@kelceyp/caw-server 1.0.290 → 1.1.0

package/dist/pty-non-interactive-setup.mjs

@@ -1,319 +0,0 @@
-/**
- * Pre-seed ~/.claude.json to avoid interactive dialogs.
- *
- * Extracted from `pty-wrapper.mjs` as Commit A of story As1050 (H6 first-init
- * write serialisation). The wrapper is currently this module's only caller;
- * Task 3 hoists the call to `claude-session.js` and gates it on
- * `--skip-non-interactive-setup`.
- *
- * Fail-fast / atomic / idempotent write contract (As1016):
- *   - `CLAUDE_CONFIG_DIR` refused → before any filesystem access, throw the
- *     As1065 guard's own error (`assertClaudeConfigDirForwardable` in
- *     `claude-config-dir-guard.mjs`), whose message starts with
- *     `CLAUDE_CONFIG_DIR_REFUSED (<RULE>): ...`. This module does not own
- *     the config-dir check; it delegates to the guard, the same predicate
- *     the claude strategies' direct-mode `validatePrerequisites` apply.
- *   - Absent  → seed with data = {} and mode 0o644, then atomic write.
- *   - Present but stat/read/parse fails (with one-shot SyntaxError retry) →
- *     throw a typed error whose message starts with
- *     `CLAUDE_JSON_UNREADABLE (<code>): <path>. ...`. No write.
- *   - The wrapper's discriminating catch (the `ensureNonInteractiveSetup`
- *     call site in `pty-wrapper.mjs`) classifies both prefixes,
- *     `CLAUDE_JSON_UNREADABLE` and `CLAUDE_CONFIG_DIR_REFUSED`: it re-emits
- *     `err.message + '\n'` to stderr and calls `process.exit(1)` —
- *     byte-for-byte identical to today's inline behaviour. Every other
- *     error is rethrown by the wrapper.
- *   - Present and read succeeded → apply the guarded mutations; short-circuit
- *     via the idempotent guard when both onboarding and every trust-set entry
- *     are already recorded.
- *   - Writes go via unique `<target>.tmp.<pid>.<counter>` in the SAME
- *     directory (`renameSync` must stay on one filesystem), preserving the
- *     target's existing mode (belt-and-braces `chmodSync` against umask),
- *     cleaning up (`unlinkSync` + rethrow the original error) on any
- *     temp-write / chmod / rename failure so the underlying cause is not
- *     masked.
- *   - A dangling symlink materialises the file at the link's own target;
- *     `lstatSync` classifies the nominal path (single-hop only).
- *   - At function top, sweeps `<basename>.tmp.*` siblings older than 60 s
- *     from `<dirname>` so a crashed prior writer never accumulates cruft;
- *     sweep failures are logged (via the caller-supplied `log`, if any) and
- *     ignored (never the caller's failure).
- *
- * `CLAUDE_JSON_UNREADABLE_PREFIX` is carried in-line here rather than
- * imported from `shared/jobErrorPrefixes.js` — `shared/` is not published
- * from `server/dist/`, and the wrapper carries its own inline copy for the
- * same reason. Three co-located literals (`shared/jobErrorPrefixes.js`,
- * `pty-wrapper.mjs`, this module) must stay in sync per As1016 D8 (extended
- * from dual- to triple-literal by this commit). The
- * `CLAUDE_CONFIG_DIR_REFUSED` prefix is not carried here: it lives in the
- * guard (literal copy 2 of 2; copy 1 is in `shared/jobErrorPrefixes.js`).
- */
-
-import {
-    readFileSync,
-    existsSync,
-    writeFileSync,
-    realpathSync,
-    statSync,
-    chmodSync,
-    renameSync,
-    unlinkSync,
-    lstatSync,
-    readlinkSync,
-    readdirSync,
-} from 'fs';
-import { join, dirname, basename, resolve, isAbsolute } from 'path';
-import { assertClaudeConfigDirForwardable } from './claude-config-dir-guard.mjs';
-
-export const CLAUDE_JSON_UNREADABLE_PREFIX = 'CLAUDE_JSON_UNREADABLE';
-
-// Module-local counter so each write produces a unique temp path
-// (`<target>.tmp.<pid>.<counter>`, first temp is `.tmp.<pid>.1`).
