@indigoai-us/hq-cloud 6.13.0 → 6.13.2

package/src/operation-lock.ts

@@ -103,6 +103,12 @@ import * as path from "path";
 /** Process exit code used when an operation is refused because the lock is held. */
 export const OPERATION_LOCKED_EXIT = 17;
 
+/**
+ * Process exit code used when an operation is refused because the lock's state
+ * directory is not writable (a permission-class fs error, not a live holder).
+ */
+export const OPERATION_LOCK_UNWRITABLE_EXIT = 18;
+
 export interface LockInfo {
   pid: number;
   command: string;
@@ -128,6 +134,36 @@ export class OperationLockedError extends Error {
   }
 }
 
+/**
+ * Thrown by `acquireOperationLock*` when the per-root lock CANNOT BE CREATED
+ * because its state directory is not writable — a permission-class fs error
+ * (`EPERM` / `EACCES` / `EROFS`) on the lock dir or its temp file, NOT a live
+ * holder. Distinct from {@link OperationLockedError}: nothing is holding the
+ * lock; this process simply cannot write there — e.g. `~/.hq` owned by another
+ * user (created by a past `sudo` run), a macOS privacy/security restriction
+ * (which surfaces as `EPERM: operation not permitted`), or a read-only volume.
+ * Callers turn this into a clear, actionable message + clean exit rather than a
+ * raw uncaught `fs` crash (HQ-CLI-2).
+ */
+export class OperationLockUnwritableError extends Error {
+  constructor(
+    public readonly lockDir: string,
+    public readonly cause: NodeJS.ErrnoException,
+  ) {
+    super(
+      `Cannot create the HQ operation lock in "${lockDir}" ` +
+        `(${cause.code}: ${cause.message}). That directory is not writable, so ` +
+        `HQ can't guard this operation against a concurrent run. Likely causes: ` +
+        `it is owned by another user (e.g. created by a past "sudo" command), a ` +
+        `macOS privacy/security restriction, or a read-only volume. To fix: make ` +
+        `it writable (e.g. "sudo chown -R $(whoami) ~/.hq"), or point HQ at a ` +
+        `writable state directory with HQ_STATE_DIR=<dir>. To bypass the lock for ` +
+        `a single run (drops concurrency protection), set HQ_DISABLE_OP_LOCK=1.`,
+    );
+    this.name = "OperationLockUnwritableError";
+  }
+}
+
 export interface LockHandle {
   /** Absolute path of the lock file. */
   readonly path: string;
@@ -363,10 +399,42 @@ function disabledHandle(hqRoot: string, command: string): LockHandle {
   return { ...NOOP_HANDLE_BASE, path: "", info };
 }
 
+/**
+ * Permission-class fs error codes that mean the lock's state directory itself is
+ * unusable for THIS process (not a transient/EEXIST race). macOS surfaces the
+ * restricted-location case as `EPERM`; Linux as `EACCES`; a read-only mount as
+ * `EROFS`.
+ */
+const UNWRITABLE_LOCK_CODES = new Set(["EPERM", "EACCES", "EROFS"]);
+
+/**
+ * If `err` is a permission-class fs error against the lock dir, rethrow it as an
+ * actionable {@link OperationLockUnwritableError}; otherwise rethrow it
+ * unchanged. Always throws (return type `never`).
+ *
+ * Exported for unit testing: ESM module namespaces can't be spied, so the
+ * classification decision is verified directly here rather than by mocking
+ * `fs.openSync` (see operation-lock.test.ts, HQ-CLI-2).
+ */
+export function rethrowLockCreateError(err: unknown, lockDir: string): never {
+  const e = err as NodeJS.ErrnoException | null;
+  if (e && typeof e.code === "string" && UNWRITABLE_LOCK_CODES.has(e.code)) {
+    throw new OperationLockUnwritableError(lockDir, e);
+  }
+  throw err;
+}
+
 /** Build the lock payload + ensure the locks dir exists. */
 function prepareLock(hqRoot: string, command: string): { p: string; info: LockInfo; payload: string } {
   const p = lockPathFor(hqRoot);
-  fs.mkdirSync(path.dirname(p), { recursive: true });
+  const dir = path.dirname(p);
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+  } catch (err) {
+    // The state dir (e.g. ~/.hq) can't be created — surface it as an actionable
+    // unwritable-lock error rather than a raw mkdir crash.
+    rethrowLockCreateError(err, dir);
+  }
   const info: LockInfo = {
     pid: process.pid,
     command,
@@ -381,7 +449,15 @@ function writeLockTemp(dir: string, payload: string): string {
     dir,
     `.operation-lock.${process.pid}.${Date.now()}.${crypto.randomBytes(6).toString("hex")}.tmp`,
   );
-  const fd = fs.openSync(tmp, "wx", 0o600);
+  let fd: number;
+  try {
+    fd = fs.openSync(tmp, "wx", 0o600);
+  } catch (err) {
+    // The locks dir isn't writable (e.g. macOS EPERM / Linux EACCES on a
+    // root-owned or restricted ~/.hq) — surface an actionable error, not a raw
+    // `EPERM: operation not permitted, open` crash (HQ-CLI-2).
+    rethrowLockCreateError(err, dir);
+  }
   let closed = false;
   try {
     fs.writeSync(fd, payload);

