@yeaft/webchat-agent 1.0.413 → 1.0.414

package/yeaft/init.js

@@ -9,6 +9,7 @@ import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, access
 import { join, dirname } from 'path';
 import { homedir } from 'os';
 import { createHash } from 'crypto';
+import { mutateAgentConfig } from './config-store.js';
 // NOTE: migrateSessions runs at the end of initYeaftDir(). It collapses
 // legacy groups/ + chats/ + memory/{group,chat}/ into the unified sessions/
 // layout AND rewrites pre-rename per-message frontmatter (groupId → sessionId).
@@ -31,9 +32,9 @@ export function isPermissionError(err) {
  * @param {string} content
  * @param {string[]} warnings — array to push warning messages into
  */
-function safeWriteFile(filePath, content, warnings) {
+function safeWriteFile(filePath, content, warnings, mode = 0o644) {
   try {
-    writeFileSync(filePath, content, { encoding: 'utf8', mode: 0o644 });
+    writeFileSync(filePath, content, { encoding: 'utf8', mode });
   } catch (err) {
     if (isPermissionError(err)) {
       warnings.push(`Cannot write ${filePath}: ${err.code}`);
@@ -49,9 +50,9 @@ function safeWriteFile(filePath, content, warnings) {
  * @param {string[]} warnings — array to push warning messages into
  * @returns {boolean} — true if directory exists (created or already existed)
  */
-function safeMkdir(dirPath, warnings) {
+function safeMkdir(dirPath, warnings, mode = 0o755) {
   try {
-    mkdirSync(dirPath, { recursive: true, mode: 0o755 });
+    mkdirSync(dirPath, { recursive: true, mode });
     return true;
   } catch (err) {
     if (isPermissionError(err)) {
@@ -168,7 +169,7 @@ export function initYeaftDir(dir) {
 
   // Ensure root exists
   if (!existsSync(root)) {
-    if (safeMkdir(root, warnings)) {
+    if (safeMkdir(root, warnings, 0o700)) {
       created.push(root);
     }
   }
@@ -194,8 +195,20 @@ export function initYeaftDir(dir) {
   // config.json — default configuration (user edits this directly)
   const configJsonPath = join(root, 'config.json');
   if (!existsSync(configJsonPath)) {
-    safeWriteFile(configJsonPath, DEFAULT_CONFIG_JSON, warnings);
-    created.push(configJsonPath);
+    let seeded = false;
+    try {
+      const defaults = JSON.parse(DEFAULT_CONFIG_JSON);
+      mutateAgentConfig(root, (current, state) => {
+        if (!state.exists) {
+          Object.assign(current, defaults);
+          seeded = true;
+        }
+      });
+      if (seeded) created.push(configJsonPath);
+    } catch (err) {
+      if (isPermissionError(err)) warnings.push(`Cannot write ${configJsonPath}: ${err.code}`);
+      else throw err;
+    }
   }
 
   const memoryPath = join(root, 'memory', 'MEMORY.md');

package/yeaft/sessions/feature-flag.js

@@ -12,8 +12,7 @@
 
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
-import { normalizePluginConfig } from '../plugins.js';
-import { writeAtomic } from '../storage/index.js';
+import { mutateAgentConfig } from '../config-store.js';
 
 const CONFIG_FILE = 'config.json';
 const FLAG_PATH = ['yeaft', 'multiVp', 'enabled'];
@@ -34,20 +33,6 @@ function readConfig(yeaftDir) {
  * remain tolerant because the flag is optional, but no mutation may replace a
  * malformed root or a Plugin policy that the runtime must keep fail-closed.
  */
-function readConfigForWrite(yeaftDir) {
-  const path = join(yeaftDir, CONFIG_FILE);
-  if (!existsSync(path)) return {};
-  const config = JSON.parse(readFileSync(path, 'utf8'));
-  if (!config || typeof config !== 'object' || Array.isArray(config)
-    || Object.getPrototypeOf(config) !== Object.prototype) {
-    throw new Error('config.json must contain an object');
-  }
-  if (Object.prototype.hasOwnProperty.call(config, 'plugins')) {
-    normalizePluginConfig(config.plugins);
-  }
-  return config;
-}
-
 export function isMultiVpEnabled(yeaftDir) {
   const cfg = readConfig(yeaftDir);
   let cur = cfg;
@@ -59,24 +44,21 @@ export function isMultiVpEnabled(yeaftDir) {
 }
 
