withResolvers<T>();
+	const abort = () => deferred.reject(signal.reason);
+	signal.addEventListener("abort", abort, { once: true });
+	operation.then(deferred.resolve, deferred.reject).finally(() => signal.removeEventListener("abort", abort));
+	return deferred.promise;
+}
+
+function normalizePeerAddress(address: string): string {
+	const normalized = address.toLowerCase();
+	return normalized.startsWith("::ffff:") ? normalized.slice(7) : normalized;
+}
+
+function normalizeUrlHostname(hostname: string): string {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+
+async function validateCatalogUrl(rawUrl: string, signal: AbortSignal) {
+	const url = new URL(rawUrl);
+	const hostname = normalizeUrlHostname(url.hostname);
+	// URL.hostname retains IPv6 brackets in Node/Bun, while net.isIP expects the bare literal.
+	if (net.isIP(hostname) === 6) {
+		if (url.protocol !== "http:" && url.protocol !== "https:")
+			return { ok: false as const, reason: `unsupported scheme ${url.protocol}` };
+		if (url.username || url.password) return { ok: false as const, reason: "URL credentials are not allowed" };
+		if (isPrivateOrSpecialAddress(hostname))
+			return { ok: false as const, reason: "private, loopback, link-local, or reserved IP literal" };
+		return { ok: true as const, url, addresses: [hostname] };
+	}
+	return withAbortSignal(validatePublicHttpUrl(rawUrl), signal);
+}
+
+function openCatalogResponse(url: URL, addresses: string[], signal: AbortSignal): Promise<http.IncomingMessage> {
+	const hostname = normalizeUrlHostname(url.hostname);
+	const approved = addresses.map(address => ({ address, family: net.isIP(address) }));
+	const approvedPeers = new Set(approved.map(record => normalizePeerAddress(record.address)));
+	const lookup: net.LookupFunction = (requestedHostname, options, callback) => {
+		const requestedFamily = options.family === "IPv4" ? 4 : options.family === "IPv6" ? 6 : (options.family ?? 0);
+		const matching = approved.filter(record => requestedFamily === 0 || record.family === requestedFamily);
+		if (normalizeUrlHostname(requestedHostname) !== hostname || matching.length === 0) {
+			const error = Object.assign(new Error("No approved address for marketplace host"), { code: "ENOTFOUND" });
+			callback(error, options.all ? [] : "", 0);
+			return;
+		}
+		if (options.all) callback(null, matching);
+		else callback(null, matching[0].address, matching[0].family);
+	};
+	const deferred = Promise.withResolvers<http.IncomingMessage>();
+	const options: https.RequestOptions = {
+		protocol: url.protocol,
+		hostname,
+		port: url.port || undefined,
+		path: `${url.pathname}${url.search}`,
+		method: "GET",
+		headers: { Accept: "application/json", "Accept-Encoding": "identity", Connection: "close", Host: url.host },
+		agent: false,
+		insecureHTTPParser: false,
+		lookup,
+		maxHeaderSize: URL_FETCH_MAX_HEADER_BYTES,
+		signal,
+		...(url.protocol === "https:"
+			? { rejectUnauthorized: true, servername: net.isIP(hostname) === 0 ? hostname : undefined }
+			: {}),
+	};
+	const requestFn = url.protocol === "https:" ? https.request : http.request;
+	const request = requestFn(options, response => {
+		const peer = response.socket.remoteAddress;
+		if (!peer || isPrivateOrSpecialAddress(peer) || !approvedPeers.has(normalizePeerAddress(peer))) {
+			response.destroy();
+			deferred.reject(
+				new Error(`Refusing marketplace catalog response from unapproved connected peer ${peer ?? "unknown"}`),
+			);
+			return;
+		}
+		deferred.resolve(response);
+	});
+	request.once("error", deferred.reject);
+	const abort = () => {
+		request.destroy(signal.reason);
+		deferred.reject(signal.reason);
+	};
