@vybestack/llxprt-code 0.10.0 → 0.11.0-nightly.260728.ffaa8d5d7

package/src/utils/cleanup-state.ts

@@ -0,0 +1,115 @@
+/**
+ * @license
+ * Copyright 2025 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Private, lightweight cleanup-state owner.
+ *
+ * Owns the cleanup registration queues and the reentrancy/concurrency guard.
+ * This module has NO `@vybestack/llxprt-code-core`, React, ink, or
+ * `cleanup.ts` imports, so importing it never transitively evaluates the
+ * core barrel. The pure-node test base setup imports only the reset
+ * operation from here, eliminating the core-barrel cost.
+ *
+ * State is managed via immutable reassignment: registration appends to a
+ * new array assigned back to the module-level binding; draining clears by
+ * reassigning to an empty array. No mutable arrays are exposed to callers.
+ *
+ * Draining semantics: callbacks appended during an active drain are picked
+ * up by continuing to drain until the queue is empty. This preserves the
+ * observable behavior of the original live-array `for...of` iteration.
+ */
+
+type CleanupFn = (() => void) | (() => Promise<void>);
+type SyncCleanupFn = () => void;
+
+interface CleanupState {
+  readonly asyncFns: readonly CleanupFn[];
+  readonly syncFns: readonly SyncCleanupFn[];
+  readonly inProgress: boolean;
+}
+
+const EMPTY_ASYNC_FNS: readonly CleanupFn[] = [];
+const EMPTY_SYNC_FNS: readonly SyncCleanupFn[] = [];
+
+const EMPTY_STATE: CleanupState = {
+  asyncFns: EMPTY_ASYNC_FNS,
+  syncFns: EMPTY_SYNC_FNS,
+  inProgress: false,
+};
+
+let state: CleanupState = EMPTY_STATE;
+
+export function registerCleanupFn(fn: CleanupFn): void {
+  state = { ...state, asyncFns: [...state.asyncFns, fn] };
+}
+
+export function registerSyncCleanupFn(fn: SyncCleanupFn): void {
+  state = { ...state, syncFns: [...state.syncFns, fn] };
+}
+
+export function isCleanupInProgress(): boolean {
+  return state.inProgress;
+}
+
+/** Mark cleanup as started, preventing reentrant/concurrent runs. */
+export function beginCleanup(): void {
+  state = { ...state, inProgress: true };
+}
+
+/**
+ * Drain all pending synchronous callbacks in registration order until the
+ * queue is empty (callbacks appended during draining are included).
+ * Returns the drained callbacks. Each callback's errors are tolerated
+ * exactly as before — the caller passes an error handler.
+ */
+export function drainSyncCleanups(
+  onError: (fn: SyncCleanupFn, error: unknown) => void,
+): void {
+  while (state.syncFns.length > 0) {
+    // Snapshot the current batch, then clear the queue so callbacks appended
+    // during this batch form a new batch for the next loop iteration.
+    const batch = state.syncFns;
+    state = { ...state, syncFns: [] };
+    for (const fn of batch) {
+      try {
+        fn();
+      } catch (error) {
+        onError(fn, error);
+      }
+    }
+  }
+}
+
+/**
+ * Drain all pending asynchronous callbacks in registration order until the
+ * queue is empty (callbacks appended during draining are included).
+ */
+export async function drainAsyncCleanups(
+  onError: (fn: CleanupFn, error: unknown) => void,
+): Promise<void> {
+  while (state.asyncFns.length > 0) {
+    const batch = state.asyncFns;
+    state = { ...state, asyncFns: [] };
+    for (const fn of batch) {
+      try {
+        await fn();
+      } catch (error) {
+        onError(fn, error);
+      }
+    }
+  }
+}
+
+/**
+ * Reset cleanup state for testing purposes only.
+ * Clears pending sync/async callbacks and returns the in-progress guard
+ * to idle.
+ * DO NOT use this in production code.
+ * @internal
+ */
+export function __resetCleanupStateForTesting(): void {
+  state = EMPTY_STATE;
+}

package/src/utils/cleanup.ts

@@ -9,27 +9,42 @@ import { join } from 'path';
 import { ShellExecutionService } from '@vybestack/llxprt-code-core';
 import { FileOutput } from '@vybestack/llxprt-code-telemetry';
 import { Storage } from '@vybestack/llxprt-code-settings';
+import {
+  beginCleanup,
+  drainAsyncCleanups,
+  drainSyncCleanups,
+  isCleanupInProgress,
+  registerCleanupFn,
+  registerSyncCleanupFn,
+} from './cleanup-state.js';
 
 type FileOutputWithOptionalDisposeInstance = typeof FileOutput & {
   disposeInstance?: unknown;
 };
 