 export function setMultiVpEnabled(yeaftDir, enabled) {
-  let cfg;
-  try {
-    cfg = readConfigForWrite(yeaftDir);
-  } catch (err) {
-    return { error: `Failed to read config.json: ${err?.message || err}` };
-  }
-  let cur = cfg;
-  for (let i = 0; i < FLAG_PATH.length - 1; i++) {
-    const seg = FLAG_PATH[i];
-    if (!cur[seg] || typeof cur[seg] !== 'object' || Array.isArray(cur[seg])) cur[seg] = {};
-    cur = cur[seg];
-  }
   const nextValue = Boolean(enabled);
-  cur[FLAG_PATH[FLAG_PATH.length - 1]] = nextValue;
   try {
-    writeAtomic(join(yeaftDir, CONFIG_FILE), JSON.stringify(cfg, null, 2));
-  } catch (err) {
-    return { error: `Failed to write config.json: ${err?.message || err}` };
+    return mutateAgentConfig(yeaftDir, config => {
+      let current = config;
+      for (let index = 0; index < FLAG_PATH.length - 1; index += 1) {
+        const segment = FLAG_PATH[index];
+        if (!current[segment] || typeof current[segment] !== 'object' || Array.isArray(current[segment])) {
+          current[segment] = {};
+        }
+        current = current[segment];
+      }
+      current[FLAG_PATH.at(-1)] = nextValue;
+      return { enabled: nextValue };
+    });
+  } catch (error) {
+    return { error: `Failed to read config.json or persist update: ${error?.message || error}` };
   }
-  return { enabled: nextValue };
 }

package/yeaft/storage/atomic.js

@@ -9,8 +9,8 @@
  * the only debris; they are safe to delete on boot (see sweepTmp()).
  *
  * Implementation:
- *   1. Write bytes to `path.tmp.<pid>.<counter>` via writeFileSync.
- *   2. fsync the tmp file (force bytes to disk before rename).
+ *   1. Exclusively create `path.tmp.<pid>.<counter>` and write through its fd.
+ *   2. fsync the same fd (force bytes to disk before rename).
  *   3. rename(tmp, path) — POSIX-atomic on same filesystem.
  *   4. fsync the parent dir (persist the rename itself).
  *
@@ -31,36 +31,62 @@ import {
   existsSync,
   unlinkSync,
   readdirSync,
+  lstatSync,
+  constants,
 } from 'fs';
 import { dirname, basename, join } from 'path';
 
 let tmpCounter = 0;
 
+export function nextAtomicTmpPathForTest(path) {
+  return `${path}.tmp.${process.pid}.${tmpCounter + 1}`;
+}
+
+function targetMode(path, requestedMode) {
+  try {
+    const stat = lstatSync(path);
+    if (!stat.isFile()) throw new Error(`Atomic write target is not a regular file: ${path}`);
+    const existingMode = stat.mode & 0o777;
+    return requestedMode == null ? existingMode : existingMode & requestedMode;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return requestedMode ?? 0o666;
+    throw error;
+  }
+}
+
 /**
  * Atomically write `data` (string | Buffer) to `path`.
  * Throws on failure; never leaves `path` in a half-written state.
+ *
+ * When supplied, `mode` is the maximum permission set for the replacement and
+ * is still restricted by umask. Existing files preserve any tighter permissions
+ * but never retain bits outside that explicit maximum. Omitted mode preserves
+ * the historical behavior: existing modes survive, new files default to 0666.
  */
-export function writeAtomic(path, data) {
+export function writeAtomic(path, data, { mode = null } = {}) {
   const dir = dirname(path);
   const tmpPath = `${path}.tmp.${process.pid}.${++tmpCounter}`;
-
-  writeFileSync(tmpPath, data);
-
-  // fsync the tmp file so the bytes hit disk before we swap.
+  const fileMode = targetMode(path, mode);
+  let fd = null;
   try {
-    const fd = openSync(tmpPath, 'r+');
-    try {
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
+    fd = openSync(
+      tmpPath,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
+      fileMode,
+    );
+    writeFileSync(fd, data);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmpPath, path);
+  } catch (error) {
+    if (fd !== null) {
+      try { closeSync(fd); } catch {}
+      try { unlinkSync(tmpPath); } catch {}
     }
-  } catch {
-    // Best-effort; some filesystems / platforms don't support fsync on a file
-    // opened r+. The rename below is still the atomic boundary.
+    throw error;
   }
 
-  renameSync(tmpPath, path);
-
   // fsync the parent directory so the rename is durable.
   // Windows: cannot fsync a directory; skip.
   if (process.platform !== 'win32') {

package/yeaft/tools/process-runner.js

@@ -71,18 +71,26 @@ function isSystemdScopeInactive(scope, spawnProcessSync) {
   }
 }
 
