@harness-mix/cli 0.1.3

package/src/main/native/rs/crates/shim/src/job.rs

@@ -0,0 +1,83 @@
+//! Windows Job Object helper: put this process (and every descendant it later
+//! spawns) into a job carrying JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, so the whole
+//! process tree dies with the shim no matter how the shim itself exits.
+//!
+//! Zero external crates on purpose: raw kernel32 FFI only, mirroring the
+//! hand-written COM declarations in the appx crate.
+#![cfg(windows)]
+
+use std::ffi::c_void;
+
+type Handle = *mut c_void;
+type Bool = i32;
+
+const JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE: u32 = 0x0000_2000;
+const JOB_OBJECT_EXTENDED_LIMIT_INFORMATION_CLASS: i32 = 9;
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+struct IoCounters {
+    read_operation_count: u64,
+    write_operation_count: u64,
+    other_operation_count: u64,
+    read_transfer_count: u64,
+    write_transfer_count: u64,
+    other_transfer_count: u64,
+}
+
+#[repr(C)]
+struct JobObjectBasicLimitInformation {
+    per_process_user_time_limit: i64,
+    per_job_user_time_limit: i64,
+    limit_flags: u32,
+    minimum_working_set_size: usize,
+    maximum_working_set_size: usize,
+    active_process_limit: u32,
+    affinity: usize,
+    priority_class: u32,
+    scheduling_class: u32,
+}
+
+#[repr(C)]
+struct JobObjectExtendedLimitInformation {
+    basic_limit_information: JobObjectBasicLimitInformation,
+    io_info: IoCounters,
+    process_memory_limit: usize,
+    job_memory_limit: usize,
+    peak_process_memory_used: usize,
+    peak_job_memory_used: usize,
+}
+
+#[link(name = "kernel32")]
+extern "system" {
+    fn CreateJobObjectW(attributes: *mut c_void, name: *const u16) -> Handle;
+    fn SetInformationJobObject(job: Handle, info_class: i32, info: *mut c_void, length: u32) -> Bool;
+    fn AssignProcessToJobObject(job: Handle, process: Handle) -> Bool;
+    fn GetCurrentProcess() -> Handle;
+    fn GetLastError() -> u32;
+}
+
+/// Puts the current process into a fresh kill-on-close job. `Ok(())` means the
+/// OS will now terminate every descendant of this process when it dies, for any
+/// reason, including force-kill. Failure is advisory: callers keep running.
+pub fn assign_kill_on_close() -> Result<(), String> {
+    unsafe {
+        let job = CreateJobObjectW(std::ptr::null_mut(), std::ptr::null());
+        if job.is_null() {
+            return Err(format!("CreateJobObject failed ({})", GetLastError()));
+        }
+        let mut info: JobObjectExtendedLimitInformation = std::mem::zeroed();
+        info.basic_limit_information.limit_flags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+        let sized = std::mem::size_of::<JobObjectExtendedLimitInformation>() as u32;
+        if SetInformationJobObject(job, JOB_OBJECT_EXTENDED_LIMIT_INFORMATION_CLASS, &mut info as *mut _ as *mut c_void, sized) == 0 {
+            return Err(format!("SetInformationJobObject failed ({})", GetLastError()));
+        }
+        if AssignProcessToJobObject(job, GetCurrentProcess()) == 0 {
+            return Err(format!("AssignProcessToJobObject failed ({})", GetLastError()));
+        }
+        // The handle is intentionally leaked: the job must live exactly as long
+        // as this process. The OS closes the handle on exit, which is what
+        // triggers the kill of every remaining member.
+        Ok(())
+    }
+}