-const cleanupFunctions: Array<(() => void) | (() => Promise<void>)> = [];
-const syncCleanupFunctions: Array<() => void> = [];
-let cleanupInProgress = false;
-
 export function registerCleanup(fn: (() => void) | (() => Promise<void>)) {
-  cleanupFunctions.push(fn);
+  registerCleanupFn(fn);
 }
 
 export function registerSyncCleanup(fn: () => void) {
-  syncCleanupFunctions.push(fn);
+  registerSyncCleanupFn(fn);
+}
+
+export function runBestEffortSyncCleanup(
+  cleanup: (() => void) | undefined,
+  onError?: (error: unknown) => void,
+) {
+  try {
+    cleanup?.();
+  } catch (error) {
+    onError?.(error);
+  }
 }
 
 export async function runExitCleanup() {
   // Guard against concurrent cleanup if signal handlers fire multiple times
-  if (cleanupInProgress) return;
-  cleanupInProgress = true;
+  if (isCleanupInProgress()) return;
+  beginCleanup();
 
   // Tear down any active PTYs first to release FDs/sockets promptly
   try {
@@ -39,23 +54,13 @@ export async function runExitCleanup() {
   }
 
   // Run sync cleanups first (e.g., stdio restoration)
-  for (const fn of syncCleanupFunctions) {
-    try {
-      fn();
-    } catch {
-      // Ignore errors during cleanup.
-    }
-  }
-  syncCleanupFunctions.length = 0;
+  drainSyncCleanups(() => {
+    // Ignore errors during cleanup.
+  });
 
-  for (const fn of cleanupFunctions) {
-    try {
-      await fn();
-    } catch {
-      // Ignore errors during cleanup.
-    }
-  }
-  cleanupFunctions.length = 0; // Clear the array
+  await drainAsyncCleanups(() => {
+    // Ignore errors during cleanup.
+  });
 
   try {
     const disposeInstance = (
@@ -72,16 +77,9 @@ export async function runExitCleanup() {
   }
 }
 
-/**
- * Reset cleanup state for testing purposes only.
- * DO NOT use this in production code.
- * @internal
- */
-export function __resetCleanupStateForTesting() {
-  cleanupFunctions.length = 0;
-  syncCleanupFunctions.length = 0;
-  cleanupInProgress = false;
-}
+// Re-export the test reset from the state module that owns the state,
+// preserving backward compatibility for existing consumers.
+export { __resetCleanupStateForTesting } from './cleanup-state.js';
 
 export async function cleanupCheckpoints() {
   const storage = new Storage(process.cwd());

package/src/utils/sandbox-containers.ts

@@ -8,6 +8,7 @@ import { execSync, spawn, exec, type ChildProcess } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
 import fs from 'node:fs';
+import crypto from 'node:crypto';
 import { promisify } from 'node:util';
 import { parse } from 'shell-quote';
 import type { Config, SandboxConfig } from '@vybestack/llxprt-code-core';
@@ -18,6 +19,7 @@ import type {
   CredentialProxyBridgeResult,
   SshAgentResult,
 } from './sandbox-ssh.js';
+import { runBestEffortSyncCleanup } from './cleanup.js';
 import {
   USER_SETTINGS_DIR,
   SETTINGS_DIRECTORY_NAME,
@@ -42,6 +44,7 @@ import {
   createAndStartProxy,
   stopProxy,
   getProxySocketPath,
+  getProxyCapabilityToken,
 } from '@vybestack/llxprt-code-providers/auth.js';
 
 const execAsync = promisify(exec);
@@ -72,6 +75,21 @@ const SANDBOX_PROXY_NAME = 'llxprt-code-sandbox-proxy';
 
 export { LOCAL_DEV_SANDBOX_IMAGE_NAME };
 
