@moxxy/sdk 0.15.0 → 0.15.2

package/src/stuck-loop.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { createStuckLoopDetector } from './mode-helpers.js';
+import { createStuckLoopDetector, stableHash } from './mode-helpers.js';
 
 describe('createStuckLoopDetector', () => {
   it('trips on exact-input repeats at repeatThreshold', () => {
@@ -39,4 +39,80 @@ describe('createStuckLoopDetector', () => {
       expect(sig.stuck).toBe(false);
     }
   });
+
+  // record() hashes the (model-supplied, `unknown`) tool input in the hot
+  // dispatch path; a throw there crashes the whole turn. These assert it stays
+  // total on hostile/partial input — the worst case the provider can hand us.
+  it('does not throw recording a tool input with a circular reference', () => {
+    const d = createStuckLoopDetector();
+    const input: Record<string, unknown> = { a: 1 };
+    input.self = input;
+    expect(() => d.record('weird', input)).not.toThrow();
+    // And a repeated circular input still trips exact detection (stable key).
+    d.record('weird', input);
+    expect(d.record('weird', input).stuck).toBe(true);
+  });
+
+  it('does not throw recording a tool input that carries a BigInt', () => {
+    const d = createStuckLoopDetector();
+    expect(() => d.record('weird', { n: 10n })).not.toThrow();
+  });
+
+  it('does not throw on a pathologically deep tool input', () => {
+    const d = createStuckLoopDetector();
+    let deep: Record<string, unknown> = {};
+    const root = deep;
+    for (let i = 0; i < 5000; i++) {
+      const next: Record<string, unknown> = {};
+      deep.child = next;
+      deep = next;
+    }
+    expect(() => d.record('weird', root)).not.toThrow();
+  });
+});
+
+describe('stableHash', () => {
+  it('is key-order canonical', () => {
+    expect(stableHash({ a: 1, b: 2 })).toBe(stableHash({ b: 2, a: 1 }));
+  });
+
+  it('returns a string (never throws) on circular, BigInt, and non-finite input', () => {
+    const circular: Record<string, unknown> = {};
+    circular.self = circular;
+    expect(typeof stableHash(circular)).toBe('string');
+    expect(typeof stableHash({ n: 9007199254740993n })).toBe('string');
+    expect(typeof stableHash({ x: Number.NaN, y: Infinity })).toBe('string');
+  });
+
+  it('distinguishes a BigInt from the equal-valued number', () => {
+    expect(stableHash({ n: 1n })).not.toBe(stableHash({ n: 1 }));
+  });
+
+  it('does not flag a shared (non-cyclic) sub-object as circular', () => {
+    const shared = { k: 'v' };
+    // Same object in two sibling positions is a DAG, not a cycle.
+    expect(stableHash({ a: shared, b: shared })).toBe(
+      stableHash({ a: { k: 'v' }, b: { k: 'v' } }),
+    );
+  });
+
+  it('never throws even when a value trap / getter throws', () => {
+    const hostileProxy = new Proxy(
+      {},
+      {
+        ownKeys() {
+          throw new Error('trap throws');
+        },
+      },
+    );
+    expect(() => stableHash({ x: hostileProxy })).not.toThrow();
+    const throwingGetter = Object.defineProperty({}, 'boom', {
+      enumerable: true,
+      get() {
+        throw new Error('getter throws');
+      },
+    });
+    expect(() => stableHash(throwingGetter)).not.toThrow();
+    expect(typeof stableHash(throwingGetter)).toBe('string');
+  });
 });

