@xingular/harness 0.1.3 → 0.1.4

package/dist/cli.js

@@ -9921,7 +9921,7 @@ var TerminalController = class {
 };
 
 // src/terminal/socket.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash7, randomBytes } from "node:crypto";
 import { chmodSync as chmodSync10, mkdirSync as mkdirSync12, rmSync as rmSync8, statSync as statSync6 } from "node:fs";
 import { createServer as createServer2 } from "node:net";
 import { tmpdir } from "node:os";
@@ -9929,13 +9929,22 @@ import { dirname as dirname12, join as join37 } from "node:path";
 var MAX_REQUEST_BYTES = 1024 * 1024;
 var MAX_SOCKET_PATH = 100;
 function socketPath(stateDir) {
+  if (process.platform === "win32") return `\\\\.\\pipe\\xingular-harness-${randomBytes(12).toString("hex")}`;
   const path3 = join37(stateDir, "run", "harness.sock");
   if (Buffer.byteLength(path3) <= MAX_SOCKET_PATH) return path3;
   return join37(tmpdir(), `xh-${createHash7("sha256").update(path3).digest("hex").slice(0, 16)}.sock`);
 }
+var isPipePath = (path3) => path3.startsWith("\\\\.\\pipe\\");
 function refusedBind(path3, error) {
   const code = error?.code;
   if (code !== "EACCES" && code !== "EPERM") return error;
+  if (isPipePath(path3)) {
+    return new HarnessError(
+      "session_socket_denied",
+      `The session pipe ${path3} could not be created (${code}).`,
+      "Start the harness again from your own user session. If it keeps failing, report this code and the Windows version."
+    );
+  }
   let folder;
   try {
     const stat = statSync6(dirname12(path3));
@@ -10046,18 +10055,22 @@ var SessionSocket = class {
   /** Binds the socket once; later calls wait for the same bind. */
   listen() {
     this.listening ??= new Promise((resolve10, reject) => {
-      mkdirSync12(dirname12(this.path), { recursive: true, mode: 448 });
-      rmSync8(this.path, { force: true });
+      if (!isPipePath(this.path)) {
+        mkdirSync12(dirname12(this.path), { recursive: true, mode: 448 });
+        rmSync8(this.path, { force: true });
+      }
       const server = createServer2((client) => this.serve(client));
       server.once("error", (error) => {
         this.listening = null;
         reject(refusedBind(this.path, error));
       });
       server.listen(this.path, () => {
-        try {
-          chmodSync10(this.path, 384);
-        } catch (error) {
-          log("session socket permissions", error instanceof Error ? error.message : String(error));
+        if (!isPipePath(this.path)) {
+          try {
+            chmodSync10(this.path, 384);
+          } catch (error) {
+            log("session socket permissions", error instanceof Error ? error.message : String(error));
+          }
         }
         this.server = server;
         resolve10();
@@ -10072,7 +10085,7 @@ var SessionSocket = class {
     this.listening = null;
     for (const client of this.clients) client.destroy();
     if (server) await new Promise((resolve10) => server.close(() => resolve10()));
-    rmSync8(this.path, { force: true });
+    if (!isPipePath(this.path)) rmSync8(this.path, { force: true });
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xingular/harness",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "description": "Xingular Harness — a Pi agent harness with multi-account sign-in, a compiled system prompt, a memory lifecycle (Wiki), tools, MCP, and skills",
   "repository": {

package/src/terminal/socket.test.ts

@@ -1,13 +1,56 @@
 import { chmodSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'
+import { createConnection } from 'node:net'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 
-import { SessionSocket } from './socket'
+import { SessionSocket, socketPath } from './socket'
 
 const handlers = { memory: () => '', apps: async () => null }
 
+/** Runs `body` as if on another operating system; `process.platform` is read at call time. */
+function onPlatform<T>(platform: NodeJS.Platform, body: () => T): T {
+  const original = Object.getOwnPropertyDescriptor(process, 'platform')!
+  Object.defineProperty(process, 'platform', { value: platform })
+  try {
+    return body()
+  } finally {
+    Object.defineProperty(process, 'platform', original)
+  }
+}
+
+describe('session socket path', () => {
+  it('keeps the socket file in the state folder on Unix', () => {
+    expect(onPlatform('darwin', () => socketPath('/tmp/state'))).toBe(join('/tmp/state', 'run', 'harness.sock'))
+  })
+
+  it('uses a named pipe on Windows, with a random name each time', () => {
+    const first = onPlatform('win32', () => socketPath('C:\\Users\\someone\\.xingular-harness\\state'))
+    const second = onPlatform('win32', () => socketPath('C:\\Users\\someone\\.xingular-harness\\state'))
+    expect(first).toMatch(/^\\\\\.\\pipe\\xingular-harness-[0-9a-f]{24}$/)
+    expect(second).not.toBe(first)
+  })
+})
+
 describe('session socket', () => {
+  it.skipIf(process.platform !== 'win32')('listens on a named pipe and answers a request on Windows', async () => {
+    const socket = new SessionSocket(socketPath('unused'), handlers)
+    await socket.listen()
+    try {
+      const reply = await new Promise<string>((resolve, reject) => {
+        const client = createConnection(socket.path)
+        let buffer = ''
+        client.on('connect', () => client.write('{"token":"nope","call":"wiki.read"}\n'))
+        client.on('data', (chunk) => (buffer += chunk.toString('utf8')))
+        client.on('end', () => resolve(buffer))
+        client.on('error', reject)
+      })
+      expect(JSON.parse(reply)).toMatchObject({ error: { code: 'unauthorized' } })
+    } finally {
+      await socket.close()
+    }
+  })
+
   it('names the folder and the user when the operating system refuses to create the socket', async () => {
     // Root can write anywhere, so the refusal cannot be produced there.
     if (process.platform === 'win32' || process.getuid?.() === 0) return

