@proflandrigan/shards 1.1.0

package/src/ui/cc-readonly.js

@@ -0,0 +1,181 @@
+'use strict';
+
+// Replicates Claude Code's built-in read-only classifier. The UI's intercept
+// path checks only .claude/settings.json allow rules, so CC's built-in
+// read-only commands wrongly surface as permission cards. This module mirrors
+// CC's built-in set so those commands auto-approve.
+
+// Tools that CC treats as read-only built-ins in every permission mode.
+const CC_READONLY_TOOLS = new Set([
+  'Read', 'Glob', 'Grep', 'WebSearch',
+]);
+
+// Bash command prefixes that CC treats as read-only built-ins.
+// Matched as: command.trim() === prefix || command.startsWith(prefix + ' ')
+const CC_READONLY_BASH_PREFIXES = [
+  // Bare read-only commands (from the install.js built-ins comment)
+  'ls', 'cat', 'echo', 'pwd', 'head', 'tail', 'grep', 'find', 'wc',
+  'which', 'diff', 'stat', 'du', 'cd',
+  // Read-only git forms (from READONLY_PRESET). Only subcommand forms that
+  // cannot mutate refs/config are listed: bare `git branch`/`git tag`/
+  // `git remote` also match `-d`, `-D`, `-m`, `-M`, `add`, `remove`,
+  // `set-url`, and positional-arg creation, so they must NOT be treated as
+  // read-only.
+  'git status',
+  'git log',
+  'git diff',
+  'git show',
+  'git rev-parse',
+  'git stash list',
+  'git branch --list',
+  'git branch -a',
+  'git branch -r',
+  'git branch -v',
+  'git branch -vv',
+  'git branch --remotes',
+  'git branch --merged',
+  'git branch --no-merged',
+  'git branch --show-current',
+  'git branch --contains',
+  'git tag --list',
+  'git tag -l',
+  'git remote -v',
+  'git remote get-url',
+  'git remote show',
+];
+
+// Bash patterns that indicate destructive intent. Even if a more permissive
+// prefix matches above, these veto the auto-approval. Belt-and-braces.
+const DESTRUCTIVE_MARKERS = [
+  /\brm\b/, /\bmv\b/, /\bcp\s+-/, // basic destructive
+  />\s*[^|]/,                       // shell redirect to file
+  />>\s*/,                          // append redirect
+  /\bsudo\b/,
+  /\bcurl\b/, /\bwget\b/,           // network fetches that may exfiltrate
+  /\|\s*sh\b/, /\|\s*bash\b/,       // pipe-to-shell
+  /\$\([^)]/,                       // command substitution — bail (could hide anything)
+  /`[^`]/,                          // backtick command substitution
+  // find — -delete and -exec/-execdir/-ok/-okdir run arbitrary (often
+  // destructive) work with no `rm`/`;` present to trip the other markers;
+  // -fprint/-fprint0/-fprintf/-fls write output to a file (path-controlled
+  // write). `-ok` must not match `-okdir` (its exec-per-file prompt sibling),
+  // and `-fprint` must not match `-fprintf`, so each is listed separately;
+  // `-printf`/`-ls`/`-print0` (stdout-only forms) stay read-only.
+  /\s-delete\b/,
+  /\s-exec\b/,
+  /\s-execdir\b/,
+  /\s-ok\b/,
+  /\s-okdir\b/,
+  /\s-fprint(?:0)?\b/,
+  /\s-fprintf\b/,
+  /\s-fls\b/,
+  // git branch — the `-v`/`-vv` listing forms silently become CREATES when a
+  // bare branch name follows (`git branch -v feature` creates `feature`).
+  // Listing with `-v`/`-vv` never takes a positional, so any non-option token
+  // right after them is a create intent.
+  /\bgit\s+branch\s+-v+\s+[^\s-]/,
+  // git diff/show/log — --output=FILE / --output FILE / -o FILE silently
+  // writes a patch file. `--output-indicator-*` (a read-only diff styling
+  // flag) must not match.
+  /--output(?=\s|=)/,
+  /\bgit\s+(?:diff|show|log)\b[^\n]*\s-o(?=\s*\S)/,
+];
+
+// Compound separator detection — a single allow shouldn't authorize
+// `safe-cmd && rm -rf /`. If we see compound separators, bail.
+// Covers `&&`, `||`, `;`, `|`, a lone backgrounding `&` (`cat x & rm ...`),
+// and a literal newline (a command separator in bash when the model emits a
+// multi-line tool call). `&&`/`||` are matched by their own alternatives so
+// lone `&`/`|` (e.g. inside `$((..))` arithmetic) can't double-match.
