@kelceyp/caw-server 1.0.280 → 1.0.282

package/dist/prompt-rejection-detector.mjs

@@ -0,0 +1,158 @@
+// prompt-rejection-detector.mjs — PromptRejectionDetector module.
+//
+// Evaluates JSONL transcript entries handed to it by the wrapper (Task 6
+// wiring) and, on a first conjunctive-predicate match, emits the failure line
+// on stdout exactly once. Unimported sibling of `pty-wrapper.mjs` at this
+// task's end-of-task; wired in at Task 6.
+//
+// Instance-owned mutable state — no module-level mutables. Two instances
+// constructed in the same test file do not share state. The `getEmissionState`
+// / `setEmissionState` callbacks are stored **by reference** so the coupling
+// with the wrapper's `resultEmitted`/`failureEmitted` variables stays live at
+// Task 6 — the detector never snapshots them at construction.
+
+// Anchored, case-sensitive, whitespace-trim-only. Any drift here breaks
+// downstream Task 7 drift-guard lockstep.
+const NORMALISED_REJECTION_TEXT = /^Prompt is too long$/;
+
+export function createPromptRejectionDetector({ log, getEmissionState, setEmissionState, tailer } = {}) {
+    const emit = typeof log === 'function'
+        ? log
+        : (message) => { process.stderr.write(message + '\n'); };
+
+    const state = {
+        oneShotFired: false,
+        transcriptUnresolvedFired: false,
+        boundaryUnusableFired: false,
+        boundaryUnusableCause: null,
+    };
+
+    function noteTranscriptUnresolved() {
+        if (state.transcriptUnresolvedFired) return;
+        state.transcriptUnresolvedFired = true;
+        emit('prompt-rejection: refused, reason=transcript-unresolved');
+    }
+
+    // First-writer-wins on cause: second and later note calls are no-ops (item
+    // 13-style idempotency without a separate flag — the state tuple stays
+    // {oneShotFired, transcriptUnresolvedFired, boundaryUnusableFired,
+    // boundaryUnusableCause}). The distinct `boundaryUnusableFired` flag
+    // guards the leg's own once-per-turn emit so a subsequent noteBoundaryUnusable
+    // call cannot squelch the leg (test (h)).
+    function noteBoundaryUnusable(cause) {
+        if (state.boundaryUnusableCause !== null) return;
+        state.boundaryUnusableCause = cause;
+    }
+
+    function textBlockMatches(block) {
+        if (!block || block.type !== 'text') return false;
+        if (typeof block.text !== 'string') return false;
+        return NORMALISED_REJECTION_TEXT.test(block.text.trim());
+    }
+
+    function findMatchingText(content) {
+        for (const block of content) {
+            if (textBlockMatches(block)) return block.text;
+        }
+        return null;
+    }
+
+    function consider(entry) {
+        const uuid = entry && typeof entry === 'object' ? entry.uuid : undefined;
+        const uuidField = uuid !== undefined ? `uuid=${uuid}` : 'uuid=undefined';
+
+        // Leg 1: missing-flag
+        if (!entry || entry.isApiErrorMessage !== true) {
+            const code = entry && entry.error !== undefined ? entry.error : 'null';
+            emit(`prompt-rejection: refused, reason=missing-flag ${uuidField} error=${code}`);
+            return;
+        }
+
+        // Leg 2: wrong-typed-code (top-level entry.error, NOT entry.message.error)
+        if (entry.error !== 'invalid_request') {
+            const code = entry.error !== undefined ? entry.error : 'null';
+            emit(`prompt-rejection: refused, reason=wrong-typed-code ${uuidField} error=${code}`);
+            return;
+        }
+
+        // Leg 3: content-shape
+        const content = entry.message && entry.message.content;
+        if (!Array.isArray(content)) {
+            emit(`prompt-rejection: refused, reason=content-shape ${uuidField} contentType=${typeof content}`);
+            return;
+        }
+
+        // Leg 4: text-mismatch
+        const matchedText = findMatchingText(content);
+        if (matchedText === null) {
+            emit(`prompt-rejection: refused, reason=text-mismatch ${uuidField} error=invalid_request`);
+            return;
+        }
+
+        // Leg 5: boundary-unusable (at most once per turn, mirrors the tailer's
+        // own one-shot boundary-unusable line)
+        if (tailer && tailer.unusable === true) {
+            if (!state.boundaryUnusableFired) {
+                state.boundaryUnusableFired = true;
+                const cause = state.boundaryUnusableCause !== null
+                    ? state.boundaryUnusableCause
+                    : 'unknown';
+                emit(`prompt-rejection: refused, reason=boundary-unusable path=${tailer.path} cause=${cause}`);
+            }
+            return;
+        }
+
+        // Leg 6: no-uuid
+        if (!uuid) {
+            emit(`prompt-rejection: refused, reason=no-uuid error=invalid_request`);
+            return;
+        }
+
+        // Leg 7: pre-baseline (defensive — the tailer already suppresses these)
+        if (tailer && tailer.preBaselineUUIDs && tailer.preBaselineUUIDs.has(uuid)) {
+            emit(`prompt-rejection: refused, reason=pre-baseline uuid=${uuid}`);
+            return;
+        }
+
+        // Match survived every predicate leg. Apply the one-shot emission guard
+        // immediately before writing to stdout so a concurrent Stop-hook
+        // emitResult() cannot squeeze in between the check and the write.