-let claudeJsonTempCounter = 0;
-
-const noopLog = () => {};
-
-export const ensureNonInteractiveSetup = (cwd, { home, configDir, log = noopLog } = {}) => {
-    // Fail-fast home validation. On invalid `home` the module throws a typed
-    // error whose message starts with `CLAUDE_JSON_UNREADABLE` so the
-    // wrapper's discriminating catch classifies it identically to today's
-    // filesystem-level fail-fast branches. The wrapper always passes
-    // `homedir()`, so this branch is not exercised by the seven existing
-    // integration tests; it protects future callers (Task 3's hoisted
-    // `claude-session.js` call) from silently misconfiguring the file.
-    if (typeof home !== 'string' || home.length === 0 || !isAbsolute(home)) {
-        throw new Error(
-            `${CLAUDE_JSON_UNREADABLE_PREFIX} (HOME_UNSET): resolved home directory is missing or not absolute (got ${JSON.stringify(home)}). Set HOME or pass an absolute path, then retry.`
-        );
-    }
-
-    // As1050 AC 19 — `CLAUDE_CONFIG_DIR` precondition. When the variable is
-    // set, Claude Code 2.1.245+ relocates `.claude.json` (and `projects/`,
-    // `sessions/`, `backups/`) into that directory; a seed written to
-    // `$HOME/.claude.json` under that regime lands in a file the child does
-    // not consult, silently defeating both the setup and the mutex that
-    // serialises writes to it. Route the seed through `$CLAUDE_CONFIG_DIR`
-    // when it is present, else fall back to `$HOME` (Task 3 pre-AC-19
-    // behaviour).
-    //
-    // The value check belongs to the As1065 guard
-    // (`assertClaudeConfigDirForwardable`), the same predicate the claude
-    // strategies' direct-mode `validatePrerequisites` apply. A refused value
-    // throws the guard's own `CLAUDE_CONFIG_DIR_REFUSED (<RULE>): ...` error,
-    // unwrapped, before anything below touches the filesystem; the wrapper's
-    // discriminating catch classifies that prefix alongside
-    // `CLAUDE_JSON_UNREADABLE`. `configDir` is `string | undefined`: a
-    // non-string, including `null`, throws the guard's `TypeError` (As1065
-    // KD5).
-    assertClaudeConfigDirForwardable(configDir);
-    const baseDir = configDir === undefined ? home : configDir;
-
-    const nominal = join(baseDir, '.claude.json');
-
-    // D15: classify the nominal path via lstatSync (not existsSync).
-    //   - not-a-symlink or absent → target = nominal
-    //   - live symlink            → target = realpathSync(nominal)
-    //   - dangling symlink        → target = resolve(dirname(nominal), readlinkSync(nominal))
-    // Single-hop only. Dangling symlink materialises the file at the link's
-    // OWN target rather than replacing the link with a regular file.
-    let target = nominal;
-    try {
-        const linkSt = lstatSync(nominal);
-        if (linkSt.isSymbolicLink()) {
-            try {
-                target = realpathSync(nominal);
-            } catch {
-                const linkText = readlinkSync(nominal);
-                target = resolve(dirname(nominal), linkText);
-            }
-        }
-    } catch (err) {
-        if (err.code !== 'ENOENT') {
-            // A stat failure on the nominal path itself that is not "absent"
-            // (EACCES on the parent dir, ELOOP, ENOTDIR, ...) is unclassifiable
-            // — fail-fast rather than write blindly.
-            throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${nominal}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
-        }
-        // ENOENT on the nominal path is the absent case; target stays nominal.