+/** Composes two optional cleanup callbacks into one, calling both safely. */
+function composeCleanups(
+  a: (() => void) | undefined,
+  b: (() => void) | undefined,
+): (() => void) | undefined {
+  if (a === undefined && b === undefined) return undefined;
+  const reportCleanupError = (error: unknown): void => {
+    debugLogger.error('cleanup step failed:', error);
+  };
+  return () => {
+    runBestEffortSyncCleanup(a, reportCleanupError);
+    runBestEffortSyncCleanup(b, reportCleanupError);
+  };
+}
+
 /** Rewrites only the loopback hostname of a proxy URL to the sandbox proxy name,
  *  preserving credentials, port, and path. Falls back to the original URL on parse failure. */
 function rewriteProxyHostname(proxyUrl: string): string {
@@ -422,6 +440,97 @@ export async function setupContainerUser(
   return userFlag;
 }
 
+/**
+ * Writes the capability token to a temp env file and pushes --env-file to args.
+ * Uses --env-file instead of --env to avoid exposing the token in the process
+ * argument list (visible via ps aux / docker inspect).
+ *
+ * Returns a cleanup function that removes the temp file. The caller should
+ * register it on process exit / sandbox close to avoid leaving the token
+ * file on disk.
+ */
+function pushCapabilityEnvFile(
+  args: string[],
+  resolvedTmpdir: string,
+): (() => void) | undefined {
+  const capabilityToken = getProxyCapabilityToken();
+  if (capabilityToken === undefined) return undefined;
+  if (/[\r\n=]/.test(capabilityToken)) {
+    throw new Error(
+      'Capability token contains invalid characters for env file',
+    );
+  }
+  const envFile = path.join(
+    resolvedTmpdir,
+    `.capability-env-${process.pid}-${crypto.randomUUID()}`,
+  );
+  // Use openSync with explicit mode for defense-in-depth: writeFileSync applies
+  // the mode option but is subject to umask masking. openSync + fchmodSync
+  // guarantees the restrictive permissions regardless of umask.
+  const fd = fs.openSync(envFile, 'w', 0o600);
+  try {
+    fs.writeSync(fd, `LLXPRT_CAPABILITY_TOKEN=${capabilityToken}\n`);
+    fs.fchmodSync(fd, 0o600);
+  } catch (writeErr) {
+    try {
+      fs.closeSync(fd);
+    } catch {
+      // fd may already be closed
+    }
+    try {
+      fs.unlinkSync(envFile);
+    } catch {
+      // file may not exist or already removed
+    }
+    throw writeErr;
+  }
+  // closeSync may fail if the fd is already closed or invalid; the file was
+  // written successfully, so swallow the error and still return the cleanup
+  // closure to ensure the temp env file (containing the capability token)
+  // is eventually removed.
+  try {
+    fs.closeSync(fd);
+  } catch {
+    // fd may already be closed; file content is still valid
+  }
+  args.push('--env-file', envFile);
+  return () => {
+    try {
+      fs.unlinkSync(envFile);
+    } catch {
+      // file may already be removed
+    }
+  };
+}
+
+/** Sets up the macOS credential proxy bridge based on container command. */
+async function setupMacOSCredProxyBridge(
+  args: string[],
+  config: SandboxConfig,
+  socketPath: string,
+  reservedTunnelPorts: Set<number>,
+): Promise<CredentialProxyBridgeResult | undefined> {
+  switch (config.command) {
+    case 'podman':
+      return setupCredentialProxyPodmanMacOS(
+        args,
+        socketPath,
+        SSH_TUNNEL_POLL_TIMEOUT_MS,
+        {
+          reserveTunnelPort: (port: number) => {
+            reservedTunnelPorts.add(port);
+          },
+          excludedTunnelPorts: reservedTunnelPorts,
+        },
+      );
+    case 'docker':
+      return setupCredentialProxyDockerMacOS(args, socketPath);
+    case 'sandbox-exec':
+    default:
+      return undefined;
+  }
+}
+
 /** Starts credential proxy and sets up bridge for Podman/Docker macOS. */
 export async function setupCredentialProxy(
   args: string[],
@@ -435,69 +544,70 @@ export async function setupCredentialProxy(
 }> {
   let credentialProxyBridgeResult: CredentialProxyBridgeResult | undefined;
   let credentialProxyBridgeCleanup: (() => void) | undefined;
+  let envFileCleanup: (() => void) | undefined;
 