package/src/main/native/rs/crates/shim/src/main.rs

@@ -0,0 +1,257 @@
+// Harness Mix executable bridge, built from this source by build-native.cjs.
+// Rust port of the original shim.cs: identical routing and stdio contract.
+//
+// - `... app-server ...`  -> node scripts/native-host.cjs (Harness Mix kernel)
+// - anything else         -> stock codex.exe passthrough
+use std::env;
+use std::fs;
+use std::io::{self, Write};
+#[cfg(not(unix))]
+use std::io::Read;
+use std::path::Path;
+use std::process::{Command, Stdio};
+#[cfg(not(unix))]
+use std::sync::{Arc, Mutex};
+#[cfg(not(unix))]
+use std::thread;
+
+mod job;
+
+#[cfg(windows)]
+use std::os::windows::process::CommandExt;
+
+#[cfg(windows)]
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+
+fn read_trimmed(path: &Path) -> io::Result<String> {
+    Ok(fs::read_to_string(path)?.trim().to_string())
+}
+
+fn json_escape(value: &str) -> String {
+    let mut out = String::with_capacity(value.len());
+    for c in value.chars() {
+        match c {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            c if (c as u32) < 0x20 => out.push_str(&format!("\\u{:04x}", c as u32)),
+            c => out.push(c),
+        }
+    }
+    out
+}
+
+// Invocation journal next to the exe: one JSON line on spawn, one on exit.
+// The desktop spawns this shim for every CLI call, so this is the ground
+// truth for which invocation fails and with what stderr.
+fn log_line(exe_dir: &Path, line: &str) {
+    let Ok(mut file) = fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(exe_dir.join("shim-invocations.log"))
+    else {
+        return;
+    };
+    let ts = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_millis())
+        .unwrap_or(0);
+    let _ = writeln!(file, "{{\"ts\":{ts},{line}}}");
+}
+
+fn log_spawn(exe_dir: &Path, mode: &str, args: &[String]) {
+    let args = args
+        .iter()
+        .map(|a| format!("\"{}\"", json_escape(a)))
+        .collect::<Vec<_>>()
+        .join(",");
+    log_line(
+        exe_dir,
+        &format!(
+            "\"pid\":{},\"mode\":\"{}\",\"args\":[{}]",
+            std::process::id(),
+            mode,
+            args
+        ),
+    );
+}
+
+#[cfg(not(unix))]
+fn log_exit(exe_dir: &Path, code: i32, stderr_tail: &[u8]) {
+    let tail = json_escape(&String::from_utf8_lossy(stderr_tail));
+    log_line(
+        exe_dir,
+        &format!(
+            "\"pid\":{},\"exit\":{},\"stderr_tail\":\"{}\"",
+            std::process::id(),
+            code,
+            tail
+        ),
+    );
+}
+
+// Keep the invocation journal bounded: one live file plus two rotations.
+const LOG_MAX_BYTES: u64 = 5 * 1024 * 1024;
+
+fn rotate_log(dir: &Path) {
+    let base = dir.join("shim-invocations.log");
+    let Ok(metadata) = fs::metadata(&base) else { return };
+    if metadata.len() < LOG_MAX_BYTES { return; }
+    let _ = fs::remove_file(dir.join("shim-invocations.log.2"));
+    let _ = fs::rename(dir.join("shim-invocations.log.1"), dir.join("shim-invocations.log.2"));
+    let _ = fs::rename(&base, dir.join("shim-invocations.log.1"));
+}
+
+fn setting(env_name: &str, file: &Path) -> io::Result<String> {
+    match env::var(env_name) {
+        Ok(value) if !value.is_empty() => Ok(value),
+        _ => read_trimmed(file),
+    }
+}
+
+#[cfg(not(unix))]
+fn pump<R: Read + Send + 'static, W: Write + Send + 'static>(
+    mut source: R,
+    mut destination: W,
+) -> thread::JoinHandle<()> {
+    thread::spawn(move || {
+        let _ = io::copy(&mut source, &mut destination);
+        let _ = destination.flush();
+    })
+}
+
+fn run() -> io::Result<i32> {
+    let exe = env::current_exe()?;
+    let exe_dir = exe
+        .parent()
+        .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "Shim has no base directory"))?;
+    // Path.GetFullPath equivalent: normalize without resolving symlinks or adding \\?\.
+    let root = std::path::absolute(exe_dir.join("../.."))?;
+    let args: Vec<String> = env::args().skip(1).collect();
+    let server = args.iter().any(|arg| arg == "app-server");
+
+    rotate_log(exe_dir);
+    // Kill-on-close job: the node host, every harness CLI it spawns and any
+    // shell children all die with this shim, including on force-kill.
