@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/lanes/runaway-tool-guard.js

@@ -0,0 +1,284 @@
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { readProcStarttime } from "./spawn.js";
+export const RUNAWAY_TOOL_GUARD_FLAG = "lanes.runaway-tool-guard";
+const SEARCH_COMMANDS = new Set(["rg", "grep", "ugrep", "ag", "find"]);
+const VALUE_OPTIONS = new Set([
+    "-A", "--after-context", "-B", "--before-context", "-C", "--context",
+    "-e", "--regexp", "-f", "--file", "-g", "--glob", "-t", "--type",
+    "-T", "--type-not", "-M", "--max-count", "-m", "--max-count",
+    "-j", "--threads", "--ignore-file", "--include", "--exclude",
+    "--exclude-dir", "--exclude-from", "--encoding", "--sort",
+]);
+function commandName(command) {
+    return path.basename(command).toLowerCase();
+}
+function hasNoIgnoreFlag(command, args) {
+    if (command === "rg" || command === "ag") {
+        return args.some((arg) => ["--no-ignore", "--no-ignore-vcs", "--unrestricted", "--skip-vcs-ignores"].includes(arg) ||
+            /^-[A-Za-z]*u[A-Za-z]*$/.test(arg));
+    }
+    if (command === "grep" || command === "ugrep") {
+        return args.some((arg) => ["--recursive", "--dereference-recursive"].includes(arg) ||
+            /^-[A-Za-z]*[rR][A-Za-z]*$/.test(arg));
+    }
+    return false;
+}
+function findDepth(args) {
+    for (let index = 0; index < args.length; index += 1) {
+        if (args[index] !== "-maxdepth")
+            continue;
+        const value = Number(args[index + 1]);
+        return Number.isInteger(value) && value >= 0 ? value : null;
+    }
+    return null;
+}
+function positionalArgs(command, args) {
+    if (command === "find") {
+        let index = 0;
+        while (index < args.length) {
+            const arg = args[index];
+            if (["-H", "-L", "-P"].includes(arg) || /^-O\d+$/.test(arg)) {
+                index += 1;
+                continue;
+            }
+            if (arg === "-D") {
+                index += 2;
+                continue;
+            }
+            if (/^-D.+/.test(arg)) {
+                index += 1;
+                continue;
+            }
+            break;
+        }
+        const paths = [];
+        for (; index < args.length; index += 1) {
+            const arg = args[index];
+            if (arg.startsWith("-"))
+                break;
+            paths.push(arg);
+        }
+        return paths;
+    }
+    const positionals = [];
+    let explicitPattern = false;
+    let afterTerminator = false;
+    let listFiles = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (afterTerminator) {
+            positionals.push(arg);
+            continue;
+        }
+        if (arg === "--") {
+            afterTerminator = true;
+            continue;
+        }
+        if (arg === "--files") {
+            listFiles = true;
+            continue;
+        }
+        if (VALUE_OPTIONS.has(arg)) {
+            if (["-e", "--regexp", "-f", "--file"].includes(arg))
+                explicitPattern = true;
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith("--")) {
+            if (arg.startsWith("--regexp=") || arg.startsWith("--file="))
+                explicitPattern = true;
+            continue;
+        }
+        if (arg.startsWith("-") && arg.length > 1) {
+            if (/^-e.+$/.test(arg) || /^-f.+$/.test(arg))
+                explicitPattern = true;
+            continue;
+        }
+        positionals.push(arg);
+    }
+    if (listFiles || explicitPattern)
+        return positionals;
+    return positionals.slice(1);
+}
+function canonicalPath(candidate) {
+    try {
+        return fs.realpathSync(candidate);
+    }
+    catch {
+        return path.resolve(candidate);
+    }