   // @plan:PLAN-20250214-CREDPROXY.P34 R25.1: Start credential proxy BEFORE spawning container
-  // The proxy must be listening before the container starts so it can connect immediately
-  let credentialProxyHandle: { stop: () => Promise<void> } | undefined;
   try {
-    credentialProxyHandle = await createAndStartProxy({
-      socketPath: resolvedTmpdir,
-    });
-    void credentialProxyHandle;
+    await createAndStartProxy({ socketPath: resolvedTmpdir });
   } catch (err) {
-    // @plan:PLAN-20250214-CREDPROXY.P34 R25.1a: Proxy creation failure aborts before spawning container
     throw new FatalSandboxError(
       `Failed to start credential proxy: ${err instanceof Error ? err.message : String(err)}`,
     );
   }
   const socketPath = getProxySocketPath();
   if (socketPath === undefined) {
+    try {
+      await stopProxy();
+    } catch {
+      // best-effort cleanup
+    }
     return { credentialProxyBridgeResult, credentialProxyBridgeCleanup };
   }
 
   // @plan:PLAN-20250214-CREDPROXY.P34 R3.6: Pass socket path to container via env var
-  if (os.platform() === 'darwin') {
-    const sandboxCommand: string = config.command;
-    switch (sandboxCommand) {
-      case 'podman':
-        credentialProxyBridgeResult = await setupCredentialProxyPodmanMacOS(
-          args,
-          socketPath,
-          SSH_TUNNEL_POLL_TIMEOUT_MS,
-          {
-            reserveTunnelPort: (port: number) => {
-              reservedTunnelPorts.add(port);
-            },
-            excludedTunnelPorts: reservedTunnelPorts,
-          },
-        );
-        break;
-      case 'docker':
-        credentialProxyBridgeResult = await setupCredentialProxyDockerMacOS(
-          args,
-          socketPath,
-        );
-        break;
-      default:
-        args.push('--env', `LLXPRT_CREDENTIAL_SOCKET=${socketPath}`);
-        break;
+  const isDarwin = os.platform() === 'darwin';
+  try {
+    if (isDarwin) {
+      credentialProxyBridgeResult = await setupMacOSCredProxyBridge(
+        args,
+        config,
+        socketPath,
+        reservedTunnelPorts,
+      );
     }
 
-    if (credentialProxyBridgeResult !== undefined) {
+    const effectiveSocketPath =
+      credentialProxyBridgeResult?.containerSocketPath ?? socketPath;
+    args.push('--env', `LLXPRT_CREDENTIAL_SOCKET=${effectiveSocketPath}`);
+
+    if (credentialProxyBridgeResult !== undefined && isDarwin) {
       credentialProxyBridgeCleanup = credentialProxyBridgeResult.cleanup;
-      if (credentialProxyBridgeResult.entrypointPrefix !== undefined) {
-        entrypointPrefixes.push(credentialProxyBridgeResult.entrypointPrefix);
+      const prefix = credentialProxyBridgeResult.entrypointPrefix;
+      if (prefix !== undefined) {
+        entrypointPrefixes.push(prefix);
       }
-      args.push(
-        '--env',
-        `LLXPRT_CREDENTIAL_SOCKET=${credentialProxyBridgeResult.containerSocketPath}`,
-      );
     }
-  } else {
-    args.push('--env', `LLXPRT_CREDENTIAL_SOCKET=${socketPath}`);
+    envFileCleanup = pushCapabilityEnvFile(args, resolvedTmpdir);
+  } catch (err) {
+    envFileCleanup?.();
+    credentialProxyBridgeCleanup?.();
+    try {
+      await stopProxy();
+    } catch {
+      // best-effort cleanup; the original error is the one we want to throw
+    }
+    throw err;
   }
 
-  return { credentialProxyBridgeResult, credentialProxyBridgeCleanup };
+  // Compose env file cleanup with any existing bridge cleanup so the temp
+  // file is removed when the sandbox container closes (not just on process exit).
+  return {
+    credentialProxyBridgeResult,
+    credentialProxyBridgeCleanup: composeCleanups(
+      credentialProxyBridgeCleanup,
+      envFileCleanup,
+    ),
+  };
 }
 
