@pi-harness/pi-harness 0.1.21 → 0.1.23

package/node_modules/@pi-harness/api-gateway/dist/index.js

@@ -1,25 +1,39 @@
 import { execFile } from "node:child_process";
-import { mkdir, mkdtemp, readFile, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { basename, isAbsolute, join, relative, resolve } from "node:path";
+import { mkdir, mkdtemp, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
+import { atomicWriteFile } from "@pi-harness/core";
 import { MARKETPLACE_CAPABILITIES, MARKETPLACE_CATEGORIES, MARKETPLACE_PLUGINS, attachMarketplaceStatistics, createMarketplaceStatisticsLoader, paginateMarketplace, searchMarketplace, needsMarketplacePackageInstall, sortMarketplaceByRecommendation, } from "./marketplace.js";
 import { parseGitWorktrees } from "./workspaces.js";
 const loadMarketplaceStatistics = createMarketplaceStatisticsLoader();
+const DEFAULT_BODY_LIMIT_BYTES = 64 * 1024;
+const IMPORT_CONTENT_LIMIT_BYTES = 10 * 1024 * 1024;
+// The import body carries the JSONL content as a JSON string, so quotes and newlines are escaped; leave headroom above the content limit for that overhead.
+const IMPORT_BODY_LIMIT_BYTES = 16 * 1024 * 1024;
+// Retained trajectory events are replayed to every SSE client and returned by /api/session, so the array must stay bounded.
+const MAX_RETAINED_EVENTS = 2000;
+const GIT_TIMEOUT_MS = 15_000;
+class PayloadTooLargeError extends Error {
+    constructor() {
+        super("Request body is too large");
+        this.name = "PayloadTooLargeError";
+    }
+}
 function sendJson(response, status, payload) {
     const body = JSON.stringify(payload);
     response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", "content-length": Buffer.byteLength(body) });
     response.end(body);
 }
-async function bodyText(request) {
+async function bodyText(request, maxBytes = DEFAULT_BODY_LIMIT_BYTES) {
     const chunks = [];
     let length = 0;
     for await (const chunk of request) {
         const input = chunk;
         const value = typeof input === "string" ? input : Buffer.from(input).toString("utf8");
         length += Buffer.byteLength(value);
-        if (length > 64 * 1024)
-            throw new Error("Request body is too large");
+        if (length > maxBytes)
+            throw new PayloadTooLargeError();
         chunks.push(value);
     }
     return chunks.join("");
@@ -106,26 +120,63 @@ function piConfig(services) {
 function sessionMetadataFile(manager) {
     return resolve(manager.getSessionDir(), ".pi-harness-session-meta.json");
 }
-async function readSessionMetadata(manager) {
+// A missing file is the normal first-run state. Any other read or parse failure means the file exists but is unusable; it is renamed aside so the wreckage survives for recovery and the next write cannot silently replace the only copy.
+async function readSessionMetadata(manager, logger) {
+    const file = sessionMetadataFile(manager);
+    let raw;
     try {
-        const parsed = JSON.parse(await readFile(sessionMetadataFile(manager), "utf8"));
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        raw = await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
             return {};
+        await quarantineSessionMetadata(file, logger, error);
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("session metadata must be a JSON object");
         return parsed;
     }
-    catch {
+    catch (error) {
+        await quarantineSessionMetadata(file, logger, error);
         return {};
     }
 }
+async function quarantineSessionMetadata(file, logger, error) {
+    const quarantined = `${file}.corrupt-${Date.now()}`;
+    try {
+        await rename(file, quarantined);
+        logger.warn(`Session metadata at ${file} is unreadable (${errorText(error)}); moved it to ${quarantined} and starting from an empty map`);
+    }
+    catch (renameError) {
+        logger.warn(`Session metadata at ${file} is unreadable (${errorText(error)}) and could not be quarantined: ${errorText(renameError)}`);
+    }
+}
 async function writeSessionMetadata(manager, metadata) {
     await mkdir(manager.getSessionDir(), { recursive: true });
-    await writeFile(sessionMetadataFile(manager), JSON.stringify(metadata, null, 2) + "\n", "utf8");
+    await atomicWriteFile(sessionMetadataFile(manager), JSON.stringify(metadata, null, 2) + "\n", { encoding: "utf8" });
+}
+// Every read-modify-write of the metadata file runs through this chain so concurrent requests cannot interleave and drop each other's updates.
