acbridge 0.0.1 → 1.0.0

package/plugin/plugins/alexa/scripts/statusline.mjs

@@ -0,0 +1,322 @@
+#!/usr/bin/env node
+// Statusline TEE for the Alexa voice-bridge plugin (states expansion). Installed as Claude Code's
+// `statusLine` command by `acbridge` (cli/src/statusline-install.ts — reversible; off-switch
+// BRIDGE_STATUSLINE=0 or `"autoStatusline": false` in ~/.claude-bridge/config.json).
+//
+// Claude runs this on every message with a JSON snapshot on stdin. We tee it two ways, in parallel:
+//   1. POST the EXACT context % (context_window.used_percentage) and the rate-limit percentages
+//      (rate_limits.five_hour/seven_day — Pro/Max only) to the hub's /local/session/context. This is
+//      the data feed for the usageHigh threshold state (hooks can't see rate limits) and the freshest
+//      source for contextLow/contextCritical (message-cadence vs the hooks' tool-cadence).
+//   2. RENDER: chain the user's ORIGINAL statusline command (stored at install as config.json
+//      `statusline.prev`) with our stdin passed through verbatim — or print a default one-liner.
+//
+// A statusline must never hang Claude's repaint: the POST is fire-and-forget (short timeout, runs
+// while the chain renders), a hard deadline bounds the whole run, and EVERY path prints something and
+// exits 0. Zero-dep and self-contained like signal.mjs (a plugin script can't import the workspace).
+//
+// It must also never REPRODUCE. The deadline bounds each process's lifetime, not the chain's depth, so a
+// `prev` pointing back at this script spawns an unbounded treadmill (2026-07-30: 372 node.exe / 18.65 GB).
+// statusline-guard.mjs holds the refusal predicates; every spawn here goes through them.
+
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { request } from "node:http";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { readActiveUserSub, resolveBridgeHome, resolveHubTokenFile, writePlainSessionHandshakeIfAbsent } from "./scope.mjs";
+import { chainChildEnv, selectStatuslinePrev, shouldChain } from "./statusline-guard.mjs";
+
+const DEFAULT_HUB_PORT = 8790; // mirrors @bridge/node-core HUB_PORT — the plugin can't import the workspace
+// The home of the hub this box is actually running (scope.mjs Part C) — the same resolution signal.mjs
+// does, so the statusline's context ferry and the state signals can never target different hub homes.
+const BRIDGE_HOME = resolveBridgeHome();
+const SECRET_DIR = BRIDGE_HOME.dir;
+// `statusline.prev` is LOCAL-INSTALLER state: node-core writes it to THIS machine's own ~/.claude-bridge
+// (node-core's SECRET_DIR is never peer-resolved). BRIDGE_HOME, by contrast, IS the peer home (WSL↔Windows,
+// scope.mjs Part C) whenever the live hub sits on the other side of that boundary — so reading `prev` from
+// it would chain a command written for the OTHER OS's shell: a `node "C:\…"` string handed to /bin/sh. That
+// fails, silently replacing the user's real statusline with our default line. Hub coordinates (port, token,
+// handshakes) legitimately come from BRIDGE_HOME; `prev` alone is local. Env override mirrors
+// resolveBridgeHomeWith's own explicit-dir branch, so the two agree in tests and under BRIDGE_SECRET_DIR.
+const LOCAL_DIR = process.env.BRIDGE_SECRET_DIR || path.join(os.homedir(), ".claude-bridge");
+/** This file's real path — the guard's strongest self-recognition signal. */
+const SELF_PATH = (() => {
+  try {
+    return fileURLToPath(import.meta.url);
+  } catch {
+    return "";
+  }
+})();
+const POST_TIMEOUT_MS = 400; // a statusline repaint budget is tight — never wait on a slow hub
+const DEADLINE_MS = 1500; // hard ceiling for the whole run (chain included)
+
+let rendered = false;
+function render(line) {
+  if (rendered) return;
+  rendered = true;
+  process.stdout.write(line.endsWith("\n") ? line : line + "\n");
+}
+
+/** Resolves when the tee POST settles (response drained / error / timeout); null when no POST was made.
