@tagma/sdk 0.2.7 → 0.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tagma/sdk",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/completions/output-check.ts

@@ -34,6 +34,17 @@ export const OutputCheckCompletion: CompletionPlugin = {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
 
+    // Wire pipeline abort signal into the check process so external abort
+    // terminates the child instead of leaving it running undetected.
+    const onAbort = () => controller.abort();
+    if (ctx.signal) {
+      if (ctx.signal.aborted) {
+        controller.abort();
+      } else {
+        ctx.signal.addEventListener('abort', onAbort, { once: true });
+      }
+    }
+
     const proc = Bun.spawn(shellArgs(checkCmd) as string[], {
       cwd: ctx.workDir,
       stdin: 'pipe',
@@ -69,6 +80,7 @@ export const OutputCheckCompletion: CompletionPlugin = {
       return exitCode === 0;
     } finally {
       clearTimeout(timer);
+      if (ctx.signal) ctx.signal.removeEventListener('abort', onAbort);
     }
   },
 };

package/src/dag.ts

@@ -118,8 +118,10 @@ export function buildDag(config: PipelineConfig): Dag {
   }
 
   const sorted: string[] = [];
-  while (queue.length > 0) {
-    const current = queue.shift()!;
+  // Use an index pointer instead of shift() to avoid O(n) per dequeue.
+  let qi = 0;
+  while (qi < queue.length) {
+    const current = queue[qi++]!;
     sorted.push(current);
     for (const child of adjacency.get(current)!) {
       const newDegree = inDegree.get(child)! - 1;
@@ -129,8 +131,13 @@ export function buildDag(config: PipelineConfig): Dag {
   }
 
   if (sorted.length !== nodes.size) {
-    const remaining = [...nodes.keys()].filter(id => !sorted.includes(id));
-    throw new Error(`Circular dependency detected involving tasks: ${remaining.join(', ')}`);
+    // Only report nodes that are actually part of cycles (in-degree > 0
+    // after Kahn's algorithm), not their downstream dependents.
+    const sortedSet = new Set(sorted);
+    const cycleMembers = [...nodes.keys()].filter(id =>
+      !sortedSet.has(id) && (inDegree.get(id) ?? 0) > 0
+    );
+    throw new Error(`Circular dependency detected involving tasks: ${cycleMembers.join(', ')}`);
   }
 
   return { nodes, sorted };

package/src/engine.ts

@@ -88,13 +88,23 @@ function preflight(config: PipelineConfig, dag: Dag): void {
 }
 
 function resolveRefInDag(dag: Dag, ref: string, fromTrackId: string): string | null {
+  // Already fully qualified
   if (dag.nodes.has(ref)) return ref;
+  // Same-track match (preferred)
   const sameTrack = `${fromTrackId}.${ref}`;
   if (dag.nodes.has(sameTrack)) return sameTrack;
+  // Cross-track bare name lookup — must be unambiguous (aligned with buildDag's resolveRef)
+  let match: string | null = null;
   for (const [id] of dag.nodes) {
-    if (id.endsWith(`.${ref}`)) return id;
+    if (id.endsWith(`.${ref}`)) {
+      if (match !== null) {
+        // Ambiguous: multiple tasks share the bare name across tracks
+        return null;
+      }
+      match = id;
+    }
   }
-  return null;
+  return match;
 }
 
 // ═══ Engine ═══
@@ -187,6 +197,9 @@ export async function runPipeline(
       text: record.text,
     });
   });
+
+  try {
+
   log.info('[pipeline]', `start "${config.name}" run_id=${runId}`);
 
   // File-only: dump the resolved pipeline shape + DAG topology for post-mortem.
@@ -220,8 +233,6 @@ export async function runPipeline(
     });
   }
 
-  try {
-
   // Pipeline start hook (gate)
   const startHook = await executeHook(
     config.hooks, 'pipeline_start', buildPipelineStartContext(pipelineInfo), workDir,
@@ -274,15 +285,15 @@ export async function runPipeline(
   });
 
   // Wire external cancel signal into the internal abort controller.
+  const externalAbortHandler = () => {
+    pipelineAborted = true;
+    abortController.abort();
+  };
   if (options.signal) {
     if (options.signal.aborted) {
-      pipelineAborted = true;
-      abortController.abort();
+      externalAbortHandler();
     } else {
-      options.signal.addEventListener('abort', () => {
-        pipelineAborted = true;
-        abortController.abort();
-      }, { once: true });
+      options.signal.addEventListener('abort', externalAbortHandler, { once: true });
     }
   }
 
