@xortex/xcode 3.0.0

package/utils/envDynamic.ts

@@ -0,0 +1,151 @@
+import { feature } from 'bun:bundle'
+import { stat } from 'fs/promises'
+import memoize from 'lodash-es/memoize.js'
+import { env, JETBRAINS_IDES } from './env.js'
+import { isEnvTruthy } from './envUtils.js'
+import { execFileNoThrow } from './execFileNoThrow.js'
+import { getAncestorCommandsAsync } from './genericProcessUtils.js'
+
+// Functions that require execFileNoThrow and thus cannot be in env.ts
+
+const getIsDocker = memoize(async (): Promise<boolean> => {
+  if (process.platform !== 'linux') return false
+  // Check for .dockerenv file
+  const { code } = await execFileNoThrow('test', ['-f', '/.dockerenv'])
+  return code === 0
+})
+
+function getIsBubblewrapSandbox(): boolean {
+  return (
+    process.platform === 'linux' &&
+    isEnvTruthy(process.env.CLAUDE_CODE_BUBBLEWRAP)
+  )
+}
+
+// Cache for the runtime musl detection fallback (node/unbundled only).
+// In native linux builds, feature flags resolve this at compile time, so the
+// cache is only consulted when both IS_LIBC_MUSL and IS_LIBC_GLIBC are false.
+let muslRuntimeCache: boolean | null = null
+
+// Fire-and-forget: populate the musl cache for the node fallback path.
+// Native builds never reach this (feature flags short-circuit), so this only
+// matters for unbundled node on Linux. Installer calls on native builds are
+// unaffected since feature() resolves at compile time.
+if (process.platform === 'linux') {
+  const muslArch = process.arch === 'x64' ? 'x86_64' : 'aarch64'
+  void stat(`/lib/libc.musl-${muslArch}.so.1`).then(
+    () => {
+      muslRuntimeCache = true
+    },
+    () => {
+      muslRuntimeCache = false
+    },
+  )
+}
+
+/**
+ * Checks if the system is using MUSL libc instead of glibc.
+ * In native linux builds, this is statically known at compile time via IS_LIBC_MUSL/IS_LIBC_GLIBC flags.
+ * In node (unbundled), both flags are false and we fall back to a runtime async stat check
+ * whose result is cached at module load. If the cache isn't populated yet, returns false.
+ */
+function isMuslEnvironment(): boolean {
+  if (feature('IS_LIBC_MUSL')) return true
+  if (feature('IS_LIBC_GLIBC')) return false
+
+  // Fallback for node: runtime detection via pre-populated cache
+  if (process.platform !== 'linux') return false
+  return muslRuntimeCache ?? false
+}
+
+// Cache for async JetBrains detection
+let jetBrainsIDECache: string | null | undefined
+
+async function detectJetBrainsIDEFromParentProcessAsync(): Promise<
+  string | null
+> {
+  if (jetBrainsIDECache !== undefined) {
+    return jetBrainsIDECache
+  }
+
+  if (process.platform === 'darwin') {
+    jetBrainsIDECache = null
+    return null // macOS uses bundle ID detection which is already handled
+  }
+
+  try {
+    // Get ancestor commands in a single call (avoids sync bash in loop)
+    const commands = await getAncestorCommandsAsync(process.pid, 10)
+
+    for (const command of commands) {
+      const lowerCommand = command.toLowerCase()
+      // Check for specific JetBrains IDEs in the command line
+      for (const ide of JETBRAINS_IDES) {
+        if (lowerCommand.includes(ide)) {
+          jetBrainsIDECache = ide
+          return ide
+        }
+      }
+    }
+  } catch {
+    // Silently fail - this is a best-effort detection
+  }
+
+  jetBrainsIDECache = null
+  return null
+}
+
+export async function getTerminalWithJetBrainsDetectionAsync(): Promise<
+  string | null
+> {
+  // Check for JetBrains terminal on Linux/Windows
+  if (process.env.TERMINAL_EMULATOR === 'JetBrains-JediTerm') {
+    // For macOS, bundle ID detection above already handles JetBrains IDEs
+    if (env.platform !== 'darwin') {
+      const specificIDE = await detectJetBrainsIDEFromParentProcessAsync()
+      return specificIDE || 'pycharm'
+    }
+  }
+  return env.terminal
+}
+
+// Synchronous version that returns cached result or falls back to env.terminal
+// Used for backward compatibility - callers should migrate to async version
+export function getTerminalWithJetBrainsDetection(): string | null {
+  // Check for JetBrains terminal on Linux/Windows
+  if (process.env.TERMINAL_EMULATOR === 'JetBrains-JediTerm') {
+    // For macOS, bundle ID detection above already handles JetBrains IDEs
+    if (env.platform !== 'darwin') {
+      // Return cached value if available, otherwise fall back to generic detection
+      // The async version should be called early in app initialization to populate cache
+      if (jetBrainsIDECache !== undefined) {
+        return jetBrainsIDECache || 'pycharm'
+      }
+      // Fall back to generic 'pycharm' if cache not populated yet
+      return 'pycharm'
+    }
+  }
+  return env.terminal
+}
+
+/**
+ * Initialize JetBrains IDE detection asynchronously.