+let sessionMetadataQueue = Promise.resolve();
+function mutateSessionMetadata(manager, logger, mutate) {
+    const operation = sessionMetadataQueue
+        .catch(() => undefined)
+        .then(async () => {
+        const metadata = await readSessionMetadata(manager, logger);
+        const result = await mutate(metadata);
+        await writeSessionMetadata(manager, metadata);
+        return result;
+    });
+    sessionMetadataQueue = operation;
+    return operation;
 }
 function sessionPathInDirectory(path, manager) {
     const root = resolve(manager.getSessionDir());
     const target = resolve(path);
     const relativePath = relative(root, target);
-    return relativePath !== "" && !isAbsolute(relativePath) && relativePath !== ".." && !relativePath.startsWith(".." + "/") && target.endsWith(".jsonl");
+    return relativePath !== "" && !isAbsolute(relativePath) && relativePath !== ".." && !relativePath.startsWith(".." + sep) && target.endsWith(".jsonl");
 }
 const webSessionUi = {
     select: (_title, options) => Promise.resolve(options[0]),
@@ -412,21 +463,52 @@ async function updateMarketplaceProfile(configPath, entryId, update) {
 function writeSse(response, payload) {
     response.write(`data: ${JSON.stringify(jsonSafe(payload))}\n\n`);
 }
+// Node reports a maxBuffer overflow through a string error code and a timeout through `killed`; neither is a git exit status, so they must not be folded into an ordinary non-zero exit.
+function gitTermination(error) {
+    if (error === null)
+        return undefined;
+    if (error.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER")
+        return "output-limit";
+    if (error.killed === true)
+        return "timeout";
+    return undefined;
+}
+function gitTerminationMessage(command, termination) {
+    return termination === "timeout"
+        ? `git ${command} timed out after ${GIT_TIMEOUT_MS / 1000} seconds`
+        : `git ${command} produced more output than the buffer limit allows`;
+}
 function gitStatus(cwd) {
-    return new Promise((resolve) => {
-        execFile("git", ["status", "--short", "--untracked-files=all"], { cwd, maxBuffer: 512 * 1024 }, (error, stdout) => resolve(error ? "" : stdout));
+    return new Promise((resolveStatus, rejectStatus) => {
+        execFile("git", ["status", "--short", "--untracked-files=all"], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 }, (error, stdout, stderr) => {
+            if (error === null) {
+                resolveStatus({ output: stdout, truncated: false });
+                return;
+            }
+            const termination = gitTermination(error);
+            if (termination === "output-limit") {
+                // Keep the complete lines that arrived before the kill; the final line may have been cut mid-path.
+                resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\n") + 1), truncated: true });
+                return;
+            }
+            if (termination === undefined && error.code === 128 && /not a git repository/i.test(stderr)) {
+                resolveStatus({ output: "", truncated: false });
+                return;
+            }
+            rejectStatus(new Error(termination ? gitTerminationMessage("status", termination) : stderr.trim() || error.message, { cause: error }));
+        });
     });
 }
 function gitDiff(cwd, path) {
     return new Promise((resolveOutput) => {
-        execFile("git", ["diff", "--no-ext-diff", "--", path], { cwd, maxBuffer: 1024 * 1024 }, (error, stdout) => resolveOutput(error && stdout.length === 0 ? "" : stdout));
+        execFile("git", ["diff", "--no-ext-diff", "--", path], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 1024 * 1024 }, (error, stdout) => resolveOutput(error && stdout.length === 0 ? "" : stdout));
     });
 }
 function gitCommand(cwd, args) {
     return new Promise((resolveResult) => {
-        execFile("git", [...args], { cwd, maxBuffer: 2 * 1024 * 1024 }, (error, stdout, stderr) => {
+        execFile("git", [...args], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 2 * 1024 * 1024 }, (error, stdout, stderr) => {
             const code = error && typeof error.code === "number" ? error.code : error ? 1 : 0;
-            resolveResult({ stdout, stderr, code });
+            resolveResult({ stdout, stderr, code, terminated: gitTermination(error) });
         });
     });
 }
@@ -503,7 +585,12 @@ export default {
         const events = [];
         const eventClients = new Set();
         const handleEvent = (event) => {
-            events.push(event);
+            // Streaming deltas reach clients live over SSE and each one carries the whole partial message, so only durable events are retained for snapshots.
