@hayasaka7/haya-pet 0.2.0 → 0.2.2

package/packages/cli-core/test/codex-transcript-watcher.test.mjs

@@ -0,0 +1,108 @@
+import assert from "node:assert/strict";
+import { appendFileSync, mkdirSync, mkdtempSync, utimesSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "../../../test/harness.mjs";
+import { discoverCodexTranscript, watchCodexTranscript } from "../src/codex-transcript-watcher.js";
+
+const noopTimers = { setInterval: () => ({}), clearInterval: () => {} };
+
+function toolStart(toolName = "shell_command", callId = "call_1", timestamp) {
+  return `${JSON.stringify({
+    ...(timestamp ? { timestamp } : {}),
+    type: "response_item",
+    payload: { type: "function_call", name: toolName, call_id: callId }
+  })}\n`;
+}
+
+test("discoverCodexTranscript finds the newest session jsonl under date folders", () => {
+  const root = mkdtempSync(join(tmpdir(), "codex-sessions-"));
+  const oldDir = join(root, "2026", "06", "07");
+  const newDir = join(root, "2026", "06", "08");
+  mkdirSync(oldDir, { recursive: true });
+  mkdirSync(newDir, { recursive: true });
+
+  const oldFile = join(oldDir, "rollout-old.jsonl");
+  const newFile = join(newDir, "rollout-new.jsonl");
+  writeFileSync(oldFile, "{}\n");
+  writeFileSync(newFile, "{}\n");
+  appendFileSync(newFile, "{}\n");
+
+  assert.equal(discoverCodexTranscript(root), newFile);
+});
+
+test("discoverCodexTranscript skips files older than session start", () => {
+  const root = mkdtempSync(join(tmpdir(), "codex-sessions-"));
+  const dir = join(root, "2026", "06", "08");
+  mkdirSync(dir, { recursive: true });
+
+  const oldFile = join(dir, "rollout-old.jsonl");
+  writeFileSync(oldFile, "{}\n");
+  const past = new Date(Date.now() - 3_600_000);
+  utimesSync(oldFile, past, past);
+
+  assert.equal(discoverCodexTranscript(root, Date.now() - 1000), undefined);
+});
+
+test("watchCodexTranscript reports appended tool events", () => {
+  const dir = mkdtempSync(join(tmpdir(), "codex-transcript-"));
+  const path = join(dir, "session.jsonl");
+  writeFileSync(path, "");
+
+  const events = [];
+  const watcher = watchCodexTranscript({
+    transcriptPath: path,
+    onToolEvent: (event) => events.push(event),
+    ...noopTimers
+  });
+
+  watcher._tick();
+  appendFileSync(path, toolStart("shell_command", "call_shell"));
+  watcher._tick();
+
+  assert.deepEqual(events, [
+    {
+      type: "tool_started",
+      toolCallId: "call_shell",
+      toolName: "shell_command",
+      state: "running_tool"
+    }
+  ]);
+
+  watcher.stop();
+});
+
+test("watchCodexTranscript replays current-session records when a transcript is first discovered", () => {
+  const root = mkdtempSync(join(tmpdir(), "codex-sessions-"));
+  const dir = join(root, "2026", "06", "08");
+  mkdirSync(dir, { recursive: true });
+  const path = join(dir, "rollout-new.jsonl");
+  writeFileSync(
+    path,
+    [
+      toolStart("shell_command", "call_old", "2026-06-08T10:59:59.000Z"),
+      toolStart("shell_command", "call_new", "2026-06-08T11:00:01.000Z")
+    ].join("")
+  );
+
+  const events = [];
+  const watcher = watchCodexTranscript({
+    sessionsRoot: root,
+    startedAt: Date.parse("2026-06-08T11:00:00.000Z"),
+    onToolEvent: (event) => events.push(event),
+    ...noopTimers
+  });
+
+  watcher._tick();
+
+  assert.deepEqual(events, [
+    {
+      type: "tool_started",
+      toolCallId: "call_new",
+      toolName: "shell_command",
+      state: "running_tool"
+    }
+  ]);
+
+  watcher.stop();
+});

package/packages/daemon-core/src/approval-process-watcher.js

@@ -0,0 +1,169 @@
+// Detects that the user ACCEPTED a client's permission prompt by observing the
+// client's process tree. Claude Code (and similar CLIs) emit no hook and write
+// no transcript record at the moment of a manual approval — the only real-world
+// signal is that the approved command actually starts running as a new process
+// under the client. This watcher turns that into an event.