 /** Spawns proxy container and waits for it to be ready. */
@@ -589,7 +699,7 @@ export function wireCleanupHandlers(
   _cliConfig: Config | undefined,
   sshResult: SshAgentResult,
   portForwardingResult: PortForwardingResult | undefined,
-  credentialProxyBridgeResult: CredentialProxyBridgeResult | undefined,
+  credentialProxyBridgeCleanup: (() => void) | undefined,
   setCredentialProxyBridgeCleanup: (c: (() => void) | undefined) => void,
 ): void {
   sandboxProcess.on('error', (err) => {
@@ -608,20 +718,40 @@ export function wireCleanupHandlers(
     sandboxProcess.on('close', portForwardingResult.cleanup);
   }
 
-  if (credentialProxyBridgeResult?.cleanup !== undefined) {
-    const stopCredentialBridgeTunnel = credentialProxyBridgeResult.cleanup;
-    process.on('exit', stopCredentialBridgeTunnel);
-    process.on('SIGINT', stopCredentialBridgeTunnel);
-    process.on('SIGTERM', stopCredentialBridgeTunnel);
-    sandboxProcess.on('close', () => {
+  if (credentialProxyBridgeCleanup !== undefined) {
+    // Register the composed cleanup (bridge tunnel + env file) on all
+    // process-level events as well as the sandbox close event. This ensures
+    // tunnels are torn down even on abnormal exit where the sandbox close
+    // event may not fire.
+    let bridgeCleanedUp = false;
+    const runBridgeCleanup = (): void => {
+      if (bridgeCleanedUp) return;
+      bridgeCleanedUp = true;
+      credentialProxyBridgeCleanup();
+      process.off('exit', runBridgeCleanup);
+      process.off('SIGINT', runBridgeCleanup);
+      process.off('SIGTERM', runBridgeCleanup);
+      sandboxProcess.off('close', runBridgeCleanup);
       setCredentialProxyBridgeCleanup(undefined);
-      stopCredentialBridgeTunnel();
-    });
+    };
+    process.on('exit', runBridgeCleanup);
+    process.on('SIGINT', runBridgeCleanup);
+    process.on('SIGTERM', runBridgeCleanup);
+    sandboxProcess.on('close', runBridgeCleanup);
   }
 
   // @plan:PLAN-20250214-CREDPROXY.P34 R25.2, R25.3: Clean up credential proxy on sandbox exit
-  const stopCredentialProxy = () => {
-    void stopProxy();
+  let proxyStopped = false;
+  const stopCredentialProxy = (): void => {
+    if (proxyStopped) return;
+    proxyStopped = true;
+    process.off('exit', stopCredentialProxy);
+    process.off('SIGINT', stopCredentialProxy);
+    process.off('SIGTERM', stopCredentialProxy);
+    sandboxProcess.off('close', stopCredentialProxy);
+    void stopProxy().catch(() => {
+      // best-effort cleanup during shutdown
+    });
   };
   process.on('exit', stopCredentialProxy);
   process.on('SIGINT', stopCredentialProxy);