+const COMPOUND_SEPARATORS = /(\&\&|\|\||[;&\n]|\|(?!\|))/;
+
+function isReadOnlyTool(toolName) {
+  if (!toolName) return false;
+  return CC_READONLY_TOOLS.has(toolName);
+}
+
+// Mask literal quoted spans so the veto scanners don't fire on them (used by
+// isCcReadOnlyBash). Single quotes are fully literal to bash — mask through
+// the closing quote. Double quotes are masked only when the span contains no
+// `$`, backtick, or backslash, since those can still trigger expansion or
+// command substitution inside the quotes.
+function maskQuotedRegions(cmd) {
+  let out = '';
+  for (let i = 0; i < cmd.length; i++) {
+    const ch = cmd[i];
+    if (ch === "'") {
+      const end = cmd.indexOf("'", i + 1);
+      const stop = end === -1 ? cmd.length : end + 1;
+      out += ' '.repeat(stop - i);
+      i = stop - 1;
+    } else if (ch === '"') {
+      const end = cmd.indexOf('"', i + 1);
+      if (end === -1) {
+        out += ch;
+        continue;
+      }
+      const span = cmd.slice(i + 1, end);
+      if (!/[$`\\]/.test(span)) {
+        out += ' '.repeat(end - i + 1);
+        i = end;
+      } else {
+        out += ch;
+      }
+    } else {
+      out += ch;
+    }
+  }
+  return out;
+}
+
+function isCcReadOnlyBash(command) {
+  if (typeof command !== 'string') return false;
+  const cmd = command.trim();
+  if (!cmd) return false;
+
+  // Veto scans run over the whole command string, so skip literal spans:
+  // `grep 'rm' file` and `echo "a|b"` are read-only and must not be vetoed by
+  // word matches inside quoted text. Everything inside single quotes is
+  // literal to bash (mask outright). Double quotes only mask when the span
+  // can't execute anything — a `$`, backtick, or backslash inside double
+  // quotes can still run expansion/command substitution, so those spans stay
+  // visible to the veto scanners.
+  const masked = maskQuotedRegions(cmd);
+
+  // Reject compound commands outright.
+  if (COMPOUND_SEPARATORS.test(masked)) return false;
+
+  // Destructive markers veto.
+  for (const re of DESTRUCTIVE_MARKERS) {
+    if (re.test(masked)) return false;
+  }
+
+  // Prefix match against the read-only list.
+  for (const prefix of CC_READONLY_BASH_PREFIXES) {
+    if (cmd === prefix) return true;
+    if (cmd.startsWith(prefix + ' ')) return true;
+  }
+
+  return false;
+}
+
+function isCcReadOnlyAutoApprovable(toolName, toolInput) {
+  if (!toolName) return false;
+
+  // Always-safe tools
+  if (isReadOnlyTool(toolName)) return true;
+
+  if (toolName !== 'Bash') return false;
+  if (!toolInput || typeof toolInput.command !== 'string') return false;
+
+  return isCcReadOnlyBash(toolInput.command);
+}
+
+module.exports = {
+  CC_READONLY_TOOLS,
+  CC_READONLY_BASH_PREFIXES,
+  isReadOnlyTool,
+  isCcReadOnlyBash,
+  isCcReadOnlyAutoApprovable,
+  maskQuotedRegions,
+};

package/src/ui/chat-session.js

@@ -0,0 +1,466 @@
+'use strict';
+
+const { spawn } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const { randomUUID } = require('crypto');
+
+const LOG_FILE = path.join(process.cwd(), '.shards', 'ui.log');
+
+function log(msg) {
+  const ts = new Date().toISOString();
+  try { fs.appendFileSync(LOG_FILE, `[${ts}] [chat-session] ${msg}\n`); } catch {}
+}
+
+class ChatSession {
+  constructor({ agent, sessionId, resumeSessionId, cwd, sessionsDir, permissionMode, model, onEvent, onExit, addDir, mcpConfig, betas }) {
+    this.agent = agent;
+    this.sessionId = sessionId || randomUUID();
+    this.resumeSessionId = resumeSessionId || null;
+    this.cwd = cwd || process.cwd();
+    this.sessionsDir = sessionsDir || path.join(this.cwd, '.shards', 'sessions');
+    this.permissionMode = permissionMode || 'acceptEdits';
+    this.model = model || null;
+    this.addDir = addDir || null;
+    this.mcpConfig = mcpConfig || null;
+    this.betas = betas || null;
+    this.onEvent = onEvent || (() => {});
+    this.onExit = onExit || (() => {});
+    this.child = null;
+    this.startedAt = null;
+    this._buffer = '';
+    this._responding = false;
+  }
+
+  start() {
+    const args = [
+      '-p',
+      '--output-format', 'stream-json',
+      '--input-format', 'stream-json',
+      '--verbose',
+      '--include-partial-messages',
+      '--forward-subagent-text',
+      '--permission-mode', this.permissionMode,
+    ];
+