+	if (signal.aborted) abort();
+	else signal.addEventListener("abort", abort, { once: true });
+	request.once("close", () => signal.removeEventListener("abort", abort));
+	request.end();
+	return deferred.promise;
+}
+
+async function readCatalogResponse(
+	response: http.IncomingMessage,
+	source: string,
+	signal: AbortSignal,
+): Promise<string> {
+	const rawContentLengths: string[] = [];
+	let hasTransferEncoding = false;
+	for (let index = 0; index < response.rawHeaders.length; index += 2) {
+		const name = response.rawHeaders[index]?.toLowerCase();
+		if (name === "content-length") rawContentLengths.push(response.rawHeaders[index + 1] ?? "");
+		if (name === "transfer-encoding") hasTransferEncoding = true;
+	}
+	if (rawContentLengths.length > 1 || (rawContentLengths.length > 0 && hasTransferEncoding)) {
+		response.destroy();
+		throw new Error(`Marketplace catalog from ${source} has ambiguous response framing`);
+	}
+	const contentLength = response.headers["content-length"];
+	if (contentLength !== undefined) {
+		const declaredBytes =
+			typeof contentLength === "string" && /^\d+$/.test(contentLength) ? Number(contentLength) : NaN;
+		if (!Number.isSafeInteger(declaredBytes)) {
+			response.destroy();
+			throw new Error(`Marketplace catalog from ${source} has an invalid Content-Length`);
+		}
+		if (declaredBytes > URL_FETCH_MAX_BYTES) {
+			response.destroy();
+			throw new Error(`Marketplace catalog from ${source} exceeds the maximum size of 2 MiB`);
+		}
+	}
+
+	const abort = () => response.destroy(signal.reason);
+	if (signal.aborted) {
+		abort();
+		throw signal.reason;
+	}
+	signal.addEventListener("abort", abort, { once: true });
+	const chunks: Buffer[] = [];
+	let receivedBytes = 0;
+	try {
+		for await (const chunk of response) {
+			const bytes = Buffer.from(chunk);
+			receivedBytes += bytes.byteLength;
+			if (receivedBytes > URL_FETCH_MAX_BYTES) {
+				response.destroy();
+				throw new Error(`Marketplace catalog from ${source} exceeds the maximum size of 2 MiB`);
+			}
+			chunks.push(bytes);
+		}
+		return Buffer.concat(chunks, receivedBytes).toString("utf8");
+	} finally {
+		signal.removeEventListener("abort", abort);
+	}
+}
+
+async function fetchMarketplaceCatalogUrl(source: string): Promise<string> {
+	const deadline = AbortSignal.timeout(URL_FETCH_TIMEOUT_MS);
+	let currentUrl = source;
+	try {
+		for (let redirectCount = 0; ; redirectCount++) {
+			const guard = await validateCatalogUrl(currentUrl, deadline);
+			if (!guard.ok) {
+				throw new Error(`Refusing marketplace catalog URL: target URL is not public HTTP(S): ${guard.reason}`);
+			}
+			const response = await openCatalogResponse(guard.url, guard.addresses, deadline);
+			const status = response.statusCode ?? 0;
+			if (REDIRECT_STATUSES.has(status)) {
+				if (redirectCount >= URL_FETCH_MAX_REDIRECTS) {
+					response.destroy();
+					throw new Error(`Too many redirects fetching marketplace catalog from ${source}`);
+				}
+				const location = response.headers.location;
+				response.destroy();
+				if (!location)
+					throw new Error(`Marketplace catalog redirect from ${currentUrl} is missing a Location header`);
+				currentUrl = new URL(location, guard.url).toString();
+				continue;
+			}
+			if (status < 200 || status >= 300) {
+				response.destroy();
+				throw new Error(
+					`Failed to fetch marketplace catalog from ${currentUrl}: HTTP ${status} ${response.statusMessage ?? ""}`,
+				);
+			}
+			return await readCatalogResponse(response, currentUrl, deadline);
+		}
+	} catch (err) {
+		if (deadline.aborted) throw new Error(`Timed out fetching marketplace catalog from ${source}`);
+		throw err;
+	}
+}
 
