@humwick/runner 0.0.0-stage → 0.130.0

package/src/claude-workspace-trust.ts

@@ -0,0 +1,289 @@
+// #2254 — Claude folder-trust seeding for EVERY launch, host-base included.
+//
+// THE BUG: relay seeded `projects[cwd].hasTrustDialogAccepted` only into an ISOLATED
+// `CLAUDE_CONFIG_DIR` (profile-home's `ensureClaudeConfigSeed`). Host-base profiles and
+// profile-less spawns got nothing, on the assumption that `--dangerously-skip-permissions`
+// bypasses the trust gate. It does not: CC 2.1.233 still renders "Is this a project you
+// created or one you trust?" and blocks the launch until a human answers, so those spawns
+// wedged until reaped. It looked random only because host-base is the minority class.
+//
+// THE FIX, in three parts:
+//   1. Seed into the config file CC ACTUALLY READS for this launch — the isolated
+//      `<home>/.claude.json` when the profile has one, otherwise the shared config
+//      (`$CLAUDE_CONFIG_DIR/.claude.json`, else `~/.claude.json`). Note the shared file is
+//      the HOME-level `~/.claude.json`, not `~/.claude/.claude.json`: `providerSourceHome`
+//      points at `~/.claude` because that is where the auth items live, but CC's config
+//      lives one level up unless CLAUDE_CONFIG_DIR redirects it.
+//   2. Seed EVERY key CC might look the project up under: the lexical cwd, its realpath,
+//      and the git canonical root (a worktree's state is keyed on the checkout that owns
+//      the common git dir). Cheap insurance against a path-shape mismatch.
+//   3. Touch ONLY the trust flags. The shared file is the operator's real config (session
+//      history, mcpServers, auth-adjacent state); an unparseable one is left strictly
+//      alone rather than reseeded, and every other key round-trips untouched.
+//
+// Concurrency: the shared file has many writers (parallel spawns, and CC itself). We take
+// an O_EXCL lockfile with a bounded wait around read → patch → atomic rename, then re-read
+// to verify the flags actually landed. A lock we cannot get is never allowed to block a
+// spawn — we break it and proceed, because an unseeded launch wedges for a human.
+//
+// Deliberately NOT `CLAUDE_CODE_SANDBOXED`: that env var would suppress the dialog by
+// telling CC it runs sandboxed, which is a lie about the launch and changes other CC
+// behaviour. Trust is granted as data, in the file CC reads.
+//
+// The sync fs/subprocess calls here are spawn-time only (once per launch, before the
+// provider starts) — they are not on any tick or transport hot path, and the seed must be
+// on disk before CC opens the config, so an async variant would only add an ordering risk.
+
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { isRecord } from "@humwick/sdk";
+import { spawnSyncBounded } from "./bounded-spawn-sync";
+import { claudeTrustSeedDisabledFromEnv } from "./config";
+
+/** The per-project flags CC's trust gate honours. Both must be `true` or the dialog renders. */
+export const CLAUDE_TRUST_FLAGS = ["hasTrustDialogAccepted", "hasCompletedProjectOnboarding"] as const;
+
+const LOCK_SUFFIX = ".relay-trust.lock";
+const LOCK_WAIT_MS = 2_000;
+const LOCK_POLL_MS = 20;
+const LOCK_STALE_MS = 10_000;
+const GIT_COMMON_DIR_ARGS = ["rev-parse", "--path-format=absolute", "--git-common-dir"];
+
+export type ClaudeTrustSeedSkip = "no-cwd" | "unparseable-config" | "seed-disabled" | "write-failed";
+
+export type ClaudeTrustSeedResult = {
+  /** The config file CC will read for this launch. */
+  path: string;
+  /** Every project key seeded (or that would have been seeded, when skipped). */
+  keys: string[];
+  /** Whether the file was rewritten (false = already trusted, nothing to do). */
+  changed: boolean;
+  /** Re-read confirmation that all keys carry both flags. */
+  verified: boolean;
+  skipped?: ClaudeTrustSeedSkip;
+};
+
+/**
+ * Every path key CC might resolve this launch's project state under.
+ *
+ * `resolve(cwd)` is the lexical path relay hands the provider; `realpathSync` differs
+ * whenever any ancestor is a symlink; the git canonical root is what CC keys a WORKTREE's
+ * project state on (the checkout owning the common git dir), which is a different directory
+ * from the worktree cwd for every isolated-workspace spawn.