+//
+// Safety contract (the project rule this exists to honor): a pending-approval
+// warning must NEVER be cleared by a guess or a timer. The watcher only reports
+// "approved" when a NEW descendant process appears after the prompt and is still
+// alive on the next poll. Short-lived blips (our own hook reporter, the user's
+// hooks) die between polls and are filtered out. A missed detection is always
+// safe — the pet just keeps showing "waiting" until the tool finishes.
+
+const DEFAULT_POLL_INTERVAL_MS = 1500;
+
+// Polls a full-process-table lister and fires `onApproved` ONCE when a new
+// descendant of `rootPid` persists across two consecutive snapshots.
+export function watchForApprovedProcess(options = {}) {
+  const {
+    rootPid,
+    listProcesses,
+    onApproved = () => {},
+    pollIntervalMs = DEFAULT_POLL_INTERVAL_MS,
+    immediate = true,
+    setInterval: setIntervalFn = setInterval,
+    clearInterval: clearIntervalFn = clearInterval
+  } = options;
+
+  let baseline;
+  let candidates = new Set();
+  let stopped = false;
+  let ticking = false;
+
+  const tick = async () => {
+    if (stopped || ticking) {
+      return;
+    }
+    ticking = true;
+    try {
+      const table = await listProcesses();
+      const descendants = collectDescendants(table, rootPid);
+
+      if (!baseline) {
+        // First successful snapshot: everything already running (the client
+        // itself, its shell, the hook that reported the prompt) is baseline
+        // and can never count as the approved command.
+        baseline = descendants;
+        return;
+      }
+
+      const fresh = new Set();
+      for (const pid of descendants) {
+        if (baseline.has(pid)) {
+          continue;
+        }
+        if (candidates.has(pid)) {
+          // Seen in two consecutive snapshots — a real, persistent process.
+          stop();
+          onApproved({ pid });
+          return;
+        }
+        fresh.add(pid);
+      }
+      candidates = fresh;
+    } catch {
+      // Snapshots are best-effort; a failed poll must never break the daemon.
+    } finally {
+      ticking = false;
+    }
+  };
+
+  const timer = setIntervalFn(tick, pollIntervalMs);
+  if (timer && typeof timer.unref === "function") {
+    timer.unref();
+  }
+
+  function stop() {
+    if (stopped) {
+      return;
+    }
+    stopped = true;
+    clearIntervalFn(timer);
+  }
+
+  if (immediate) {
+    // Take the baseline right away rather than a full poll interval later, so a
+    // quickly-approved command is less likely to slip into the baseline.
+    void tick();
+  }
+
+  return { stop, _tick: tick };
+}
+
+// Walks the process table for all (transitive) descendants of rootPid. The
+// client may sit behind shim layers (cmd.exe -> claude.exe -> command), so the
+// whole subtree counts, not just direct children.