+}
+function searchesBroadRoot(hqRoot, processInfo, command, args) {
+    const roots = new Set([
+        canonicalPath(hqRoot),
+        canonicalPath(path.join(hqRoot, "workspace")),
+        canonicalPath(os.homedir()),
+        path.parse(path.resolve("/")).root,
+    ]);
+    const operands = positionalArgs(command, args);
+    const candidates = operands.length > 0
+        ? operands.map((operand) => path.resolve(processInfo.cwd || ".", operand))
+        : [processInfo.cwd || "."];
+    return candidates.some((candidate) => roots.has(canonicalPath(candidate)));
+}
+function isUnboundedSearch(hqRoot, processInfo, findMaxdepthExempt) {
+    const command = commandName(processInfo.command);
+    if (!SEARCH_COMMANDS.has(command))
+        return false;
+    const args = processInfo.argv.slice(1);
+    if (command === "find") {
+        if (args.includes("-prune"))
+            return false;
+        const depth = findDepth(args);
+        if (depth !== null && depth <= findMaxdepthExempt)
+            return false;
+        return searchesBroadRoot(hqRoot, processInfo, command, args);
+    }
+    if (!hasNoIgnoreFlag(command, args))
+        return false;
+    return searchesBroadRoot(hqRoot, processInfo, command, args);
+}
+function laneAncestor(processInfo, processByPid, laneByPid, currentUid) {
+    let parentPid = processInfo.ppid;
+    const visited = new Set([processInfo.pid]);
+    for (let depth = 0; depth < 128; depth += 1) {
+        const laneId = laneByPid.get(parentPid);
+        if (laneId)
+            return laneId;
+        if (parentPid <= 1 || visited.has(parentPid))
+            return null;
+        visited.add(parentPid);
+        const parent = processByPid.get(parentPid);
+        if (!parent || parent.uid !== currentUid)
+            return null;
+        parentPid = parent.ppid;
+    }
+    return null;
+}
+function errorName(error) {
+    return error instanceof Error ? error.name : "UnknownError";
+}
+export function runRunawayToolGuard(input) {
+    const processByPid = new Map();
+    for (const processInfo of input.processes) {
+        if (Number.isSafeInteger(processInfo.pid) && processInfo.pid > 1) {
+            processByPid.set(processInfo.pid, processInfo);
+        }
+    }
+    const laneByPid = new Map();
+    const ambiguousPids = new Set();
+    for (const lane of input.lanes) {
+        const agent = processByPid.get(lane.agentPid);
+        if (!agent ||
+            !Number.isSafeInteger(lane.agentStarttime) ||
+            agent.starttime !== lane.agentStarttime ||
+            agent.uid !== input.currentUid ||
+            agent.pid === agent.ppid)
+            continue;
+        if (laneByPid.has(lane.agentPid))
+            ambiguousPids.add(lane.agentPid);
+        else
+            laneByPid.set(lane.agentPid, lane.laneId);
+    }
+    for (const pid of ambiguousPids)
+        laneByPid.delete(pid);
+    let stopped = 0;
+    for (const processInfo of input.processes) {
+        if (processInfo.uid !== input.currentUid ||
+            !Number.isFinite(processInfo.elapsedSeconds) ||
+            processInfo.elapsedSeconds <= input.config.max_age_seconds ||
+            processInfo.starttime === null ||
+            !isUnboundedSearch(input.hqRoot, processInfo, input.config.find_maxdepth_exempt))
+            continue;
+        const laneId = laneAncestor(processInfo, processByPid, laneByPid, input.currentUid);
+        if (!laneId || !input.isCurrentProcess(processInfo.pid, processInfo.starttime))
+            continue;
+        try {
+            input.signal(processInfo.pid, "SIGTERM");
+        }
+        catch (error) {
+            if (error.code !== "ESRCH") {
+                input.reportError("signal", errorName(error));