 /**
  * Expand a `~/...` path to an absolute path using os.homedir().
@@ -249,13 +439,7 @@ export async function fetchMarketplace(source: string, cacheDir: string): Promis
 	}
 
 	// type === "url"
-	const response = await fetch(source, { signal: AbortSignal.timeout(60_000) });
-	if (!response.ok) {
-		throw new Error(
-			`Failed to fetch marketplace catalog from ${source}: HTTP ${response.status} ${response.statusText}`,
-		);
-	}
-	const text = await response.text();
+	const text = await fetchMarketplaceCatalogUrl(source);
 	const catalog = parseMarketplaceCatalog(text, source);
 
 	const catalogDir = path.join(cacheDir, catalog.name);

package/src/gjc-runtime/ultragoal-guard.ts

@@ -2,6 +2,10 @@ import * as fs from "node:fs/promises";
 import { DEFAULT_ULTRAGOAL_OBJECTIVE } from "./goal-mode-request";
 import { resolveGjcSessionForRead, SessionResolutionError } from "./session-resolution";
 import {
+	findCleanPauseCriticVerdict,
+	findLedgerReceiptEvent,
+	terminalCriticCeilingReached,
+	terminalCriticGateOverridden,
 	validateDeferredMemberReceiptFresh,
 	validateReceiptFreshBase,
 	validateSupersededFinalAggregateReceipt,
@@ -32,6 +36,7 @@ export type UltragoalGuardState =
 	| "active_dirty_quality_gate"
 	| "active_review_blocked_unrecorded"
 	| "active_review_blocked_recorded"
+	| "active_missing_critic_verdict"
 	| "unreadable_fail_closed";
 
 export interface UltragoalGuardDiagnostic {
@@ -256,6 +261,31 @@ export function validateCompletionReceipt(input: {
 			goalId: input.goal.id,
 		};
 	}
+	if (input.receiptKind === "final-aggregate") {
+		const checkpointEvent = findLedgerReceiptEvent(input.ledger, receipt);
+		if (checkpointEvent) {
+			const qualityGate =
+				typeof checkpointEvent.qualityGateJson === "object" &&
+				checkpointEvent.qualityGateJson !== null &&
+				!Array.isArray(checkpointEvent.qualityGateJson)
+					? (checkpointEvent.qualityGateJson as Record<string, unknown>)
+					: undefined;
+			const criticReview =
+				qualityGate &&
+				typeof qualityGate.criticReview === "object" &&
+				qualityGate.criticReview !== null &&
+				!Array.isArray(qualityGate.criticReview)
+					? (qualityGate.criticReview as Record<string, unknown>)
+					: undefined;
+			if (criticReview?.verdict !== "OKAY") {
+				return {
+					state: "active_missing_critic_verdict",
+					message: `Ultragoal ${input.goal.id} final aggregate receipt checkpoint requires criticReview with verdict OKAY.`,
+					goalId: input.goal.id,
+				};
+			}
+		}
+	}
 	if (receipt.validationBatch?.role === "deferred-member") {
 		return validateDeferredMemberReceiptFresh({
 			plan: input.plan,
@@ -274,6 +304,15 @@ export function validateCompletionReceipt(input: {
 		receiptKind: input.receiptKind,
 	});
 	if (baseDiagnostic) return baseDiagnostic;
+	if (input.receiptKind === "final-aggregate") {
+		if (terminalCriticCeilingReached(input.ledger) && !terminalCriticGateOverridden(input.ledger)) {
+			return {
+				state: "active_stale_receipt",
+				message: `Ultragoal ${input.goal.id} final aggregate receipt is stale because the terminal-critic ceiling is currently reached.`,
+				goalId: input.goal.id,
+			};
+		}
+	}
 	if (receipt.validationBatch?.role === "batch-close") {
 		for (const memberId of receipt.validationBatch.memberIds) {
 			const member = input.plan.goals.find(goal => goal.id === memberId);
@@ -856,10 +895,10 @@ export interface UltragoalPauseBlockDiagnostic {
 
