aegis-desktop 0.5.3 → 0.5.4

package/lib/local/turn-guard.js

@@ -0,0 +1,297 @@
+'use strict';
+
+/**
+ * Turn-start foreign-write detection.
+ *
+ * Ported from aegiscodex-dev/src/turn-guard.js (ESM → CommonJS).
+ *
+ * Bug this exists for: the commit-time scope check already knew how to tell
+ * "my changes" from "somebody else's in-flight work" — but only *after* a
+ * task had finished. The dangerous window is the opposite end: a session
+ * reads a file, time passes, a second agent edits that file, and the first
+ * session then acts on a stale mental model. That is how a live session
+ * destroyed a peer's work — the content it reverted was real and correct,
+ * just not the content it had read.
+ *
+ * `git checkout HEAD -- <file>`, `git reset --hard`, `git stash` and
+ * `git clean` are the destructive operations, and their default scope is the
+ * whole tree. Running any of them while a peer has uncommitted work is the
+ * entire incident.
+ *
+ * Fix: snapshot the dirty set at turn start, record the paths this session
+ * actually writes, then answer two questions on demand —
+ *   `foreignSince()` / `concurrentSince()`   whose work is in the tree
+ *   `blocksDestructive()`                    would a given command clobber it
+ * The second is load-bearing: it turns "revert someone else's file" into a
+ * refusal, which is the cheapest place to stop it.
+ *
+ * This is detection, not prevention — it cannot stop a writer outside the
+ * host. Paired with worktree-lock.js it covers our own sessions.
+ */
+
+const { gitRoot, gitStatusSnapshot } = require('./git-scope.js');
+
+/** Git's own flags that consume the *next* argv entry, so that token is not
+ * the subcommand. Without this, `git -C /repo reset --hard` parses `reset`
+ * as a flag argument and the whole command reads as harmless. */
+const GIT_FLAGS_WITH_ARG = new Set([
+  '-C', '-c', '--git-dir', '--work-tree', '--namespace', '--exec-path',
+]);
+
+/** Split a command line into shell segments and then argv, stripping quotes.
+ * Segmenting on `&&`/`;`/`|` means `ls && git checkout -- a` is still caught,
+ * while `git stash list` is judged on its own segment. */
+function tokenize(command) {
+  const out = [];
+  for (const segment of String(command || '').split(/[|;&\n]+/)) {
+    const argv = [];
+    const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    let m;
+    while ((m = re.exec(segment))) argv.push(m[1] ?? m[2] ?? m[3]);
+    if (argv.length) out.push(argv);
+  }
+  return out;
+}
+
+/** The git subcommand and its arguments in one argv, or null if this argv
+ * isn't a git invocation that has a subcommand. */
+function gitInvocation(argv) {
+  const i = argv.findIndex((t) => t === 'git' || t.endsWith('/git'));
+  if (i === -1) return null;
+  let j = i + 1;
+  while (j < argv.length && argv[j].startsWith('-')) {
+    j += GIT_FLAGS_WITH_ARG.has(argv[j]) ? 2 : 1;
+  }
+  if (j >= argv.length) return null;
+  return { sub: argv[j], args: argv.slice(j + 1) };
+}
+
+/** Positional arguments (the paths a command names), dropping flags. Values
+ * after `--` are always paths; before it, anything not starting with `-` is
+ * taken as one, which is right for checkout/restore and harmlessly unused
+ * elsewhere. */
+function namedPaths(args) {
+  const sep = args.indexOf('--');
+  if (sep !== -1) return args.slice(sep + 1).filter((a) => !a.startsWith('-'));
+  return args.filter((a) => !a.startsWith('-'));
+}
+
+const isTreeMark = (p) => p === '.' || p === './' || p === '*' || p === './*';
+const hasForce = (args) => args.some((a) => a === '-f' || a === '--force' || /^-[a-zA-Z]*f/.test(a));
+
+/** subcommand -> { what, scope } where scope is 'tree' (discards broadly) or
+ * 'paths' (discards only the paths it names). Returns null when harmless. */
+function judge(sub, args) {
+  const paths = namedPaths(args);
+  const treeWide = paths.length === 0 || paths.some(isTreeMark);
+  switch (sub) {
+    case 'checkout':
+      if (args.includes('--') || hasForce(args)) {
+        return { what: 'checkout of uncommitted changes', scope: treeWide ? 'tree' : 'paths', paths };
+      }
+      // `git checkout .` restores the whole tree; a bare branch switch is safe.