+            }
+            continue;
+        }
+        const command = commandName(processInfo.command);
+        const durationSeconds = Math.floor(processInfo.elapsedSeconds);
+        stopped += 1;
+        try {
+            input.recordEvent(laneId, {
+                event: "runaway_search_stopped",
+                at: input.now.toISOString(),
+                pid: processInfo.pid,
+                command,
+                duration_seconds: durationSeconds,
+            });
+        }
+        catch (error) {
+            input.reportError("record", errorName(error));
+        }
+        try {
+            input.notifyLane(laneId, `runaway-search-guard stopped ${command} after ${durationSeconds}s. Narrow the search to the smallest repo path that holds the answer and keep ignore rules on.`);
+        }
+        catch (error) {
+            input.reportError("notify", errorName(error));
+        }
+    }
+    return { stopped };
+}
+/** Read the host process table once. argv and cwd are read only for search tools. */
+export function listHostProcesses() {
+    if (process.platform !== "linux")
+        return [];
+    let output;
+    try {
+        output = execFileSync("ps", ["-eo", "pid=,ppid=,etimes=,uid=,comm="], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 2_000,
+            maxBuffer: 8 * 1024 * 1024,
+            windowsHide: true,
+        });
+    }
+    catch {
+        throw new Error("ps process-table read failed");
+    }
+    const processes = [];
+    for (const line of output.split("\n")) {
+        const match = line.trim().match(/^(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(.+)$/);
+        if (!match)
+            continue;
+        const pid = Number(match[1]);
+        const ppid = Number(match[2]);
+        const elapsedSeconds = Number(match[3]);
+        const uid = Number(match[4]);
+        const command = match[5].trim();
+        if (![pid, ppid, elapsedSeconds, uid].every(Number.isSafeInteger) || !command)
+            continue;
+        let argv = [];
+        let cwd = "";
+        let starttime = null;
+        if (SEARCH_COMMANDS.has(commandName(command))) {
+            try {
+                const commandLine = fs.readFileSync(`/proc/${pid}/cmdline`);
+                argv = commandLine.toString("utf8").split("\0");
+                if (argv.at(-1) === "")
+                    argv.pop();
+                cwd = fs.readlinkSync(`/proc/${pid}/cwd`);
+                starttime = readProcStarttime(pid);
+            }
+            catch {
+                argv = [];
+                cwd = "";
+                starttime = null;
+            }
+        }
+        processes.push({ pid, ppid, elapsedSeconds, uid, command, argv, cwd, starttime });
+    }
+    return processes;
+}
+export { DEFAULT_RUNAWAY_SEARCH_GUARD_CONFIG } from "./config.js";
+//# sourceMappingURL=runaway-tool-guard.js.map

package/dist/lib/lanes/session-relink.d.ts

@@ -0,0 +1,25 @@
+import { type SessionCopyResult } from "./move-account.js";
+import type { LaneProvider } from "./types.js";
+export interface EnsureSessionHomeInput {
+    provider: Exclude<LaneProvider, "grok">;
+    sessionId: string;
+    cwd: string;
+    targetHome: string;
+    registeredHomes: string[];
+    providerHomeAtSpawn?: string;
+}
+export interface EnsureSessionHomeResult extends SessionCopyResult {
+    source_home: string;
+    transcript_path: string;
+    homes_searched: string[];
+}
+/**
+ * Older Claude account homes can share a registered `account-N/.claude`
+ * parent even after one account is re-registered elsewhere. Discover only
+ * those sibling homes, then inspect the exact session path; credential files
+ * are never opened.