+    if (this.agent) {
+      args.push('--agent', this.agent);
+    }
+
+    if (this.resumeSessionId) {
+      args.push('--resume', this.resumeSessionId);
+      args.push('--fork-session');
+      // Omit --session-id when forking; CLI generates the new ID
+    } else {
+      args.push('--session-id', this.sessionId);
+    }
+
+    if (this.model) {
+      args.push('--model', this.model);
+    }
+
+    if (this.addDir) {
+      args.push('--add-dir', this.addDir);
+    }
+
+    if (this.mcpConfig) {
+      args.push('--mcp-config', this.mcpConfig);
+    }
+
+    if (this.betas) {
+      args.push('--betas', this.betas);
+    }
+
+    log(`Spawning claude CLI for agent="${this.agent || '(plain)'}" session="${this.sessionId}" permissionMode="${this.permissionMode}"${this.resumeSessionId ? ` resume="${this.resumeSessionId}"` : ''}`);
+
+    // P4: Spawn detached so process survives server restarts
+    this.child = spawn('claude', args, {
+      cwd: this.cwd,
+      detached: true,
+      stdio: ['pipe', 'pipe', 'pipe'],
+      env: { ...process.env },
+    });
+
+    // Don't let the child keep the parent alive
+    this.child.unref();
+
+    this.startedAt = new Date().toISOString();
+    log(`claude process spawned, PID=${this.child.pid}`);
+
+    // P4: Write session metadata for reconnection
+    this._writeMetadata();
+
+    this._attachStreams();
+  }
+
+  // P4: Reconnect to an existing detached process
+  reconnect(pid) {
+    log(`Attempting reconnect to PID=${pid} for session="${this.sessionId}"`);
+
+    // We can't reattach to stdio of a detached process without IPC.
+    // Instead, we verify the process is alive and mark it as connected.
+    // The process will eventually exit and we'll detect that via polling.
+    try {
+      process.kill(pid, 0); // throws if not alive
+    } catch {
+      log(`PID=${pid} is not alive, cannot reconnect`);
+      return false;
+    }
+
+    this.startedAt = this.startedAt || new Date().toISOString();
+    this._responding = false;
+
+    // Start a heartbeat poller to detect when the process dies
+    this._heartbeatInterval = setInterval(() => {
+      try {
+        process.kill(pid, 0);
+        this._updateMetadata();
+      } catch {
+        // Process died while server was down or between heartbeats
+        clearInterval(this._heartbeatInterval);
+        this._heartbeatInterval = null;
+        log(`Heartbeat: PID=${pid} is dead for session="${this.sessionId}"`);
+        this._removeMetadata();
+        this.onExit({ code: null, sessionId: this.sessionId });
+      }
+    }, 5000);
+
+    this._reconnectedPid = pid;
+    return true;
+  }
+
+  _attachStreams() {
+    // Parse stdout line by line (JSONL)
+    this.child.stdout.on('data', (chunk) => {
+      this._buffer += chunk.toString();
+      const lines = this._buffer.split('\n');
+      this._buffer = lines.pop();
+      for (const line of lines) {
+        if (line.trim()) this._parseLine(line.trim());
+      }
+    });
+
+    this.child.stderr.on('data', (chunk) => {
+      const text = chunk.toString().trim();
+      if (text) {
+        log(`stderr: ${text}`);
+        this.onEvent({ type: 'chat-stderr', text, sessionId: this.sessionId });
+      }
+    });
+
+    this.child.on('close', (code) => {
+      log(`claude process exited, code=${code}, agent="${this.agent}", session="${this.sessionId}"`);
+      this.child = null;
+      this._responding = false;
+      this._removeMetadata();
+      this.onExit({ code, sessionId: this.sessionId });
+    });
+
+    this.child.on('error', (err) => {
+      log(`claude process error: ${err.message}`);
+      this.onEvent({ type: 'chat-error', error: err.message, sessionId: this.sessionId });
+    });
+  }
+
+  _parseLine(line) {
+    let data;
+    try {
+      data = JSON.parse(line);
+    } catch {
+      return;
+    }
+
+    const { type } = data;
+
+    if (type === 'system' && data.subtype === 'init') {
+      // When forking, the CLI assigns a new session ID internally. We do NOT
+      // update this.sessionId — the server's sessions map and the browser both
+      // know us by the original randomUUID. If we changed it here, all
+      // subsequent broadcasts would carry the CLI-assigned ID and the browser
+      // would silently drop them because it can't find a matching session.