+            if (event.type !== "message_update") {
+                events.push(event);
+                if (events.length > MAX_RETAINED_EVENTS)
+                    events.splice(0, events.length - MAX_RETAINED_EVENTS);
+            }
             for (const response of eventClients) {
                 if (response.writableEnded || response.destroyed) {
                     eventClients.delete(response);
@@ -639,7 +726,9 @@ export default {
                         return;
                     }
                     const path = join(services.launch.agentDir, "settings.json");
-                    await writeFile(path, JSON.stringify(parsed, null, 2) + "\n", "utf8");
+                    // Replace the file atomically so an interrupted write never leaves a truncated settings.json behind; keep the existing permission bits.
+                    const mode = await stat(path).then((info) => info.mode & 0o777, () => 0o644);
+                    await atomicWriteFile(path, JSON.stringify(parsed, null, 2) + "\n", { encoding: "utf8", mode });
                     await services.runtime.session.settingsManager.reload();
                     sendJson(response, 200, piConfig(services));
                 }
@@ -1149,8 +1238,15 @@ export default {
         const disposeFiles = services.webServer.register({
             path: "/api/files",
             async handler(_request, response) {
-                const output = await gitStatus(activeCwd(services));
-                const items = output
+                let status;
+                try {
+                    status = await gitStatus(activeCwd(services));
+                }
+                catch (error) {
+                    sendJson(response, 500, { error: errorText(error) });
+                    return;
+                }
+                const items = status.output
                     .split("\n")
                     .map((line) => line.trimEnd())
                     .filter((line) => line.length > 0)
@@ -1162,7 +1258,7 @@ export default {
                         label: status === "??" ? "untracked" : status.includes("D") ? "deleted" : status.includes("A") ? "added" : "modified",
                     };
                 });
-                sendJson(response, 200, { items });
+                sendJson(response, 200, { items, ...(status.truncated ? { truncated: true } : {}) });
             },
         });
         const disposeFileDiff = services.webServer.register({
@@ -1181,7 +1277,7 @@ export default {
                 const root = resolve(activeCwd(services));
                 const absolute = resolve(root, requested);
                 const relativePath = relative(root, absolute);
-                if (isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith(".." + "/")) {
+                if (isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith(".." + sep)) {
                     sendJson(response, 400, { error: "path must stay inside the workspace" });
                     return;
                 }
@@ -1208,11 +1304,19 @@ export default {
                     }
                     const root = resolve(activeCwd(services));
                     const add = await gitCommand(root, ["add", "-A", "--", ...paths]);
+                    if (add.terminated) {
+                        sendJson(response, 500, { error: gitTerminationMessage("add", add.terminated) });
+                        return;
+                    }
                     if (add.code !== 0) {
                         sendJson(response, 409, { error: add.stderr.trim() || "Unable to stage workspace files" });
                         return;
                     }
                     const commit = await gitCommand(root, ["commit", "-m", payload.message.trim(), "--", ...paths]);
+                    if (commit.terminated) {
+                        sendJson(response, 500, { error: gitTerminationMessage("commit", commit.terminated) });
+                        return;
+                    }
                     if (commit.code !== 0) {
                         sendJson(response, 409, { error: commit.stdout.trim() || commit.stderr.trim() || "Nothing to commit" });
                         return;
@@ -1244,16 +1348,39 @@ export default {
                         sendJson(response, 400, { error: paths.message });
                         return;
                     }
-                    const untracked = await gitCommand(root, ["ls-files", "--others", "--exclude-standard", "--", ...paths]);
-                    const restore = await gitCommand(root, ["restore", "--worktree", "--staged", "--", ...paths]);
-                    if (restore.code !== 0 && !restore.stderr.includes("pathspec")) {
-                        sendJson(response, 409, { error: restore.stderr.trim() || "Unable to restore workspace files" });
+                    const untracked = await gitCommand(root, ["ls-files", "-z", "--others", "--exclude-standard", "--", ...paths]);
+                    // `git restore` refuses the whole request when any pathspec is unknown to it, so restore only the paths git tracks. `--with-tree=HEAD` keeps staged deletions in the list; it fails on an unborn HEAD, where the plain index listing is all there is.
