@illuminis/comprism 0.1.3 → 0.1.4

package/out/executor/shell.js

@@ -33,11 +33,17 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TIMEOUT_MS = void 0;
 exports.safeEnvironment = safeEnvironment;
+exports.keptOutput = keptOutput;
+exports.shellFor = shellFor;
 exports.runCommand = runCommand;
+exports.runProgram = runProgram;
+exports.stopForeground = stopForeground;
 exports.startBackground = startBackground;
 exports.readOutput = readOutput;
 exports.stopProcess = stopProcess;
+exports.listProcesses = listProcesses;
 exports.stopEverything = stopEverything;
 exports.guessTestCommand = guessTestCommand;
 exports.runTests = runTests;
@@ -97,12 +103,52 @@ function safeEnvironment(from = process.env) {
     out.ILLUMINIS_AGENT = "1";
     return out;
 }
+/** Long output keeps its beginning and its end, where a build's first error
+ *  and a test run's summary are, and says how much of the middle was cut
+ *  (manual 5.12). */
 function clip(text) {
     if (text.length <= MAX_OUTPUT_CHARS)
         return text;
     const cut = text.length - MAX_OUTPUT_CHARS;
-    return (`${text.slice(0, MAX_OUTPUT_CHARS)}\n\n[... ${cut.toLocaleString()} more ` +
-        `characters. Narrow the command, or write the output to a file and read part of it.]`);
+    const head = text.slice(0, MAX_OUTPUT_CHARS / 2);
+    const tail = text.slice(text.length - MAX_OUTPUT_CHARS / 2);
+    return (`${head}\n\n[... ${cut.toLocaleString()} characters cut from the middle. The first and ` +
+        `last parts are shown. Narrow the command, or write the output to a file and read part of it.]\n\n${tail}`);
+}
+/** The default time limit on a command (manual 5.12). */
+exports.DEFAULT_TIMEOUT_MS = 120_000;
+/** How long a command may sit silent after printing what looks like a question
+ *  before it is taken to be waiting for someone to type (manual 5.12). */
+const WAITING_MS = 8_000;
+const ASK_WORDS = /(password|passphrase|y\/n|yes\/no|continue|proceed|press (enter|any key)|enter |select|choose|overwrite|confirm)/i;
+/** A last line that reads as a question to whoever is at the keyboard. */
+function asksForInput(line) {
+    const last = line.trim();
+    if (!last)
+        return false;
+    if (/\?$/.test(last))
+        return true;
+    return /[:>\])]$/.test(last) && ASK_WORDS.test(last);
+}
+/** Every command's whole output, by its number, for `output N` in a session.
+ *  Kept in memory for this process only and never sent anywhere. */
+const outputs = new Map();
+let outputCounter = 0;
+const MAX_KEPT = 50;
+function keptOutput(n) {
+    return outputs.get(n);
+}
+function keep(command, text) {
+    outputCounter += 1;
+    outputs.set(outputCounter, { command, text });
+    if (outputs.size > MAX_KEPT)
+        outputs.delete(Math.min(...outputs.keys()));
+    return outputCounter;
+}
+function lineCount(text) {
+    if (!text)
+        return 0;
+    return text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
 }
 /** Run a command and wait for it.
  *
@@ -110,12 +156,39 @@ function clip(text) {
  *  RESULT: it is usually the most useful thing that can happen, because it is
  *  how the agent learns what is wrong.
  */
+/**
+ * The shell a command runs in: the system shell on macOS and Linux, and
+ * PowerShell on Windows (manual 1.2), which is what a Windows developer types
+ * into and what the agent is told it is writing for.
+ */
+function shellFor(command) {
+    if (process.platform === "win32" && process.env.COMPRISM_WINDOWS_SHELL !== "cmd") {
+        // PowerShell 7 where it is installed, because it takes `a && b` as people
+        // write it; Windows PowerShell otherwise, which every Windows machine has.