package/src/tool-dispatch.test.ts

@@ -0,0 +1,215 @@
+import { describe, expect, it } from 'vitest';
+import { asSessionId, asTurnId } from './ids.js';
+import type { EmittedEvent, MoxxyEvent } from './events.js';
+import type { ModeContext } from './mode.js';
+import type { CollectedToolUse, StuckLoopDetector, StuckSignal } from './mode-helpers.js';
+import type { ToolCallVerdict } from './hooks.js';
+import type { PermissionDecision } from './permission.js';
+import {
+  dispatchToolCall,
+  executeToolUses,
+  emitRequestsAndDetectStuck,
+  type StuckLoopReport,
+} from './tool-dispatch.js';
+
+/**
+ * The orphan-prevention guarantees in tool-dispatch are load-bearing: the event
+ * log must never end on a `tool_call_requested` without a paired `tool_result`,
+ * across hook throws, resolver throws, emit throws, mid-batch abort, and a
+ * stuck-loop trip. These tests drive each defensive path directly (the mode
+ * tests only exercise the happy path).
+ */
+
+interface StubOpts {
+  readonly verdict?: ToolCallVerdict | (() => ToolCallVerdict | Promise<ToolCallVerdict>);
+  readonly decision?: PermissionDecision;
+  readonly execute?: (name: string, input: unknown) => unknown;
+  /** Throw from `emit` for these 0-based emit indices. */
+  readonly throwOnEmitIndices?: ReadonlyArray<number>;
+  readonly aborted?: boolean;
+}
+
+function makeCtx(opts: StubOpts = {}): { ctx: ModeContext; events: MoxxyEvent[] } {
+  const events: MoxxyEvent[] = [];
+  let emitCount = 0;
+  const controller = new AbortController();
+  if (opts.aborted) controller.abort();
+
+  const emit = async (event: EmittedEvent): Promise<MoxxyEvent> => {
+    const idx = emitCount++;
+    if (opts.throwOnEmitIndices?.includes(idx)) {
+      throw new Error('emit boom');
+    }
+    const full = { ...event, id: `e${idx}`, ts: idx } as unknown as MoxxyEvent;
+    events.push(full);
+    return full;
+  };
+
+  const ctx = {
+    sessionId: asSessionId('s1'),
+    turnId: asTurnId('t1'),
+    cwd: '/tmp',
+    env: {},
+    log: { events: () => [], subscribe: () => () => {} } as unknown,
+    signal: controller.signal,
+    hooks: {
+      dispatchToolCall: async (): Promise<ToolCallVerdict> => {
+        const v = opts.verdict ?? { action: 'allow' };
+        return typeof v === 'function' ? v() : v;
+      },
+    } as unknown,
+    permissions: {
+      check: async (): Promise<PermissionDecision> => opts.decision ?? { mode: 'allow' },
+    } as unknown,
+    tools: {
+      get: () => undefined,
+      execute: async (name: string, input: unknown) =>
+        opts.execute ? opts.execute(name, input) : 'ok',
+    } as unknown,
+    emit,
+  } as unknown as ModeContext;
+
+  return { ctx, events };
+}
+
+async function drain(
+  gen: AsyncGenerator<MoxxyEvent, unknown, unknown>,
+): Promise<unknown> {
+  let res = await gen.next();
+  while (!res.done) res = await gen.next();
+  return res.value;
+}
+
+const tool: CollectedToolUse = { id: 'c1', name: 'Read', input: { x: 1 } };
+
+describe('dispatchToolCall — orphan prevention', () => {
+  it('happy path ends with a successful tool_result', async () => {
+    const { ctx, events } = makeCtx({ execute: () => 'output' });
+    await drain(dispatchToolCall(ctx, tool, 0));
+    const result = events.find((e) => e.type === 'tool_result') as { ok: boolean } | undefined;
+    expect(result?.ok).toBe(true);
+  });
+
+  it('synthesizes a failed result when the hook throws (no orphan)', async () => {
+    const { ctx, events } = makeCtx({
+      verdict: () => {
+        throw new Error('hook exploded');
+      },
+    });
+    await drain(dispatchToolCall(ctx, tool, 0));
+    const result = events.find((e) => e.type === 'tool_result') as
+      | { ok: boolean; error: { message: string } }
+      | undefined;
+    expect(result?.ok).toBe(false);
+    expect(result?.error.message).toContain('pre-execute failure');
+    expect(result?.error.message).toContain('hook exploded');
+  });
+
+  it('synthesizes a failed result when the resolver throws', async () => {
+    const { ctx, events } = makeCtx({
+      decision: undefined,
+    });
+    // Make permissions.check itself throw via a hostile override.