+                    let tracked = await gitCommand(root, ["ls-files", "-z", "--with-tree=HEAD", "--", ...paths]);
+                    if (tracked.code !== 0 && tracked.terminated === undefined)
+                        tracked = await gitCommand(root, ["ls-files", "-z", "--", ...paths]);
+                    const listing = [untracked, tracked].find((result) => result.terminated !== undefined || result.code !== 0);
+                    if (listing) {
+                        if (listing.terminated)
+                            sendJson(response, 500, { error: gitTerminationMessage("ls-files", listing.terminated) });
+                        else
+                            sendJson(response, 409, { error: listing.stderr.trim() || "Unable to inspect workspace files" });
+                        return;
+                    }
+                    const untrackedPaths = untracked.stdout.split("\0").filter(Boolean);
+                    const trackedPaths = tracked.stdout.split("\0").filter(Boolean);
+                    const known = [...untrackedPaths, ...trackedPaths];
+                    const unknown = paths.filter((path) => !known.some((candidate) => candidate === path || candidate.startsWith(path + "/")));
+                    if (unknown.length > 0) {
+                        sendJson(response, 409, { error: `Paths did not match any file known to git: ${unknown.join(", ")}` });
                         return;
                     }
-                    for (const path of untracked.stdout
-                        .split("\n")
-                        .map((item) => item.trim())
-                        .filter(Boolean)) {
+                    if (trackedPaths.length > 0) {
+                        const restore = await gitCommand(root, ["restore", "--worktree", "--staged", "--", ...trackedPaths]);
+                        if (restore.terminated) {
+                            sendJson(response, 500, { error: gitTerminationMessage("restore", restore.terminated) });
+                            return;
+                        }
+                        if (restore.code !== 0) {
+                            sendJson(response, 409, { error: restore.stderr.trim() || "Unable to restore workspace files" });
+                            return;
+                        }
+                    }
+                    for (const path of untrackedPaths) {
                         await rm(resolve(root, path), { recursive: true, force: true });
                     }
                     sendJson(response, 200, { reverted: true, paths });
@@ -1291,6 +1418,10 @@ export default {
         const disposePrompt = services.webServer.register({
             path: "/api/prompt",
             async handler(request, response) {
+                if (request.method !== "POST") {
+                    sendJson(response, 405, { error: "Method not allowed" });
+                    return;
+                }
                 if (busy) {
                     sendJson(response, 409, { error: "Another prompt is already running" });
                     return;
@@ -1541,9 +1672,9 @@ export default {
                         events.length = 0;
                     }
                     await unlink(path);
-                    const metadata = await readSessionMetadata(manager);
-                    delete metadata[path];
-                    await writeSessionMetadata(manager, metadata);
+                    await mutateSessionMetadata(manager, context.logger, (metadata) => {
+                        delete metadata[path];
+                    });
                     sendJson(response, 200, { deleted: true, path, sessionFile: services.runtime.session.sessionFile });
                 }
                 catch (error) {
@@ -1566,16 +1697,17 @@ export default {
                         sendJson(response, 400, { error: "Invalid session path" });
                         return;
                     }
-                    const metadata = await readSessionMetadata(manager);
-                    const currentMetadata = metadata[path] ?? {};
-                    const nextMetadata = {
-                        ...currentMetadata,
-                        ...(payload.archived === undefined ? {} : { archived: payload.archived === true }),
-                        ...(payload.pinned === undefined ? {} : { pinned: payload.pinned === true }),
-                    };
-                    metadata[path] = nextMetadata;
-                    await writeSessionMetadata(manager, metadata);
-                    sendJson(response, 200, { path, metadata: metadata[path] });
+                    const nextMetadata = await mutateSessionMetadata(manager, context.logger, (metadata) => {
+                        const currentMetadata = metadata[path] ?? {};
+                        const updated = {
+                            ...currentMetadata,
+                            ...(payload.archived === undefined ? {} : { archived: payload.archived === true }),
+                            ...(payload.pinned === undefined ? {} : { pinned: payload.pinned === true }),
+                        };
+                        metadata[path] = updated;
+                        return updated;
+                    });
+                    sendJson(response, 200, { path, metadata: nextMetadata });
                 }
                 catch (error) {
                     sendJson(response, 400, { error: errorText(error) });
@@ -1612,22 +1744,22 @@ export default {
                         sendJson(response, 409, { error: "Cannot batch-delete the active session" });
                         return;
                     }
-                    const metadata = await readSessionMetadata(manager);
-                    for (const path of paths) {
-                        if (action === "delete") {
-                            await unlink(path);