-function killProcessTree(proc, signalName, platform, spawnProcessSync, systemdScope) {
+function killProcessTree(
+  proc,
+  signalName,
+  platform,
+  spawnProcessSync,
+  systemdScope,
+  commandTimeoutMs = 5000,
+) {
   if (!proc.pid) return false;
   if (platform === 'win32') {
     try {
       const result = spawnProcessSync('taskkill', ['/pid', String(proc.pid), '/t', '/f'], {
         stdio: 'ignore',
         windowsHide: true,
-        timeout: 5000,
+        timeout: Math.max(1, commandTimeoutMs),
       });
       if (!result.error && result.status === 0) return true;
     } catch {}
-    try { return proc.kill(signalName) !== false; } catch { return false; }
+    try { proc.kill(signalName); } catch {}
+    return false;
   }
 
   let signalled = signalSystemdScope(systemdScope, signalName, spawnProcessSync);
@@ -96,12 +104,22 @@ function killProcessTree(proc, signalName, platform, spawnProcessSync, systemdSc
   return signalled;
 }
 
+function processGroupIsInactive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return true;
+  try {
+    process.kill(-pid, 0);
+    return false;
+  } catch (error) {
+    return error?.code === 'ESRCH';
+  }
+}
+
 /**
  * Execute a binary directly without a shell and keep captured output bounded.
  *
  * @param {string} command
  * @param {string[]} args
- * @param {{ cwd?: string, signal?: AbortSignal, timeoutMs?: number, maxBytes?: number, env?: NodeJS.ProcessEnv, preserveCarriageReturns?: boolean, killGraceMs?: number, forceSettleMs?: number, requireExitConfirmation?: boolean, systemdScope?: { unit: string, systemctlPath: string, env?: NodeJS.ProcessEnv } | null, onSettled?: (() => void) | null, platform?: NodeJS.Platform, spawnProcess?: typeof spawn, spawnProcessSync?: typeof spawnSync }} [options]
+ * @param {{ cwd?: string, signal?: AbortSignal, timeoutMs?: number, maxBytes?: number, env?: NodeJS.ProcessEnv, preserveCarriageReturns?: boolean, killGraceMs?: number, gracefulTerminationDeadline?: number, terminationDeadline?: number, forceSettleMs?: number, treeKillTimeoutMs?: number, requireExitConfirmation?: boolean, requireProcessGroupExit?: boolean, systemdScope?: { unit: string, systemctlPath: string, env?: NodeJS.ProcessEnv } | null, onSettled?: (() => void) | null, platform?: NodeJS.Platform, spawnProcess?: typeof spawn, spawnProcessSync?: typeof spawnSync }} [options]
  * @returns {Promise<{ code: number, stdout: string, stderr: string, truncated: boolean, timedOut: boolean, terminationError?: string }>}
  */
 export function runProcess(command, args, options = {}) {
@@ -123,6 +141,17 @@ export function runProcess(command, args, options = {}) {
     const forceSettleMs = Number.isFinite(options.forceSettleMs)
       ? Math.max(1, options.forceSettleMs)
       : DEFAULT_FORCE_SETTLE_MS;
+    const treeKillTimeoutMs = Number.isFinite(options.treeKillTimeoutMs)
+      ? Math.max(1, options.treeKillTimeoutMs)
+      : 5000;
+    const deadlineBudget = (maximum, deadline) => {
+      if (!Number.isFinite(deadline)) return maximum;
+      return Math.max(0, Math.min(maximum, deadline - Date.now()));
+    };
+    const terminationBudget = maximum => deadlineBudget(maximum, options.terminationDeadline);
+    const treeKillBudget = () => Number.isFinite(options.terminationDeadline)
+      ? terminationBudget(treeKillTimeoutMs)
+      : treeKillTimeoutMs;
     let proc;
     try {
       proc = spawnProcess(command, args, {
@@ -149,6 +178,8 @@ export function runProcess(command, args, options = {}) {
     let aborted = false;
     let stopRequested = false;
     let forceRequested = false;
+    let processTreeKillConfirmed = platform !== 'win32';
+    let treeKillFailed = false;
     let directClosed = false;
     let directCode = null;
     let timer = null;
@@ -217,7 +248,14 @@ export function runProcess(command, args, options = {}) {
     const terminationConfirmed = () => {
       if (!options.requireExitConfirmation) return directClosed;
       const scopeInactive = isSystemdScopeInactive(options.systemdScope, spawnProcessSync);
-      return directClosed && scopeInactive;
+      const processTreeInactive = !options.requireProcessGroupExit
+        || (platform === 'win32'
+          ? processTreeKillConfirmed
+          : processGroupIsInactive(proc.pid));
+      const treeKillSucceeded = platform !== 'win32'
+        || !options.requireProcessGroupExit
+        || !treeKillFailed;
+      return directClosed && scopeInactive && processTreeInactive && treeKillSucceeded;