+    (ctx.permissions as unknown as { check: () => Promise<never> }).check = async () => {
+      throw new Error('resolver down');
+    };
+    await drain(dispatchToolCall(ctx, tool, 0));
+    const result = events.find((e) => e.type === 'tool_result') as
+      | { ok: boolean; error: { message: string } }
+      | undefined;
+    expect(result?.ok).toBe(false);
+    expect(result?.error.message).toContain('pre-execute failure');
+  });
+
+  it('labels a post-run emit failure as "tool ran but result emit failed"', async () => {
+    // Emit order: #0 = tool_call_approved, #1 = success tool_result (throws →
+    // inner catch), #2 = inner-catch failed tool_result (throws → outer catch).
+    // The outer catch must NOT mislabel a tool that already ran as a
+    // pre-execute failure.
+    const { ctx, events } = makeCtx({
+      execute: () => 'output',
+      throwOnEmitIndices: [1, 2],
+    });
+    await drain(dispatchToolCall(ctx, tool, 0));
+    const result = events.find((e) => e.type === 'tool_result') as
+      | { ok: boolean; error: { message: string } }
+      | undefined;
+    expect(result?.ok).toBe(false);
+    expect(result?.error.message).toContain('tool ran but result emit failed');
+    expect(result?.error.message).not.toContain('pre-execute failure');
+  });
+
+  it('emits a denied result + tool_result when the hook denies', async () => {
+    const { ctx, events } = makeCtx({ verdict: { action: 'deny', reason: 'nope' } });
+    await drain(dispatchToolCall(ctx, tool, 0));
+    expect(events.some((e) => e.type === 'tool_call_denied')).toBe(true);
+    const result = events.find((e) => e.type === 'tool_result') as { ok: boolean } | undefined;
+    expect(result?.ok).toBe(false);
+  });
+});
+
+describe('executeToolUses — mid-batch abort', () => {
+  it('synthesizes a tool_result for every un-run call and an abort when aborted up front', async () => {
+    const { ctx, events } = makeCtx({ aborted: true });
+    const calls: CollectedToolUse[] = [
+      { id: 'a', name: 'Read', input: {} },
+      { id: 'b', name: 'Read', input: {} },
+    ];
+    const stop = await drain(executeToolUses(ctx, calls, 0));
+    expect(stop).toBe(true);
+    const results = events.filter((e) => e.type === 'tool_result') as Array<{
+      callId: string;
+      error: { kind: string };
+    }>;
+    expect(new Set(results.map((r) => r.callId))).toEqual(new Set(['a', 'b']));
+    expect(results.every((r) => r.error.kind === 'aborted')).toBe(true);
+    expect(events.some((e) => e.type === 'abort')).toBe(true);
+  });
+});
+
+describe('emitRequestsAndDetectStuck — stuck trip', () => {
+  const report: StuckLoopReport = {
+    abortedResultMessage: 'stuck — not run',
+    nearHint: 'with nearly identical input',
+    fatalMessage: ({ toolName }) => `stuck on ${toolName}`,
+  };
+
+  function detector(trip: StuckSignal): StuckLoopDetector {
+    return { record: () => trip } as unknown as StuckLoopDetector;
+  }
+
+  it('synthesizes a failed tool_result for the emitted request before the fatal error', async () => {
+    const { ctx, events } = makeCtx();
+    const stop = await drain(
+      emitRequestsAndDetectStuck(
+        ctx,
+        [tool],
+        detector({ stuck: true, kind: 'exact', count: 3 }),
+        report,
+      ),
+    );
+    expect(stop).toBe(true);
+    // The request must be paired with a synthesized aborted result — no orphan.
+    expect(events.some((e) => e.type === 'tool_call_requested')).toBe(true);
+    const result = events.find((e) => e.type === 'tool_result') as
+      | { ok: boolean; error: { kind: string } }
+      | undefined;
+    expect(result?.ok).toBe(false);
+    expect(result?.error.kind).toBe('aborted');
+    expect(events.some((e) => e.type === 'error')).toBe(true);
+  });
+
+  it('returns false (no synthesis) when the detector does not trip', async () => {
+    const { ctx, events } = makeCtx();
+    const stop = await drain(
+      emitRequestsAndDetectStuck(
+        ctx,
+        [tool],
+        detector({ stuck: false, kind: 'exact', count: 0 }),
+        report,
+      ),
+    );
+    expect(stop).toBe(false);
+    expect(events.filter((e) => e.type === 'tool_result')).toHaveLength(0);
+  });
+});