+ *  finish() waits on it (bounded) — a hard process.exit while the request is in flight would cut it. */
+let postPending = null;
+
+/** The chained child, while one is running — so finish() can kill it instead of orphaning it. */
+let activeChild = null;
+
+/** Exit 0 no matter what, printing SOMETHING first — a blank statusline beats a hung one. The LINE is
+ *  already on stdout before we wait for the tee, so the repaint never blocks on the hub. */
+function finish(line) {
+  if (!rendered) render(line ?? "⏺ Claude");
+  // Kill any chained child before exiting. process.exit() alone ORPHANS it — and an orphan that keeps
+  // spawning is precisely how the 2026-07-30 treadmill outlived every parent's DEADLINE_MS.
+  if (activeChild) {
+    const c = activeChild;
+    activeChild = null;
+    try {
+      c.kill();
+    } catch {
+      /* already gone */
+    }
+  }
+  if (!postPending) process.exit(0);
+  const t = setTimeout(() => process.exit(0), POST_TIMEOUT_MS + 100);
+  t.unref?.();
+  postPending.then(() => process.exit(0), () => process.exit(0));
+}
+setTimeout(() => finish(), DEADLINE_MS).unref?.();
+process.on("uncaughtException", () => finish());
+
+// ── stdin: the statusline JSON snapshot. Unparsable → still render a stub and exit 0. ────────────────
+let raw = "";
+let snap = {};
+try {
+  raw = readFileSync(0, "utf8");
+  snap = JSON.parse(raw || "{}");
+} catch {
+  snap = null;
+}
+
+// ── Hub coordinates: the same three-tier resolve as signal.mjs (env → handshake file → self-derive). ──
+const isPlaceholder = (v) => Boolean(v) && /^\$\{.*\}$/.test(v);
+const envVar = (v) => (v && !isPlaceholder(v) ? v : undefined);
+
+function readConfigIn(dir) {
+  try {
+    return JSON.parse(readFileSync(path.join(dir, "config.json"), "utf8")) || {};
+  } catch {
+    return {}; // no config file → env + hostname defaults
+  }
+}
+
+function readCliConfig() {
+  const file = readConfigIn(SECRET_DIR);
+  // See LOCAL_DIR: `prev` comes from the LOCAL home, never a peer's. Same object in the common case
+  // (homes match), so this costs one extra read only on a genuinely cross-home box.
+  const localFile = LOCAL_DIR === SECRET_DIR ? file : readConfigIn(LOCAL_DIR);
+  return {
+    machine: envVar(process.env.BRIDGE_MACHINE) || file.machine || os.hostname().split(".")[0] || "node",
+    // The resolved home's beacon carries the port the hub actually bound — authoritative over the default
+    // when the hub lives in a peer home (WSL↔Windows) whose config.json this side doesn't own.
+    hubPort: Number(envVar(process.env.BRIDGE_HUB_PORT) || BRIDGE_HOME.beacon?.port || file.hubPort || DEFAULT_HUB_PORT),
+    autoProfiles: file.autoProfiles,
+    statuslinePrev: selectStatuslinePrev({ local: localFile, resolved: file }),
+  };
+}
+
+function resolveHandshake(cfg, sessionId, cwd) {
+  const envId = envVar(process.env.BRIDGE_SESSION_ID);
+  if (envId) {
+    return {
+      id: envId,
+      hubPort: Number(envVar(process.env.BRIDGE_HUB_PORT)) || DEFAULT_HUB_PORT,
+      // AS-T9f Part A: env wins; else scoped step (users/<seg>/hub-token) → machine-global.
+      hubTokenFile: resolveHubTokenFile(SECRET_DIR, envVar(process.env.BRIDGE_HUB_TOKEN_FILE)),
+    };
+  }
+  if (sessionId) {
+    try {
+      const h = JSON.parse(readFileSync(path.join(SECRET_DIR, "sessions", `${sessionId}.json`), "utf8"));
+      if (h && h.id) {
+        // AS-T9f Part A: the file's scoped hubTokenFile is authoritative; a legacy file without it falls
+        // to the scoped step → machine-global.
+        return { id: h.id, hubPort: Number(h.hubPort) || DEFAULT_HUB_PORT, hubTokenFile: resolveHubTokenFile(SECRET_DIR, h.hubTokenFile) };
+      }
+    } catch {
+      /* no per-session handshake → try self-derive */
+    }
+  }
+  // AUTO-PROFILES self-derive (default on): a hub is set up on this machine ⇒ derive project@machine.
+  const env = process.env.BRIDGE_AUTO_PROFILES;
+  if (env === "0" || env === "false" || cfg.autoProfiles === false) return null;
+  // AS-T9f Part A: scoped-first hub-token; the dormancy gate reads whichever the chain resolves.