+      // The CLI's internal ID is irrelevant for in-memory routing; the
+      // metadata file (written by start()) keeps the original ID for
+      // reconnectOrCleanup to find. See the integration audit for the full
+      // trace of why this.sessionId must stay unchanged.
+      this.onEvent({ type: 'chat-init', sessionId: this.sessionId, data });
+      return;
+    }
+
+    if (type === 'stream_event') {
+      const evt = data.event;
+      if (!evt) return;
+
+      if (evt.type === 'content_block_delta' && evt.delta) {
+        if (evt.delta.type === 'text_delta') {
+          this._responding = true;
+          this.onEvent({
+            type: 'chat-token',
+            text: evt.delta.text,
+            index: evt.index,
+            sessionId: this.sessionId,
+          });
+        } else if (evt.delta.type === 'input_json_delta') {
+          this.onEvent({
+            type: 'chat-tool-input-delta',
+            partial_json: evt.delta.partial_json,
+            index: evt.index,
+            sessionId: this.sessionId,
+          });
+        } else if (evt.delta.type === 'thinking_delta') {
+          this._responding = true;
+          this.onEvent({
+            type: 'chat-thinking-token',
+            text: evt.delta.thinking,
+            index: evt.index,
+            sessionId: this.sessionId,
+          });
+        }
+        return;
+      }
+
+      if (evt.type === 'content_block_start' && evt.content_block) {
+        if (evt.content_block.type === 'tool_use') {
+          this.onEvent({
+            type: 'chat-tool-use',
+            tool: evt.content_block.name,
+            id: evt.content_block.id,
+            index: evt.index,
+            sessionId: this.sessionId,
+          });
+        }
+        return;
+      }
+
+      if (evt.type === 'content_block_stop') {
+        this.onEvent({
+          type: 'chat-block-stop',
+          index: evt.index,
+          sessionId: this.sessionId,
+        });
+        return;
+      }
+
+      if (evt.type === 'message_start') {
+        const usage = evt.message && evt.message.usage;
+        if (usage && typeof usage.input_tokens === 'number') {
+          this.onEvent({
+            type: 'chat-usage',
+            sessionId: this.sessionId,
+            usage: {
+              inputTokens: usage.input_tokens,
+              cacheReadTokens: usage.cache_read_input_tokens || 0,
+              cacheCreationTokens: usage.cache_creation_input_tokens || 0,
+              outputTokens: usage.output_tokens || 0,
+            },
+          });
+        }
+        return;
+      }
+      if (evt.type === 'message_delta' || evt.type === 'message_stop') {
+        return;
+      }
+
+      return;
+    }
+
+    if (type === 'assistant') {
+      const content = data.message && data.message.content;
+      const hasText = Array.isArray(content) && content.some(b => b.type === 'text');
+      if (!hasText) return;
+      this._responding = false;
+      this.onEvent({
+        type: 'chat-message',
+        content,
+        sessionId: this.sessionId,
+      });
+      return;
+    }
+
+    if (type === 'result') {
+      this._responding = false;
+      this.onEvent({
+        type: 'chat-turn-end',
+        sessionId: this.sessionId,
+        cost: data.cost_usd,
+        duration: data.duration_ms,
+      });
+      return;
+    }
+
+    this.onEvent({ type: 'chat-unknown', raw: data, sessionId: this.sessionId });
+  }
+
+  send(message, attachments) {
+    if (!this.child || !this.child.stdin.writable) {
+      throw new Error('Chat session is not running');
+    }
+    // Build the content array. Anthropic's Messages API recommends image blocks
+    // before the text block when both are present, since the text typically
+    // references the image. An empty text block is invalid, so we omit it when
+    // the user sent only attachments.
+    const content = [];
+    if (Array.isArray(attachments)) {
+      for (const a of attachments) {
+        if (!a || !a.dataBase64 || !a.mediaType) continue;
+        content.push({
+          type: 'image',
+          source: {
+            type: 'base64',
+            media_type: a.mediaType,
+            data: a.dataBase64,
+          },
+        });
+      }
+    }
+    if (message && message.length > 0) {
+      content.push({ type: 'text', text: message });
+    }
+    if (content.length === 0) {
+      // Should be unreachable — /chat/send rejects empty payloads — but guard
+      // against a degenerate input rather than emit an invalid stream-json frame.
