@neuralnomads/codenomad-dev 0.18.0-dev-20260715-07e8ce68 → 0.18.0-dev-20260716-40cee071

package/dist/workspaces/launch-cleanup.js

@@ -0,0 +1,132 @@
+export const LAUNCH_CLEANUP_TOKEN_ENV = "CODENOMAD_LAUNCH_CLEANUP_TOKEN";
+const LINUX_TOKEN_PROBE_SCRIPT = String.raw `
+boot=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null) || exit 20
+key=$1; expected=$2
+matches_token() {
+  test -r "/proc/$1/environ" || return 1
+  tr '\0' '\n' < "/proc/$1/environ" 2>/dev/null | grep -Fqx -- "$key=$expected"
+}
+read_stat() {
+  line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1
+  stat_pid=$(printf '%s\n' "$line" | cut -d' ' -f1); rest=$(printf '%s\n' "$line" | sed 's/^.*) //'); set -- $rest
+  stat_ppid=$2; stat_group=$3; stat_start=$20
+}
+for environ in /proc/[0-9]*/environ; do
+  pid=$(basename "$(dirname "$environ")")
+  if matches_token "$pid" && read_stat "$pid"; then
+    printf '%s|%s|%s|%s|%s|%s\n' "$stat_pid" "$stat_ppid" "$stat_group" "$stat_start" "$boot" "$stat_start"
+  fi
+done
+`;
+const LINUX_TOKEN_SIGNAL_SCRIPT = String.raw `
+boot=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null) || exit 20
+key=$1; expected=$2; requested_signal=$3
+matches_token() {
+  test -r "/proc/$1/environ" || return 1
+  tr '\0' '\n' < "/proc/$1/environ" 2>/dev/null | grep -Fqx -- "$key=$expected"
+}
+read_stat() {
+  line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1
+  stat_pid=$(printf '%s\n' "$line" | cut -d' ' -f1); rest=$(printf '%s\n' "$line" | sed 's/^.*) //'); set -- $rest
+  stat_ppid=$2; stat_group=$3; stat_start=$20
+}
+signal_sent=0
+# Repeat inside the one bounded adapter so children forked by a signaled parent are selected too.
+for pass in 1 2 3; do
+  for environ in /proc/[0-9]*/environ; do
+    pid=$(basename "$(dirname "$environ")")
+    if matches_token "$pid" && read_stat "$pid"; then
+      printf 'CODENOMAD_TARGET|%s|%s|%s|%s|%s|%s\n' "$stat_pid" "$stat_ppid" "$stat_group" "$stat_start" "$boot" "$stat_start"
+      if matches_token "$pid" && read_stat "$pid" && kill "-$requested_signal" "$pid" 2>/dev/null; then signal_sent=1; fi
+    fi
+  done
+done
+printf 'CODENOMAD_RESULT|%s\n' "$signal_sent"
+`;
+function failure(result, token) {
+    const message = result.error?.message || `launch cleanup command failed with exit code ${result.status}`;
+    return token ? redactToken(message, token) : message;
+}
+function redactToken(value, token) {
+    return value.split(token).join("[REDACTED]");
+}
+function parseIdentity(line) {
+    const fields = line.split("|");
+    if (fields.length !== 6)
+        return null;
+    const [pidText = "", parentPidText = "", groupIdText = "", startTime = "", bootId = "", startOrder = ""] = fields;
+    if (!/^\d+$/.test(pidText) || !/^\d+$/.test(parentPidText) || !/^\d+$/.test(groupIdText) ||
+        !startTime || !bootId || !/^\d+$/.test(startOrder))
+        return null;
+    const pid = Number.parseInt(pidText, 10);
+    const parentPid = Number.parseInt(parentPidText, 10);
+    const groupId = Number.parseInt(groupIdText, 10);
+    if (pid <= 0 || parentPid < 0 || groupId <= 0)
+        return null;
+    return { pid, parentPid, groupId, startTime, bootId, startOrder };
+}
+function runLinux(spawnCommand, script, args, timeoutMs, distro) {
+    return distro
+        ? spawnCommand("wsl.exe", ["--distribution", distro, "--exec", "sh", "-c", script, "codenomad-token-cleanup", ...args], {
+            encoding: "utf8",
+            timeout: timeoutMs,
+        })
+        : spawnCommand("sh", ["-c", script, "codenomad-token-cleanup", ...args], { encoding: "utf8", timeout: timeoutMs });
+}
+export function probeLaunchCleanupToken(spawnCommand, token, timeoutMs, distro) {
+    try {
+        const result = runLinux(spawnCommand, LINUX_TOKEN_PROBE_SCRIPT, [LAUNCH_CLEANUP_TOKEN_ENV, token], timeoutMs, distro);
+        if (result.status !== 0)
+            return { ok: false, error: failure(result, token) };
+        const processes = new Map();
+        for (const line of String(result.stdout ?? "").split(/\r?\n/)) {
+            if (!line)
+                continue;
+            const identity = parseIdentity(line);
+            if (!identity)
+                return { ok: false, error: "launch cleanup probe returned a malformed identity record" };
+            processes.set(identity.pid, identity);
+        }
+        return { ok: true, processes };
+    }
+    catch (error) {
+        return { ok: false, error: redactToken(error instanceof Error ? error.message : String(error), token) };
+    }
+}
+export function signalLaunchCleanupToken(spawnCommand, token, signal, timeoutMs, distro) {
+    try {
+        const signalName = signal === "SIGKILL" ? "KILL" : "TERM";
+        const result = runLinux(spawnCommand, LINUX_TOKEN_SIGNAL_SCRIPT, [LAUNCH_CLEANUP_TOKEN_ENV, token, signalName], timeoutMs, distro);
+        if (result.status !== 0)
+            return { ok: false, signalSent: false, targets: [], error: failure(result, token) };
+        const targets = new Map();
+        let signalSent;
+        for (const line of String(result.stdout ?? "").split(/\r?\n/)) {
+            if (!line)
+                continue;
+            if (line.startsWith("CODENOMAD_TARGET|")) {
+                const identity = parseIdentity(line.slice("CODENOMAD_TARGET|".length));
+                if (!identity)
+                    return { ok: false, signalSent: false, targets: [], error: "launch cleanup signal returned a malformed target record" };
+                targets.set(identity.pid, identity);
+                continue;
+            }
+            if (line === "CODENOMAD_RESULT|0" || line === "CODENOMAD_RESULT|1") {
+                signalSent = line.endsWith("1");
+                continue;
+            }
+            return { ok: false, signalSent: false, targets: [], error: "launch cleanup signal returned unexpected output" };
+        }
+        return signalSent === undefined
+            ? { ok: false, signalSent: false, targets: [], error: "launch cleanup signal returned no structured result" }
+            : { ok: true, signalSent, targets: Array.from(targets.values()) };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            signalSent: false,
+            targets: [],
+            error: redactToken(error instanceof Error ? error.message : String(error), token),
+        };
+    }
+}