     };
     const maybeFinishStopped = () => {
       if (settled || !stopRequested || !terminationConfirmed()) return false;
@@ -227,18 +265,30 @@ export function runProcess(command, args, options = {}) {
     const startConfirmationPolling = () => {
       if (!options.requireExitConfirmation || confirmationTimer) return;
       confirmationTimer = setInterval(maybeFinishStopped, CONFIRMATION_POLL_MS);
+      if (!options.requireProcessGroupExit) confirmationTimer.unref?.();
     };
     const forceStop = () => {
       if (settled || forceRequested) return;
       forceRequested = true;
+      const settleBudget = terminationBudget(forceSettleMs);
       killProcessTree(
         proc,
         'SIGKILL',
         platform,
         spawnProcessSync,
         options.systemdScope,
+        Math.max(1, treeKillBudget() || 1),
       );
       if (maybeFinishStopped()) return;
+      if (settleBudget <= 0) {
+        finish(
+          null,
+          options.requireExitConfirmation
+            ? new ProcessTerminationError(command, forceSettleMs)
+            : null,
+        );
+        return;
+      }
       forceSettleTimer = setTimeout(() => {
         if (maybeFinishStopped()) return;
         finish(
@@ -247,7 +297,7 @@ export function runProcess(command, args, options = {}) {
             ? new ProcessTerminationError(command, forceSettleMs)
             : null,
         );
-      }, forceSettleMs);
+      }, settleBudget);
     };
     const stop = () => {
       if (settled || stopRequested) return;
@@ -256,20 +306,35 @@ export function runProcess(command, args, options = {}) {
         // taskkill must run while the parent PID still identifies the tree.
         // It is already forceful, so do not wait for the direct child to exit.
         forceRequested = true;
-        killProcessTree(proc, 'SIGKILL', platform, spawnProcessSync, null);
+        const settleBudget = terminationBudget(forceSettleMs);
+        processTreeKillConfirmed = killProcessTree(
+          proc,
+          'SIGKILL',
+          platform,
+          spawnProcessSync,
+          null,
+          Math.max(1, treeKillBudget() || 1),
+        );
+        treeKillFailed = !processTreeKillConfirmed;
+        if (maybeFinishStopped()) return;
         if (!settled) {
-          forceSettleTimer = setTimeout(() => {
+          const finishAfterForce = () => {
+            if (maybeFinishStopped()) return;
             finish(
               null,
               options.requireExitConfirmation
                 ? new ProcessTerminationError(command, forceSettleMs)
                 : null,
             );
-          }, forceSettleMs);
+          };
+          const remainingSettleBudget = terminationBudget(forceSettleMs);
+          if (remainingSettleBudget <= 0) finishAfterForce();
+          else forceSettleTimer = setTimeout(finishAfterForce, remainingSettleBudget);
         }
         return;
       }
       startConfirmationPolling();
+      if (maybeFinishStopped()) return;
       killProcessTree(
         proc,
         'SIGTERM',
@@ -277,8 +342,12 @@ export function runProcess(command, args, options = {}) {
         spawnProcessSync,
         options.systemdScope,
       );
-      forceTimer = setTimeout(forceStop, killGraceMs);
-      forceTimer.unref?.();
+      const graceBudget = deadlineBudget(killGraceMs, options.gracefulTerminationDeadline);
+      if (graceBudget <= 0) forceStop();
+      else {
+        forceTimer = setTimeout(forceStop, graceBudget);
+        if (!options.requireProcessGroupExit) forceTimer.unref?.();
+      }
     };
     const onAbort = () => {
       aborted = true;
@@ -321,7 +390,7 @@ export function runProcess(command, args, options = {}) {
       if (settled) return;
       if (stopRequested) {
         directClosed = true;
-        finishStoppedChild();
+        if (platform !== 'win32' || !treeKillFailed || !options.requireProcessGroupExit) finishStoppedChild();
         return;
       }
       settled = true;
@@ -331,8 +400,12 @@ export function runProcess(command, args, options = {}) {
     onClose = code => {
       directClosed = true;
       directCode = code;
+      if (!stopRequested && options.requireProcessGroupExit && !terminationConfirmed()) {
+        stop();
+        return;
+      }
       if (stopRequested) {
-        finishStoppedChild();
+        if (platform !== 'win32' || !treeKillFailed || !options.requireProcessGroupExit) finishStoppedChild();
         return;
       }
       finish(code);