 /**
  * While an Ultragoal run is active, `goal({"op":"pause"})` is only allowed when the
- * current durable Ultragoal state is readable and the latest durable ledger event
- * classifies the current blocker as `human_blocked`. Resolvable blockers must be
- * worked, not parked. Reads fail closed so unreadable durable state or ledger data
- * blocks pause rather than silently allowing a give-up.
+ * current durable Ultragoal state is readable, the latest `blocker_classified`
+ * event is `human_blocked`, and a later fresh clean pause terminal critic verdict is bound to
+ * that exact classification. Reads fail closed so unreadable durable state or
+ * ledger data blocks pause rather than silently allowing a give-up.
  */
 export async function isUltragoalPauseBlocked(cwd: string): Promise<UltragoalPauseBlockDiagnostic> {
 	if (!cwd) return { blocked: false, reason: "No cwd to resolve durable Ultragoal state." };
@@ -880,14 +919,53 @@ export async function isUltragoalPauseBlocked(cwd: string): Promise<UltragoalPau
 			reason: `Unable to read durable Ultragoal ledger: ${error instanceof Error ? error.message : String(error)}`,
 		};
 	}
-	const latest = ledger.at(-1);
-	if (latest?.event === "blocker_classified" && latest.classification === "human_blocked") {
-		return { blocked: false, reason: "Latest Ultragoal ledger event classifies the blocker as human_blocked." };
+	if (terminalCriticCeilingReached(ledger) && !terminalCriticGateOverridden(ledger)) {
+		return {
+			blocked: true,
+			reason:
+				"The Ultragoal run hit the terminal-critic ceiling; requires human/leader `gjc ultragoal record-critic-gate-override` before further terminal attempts.",
+		};
+	}
+
+	const classification = [...ledger].reverse().find(event => event.event === "blocker_classified");
+	if (classification?.classification !== "human_blocked") {
+		return {
+			blocked: true,
+			reason:
+				"An Ultragoal run is active. Pausing requires the latest blocker_classified event to be human_blocked, followed by a bound clean pause terminal critic verdict.",
+		};
+	}
+	if (typeof classification.eventId !== "string" || !classification.eventId.trim()) {
+		return {
+			blocked: true,
+			reason:
+				"Pausing requires a later fresh clean pause terminal critic OKAY verdict bound to the latest human_blocked blocker_classified event; a REJECT/ITERATE/stale/missing verdict blocks the pause and the run must keep executing.",
+		};
+	}
+	let plan: UltragoalPlan | null;
+	try {
+		plan = await readUltragoalPlan(cwd);
+	} catch (error) {
+		return {
+			blocked: true,
+			reason: `Unable to read durable Ultragoal plan for pause critic verdict: ${error instanceof Error ? error.message : String(error)}`,
+		};
+	}
+	if (!plan) {
+		return { blocked: true, reason: "Unable to read durable Ultragoal plan for pause critic verdict." };
+	}
+	const criticVerdict = findCleanPauseCriticVerdict(plan, ledger, classification.eventId);
+	if (!criticVerdict) {
+		return {
+			blocked: true,
+			reason:
+				"Pausing requires a later fresh clean pause terminal critic OKAY verdict bound to the latest human_blocked blocker_classified event; a REJECT/ITERATE/stale/missing verdict blocks the pause and the run must keep executing.",
+		};
 	}
 	return {
-		blocked: true,
+		blocked: false,
 		reason:
-			"An Ultragoal run is active. Pausing requires the current blocker to be classified human_blocked as the latest ledger event.",
+			"Latest blocker_classified event is human_blocked with a later fresh clean bound pause terminal critic verdict.",
 	};
 }
 
@@ -902,7 +980,7 @@ export async function assertUltragoalPauseAllowed(cwd: string): Promise<void> {
 		[
 			diagnostic.reason,
 			"Resolvable blockers must be worked, not paused: investigate, `gjc ultragoal steer --kind add_subgoal`, delegate an executor, or `gjc ultragoal record-review-blockers`.",
-			'If the blocker is genuinely human-only, record `gjc ultragoal classify-blocker --classification human_blocked --evidence "<human-only dependency>"` immediately before pausing.',
+			'If the blocker is genuinely human-only, record `gjc ultragoal classify-blocker --classification human_blocked --evidence "<human-only dependency>"`, then record a clean bound `gjc ultragoal record-critic-verdict --terminus pause --classification-event-id <eventId> --verdict OKAY --evidence "<critic evidence>"` before pausing.',
 		].join("\n"),
 	);
 }

package/src/gjc-runtime/ultragoal-receipt-freshness.ts

@@ -8,6 +8,12 @@ import type {
 	UltragoalReceiptKind,
 } from "./ultragoal-runtime";
 
+export const CRITIC_VERDICT_EVENT = "critic_verdict";
+export const CRITIC_GATE_HARD_STOP_EVENT = "critic_gate_hard_stop";
+export const CRITIC_GATE_OVERRIDE_EVENT = "critic_gate_override";
+export const TERMINAL_CRITIC_CEILING = 5;
+export type CriticVerdict = "OKAY" | "ITERATE" | "REJECT";
+
 export type UltragoalReceiptFreshnessDiagnostic = {
 	state:
 		| "inactive"
@@ -46,6 +52,103 @@ export function requiredUltragoalGoals(plan: UltragoalPlan): UltragoalGoal[] {
 	return plan.goals.filter(goal => goal.status !== "superseded");
 }
 