@@ -367,7 +378,7 @@ export async function runPipeline(
 
   async function fireHook(taskId: string, event: 'task_success' | 'task_failure'): Promise<void> {
     await executeHook(config.hooks, event,
-      buildTaskContext(event, pipelineInfo, trackInfoOf(taskId), buildTaskInfoObj(taskId)), workDir);
+      buildTaskContext(event, pipelineInfo, trackInfoOf(taskId), buildTaskInfoObj(taskId)), workDir, abortController.signal);
   }
 
   // ── Process a single task ──
@@ -429,7 +440,7 @@ export async function runPipeline(
 
     // 3. task_start hook (gate)
     const hookResult = await executeHook(config.hooks, 'task_start',
-      buildTaskContext('task_start', pipelineInfo, trackInfoOf(taskId), buildTaskInfoObj(taskId)), workDir);
+      buildTaskContext('task_start', pipelineInfo, trackInfoOf(taskId), buildTaskInfoObj(taskId)), workDir, abortController.signal);
     if (hookResult.exitCode !== 0 || config.hooks?.task_start) {
       log.debug(`[task:${taskId}]`,
         `task_start hook exit=${hookResult.exitCode} allowed=${hookResult.allowed}`);
@@ -521,7 +532,7 @@ export async function runPipeline(
         terminalStatus = 'failed';
       } else if (task.completion) {
         const plugin = getHandler<CompletionPlugin>('completions', task.completion.type);
-        const completionCtx = { workDir: task.cwd ?? workDir };
+        const completionCtx = { workDir: task.cwd ?? workDir, signal: abortController.signal };
         const passed = await plugin.check(task.completion as Record<string, unknown>, result, completionCtx);
         terminalStatus = passed ? 'success' : 'failed';
       } else {
@@ -670,6 +681,11 @@ export async function runPipeline(
     }
   } finally {
     if (pipelineTimer) clearTimeout(pipelineTimer);
+    // Clean up the external abort signal listener to prevent dead references
+    // accumulating on long-lived shared AbortControllers.
+    if (options.signal) {
+      options.signal.removeEventListener('abort', externalAbortHandler);
+    }
     // Safety net: drain any approvals still pending at shutdown (e.g. crash path).
     if (approvalGateway.pending().length > 0) {
       approvalGateway.abortAll('pipeline finished');
@@ -720,10 +736,10 @@ export async function runPipeline(
     log.quiet(`  ${state.status.padEnd(8)} ${id}  (exit=${exit}, ${dur})`);
   }
 
-  console.log(`\n[Pipeline "${config.name}"] completed`);
-  console.log(`  Total: ${summary.total} | Success: ${summary.success} | Failed: ${summary.failed} | Skipped: ${summary.skipped} | Timeout: ${summary.timeout} | Blocked: ${summary.blocked}`);
-  console.log(`  Duration: ${(durationMs / 1000).toFixed(1)}s`);
-  console.log(`  Log: ${log.path}`);
+  log.info('[pipeline]', `completed "${config.name}"`);
+  log.info('[pipeline]', `Total: ${summary.total} | Success: ${summary.success} | Failed: ${summary.failed} | Skipped: ${summary.skipped} | Timeout: ${summary.timeout} | Blocked: ${summary.blocked}`);
+  log.info('[pipeline]', `Duration: ${(durationMs / 1000).toFixed(1)}s`);
+  log.info('[pipeline]', `Log: ${log.path}`);
 
   emit({ type: 'pipeline_end', runId, success: allSuccess });
   return { success: allSuccess, runId, logPath: log.path, summary, states: freezeStates(states) };

package/src/hooks.ts

@@ -18,42 +18,71 @@ function normalizeCommands(cmd: HookCommand | undefined): readonly string[] {
   return cmd;
 }
 
-async function runSingleHook(command: string, context: unknown, cwd?: string): Promise<number> {
+const DEFAULT_HOOK_TIMEOUT_MS = 30_000;
+
+async function runSingleHook(
+  command: string,
+  context: unknown,
+  cwd?: string,
+  signal?: AbortSignal,
+  timeoutMs: number = DEFAULT_HOOK_TIMEOUT_MS,
+): Promise<number> {
   const jsonInput = JSON.stringify(context, null, 2);
 