+        if (state.oneShotFired) {
+            emit(`prompt-rejection: refused, reason=already-emitted uuid=${uuid}`);
+            return;
+        }
+        const emissionState = typeof getEmissionState === 'function' ? getEmissionState() : null;
+        if (emissionState === 'result' || emissionState === 'failure') {
+            emit(`prompt-rejection: refused, reason=already-emitted uuid=${uuid}`);
+            return;
+        }
+
+        // Detection log line — inside the guard, between the check and the
+        // stdout write, so the log line matches the emission 1:1.
+        emit(
+            `prompt-rejection: matched entry uuid=${uuid} error=invalid_request `
+            + `boundary=post-baseline — emitting failure and killing pty`
+        );
+
+        // stdout write MUST happen before setEmissionState('failure') returns
+        // (load-bearing ordering invariant, item 10). A racing observer that
+        // reads state after seeing the stdout line always finds `failure`.
+        const failureLine = JSON.stringify({
+            type: 'error',
+            error: 'prompt_too_long',
+            message: matchedText,
+        }) + '\n';
+        process.stdout.write(failureLine);
+
+        if (typeof setEmissionState === 'function') {
+            setEmissionState('failure');
+        }
+        state.oneShotFired = true;
+    }
+
+    return {
+        consider,
+        noteTranscriptUnresolved,
+        noteBoundaryUnusable,
+    };
+}

package/dist/pty-emit-result.mjs

@@ -28,8 +28,11 @@
  * caller passes the current flag state, and the function no-ops when true.
  * The return value `{ emitted: 'result' | 'error' | null }` lets the caller
  * translate a successful call back into its module-level `resultEmitted` /
- * `failureEmitted` flags, which the prompt-too-long branch at
- * `pty-wrapper.mjs:488` still reads externally.
+ * `failureEmitted` flags. After As1080 Increment A the wrapper no longer has
+ * any text-based prompt-rejection branch, so this delegator is the sole
+ * emitter of `{ type: 'error', ... }` lines on the wrapper's stdout — a
+ * genuine API-level rejection reaches it only when the Stop-hook sentinel
+ * carries a structured `error` field.
  */
 
 const defaultWrite = (line) => process.stdout.write(line);

package/dist/pty-non-interactive-setup.mjs

@@ -0,0 +1,307 @@
+/**
+ * Pre-seed ~/.claude.json to avoid interactive dialogs.
+ *
+ * Extracted from `pty-wrapper.mjs` as Commit A of story As1050 (H6 first-init
+ * write serialisation). The wrapper is currently this module's only caller;
+ * Task 3 hoists the call to `claude-session.js` and gates it on
+ * `--skip-non-interactive-setup`.
+ *
+ * Fail-fast / atomic / idempotent write contract (As1016):
+ *   - Absent  → seed with data = {} and mode 0o644, then atomic write.
+ *   - Present but stat/read/parse fails (with one-shot SyntaxError retry) →
+ *     throw a typed error whose message starts with
+ *     `CLAUDE_JSON_UNREADABLE (<code>): <path>. ...`. No write. The wrapper's
+ *     discriminating catch (pty-wrapper.mjs `:316`) re-emits `err.message + '\n'`
+ *     to stderr and calls `process.exit(1)` — byte-for-byte identical to
+ *     today's inline behaviour. Non-`CLAUDE_JSON_UNREADABLE` errors are
+ *     rethrown by the wrapper.