package/src/skill-telemetry.test.ts

@@ -226,6 +226,30 @@ describe("extractCodexSkillToolEvents (Codex model-driven SKILL.md reads)", () =
     expect(ev.source).toBe("model");
   });
 
+  it("matches normal Codex skill paths without backtracking ambiguity", () => {
+    expect(
+      extractCodexSkillToolEvents(
+        execEnd("cat /home/u/.claude/skills/hq/land/SKILL.md"),
+        ctx,
+      )[0].skill,
+    ).toBe("land");
+    expect(
+      extractCodexSkillToolEvents(
+        execEnd("cat /home/u/.claude/skills/a/b/c/SKILL.md"),
+        ctx,
+      )[0].skill,
+    ).toBe("c");
+  });
+
+  it("returns quickly for pathological non-matching skills paths", () => {
+    const cmd = "/home/u/.claude/skills/" + "a/".repeat(2000) + "z z";
+    const started = Date.now();
+    const events = extractCodexSkillToolEvents(execEnd(cmd), ctx);
+    const elapsedMs = Date.now() - started;
+    expect(events).toEqual([]);
+    expect(elapsedMs).toBeLessThan(200);
+  });
+
   it("absolute and relative SKILL.md paths both resolve", () => {
     expect(
       extractCodexSkillToolEvents(execEnd("cat /abs/path/.agents/skills/quiz/SKILL.md"), ctx)[0].skill,

package/src/skill-telemetry.ts

@@ -342,10 +342,11 @@ export function extractCodexSkillEvents(
  *  may be nested arbitrarily deep (`.agents/skills/…`, `.codex/skills/hq/…`),
  *  and `<name>` is always the directory immediately above SKILL.md — captured
  *  as the last segment so the bridge's `skills/hq/<name>/` layout resolves to
- *  `<name>`, not `hq`. The leading `(?:…/)*` is non-greedy via the segment class
- *  so it stops at the final directory boundary. */
+ *  `<name>`, not `hq`. The segment classes deliberately exclude `/` so segment
+ *  boundaries are unambiguous and non-matching `skills/...` paths cannot
+ *  catastrophically backtrack. */
 const CODEX_SKILL_FILE =
-  /(?:^|\/)skills\/(?:[^\s'"]+\/)*?([^/\s'"]+)\/SKILL\.md\b/;
+  /(?:^|\/)skills\/(?:[^/\s'"]+\/)*?([^/\s'"]+)\/SKILL\.md\b/;
 
 /** Pull the shell command string out of a Codex `exec_command_end` `command`,
  *  which is `["/bin/zsh", "-lc", "<cmd>"]` (array) on the runtimes we see, but
@@ -488,6 +489,8 @@ export function extractCodexSkillToolEvents(
   const exec = codexExecParams(obj, payload, ctx);
   if (!exec) return [];
   const { cmd } = exec;
+  // Real exec commands are tiny; avoid running regexes over pathological rows.
+  if (cmd.length > 100_000) return [];
   const m = CODEX_SKILL_FILE.exec(cmd);
   if (!m) return [];
   // Confirm the exec is a read of the skill file, not a write to it. Codex's own