+ * Call this early in app initialization to populate the cache.
+ * After this resolves, getTerminalWithJetBrainsDetection() will return accurate results.
+ */
+export async function initJetBrainsDetection(): Promise<void> {
+  if (process.env.TERMINAL_EMULATOR === 'JetBrains-JediTerm') {
+    await detectJetBrainsIDEFromParentProcessAsync()
+  }
+}
+
+// Combined export that includes all env properties plus dynamic functions
+export const envDynamic = {
+  ...env, // Include all properties from env
+  terminal: getTerminalWithJetBrainsDetection(),
+  getIsDocker,
+  getIsBubblewrapSandbox,
+  isMuslEnvironment,
+  getTerminalWithJetBrainsDetectionAsync,
+  initJetBrainsDetection,
+}

package/utils/envUtils.ts

@@ -0,0 +1,183 @@
+import memoize from 'lodash-es/memoize.js'
+import { homedir } from 'os'
+import { join } from 'path'
+
+// Memoized: 150+ callers, many on hot paths. Keyed off CLAUDE_CONFIG_DIR so
+// tests that change the env var get a fresh value without explicit cache.clear.
+export const getClaudeConfigHomeDir = memoize(
+  (): string => {
+    return (
+      process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude')
+    ).normalize('NFC')
+  },
+  () => process.env.CLAUDE_CONFIG_DIR,
+)
+
+export function getTeamsDir(): string {
+  return join(getClaudeConfigHomeDir(), 'teams')
+}
+
+/**
+ * Check if NODE_OPTIONS contains a specific flag.
+ * Splits on whitespace and checks for exact match to avoid false positives.
+ */
+export function hasNodeOption(flag: string): boolean {
+  const nodeOptions = process.env.NODE_OPTIONS
+  if (!nodeOptions) {
+    return false
+  }
+  return nodeOptions.split(/\s+/).includes(flag)
+}
+
+export function isEnvTruthy(envVar: string | boolean | undefined): boolean {
+  if (!envVar) return false
+  if (typeof envVar === 'boolean') return envVar
+  const normalizedValue = envVar.toLowerCase().trim()
+  return ['1', 'true', 'yes', 'on'].includes(normalizedValue)
+}
+
+export function isEnvDefinedFalsy(
+  envVar: string | boolean | undefined,
+): boolean {
+  if (envVar === undefined) return false
+  if (typeof envVar === 'boolean') return !envVar
+  if (!envVar) return false
+  const normalizedValue = envVar.toLowerCase().trim()
+  return ['0', 'false', 'no', 'off'].includes(normalizedValue)
+}
+
+/**
+ * --bare / CLAUDE_CODE_SIMPLE — skip hooks, LSP, plugin sync, skill dir-walk,
+ * attribution, background prefetches, and ALL keychain/credential reads.
+ * Auth is strictly ANTHROPIC_API_KEY env or apiKeyHelper from --settings.
+ * Explicit CLI flags (--plugin-dir, --add-dir, --mcp-config) still honored.
+ * ~30 gates across the codebase.
+ *
+ * Checks argv directly (in addition to the env var) because several gates
+ * run before main.tsx's action handler sets CLAUDE_CODE_SIMPLE=1 from --bare
+ * — notably startKeychainPrefetch() at main.tsx top-level.
