@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/task/role-body.ts

@@ -0,0 +1,84 @@
+/**
+ * Keep a subagent role body inside the host [ROLE] block.
+ *
+ * The body is the agent instruction. It is inserted between host [ROLE] and
+ * [/ROLE]. A literal framing tag would end that block early. Only the four
+ * host framing names are rewritten; other brackets stay literal.
+ *
+ * One left-to-right scan: a gap run, a slash only when it is present, then
+ * one more gap run, then the word. A non-matching "[" does not hide a later tag.
+ */
+
+const WORDS = ["completion", "context", "role", "coop"] as const;
+
+function isGap(code: number): boolean {
+	return (
+		code === 0x09 ||
+		code === 0x0a ||
+		code === 0x0b ||
+		code === 0x0c ||
+		code === 0x0d ||
+		code === 0x20 ||
+		code === 0xa0 ||
+		code === 0x200b ||
+		code === 0x200c ||
+		code === 0x200d ||
+		code === 0x1680 ||
+		(code >= 0x2000 && code <= 0x200a) ||
+		code === 0x2028 ||
+		code === 0x2029 ||
+		code === 0x202f ||
+		code === 0x205f ||
+		code === 0x3000 ||
+		code === 0xfeff
+	);
+}
+
+function wordLengthAt(body: string, index: number): number {
+	const slice = body.slice(index, index + 10).toLowerCase();
+	for (const word of WORDS) {
+		if (!slice.startsWith(word)) continue;
+		const after = body.charCodeAt(index + word.length);
+		if (Number.isNaN(after) || isGap(after) || after === 0x5d) return word.length;
+	}
+	return 0;
+}
+
+/** End index of a framing tag starting at "[", or -1. */
+function framingTagEnd(body: string, start: number): number {
+	let index = start + 1;
+	while (index < body.length && isGap(body.charCodeAt(index))) index++;
+	if (body.charCodeAt(index) === 0x2f) {
+		index++;
+		while (index < body.length && isGap(body.charCodeAt(index))) index++;
+	}
+	const wordLength = wordLengthAt(body, index);
+	if (wordLength === 0) return -1;
+	index += wordLength;
+	while (index < body.length && isGap(body.charCodeAt(index))) index++;
+	return body.charCodeAt(index) === 0x5d ? index + 1 : -1;
+}
+
+export function containSubagentRoleBody(body: string): string {
+	const parts: string[] = [];
+	let plainStart = 0;
+	let index = 0;
+	while (index < body.length) {
+		if (body.charCodeAt(index) !== 0x5b) {
+			index++;
+			continue;
+		}
+		const end = framingTagEnd(body, index);
+		if (end < 0) {
+			index++;
+			continue;
+		}
+		if (plainStart < index) parts.push(body.slice(plainStart, index));
+		parts.push(body.slice(index, end).replaceAll("[", "［").replaceAll("]", "］"));
+		index = end;
+		plainStart = index;
+	}
+	if (plainStart === 0) return body;
+	if (plainStart < body.length) parts.push(body.slice(plainStart));
+	return parts.join("");
+}