+/** Hash the current required-goal set for terminal critic verdict freshness. */
+export function computeCriticVerdictPlanGeneration(plan: UltragoalPlan): string {
+	return hashStructuredValue(
+		requiredUltragoalGoals(plan).map(goal => ({
+			id: goal.id,
+			status: goal.status,
+			updatedAt: goal.updatedAt,
+		})),
+	);
+}
+
+export function isCleanPauseCriticVerdictShape(
+	candidate: UltragoalLedgerEvent,
+	planGeneration: string,
+	classificationEventId: string,
+): boolean {
+	return (
+		candidate.event === CRITIC_VERDICT_EVENT &&
+		candidate.terminus === "pause" &&
+		candidate.verdict === "OKAY" &&
+		typeof candidate.evidence === "string" &&
+		candidate.evidence.trim().length > 0 &&
+		Array.isArray(candidate.blockers) &&
+		candidate.blockers.length === 0 &&
+		candidate.planGeneration === planGeneration &&
+		candidate.classificationEventId === classificationEventId
+	);
+}
+
+export function isCleanPauseCriticVerdict(
+	event: UltragoalLedgerEvent,
+	opts: { planGeneration: string; classificationEventId: string },
+): boolean {
+	return isCleanPauseCriticVerdictShape(event, opts.planGeneration, opts.classificationEventId);
+}
+
+export function findCleanPauseCriticVerdict(
+	plan: UltragoalPlan,
+	ledger: readonly UltragoalLedgerEvent[],
+	classificationEventId: string,
+): UltragoalLedgerEvent | null {
+	const classificationIndex = ledger.findIndex(event => event.eventId === classificationEventId);
+	if (classificationIndex < 0) return null;
+	const planGeneration = computeCriticVerdictPlanGeneration(plan);
+	for (let index = ledger.length - 1; index > classificationIndex; index--) {
+		const event = ledger[index];
+		if (
+			event.event !== CRITIC_VERDICT_EVENT ||
+			event.terminus !== "pause" ||
+			event.planGeneration !== planGeneration ||
+			event.classificationEventId !== classificationEventId
+		)
+			continue;
+		return isCleanPauseCriticVerdict(event, { planGeneration, classificationEventId }) ? event : null;
+	}
+	return null;
+}
+
+/** Pure: count all ledger `critic_verdict` rows for an exact plan generation. */
+export function countTerminalCriticVerdicts(ledger: readonly UltragoalLedgerEvent[], planGeneration: string): number {
+	return ledger.filter(event => event.event === CRITIC_VERDICT_EVENT && event.planGeneration === planGeneration)
+		.length;
+}
+/** Pure: count every non-OKAY terminal critic verdict recorded for this run. */
+export function countNonOkayTerminalCriticVerdicts(
+	ledger: readonly UltragoalLedgerEvent[],
+	_legacyPlanGeneration?: string,
+): number {
+	return ledger.filter(event => event.event === CRITIC_VERDICT_EVENT && event.verdict !== "OKAY").length;
+}
+
+export function terminalCriticHardStopReached(
+	ledger: readonly UltragoalLedgerEvent[],
+	_legacyPlanGeneration?: string,
+): boolean {
+	return ledger.some(event => event.event === CRITIC_GATE_HARD_STOP_EVENT);
+}
+
+export function terminalCriticGateOverridden(ledger: readonly UltragoalLedgerEvent[]): boolean {
+	let overrideAfterLatestHardStop = false;
+	for (let index = ledger.length - 1; index >= 0; index--) {
+		const event = ledger[index];
+		if (event.event === CRITIC_GATE_OVERRIDE_EVENT) overrideAfterLatestHardStop = true;
+		if (event.event === CRITIC_GATE_HARD_STOP_EVENT) return overrideAfterLatestHardStop;
+	}
+	return false;
+}
+
+export function terminalCriticCeilingReached(
+	ledger: readonly UltragoalLedgerEvent[],
+	_legacyPlanGeneration?: string,
+): boolean {
+	return (
+		countNonOkayTerminalCriticVerdicts(ledger) >= TERMINAL_CRITIC_CEILING || terminalCriticHardStopReached(ledger)
+	);
+}
+
 export function receiptRelevantGoals(
 	plan: UltragoalPlan,
 	goal: UltragoalGoal,