+    #[cfg(windows)]
+    if let Err(error) = job::assign_kill_on_close() {
+        eprintln!("Harness Mix Shim: process supervision unavailable: {error}");
+    }
+
+    let build_dir = root.join("output").join("native-build");
+    let stock = setting(
+        "CODEXHOST_STOCK_CODEX_PATH",
+        &build_dir.join("stock-path.txt"),
+    )?;
+    let node = setting("HARNESS_MIX_NODE_PATH", &build_dir.join("node-path.txt"))?;
+    log_spawn(exe_dir, if server { "server" } else { "passthrough" }, &args);
+
+    let mut command = if server {
+        // Tests point this at a fixture host; production uses the in-repo entry.
+        let host_script = env::var("HARNESS_MIX_HOST_SCRIPT")
+            .ok()
+            .filter(|value| !value.trim().is_empty())
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(|| root.join("scripts").join("native-host.cjs"));
+        let mut command = Command::new(&node);
+        command.arg("--max-old-space-size=8192");
+        command.arg(host_script);
+        command
+    } else {
+        Command::new(&stock)
+    };
+    command
+        .args(&args)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .env_remove("CODEX_CLI_PATH")
+        .env("CODEXHOST_STOCK_CODEX_PATH", &stock);
+    #[cfg(windows)]
+    command.creation_flags(CREATE_NO_WINDOW);
+
+    // Unix exec keeps the Desktop-owned PID and stdio: signals and EOF reach
+    // the native host directly, without an extra unsupervised pump process.
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::CommandExt;
+        command.stdin(Stdio::inherit()).stdout(Stdio::inherit()).stderr(Stdio::inherit());
+        return Err(command.exec());
+    }
+
+    #[cfg(not(unix))]
+    supervise(command, exe_dir)
+}
+
+#[cfg(not(unix))]
+fn supervise(mut command: Command, exe_dir: &Path) -> io::Result<i32> {
+    let mut child = command.spawn()?;
+    let child_stdin = child
+        .stdin
+        .take()
+        .ok_or_else(|| io::Error::new(io::ErrorKind::BrokenPipe, "child stdin unavailable"))?;
+    let child_stdout = child
+        .stdout
+        .take()
+        .ok_or_else(|| io::Error::new(io::ErrorKind::BrokenPipe, "child stdout unavailable"))?;
+    let child_stderr = child
+        .stderr
+        .take()
+        .ok_or_else(|| io::Error::new(io::ErrorKind::BrokenPipe, "child stderr unavailable"))?;
+
+    // Stdin EOF must close the child's stdin, mirroring the C# pump's finally.
+    let input = thread::spawn(move || {
+        let stdin = io::stdin();
+        let mut locked = stdin.lock();
+        let mut writer = child_stdin;
+        let _ = io::copy(&mut locked, &mut writer);
+        let _ = writer.flush();
+        drop(writer);
+    });
+    let output = pump(child_stdout, io::stdout());
+    // Tee stderr: forward live and keep the tail for the invocation journal.
+    let tail = Arc::new(Mutex::new(Vec::<u8>::new()));
+    let tail_writer = Arc::clone(&tail);
+    let error = thread::spawn(move || {
+        let mut reader = child_stderr;
+        let mut stderr = io::stderr();
+        let mut buffer = [0u8; 4096];
+        loop {
+            match reader.read(&mut buffer) {
+                Ok(0) | Err(_) => break,
+                Ok(count) => {
+                    let chunk = &buffer[..count];
+                    let _ = stderr.write_all(chunk);
+                    let _ = stderr.flush();
+                    if let Ok(mut tail) = tail_writer.lock() {
+                        tail.extend_from_slice(chunk);
+                        if tail.len() > 4096 {
+                            let excess = tail.len() - 4096;
+                            tail.drain(..excess);
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    let status = child.wait()?;
+    let _ = output.join();
+    let _ = error.join();
+    let code = status.code().unwrap_or(1);
+    let tail = tail.lock().map(|t| t.clone()).unwrap_or_default();
+    log_exit(&exe_dir, code, &tail);
+    drop(input); // stdin may outlive the child; do not block exit on it.
+    Ok(code)
+}
+
+fn main() {
+    match run() {
+        Ok(code) => std::process::exit(code),
+        Err(error) => {
+            eprintln!("Harness Mix Shim: {error}");
+            std::process::exit(1);
+        }
+    }
+}