+ */
+export function claudeTrustProjectKeys(cwd: string | undefined): string[] {
+  if (!cwd) return [];
+  const lexical = resolve(cwd);
+  const keys = new Set<string>([lexical]);
+  try {
+    keys.add(realpathSync(lexical));
+  } catch {
+    // cwd may not exist yet on this host; the lexical key still stands.
+  }
+  const canonical = gitCanonicalRoot(lexical);
+  if (canonical) keys.add(canonical);
+  return [...keys];
+}
+
+/**
+ * The `.claude.json` this launch's Claude will read: the isolated profile home when the
+ * launch has one (relay sets CLAUDE_CONFIG_DIR to it), otherwise the shared host config.
+ */
+export function claudeLaunchConfigPath(isolatedHome?: string): string {
+  if (isolatedHome) return join(isolatedHome, ".claude.json");
+  const configDir = process.env.CLAUDE_CONFIG_DIR;
+  return configDir ? join(configDir, ".claude.json") : join(homedir(), ".claude.json");
+}
+
+/**
+ * Ensures the trust flags for `cwd` (and its sibling keys) exist in the config CC reads.
+ * Idempotent, and a no-op write when the flags are already true.
+ */
+export function ensureClaudeWorkspaceTrust(cwd: string | undefined, isolatedHome?: string): ClaudeTrustSeedResult {
+  const path = claudeLaunchConfigPath(isolatedHome);
+  const keys = claudeTrustProjectKeys(cwd);
+  if (!keys.length) return { path, keys, changed: false, verified: true, skipped: "no-cwd" };
+  // The ONLY way to switch the seed off is an explicit operator opt-out. It is deliberately
+  // not keyed on anything ambient (an earlier NODE_ENV check would have silently disabled the
+  // seed for ephemeral Proof-of-Life instances, which carry NODE_ENV through the env
+  // allowlist). Test processes stay off the real host config by pointing CLAUDE_CONFIG_DIR at
+  // a fixture (scripts/test-preload-provider-home.ts), never by disabling this path.
+  if (claudeTrustSeedDisabledFromEnv()) return { path, keys, changed: false, verified: false, skipped: "seed-disabled" };
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+  } catch {
+    // A missing, unwritable config dir surfaces on the patch attempt below.
+  }
+  return withConfigLock(path, () => patchTrustKeys(path, keys));
+}
+
+// Read → patch trust flags only → atomic rename → re-read verify.
+function patchTrustKeys(path: string, keys: string[]): ClaudeTrustSeedResult {
+  const existing = readConfigObject(path);
+  if (existing === "unparseable") return { path, keys, changed: false, verified: false, skipped: "unparseable-config" };
+  const config = existing ?? {};
+  const projects = isRecord(config.projects) ? { ...config.projects } : {};
+  let changed = false;
+  for (const key of keys) {
+    const entry = isRecord(projects[key]) ? { ...projects[key] } : {};
+    for (const flag of CLAUDE_TRUST_FLAGS) {
+      if (entry[flag] !== true) {
+        entry[flag] = true;
+        changed = true;
+      }
+    }
+    projects[key] = entry;
+  }
+  if (!changed) return { path, keys, changed: false, verified: true };
+  config.projects = projects;
+  try {
+    writeJsonPreservingMode(path, config);
+  } catch {
+    return { path, keys, changed: false, verified: false, skipped: "write-failed" };
+  }
+  return { path, keys, changed: true, verified: trustVerified(path, keys) };
+}
+
+/** `undefined` = no file yet (safe to create); `"unparseable"` = leave the file alone. */
+function readConfigObject(path: string): Record<string, unknown> | "unparseable" | undefined {
+  if (!existsSync(path)) return undefined;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as unknown;
+    return isRecord(parsed) ? parsed : "unparseable";
+  } catch {
+    return "unparseable";
+  }
+}
+
+function trustVerified(path: string, keys: string[]): boolean {
+  const config = readConfigObject(path);
+  if (!config || config === "unparseable") return false;
+  const projects = isRecord(config.projects) ? config.projects : {};
+  return keys.every((key) => {
+    const entry = projects[key];
+    return isRecord(entry) && CLAUDE_TRUST_FLAGS.every((flag) => entry[flag] === true);
+  });
+}
+
+// Atomic: temp file in the SAME directory, then rename(2) — a crash mid-write can only
+// orphan the temp file, never truncate the config. An existing file keeps its own mode.