+      if (treeWide && paths.length) return { what: 'checkout . (tree-wide restore)', scope: 'tree', paths };
+      return null;
+    case 'restore':
+      return { what: 'restore (discards uncommitted changes)', scope: treeWide ? 'tree' : 'paths', paths };
+    case 'reset':
+      return args.includes('--hard') ? { what: 'reset --hard', scope: 'tree', paths: [] } : null;
+    case 'clean':
+      return hasForce(args) ? { what: 'clean -f (deletes untracked files)', scope: 'tree', paths: [] } : null;
+    case 'stash': {
+      const first = args.find((a) => !a.startsWith('-'));
+      if (first === 'list' || first === 'show') return null;
+      // pop/apply can conflict with, and push parks, every path in the tree.
+      return { what: `stash ${first || 'push'} (uncommitted changes across the tree)`, scope: 'tree', paths: [] };
+    }
+    case 'worktree': {
+      const first = args.find((a) => !a.startsWith('-'));
+      return first === 'remove' || first === 'prune'
+        ? { what: `worktree ${first}`, scope: 'tree', paths: [] }
+        : null;
+    }
+    default:
+      return null;
+  }
+}
+
+/**
+ * Classify a shell command line. Returns
+ * `{destructive:false}` or `{destructive:true, what, scope:'tree'|'paths', paths}`.
+ *
+ * Parsed as argv rather than matched as text, because a message *about* a
+ * destructive command is not one: `git commit -m "fix stash handling"` must
+ * not read as a stash. Quoting is handled, so the two are actually different.
+ */
+function classifyDestructive(command) {
+  for (const argv of tokenize(command)) {
+    const inv = gitInvocation(argv);
+    if (!inv) continue;
+    const verdict = judge(inv.sub, inv.args);
+    if (verdict) return { destructive: true, ...verdict };
+  }
+  return { destructive: false };
+}
+
+/**
+ * Begin guarding a turn in `cwd`. Costs one `git status`; a non-repo (or a
+ * git failure) yields a guard that reports nothing, so callers never have to
+ * branch on whether the guard is armed.
+ */
+function beginTurnGuard(cwd) {
+  const root = gitRoot(cwd);
+  const before = root ? gitStatusSnapshot(cwd) : null;
+  return {
+    root,
+    cwd,
+    before,
+    startedAt: Date.now(),
+    written: new Set(),
+    active: Boolean(root && before),
+  };
+}
+
+/** Normalise a written path to root-relative, so it can be compared against
+ * porcelain output. Accepts absolute or relative paths. */
+function toRel(guard, p) {
+  let s = String(p || '');
+  if (!s) return null;
+  if (guard.root && s.startsWith(guard.root)) {
+    s = s.slice(guard.root.length).replace(/^[/\\]/, '');
+  }
+  return s.split('\\').join('/');
+}
+
+/**
+ * Record a path this session itself wrote. A recorded path is never reported
+ * as foreign — this is what keeps the guard from crying wolf about the
+ * caller's own edits, and it is why the host's file tools must call it.
+ */
+function recordWrite(guard, p) {
+  if (!guard || !guard.active) return;
+  const rel = toRel(guard, p);
+  if (rel) guard.written.add(rel);
+}
+
+/**
+ * Paths that are *unambiguously* a peer's in-flight work: dirty when the turn
+ * started, byte-identical now, and never written by this session.
+ *
+ * "Dirty before and still identical" is what makes this confident — a path
+ * nobody touched is dirty *because* it belongs to someone else. It is
+ * git-scope's own definition, which is why the two modules agree.
+ */
+function foreignSince(guard) {
+  if (!guard || !guard.active) return [];
+  const now = gitStatusSnapshot(guard.cwd);
+  if (!now) return [];
+  const out = [];
+  for (const [p, hash] of now) {
+    if (guard.written.has(p)) continue;
+    if (guard.before.has(p) && guard.before.get(p) === hash) out.push(p);
+  }
+  return out.sort();
+}
+
+/**
+ * Paths clean at turn start and dirty now, excluding any this session
+ * recorded writing.
+ *
+ * Weaker than `foreignSince` because attribution is incomplete: the host's
+ * file tools call `recordWrite`, but a path a shell command creates
+ * (`> out.txt`, `npm install`) is invisible here and can be mistaken for a
+ * peer's. Still reported, and still consulted by `blocksDestructive` — see
+ * the asymmetry note there.
+ */
+function concurrentSince(guard) {
+  if (!guard || !guard.active) return [];
+  const now = gitStatusSnapshot(guard.cwd);
+  if (!now) return [];
+  const out = [];
+  for (const [p] of now) {
+    if (guard.written.has(p)) continue;
+    if (!guard.before.has(p)) out.push(p);
+  }
+  return out.sort();
+}
+
+/**
+ * Would running `command` be unsafe right now? Returns `{ok:true}` or
+ * `{ok:false, what, scope, reason, foreign, unattributed}`.