package/src/task/token-log-mode.test.ts

@@ -0,0 +1,162 @@
+import { afterAll, describe, expect, it } from "bun:test";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { persistTaskTokenLog, taskTokenLogFromChat } from "./token-log";
+
+// Mode bits and final-component symlinks are POSIX. Windows ACLs are out of scope.
+const skipPosix = process.platform === "win32";
+const skipOwnerReadOnly = skipPosix || process.getuid?.() === 0;
+const tempRoots: string[] = [];
+
+async function tempDir(): Promise<string> {
+	const dir = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-token-log-mode-"));
+	tempRoots.push(dir);
+	return dir;
+}
+
+afterAll(async () => {
+	await Promise.all(tempRoots.splice(0).map(dir => fs.rm(dir, { recursive: true, force: true })));
+});
+
+function entry(id: string) {
+	return taskTokenLogFromChat(
+		{ inputTokens: 1, outputTokens: 2, cachedInputTokens: 0, cacheWriteTokens: 0 },
+		{ subagentId: id, turn: 1, at: "2026-01-01T00:00:00.000Z" },
+	);
+}
+
+async function modeOf(filePath: string): Promise<number> {
+	return (await fs.lstat(filePath)).mode & 0o777;
+}
+
+describe("task token log mode", () => {
+	it.skipIf(skipPosix)("refuses a symlink token-log.jsonl", async () => {
+		const root = await tempDir();
+		const outside = path.join(root, "outside.jsonl");
+		await fs.writeFile(outside, "kept");
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir);
+		const link = path.join(dir, "token-log.jsonl");
+		await fs.symlink(outside, link);
+
+		await expect(persistTaskTokenLog(entry("root"), { dir })).rejects.toThrow(/not a regular file/);
+		expect(await fs.readFile(outside, "utf8")).toBe("kept");
+		expect((await fs.lstat(link)).isSymbolicLink()).toBe(true);
+	});
+
+	it.skipIf(skipPosix)("refuses a symlink token-log directory", async () => {
+		const root = await tempDir();
+		const outside = path.join(root, "outside");
+		await fs.mkdir(outside);
+		const dir = path.join(root, "token-logs");
+		await fs.symlink(outside, dir);
+
+		await expect(persistTaskTokenLog(entry("root"), { dir })).rejects.toThrow(/not a directory/);
+		expect(await fs.readdir(outside)).toEqual([]);
+		expect((await fs.lstat(dir)).isSymbolicLink()).toBe(true);
+	});
+
+	it.skipIf(skipPosix)("creates a token log as mode 0600 under a permissive umask", async () => {
+		const previous = process.umask(0);
+		try {
+			const root = await tempDir();
+			const dir = path.join(root, "logs");
+			await persistTaskTokenLog(entry("root"), { dir });
+			expect(await modeOf(dir)).toBe(0o700);
+			expect(await modeOf(path.join(dir, "token-log.jsonl"))).toBe(0o600);
+		} finally {
+			process.umask(previous);
+		}
+	});
+
+	it.skipIf(skipPosix)("tightens an existing mode 0666 token log to 0600", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o700 });
+		const file = path.join(dir, "token-log.jsonl");
+		await fs.writeFile(file, "", { mode: 0o666 });
+		await fs.chmod(file, 0o666);
+
+		await persistTaskTokenLog(entry("root"), { dir });
+
+		expect(await modeOf(file)).toBe(0o600);
+		expect(await fs.readFile(file, "utf8")).toContain('"subagentId":"root"');
+	});
+
+	it.skipIf(skipPosix)("tightens an existing mode 0777 token-log directory to 0700", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o777 });
+		await fs.chmod(dir, 0o777);
+
+		await persistTaskTokenLog(entry("root"), { dir });
+
+		expect(await modeOf(dir)).toBe(0o700);
+		expect(await modeOf(path.join(dir, "token-log.jsonl"))).toBe(0o600);
+	});
+
+	it("still allows a second append to a regular token log", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await persistTaskTokenLog(entry("one"), { dir });
+		await persistTaskTokenLog(entry("two"), { dir });
+		const text = await fs.readFile(path.join(dir, "token-log.jsonl"), "utf8");
+		expect(text).toContain('"subagentId":"one"');
+		expect(text).toContain('"subagentId":"two"');
+	});
+
+	it.skipIf(skipPosix)("still allows a token log through a symlinked parent", async () => {
+		const root = await tempDir();
+		const realParent = path.join(root, "real");
+		await fs.mkdir(realParent);
+		const via = path.join(root, "via");
+		await fs.symlink(realParent, via);
+		const dir = path.join(via, "token-logs");
+
+		await persistTaskTokenLog(entry("via"), { dir });
+
+		expect(await fs.readFile(path.join(realParent, "token-logs", "token-log.jsonl"), "utf8")).toContain(
+			'"subagentId":"via"',
+		);
+	});
+
+	it.skipIf(skipPosix)("keeps owner mode 0600 when appending a token log", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o700 });
+		const file = path.join(dir, "token-log.jsonl");
+		await fs.writeFile(file, "", { mode: 0o600 });
+
+		await persistTaskTokenLog(entry("root"), { dir });
+
+		expect(await modeOf(file)).toBe(0o600);
+		expect(await fs.readFile(file, "utf8")).toContain('"subagentId":"root"');
+	});
+
+	it.skipIf(skipOwnerReadOnly)("still allows a token log in a mode 0300 directory", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o700 });
+		await fs.chmod(dir, 0o300);
+		try {
+			await persistTaskTokenLog(entry("root"), { dir });
+			expect(await fs.readFile(path.join(dir, "token-log.jsonl"), "utf8")).toContain('"subagentId":"root"');
+		} finally {
+			await fs.chmod(dir, 0o700);
+		}
+	});
+
+	it.skipIf(skipOwnerReadOnly)("leaves a mode 0400 token log unchanged when the append cannot write", async () => {
+		const root = await tempDir();
+		const dir = path.join(root, "logs");
+		await fs.mkdir(dir, { mode: 0o700 });
+		const file = path.join(dir, "token-log.jsonl");
+		await fs.writeFile(file, "kept\n", { mode: 0o600 });
+		await fs.chmod(file, 0o400);
+
+		await expect(persistTaskTokenLog(entry("root"), { dir })).rejects.toThrow(/EACCES/);
+		expect(await fs.readFile(file, "utf8")).toBe("kept\n");
+		expect(await modeOf(file)).toBe(0o400);
+	});
+});

package/src/task/token-log.ts

@@ -1,3 +1,4 @@
+import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { ChatUsageSnapshot, CostEstimate } from "@gajae-code/agent-core";
@@ -6,6 +7,7 @@ import { resolveGjcSessionForRead, SessionResolutionError } from "../gjc-runtime
 import type { TaskTokenLog, TaskTokenMetrics } from "./types";
 