+  const hubTokenFile = resolveHubTokenFile(SECRET_DIR, undefined);
+  try {
+    if (!readFileSync(hubTokenFile, "utf8").trim()) return null;
+  } catch {
+    return null; // no hub token (scoped or machine-global) → bridge not set up here → render-only
+  }
+  const dir = typeof cwd === "string" && cwd ? cwd : process.cwd();
+  const id = `${path.basename(dir) || "session"}@${cfg.machine}`;
+  // AS-T9f Part B (owner-approved restore): stamp a plain session's handshake for the SIGNED-IN account so
+  // the hub adopts its context/usage ticks (same rule as signal.mjs — the statusline tee fires on every
+  // message, so whichever of the two hooks runs first writes; the other no-ops on existsSync). No account ⇒
+  // nothing written; an acbridge run / channel file is never overwritten.
+  writePlainSessionHandshakeIfAbsent({
+    secretDir: SECRET_DIR,
+    id,
+    hubPort: cfg.hubPort,
+    hubTokenFile,
+    cwd: dir,
+    claudeSessionId: typeof sessionId === "string" ? sessionId : undefined,
+    sub: readActiveUserSub(SECRET_DIR),
+  });
+  return { id, hubPort: cfg.hubPort, hubTokenFile };
+}
+
+// ── The tee POST (fire-and-forget; failures are invisible — rendering never depends on it). ──────────
+function postReading(cfg) {
+  if (!snap || typeof snap !== "object") return;
+  const cw = snap.context_window;
+  const rl = snap.rate_limits;
+  const pct = cw && typeof cw.used_percentage === "number" ? Math.min(100, Math.max(0, cw.used_percentage)) : undefined;
+  const win = (w) =>
+    w && typeof w.used_percentage === "number"
+      ? { usedPct: Math.min(100, Math.max(0, w.used_percentage)), ...(typeof w.resets_at === "number" ? { resetsAt: Math.round(w.resets_at * 1000) } : {}) }
+      : undefined;
+  const fiveHour = win(rl && rl.five_hour);
+  const sevenDay = win(rl && rl.seven_day);
+  // Mode/model FERRY (raw, undiffed — the hub synthesizes modelChanged/mode states from per-session diffs).
+  // The statusline JSON carries model {id, display_name} but NO permission_mode today (July 2026) — the
+  // guard is future-proofing; the mode ferry's live source is signal.mjs's transcript read.
+  const modelId = snap.model && typeof snap.model.id === "string" && snap.model.id ? snap.model.id : undefined;
+  const modelName = snap.model && typeof snap.model.display_name === "string" && snap.model.display_name ? snap.model.display_name : undefined;
+  const mode = typeof snap.permission_mode === "string" && snap.permission_mode ? snap.permission_mode : undefined;
+  // Claude review tee (S2): the PR review-state snapshot field (docs/CLAUDE-SIGNALS.md §5's verified
+  // schema — `pr.review_state`, one of approved|pending|changes_requested|draft). Ferried verbatim,
+  // additive, OMITTED (never null) when absent — the hub's tracker does the baseline-quiet diff.
+  const review = snap.pr && typeof snap.pr === "object" && typeof snap.pr.review_state === "string" && snap.pr.review_state ? snap.pr.review_state : undefined;
+  // Cost FERRY: the statusline JSON carries a running total spend (USD) for the session — feeds the
+  // hub's costHigh threshold state the same way pct/rateLimits feed usageHigh/contextHigh.
+  const cost = snap.cost && typeof snap.cost.total_cost_usd === "number" ? snap.cost.total_cost_usd : undefined;
+  if (pct === undefined && !fiveHour && !sevenDay) return; // nothing to report (early session)
+
+  const cwd = typeof snap.cwd === "string" ? snap.cwd : undefined;
+  const handshake = resolveHandshake(cfg, typeof snap.session_id === "string" ? snap.session_id : undefined, cwd);
+  if (!handshake) return;
+  let token;
+  try {
+    token = readFileSync(handshake.hubTokenFile, "utf8").trim();
+  } catch {
+    return;
+  }
+  if (!token) return;
+
+  const payload = JSON.stringify({
+    sessionId: handshake.id,
+    ...(typeof snap.session_id === "string" ? { claudeSessionId: snap.session_id } : {}),
+    ...(cwd ? { cwd } : {}),
+    ts: Date.now(),
+    ...(pct !== undefined
+      ? {
+          context: {
+            pct,
+            ...(cw && typeof cw.total_input_tokens === "number" ? { usedTokens: cw.total_input_tokens } : {}),
+            ...(cw && typeof cw.context_window_size === "number" ? { windowTokens: cw.context_window_size } : {}),
+          },
+        }
+      : {}),
+    ...(fiveHour || sevenDay ? { rateLimits: { ...(fiveHour ? { fiveHour } : {}), ...(sevenDay ? { sevenDay } : {}) } } : {}),
+    ...(modelId ? { model: modelId } : {}),
+    ...(modelName ? { modelName } : {}),
+    ...(mode ? { mode } : {}),
+    ...(review ? { review } : {}),
+    ...(typeof cost === "number" ? { cost } : {}),
+  });
+  // node:http for zero deps + no Origin header (the loopback guard 403s any Origin) + a hard timeout.