-    }
-
-    // D17: sweep stale <basename>.tmp.* siblings older than 60 s. Best-effort
-    // cleanup; failures are logged and never surfaced (a broken sweep must
-    // not fail the wrapper turn).
-    try {
-        const parentDir = dirname(target);
-        const prefix = `${basename(target)}.tmp.`;
-        const now = Date.now();
-        for (const name of readdirSync(parentDir)) {
-            if (!name.startsWith(prefix)) continue;
-            const stalePath = join(parentDir, name);
-            try {
-                const staleSt = statSync(stalePath);
-                if (now - staleSt.mtimeMs > 60_000) {
-                    unlinkSync(stalePath);
-                }
-            } catch (sweepErr) {
-                log(`Warning: stale temp sweep of ${stalePath} failed: ${sweepErr.message}`);
-            }
-        }
-    } catch (sweepErr) {
-        log(`Warning: stale temp sweep of ${dirname(target)} failed: ${sweepErr.message}`);
-    }
-
-    // Classified read. `statSync(target)` classifies ENOENT as absent
-    // (data = {}, existingMode = 0o644); any other stat error fails fast.
-    // On SyntaxError from the initial JSON.parse a single re-stat +
-    // re-readFileSync + re-JSON.parse retry runs with no sleep (reclassifies
-    // to absent if the re-stat returns ENOENT). Other read failures fail
-    // immediately with no retry.
-    let data;
-    let existingMode;
-    let readSucceeded = false;
-
-    let st;
-    try {
-        st = statSync(target);
-    } catch (err) {
-        if (err.code === 'ENOENT') {
-            data = {};
-            existingMode = 0o644;
-        } else {
-            throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
-        }
-    }
-
-    if (st) {
-        existingMode = st.mode & 0o777;
-        let raw;
-        try {
-            raw = readFileSync(target, 'utf-8');
-        } catch (err) {
-            throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
-        }
-        try {
-            data = JSON.parse(raw);
-            readSucceeded = true;
-        } catch {
-            // D1: one-shot SyntaxError retry (no sleep). A concurrent
-            // in-flight write from a peer can momentarily present a partial
-            // JSON snapshot; a single re-stat + re-read gives it a chance to
-            // land. Deliberately untested per D1 ("best-effort insurance for
-            // the deploy, not a standing guarantee").
-            let retrySt;
-            try {
-                retrySt = statSync(target);
-            } catch (retryErr) {
-                if (retryErr.code === 'ENOENT') {
-                    data = {};
-                    existingMode = 0o644;
-                } else {
-                    throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${retryErr.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
-                }
-            }
-            if (retrySt) {
-                existingMode = retrySt.mode & 0o777;
-                let retryRaw;
-                try {
-                    retryRaw = readFileSync(target, 'utf-8');
-                } catch (retryErr) {
-                    throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${retryErr.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
-                }
-                try {
-                    data = JSON.parse(retryRaw);
-                    readSucceeded = true;
-                } catch {
-                    throw new Error(`${CLAUDE_JSON_UNREADABLE_PREFIX} (SyntaxError): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.`);
-                }
-            }
-        }
-    }
-
-    // Trust both the raw and real cwd paths (handles macOS /tmp symlink).
-    // The inner try/ignore on realpathSync(cwd) is preserved — a stat failure
-    // on cwd is a defensible reduction of the trust set, not the anti-pattern
-    // rewritten out above.
-    const paths = new Set([cwd]);
-    try { paths.add(realpathSync(cwd)); } catch { /* ignore */ }
-
-    // D3/D4 idempotent guard — predicated on a SUCCESSFUL read, never on the
-    // shape of `data` alone.
-    //
-    // Closes: steady-state lost updates — the reproduced mechanism where two
-    //   concurrent turns race a read-modify-write when neither had any change
-    //   to make in the first place (e.g. `mcpServers` emptied for one project
-    //   with onboarding intact).