+ *   - Present and read succeeded → apply the guarded mutations; short-circuit
+ *     via the idempotent guard when both onboarding and every trust-set entry
+ *     are already recorded.
+ *   - Writes go via unique `<target>.tmp.<pid>.<counter>` in the SAME
+ *     directory (`renameSync` must stay on one filesystem), preserving the
+ *     target's existing mode (belt-and-braces `chmodSync` against umask),
+ *     cleaning up (`unlinkSync` + rethrow the original error) on any
+ *     temp-write / chmod / rename failure so the underlying cause is not
+ *     masked.
+ *   - A dangling symlink materialises the file at the link's own target;
+ *     `lstatSync` classifies the nominal path (single-hop only).
+ *   - At function top, sweeps `<basename>.tmp.*` siblings older than 60 s
+ *     from `<dirname>` so a crashed prior writer never accumulates cruft;
+ *     sweep failures are logged (via the caller-supplied `log`, if any) and
+ *     ignored (never the caller's failure).
+ *
+ * `CLAUDE_JSON_UNREADABLE_PREFIX` is carried in-line here rather than
+ * imported from `shared/jobErrorPrefixes.js` — `shared/` is not published
+ * from `server/dist/`, and the wrapper carries its own inline copy for the
+ * same reason. Three co-located literals (`shared/jobErrorPrefixes.js`,
+ * `pty-wrapper.mjs`, this module) must stay in sync per As1016 D8 (extended
+ * from dual- to triple-literal by this commit).
+ */
+
+import {
+    readFileSync,
+    existsSync,
+    writeFileSync,
+    realpathSync,
+    statSync,
+    chmodSync,
+    renameSync,
+    unlinkSync,
+    lstatSync,
+    readlinkSync,
+    readdirSync,
+} from 'fs';
+import { join, dirname, basename, resolve, isAbsolute } from 'path';
+
+export const CLAUDE_JSON_UNREADABLE_PREFIX = 'CLAUDE_JSON_UNREADABLE';
+
+// Module-local counter so each write produces a unique temp path
+// (`<target>.tmp.<pid>.<counter>`, first temp is `.tmp.<pid>.1`).
+let claudeJsonTempCounter = 0;
+
+const noopLog = () => {};
+
+export const ensureNonInteractiveSetup = (cwd, { home, configDir, log = noopLog } = {}) => {
+    // Fail-fast home validation. On invalid `home` the module throws a typed
+    // error whose message starts with `CLAUDE_JSON_UNREADABLE` so the
+    // wrapper's discriminating catch classifies it identically to today's
+    // filesystem-level fail-fast branches. The wrapper always passes
+    // `homedir()`, so this branch is not exercised by the seven existing
+    // integration tests; it protects future callers (Task 3's hoisted
+    // `claude-session.js` call) from silently misconfiguring the file.
+    if (typeof home !== 'string' || home.length === 0 || !isAbsolute(home)) {
+        throw new Error(
+            `${CLAUDE_JSON_UNREADABLE_PREFIX} (HOME_UNSET): resolved home directory is missing or not absolute (got ${JSON.stringify(home)}). Set HOME or pass an absolute path, then retry.`
+        );
+    }
+
+    // As1050 AC 19 — `CLAUDE_CONFIG_DIR` precondition. When the variable is
+    // set, Claude Code 2.1.245+ relocates `.claude.json` (and `projects/`,
+    // `sessions/`, `backups/`) into that directory; a seed written to
+    // `$HOME/.claude.json` under that regime lands in a file the child does
+    // not consult, silently defeating both the setup and the mutex that
+    // serialises writes to it. Route the seed through `$CLAUDE_CONFIG_DIR`
+    // when it is present, else fall back to `$HOME` (Task 3 pre-AC-19
+    // behaviour). Absolute-path validation on `configDir` matches `home`'s
+    // fail-fast shape so the wrapper's discriminating catch classifies both
+    // identically.
+    let baseDir = home;
+    if (configDir !== undefined && configDir !== null) {
+        if (typeof configDir !== 'string' || configDir.length === 0 || !isAbsolute(configDir)) {
+            throw new Error(
+                `${CLAUDE_JSON_UNREADABLE_PREFIX} (CLAUDE_CONFIG_DIR_INVALID): CLAUDE_CONFIG_DIR is set but is not an absolute path (got ${JSON.stringify(configDir)}). Unset it or point it at an absolute path, then retry.`
+            );
+        }
+        baseDir = configDir;
+    }
+
+    const nominal = join(baseDir, '.claude.json');
+
+    // D15: classify the nominal path via lstatSync (not existsSync).