+export function collectDescendants(table, rootPid) {
+  const childrenByParent = new Map();
+  for (const entry of table) {
+    if (!Number.isInteger(entry?.pid) || !Number.isInteger(entry?.ppid)) {
+      continue;
+    }
+    const siblings = childrenByParent.get(entry.ppid);
+    if (siblings) {
+      siblings.push(entry.pid);
+    } else {
+      childrenByParent.set(entry.ppid, [entry.pid]);
+    }
+  }
+
+  const descendants = new Set();
+  const queue = [rootPid];
+  while (queue.length > 0) {
+    const parent = queue.pop();
+    for (const child of childrenByParent.get(parent) ?? []) {
+      if (!descendants.has(child)) {
+        descendants.add(child);
+        queue.push(child);
+      }
+    }
+  }
+  return descendants;
+}
+
+// Bridges session state changes to per-session watchers: watch a session's
+// process tree only while it sits in waiting_approval (and has a known pid),
+// stop the moment any other state arrives (finish, denial, exit), and report
+// detections with the owning sessionId.
+export function createApprovalWatchCoordinator(options = {}) {
+  const { createWatcher, onApproved = () => {} } = options;
+  const watchers = new Map();
+
+  return {
+    onSessionChanged(session) {
+      if (!session || typeof session.sessionId !== "string") {
+        return;
+      }
+
+      const { sessionId, pid, state } = session;
+
+      if (state === "waiting_approval" && Number.isInteger(pid)) {
+        if (!watchers.has(sessionId)) {
+          const watcher = createWatcher({
+            rootPid: pid,
+            onApproved: (event) => {
+              watchers.delete(sessionId);
+              onApproved(sessionId, event);
+            }
+          });
+          watchers.set(sessionId, watcher);
+        }
+        return;
+      }
+
+      const watcher = watchers.get(sessionId);
+      if (watcher) {
+        watchers.delete(sessionId);
+        watcher.stop();
+      }
+    },
+
+    stopAll() {
+      for (const watcher of watchers.values()) {
+        watcher.stop();
+      }
+      watchers.clear();
+    }
+  };
+}

package/packages/daemon-core/test/approval-process-watcher.test.mjs

@@ -0,0 +1,295 @@
+import assert from "node:assert/strict";
+import { test } from "../../../test/harness.mjs";
+import {
+  watchForApprovedProcess,
+  createApprovalWatchCoordinator
+} from "../src/approval-process-watcher.js";
+
+// --- watchForApprovedProcess -------------------------------------------------
+// The watcher's contract is event-based, never time-based: it may only report
+// "approved" because a real NEW process appeared under the client and stayed
+// alive across two consecutive polls. A missed detection is always safe (the
+// pet just keeps showing "waiting"); a false detection would hide a pending
+// approval warning, so the persistence filter errs toward not firing.
+
+function makeWatcher(snapshots, overrides = {}) {
+  // `snapshots` is a queue of process tables the fake lister returns per call.
+  const calls = { cleared: 0 };
+  const watcher = watchForApprovedProcess({
+    rootPid: 100,
+    listProcesses: async () => {
+      if (snapshots.length === 0) {
+        throw new Error("test ran out of snapshots");
+      }
+      const next = snapshots.shift();
+      if (next instanceof Error) {
+        throw next;
+      }
+      return next;
+    },
+    immediate: false,
+    setInterval: () => ({ unref() {} }),
+    clearInterval: () => {
+      calls.cleared += 1;
+    },
+    ...overrides
+  });
+  return { watcher, calls };
+}
+
+const ROOT = { pid: 100, ppid: 1 };
+const BASE_CHILD = { pid: 110, ppid: 100 };
+
+test("approval watcher ignores descendants that existed at baseline", async () => {
+  const approved = [];
+  const { watcher } = makeWatcher(
+    [
+      [ROOT, BASE_CHILD],
+      [ROOT, BASE_CHILD],
+      [ROOT, BASE_CHILD]
+    ],
+    { onApproved: (event) => approved.push(event) }
+  );
+
+  await watcher._tick(); // baseline
+  await watcher._tick();
+  await watcher._tick();
+
+  assert.deepEqual(approved, []);
+});
+
+test("approval watcher fires once when a new descendant persists across two polls", async () => {
+  const approved = [];
+  const newChild = { pid: 200, ppid: 100 };
+  const { watcher, calls } = makeWatcher(
+    [
+      [ROOT, BASE_CHILD],
+      [ROOT, BASE_CHILD, newChild],
+      [ROOT, BASE_CHILD, newChild],
+      [ROOT, BASE_CHILD, newChild, { pid: 300, ppid: 100 }]
+    ],
+    { onApproved: (event) => approved.push(event) }
+  );
+
+  await watcher._tick(); // baseline
+  await watcher._tick(); // candidate seen once — not yet
+  assert.deepEqual(approved, []);
+  await watcher._tick(); // candidate persisted — fire
+  assert.deepEqual(approved, [{ pid: 200 }]);
+
+  // Fires once and stops itself; later ticks are no-ops.