+        return [windowsPowerShell(), ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass",
+                "-Command", command], false];
+    }
+    return [command, [], true];
+}
+let pwshFound;
+function windowsPowerShell() {
+    if (pwshFound === undefined) {
+        pwshFound = null;
+        for (const dir of (process.env.PATH || "").split(path.delimiter)) {
+            const candidate = path.join(dir, "pwsh.exe");
+            if (dir && fs.existsSync(candidate)) {
+                pwshFound = candidate;
+                break;
+            }
+        }
+    }
+    return pwshFound ?? "powershell.exe";
+}
 function runCommand(command, opts) {
     const cwd = opts.cwd ? (0, paths_1.resolveInside)(opts.root, opts.cwd, true) : fs.realpathSync(opts.root);
-    const timeoutMs = opts.timeoutMs ?? 300_000;
-    return new Promise((resolve) => {
-        let out = "";
-        let done = false;
+    if (opts.sandbox)
+        return sandboxed(command, cwd, opts);
+    return collect({ ...opts, label: opts.label ?? command }, () => {
         // Through a shell on purpose: pipes, redirection and `&&` are how people
         // actually write commands, and an agent told it cannot use them writes three
         // commands where a person would write one.
@@ -128,77 +201,197 @@ function runCommand(command, opts) {
         // would move the same commands somewhere with fewer checks in front of them.
         // The marker has to be the LAST line before the call, not the first line of
         // the explanation: semgrep only reads the line immediately above.
-        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        const child = (0, child_process_1.spawn)(command, {
-            cwd, shell: true,
+        const [file, argv, useShell] = shellFor(command);
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process -- runs the command the person approved, which is what this tool is for
+        const child = (0, child_process_1.spawn)(file, argv, {
+            cwd, shell: useShell,
             env: { ...safeEnvironment(), ...(opts.extraEnv ?? {}) },
-            stdio: ["ignore", "pipe", "pipe"],
+            stdio: [opts.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+            // Its own process group, so stopping it stops what the shell started as
+            // well (manual 6.7). Not on Windows, where it would open a new window.
+            detached: process.platform !== "win32",
         });
+        if (opts.input !== undefined && child.stdin) {
+            // A command that never reads its input must not fail on it.
+            child.stdin.on("error", () => undefined);
+            child.stdin.end(opts.input);
+        }
+        return child;
+    });
+}
+/** The same command inside the sandbox, and anything it blocked said as
+ *  blocked by the sandbox (manual 4.12). */
+async function sandboxed(command, cwd, opts) {
+    const box = opts.sandbox;
+    box.takeBlocked();
+    const w = box.wrap(command, cwd);
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process -- the approved command, wrapped by the sandbox
+    const result = await collect({ ...opts, label: opts.label ?? command }, () => (0, child_process_1.spawn)(w.file, w.args, {
+        cwd, env: { ...safeEnvironment(), ...(opts.extraEnv ?? {}), ...w.env },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32",
+    }));
+    const why = box.explain(result.content, box.takeBlocked());
+    return why ? { ...result, isError: true, summary: why, content: `${why}\n\n${result.content}` } : result;
+}
+/** Run one program with its arguments as a list, and no shell in between.
+ *
+ *  For commands this tool builds itself, such as git. A shell would have to be
+ *  told how to quote each argument, and the quoting differs by shell: the POSIX
+ *  single quotes that kept a commit message whole on macOS and Linux reached
+ *  git on Windows as literal characters, so a commit read `'fix` and a branch
+ *  name no longer matched. With no shell there is nothing to quote, on any
+ *  system, and a model written message cannot become a second command. */
+function runProgram(file, args, opts) {
+    const cwd = opts.cwd ? (0, paths_1.resolveInside)(opts.root, opts.cwd, true) : fs.realpathSync(opts.root);
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process -- a fixed program with its arguments as a list, no shell
+    return collect(opts, () => (0, child_process_1.spawn)(file, args, {
+        cwd, env: { ...safeEnvironment(), ...(opts.extraEnv ?? {}) },
+        stdio: ["ignore", "pipe", "pipe"],
+    }));
+}
+/** Commands running in the foreground right now, so Ctrl+C can stop them
+ *  (manual 6.7). Each is marked stopped before it is killed, so its result
+ *  says so rather than reading as an ordinary exit. */
+const foreground = new Map();
+/** Stop every foreground command and everything it started. */
+function stopForeground() {
+    for (const [child, mark] of foreground) {
+        mark.stopped = true;
+        killTree(child);
+    }
+}
+function killTree(child) {
+    if (process.platform === "win32" && child.pid) {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.spawn)("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
+        return;
+    }
+    try {
+        process.kill(-child.pid, "SIGKILL");
+    }
+    catch {
+        child.kill("SIGKILL");
+    }
+}
+function collect(opts, start) {
+    const timeoutMs = opts.timeoutMs ?? exports.DEFAULT_TIMEOUT_MS;
+    const began = Date.now();
+    return new Promise((resolve) => {
+        let out = "";
+        let done = false;
+        const child = start();
+        const mark = { stopped: false };
+        foreground.set(child, mark);
+        let lastOutput = Date.now();
         const collect = (chunk) => {
             const text = chunk.toString();
             out += text;
+            lastOutput = Date.now();
             opts.onOutput?.(text);
         };
         child.stdout?.on("data", collect);
         child.stderr?.on("data", collect);
-        const timer = setTimeout(() => {
+        const finish = (r) => {
             if (done)
                 return;
             done = true;
+            clearTimeout(timer);
+            clearInterval(watch);
+            foreground.delete(child);
+            const id = keep(opts.label ?? "", out);
+            resolve({ ...r, facts: { ...(r.facts ?? {}), output_id: id, lines: lineCount(out),
+                    seconds: Math.round((Date.now() - began) / 100) / 10 } });
+        };
+        const timer = setTimeout(() => {
             // The whole process group, not just the shell. Killing the shell leaves
             // whatever it started running, which is how a stuck job leaves a server
-            // holding a port after everybody has gone home.