+    //   - not-a-symlink or absent → target = nominal
+    //   - live symlink            → target = realpathSync(nominal)
+    //   - dangling symlink        → target = resolve(dirname(nominal), readlinkSync(nominal))
+    // Single-hop only. Dangling symlink materialises the file at the link's
+    // OWN target rather than replacing the link with a regular file.
+    let target = nominal;
+    try {
+        const linkSt = lstatSync(nominal);
+        if (linkSt.isSymbolicLink()) {
+            try {
+                target = realpathSync(nominal);
+            } catch {
+                const linkText = readlinkSync(nominal);
+                target = resolve(dirname(nominal), linkText);
+            }
+        }
+    } catch (err) {
+        if (err.code !== 'ENOENT') {
+            // A stat failure on the nominal path itself that is not "absent"
+            // (EACCES on the parent dir, ELOOP, ENOTDIR, ...) is unclassifiable
+            // — fail-fast rather than write blindly.
+            throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${nominal}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
+        }
+        // ENOENT on the nominal path is the absent case; target stays nominal.
+    }
+
+    // D17: sweep stale <basename>.tmp.* siblings older than 60 s. Best-effort
+    // cleanup; failures are logged and never surfaced (a broken sweep must
+    // not fail the wrapper turn).
+    try {
+        const parentDir = dirname(target);
+        const prefix = `${basename(target)}.tmp.`;
+        const now = Date.now();
+        for (const name of readdirSync(parentDir)) {
+            if (!name.startsWith(prefix)) continue;
+            const stalePath = join(parentDir, name);
+            try {
+                const staleSt = statSync(stalePath);
+                if (now - staleSt.mtimeMs > 60_000) {
+                    unlinkSync(stalePath);
+                }
+            } catch (sweepErr) {
+                log(`Warning: stale temp sweep of ${stalePath} failed: ${sweepErr.message}`);
+            }
+        }
+    } catch (sweepErr) {
+        log(`Warning: stale temp sweep of ${dirname(target)} failed: ${sweepErr.message}`);
+    }
+
+    // Classified read. `statSync(target)` classifies ENOENT as absent
+    // (data = {}, existingMode = 0o644); any other stat error fails fast.
+    // On SyntaxError from the initial JSON.parse a single re-stat +
+    // re-readFileSync + re-JSON.parse retry runs with no sleep (reclassifies
+    // to absent if the re-stat returns ENOENT). Other read failures fail
+    // immediately with no retry.
+    let data;
+    let existingMode;
+    let readSucceeded = false;
+
+    let st;
+    try {
+        st = statSync(target);
+    } catch (err) {
+        if (err.code === 'ENOENT') {
+            data = {};
+            existingMode = 0o644;
+        } else {
+            throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
+        }
+    }
+
+    if (st) {
+        existingMode = st.mode & 0o777;
+        let raw;
+        try {
+            raw = readFileSync(target, 'utf-8');
+        } catch (err) {
+            throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
+        }
+        try {
+            data = JSON.parse(raw);
+            readSucceeded = true;
+        } catch {
+            // D1: one-shot SyntaxError retry (no sleep). A concurrent
+            // in-flight write from a peer can momentarily present a partial
+            // JSON snapshot; a single re-stat + re-read gives it a chance to
+            // land. Deliberately untested per D1 ("best-effort insurance for
+            // the deploy, not a standing guarantee").
+            let retrySt;
+            try {
+                retrySt = statSync(target);
+            } catch (retryErr) {
+                if (retryErr.code === 'ENOENT') {
+                    data = {};
+                    existingMode = 0o644;
+                } else {
+                    throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${retryErr.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
+                }
+            }
+            if (retrySt) {
+                existingMode = retrySt.mode & 0o777;
+                let retryRaw;
+                try {
+                    retryRaw = readFileSync(target, 'utf-8');
+                } catch (retryErr) {
+                    throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${retryErr.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
+                }
+                try {
+                    data = JSON.parse(retryRaw);
+                    readSucceeded = true;
+                } catch {
+                    throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (SyntaxError): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
+                }
+            }
+        }
+    }
+
+    // Trust both the raw and real cwd paths (handles macOS /tmp symlink).
+    // The inner try/ignore on realpathSync(cwd) is preserved — a stat failure
+    // on cwd is a defensible reduction of the trust set, not the anti-pattern
+    // rewritten out above.