+  postPending = new Promise((resolve) => {
+    const req = request(
+      {
+        host: "127.0.0.1",
+        port: handshake.hubPort,
+        path: "/local/session/context",
+        method: "POST",
+        headers: { "content-type": "application/json", "content-length": Buffer.byteLength(payload), "x-bridge-hub-token": token },
+        timeout: POST_TIMEOUT_MS,
+      },
+      (res) => {
+        res.on("data", () => {});
+        res.on("end", resolve);
+      },
+    );
+    req.on("timeout", () => {
+      req.destroy();
+      resolve();
+    });
+    req.on("error", resolve); // hub down → silent; the render must not care
+    req.end(payload);
+  });
+}
+
+// ── Render: chain the stored original statusline, or print the default line. ─────────────────────────
+function defaultLine() {
+  if (!snap || typeof snap !== "object") return "⏺ Claude";
+  const model = (snap.model && (snap.model.display_name || snap.model.id)) || "Claude";
+  const parts = [`⏺ ${model}`];
+  const cw = snap.context_window;
+  if (cw && typeof cw.used_percentage === "number") parts.push(`ctx ${Math.round(cw.used_percentage)}%`);
+  const fh = snap.rate_limits && snap.rate_limits.five_hour;
+  if (fh && typeof fh.used_percentage === "number") parts.push(`5h ${Math.round(fh.used_percentage)}%`);
+  return parts.join(" · ");
+}
+
+function renderChained(prev) {
+  // chainChildEnv stamps the depth fuse, so whatever we spawn cannot itself chain — the chain is capped at
+  // depth 1 even if `prev` turns out to reach this script by a route the guard didn't recognise.
+  const child = spawn(prev, { shell: true, stdio: ["pipe", "pipe", "ignore"], env: chainChildEnv(process.env) });
+  activeChild = child;
+  let out = "";
+  let settled = false;
+  const settle = (line) => {
+    if (settled) return;
+    settled = true;
+    finish(line);
+  };
+  child.stdout.on("data", (c) => (out += c.toString()));
+  // A chained statusline is under no obligation to READ the snapshot — starship, oh-my-posh and most shell
+  // one-liners never touch stdin. When such a child exits before our write drains, the pipe breaks and node
+  // emits EPIPE on child.stdin; an 'error' event with no listener is THROWN, so the uncaughtException handler
+  // above calls finish() before anything has rendered and the user's real line is replaced by "⏺ Claude".
+  // The try/catch around .end() cannot see it — EPIPE arrives asynchronously. Swallowing it is correct on its
+  // own terms too: the child not wanting our stdin says nothing about whether its OUTPUT is good, and close/
+  // error below already decide the line.
+  child.stdin.on("error", () => {});
+  child.on("error", () => {
+    activeChild = null;
+    settle(defaultLine()); // prev vanished → fall back, never blank
+  });
+  child.on("close", () => {
+    activeChild = null;
+    render(out.trimEnd() || defaultLine());
+    settle();
+  });
+  try {
+    child.stdin.end(raw); // the SAME stdin snapshot, byte-for-byte — the chained line sees what we saw
+  } catch {
+    settle(defaultLine());
+  }
+}
+
+const cfg = readCliConfig();
+try {
+  postReading(cfg);
+} catch {
+  /* the tee must never break the render */
+}
+// Guarded: refuse a `prev` that is (or re-enters) THIS script, and refuse to chain at all when we are
+// already a chained child. Either refusal falls through to defaultLine() — the documented fallback, i.e. a
+// cosmetically plainer statusline instead of an unbounded spawn chain.
+if (shouldChain(cfg.statuslinePrev, { env: process.env, selfPath: SELF_PATH })) renderChained(cfg.statuslinePrev);
+else finish(defaultLine());