-            try {
-                process.kill(-child.pid, "SIGKILL");
-            }
-            catch {
-                child.kill("SIGKILL");
-            }
-            resolve({
+            // holding a port after everybody has gone home. On Windows the tree is
+            // stopped with taskkill, since there are no process groups.
+            killTree(child);
+            const secs = Math.round(timeoutMs / 1000);
+            finish({
                 isError: true,
                 content: clip(out) +
-                    `\n\n[Stopped after ${Math.round(timeoutMs / 1000)}s. If this command ` +
-                    `waits for input it will never finish; run it in a way that does not.]`,
-                summary: `timed out after ${Math.round(timeoutMs / 1000)}s`,
+                    `\n\n[Timed out: stopped after ${secs}s, the time limit. If this command ` +
+                    "waits for input it will never finish; run it in a way that does not. " +
+                    "A longer limit is --timeout on the job.]",
+                summary: `timed out after ${secs}s`,
+                facts: { timed_out: 1, limit_s: secs },
             });
         }, timeoutMs);
-        child.on("error", (err) => {
-            if (done)
+        // A command waiting for somebody to type never finishes: stdin is closed,
+        // but a program that reads the terminal directly (a password prompt) sits
+        // there until the limit. Silence after a question is taken as that.
+        const watch = setInterval(() => {
+            if (done || Date.now() - lastOutput < WAITING_MS)
                 return;
-            done = true;
-            clearTimeout(timer);
-            resolve({ isError: true, content: `Could not run it: ${err.message}` });
+            const last = out.trimEnd().split("\n").pop() ?? "";
+            if (!asksForInput(last))
+                return;
+            killTree(child);
+            finish({
+                isError: true,
+                content: clip(out) +
+                    "\n\n[Stopped: it was waiting for keyboard input, and nobody can type into a " +
+                    "command the agent runs. Pass the answer as an option, or run it yourself.]",
+                summary: "stopped: waiting for keyboard input",
+                facts: { waiting_input: 1 },
+            });
+        }, 1_000);
+        child.on("error", (err) => {
+            finish({ isError: true, content: `Could not run it: ${err.message}` });
         });
         child.on("close", (code) => {
-            if (done)
-                return;
-            done = true;
-            clearTimeout(timer);
             const body = clip(out).trim() || "(no output)";
-            resolve({
+            if (mark.stopped) {
+                finish({
+                    isError: true,
+                    content: `${body}\n\n[Stopped by the person. The output above is everything it printed before it was stopped.]`,
+                    summary: "stopped",
+                    facts: { stopped: 1 },
+                });
+                return;
+            }
+            finish({
                 // Non-zero is not an error in the sense that matters here. It is
                 // information, and it is usually the most useful information available.
                 isError: false,
                 content: `exit ${code}\n\n${body}`,
                 summary: code === 0 ? "exit 0" : `exit ${code}`,
+                facts: { exit: code ?? -1 },
             });
         });
     });
 }
 const running = new Map();
 let counter = 0;
+/** A port a server announces in its output: "port 8765", "localhost:5173". */
+const PORT = /(?:\bport\s+|localhost:|127\.0\.0\.1:|0\.0\.0\.0:|\[::\]:|\/\/[\w.-]+:)(\d{2,5})\b/i;
 function startBackground(command, opts) {
     const cwd = opts.cwd ? (0, paths_1.resolveInside)(opts.root, opts.cwd, true) : fs.realpathSync(opts.root);
     const id = `p${++counter}`;
     // The background half of the same shell tool, with the same approval list and
-    // the same workspace root in front of it. See `runCommand` above.
