@kelceyp/caw-server 1.0.276 → 1.0.278

package/dist/pty-wrapper.mjs

@@ -19,8 +19,8 @@
  */
 
 import * as pty from 'node-pty';
-import { mkdtempSync, readFileSync, existsSync, writeFileSync, rmSync, realpathSync } from 'fs';
-import { join } from 'path';
+import { mkdtempSync, readFileSync, existsSync, writeFileSync, rmSync, realpathSync, statSync, chmodSync, renameSync, unlinkSync, lstatSync, readlinkSync, readdirSync } from 'fs';
+import { join, dirname, basename, resolve } from 'path';
 import { tmpdir, homedir } from 'os';
 import { execSync } from 'child_process';
 import { readSentinelPayload, hasPendingWork } from './pty-deferred-teardown.mjs';
@@ -76,6 +76,244 @@ try {
     process.exit(1);
 }
 
+// --- Pre-seed ~/.claude.json to avoid interactive dialogs ---
+// Sets hasCompletedOnboarding and trusts the working directory.
+// Uses realpathSync to handle macOS /tmp → /private/tmp symlinks.
+//
+// Fail-fast / atomic / idempotent write contract (As1016):
+//   - Absent  → seed with data = {} and mode 0o644, then atomic write.
+//   - Present but stat/read/parse fails (with one-shot SyntaxError retry) →
+//     print classified `CLAUDE_JSON_UNREADABLE (<code>): <path>. ...` to
+//     stderr and exit 1. No `[pty-wrapper]` prefix. No write.
+//   - Present and read succeeded → apply the guarded mutations; short-circuit
+//     via the idempotent guard when both onboarding and every trust-set entry
+//     are already recorded.
+//   - Writes go via unique `<target>.tmp.<pid>.<counter>` in the SAME
+//     directory (`renameSync` must stay on one filesystem), preserving the
+//     target's existing mode (belt-and-braces `chmodSync` against umask),
+//     cleaning up (`unlinkSync` + rethrow the original error) on any
+//     temp-write / chmod / rename failure so the underlying cause is not
+//     masked.
+//   - A dangling symlink materialises the file at the link's own target;
+//     `lstatSync` classifies the nominal path (single-hop only).
+//   - At function top, sweeps `<basename>.tmp.*` siblings older than 60 s
+//     from `<dirname>` so a crashed prior writer never accumulates cruft;
+//     sweep failures are logged and ignored (never the caller's failure).
+//
+// Declared here (post log()/stdin-drain/claude-binary, immediately before
+// mkdtempSync) so an early `process.exit(1)` cannot EPIPE the parent's
+// stdin.write at JobRunner.js:747/:1145 (no 'error' listener there).
+// Relocating only the invocation and not the declaration would trip the
+// const binding's TDZ — `ReferenceError: Cannot access
+// 'ensureNonInteractiveSetup' before initialization` on every direct PTY
+// turn.
+//
+// Matched by shared/jobErrorPrefixes.js's `CLAUDE_JSON_UNREADABLE_PREFIX`
+// export (not imported here — `shared/` is not published from
+// `server/dist/`; keep the two literals in sync).
+const CLAUDE_JSON_UNREADABLE_PREFIX = 'CLAUDE_JSON_UNREADABLE';
+
+// Module-local counter so each write produces a unique temp path
+// (`<target>.tmp.<pid>.<counter>`, first temp is `.tmp.<pid>.1`).
+let claudeJsonTempCounter = 0;
+
+const ensureNonInteractiveSetup = (cwd) => {
+    const nominal = join(homedir(), '.claude.json');
+
+    // D15: classify the nominal path via lstatSync (not existsSync).
+    //   - not-a-symlink or absent → target = nominal
+    //   - live symlink            → target = realpathSync(nominal)
+    //   - dangling symlink        → target = resolve(dirname(nominal), readlinkSync(nominal))
+    // Single-hop only. Dangling symlink materialises the file at the link's
+    // OWN target rather than replacing the link with a regular file.
+    let target = nominal;
+    try {
+        const linkSt = lstatSync(nominal);
+        if (linkSt.isSymbolicLink()) {
+            try {
+                target = realpathSync(nominal);
+            } catch {
+                const linkText = readlinkSync(nominal);
+                target = resolve(dirname(nominal), linkText);
+            }
+        }
+    } catch (err) {
+        if (err.code !== 'ENOENT') {
+            // A stat failure on the nominal path itself that is not "absent"
+            // (EACCES on the parent dir, ELOOP, ENOTDIR, ...) is unclassifiable
+            // — fail-fast rather than write blindly.
+            process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${nominal}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
+            process.exit(1);
+        }
+        // ENOENT on the nominal path is the absent case; target stays nominal.
+    }
+
+    // D17: sweep stale <basename>.tmp.* siblings older than 60 s. Best-effort
+    // cleanup; failures are logged and never surfaced (a broken sweep must
+    // not fail the wrapper turn).
+    try {
+        const parentDir = dirname(target);
+        const prefix = `${basename(target)}.tmp.`;
+        const now = Date.now();
+        for (const name of readdirSync(parentDir)) {
+            if (!name.startsWith(prefix)) continue;
+            const stalePath = join(parentDir, name);
+            try {
+                const staleSt = statSync(stalePath);
+                if (now - staleSt.mtimeMs > 60_000) {
+                    unlinkSync(stalePath);
+                }
+            } catch (sweepErr) {
+                log(`Warning: stale temp sweep of ${stalePath} failed: ${sweepErr.message}`);
+            }
+        }
+    } catch (sweepErr) {
+        log(`Warning: stale temp sweep of ${dirname(target)} failed: ${sweepErr.message}`);
+    }
+
+    // Classified read. `statSync(target)` classifies ENOENT as absent
+    // (data = {}, existingMode = 0o644); any other stat error fails fast.
+    // On SyntaxError from the initial JSON.parse a single re-stat +
+    // re-readFileSync + re-JSON.parse retry runs with no sleep (reclassifies