+  await watcher._tick();
+  assert.equal(approved.length, 1);
+  assert.equal(calls.cleared, 1);
+});
+
+test("approval watcher ignores a short-lived blip (hook spawn)", async () => {
+  const approved = [];
+  const blip = { pid: 200, ppid: 100 };
+  const { watcher } = makeWatcher(
+    [
+      [ROOT, BASE_CHILD],
+      [ROOT, BASE_CHILD, blip],
+      [ROOT, BASE_CHILD],
+      [ROOT, BASE_CHILD]
+    ],
+    { onApproved: (event) => approved.push(event) }
+  );
+
+  await watcher._tick(); // baseline
+  await watcher._tick(); // blip appears
+  await watcher._tick(); // blip gone — must not fire
+  await watcher._tick();
+
+  assert.deepEqual(approved, []);
+});
+
+test("approval watcher detects new grandchildren, not just direct children", async () => {
+  const approved = [];
+  // New process hangs off the pre-existing shell child (root -> shell -> command).
+  const grandchild = { pid: 200, ppid: 110 };
+  const { watcher } = makeWatcher(
+    [
+      [ROOT, BASE_CHILD],
+      [ROOT, BASE_CHILD, grandchild],
+      [ROOT, BASE_CHILD, grandchild]
+    ],
+    { onApproved: (event) => approved.push(event) }
+  );
+
+  await watcher._tick();
+  await watcher._tick();
+  await watcher._tick();
+
+  assert.deepEqual(approved, [{ pid: 200 }]);
+});
+
+test("approval watcher does not detect unrelated processes", async () => {
+  const approved = [];
+  const unrelated = { pid: 200, ppid: 999 };
+  const { watcher } = makeWatcher(
+    [
+      [ROOT, BASE_CHILD],
+      [ROOT, BASE_CHILD, unrelated],
+      [ROOT, BASE_CHILD, unrelated]
+    ],
+    { onApproved: (event) => approved.push(event) }
+  );
+
+  await watcher._tick();
+  await watcher._tick();
+  await watcher._tick();
+
+  assert.deepEqual(approved, []);
+});
+
+test("approval watcher survives lister errors and keeps working", async () => {
+  const approved = [];
+  const newChild = { pid: 200, ppid: 100 };
+  const { watcher } = makeWatcher(
+    [
+      [ROOT, BASE_CHILD],
+      new Error("snapshot failed"),
+      [ROOT, BASE_CHILD, newChild],
+      [ROOT, BASE_CHILD, newChild]
+    ],
+    { onApproved: (event) => approved.push(event) }
+  );
+
+  await watcher._tick(); // baseline
+  await watcher._tick(); // error — swallowed
+  await watcher._tick(); // candidate
+  await watcher._tick(); // persisted — fire
+
+  assert.deepEqual(approved, [{ pid: 200 }]);
+});
+
+test("approval watcher stop() prevents any further detection", async () => {
+  const approved = [];
+  const newChild = { pid: 200, ppid: 100 };
+  const { watcher, calls } = makeWatcher(
+    [
+      [ROOT, BASE_CHILD],
+      [ROOT, BASE_CHILD, newChild],
+      [ROOT, BASE_CHILD, newChild]
+    ],
+    { onApproved: (event) => approved.push(event) }
+  );
+
+  await watcher._tick();
+  watcher.stop();
+  await watcher._tick();
+  await watcher._tick();
+
+  assert.deepEqual(approved, []);
+  assert.equal(calls.cleared, 1);
+});
+
+// --- createApprovalWatchCoordinator -------------------------------------------
+// Bridges session state changes to per-session watchers: watch only while a
+// session with a known pid sits in waiting_approval; stop on any other state.