+ */
+export function isBareMode(): boolean {
+  return (
+    isEnvTruthy(process.env.CLAUDE_CODE_SIMPLE) ||
+    process.argv.includes('--bare')
+  )
+}
+
+/**
+ * Parses an array of environment variable strings into a key-value object
+ * @param envVars Array of strings in KEY=VALUE format
+ * @returns Object with key-value pairs
+ */
+export function parseEnvVars(
+  rawEnvArgs: string[] | undefined,
+): Record<string, string> {
+  const parsedEnv: Record<string, string> = {}
+
+  // Parse individual env vars
+  if (rawEnvArgs) {
+    for (const envStr of rawEnvArgs) {
+      const [key, ...valueParts] = envStr.split('=')
+      if (!key || valueParts.length === 0) {
+        throw new Error(
+          `Invalid environment variable format: ${envStr}, environment variables should be added as: -e KEY1=value1 -e KEY2=value2`,
+        )
+      }
+      parsedEnv[key] = valueParts.join('=')
+    }
+  }
+  return parsedEnv
+}
+
+/**
+ * Get the AWS region with fallback to default
+ * Matches the Anthropic Bedrock SDK's region behavior
+ */
+export function getAWSRegion(): string {
+  return process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1'
+}
+
+/**
+ * Get the default Vertex AI region
+ */
+export function getDefaultVertexRegion(): string {
+  return process.env.CLOUD_ML_REGION || 'us-east5'
+}
+
+/**
+ * Check if bash commands should maintain project working directory (reset to original after each command)
+ * @returns true if CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR is set to a truthy value
+ */
+export function shouldMaintainProjectWorkingDir(): boolean {
+  return isEnvTruthy(process.env.CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR)
+}
+
+/**
+ * Check if running on Homespace (ant-internal cloud environment)
+ */
+export function isRunningOnHomespace(): boolean {
+  return (
+    process.env.USER_TYPE === 'ant' &&
+    isEnvTruthy(process.env.COO_RUNNING_ON_HOMESPACE)
+  )
+}
+
+/**
+ * Conservative check for whether Claude Code is running inside a protected
+ * (privileged or ASL3+) COO namespace or cluster.
+ *
+ * Conservative means: when signals are ambiguous, assume protected. We would
+ * rather over-report protected usage than miss it. Unprotected environments
+ * are homespace, namespaces on the open allowlist, and no k8s/COO signals
+ * at all (laptop/local dev).
+ *
+ * Used for telemetry to measure auto-mode usage in sensitive environments.
+ */
+export function isInProtectedNamespace(): boolean {
+  // USER_TYPE is build-time --define'd; in external builds this block is
+  // DCE'd so the require() and namespace allowlist never appear in the bundle.
+  if (process.env.USER_TYPE === 'ant') {
+    /* eslint-disable @typescript-eslint/no-require-imports */
+    return (
+      require('./protectedNamespace.js') as typeof import('./protectedNamespace.js')
+    ).checkProtectedNamespace()
+    /* eslint-enable @typescript-eslint/no-require-imports */
+  }
+  return false
+}
+
+// @[MODEL LAUNCH]: Add a Vertex region override env var for the new model.
+/**
+ * Model prefix → env var for Vertex region overrides.
+ * Order matters: more specific prefixes must come before less specific ones
+ * (e.g., 'claude-opus-4-1' before 'claude-opus-4').
+ */
+const VERTEX_REGION_OVERRIDES: ReadonlyArray<[string, string]> = [
+  ['claude-haiku-4-5', 'VERTEX_REGION_CLAUDE_HAIKU_4_5'],
+  ['claude-3-5-haiku', 'VERTEX_REGION_CLAUDE_3_5_HAIKU'],
+  ['claude-3-5-sonnet', 'VERTEX_REGION_CLAUDE_3_5_SONNET'],
+  ['claude-3-7-sonnet', 'VERTEX_REGION_CLAUDE_3_7_SONNET'],
+  ['claude-opus-4-1', 'VERTEX_REGION_CLAUDE_4_1_OPUS'],
+  ['claude-opus-4', 'VERTEX_REGION_CLAUDE_4_0_OPUS'],
+  ['claude-sonnet-4-6', 'VERTEX_REGION_CLAUDE_4_6_SONNET'],
+  ['claude-sonnet-4-5', 'VERTEX_REGION_CLAUDE_4_5_SONNET'],
+  ['claude-sonnet-4', 'VERTEX_REGION_CLAUDE_4_0_SONNET'],
+]
+
+/**
+ * Get the Vertex AI region for a specific model.
+ * Different models may be available in different regions.