+function writeJsonPreservingMode(path: string, value: unknown): void {
+  const mode = fileMode(path) ?? 0o600;
+  const tmpPath = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+  let renamed = false;
+  try {
+    writeFileSync(tmpPath, JSON.stringify(value, null, 2), { mode });
+    renameSync(tmpPath, path);
+    renamed = true;
+  } finally {
+    // A failed write/rename must not leave the temp file beside the operator's config.
+    if (!renamed) {
+      try {
+        rmSync(tmpPath, { force: true });
+      } catch {
+        // Nothing further to do — the leftover is inert.
+      }
+    }
+  }
+}
+
+function fileMode(path: string): number | undefined {
+  try {
+    return statSync(path).mode & 0o777;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * O_EXCL lockfile with a bounded wait. Every exit path runs `fn` — a lock we cannot take
+ * (stale holder, unwritable dir, a peer that outlasts the wait) must not wedge a spawn,
+ * and the worst case of an unlocked patch is losing a concurrent writer's flag for one
+ * key, which the next launch re-adds.
+ */
+function withConfigLock<T>(path: string, fn: () => T): T {
+  const lockPath = `${path}${LOCK_SUFFIX}`;
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  for (;;) {
+    const fd = tryAcquire(lockPath);
+    if (fd !== undefined) return runUnderLock(fd, lockPath, fn);
+    const expired = Date.now() >= deadline;
+    if (expired || lockIsStale(lockPath)) {
+      // Break it: a holder that died mid-write, or one that outlasts our wait, must not
+      // wedge a spawn on a file whose only contested content is a set of `true` flags.
+      try {
+        rmSync(lockPath, { force: true });
+      } catch {
+        return fn();
+      }
+      const takeover = tryAcquire(lockPath);
+      if (takeover !== undefined) return runUnderLock(takeover, lockPath, fn);
+      if (expired) return fn();
+    }
+    Bun.sleepSync(LOCK_POLL_MS);
+  }
+}
+
+function runUnderLock<T>(fd: number, lockPath: string, fn: () => T): T {
+  try {
+    return fn();
+  } finally {
+    closeSync(fd);
+    try {
+      rmSync(lockPath, { force: true });
+    } catch {
+      // A lock we cannot remove goes stale and is broken by the next writer.
+    }
+  }
+}
+
+function tryAcquire(lockPath: string): number | undefined {
+  try {
+    return openSync(lockPath, "wx", 0o600);
+  } catch {
+    return undefined;
+  }
+}
+
+function lockIsStale(lockPath: string): boolean {
+  try {
+    return Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The checkout that owns the common git dir — the main checkout even when `cwd` is a linked
+ * worktree. The server has a richer, cached, filesystem-first twin
+ * (`src/services/canonical-root.ts`); it is not imported here because the runner is a
+ * separate package and that module is wired into the relay server's own loop ledger. One
+ * bounded git call per launch is the cheaper seam for the runner.
+ */
+function gitCanonicalRoot(cwd: string): string | undefined {
+  try {
+    const result = spawnSyncBounded(["git", "-C", cwd, ...GIT_COMMON_DIR_ARGS], {
+      stdin: "ignore", stdout: "pipe", stderr: "ignore", env: gitChildEnv(),
+    });
+    if (result.exitCode !== 0) return undefined;
+    const commonDir = result.stdout.toString().trim();
+    // Only a real `.../.git` common dir names a checkout root. A submodule's gitdir
+    // (`/repo/.git/modules/sub`) and bare repos do not, and must not be hoisted.
+    if (!commonDir || basename(commonDir) !== ".git") return undefined;
+    return dirname(commonDir);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * An inherited `GIT_DIR` / `GIT_WORK_TREE` / `GIT_COMMON_DIR` overrides `-C`, so a runner
+ * launched from inside a git operation (a hook, a rebase) would answer about THAT repo and
+ * seed trust for the wrong root. Strip them; everything else the child may need stays.
+ */
+function gitChildEnv(): Record<string, string | undefined> {
+  const { GIT_DIR, GIT_WORK_TREE, GIT_COMMON_DIR, ...rest } = process.env;
+  void GIT_DIR; void GIT_WORK_TREE; void GIT_COMMON_DIR;
+  return rest;
+}