@symerian/symi 2.6.42 → 2.7.1

package/skills/long-task/scripts/detach-task.sh

@@ -10,18 +10,28 @@
 #   task-<id>.cmd       — literal command line (for future agent turns to see)
 #   task-<id>.started   — ISO-8601 start timestamp
 #   task-<id>.log       — combined stdout + stderr (grows as task runs)
-#   task-<id>.status    — "running" while alive, "complete rc=<N>" after exit
+#   task-<id>.status    — "running pid=<N> started=<ISO>"
+#                         → "complete rc=<N> ended=<ISO>" on clean exit
+#                         → "aborted rc=<N> signal=<NAME>" on SIGTERM/INT/HUP
 #
-# Exit code: 0 on successful spawn (PID recorded), 1 on invalid args.
+# Exit code: 0 on successful spawn, 1 on missing args, 2 on invalid args,
+#            3 on workdir creation failure.
+#
+# Hardening notes (2.7.0):
+# - task-id is validated against an allow-list ([a-zA-Z0-9._-], 1–60 chars,
+#   must not start with '.' or '-'). Prevents path traversal via task-id.
+# - workdir must be an absolute path.
+# - Status file is written via tmp + mv so concurrent readers never see a
+#   half-written file and the "stuck at running after SIGTERM" failure mode
+#   is eliminated.
+# - Child shell has a TERM/INT/HUP trap that records an "aborted" status
+#   before exiting, so external kill signals leave a deterministic record.
 #
 # Design notes:
 # - setsid + nohup + disown: triple-armor against SIGHUP when the parent
 #   shell exits. The subprocess gets its own session.
 # - stdin closed, stdout/stderr redirected to the log file. No terminal.
 # - The wrapper shell exits immediately after spawning; does NOT wait.
-# - On process exit, an inner wrapper writes "complete rc=<N>" to the
-#   status file so a future agent turn can detect completion without
-#   racing with the cron monitor's polling.
 
 set -euo pipefail
 
@@ -30,29 +40,96 @@ if [[ $# -lt 3 ]]; then
   exit 1
 fi
 
-task_id="$1"
+raw_task_id="$1"
 workdir="$2"
 shift 2
 
-mkdir -p "$workdir"
+# --- task-id validation -----------------------------------------------------
+if [[ -z "$raw_task_id" ]]; then
+  echo "detach-task: task-id must not be empty" >&2
+  exit 2
+fi
+if [[ ${#raw_task_id} -gt 60 ]]; then
+  echo "detach-task: task-id exceeds 60 chars" >&2
+  exit 2
+fi
+if [[ "$raw_task_id" =~ [^a-zA-Z0-9._-] ]]; then
+  echo "detach-task: task-id contains illegal chars (allowed: alphanumeric, dot, dash, underscore): $raw_task_id" >&2
+  exit 2
+fi
+case "$raw_task_id" in
+  .* | -*)
+    echo "detach-task: task-id must not start with dot or dash: $raw_task_id" >&2
+    exit 2
+    ;;
+esac
+task_id="$raw_task_id"
+
+# --- workdir validation -----------------------------------------------------
+if [[ "$workdir" != /* ]]; then
+  echo "detach-task: workdir must be an absolute path: $workdir" >&2
+  exit 2
+fi
+if ! mkdir -p "$workdir"; then
+  echo "detach-task: cannot create workdir: $workdir" >&2
+  exit 3
+fi
+
 pid_file="$workdir/task-${task_id}.pid"
 cmd_file="$workdir/task-${task_id}.cmd"
 started_file="$workdir/task-${task_id}.started"
 log_file="$workdir/task-${task_id}.log"
 status_file="$workdir/task-${task_id}.status"
 
+# --- atomic status writer (parent) -----------------------------------------
+write_status_atomic() {
+  local _payload="$1"
+  local _tmp="${status_file}.$$.${RANDOM}.tmp"
+  printf '%s\n' "$_payload" > "$_tmp"
+  mv -f "$_tmp" "$status_file"
+}
+
 printf '%s\n' "$*" > "$cmd_file"
-date -u -Iseconds > "$started_file"
-echo "running" > "$status_file"
+started_at="$(date -u -Iseconds)"
+printf '%s\n' "$started_at" > "$started_file"
+write_status_atomic "running started=$started_at"
 
-setsid nohup bash -c "
-  \"\$@\" > '$log_file' 2>&1
-  rc=\$?
-  echo \"complete rc=\$rc\" > '$status_file'
-" -- "$@" < /dev/null > /dev/null 2>&1 &
+# --- detached child --------------------------------------------------------
+# The inner `bash -c` inherits status/log paths as positional args so we
+# never string-interpolate paths into the script body. The inner script
+# re-implements the atomic writer (functions don't cross process boundaries
+# via `bash -c`). A TERM/INT/HUP trap catches external kill signals and
+# writes a terminal "aborted" status before exiting with the signal's code.
+setsid nohup bash -c '
+  set -u
+  _status="$1"
+  _log="$2"
+  shift 2
+  _write() {
+    local _tmp="${_status}.$$.${RANDOM}.tmp"
+    printf "%s\n" "$1" > "$_tmp" && mv -f "$_tmp" "$_status"
+  }
+  _on_signal() {
+    local _sig="$1"
+    local _rc=$?
+    _write "aborted rc=$_rc signal=$_sig ended=$(date -u -Iseconds)" 2>/dev/null || true
+    exit "$_rc"
+  }
+  trap "_on_signal TERM" TERM
+  trap "_on_signal INT"  INT
+  trap "_on_signal HUP"  HUP
+  "$@" > "$_log" 2>&1
+  rc=$?
+  _write "complete rc=$rc ended=$(date -u -Iseconds)"
+' -- "$status_file" "$log_file" "$@" < /dev/null > /dev/null 2>&1 &
 
 pid=$!
 disown "$pid" 2>/dev/null || true
 printf '%d\n' "$pid" > "$pid_file"
 
+# Finalise the parent status with the PID once known. The child may race us
+# and overwrite with "complete" if the command was very fast — that's fine,
+# the mv is atomic and the final state wins.
+write_status_atomic "running pid=$pid started=$started_at"
+
 echo "spawned task=$task_id pid=$pid log=$log_file status=$status_file"