+ *
+ * Scope decides what has to be at risk:
+ *  - a *tree-wide* op (`git reset --hard`, `git stash`, `git checkout .`) is
+ *    refused whenever any peer work is present, because it cannot help but
+ *    touch it;
+ *  - a *path-scoped* op is refused only when one of the paths it names is
+ *    actually foreign, so reverting your own file still works while a peer
+ *    happens to be editing a different one.
+ *
+ * Both signals count, because the risk is asymmetric: a refusal costs the
+ * caller one step (name the paths, or take the lock), while a miss destroys
+ * work that may exist nowhere else. In the incident this module exists for,
+ * the peer's files appeared *during* the turn, so the confident signal was
+ * empty — blocking on it alone would have missed the exact case that
+ * motivated the guard.
+ *
+ * A tree with nothing foreign is never blocked, so a solo session is never
+ * wedged: the module is inert unless somebody else's work is present.
+ */
+function blocksDestructive(guard, command) {
+  const verdict = classifyDestructive(command);
+  if (!verdict.destructive) return { ok: true };
+  if (!guard || !guard.active) return { ok: true };
+
+  let foreign = foreignSince(guard);
+  let unattributed = concurrentSince(guard).filter((p) => !foreign.includes(p));
+
+  let atRisk = [];
+  if (verdict.scope === 'tree') {
+    atRisk = [...foreign, ...unattributed];
+  } else {
+    const named = new Set(verdict.paths.map((p) => p.replace(/^\.\//, '')));
+    const hits = (list) => list.filter((p) => named.has(p) || named.has('./' + p));
+    foreign = hits(foreign);
+    unattributed = hits(unattributed);
+    atRisk = [...foreign, ...unattributed];
+  }
+  if (!atRisk.length) return { ok: true, what: verdict.what };
+
+  const parts = [];
+  if (foreign.length) {
+    parts.push(
+      `${foreign.length} hold another agent's uncommitted work: `
+      + foreign.slice(0, 8).join(', ') + (foreign.length > 8 ? ` (+${foreign.length - 8} more)` : ''),
+    );
+  }
+  if (unattributed.length) {
+    parts.push(
+      `${unattributed.length} changed since this turn began and were not written by `
+      + `this session: ${unattributed.slice(0, 8).join(', ')}`
+      + (unattributed.length > 8 ? ` (+${unattributed.length - 8} more)` : ''),
+    );
+  }
+  return {
+    ok: false,
+    what: verdict.what,
+    scope: verdict.scope,
+    foreign,
+    unattributed,
+    reason:
+      `refusing \`${verdict.what}\` in ${guard.root}: `
+      + (verdict.scope === 'tree'
+        ? 'it is tree-scoped and would discard work it did not create — '
+        : 'it targets a path that is not yours to discard — ')
+      + parts.join('; ')
+      + '. Name only the paths you mean, or take the worktree lock first.',
+  };
+}
+
+module.exports = {
+  classifyDestructive,
+  beginTurnGuard,
+  recordWrite,
+  foreignSince,
+  concurrentSince,
+  blocksDestructive,
+};

package/lib/local/worktree-lock.js

@@ -0,0 +1,232 @@
+'use strict';
+
+/**
+ * Cross-process lock on a git working tree.
+ *
+ * Ported from aegiscodex-dev/src/worktree-lock.js (ESM → CommonJS).
+ *
+ * Bug this exists for: nothing keyed on *the working tree*. A session-scoped
+ * lock only stops two processes resuming the SAME transcript, so three
+ * different sessions in one checkout are three different ids and therefore
+ * all legal. A queue-worker lock only serialises queue drains. An interactive
+ * session took no lock at all.
+ *
+ * So N agents editing one checkout was, by every existing lock, correct
+ * behaviour — and it is destructive. It happened for real: one session ran
+ * `git checkout HEAD --` against a file a second session was mid-edit on
+ * (destroying it), a third ran `git stash` and parked everybody's tree, and a
+ * test run on that shared tree reported failures belonging to a half-built
+ * feature that was not the caller's. Git has no advisory locking, so none of
+ * it produced an error — just unexplained file changes, which is exactly the
+ * kind of evidence that gets misread as "my tool lied to me".
+ *
+ * Fix: a lock keyed on the repository root — the resource actually contended
+ * — taken by every host that runs a turn (the desktop app and the CLI both
+ * reach this file through desktop/lib/local/engine.js). Same atomic-marker +
+ * PID-liveness pattern as the session lock, so a crashed holder is reclaimed
+ * with no staleness window to tune and no manual cleanup.
+ *
+ * This lock is advisory and cooperative: it cannot stop a writer that does
+ * not take it (a plain `git` in a terminal, another harness, an editor). Its
+ * value is that our own hosts stop racing each other, and that a caller
+ * receiving `null` knows to back off instead of writing blind.