-  const proc = Bun.spawn(shellArgs(command) as string[], {
-    stdin: 'pipe',
-    stdout: 'pipe',
-    stderr: 'pipe',
-    ...(cwd ? { cwd } : {}),
-  });
-
-  if (proc.stdin) {
-    try {
-      proc.stdin.write(jsonInput);
-      proc.stdin.end();
-    } catch {
-      // Process may exit before reading stdin (e.g. `exit 1`), ignore EPIPE
+  const controller = new AbortController();
+  const timer = timeoutMs > 0
+    ? setTimeout(() => controller.abort(), timeoutMs)
+    : null;
+
+  // Wire pipeline abort signal into hook process
+  const onAbort = () => controller.abort();
+  if (signal) {
+    if (signal.aborted) {
+      controller.abort();
+    } else {
+      signal.addEventListener('abort', onAbort, { once: true });
     }
   }
 
-  // Consume stdout and stderr concurrently with waiting for exit.
-  // Sequential reads after proc.exited risk a pipe-buffer deadlock when
-  // hook output exceeds the ~64 KB kernel buffer.
-  const [exitCode, stdout, stderr] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-  ]);
-
-  if (stdout.trim()) {
-    console.log(`[hook: ${command}] stdout: ${stdout.trim()}`);
-  }
-  if (stderr.trim()) {
-    console.error(`[hook: ${command}] stderr: ${stderr.trim()}`);
-  }
+  try {
+    const proc = Bun.spawn(shellArgs(command) as string[], {
+      stdin: 'pipe',
+      stdout: 'pipe',
+      stderr: 'pipe',
+      signal: controller.signal,
+      ...(cwd ? { cwd } : {}),
+    });
+
+    if (proc.stdin) {
+      try {
+        proc.stdin.write(jsonInput);
+        proc.stdin.end();
+      } catch {
+        // Process may exit before reading stdin (e.g. `exit 1`), ignore EPIPE
+      }
+    }
 
-  return exitCode;
+    // Consume stdout and stderr concurrently with waiting for exit.
+    // Sequential reads after proc.exited risk a pipe-buffer deadlock when
+    // hook output exceeds the ~64 KB kernel buffer.
+    const [exitCode, stdout, stderr] = await Promise.all([
+      proc.exited,
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+    ]);
+
+    if (stdout.trim()) {
+      console.log(`[hook: ${command}] stdout: ${stdout.trim()}`);
+    }
+    if (stderr.trim()) {
+      console.error(`[hook: ${command}] stderr: ${stderr.trim()}`);
+    }
+
+    return exitCode;
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (signal) signal.removeEventListener('abort', onAbort);
+  }
 }
 
 export async function executeHook(
@@ -61,6 +90,7 @@ export async function executeHook(
   event: HookEvent,
   context: unknown,
   workDir?: string,
+  signal?: AbortSignal,
 ): Promise<HookResult> {
   if (!hooks) return { allowed: true, exitCode: 0 };
 
@@ -70,7 +100,7 @@ export async function executeHook(
   const isGate = GATE_HOOKS.has(event);
 
   for (const cmd of commands) {
-    const exitCode = await runSingleHook(cmd, context, workDir);
+    const exitCode = await runSingleHook(cmd, context, workDir, signal);
 
     if (isGate && exitCode === 1) {
       // Only exit code 1 has gate semantics (block execution)

package/src/pipeline-runner.ts

@@ -61,6 +61,15 @@ export class PipelineRunner {
   start(): Promise<EngineResult> {
     if (this._result) return this._result;
 
+    // Guard: if abort() was called before start(), the signal is already
+    // aborted. Create a fresh controller so the pipeline doesn't terminate
+    // immediately. If users truly want pre-abort semantics, they call
+    // abort() after start().
+    if (this._abortController.signal.aborted) {
+      this._abortController = new AbortController();
+      this._status = 'idle';
+    }
+
     this._status = 'running';
     this._result = runPipeline(this.config, this.workDir, {
       ...this.opts,

package/src/registry.ts

@@ -37,8 +37,20 @@ export function hasHandler(category: PluginCategory, type: string): boolean {
   return registries[category].has(type);
 }
 