-    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    const child = (0, child_process_1.spawn)(command, {
-        cwd, shell: true, env: safeEnvironment(), stdio: ["ignore", "pipe", "pipe"],
+    // the same workspace root in front of it. See `runCommand` above. Its own
+    // process group, so stopping it stops everything it started (manual 5.13).
+    const [file, argv, useShell] = shellFor(command);
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process -- runs the command the person approved, which is what this tool is for
+    const child = (0, child_process_1.spawn)(file, argv, {
+        // Unbuffered, so a Python server's "port 8765" line arrives when it is
+        // printed rather than when a buffer fills (read_output, processes).
+        cwd, shell: useShell, env: { ...safeEnvironment(), PYTHONUNBUFFERED: "1" },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32",
     });
-    const entry = { child, buffer: "", read: 0, command };
+    const entry = { child, buffer: "", read: 0, command, started: Date.now() };
     const collect = (chunk) => {
-        entry.buffer += chunk.toString();
+        const text = chunk.toString();
+        entry.buffer += text;
+        if (!entry.port) {
+            const m = PORT.exec(text);
+            if (m)
+                entry.port = Number(m[1]);
+        }
         // Bounded. A watcher left running for an hour would otherwise hold its whole
         // output in memory, and nobody is going to read the first hour of it.
         if (entry.buffer.length > MAX_OUTPUT_CHARS * 4) {
@@ -212,40 +405,77 @@ function startBackground(command, opts) {
     return {
         content: `Started as ${id}: ${command}\nUse read_output with ${id} to see what it prints, and stop_process to end it.`,
         summary: `started ${id}`,
+        facts: { process: counter },
     };
 }
+function alive(entry) {
+    return entry.child.exitCode === null && entry.child.signalCode === null;
+}
 function readOutput(id) {
     const entry = running.get(id);
     if (!entry)
-        return { isError: true, content: `No process called ${id}.` };
+        return { isError: true, content: `No process called ${id}. Only processes this session started can be read.` };
     const fresh = entry.buffer.slice(entry.read);
     entry.read = entry.buffer.length;
-    const alive = entry.child.exitCode === null && !entry.child.killed;
+    const up = alive(entry);
     return {
         content: (fresh.trim() || "(nothing new)") +
-            `\n\n[${id} is ${alive ? "still running" : `finished, exit ${entry.child.exitCode}`}.]`,
-        summary: alive ? `${id} running` : `${id} exited`,
+            `\n\n[${id} is ${up ? "still running" : `finished, exit ${entry.child.exitCode}`}.]`,
+        summary: up ? `${id} running` : `${id} exited`,
     };
 }
+/** Stop one process this tool started, and everything it started, by the
+ *  number it was given. Never by name or by port (manual 5.13). */
 function stopProcess(id) {
     const entry = running.get(id);
-    if (!entry)
-        return { isError: true, content: `No process called ${id}.` };
-    try {
-        process.kill(-entry.child.pid, "SIGTERM");
+    if (!entry) {
+        return { isError: true, content: `No process called ${id}. The agent can stop only processes it started, by their number.` };
     }
-    catch {
-        entry.child.kill("SIGTERM");
+    const wasUp = alive(entry);
+    if (wasUp) {
+        if (process.platform === "win32" && entry.child.pid) {
+            // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+            (0, child_process_1.spawn)("taskkill", ["/pid", String(entry.child.pid), "/T", "/F"], { stdio: "ignore" });
+        }
+        else {
+            try {
+                process.kill(-entry.child.pid, "SIGTERM");
+            }
+            catch {
+                entry.child.kill("SIGTERM");
+            }
+            // Whatever ignores the polite request is stopped a moment later.