+
+function makeCoordinator(overrides = {}) {
+  const events = { started: [], stopped: [], approved: [] };
+  const watchers = new Map();
+  const coordinator = createApprovalWatchCoordinator({
+    createWatcher: ({ rootPid, onApproved }) => {
+      events.started.push(rootPid);
+      const watcher = {
+        onApproved,
+        stop: () => events.stopped.push(rootPid)
+      };
+      watchers.set(rootPid, watcher);
+      return watcher;
+    },
+    onApproved: (sessionId, event) => events.approved.push({ sessionId, ...event }),
+    ...overrides
+  });
+  return { coordinator, events, watchers };
+}
+
+function session(state, overrides = {}) {
+  return { sessionId: "sess_a", pid: 100, state, ...overrides };
+}
+
+test("coordinator starts a watcher when a session enters waiting_approval", () => {
+  const { coordinator, events } = makeCoordinator();
+
+  coordinator.onSessionChanged(session("thinking"));
+  assert.deepEqual(events.started, []);
+
+  coordinator.onSessionChanged(session("waiting_approval"));
+  assert.deepEqual(events.started, [100]);
+});
+
+test("coordinator does not start a duplicate watcher for the same session", () => {
+  const { coordinator, events } = makeCoordinator();
+
+  coordinator.onSessionChanged(session("waiting_approval"));
+  coordinator.onSessionChanged(session("waiting_approval"));
+
+  assert.deepEqual(events.started, [100]);
+});
+
+test("coordinator stops the watcher when the session leaves waiting_approval", () => {
+  const { coordinator, events } = makeCoordinator();
+
+  coordinator.onSessionChanged(session("waiting_approval"));
+  coordinator.onSessionChanged(session("thinking"));
+
+  assert.deepEqual(events.stopped, [100]);
+
+  // Re-entering waiting_approval starts a fresh watcher.
+  coordinator.onSessionChanged(session("waiting_approval"));
+  assert.deepEqual(events.started, [100, 100]);
+});
+
+test("coordinator ignores sessions without a pid", () => {
+  const { coordinator, events } = makeCoordinator();
+
+  coordinator.onSessionChanged(session("waiting_approval", { pid: undefined }));
+
+  assert.deepEqual(events.started, []);
+});
+
+test("coordinator ignores undefined session changes", () => {
+  const { coordinator, events } = makeCoordinator();
+
+  coordinator.onSessionChanged(undefined);
+
+  assert.deepEqual(events.started, []);
+});
+
+test("coordinator forwards approval with the sessionId and stops tracking", () => {
+  const { coordinator, events, watchers } = makeCoordinator();
+
+  coordinator.onSessionChanged(session("waiting_approval"));
+  watchers.get(100).onApproved({ pid: 200 });
+
+  assert.deepEqual(events.approved, [{ sessionId: "sess_a", pid: 200 }]);
+
+  // The fired watcher is forgotten — a later waiting_approval starts a new one.