+// Plugin name must be a scoped npm package or a tagma-prefixed package.
+// Reject absolute/relative paths and suspicious patterns to prevent
+// arbitrary code execution via crafted YAML configs.
+const PLUGIN_NAME_RE = /^(@[a-z0-9-]+\/[a-z0-9._-]+|tagma-plugin-[a-z0-9._-]+)$/;
+
 export async function loadPlugins(pluginNames: readonly string[]): Promise<void> {
   for (const name of pluginNames) {
+    if (!PLUGIN_NAME_RE.test(name)) {
+      throw new Error(
+        `Plugin "${name}" rejected: plugin names must be scoped npm packages ` +
+        `(e.g. @tagma/trigger-xyz) or tagma-plugin-* packages. ` +
+        `Relative/absolute paths are not allowed.`
+      );
+    }
     const mod = await import(name);
     if (!mod.pluginCategory || !mod.pluginType || !mod.default) {
       throw new Error(

package/src/runner.ts

@@ -49,8 +49,18 @@ export interface RunOptions {
  * Returns the original name if resolution fails; Bun will raise the same
  * ENOENT it would have otherwise.
  */
+const RESOLVED_EXE_CACHE_MAX = 128;
 const resolvedExeCache = new Map<string, string | null>();
 
+/** Evict the oldest entry when the cache is at capacity. */
+function evictIfFull(): void {
+  if (resolvedExeCache.size >= RESOLVED_EXE_CACHE_MAX) {
+    // Map iteration order is insertion order — delete the first (oldest) key.
+    const oldest = resolvedExeCache.keys().next().value;
+    if (oldest !== undefined) resolvedExeCache.delete(oldest);
+  }
+}
+
 function resolveWindowsExe(
   args: readonly string[],
   envPath: string,
@@ -80,11 +90,13 @@ function resolveWindowsExe(
     for (const ext of exts) {
       const candidate = join(dir, cmd + ext);
       if (existsSync(candidate)) {
+        evictIfFull();
         resolvedExeCache.set(cacheKey, candidate);
         return [candidate, ...args.slice(1)];
       }
     }
   }
+  evictIfFull();
   resolvedExeCache.set(cacheKey, null);
   return args;
 }

package/src/schema.ts

@@ -198,10 +198,15 @@ function expandTemplateTask(
       newTask.continue_from = `${instanceId}.${task.continue_from}`;
     }
 
-    // Rewrite output path to instance namespace
+    // Rewrite output path to instance namespace so parallel template
+    // instances don't collide on the same file. Handles any relative path
+    // (e.g. ./tmp/foo, ./output/bar, ./build/result.json) by injecting
+    // the instanceId as the first directory component after `./`.
     if (task.output) {
       const original = interpolate(task.output);
-      newTask.output = original.replace('./tmp/', `./tmp/${instanceId}/`);
+      newTask.output = original.startsWith('./')
+        ? `./${instanceId}/${original.slice(2)}`
+        : `${instanceId}/${original}`;
     }
 
     return newTask as unknown as RawTaskConfig;

package/src/triggers/file.ts

@@ -1,5 +1,6 @@
 import { watch } from 'chokidar';
 import { resolve, dirname } from 'path';
+import { mkdir } from 'fs/promises';
 import type { TriggerPlugin, TriggerContext } from '../types';
 import { parseDuration, validatePath } from '../utils';
 
@@ -35,7 +36,7 @@ export const FileTrigger: TriggerPlugin = {
     const safePath = validatePath(filePath, ctx.workDir);
     const timeoutMs = config.timeout != null ? parseDuration(String(config.timeout)) : 0;
 
-    return new Promise((resolve_p, reject) => {
+    return new Promise(async (resolve_p, reject) => {
       if (ctx.signal.aborted) {
         reject(new Error('Pipeline aborted'));
         return;
@@ -44,7 +45,13 @@ export const FileTrigger: TriggerPlugin = {
       let settled = false;
       let timer: ReturnType<typeof setTimeout> | null = null;
 