package/dist/workspaces/launch-cleanup.test.js

@@ -0,0 +1,33 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { LAUNCH_CLEANUP_TOKEN_ENV, probeLaunchCleanupToken, signalLaunchCleanupToken, } from "./launch-cleanup";
+function result(stdout = "", status = 0, stderr = "") {
+    return { pid: 1, output: [null, stdout, stderr], stdout, stderr, status, signal: null };
+}
+describe("launch cleanup token adapter", () => {
+    it("passes the exact token to a bounded Linux environ probe", () => {
+        const token = "a".repeat(64);
+        let invocation;
+        const probe = probeLaunchCleanupToken(((command, args, options) => {
+            invocation = { command, args, timeout: options.timeout };
+            return result("5000|1|4242|150|boot-a|150\n");
+        }), token, 25);
+        assert.equal(probe.ok && probe.processes.get(5000)?.startOrder, "150");
+        assert.equal(invocation?.command, "sh");
+        assert.equal(invocation?.timeout, 25);
+        assert.ok(invocation?.args.includes(LAUNCH_CLEANUP_TOKEN_ENV));
+        assert.ok(invocation?.args.includes(token));
+        assert.match(invocation?.args[1] ?? "", /\/proc\/\$1\/environ/);
+    });
+    it("signals every exact-token target returned by the bounded adapter", () => {
+        const cleanup = signalLaunchCleanupToken((() => result("CODENOMAD_TARGET|4242|1|4242|100|boot-a|100\n" +
+            "CODENOMAD_TARGET|5000|1|4242|150|boot-a|150\n" +
+            "CODENOMAD_RESULT|1\n")), "b".repeat(64), "SIGKILL", 25);
+        assert.equal(cleanup.ok, true);
+        assert.deepEqual(cleanup.targets.map((target) => target.pid), [4242, 5000]);
+    });
+    it("rejects malformed cleanup records conservatively", () => {
+        const probe = probeLaunchCleanupToken((() => result("5000|1|4242|150|boot-a|150|truncated\n")), "c".repeat(64), 25);
+        assert.equal(probe.ok, false);
+    });
+});