package/src/utils/sandbox-exec.ts

@@ -21,6 +21,7 @@ import type {
   SshAgentResult,
 } from './sandbox-ssh.js';
 import type { ContainerSandboxPrepared } from './sandbox-containers.js';
+import { runBestEffortSyncCleanup } from './cleanup.js';
 import {
   buildContainerRunArgs,
   addContainerVolumeMounts,
@@ -36,6 +37,7 @@ import {
   restoreStdinAfterSandbox,
   LOCAL_DEV_SANDBOX_IMAGE_NAME,
 } from './sandbox-containers.js';
+import { stopProxy } from '@vybestack/llxprt-code-providers/auth.js';
 import { entrypoint } from './sandbox-entrypoint.js';
 import { ensureSandboxImageIsPresent } from './sandbox-image.js';
 import {
@@ -197,7 +199,12 @@ async function prepareContainerSandbox(
     credentialProxyBridgeResult = cpResult.credentialProxyBridgeResult;
     credentialProxyBridgeCleanup = cpResult.credentialProxyBridgeCleanup;
   } catch (err) {
-    credentialProxyBridgeResult?.cleanup?.();
+    runBestEffortSyncCleanup(credentialProxyBridgeResult?.cleanup);
+    try {
+      await stopProxy();
+    } catch {
+      // best-effort cleanup; the original error is the one we want to throw
+    }
     if (err instanceof FatalSandboxError) {
       throw err;
     }
@@ -242,7 +249,6 @@ async function executeContainerSandbox(
     image,
     workdir,
     portForwardingResult,
-    credentialProxyBridgeResult,
     sshResult,
   } = prepared;
   let credentialProxyBridgeCleanup = prepared.credentialProxyBridgeCleanup;
@@ -279,7 +285,7 @@ async function executeContainerSandbox(
     cliConfig,
     sshResult,
     portForwardingResult,
-    credentialProxyBridgeResult,
+    credentialProxyBridgeCleanup,
     (c) => {
       credentialProxyBridgeCleanup = c;
     },

package/src/zed-integration/acp-terminal-shell-host.ts

@@ -0,0 +1,112 @@
+/**
+ * @license
+ * Copyright 2026 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import type {
+  IShellToolHost,
+  ShellExecutionResult,
+  ShellOutputEvent,
+} from '@vybestack/llxprt-code-tools';
+import type { TerminalManager } from './zed-terminal-manager.js';
+
+export class AcpTerminalShellHost implements IShellToolHost {
+  constructor(
+    private readonly delegate: IShellToolHost,
+    private readonly terminals: TerminalManager,
+  ) {}
+
+  getTargetDir(): string {
+    return this.delegate.getTargetDir();
+  }
+
+  getWorkspaceContext() {
+    return this.delegate.getWorkspaceContext();
+  }
+
+  isCommandAllowed(command: string) {
+    return this.delegate.isCommandAllowed(command);
+  }
+
+  isShellInvocationAllowlisted(command: string, toolName: string): boolean {
+    return this.delegate.isShellInvocationAllowlisted(command, toolName);
+  }
+
+  isInteractive(): boolean {
+    return this.delegate.isInteractive();
+  }
+
+  isYoloMode(): boolean {
+    return this.delegate.isYoloMode();
+  }
+
+  getDebugMode(): boolean {
+    return this.delegate.getDebugMode();
+  }
+
+  getShellExecutionConfig() {
+    return this.delegate.getShellExecutionConfig();
+  }
+
+  getTimeoutConfig() {
+    return this.delegate.getTimeoutConfig();
+  }
+
+  getOutputLimits() {
+    return this.delegate.getOutputLimits();
+  }
+
+  executeShellCommand(
+    command: string,
+    cwd: string,
+    onOutput: (event: ShellOutputEvent) => void,
+    signal: AbortSignal,
+  ): Promise<ShellExecutionResult> {
+    return this.terminals.executeShellCommand(command, cwd, onOutput, signal);
+  }
+
+  getCommandRoots(command: string): string[] {
+    return this.delegate.getCommandRoots(command);
+  }
+
+  stripShellWrapper(command: string): string {
+    return this.delegate.stripShellWrapper(command);
+  }
+
+  validatePathWithinWorkspace(
+    workspaceContext: ReturnType<IShellToolHost['getWorkspaceContext']>,
+    dirPath: string,
+    label: string,
+  ): string | null {
+    return this.delegate.validatePathWithinWorkspace(
+      workspaceContext,
+      dirPath,
+      label,
+    );
+  }
+
+  isPtyActive(pid: number): boolean {
+    return this.delegate.isPtyActive(pid);
+  }
+
+  formatMemoryUsage(bytes: number): string {
+    return this.delegate.formatMemoryUsage(bytes);
+  }
+
+  trySummarizeOutput(
+    content: string,
+    signal: AbortSignal,
+    tokenBudget?: number,
+  ): Promise<string> {
+    return this.delegate.trySummarizeOutput(content, signal, tokenBudget);
+  }
+
+  getSummarizeConfig() {
+    return this.delegate.getSummarizeConfig();
+  }
+
+  limitOutputTokens(content: string) {
+    return this.delegate.limitOutputTokens(content);
+  }
+}