@hellolynk-ai/codex-plugin 0.0.0-stage → 0.2.99

package/plugins/hellolynk-codex/runtime/core/hellolynk-native-reply-routes.mjs

@@ -0,0 +1,96 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{2,240}$/;
+const hash = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const valid = (value) => typeof value === "string" && ID.test(value);
+const fail = () => { throw new Error("native_reply_route_invalid"); };
+
+// Only local executor metadata supplies threadId. Neither message text nor a
+// model-supplied tool argument can name the native destination.
+export async function rememberNativeReplyRoute(scope, input) {
+  const { directory, scopeHash } = location(scope);
+  const record = { version: 1, scopeHash, clientMessageId: input.clientMessageId,
+    threadId: input.threadId, conversationKey: input.conversationKey ?? null,
+    peerDelegateId: input.peerDelegateId ?? null };
+  validate(record, scopeHash, input.clientMessageId);
+  await safeDirectory(scope.runtimeRoot);
+  await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+  await safeDirectory(directory);
+  const file = path.join(directory, `${hash(record.clientMessageId)}.json`);
+  const temporary = `${file}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`;
+  let handle, temporaryCreated = false;
+  try {
+    // Publish only a complete, synced record. A link is exclusive and atomic;
+    // an existing clientMessageId is never replaced or taken over.
+    handle = await fs.open(temporary, "wx", 0o600);
+    temporaryCreated = true;
+    await handle.writeFile(JSON.stringify(record));
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    try {
+      await fs.link(temporary, file);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const existing = await readRecord(file, scopeHash, record.clientMessageId);
+      if (JSON.stringify(existing) !== JSON.stringify(record)) throw new Error("native_reply_route_conflict");
+    }
+  } finally {
+    // The body either published a complete route or already threw its cause.
+    // Cleanup must not replace that result with a secondary close/unlink error.
+    try { await handle?.close(); } catch {}
+    if (temporaryCreated) await fs.unlink(temporary).catch(() => {});
+  }
+}
+
+export async function readNativeReplyRoute(scope, message) {
+  if (message.replyToClientMessageId == null) return null;
+  if (!valid(message.replyToClientMessageId)) fail();
+  const { directory, scopeHash } = location(scope);
+  try {
+    await safeDirectory(directory);
+    const record = await readRecord(path.join(directory, `${hash(message.replyToClientMessageId)}.json`),
+      scopeHash, message.replyToClientMessageId);
+    if (record.conversationKey && record.conversationKey !== message.conversationKey) fail();
+    if (record.peerDelegateId && record.peerDelegateId !== message.peerDelegateId) fail();
+    return record;
+  } catch (error) { if (error.code === "ENOENT") return null; throw error; }
+}
+
+export function nativeReplyRouteLocation(scope) {
+  if (!scope || !path.isAbsolute(scope.runtimeRoot || "") || !["codex", "claude-code", "dsh", "openclaw", "workbuddy", "cursor", "trae-work"].includes(scope.adapterId)) fail();
+  for (const key of ["region", "principalId", "delegateId"])
+    if (typeof scope[key] !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,240}$/.test(scope[key])) fail();
+  const root = path.resolve(scope.runtimeRoot);
+  const scopeHash = hash(JSON.stringify([process.platform === "win32" ? root.toLowerCase() : root,
+    scope.region, scope.principalId, scope.delegateId, scope.adapterId]));
+  return { scopeHash, directory: path.join(root, "native-origins", scopeHash) };
+}
+const location = nativeReplyRouteLocation;
+function validate(record, scopeHash, id) {
+  if (record?.version !== 1 || record.scopeHash !== scopeHash || record.clientMessageId !== id
+    || !valid(id) || !valid(record.threadId)
+    || (!record.conversationKey && !record.peerDelegateId)
+    || (record.conversationKey !== null && !valid(record.conversationKey))
+    || (record.peerDelegateId !== null && !valid(record.peerDelegateId))
+    || Object.keys(record).sort().join() !== "clientMessageId,conversationKey,peerDelegateId,scopeHash,threadId,version") fail();
+}
+async function readRecord(file, scopeHash, id) {
+  const stat = await fs.lstat(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 8192) fail();
+  const record = JSON.parse(await fs.readFile(file, "utf8"));
+  validate(record, scopeHash, id);
+  return record;
+}
+async function safeDirectory(value) {
+  let current = path.resolve(value);
+  while (true) {
+    const stat = await fs.lstat(current);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) fail();
+    const parent = path.dirname(current);
+    if (current === parent) return;
+    current = parent;
+  }
+}