+    // to absent if the re-stat returns ENOENT). Other read failures fail
+    // immediately with no retry.
+    let data;
+    let existingMode;
+    let readSucceeded = false;
+
+    let st;
+    try {
+        st = statSync(target);
+    } catch (err) {
+        if (err.code === 'ENOENT') {
+            data = {};
+            existingMode = 0o644;
+        } else {
+            process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
+            process.exit(1);
+        }
+    }
+
+    if (st) {
+        existingMode = st.mode & 0o777;
+        let raw;
+        try {
+            raw = readFileSync(target, 'utf-8');
+        } catch (err) {
+            process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
+            process.exit(1);
+        }
+        try {
+            data = JSON.parse(raw);
+            readSucceeded = true;
+        } catch {
+            // D1: one-shot SyntaxError retry (no sleep). A concurrent
+            // in-flight write from a peer can momentarily present a partial
+            // JSON snapshot; a single re-stat + re-read gives it a chance to
+            // land. Deliberately untested per D1 ("best-effort insurance for
+            // the deploy, not a standing guarantee").
+            let retrySt;
+            try {
+                retrySt = statSync(target);
+            } catch (retryErr) {
+                if (retryErr.code === 'ENOENT') {
+                    data = {};
+                    existingMode = 0o644;
+                } else {
+                    process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${retryErr.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
+                    process.exit(1);
+                }
+            }
+            if (retrySt) {
+                existingMode = retrySt.mode & 0o777;
+                let retryRaw;
+                try {
+                    retryRaw = readFileSync(target, 'utf-8');
+                } catch (retryErr) {
+                    process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${retryErr.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
+                    process.exit(1);
+                }
+                try {
+                    data = JSON.parse(retryRaw);
+                    readSucceeded = true;
+                } catch (retryErr) {
+                    process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (SyntaxError): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
+                    process.exit(1);
+                }
+            }
+        }
+    }
+
+    // Trust both the raw and real cwd paths (handles macOS /tmp symlink).
+    // The inner try/ignore on realpathSync(cwd) is preserved — a stat failure
+    // on cwd is a defensible reduction of the trust set, not the anti-pattern
+    // rewritten out above.
+    const paths = new Set([cwd]);
+    try { paths.add(realpathSync(cwd)); } catch { /* ignore */ }
+
+    // D3/D4 idempotent guard — predicated on a SUCCESSFUL read, never on the
+    // shape of `data` alone.
+    //
+    // Closes: steady-state lost updates — the reproduced mechanism where two
+    //   concurrent turns race a read-modify-write when neither had any change
+    //   to make in the first place (e.g. `mcpServers` emptied for one project
+    //   with onboarding intact).
+    // Does NOT close: concurrent first initialization. If N wrapper turns
+    //   start against a fresh cwd before any one has completed its write,
+    //   all N read the pre-setup state and all N write; only locking or
+    //   per-session config isolation can close that residual.
+    // Note: `CLAUDE_CONFIG_DIR` isolation is empirically verified on Claude
+    //   Code 2.1.245 (relocates `.claude.json`, `projects/`, `sessions/`,
+    //   `backups/`) rather than a published contract; future upstream
+    //   changes are breaking evidence to re-verify.
+    if (readSucceeded && data.hasCompletedOnboarding) {
+        const alreadyTrusted = [...paths].every(
+            (p) => data.projects?.[p]?.hasTrustDialogAccepted
+        );
+        if (alreadyTrusted) {
+            return;
+        }
+    }
+
+    // Guarded mutations — preserved exactly:
+    //   (i)  onboarding is set ONCE; an already-onboarded seed's
+    //        `lastOnboardingVersion` is not re-stamped.
+    //   (ii) per-project trust is set ONCE; the spread preserves any
+    //        pre-existing keys (e.g. `mcpServers`) on the project's entry.
+    if (!data.hasCompletedOnboarding) {
+        data.hasCompletedOnboarding = true;
+        data.lastOnboardingVersion = '9.9.9';
+    }
+    data.projects = data.projects || {};
+    for (const p of paths) {
+        if (!data.projects[p]?.hasTrustDialogAccepted) {
+            data.projects[p] = {
+                ...(data.projects[p] || {}),
+                hasTrustDialogAccepted: true,
+                projectOnboardingSeenCount: 10
+            };
+        }
+    }
+
+    // D5/D6/D7/D19: atomic mode-preserving temp+rename.
+    // Unique temp name per (pid, counter). Same directory as `target` so
+    // `renameSync` stays on one filesystem. Belt-and-braces `chmodSync`
+    // against umask. On any error on write / chmod / rename, cleanup and
+    // rethrow the ORIGINAL error so the underlying cause is not masked.
+    const tmp = `${target}.tmp.${process.pid}.${++claudeJsonTempCounter}`;
+    try {
+        writeFileSync(tmp, JSON.stringify(data), { mode: existingMode });
+        chmodSync(tmp, existingMode);
+        renameSync(tmp, target);
+    } catch (err) {
+        try { unlinkSync(tmp); } catch { /* temp may not exist; ignore */ }
+        throw err;
+    }
+    log(`Non-interactive setup complete for: ${cwd}`);
+};
+
+ensureNonInteractiveSetup(process.cwd());
+
 // --- Temp directory for settings, hook script, and sentinel file ---
 