package/src/terminal/socket.ts

@@ -1,9 +1,9 @@
 // The session socket: how a process the harness did not start in-process (the `pi` command in
 // a terminal, with its extension and the `agentx-wiki` / `agentx-mcp` commands) reaches the
-// session it belongs to. Owner-only Unix socket, newline-delimited JSON, one request per
-// connection. Each terminal session holds a random token bound to its caller, its connected-apps
-// grant, and its controller; the token stops working when the terminal ends.
-import { createHash } from 'node:crypto'
+// session it belongs to. Owner-only Unix socket (a named pipe on Windows), newline-delimited JSON,
+// one request per connection. Each terminal session holds a random token bound to its caller, its
+// connected-apps grant, and its controller; the token stops working when the terminal ends.
+import { createHash, randomBytes } from 'node:crypto'
 import { chmodSync, mkdirSync, rmSync, statSync } from 'node:fs'
 import { createServer, type Server, type Socket } from 'node:net'
 import { tmpdir } from 'node:os'
@@ -42,16 +42,32 @@ const MAX_REQUEST_BYTES = 1024 * 1024
 /** macOS refuses a socket path longer than 103 bytes. */
 const MAX_SOCKET_PATH = 100
 
+/**
+ * Windows has no socket files for Node's `net`: it listens on a named pipe, which lives in a
+ * machine-wide namespace. A random name keeps another local process from guessing it and standing
+ * in front of the session; the token still decides what a caller may do.
+ */
 export function socketPath(stateDir: string): string {
+  if (process.platform === 'win32') return `\\\\.\\pipe\\xingular-harness-${randomBytes(12).toString('hex')}`
   const path = join(stateDir, 'run', 'harness.sock')
   if (Buffer.byteLength(path) <= MAX_SOCKET_PATH) return path
   return join(tmpdir(), `xh-${createHash('sha256').update(path).digest('hex').slice(0, 16)}.sock`)
 }
 
+/** A named pipe has no folder, file mode, or owner to check or clean up. */
+const isPipePath = (path: string): boolean => path.startsWith('\\\\.\\pipe\\')
+
 /** Names the folder and the user when the operating system refuses the socket, so the cause shows. */
 function refusedBind(path: string, error: unknown): unknown {
   const code = (error as { code?: unknown } | null)?.code
   if (code !== 'EACCES' && code !== 'EPERM') return error
+  if (isPipePath(path)) {
+    return new HarnessError(
+      'session_socket_denied',
+      `The session pipe ${path} could not be created (${code}).`,
+      'Start the harness again from your own user session. If it keeps failing, report this code and the Windows version.'
+    )
+  }
   let folder: string
   try {
     const stat = statSync(dirname(path))
@@ -169,18 +185,22 @@ export class SessionSocket {
   /** Binds the socket once; later calls wait for the same bind. */
   listen(): Promise<void> {
     this.listening ??= new Promise<void>((resolve, reject) => {
-      mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 })
-      rmSync(this.path, { force: true })
+      if (!isPipePath(this.path)) {
+        mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 })
+        rmSync(this.path, { force: true })
+      }
       const server = createServer((client) => this.serve(client))
       server.once('error', (error) => {
         this.listening = null
         reject(refusedBind(this.path, error))
       })
       server.listen(this.path, () => {
-        try {
-          chmodSync(this.path, 0o600)
-        } catch (error) {
-          log('session socket permissions', error instanceof Error ? error.message : String(error))
+        if (!isPipePath(this.path)) {
+          try {
+            chmodSync(this.path, 0o600)
+          } catch (error) {
+            log('session socket permissions', error instanceof Error ? error.message : String(error))
+          }
         }
         this.server = server
         resolve()
@@ -196,6 +216,6 @@ export class SessionSocket {
     this.listening = null
     for (const client of this.clients) client.destroy()
     if (server) await new Promise<void>((resolve) => server.close(() => resolve()))
-    rmSync(this.path, { force: true })
+    if (!isPipePath(this.path)) rmSync(this.path, { force: true })
   }
 }