package/plugins/hellolynk-codex/runtime/core/hellolynk-native-worker-lease.mjs

@@ -0,0 +1,84 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { withHelloLynkLocalMutationLock } from "./hellolynk-local-messaging.mjs";
+
+// A live OS handle elects one receiver for a client/account. It has no expiry:
+// slow model work must never let a second receiver take over. Process death
+// closes the handle. Only election itself takes the short filesystem lock.
+export async function tryAcquireNativeWorkerLease(scope) {
+  const { runtimeRoot, adapterId, principalId, delegateId, region } = scope || {};
+  if (typeof runtimeRoot !== "string" || !path.isAbsolute(runtimeRoot)
+    || [adapterId, principalId, delegateId, region].some((value) =>
+      typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,240}$/.test(value))) {
+    throw failure("native_worker_scope_invalid");
+  }
+  const root = process.platform === "win32" ? path.resolve(runtimeRoot).toLowerCase() : path.resolve(runtimeRoot);
+  const key = crypto.createHash("sha256").update(JSON.stringify([root, adapterId, principalId, delegateId, region])).digest("hex");
+  const guard = path.join(runtimeRoot, "native-workers", key);
+  let endpoint;
+  if (process.platform === "win32") endpoint = `\\\\.\\pipe\\hellolynk-native-${key}`;
+  else {
+    const directory = path.join(os.tmpdir(), `hellolynk-native-${process.getuid()}`);
+    await fs.mkdir(directory, { mode: 0o700 }).catch((error) => { if (error.code !== "EEXIST") throw error; });
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid() || (stat.mode & 0o077)) {
+      throw failure("native_worker_socket_directory_unsafe");
+    }
+    endpoint = path.join(directory, `${key.slice(0, 40)}.sock`);
+  }
+  return withHelloLynkLocalMutationLock(guard, async () => {
+    let server = await listen(endpoint);
+    if (!server && process.platform !== "win32" && await isStaleSocket(endpoint)) {
+      // Every acquisition/release uses the same guard, so a different worker
+      // cannot bind between the liveness check and removing the stale socket.
+      await fs.unlink(endpoint).catch((error) => { if (error.code !== "ENOENT") throw error; });
+      server = await listen(endpoint);
+    }
+    if (!server) return null;
+    let releaseFlight;
+    return Object.freeze({
+      release() {
+        if (!releaseFlight) releaseFlight = withHelloLynkLocalMutationLock(guard, () =>
+          new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve())));
+        return releaseFlight;
+      },
+    });
+  });
+}
+
+function listen(endpoint) {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer((socket) => socket.destroy());
+    server.once("error", (error) => {
+      if (error.code === "EADDRINUSE") resolve(null);
+      else reject(error);
+    });
+    server.listen({ path: endpoint, exclusive: true }, () => {
+      server.unref();
+      resolve(server);
+    });
+  });
+}
+
+async function isStaleSocket(endpoint) {
+  const stat = await fs.lstat(endpoint).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (!stat) return true;
+  if (!stat.isSocket() || stat.isSymbolicLink() || stat.uid !== process.getuid()) throw failure("native_worker_socket_unsafe");
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(endpoint);
+    socket.once("connect", () => { socket.destroy(); resolve(false); });
+    socket.once("error", (error) => {
+      socket.destroy();
+      if (["ECONNREFUSED", "ENOENT"].includes(error.code)) resolve(true);
+      else reject(error);
+    });
+  });
+}
+
+function failure(code) { return Object.assign(new Error(code), { code }); }