package/src/tool-dispatch.ts

@@ -23,6 +23,11 @@ export async function* dispatchToolCall(
   t: CollectedToolUse,
   iteration: number,
 ): AsyncGenerator<MoxxyEvent, void, unknown> {
+  // Set once the tool body resolves, so the outer catch can tell a genuine
+  // pre-execute failure (hook/permission/emit-before-run threw) apart from a
+  // post-run failure (the tool ran — possibly with side effects — but emitting
+  // its success result threw). The two warrant different log wording.
+  let executed = false;
   try {
     const verdict = await ctx.hooks.dispatchToolCall({
       sessionId: ctx.sessionId,
@@ -70,6 +75,7 @@ export async function* dispatchToolCall(
         log: ctx.log,
         ...(ctx.subagents ? { subagents: ctx.subagents } : {}),
       });
+      executed = true;
       yield await ctx.emit({
         type: 'tool_result',
         sessionId: ctx.sessionId,
@@ -94,9 +100,13 @@ export async function* dispatchToolCall(
     }
   } catch (err) {
     // Defensive: a hook handler, permission resolver, or the emit itself threw
-    // before we could produce a tool_result. Synthesize a failed result so the
-    // event log stays well-formed (no orphan tool_call_requested).
+    // before (or after) we could produce a tool_result. Synthesize a failed
+    // result so the event log stays well-formed (no orphan tool_call_requested).
+    // When `executed` is set the tool actually ran (possibly with side effects)
+    // and only the success-result emit failed — don't mislabel that as a
+    // pre-execute failure.
     const message = err instanceof Error ? err.message : String(err);
+    const prefix = executed ? 'tool ran but result emit failed' : 'pre-execute failure';
     yield await ctx.emit({
       type: 'tool_result',
       sessionId: ctx.sessionId,
@@ -104,7 +114,7 @@ export async function* dispatchToolCall(
       source: 'tool',
       callId: asToolCallId(t.id),
       ok: false,
-      error: { kind: 'threw', message: `pre-execute failure: ${message}` },
+      error: { kind: 'threw', message: `${prefix}: ${message}` },
     });
   }
 }

package/src/tool-display.test.ts

@@ -68,4 +68,28 @@ describe('guards', () => {
     expect(isToolDisplayResult({ forModel: 'x' })).toBe(false);
     expect(isToolDisplayResult('wrote 12 chars')).toBe(false);
   });
+
+  it('rejects malformed file-diff objects (not just the right `kind`)', () => {
+    // Right kind, but the rest of the shape is bogus — must not be trusted as a
+    // structured diff (channels would otherwise render garbage / the model loses
+    // the real output).
+    expect(isFileDiffDisplay({ kind: 'file-diff' })).toBe(false); // no path/counts/hunks
+    expect(isFileDiffDisplay({ kind: 'file-diff', path: 1, added: 1, removed: 0, hunks: [] })).toBe(false); // path not a string
+    expect(isFileDiffDisplay({ kind: 'file-diff', path: 'a', added: '1', removed: 0, hunks: [] })).toBe(false); // added not numeric
+    expect(isFileDiffDisplay({ kind: 'file-diff', path: 'a', added: 1, removed: 0, hunks: 'nope' })).toBe(false); // hunks not an array
+    expect(isFileDiffDisplay({ kind: 'file-diff', path: 'a', added: 1, removed: 0, hunks: [{ lines: 'x' }] })).toBe(false); // hunk.lines not an array
+    expect(isFileDiffDisplay({ kind: 'file-diff', path: 'a', added: 1, removed: 0, hunks: [null] })).toBe(false); // bad hunk entry
+    // A malformed display must also fail the wrapping ToolDisplayResult guard.
+    expect(isToolDisplayResult({ forModel: 'x', display: { kind: 'file-diff' } })).toBe(false);
+    // A well-formed hunk passes.
+    expect(
+      isFileDiffDisplay({
+        kind: 'file-diff',
+        path: 'a',
+        added: 1,
+        removed: 0,
+        hunks: [{ oldStart: 1, oldLines: 1, newStart: 1, newLines: 1, lines: [] }],
+      }),
+    ).toBe(true);
+  });
 });

package/src/tool-display.ts

@@ -72,12 +72,28 @@ export function isToolDisplay(x: unknown): x is ToolDisplay {
 }
 