+ */
+export declare function discoverSiblingAccountHomes(provider: EnsureSessionHomeInput["provider"], registeredHomes: string[]): string[];
+/** Find, copy, and verify a provider transcript in the home the next run uses. */
+export declare function ensureSessionHome(input: EnsureSessionHomeInput): EnsureSessionHomeResult;
+//# sourceMappingURL=session-relink.d.ts.map

package/dist/lib/lanes/session-relink.js

@@ -0,0 +1,216 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { copySessionFiles, encodeClaudeProjectDir, planSessionCopy, } from "./move-account.js";
+import { LanesError } from "./errors.js";
+function statDirectory(target) {
+    try {
+        return fs.statSync(target).isDirectory();
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return false;
+        throw err;
+    }
+}
+function claudeTranscriptPath(home, cwd, sessionId) {
+    return path.join(home, "projects", encodeClaudeProjectDir(cwd), `${sessionId}.jsonl`);
+}
+function findCodexRollouts(home, sessionId) {
+    const root = path.join(home, "sessions");
+    if (!statDirectory(root))
+        return [];
+    const suffix = `-${sessionId}.jsonl`;
+    const stack = [{ dir: root, depth: 0 }];
+    const matches = [];
+    while (stack.length > 0) {
+        const { dir, depth } = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT" || code === "ENOTDIR")
+                continue;
+            throw new LanesError("provider_home_search_failed", `Could not search provider home ${home}: ${err instanceof Error ? err.message : String(err)}`, { provider: "codex", home });
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (depth < 3)
+                    stack.push({ dir: full, depth: depth + 1 });
+            }
+            else if (entry.isFile() &&
+                entry.name.startsWith("rollout-") &&
+                entry.name.endsWith(suffix)) {
+                matches.push(full);
+            }
+        }
+    }
+    return matches;
+}
+function sessionTranscripts(provider, home, cwd, sessionId) {
+    if (provider === "codex")
+        return findCodexRollouts(home, sessionId);
+    const transcript = claudeTranscriptPath(home, cwd, sessionId);
+    try {
+        return fs.statSync(transcript).isFile() ? [transcript] : [];
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return [];
+        throw new LanesError("provider_home_search_failed", `Could not check provider home ${home}: ${err instanceof Error ? err.message : String(err)}`, { provider, home });
+    }
+}
+/**
+ * Older Claude account homes can share a registered `account-N/.claude`
+ * parent even after one account is re-registered elsewhere. Discover only
+ * those sibling homes, then inspect the exact session path; credential files
+ * are never opened.
+ */
+export function discoverSiblingAccountHomes(provider, registeredHomes) {
+    const roots = new Set();
+    for (const home of registeredHomes) {
+        if (provider === "claude") {
+            const accountDir = path.dirname(home);
+            if (path.basename(home) === ".claude" &&
+                path.basename(accountDir).startsWith("account-")) {
+                roots.add(path.dirname(accountDir));
+            }
+        }
+        else if (path.basename(home).startsWith("account-")) {
+            roots.add(path.dirname(home));
+        }
+    }
+    const homes = [];
+    for (const root of [...roots].sort()) {
+        let entries;
+        try {
+            entries = fs.readdirSync(root, { withFileTypes: true });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT" || code === "ENOTDIR")
+                continue;
+            throw new LanesError("provider_home_search_failed", `Could not search provider account directory ${root}: ${err instanceof Error ? err.message : String(err)}`, { provider, home: root });
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory() || !entry.name.startsWith("account-"))
+                continue;
+            const home = provider === "claude"
+                ? path.join(root, entry.name, ".claude")
+                : path.join(root, entry.name);
+            if (statDirectory(home))
+                homes.push(home);
+        }
+    }
+    return homes;
+}
+function uniqueHomes(homes) {
+    const unique = new Set();
+    for (const home of homes) {
+        if (typeof home !== "string" || home.trim() === "")
+            continue;
+        unique.add(path.resolve(home));
+    }
+    return [...unique];
+}
+function missingTranscript(input, homes) {