 const TOKEN_LOG_FILE = "token-log.jsonl";
+const NO_FOLLOW = process.platform === "win32" ? 0 : (fsSync.constants.O_NOFOLLOW ?? 0);
 
 export interface TaskTokenLogChatBuckets {
 	readonly inputTokens: number;
@@ -92,9 +94,96 @@ export async function resolveTaskTokenLogDir(
 		throw error;
 	}
 }
+function errnoCode(error: unknown): string | undefined {
+	return isNodeError(error) ? error.code : undefined;
+}
+
+function sameInode(left: fsSync.BigIntStats, right: fsSync.BigIntStats): boolean {
+	return left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+}
+
+/**
+ * Leaf directory mode 0700. `lstat` plus `chmod` does not need read permission, so a
+ * mode 0300 directory stays writable. A symlink leaf is refused before chmod.
+ * This does not pin the directory against a later rename in a writable parent.
+ */
+async function ensureOwnerDirectory(dir: string): Promise<void> {
+	await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+	let current: fsSync.Stats;
+	try {
+		current = await fs.lstat(dir);
+	} catch (error) {
+		const code = errnoCode(error);
+		if (code === "ELOOP" || code === "ENOTDIR") throw new Error("token log directory is not a directory");
+		throw error;
+	}
+	if (current.isSymbolicLink() || !current.isDirectory()) throw new Error("token log directory is not a directory");
+	if (process.platform === "win32" || (current.mode & 0o077) === 0) return;
+	await fs.chmod(dir, 0o700);
+	const tightened = await fs.lstat(dir);
+	if (tightened.isSymbolicLink() || !tightened.isDirectory() || (tightened.mode & 0o777) !== 0o700) {
+		throw new Error("token log directory could not be tightened to mode 0700");
+	}
+}
+
+/**
+ * Append like the workflow owner-only writer: mode 0600, `O_NOFOLLOW` when the file
+ * exists, `O_EXCL` when it does not, and chmod to 0600 when group or other bits are set.
+ */
+async function appendOwnerOnly(filePath: string, text: string): Promise<void> {
+	await ensureOwnerDirectory(path.dirname(filePath));
+	let handle: fs.FileHandle | undefined;
+	let initial: fsSync.BigIntStats | undefined;
+	for (let attempt = 0; attempt < 2; attempt++) {
+		initial = undefined;
+		try {
+			initial = await fs.lstat(filePath, { bigint: true });
+			if (initial.isSymbolicLink() || !initial.isFile()) throw new Error("token log path is not a regular file");
+		} catch (error) {
+			if (errnoCode(error) !== "ENOENT") throw error;
+		}
+		const flags = initial
+			? fsSync.constants.O_WRONLY | fsSync.constants.O_APPEND | NO_FOLLOW
+			: fsSync.constants.O_WRONLY | fsSync.constants.O_APPEND | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL;
+		try {
+			handle = await fs.open(filePath, flags, 0o600);
+			break;
+		} catch (error) {
+			const code = errnoCode(error);
+			if (code === "ELOOP") throw new Error("token log path is not a regular file");
+			if (initial === undefined && code === "EEXIST" && attempt === 0) continue;
+			throw error;
+		}
+	}
+	if (!handle) throw new Error("token log path identity changed before append");
+	try {
+		const opened = await handle.stat({ bigint: true });
+		const named = await fs.lstat(filePath, { bigint: true });
+		if (
+			opened.isSymbolicLink() ||
+			!opened.isFile() ||
+			named.isSymbolicLink() ||
+			!named.isFile() ||
+			(initial !== undefined && !sameInode(initial, opened)) ||
+			!sameInode(opened, named)
+		) {
+			throw new Error("token log path identity changed before append");
+		}
+		if (process.platform !== "win32" && (Number(opened.mode) & 0o077) !== 0) {
+			await handle.chmod(0o600);
+			const tightened = await handle.stat({ bigint: true });
+			if ((Number(tightened.mode) & 0o777) !== 0o600) {
+				throw new Error("token log path could not be tightened to mode 0600");
+			}
+		}
+		await handle.writeFile(text, "utf8");
+	} finally {
+		await handle.close();
+	}
+}
+
 export async function persistTaskTokenLog(entry: TaskTokenLog, opts: { dir: string }): Promise<void> {
-	await fs.mkdir(opts.dir, { recursive: true });
-	await fs.appendFile(path.join(opts.dir, TOKEN_LOG_FILE), `${JSON.stringify(entry)}\n`, "utf-8");
+	await appendOwnerOnly(path.join(opts.dir, TOKEN_LOG_FILE), `${JSON.stringify(entry)}\n`);
 }
 
 export async function readTaskTokenLogs(dir: string): Promise<TaskTokenLog[]> {