@gajae-code/coding-agent 0.17.1 → 0.17.2

package/src/debug/report-bundle.ts

@@ -6,7 +6,16 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { WorkProfile } from "@gajae-code/natives";
-import { APP_NAME, getLogPath, getLogsDir, getReportsDir, isEnoent } from "@gajae-code/utils";
+import {
+	APP_NAME,
+	getEffectiveLogPath,
+	getEffectiveLogsDir,
+	getLogPath,
+	getLogsDir,
+	getReportsDir,
+	isEnoent,
+	resolveEquivalentPath,
+} from "@gajae-code/utils";
 import type { CpuProfile, HeapSnapshot } from "./profiler";
 import { collectSystemInfo, sanitizeEnv } from "./system-info";
 
@@ -34,6 +43,70 @@ async function readLastLines(filePath: string, n: number, maxBytes = MAX_LOG_BYT
 	}
 }
 
+/**
+ * Both log directories can legitimately hold dated `gjc.<date>.log` files, and a
+ * reader that consults only one of them is wrong in one direction or the other.
+ *
+ * The *effective* directory is where this process writes — a trusted
+ * `GJC_LOG_DIR` pin, which the test preload sets to a per-process temp sink
+ * (issue #5618). The *canonical* directory is the config root, which carries
+ * history: previous runs, other processes, and anything written through
+ * `getLogsDir()` before this process pinned anything.
+ *
+ * Deduplicated by equivalent path, effective first. In production — and in any
+ * process that never pinned `GJC_LOG_DIR` — the two resolve to the same
+ * directory and this collapses to the single entry these readers have always
+ * used, so nothing is listed twice and no ordering changes.
+ */
+function logSearchDirs(): string[] {
+	const dirs: string[] = [];
+	for (const resolve of [getEffectiveLogsDir, getLogsDir]) {
+		const resolved = attemptPath(resolve);
+		if (resolved !== undefined && !dirs.includes(resolved)) dirs.push(resolved);
+	}
+	return dirs;
+}
+
+/**
+ * Resolve a log path, or `undefined` when it is unavailable.
+ *
+ * `getLogsDir()`/`getLogPath()` throw when there is no trustworthy home. That
+ * must not deny the caller the *other* directory, which a pinned `GJC_LOG_DIR`
+ * can still supply.
+ */
+function attemptPath(resolve: () => string): string | undefined {
+	try {
+		return resolveEquivalentPath(resolve());
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Today's log text, oldest content first.
+ *
+ * Concatenated canonical-then-effective so the tail stays chronological, and the
+ * line cap is applied to the COMBINED result: capping per file would let a large
+ * history file push this process's own entries out of a bundle that still looks
+ * complete. When the two paths are the same file — production, and any process
+ * without a `GJC_LOG_DIR` pin — this is a single read of exactly the bytes the
+ * previous single-path implementation returned.
+ */
+async function readTodayLogText(maxLines: number): Promise<string> {
+	const parts: string[] = [];
+	const seen = new Set<string>();
+	for (const resolve of [getLogPath, getEffectiveLogPath]) {
+		const candidate = attemptPath(resolve);
+		if (candidate === undefined || seen.has(candidate)) continue;
+		seen.add(candidate);
+		const text = await readLastLines(candidate, maxLines);
+		if (text.length > 0) parts.push(text);
+	}
+	const combined = parts.join("\n");
+	const lines = combined.split("\n");
+	return lines.length > maxLines ? lines.slice(-maxLines).join("\n") : combined;
+}
+
 export interface ReportBundleOptions {
 	/** Session file path */
 	sessionFile: string | undefined;
@@ -101,9 +174,8 @@ export async function createReportBundle(options: ReportBundleOptions): Promise<
 		files.push("config.json");
 	}
 
-	// Recent logs (last 1000 lines)
-	const logPath = getLogPath();
-	const logs = await readLastLines(logPath, 1000);
+	// Recent logs (last 1000 lines, across both log directories)
+	const logs = await readTodayLogText(1000);
 	if (logs) {
 		data["logs.txt"] = logs;
 		files.push("logs.txt");
@@ -228,31 +300,50 @@ async function addSubagentSessions(
 
 /** Get recent log entries for display (tail-limited to avoid OOM on large files). */
 export async function getLogText(): Promise<string> {
-	return readLastLines(getLogPath(), MAX_LOG_LINES);
+	return readTodayLogText(MAX_LOG_LINES);
 }
 
 const LOG_FILE_PATTERN = new RegExp(`^${APP_NAME}\\.(\\d{4}-\\d{2}-\\d{2})\\.log$`);
 