-    // Closes (As1050 Commit B, this call routed through the server-side
-    //   `claude-session#prepareDirectHost` hook under the module-level
-    //   `Mutex.js` singleton): concurrent first initialization within one
-    //   CAW server process — N direct-mode `claude-session` turns spawned
-    //   from the same server now serialise on this call site, so at most
-    //   one enters the read-modify-write window at a time. The Docker path
-    //   still invokes this function inside the in-container wrapper (the
-    //   server-side `--skip-non-interactive-setup` gate is not emitted on
-    //   `getDockerConfig`'s `commandParts`), but each container has its own
-    //   file-system view, so its writer set is per-container by construction.
-    // Does NOT close: trust-entry loss under uncoordinated writers outside
-    //   the one-server serialisation region. Four writer populations remain
-    //   uncoordinated even post-Commit-B:
-    //     (i)   other CAW server processes on the same host writing to the
-    //           same `~/.claude.json` (each has its own in-process singleton;
-    //           the mutex does not cross processes);
-    //     (ii)  the user's interactive terminal `claude` on the same host,
-    //           which reads and rewrites `~/.claude.json` on trust and
-    //           onboarding transitions;
-    //     (iii) CAW-spawned `claude` child processes (Task-adjudicated turns
-    //           that run `claude` themselves after this seed lands);
-    //     (iv)  `scripts/probes/claude-code-hooks/run-probe.sh`, which
-    //           invokes `claude` outside the JobRunner path entirely.
-    //   Only per-session config isolation (`CLAUDE_CONFIG_DIR` per turn) can
-    //   close the residual — the mutex closes only the CAW-vs-CAW half of
-    //   H6, not the cross-actor half.
-    // Note: `CLAUDE_CONFIG_DIR` isolation is empirically verified on Claude
-    //   Code 2.1.245 (relocates `.claude.json`, `projects/`, `sessions/`,
-    //   `backups/`) rather than a published contract; future upstream
-    //   changes are breaking evidence to re-verify.
-    if (readSucceeded && data.hasCompletedOnboarding) {
-        const alreadyTrusted = [...paths].every(
-            (p) => data.projects?.[p]?.hasTrustDialogAccepted
-        );
-        if (alreadyTrusted) {
-            return;
-        }
-    }
-
-    // Guarded mutations — preserved exactly:
-    //   (i)  onboarding is set ONCE; an already-onboarded seed's
-    //        `lastOnboardingVersion` is not re-stamped.
-    //   (ii) per-project trust is set ONCE; the spread preserves any
-    //        pre-existing keys (e.g. `mcpServers`) on the project's entry.
-    if (!data.hasCompletedOnboarding) {
-        data.hasCompletedOnboarding = true;
-        data.lastOnboardingVersion = '9.9.9';
-    }
-    data.projects = data.projects || {};
-    for (const p of paths) {
-        if (!data.projects[p]?.hasTrustDialogAccepted) {
-            data.projects[p] = {
-                ...(data.projects[p] || {}),
-                hasTrustDialogAccepted: true,
-                projectOnboardingSeenCount: 10
-            };
-        }
-    }
-
-    // D5/D6/D7/D19: atomic mode-preserving temp+rename.
-    // Unique temp name per (pid, counter). Same directory as `target` so
-    // `renameSync` stays on one filesystem. Belt-and-braces `chmodSync`
-    // against umask. On any error on write / chmod / rename, cleanup and
-    // rethrow the ORIGINAL error so the underlying cause is not masked.
-    const tmp = `${target}.tmp.${process.pid}.${++claudeJsonTempCounter}`;
-    try {
-        writeFileSync(tmp, JSON.stringify(data), { mode: existingMode });
-        chmodSync(tmp, existingMode);
-        renameSync(tmp, target);
-    } catch (err) {
-        try { unlinkSync(tmp); } catch { /* temp may not exist; ignore */ }
-        throw err;
-    }
-    log(`Non-interactive setup complete for: ${cwd}`);
-};