 export function isFileDiffDisplay(x: unknown): x is FileDiffDisplay {
-  return (
-    typeof x === 'object' &&
-    x !== null &&
-    (x as { kind?: unknown }).kind === 'file-diff' &&
-    Array.isArray((x as { hunks?: unknown }).hunks)
-  );
+  if (typeof x !== 'object' || x === null) return false;
+  const d = x as {
+    kind?: unknown;
+    path?: unknown;
+    added?: unknown;
+    removed?: unknown;
+    hunks?: unknown;
+  };
+  if (d.kind !== 'file-diff') return false;
+  // Validate the load-bearing shape, not just `kind` + a `hunks` array: this
+  // guard decides whether a tool result is TRUSTED as a structured diff (the
+  // model is then shown only `forModel`, and channels render the payload). A
+  // malformed object with a bogus path / non-numeric counts / a non-array hunk
+  // must be rejected, not silently rendered.
+  if (typeof d.path !== 'string') return false;
+  if (typeof d.added !== 'number' || typeof d.removed !== 'number') return false;
+  if (!Array.isArray(d.hunks)) return false;
+  for (const hunk of d.hunks) {
+    if (typeof hunk !== 'object' || hunk === null) return false;
+    if (!Array.isArray((hunk as { lines?: unknown }).lines)) return false;
+  }
+  return true;
 }
 
 /** Human summary, e.g. "Added 10 lines, removed 1 line". */

package/src/tunnel.ts

@@ -82,8 +82,18 @@ function ensureExitHook(): void {
     liveChildren.clear();
   };
   process.once('exit', killAll);
-  process.once('SIGINT', killAll);
-  process.once('SIGTERM', killAll);
+  // Registering a SIGINT/SIGTERM listener suppresses Node's default
+  // terminate-on-signal behavior, so an entrypoint that spawns a tunnel but
+  // installs no exit handler of its own would swallow the first Ctrl-C and hang
+  // with the process still alive. Re-raise the signal after cleanup so the
+  // default termination still fires. `process.once` removes the listener before
+  // it runs, so re-raising hits Node's default disposition (terminate).
+  const onSignal = (sig: 'SIGINT' | 'SIGTERM') => (): void => {
+    killAll();
+    process.kill(process.pid, sig);
+  };
+  process.once('SIGINT', onSignal('SIGINT'));
+  process.once('SIGTERM', onSignal('SIGTERM'));
 }
 
 /** Track a spawned child; returns an `untrack()` that also kills it cleanly. */

package/src/view-renderer.test.ts

@@ -33,6 +33,18 @@ describe('countNodes', () => {
   it('counts a leaf element as 1', () => {
     expect(countNodes(el('hr'))).toBe(1);
   });
+
+  it('does not throw (RangeError) on a deeply nested AST', () => {
+    // A hand-built/corrupt AST can be arbitrarily deep; the count must be
+    // iterative so a deep chain never blows the call stack. 100k deep would
+    // overflow naive recursion.
+    const depth = 100_000;
+    let node: ViewNode = text('leaf');
+    for (let i = 0; i < depth; i++) node = el('wrap', [node]);
+    // depth wrapping elements + the leaf text node.
+    expect(() => countNodes(node)).not.toThrow();
+    expect(countNodes(node)).toBe(depth + 1);
+  });
 });
 
 describe('view vocabulary integrity', () => {

package/src/view-renderer.ts

@@ -188,8 +188,22 @@ export const DEFAULT_VIEW_TAGS: ReadonlyArray<ViewTagSpec> = [...VIEW_PRIMITIVES
  * Count element + text nodes in a view tree (the `nodeCount` a `present_view`
  * tool reports). Single source of truth: core's parser and the plugin-view tool
  * both import this rather than re-implementing the recursion.
+ *
+ * Iterative (explicit stack) rather than recursive: a deeply nested
+ * hand-built/corrupt AST would blow the call stack with a `RangeError`, and this
+ * runs on untrusted agent-authored input. Each node counts as 1; an element's
+ * children are pushed for later counting. Order-independent (we only sum), so
+ * the count is byte-identical to the old recursion for any normal tree.
  */
 export function countNodes(node: ViewNode): number {
-  if (node.kind === 'text') return 1;
-  return 1 + node.children.reduce((sum, child) => sum + countNodes(child), 0);
+  let count = 0;
+  const stack: ViewNode[] = [node];
+  while (stack.length > 0) {
+    const current = stack.pop()!;
+    count += 1;
+    if (current.kind === 'element') {
+      for (const child of current.children) stack.push(child);
+    }
+  }
+  return count;
 }