+/**
+ * Today's log file: the one this process is writing when it exists, else the
+ * canonical one. Both spellings share a basename, so the "is this today's file"
+ * filter below is unaffected by which is chosen.
+ */
+async function resolveTodayLogPath(): Promise<string> {
+	const effective = getEffectiveLogPath();
+	if (await Bun.file(effective).exists()) return effective;
+	const canonical = attemptPath(getLogPath);
+	if (canonical !== undefined && (await Bun.file(canonical).exists())) return canonical;
+	return effective;
+}
+
 export async function createDebugLogSource(): Promise<DebugLogSource> {
-	const logsDir = getLogsDir();
-	const todayPath = getLogPath();
+	const todayPath = await resolveTodayLogPath();
 	const todayName = path.basename(todayPath);
-	let olderFiles: string[] = [];
-	try {
-		const entries = await fs.readdir(logsDir, { withFileTypes: true });
-		const datedFiles = entries
-			.filter(entry => entry.isFile())
-			.map(entry => {
-				const match = LOG_FILE_PATTERN.exec(entry.name);
-				return match ? { name: entry.name, date: match[1] } : undefined;
-			})
-			.filter((entry): entry is { name: string; date: string } => entry !== undefined)
-			.filter(entry => entry.name !== todayName)
-			.sort((a, b) => b.date.localeCompare(a.date));
-		olderFiles = datedFiles.map(entry => entry.name);
-	} catch {
-		olderFiles = [];
+	// Absolute paths, not bare names: entries can come from either log directory
+	// (see {@link logSearchDirs}), so the name alone no longer locates the file.
+	const olderFiles: string[] = [];
+	const dated: { path: string; date: string }[] = [];
+	const seen = new Set<string>();
+	for (const dir of logSearchDirs()) {
+		// A missing directory contributes nothing; the other one may still exist.
+		const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+		for (const entry of entries) {
+			if (!entry.isFile()) continue;
+			const match = LOG_FILE_PATTERN.exec(entry.name);
+			if (!match || entry.name === todayName) continue;
+			const filePath = path.join(dir, entry.name);
+			if (seen.has(filePath)) continue;
+			seen.add(filePath);
+			dated.push({ path: filePath, date: match[1]! });
+		}
 	}
+	// Newest first. `sort` is stable, so same-date files keep the directory order
+	// above (effective before canonical) and the single-directory case is ordered
+	// exactly as it was before the second directory was added.
+	dated.sort((a, b) => b.date.localeCompare(a.date));
+	olderFiles.push(...dated.map(entry => entry.path));
 
 	let cursor = 0;
 
@@ -270,8 +361,7 @@ export async function createDebugLogSource(): Promise<DebugLogSource> {
 		const slice = olderFiles.slice(cursor, cursor + count);
 		cursor += slice.length;
 		const chunks: string[] = [];
-		for (const filename of slice.reverse()) {
-			const filePath = path.join(logsDir, filename);
+		for (const filePath of slice.reverse()) {
 			try {
 				const content = await readLastLines(filePath, MAX_LOG_LINES);
 				if (content.length > 0) {

package/src/gjc-runtime/managed-owner-admission.ts

@@ -128,8 +128,15 @@ function safeChildToken(value: string): boolean {
 	}
 }
 
-async function readExactJsons(root: string, files: readonly string[]): Promise<unknown[] | null> {
-	if (process.platform !== "linux") return null;
+/**
+ * The exact reader needs the Linux-only recovery-fs authority, so an unavailable
+ * read has two very different causes. A blocked operator cannot act on either
+ * unless the outcome says which one it was, so the unavailable arm names it.
+ */
+type ExactJsonRead = { values: unknown[] } | { reader: "unsupported_platform" | "read_failed" };
+
+async function readExactJsons(root: string, files: readonly string[]): Promise<ExactJsonRead> {
+	if (process.platform !== "linux") return { reader: "unsupported_platform" };
 	try {
 		const { openRecoveryFsRoot } = require("@gajae-code/natives") as Pick<
 			typeof import("@gajae-code/natives"),
@@ -140,17 +147,37 @@ async function readExactJsons(root: string, files: readonly string[]): Promise<u
 			const values: unknown[] = [];
 			for (const file of files) {
 				const result = authority.read(file, 64 * 1024);
-				if (!result.ok || !result.data) return null;
+				if (!result.ok || !result.data) return { reader: "read_failed" };
 				const content = Buffer.from(result.data).toString("utf8");
-				if (!content.endsWith("\n") || content.indexOf("\n") !== content.length - 1) return null;
+				if (!content.endsWith("\n") || content.indexOf("\n") !== content.length - 1)
+					return { reader: "read_failed" };
 				values.push(JSON.parse(content));
 			}
-			return values;
+			return { values };
 		} finally {
 			authority.close();
 		}
 	} catch {
-		return null;
+		return { reader: "read_failed" };
+	}
+}
+
+function exactJsonValues(read: ExactJsonRead): unknown[] {
+	return "values" in read ? read.values : [];
+}
+
+function exactReaderDetails(read: ExactJsonRead): Record<string, unknown> {
+	return "values" in read ? {} : { platform: process.platform, evidence_reader: read.reader };
+}
+
+function readerExplanation(details: Record<string, unknown>): string {
+	switch (details.evidence_reader) {
+		case "unsupported_platform":
+			return ` (platform ${process.platform}: exact binding reader unsupported)`;
+		case "read_failed":
+			return ` (platform ${process.platform}: exact binding evidence unreadable)`;
+		default:
+			return "";
 	}
 }
 