+      // Ensure the parent directory exists so the watcher doesn't fail
+      // with ENOENT for nested paths like `build/output/result.json`.
       const dir = dirname(safePath);
+      try {
+        await mkdir(dir, { recursive: true });
+      } catch { /* best effort — dir may already exist */ }
+
       const watcher = watch(dir, {
         ignoreInitial: true,
         depth: 0,

package/src/triggers/manual.ts

@@ -41,19 +41,26 @@ export const ManualTrigger: TriggerPlugin = {
     // so instead we race against an abort promise and let engine status logic
     // fall back to pipelineAborted → skipped. abortAll() on gateway still runs
     // from engine shutdown path to clean up any truly-pending entries.
+    const onAbort = () => {};
     const abortPromise = new Promise<never>((_, reject) => {
       if (ctx.signal.aborted) {
         reject(new Error('Pipeline aborted'));
         return;
       }
-      ctx.signal.addEventListener(
-        'abort',
-        () => reject(new Error('Pipeline aborted')),
-        { once: true },
-      );
+      const handler = () => reject(new Error('Pipeline aborted'));
+      // Store reference so we can remove it after the race settles.
+      (onAbort as { handler?: () => void }).handler = handler;
+      ctx.signal.addEventListener('abort', handler, { once: true });
     });
 
-    const decision = await Promise.race([decisionPromise, abortPromise]);
+    let decision: Awaited<typeof decisionPromise>;
+    try {
+      decision = await Promise.race([decisionPromise, abortPromise]);
+    } finally {
+      // Clean up the abort listener to prevent leaking on normal completion.
+      const handler = (onAbort as { handler?: () => void }).handler;
+      if (handler) ctx.signal.removeEventListener('abort', handler);
+    }
 
     switch (decision.outcome) {
       case 'approved':

package/src/utils.ts

@@ -1,12 +1,12 @@
 import { resolve, relative } from 'path';
 import { randomBytes } from 'crypto';
 
-const DURATION_RE = /^(\d+(?:\.\d+)?)\s*(s|m|h)$/;
+const DURATION_RE = /^(\d*\.?\d+)\s*(s|m|h|d)$/;
 
 export function parseDuration(input: string): number {
   const match = DURATION_RE.exec(input.trim());
   if (!match) {
-    throw new Error(`Invalid duration format: "${input}". Expected format: <number>(s|m|h)`);
+    throw new Error(`Invalid duration format: "${input}". Expected format: <number>(s|m|h|d)`);
   }
   const value = parseFloat(match[1]);
   const unit = match[2];
@@ -14,6 +14,7 @@ export function parseDuration(input: string): number {
     case 's': return value * 1000;
     case 'm': return value * 60_000;
     case 'h': return value * 3_600_000;
+    case 'd': return value * 86_400_000;
     default:  throw new Error(`Unknown duration unit: "${unit}"`);
   }
 }
@@ -136,8 +137,13 @@ export function shellArgs(command: string): readonly string[] {
 /** Quote a single argument for inclusion in a shell command string. */
 function quoteArg(arg: string): string {
   if (!/[\s"'\\<>|&;`$!^%]/.test(arg)) return arg;
-  // Double-quote and escape embedded double quotes + backslashes
-  return '"' + arg.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
+  if (IS_WINDOWS) {
+    // On Windows (cmd.exe), double-quote and escape embedded quotes + backslashes
+    return '"' + arg.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
+  }
+  // On Unix, use single quotes to prevent $variable expansion.
+  // Escape embedded single quotes via the '\'' idiom.
+  return "'" + arg.replace(/'/g, "'\\''") + "'";
 }
 
 /**

package/src/validate-raw.ts

@@ -201,10 +201,13 @@ function detectCycles(
   // Canonical key = sorted node list joined — order-independent fingerprint.
   const seenCycles = new Set<string>();
 
-  function dfs(id: string, path: string[]): void {
+  // Use a mutable path array instead of copying at each level (O(n) vs O(n^2)).
+  const pathStack: string[] = [];
+
+  function dfs(id: string): void {
     if (inStack.has(id)) {
-      const cycleStart = path.indexOf(id);
-      const cycleNodes = [...path.slice(cycleStart), id];
+      const cycleStart = pathStack.indexOf(id);
+      const cycleNodes = [...pathStack.slice(cycleStart), id];
       const key = [...cycleNodes].sort().join(',');
       if (!seenCycles.has(key)) {
         seenCycles.add(key);
@@ -215,14 +218,16 @@ function detectCycles(
     if (visited.has(id)) return;
     visited.add(id);
     inStack.add(id);
+    pathStack.push(id);
     for (const dep of adj.get(id) ?? []) {
-      dfs(dep, [...path, id]);
+      dfs(dep);
     }
+    pathStack.pop();
     inStack.delete(id);
   }
 
   for (const id of adj.keys()) {
-    if (!visited.has(id)) dfs(id, []);
+    if (!visited.has(id)) dfs(id);
   }
 
   return errors;