+      throw new Error('Empty message: no text and no valid attachments');
+    }
+    const payload = {
+      type: 'user',
+      message: {
+        role: 'user',
+        content,
+      },
+    };
+    this.child.stdin.write(JSON.stringify(payload) + '\n');
+    this._responding = true;
+    this._updateMetadata();
+  }
+
+  stop() {
+    if (this._heartbeatInterval) {
+      clearInterval(this._heartbeatInterval);
+      this._heartbeatInterval = null;
+    }
+    if (this._reconnectedPid) {
+      try { process.kill(this._reconnectedPid, 'SIGTERM'); } catch {}
+      this._reconnectedPid = null;
+    }
+    if (this.child) {
+      this.child.kill('SIGTERM');
+    }
+  }
+
+  get isRunning() {
+    return this.child !== null || this._reconnectedPid !== null;
+  }
+
+  get isResponding() {
+    return this._responding;
+  }
+
+  get info() {
+    return {
+      agent: this.agent,
+      sessionId: this.sessionId,
+      startedAt: this.startedAt,
+      running: this.isRunning,
+      responding: this._responding,
+    };
+  }
+
+  // P4: Session metadata persistence
+
+  _metadataPath(sid) {
+    return path.join(this.sessionsDir, `${sid || this.sessionId}.json`);
+  }
+
+  _writeMetadata() {
+    try {
+      fs.mkdirSync(this.sessionsDir, { recursive: true });
+      fs.writeFileSync(this._metadataPath(), JSON.stringify({
+        sessionId: this.sessionId,
+        agent: this.agent,
+        pid: this.child ? this.child.pid : (this._reconnectedPid || null),
+        startedAt: this.startedAt,
+        lastActivityAt: new Date().toISOString(),
+      }));
+    } catch {}
+  }
+
+  _updateMetadata() {
+    try {
+      const meta = JSON.parse(fs.readFileSync(this._metadataPath(), 'utf8'));
+      meta.lastActivityAt = new Date().toISOString();
+      fs.writeFileSync(this._metadataPath(), JSON.stringify(meta));
+    } catch {}
+  }
+
+  _removeMetadata() {
+    try { fs.unlinkSync(this._metadataPath()); } catch {}
+  }
+}
+
+// P4: Reconnect to orphaned sessions or clean up dead ones
+function reconnectOrCleanup(sessionsDir, sessionsMap, SessionStoreClass, onEvent, onExit, cwd) {
+  if (!fs.existsSync(sessionsDir)) return;
+
+  try {
+    const files = fs.readdirSync(sessionsDir);
+    for (const file of files) {
+      if (!file.endsWith('.json')) continue;
+
+      const metaPath = path.join(sessionsDir, file);
+      let meta;
+      try {
+        meta = JSON.parse(fs.readFileSync(metaPath, 'utf8'));
+      } catch {
+        try { fs.unlinkSync(metaPath); } catch {}
+        continue;
+      }
+
+      const { sessionId, agent, pid } = meta;
+      if (!pid || !sessionId) {
+        try { fs.unlinkSync(metaPath); } catch {}
+        continue;
+      }
+
+      // Check if the process is still alive
+      let alive = false;
+      try {
+        process.kill(pid, 0);
+        alive = true;
+      } catch {}
+
+      if (!alive) {
+        // Process died while server was down — clean up
+        log(`reconnectOrCleanup: session ${sessionId} (PID=${pid}) is dead, cleaning up`);
+        try { fs.unlinkSync(metaPath); } catch {}
+        continue;
+      }
+
+      // Process is alive — attempt reconnect
+      log(`reconnectOrCleanup: reconnecting to session ${sessionId} (PID=${pid}, agent=${agent})`);
+
+      const chatSess = new ChatSession({
+        agent,
+        sessionId,
+        cwd,
+        sessionsDir,
+        onEvent,
+        onExit,
+      });
+      chatSess.startedAt = meta.startedAt;
+
+      if (chatSess.reconnect(pid)) {
+        const store = new SessionStoreClass({ sessionId, agent });
+        store.chatSession = chatSess;
+        store.createdAt = new Date(meta.startedAt);
+        store.lastActivityAt = new Date(meta.lastActivityAt || meta.startedAt);
+        sessionsMap.set(sessionId, store);
+        log(`reconnectOrCleanup: successfully reconnected session ${sessionId}`);
+      } else {
+        try { fs.unlinkSync(metaPath); } catch {}
+      }
+    }
+  } catch (err) {
+    log(`reconnectOrCleanup error: ${err.message}`);
+  }
+}
+
+module.exports = { ChatSession, reconnectOrCleanup };