@@ -187,6 +214,22 @@ async function durableHandoff(
 	}
 }
 
+/**
+ * Fails closed and says so. The durable handoff is the record of authority, but
+ * nothing reads it during an incident, so the same reason also goes to stderr:
+ * otherwise a blocked child exits 75 having printed nothing at all.
+ */
+async function blockAdmission(
+	owner: { root: string; generation: string; sessionId: string },
+	reason: string,
+	details: Record<string, unknown> = {},
+): Promise<{ kind: "blocked" }> {
+	await durableHandoff(owner.root, owner.generation, owner.sessionId, reason, details);
+	process.stderr.write(`child admission blocked: ${reason}${readerExplanation(details)}\n`);
+	process.exitCode = 75;
+	return { kind: "blocked" };
+}
+
 /**
  * This is the pre-CLI barrier. A replacement is identified only by the exact
  * predecessor token supplied by its launch binding; directory enumeration is
@@ -198,12 +241,9 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 	const childToken = process.env[MANAGED_OWNER_CHILD_TOKEN_ENV]?.trim();
 	const predecessorToken = process.env[MANAGED_OWNER_PREDECESSOR_TOKEN_ENV]?.trim();
 	if (childToken && !predecessorToken) {
-		if (!safeChildToken(childToken)) {
-			await durableHandoff(owner.root, owner.generation, owner.sessionId, "exact_child_binding_unavailable");
-			process.exitCode = 75;
-			return { kind: "blocked" };
-		}
-		const [binding] = (await readExactJsons(owner.root, [`child-${childToken}.binding.json`])) ?? [];
+		if (!safeChildToken(childToken)) return blockAdmission(owner, "exact_child_binding_unavailable");
+		const read = await readExactJsons(owner.root, [`child-${childToken}.binding.json`]);
+		const [binding] = exactJsonValues(read);
 		if (
 			isBinding(binding, {
 				generation: owner.generation,
@@ -214,33 +254,20 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 			})
 		)
 			return { kind: "supervised" };
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "exact_child_binding_unavailable");
-		process.exitCode = 75;
-		return { kind: "blocked" };
+		return blockAdmission(owner, "exact_child_binding_unavailable", exactReaderDetails(read));
 	}
 	const predecessorGeneration = process.env[MANAGED_OWNER_PREDECESSOR_GENERATION_ENV]?.trim();
 	const predecessorRunId = process.env[MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV]?.trim();
 	const predecessorIncarnation = process.env[MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV]?.trim();
-	if (!predecessorGeneration || !predecessorRunId || !predecessorIncarnation) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "replacement_predecessor_identity_missing");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
-	if (!predecessorToken) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "replacement_predecessor_binding_missing");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
-	if (!safeChildToken(predecessorToken)) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "replacement_predecessor_binding_untrusted");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
-	const [binding, receipt] =
-		(await readExactJsons(owner.root, [
-			`child-${predecessorToken}.binding.json`,
-			`sigabrt-${predecessorToken}.receipt.json`,
-		])) ?? [];
+	if (!predecessorGeneration || !predecessorRunId || !predecessorIncarnation)
+		return blockAdmission(owner, "replacement_predecessor_identity_missing");
+	if (!predecessorToken) return blockAdmission(owner, "replacement_predecessor_binding_missing");
+	if (!safeChildToken(predecessorToken)) return blockAdmission(owner, "replacement_predecessor_binding_untrusted");
+	const read = await readExactJsons(owner.root, [
+		`child-${predecessorToken}.binding.json`,
+		`sigabrt-${predecessorToken}.receipt.json`,
+	]);
+	const [binding, receipt] = exactJsonValues(read);
 	if (
 		!isBinding(binding, {
 			generation: predecessorGeneration,
@@ -249,16 +276,10 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 			incarnation: predecessorIncarnation,
 			token: predecessorToken,
 		})
-	) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "replacement_predecessor_binding_untrusted");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
-	if (!isReceipt(receipt, binding)) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "exact_sigabrt_receipt_untrusted");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
+	)
+		return blockAdmission(owner, "replacement_predecessor_binding_untrusted", exactReaderDetails(read));
+	if (!isReceipt(receipt, binding))
+		return blockAdmission(owner, "exact_sigabrt_receipt_untrusted", exactReaderDetails(read));
 	const admission = {
 		session_id: owner.sessionId,
 		endpoint_incarnation: predecessorIncarnation,
@@ -287,11 +308,7 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 		},
 		decision,
 	});
-	if (decision.disposition !== "resume") {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, decision.reason);
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
+	if (decision.disposition !== "resume") return blockAdmission(owner, decision.reason);
 	return { kind: "recovery", context: { root: owner.root, binding, receipt, admission, decision } };
 }