+  coordinator.onSessionChanged(session("waiting_approval"));
+  assert.deepEqual(events.started, [100, 100]);
+});
+
+test("coordinator tracks multiple sessions independently", () => {
+  const { coordinator, events } = makeCoordinator();
+
+  coordinator.onSessionChanged(session("waiting_approval"));
+  coordinator.onSessionChanged(session("waiting_approval", { sessionId: "sess_b", pid: 300 }));
+  coordinator.onSessionChanged(session("idle"));
+
+  assert.deepEqual(events.started, [100, 300]);
+  assert.deepEqual(events.stopped, [100]);
+});
+
+test("coordinator stopAll stops every active watcher", () => {
+  const { coordinator, events } = makeCoordinator();
+
+  coordinator.onSessionChanged(session("waiting_approval"));
+  coordinator.onSessionChanged(session("waiting_approval", { sessionId: "sess_b", pid: 300 }));
+  coordinator.stopAll();
+
+  assert.deepEqual(events.stopped.sort(), [100, 300]);
+});

package/packages/platform-core/src/process-snapshot.js

@@ -0,0 +1,88 @@
+// Cross-OS process-table snapshots: every lister resolves to the full process
+// list as [{ pid, ppid }], so consumers (the approval watcher) never branch on
+// platform. Returns undefined on platforms we don't support — callers treat
+// that as "feature unavailable", never as an error.
+import { execFile as execFileCb } from "node:child_process";
+import { promisify } from "node:util";
+import { readdir as readdirFs, readFile as readFileFs } from "node:fs/promises";
+
+const execFileAsync = promisify(execFileCb);
+
+// One pid+ppid pair per line, whitespace-separated — both `ps` and our
+// PowerShell query are shaped to emit exactly this.
+function parsePidTable(stdout) {
+  const table = [];
+  for (const line of String(stdout).split("\n")) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length !== 2) {
+      continue;
+    }
+    const pid = Number.parseInt(parts[0], 10);
+    const ppid = Number.parseInt(parts[1], 10);
+    if (Number.isInteger(pid) && Number.isInteger(ppid)) {
+      table.push({ pid, ppid });
+    }
+  }
+  return table;
+}
+
+export function createProcessSnapshotLister(options = {}) {
+  const {
+    platform = process.platform,
+    execFile = execFileAsync,
+    readdir = readdirFs,
+    readFile = readFileFs
+  } = options;
+
+  if (platform === "win32") {
+    // CIM query via PowerShell (wmic is removed on current Windows 11). Output
+    // is forced to bare "pid ppid" lines to keep parsing trivial.
+    const script =
+      "Get-CimInstance -ClassName Win32_Process | ForEach-Object { \"$($_.ProcessId) $($_.ParentProcessId)\" }";
+    return async () => {
+      const { stdout } = await execFile(
+        "powershell.exe",
+        ["-NoProfile", "-NonInteractive", "-Command", script],
+        { windowsHide: true }
+      );
+      return parsePidTable(stdout);
+    };
+  }
+
+  if (platform === "darwin") {
+    return async () => {
+      const { stdout } = await execFile("ps", ["-axo", "pid=,ppid="]);
+      return parsePidTable(stdout);
+    };
+  }
+
+  if (platform === "linux") {
+    // Read /proc directly — no subprocess at all. stat field 4 is ppid, but the
+    // comm field (2) is parenthesised and may contain spaces/parens, so parse
+    // from AFTER the last ')'.
+    return async () => {
+      const entries = await readdir("/proc");
+      const table = [];
+      for (const entry of entries) {
+        if (!/^\d+$/.test(entry)) {
+          continue;
+        }
+        let stat;
+        try {
+          stat = String(await readFile(`/proc/${entry}/stat`, "utf8"));
+        } catch {
+          continue; // process exited mid-scan
+        }
+        const afterComm = stat.slice(stat.lastIndexOf(")") + 1).trim().split(/\s+/);
+        const ppid = Number.parseInt(afterComm[1], 10);
+        const pid = Number.parseInt(entry, 10);
+        if (Number.isInteger(pid) && Number.isInteger(ppid)) {
+          table.push({ pid, ppid });
+        }
+      }
+      return table;
+    };
+  }
+
+  return undefined;
+}