 const tempDir = mkdtempSync(join(tmpdir(), 'caw-pty-'));
@@ -112,45 +350,6 @@ const settings = {
 };
 writeFileSync(settingsPath, JSON.stringify(settings));
 
-// --- Pre-seed ~/.claude.json to avoid interactive dialogs ---
-// Sets hasCompletedOnboarding and trusts the working directory.
-// Uses realpathSync to handle macOS /tmp → /private/tmp symlinks.
-
-const ensureNonInteractiveSetup = (cwd) => {
-    const claudeJsonPath = join(homedir(), '.claude.json');
-    try {
-        let data = {};
-        try { data = JSON.parse(readFileSync(claudeJsonPath, 'utf-8')); } catch { /* file may not exist */ }
-
-        if (!data.hasCompletedOnboarding) {
-            data.hasCompletedOnboarding = true;
-            data.lastOnboardingVersion = '9.9.9';
-        }
-
-        // Trust both the raw and real cwd paths (handles macOS /tmp symlink)
-        const paths = new Set([cwd]);
-        try { paths.add(realpathSync(cwd)); } catch { /* ignore */ }
-
-        data.projects = data.projects || {};
-        for (const p of paths) {
-            if (!data.projects[p]?.hasTrustDialogAccepted) {
-                data.projects[p] = {
-                    ...(data.projects[p] || {}),
-                    hasTrustDialogAccepted: true,
-                    projectOnboardingSeenCount: 10
-                };
-            }
-        }
-
-        writeFileSync(claudeJsonPath, JSON.stringify(data));
-        log(`Non-interactive setup complete for: ${cwd}`);
-    } catch (err) {
-        log(`Warning: non-interactive setup failed: ${err.message}`);
-    }
-};
-
-ensureNonInteractiveSetup(process.cwd());
-
 // --- Deferred teardown state ---
 
 // 90 minutes — covers full ScheduleWakeup range (up to 3600s) with 30m headroom.