+ */
+export function getVertexRegionForModel(
+  model: string | undefined,
+): string | undefined {
+  if (model) {
+    const match = VERTEX_REGION_OVERRIDES.find(([prefix]) =>
+      model.startsWith(prefix),
+    )
+    if (match) {
+      return process.env[match[1]] || getDefaultVertexRegion()
+    }
+  }
+  return getDefaultVertexRegion()
+}

package/utils/envValidation.ts

@@ -0,0 +1,38 @@
+import { logForDebugging } from './debug.js'
+
+export type EnvVarValidationResult = {
+  effective: number
+  status: 'valid' | 'capped' | 'invalid'
+  message?: string
+}
+
+export function validateBoundedIntEnvVar(
+  name: string,
+  value: string | undefined,
+  defaultValue: number,
+  upperLimit: number,
+): EnvVarValidationResult {
+  if (!value) {
+    return { effective: defaultValue, status: 'valid' }
+  }
+  const parsed = parseInt(value, 10)
+  if (isNaN(parsed) || parsed <= 0) {
+    const result: EnvVarValidationResult = {
+      effective: defaultValue,
+      status: 'invalid',
+      message: `Invalid value "${value}" (using default: ${defaultValue})`,
+    }
+    logForDebugging(`${name} ${result.message}`)
+    return result
+  }
+  if (parsed > upperLimit) {
+    const result: EnvVarValidationResult = {
+      effective: upperLimit,
+      status: 'capped',
+      message: `Capped from ${parsed} to ${upperLimit}`,
+    }
+    logForDebugging(`${name} ${result.message}`)
+    return result
+  }
+  return { effective: parsed, status: 'valid' }
+}

package/utils/errorLogSink.ts

@@ -0,0 +1,235 @@
+/**
+ * Error log sink implementation
+ *
+ * This module contains the heavy implementation for error logging and should be
+ * initialized during app startup. It handles file-based error logging to disk.
+ *
+ * Usage: Call initializeErrorLogSink() during app startup to attach the sink.
+ *
+ * DESIGN: This module is separate from log.ts to avoid import cycles.
+ * log.ts has NO heavy dependencies - events are queued until this sink is attached.
+ */
+
+import axios from 'src/utils/axios.js'
+import { dirname, join } from 'path'
+import { getSessionId } from '../bootstrap/state.js'
+import { createBufferedWriter } from './bufferedWriter.js'
+import { CACHE_PATHS } from './cachePaths.js'
+import { registerCleanup } from './cleanupRegistry.js'
+import { logForDebugging } from './debug.js'
+import { getFsImplementation } from './fsOperations.js'
+import { attachErrorLogSink, dateToFilename } from './log.js'
+import { jsonStringify } from './slowOperations.js'
+
+const DATE = dateToFilename(new Date())
+
+/**
+ * Gets the path to the errors log file.
+ */
+export function getErrorsPath(): string {
+  return join(CACHE_PATHS.errors(), DATE + '.jsonl')
+}
+
+/**
+ * Gets the path to MCP logs for a server.
+ */
+export function getMCPLogsPath(serverName: string): string {
+  return join(CACHE_PATHS.mcpLogs(serverName), DATE + '.jsonl')
+}
+
+type JsonlWriter = {
+  write: (obj: object) => void
+  flush: () => void
+  dispose: () => void
+}
+
+function createJsonlWriter(options: {
+  writeFn: (content: string) => void
+  flushIntervalMs?: number
+  maxBufferSize?: number
+}): JsonlWriter {
+  const writer = createBufferedWriter(options)
+  return {
+    write(obj: object): void {
+      writer.write(jsonStringify(obj) + '\n')
+    },
+    flush: writer.flush,
+    dispose: writer.dispose,
+  }
+}
+
+// Buffered writers for JSONL log files, keyed by path
+const logWriters = new Map<string, JsonlWriter>()
+
+/**
+ * Flush all buffered log writers. Used for testing.
+ * @internal
+ */
+export function _flushLogWritersForTesting(): void {
+  for (const writer of logWriters.values()) {
+    writer.flush()
+  }
+}
+
+/**
+ * Clear all buffered log writers. Used for testing.