+    const paths = new Set([cwd]);
+    try { paths.add(realpathSync(cwd)); } catch { /* ignore */ }
+
+    // D3/D4 idempotent guard — predicated on a SUCCESSFUL read, never on the
+    // shape of `data` alone.
+    //
+    // Closes: steady-state lost updates — the reproduced mechanism where two
+    //   concurrent turns race a read-modify-write when neither had any change
+    //   to make in the first place (e.g. `mcpServers` emptied for one project
+    //   with onboarding intact).
+    // Closes (As1050 Commit B, this call routed through the server-side
+    //   `claude-session#prepareDirectHost` hook under the module-level
+    //   `Mutex.js` singleton): concurrent first initialization within one
+    //   CAW server process — N direct-mode `claude-session` turns spawned
+    //   from the same server now serialise on this call site, so at most
+    //   one enters the read-modify-write window at a time. The Docker path
+    //   still invokes this function inside the in-container wrapper (the
+    //   server-side `--skip-non-interactive-setup` gate is not emitted on
+    //   `getDockerConfig`'s `commandParts`), but each container has its own
+    //   file-system view, so its writer set is per-container by construction.
+    // Does NOT close: trust-entry loss under uncoordinated writers outside
+    //   the one-server serialisation region. Four writer populations remain
+    //   uncoordinated even post-Commit-B:
+    //     (i)   other CAW server processes on the same host writing to the
+    //           same `~/.claude.json` (each has its own in-process singleton;
+    //           the mutex does not cross processes);
+    //     (ii)  the user's interactive terminal `claude` on the same host,
+    //           which reads and rewrites `~/.claude.json` on trust and
+    //           onboarding transitions;
+    //     (iii) CAW-spawned `claude` child processes (Task-adjudicated turns
+    //           that run `claude` themselves after this seed lands);
+    //     (iv)  `scripts/probes/claude-code-hooks/run-probe.sh`, which
+    //           invokes `claude` outside the JobRunner path entirely.
+    //   Only per-session config isolation (`CLAUDE_CONFIG_DIR` per turn) can
+    //   close the residual — the mutex closes only the CAW-vs-CAW half of
+    //   H6, not the cross-actor half.
+    // Note: `CLAUDE_CONFIG_DIR` isolation is empirically verified on Claude
+    //   Code 2.1.245 (relocates `.claude.json`, `projects/`, `sessions/`,
+    //   `backups/`) rather than a published contract; future upstream
+    //   changes are breaking evidence to re-verify.
+    if (readSucceeded && data.hasCompletedOnboarding) {
+        const alreadyTrusted = [...paths].every(
+            (p) => data.projects?.[p]?.hasTrustDialogAccepted
+        );
+        if (alreadyTrusted) {
+            return;
+        }
+    }
+
+    // Guarded mutations — preserved exactly:
+    //   (i)  onboarding is set ONCE; an already-onboarded seed's
+    //        `lastOnboardingVersion` is not re-stamped.
+    //   (ii) per-project trust is set ONCE; the spread preserves any
+    //        pre-existing keys (e.g. `mcpServers`) on the project's entry.
+    if (!data.hasCompletedOnboarding) {
+        data.hasCompletedOnboarding = true;
+        data.lastOnboardingVersion = '9.9.9';
+    }
+    data.projects = data.projects || {};
+    for (const p of paths) {
+        if (!data.projects[p]?.hasTrustDialogAccepted) {
+            data.projects[p] = {
+                ...(data.projects[p] || {}),
+                hasTrustDialogAccepted: true,
+                projectOnboardingSeenCount: 10
+            };
+        }
+    }
+
+    // D5/D6/D7/D19: atomic mode-preserving temp+rename.
+    // Unique temp name per (pid, counter). Same directory as `target` so
+    // `renameSync` stays on one filesystem. Belt-and-braces `chmodSync`
+    // against umask. On any error on write / chmod / rename, cleanup and
+    // rethrow the ORIGINAL error so the underlying cause is not masked.
+    const tmp = `${target}.tmp.${process.pid}.${++claudeJsonTempCounter}`;
+    try {
+        writeFileSync(tmp, JSON.stringify(data), { mode: existingMode });
+        chmodSync(tmp, existingMode);
+        renameSync(tmp, target);
+    } catch (err) {
+        try { unlinkSync(tmp); } catch { /* temp may not exist; ignore */ }
+        throw err;
+    }
+    log(`Non-interactive setup complete for: ${cwd}`);
+};