-                            delete metadata[path];
-                        }
-                        else {
-                            const current = metadata[path] ?? {};
-                            metadata[path] = {
-                                ...current,
-                                ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
-                                ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
-                            };
+                    await mutateSessionMetadata(manager, context.logger, async (metadata) => {
+                        for (const path of paths) {
+                            if (action === "delete") {
+                                await unlink(path);
+                                delete metadata[path];
+                            }
+                            else {
+                                const current = metadata[path] ?? {};
+                                metadata[path] = {
+                                    ...current,
+                                    ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
+                                    ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
+                                };
+                            }
                         }
-                    }
-                    await writeSessionMetadata(manager, metadata);
+                    });
                     sendJson(response, 200, { action, count: paths.length });
                 }
                 catch (error) {
@@ -1677,11 +1809,16 @@ export default {
                     return;
                 }
                 try {
-                    const payload = JSON.parse(await bodyText(request));
+                    const payload = JSON.parse(await bodyText(request, IMPORT_BODY_LIMIT_BYTES));
                     const suppliedPath = typeof payload.path === "string" ? payload.path : "";
                     const content = typeof payload.content === "string" ? payload.content : undefined;
-                    if ((!suppliedPath || !isAbsolute(suppliedPath)) && content === undefined) {
-                        sendJson(response, 400, { error: "A JSONL file path or file content is required" });
+                    // `path` reads an existing file and `content` is written to a private temporary file; accepting both would let the request choose where the content lands.
+                    if (suppliedPath && content !== undefined) {
+                        sendJson(response, 400, { error: "Provide either a JSONL file path or file content, not both" });
+                        return;
+                    }
+                    if (content === undefined && (!suppliedPath || !isAbsolute(suppliedPath) || !suppliedPath.endsWith(".jsonl"))) {
+                        sendJson(response, 400, { error: "An absolute .jsonl file path or file content is required" });
                         return;
                     }
                     const manager = services.runtime.session.sessionManager;
@@ -1691,11 +1828,12 @@ export default {
                     }
                     const targetCwd = typeof payload.cwd === "string" && payload.cwd.trim() ? resolve(payload.cwd) : activeCwd(services);
                     const temporaryDirectory = content === undefined ? undefined : await mkdtemp(join(tmpdir(), "pi-harness-import-"));
-                    const importPath = suppliedPath ||
-                        join(temporaryDirectory, basename(typeof payload.filename === "string" && payload.filename.trim() ? payload.filename : "import.jsonl"));
+                    const requestedName = basename(typeof payload.filename === "string" && payload.filename.trim() ? payload.filename : "import.jsonl");
+                    const importName = requestedName === "" || requestedName === "." || requestedName === ".." ? "import.jsonl" : requestedName;
+                    const importPath = temporaryDirectory === undefined ? suppliedPath : join(temporaryDirectory, importName);
                     try {
                         if (content !== undefined) {
-                            if (Buffer.byteLength(content, "utf8") > 10 * 1024 * 1024) {
+                            if (Buffer.byteLength(content, "utf8") > IMPORT_CONTENT_LIMIT_BYTES) {
                                 sendJson(response, 413, { error: "Imported session must be at most 10 MiB" });
                                 return;
                             }
@@ -1723,7 +1861,7 @@ export default {
                     }
                 }
                 catch (error) {
-                    sendJson(response, 400, { error: errorText(error) });
+                    sendJson(response, error instanceof PayloadTooLargeError ? 413 : 400, { error: errorText(error) });
                 }
             },
         });
@@ -1761,7 +1899,7 @@ export default {
                     const page = Math.max(0, Number.parseInt(url.searchParams.get("page") ?? "0", 10) || 0);
                     const pageSize = Math.min(100, Math.max(1, Number.parseInt(url.searchParams.get("pageSize") ?? "50", 10) || 50));
                     const includeArchived = url.searchParams.get("includeArchived") === "true";
-                    const metadata = await readSessionMetadata(manager);
+                    const metadata = await readSessionMetadata(manager, context.logger);
                     const items = typeof manager.isPersisted === "function" && manager.isPersisted() ? await SessionManager.list(services.launch.cwd, manager.getSessionDir()) : [];
                     const filtered = items.filter((item) => includeArchived || metadata[item.path]?.archived !== true);
                     const sorted = filtered.sort((a, b) => Number(metadata[b.path]?.pinned === true) - Number(metadata[a.path]?.pinned === true) || b.modified.getTime() - a.modified.getTime());