package/src/main/native/secure-store.js

@@ -0,0 +1,59 @@
+// Platform secret store backed by harness-mix-secret.exe (DPAPI, current user).
+// No plaintext fallback by design: when the helper is missing, callers get an
+// actionable error instead of a silent downgrade.
+const { execFile } = require('node:child_process');
+const { nativePaths } = require('./config');
+
+class SecureStoreUnavailableError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'SecureStoreUnavailableError';
+  }
+}
+
+function helperPath() {
+  if (process.platform !== 'win32') throw new SecureStoreUnavailableError('Harness Mix secret storage is unavailable on this platform; credentials remain managed by each native harness. No plaintext fallback is used.');
+  return process.env.HARNESS_MIX_SECRET_EXE || nativePaths().secret;
+}
+
+function run(args, input) {
+  return new Promise((resolve, reject) => {
+    const child = execFile(helperPath(), args, { windowsHide: true, encoding: 'buffer', maxBuffer: 8 * 1024 * 1024 }, (error, stdout, stderr) => {
+      if (error && error.code === 'ENOENT') {
+        reject(new SecureStoreUnavailableError('缺少 harness-mix-secret.exe：请运行 npm run build:native'));
+        return;
+      }
+      if (error && error.code === 2) {
+        resolve({ missing: true, stdout: Buffer.from(stdout || ''), stderr: String(stderr || '') });
+        return;
+      }
+      if (error) {
+        reject(new Error(`secret store: ${String(stderr || error.message).trim()}`));
+        return;
+      }
+      resolve({ missing: false, stdout: Buffer.from(stdout || '') });
+    });
+    if (input !== undefined && child.stdin) child.stdin.end(Buffer.from(input));
+  });
+}
+
+async function setSecret(name, value) {
+  await run(['set', name], value);
+}
+
+async function getSecret(name) {
+  const result = await run(['get', name]);
+  return result.missing ? null : result.stdout;
+}
+
+async function deleteSecret(name) {
+  const result = await run(['delete', name]);
+  return !result.missing;
+}
+
+async function listSecrets() {
+  const result = await run(['list']);
+  return result.stdout.toString('utf8').split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+}
+
+module.exports = { setSecret, getSecret, deleteSecret, listSecrets, SecureStoreUnavailableError };

package/src/main/native/thread-list.js

@@ -0,0 +1,38 @@
+// Match Desktop queries before merging local threads into an official page.
+function includesThread(thread, query = {}, threads = []) {
+  if (thread.ephemeral || Boolean(thread.archived) !== Boolean(query.archived)) return false;
+  // 父子归属查询（协作子任务/子代理列表）：按 parentThreadId 链匹配
+  if (query.parentThreadId != null) return thread.parentThreadId === query.parentThreadId;
+  if (query.ancestorThreadId != null) {
+    const byId = new Map(threads.map(entry => [entry.id, entry]));
+    for (let current = thread; current?.parentThreadId; current = byId.get(current.parentThreadId)) {
+      if (current.parentThreadId === query.ancestorThreadId) return true;
+    }
+    return false;
+  }
+  if (Object.hasOwn(query, 'sectionId') && (thread.section?.id ?? null) !== query.sectionId) return false;
+  if (Object.hasOwn(query, 'projectId') && (thread.projectId ?? null) !== query.projectId) return false;
+  if (query.isPinned === true && !thread.isPinned) return false;
+  if (query.isPinned === false && thread.isPinned) return false;
+  if (query.cwd != null && !(Array.isArray(query.cwd) ? query.cwd : [query.cwd]).includes(thread.cwd)) return false;
+  if (query.modelProviders?.length && !query.modelProviders.includes('codexhost')) return false;
+  if (query.sourceKinds?.length && !query.sourceKinds.includes('vscode')) return false;
+  if (query.searchTerm && !(thread.title || '').toLowerCase().includes(query.searchTerm.toLowerCase())) return false;
+  return true;
+}
+
+function mergeThreadPage(page, threads, query, project) {
+  if (query.cursor) return page;
+  const local = threads.filter(thread => includesThread(thread, query, threads));
+  if (query.sortKey === 'section_position') local.sort((a, b) => (a.sectionPosition || 0) - (b.sectionPosition || 0));
+  const byId = new Map(page.data.map(thread => [thread.id, thread]));
+  for (const thread of local) byId.set(thread.id, project(thread));
+  const data = [...byId.values()];
+  if (query.sortKey !== 'section_position') {
+    const key = { updated_at: 'updatedAt', recency_at: 'recencyAt' }[query.sortKey] || 'createdAt';
+    data.sort((a, b) => (query.sortDirection === 'asc' ? 1 : -1) * ((a[key] || 0) - (b[key] || 0)));
+  }
+  return { ...page, data };
+}
+
+module.exports = { includesThread, mergeThreadPage };