+    return new LanesError("provider_transcript_missing", `Provider transcript for session ${input.sessionId} was not found. Homes searched: ${homes.join(", ")}`, { provider: input.provider, session_id: input.sessionId, homes_searched: homes });
+}
+function copyVerifiedTranscript(input, sourceHome, targetHome, searched) {
+    let copied;
+    try {
+        copied = copySessionFiles(planSessionCopy(input.provider, {
+            sourceHome,
+            targetHome,
+            cwd: input.cwd,
+            sessionId: input.sessionId,
+        }));
+    }
+    catch (err) {
+        if (err instanceof LanesError && err.error === "provider_session_missing") {
+            throw missingTranscript(input, searched);
+        }
+        throw err;
+    }
+    const target = sessionTranscripts(input.provider, targetHome, input.cwd, input.sessionId);
+    if (target.length !== 1) {
+        throw new LanesError("provider_transcript_relink_failed", `Could not verify session ${input.sessionId} in target home ${targetHome}`, { provider: input.provider, session_id: input.sessionId, target_home: targetHome });
+    }
+    return {
+        ...copied,
+        source_home: sourceHome,
+        transcript_path: target[0],
+        homes_searched: searched,
+    };
+}
+/** Find, copy, and verify a provider transcript in the home the next run uses. */
+export function ensureSessionHome(input) {
+    const targetHome = path.resolve(input.targetHome);
+    const homes = uniqueHomes([
+        targetHome,
+        ...input.registeredHomes,
+        ...(input.providerHomeAtSpawn ? [input.providerHomeAtSpawn] : []),
+        ...discoverSiblingAccountHomes(input.provider, input.registeredHomes),
+    ]);
+    const searched = [targetHome];
+    const current = sessionTranscripts(input.provider, targetHome, input.cwd, input.sessionId);
+    if (current.length > 1) {
+        throw new LanesError("provider_transcript_ambiguous", `Multiple ${input.provider} transcripts for session ${input.sessionId} exist in ${targetHome}`, { provider: input.provider, session_id: input.sessionId, homes_searched: searched, matches: current });
+    }
+    const lastRunHome = input.providerHomeAtSpawn
+        ? path.resolve(input.providerHomeAtSpawn)
+        : undefined;
+    if (lastRunHome !== undefined && lastRunHome !== targetHome) {
+        searched.push(lastRunHome);
+        const lastRun = sessionTranscripts(input.provider, lastRunHome, input.cwd, input.sessionId);
+        if (lastRun.length > 1) {
+            throw new LanesError("provider_transcript_ambiguous", `Multiple ${input.provider} transcripts for session ${input.sessionId} exist in the last run home ${lastRunHome}`, { provider: input.provider, session_id: input.sessionId, homes_searched: searched, matches: lastRun });
+        }
+        if (lastRun.length === 1) {
+            return copyVerifiedTranscript(input, lastRunHome, targetHome, searched);
+        }
+    }
+    if (current.length === 1) {
+        const plan = planSessionCopy(input.provider, {
+            sourceHome: targetHome,
+            targetHome,
+            cwd: input.cwd,
+            sessionId: input.sessionId,
+        });
+        return {
+            ...plan,
+            copied: [],
+            source_home: targetHome,
+            transcript_path: current[0],
+            homes_searched: searched,
+        };
+    }
+    const matches = [];
+    for (const home of homes.slice(1)) {
+        if (home === lastRunHome && searched.includes(home))
+            continue;
+        searched.push(home);
+        const found = sessionTranscripts(input.provider, home, input.cwd, input.sessionId);
+        if (found.length > 1) {
+            throw new LanesError("provider_transcript_ambiguous", `Multiple ${input.provider} transcripts for session ${input.sessionId} exist in ${home}`, { provider: input.provider, session_id: input.sessionId, homes_searched: searched, matches: found });
+        }
+        if (found.length === 1)
+            matches.push({ home, transcript: found[0] });
+    }
+    if (matches.length === 0)
+        throw missingTranscript(input, searched);
+    if (matches.length > 1) {
+        throw new LanesError("provider_transcript_ambiguous", `Provider transcript for session ${input.sessionId} exists in multiple homes: ${matches.map((match) => match.home).join(", ")}`, {
+            provider: input.provider,
+            session_id: input.sessionId,
+            homes_searched: searched,
+            matching_homes: matches.map((match) => match.home),
+        });
+    }
+    return copyVerifiedTranscript(input, matches[0].home, targetHome, searched);
+}
+//# sourceMappingURL=session-relink.js.map