+            const pid = entry.child.pid;
+            setTimeout(() => { try {
+                process.kill(-pid, "SIGKILL");
+            }
+            catch { /* already gone */ } }, 1500).unref();
+        }
     }
     running.delete(id);
-    return { content: `Stopped ${id}.`, summary: `stopped ${id}` };
+    return {
+        content: wasUp ? `Stopped ${id} (${entry.command}) and everything it started.` : `${id} had already finished.`,
+        summary: `stopped ${id}`,
+    };
 }
-/** Everything still running, stopped. Called when a session ends, so a job that
- *  started a dev server does not leave it holding a port after the person has
- *  closed the terminal. */
+/** What this session started and is still tracking, for `processes`. */
+function listProcesses() {
+    return [...running.entries()].map(([id, e]) => ({
+        id, command: e.command, running: alive(e), seconds: Math.round((Date.now() - e.started) / 1000),
+        ...(e.port ? { port: e.port } : {}),
+    }));
+}
+/** Everything still running, stopped, and what was stopped. Called when a
+ *  session ends, so a job that started a dev server does not leave it holding
+ *  a port after the person has closed the terminal (manual 5.13). */
 function stopEverything() {
-    for (const id of Array.from(running.keys()))
+    const stopped = [];
+    for (const [id, e] of Array.from(running.entries())) {
+        if (alive(e))
+            stopped.push(`${id}  ${e.command}`);
         stopProcess(id);
+    }
+    return stopped;
 }
 // ── the tests ───────────────────────────────────────────────────────────────
 /** How this project runs its tests, worked out from what is in it.
@@ -271,6 +501,22 @@ function looksLikePython(root) {
         return false;
     }
 }
+/** The Python this machine runs: `python3` where `python` is not installed,
+ *  which is every recent Mac and most Linux. Guessing `python` there ran
+ *  nothing and cost the agent a step (exit 127). */
+function python() {
+    const dirs = (process.env.PATH ?? "").split(path.delimiter);
+    const exts = process.platform === "win32" ? [".exe", ".cmd", ".bat", ""] : [""];
+    const has = (name) => dirs.some((d) => exts.some((e) => {
+        try {
+            return fs.statSync(path.join(d, name + e)).isFile();
+        }
+        catch {
+            return false;
+        }
+    }));
+    return has("python") || !has("python3") ? "python" : "python3";
+}
 function guessTestCommand(root) {
     const has = (f) => fs.existsSync(path.join(root, f));
     const pkgPath = path.join(root, "package.json");
@@ -285,7 +531,7 @@ function guessTestCommand(root) {
         catch { /* a malformed package.json is not our problem to report here */ }
     }
     if (has("pytest.ini") || has("pyproject.toml") || has("tests") || has("setup.cfg")) {
-        return "python -m pytest -q";
+        return `${python()} -m pytest -q`;
     }
     // A project identified by its TEST FILES rather than by a configuration file.
     // A plain folder of `test_*.py` with no `pyproject.toml` is an entirely normal
@@ -296,7 +542,7 @@ function guessTestCommand(root) {
     //
     // One shallow directory read, and only when nothing above matched.
     if (looksLikePython(root))
-        return "python -m pytest -q";
+        return `${python()} -m pytest -q`;
     if (has("Cargo.toml"))
         return "cargo test";
     if (has("go.mod"))
@@ -321,7 +567,7 @@ async function runTests(opts) {
     }
     if (opts.path)
         command = `${command} ${(0, paths_1.resolveInside)(root, opts.path, false)}`;
-    const result = await runCommand(command, { ...opts, timeoutMs: opts.timeoutMs ?? 600_000 });
+    const result = await runCommand(command, opts);
     const passed = /^exit 0\b/.test(result.content);
     return {
         ...result,

package/out/executor/toolservers.d.ts

@@ -0,0 +1,20 @@
+/** The tool servers one job started, by name. */
+export declare class ToolServers {
+    private readonly cwd;
+    private running;
+    constructor(cwd: string);
+    private server;
+    /** The server's tools, as it described them, as JSON text. */
+    list(name: string, command: string): Promise<{
+        isError: boolean;
+        content: string;
+    }>;
+    /** One call, and the text the server returned. */
+    call(name: string, command: string, tool: string, args: Record<string, unknown>): Promise<{
+        isError: boolean;
+        content: string;
+    }>;
+    /** Every server this job started, stopped. Called when the job ends. */
+    stopAll(): void;
+    get count(): number;
+}