+ * @internal
+ */
+export function _clearLogWritersForTesting(): void {
+  for (const writer of logWriters.values()) {
+    writer.dispose()
+  }
+  logWriters.clear()
+}
+
+function getLogWriter(path: string): JsonlWriter {
+  let writer = logWriters.get(path)
+  if (!writer) {
+    const dir = dirname(path)
+    writer = createJsonlWriter({
+      // sync IO: called from sync context
+      writeFn: (content: string) => {
+        try {
+          // Happy-path: directory already exists
+          getFsImplementation().appendFileSync(path, content)
+        } catch {
+          // If any error occurs, assume it was due to missing directory
+          getFsImplementation().mkdirSync(dir)
+          // Retry appending
+          getFsImplementation().appendFileSync(path, content)
+        }
+      },
+      flushIntervalMs: 1000,
+      maxBufferSize: 50,
+    })
+    logWriters.set(path, writer)
+    registerCleanup(async () => writer?.dispose())
+  }
+  return writer
+}
+
+function appendToLog(path: string, message: object): void {
+  if (process.env.USER_TYPE !== 'ant') {
+    return
+  }
+
+  const messageWithTimestamp = {
+    timestamp: new Date().toISOString(),
+    ...message,
+    cwd: getFsImplementation().cwd(),
+    userType: process.env.USER_TYPE,
+    sessionId: getSessionId(),
+    version: MACRO.VERSION,
+  }
+
+  getLogWriter(path).write(messageWithTimestamp)
+}
+
+function extractServerMessage(data: unknown): string | undefined {
+  if (typeof data === 'string') {
+    return data
+  }
+  if (data && typeof data === 'object') {
+    const obj = data as Record<string, unknown>
+    if (typeof obj.message === 'string') {
+      return obj.message
+    }
+    if (
+      typeof obj.error === 'object' &&
+      obj.error &&
+      'message' in obj.error &&
+      typeof (obj.error as Record<string, unknown>).message === 'string'
+    ) {
+      return (obj.error as Record<string, unknown>).message as string
+    }
+  }
+  return undefined
+}
+
+/**
+ * Implementation for logError - writes error to debug log and file.
+ */
+function logErrorImpl(error: Error): void {
+  const errorStr = error.stack || error.message
+
+  // Enrich axios errors with request URL, status, and server message for debugging
+  let context = ''
+  if (axios.isAxiosError(error) && error.config?.url) {
+    const parts = [`url=${error.config.url}`]
+    if (error.response?.status !== undefined) {
+      parts.push(`status=${error.response.status}`)
+    }
+    const serverMessage = extractServerMessage(error.response?.data)
+    if (serverMessage) {
+      parts.push(`body=${serverMessage}`)
+    }
+    context = `[${parts.join(',')}] `
+  }
+
+  logForDebugging(`${error.name}: ${context}${errorStr}`, { level: 'error' })
+
+  appendToLog(getErrorsPath(), {
+    error: `${context}${errorStr}`,
+  })
+}
+
+/**
+ * Implementation for logMCPError - writes MCP error to debug log and file.
+ */
+function logMCPErrorImpl(serverName: string, error: unknown): void {
+  // Not themed, to avoid having to pipe theme all the way down
+  logForDebugging(`MCP server "${serverName}" ${error}`, { level: 'error' })
+
+  const logFile = getMCPLogsPath(serverName)
+  const errorStr =
+    error instanceof Error ? error.stack || error.message : String(error)
+
+  const errorInfo = {
+    error: errorStr,
+    timestamp: new Date().toISOString(),
+    sessionId: getSessionId(),
+    cwd: getFsImplementation().cwd(),
+  }
+
+  getLogWriter(logFile).write(errorInfo)
+}
+
+/**
+ * Implementation for logMCPDebug - writes MCP debug message to log file.
+ */
+function logMCPDebugImpl(serverName: string, message: string): void {
+  logForDebugging(`MCP server "${serverName}": ${message}`)
+
+  const logFile = getMCPLogsPath(serverName)
+
+  const debugInfo = {
+    debug: message,
+    timestamp: new Date().toISOString(),
+    sessionId: getSessionId(),
+    cwd: getFsImplementation().cwd(),
+  }
+
+  getLogWriter(logFile).write(debugInfo)
+}
+
+/**
+ * Initialize the error log sink.
+ *
+ * Call this during app startup to attach the error logging backend.
+ * Any errors logged before this is called will be queued and drained.
+ *
+ * Should be called BEFORE initializeAnalyticsSink() in the startup sequence.
+ *
+ * Idempotent: safe to call multiple times (subsequent calls are no-ops).
+ */
+export function initializeErrorLogSink(): void {
+  attachErrorLogSink({
+    logError: logErrorImpl,
+    logMCPError: logMCPErrorImpl,
+    logMCPDebug: logMCPDebugImpl,
+    getErrorsPath,
+    getMCPLogsPath,
+  })
+
+  logForDebugging('Error log sink initialized')
+}