package/src/main/native/update-state.js

@@ -0,0 +1,110 @@
+// Update bookkeeping for updater.js: channel detection, version compare,
+// the update state file and its lock. Pure Node built-ins; `dataDir` is
+// injected so tests can use temp directories.
+const fs = require('node:fs');
+const path = require('node:path');
+
+const STATE_FILE = 'update-state.json';
+const LOCK_FILE = 'update.lock';
+const LOCK_STALE_MS = 30 * 60 * 1000;
+
+function defaultState() {
+  return {
+    schema: 1,
+    channel: null,
+    phase: 'idle',
+    appliedVersion: null,
+    prevVersion: null,
+    appliedAt: 0,
+    attempts: 0,
+    lastBootOkAt: 0,
+    pendingVersion: null,
+    lastCheckAt: 0,
+    preUpdateHead: null,
+    rolledBackAt: 0,
+  };
+}
+
+function readState(dataDir) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(path.join(dataDir, STATE_FILE), 'utf8'));
+    return { ...defaultState(), ...(parsed && typeof parsed === 'object' ? parsed : {}) };
+  } catch {
+    return defaultState(); // missing or corrupt: rebuild, never block launch
+  }
+}
+
+function writeState(dataDir, state) {
+  fs.mkdirSync(dataDir, { recursive: true });
+  const file = path.join(dataDir, STATE_FILE);
+  fs.writeFileSync(`${file}.tmp`, JSON.stringify(state, null, 2));
+  fs.renameSync(`${file}.tmp`, file);
+  return state;
+}
+
+function updateState(dataDir, patch) {
+  return writeState(dataDir, { ...readState(dataDir), ...patch });
+}
+
+// Called by the launcher once the desktop is up and the controller survived long
+// enough to count as a healthy boot of the freshly applied version.
+function markBootOk(dataDir) {
+  const state = readState(dataDir);
+  return writeState(dataDir, { ...state, lastBootOkAt: Date.now(), attempts: 0 });
+}
+
+function pidAlive(pid) {
+  if (!pid || typeof pid !== 'number') return false;
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error.code === 'EPERM'; }
+}
+
+// Mutating update operations (apply / rollback / repair) take this lock so two
+// launchers cannot fight over the same install. Stale locks are reaped.
+function acquireLock(dataDir, op) {
+  fs.mkdirSync(dataDir, { recursive: true });
+  const file = path.join(dataDir, LOCK_FILE);
+  let existing = null;
+  try { existing = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { /* no lock yet */ }
+  if (existing && pidAlive(existing.pid) && Date.now() - Number(existing.ts || 0) < LOCK_STALE_MS) {
+    throw new Error(`更新锁被进程 ${existing.pid} 持有（${existing.op || 'update'}）`);
+  }
+  fs.writeFileSync(file, JSON.stringify({ pid: process.pid, ts: Date.now(), op }));
+  let released = false;
+  return function release() {
+    if (released) return;
+    released = true;
+    try {
+      const current = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (current.pid === process.pid) fs.unlinkSync(file);
+    } catch { /* already gone */ }
+  };
+}
+
+function compareVersions(a, b) {
+  const parse = value => String(value || '0').split('-')[0].split('.').map(part => parseInt(part, 10) || 0);
+  const left = parse(a);
+  const right = parse(b);
+  for (let i = 0; i < 3; i += 1) {
+    const x = left[i] || 0;
+    const y = right[i] || 0;
+    if (x !== y) return x > y ? 1 : -1;
+  }
+  const preA = String(a || '').includes('-');
+  const preB = String(b || '').includes('-');
+  if (preA !== preB) return preA ? -1 : 1; // release beats prerelease
+  if (String(a) === String(b)) return 0;
+  return String(a) > String(b) ? 1 : -1; // prerelease ordering is lexical (good enough)
+}
+
+function detectChannel(root) {
+  if (fs.existsSync(path.join(root, '.git'))) return 'git';
+  if (path.basename(path.dirname(path.resolve(root))) === 'node_modules') return 'npm';
+  return 'portable';
+}
+
+module.exports = {
+  STATE_FILE, LOCK_FILE, LOCK_STALE_MS,
+  defaultState, readState, writeState, updateState, markBootOk,
+  acquireLock, pidAlive, compareVersions, detectChannel,
+};