+ *
+ * The stronger fix is one worktree per agent (`git worktree add`), which
+ * removes the shared mutable tree entirely. This lock is what makes the
+ * single-tree case safe when that is not available.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+
+/**
+ * Where lock files live.
+ *
+ * The plugin's data dir is ~/.aegiscode ($AEGISCODE_HOME), per config.js's
+ * `aegisDir()` convention — but the dev engine's ~/.aegiscodex is honoured
+ * too, and either `*_WORKTREE_LOCK_DIR` override points every host at ONE
+ * directory. That override is the interlock: two separate tools disagreeing
+ * about where the lock file goes is the same as having no lock, so operators
+ * running the GUI, the CLI and the dev engine against one checkout should set
+ * AEGISCODE_WORKTREE_LOCK_DIR (or AEGISCODEX_WORKTREE_LOCK_DIR) to a shared
+ * path. Within this repo the desktop and CLI hosts always agree, because both
+ * resolve this same helper.
+ */
+function worktreeLockDir() {
+  if (process.env.AEGISCODE_WORKTREE_LOCK_DIR) return process.env.AEGISCODE_WORKTREE_LOCK_DIR;
+  if (process.env.AEGISCODEX_WORKTREE_LOCK_DIR) return process.env.AEGISCODEX_WORKTREE_LOCK_DIR;
+  const home = process.env.AEGISCODE_HOME
+    || process.env.AEGISCODEX_HOME
+    || path.join(os.homedir(), '.aegiscode');
+  return path.join(home, 'worktree-locks');
+}
+
+/** Default wait: a live holder is bounded by its own turn watchdog, so
+ * waiting slightly past that lets a legitimate queued turn run once the
+ * holder's deadline fires, rather than failing right as the tree is about to
+ * free up. */
+const DEFAULT_WORKTREE_WAIT_MS = 11 * 60 * 1000;
+
+/** Sentinel token for the "not in a repo" no-op path — always truthy, never
+ * matches a real acquisition, so a stray release() can't release anything. */
+const NOOP_TOKEN = '(no-worktree)';
+
+/**
+ * Canonicalise the root so two paths to one repo — a symlink, a trailing
+ * slash, a relative path, `/tmp/../repo` — agree on a single lock file.
+ * Falls back to the resolved path when realpath fails.
+ */
+function canonical(root) {
+  if (!root) return null;
+  const abs = path.resolve(String(root));
+  try { return fs.realpathSync(abs); } catch { return abs; }
+}
+
+/** The lock file for `root`. The path is hashed so an arbitrarily long or
+ * awkward root maps to one flat, safe filename; the root itself is written
+ * inside the file for humans reading the lock dir. */
+function worktreeLockPath(root) {
+  if (!root) return null;
+  const key = crypto.createHash('sha1').update(canonical(root)).digest('hex').slice(0, 16);
+  return path.join(worktreeLockDir(), key + '.lock');
+}
+
+function pidAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch { return false; }
+}
+
+function readHolder(root) {
+  try { return JSON.parse(fs.readFileSync(worktreeLockPath(root), 'utf8')); } catch { return null; }
+}
+
+/**
+ * The current holder of `root`'s lock, or null. Never throws and never
+ * clears a stale lock — use `isWorktreeLocked` for the reclaiming check.
+ */
+function worktreeLockHolder(root) {
+  if (!root) return null;
+  const h = readHolder(root);
+  if (!h) return null;
+  return {
+    pid: h.pid, token: h.token, since: h.since,
+    root: h.root || canonical(root), session: h.session || null,
+  };
+}
+
+/**
+ * True if `root` is held by a live process (any process, including this one
+ * — two concurrent callers inside one process must still queue behind each
+ * other). A lock file whose PID is dead or unparsable is stale and cleared as
+ * a side effect, so callers never special-case it.
+ */
+function isWorktreeLocked(root) {
+  if (!root) return false;
+  const holder = readHolder(root);
+  // `Number(null)` is 0 and `process.kill(0, 0)` targets the caller's process
+  // GROUP, so it succeeds — a missing lock file would otherwise read as a live
+  // holder forever. Require a real pid. (The session lock has the same latent
+  // trap; it never surfaced there only because it is called after EEXIST.)
+  const pid = Number(holder && holder.pid);
+  if (!Number.isInteger(pid) || pid <= 0 || !pidAlive(pid)) {
+    try { fs.unlinkSync(worktreeLockPath(root)); } catch {}
+    return false;
+  }
+  return true;
+}
+
+/** Exclusive-create the lock file for `token`. Returns true on success.
+ * Best-effort: a data-dir failure other than "already exists" fails OPEN so a
+ * broken filesystem can never block a turn that would otherwise run fine. */
+function tryAcquire(root, token, meta) {
+  try {
+    fs.mkdirSync(worktreeLockDir(), { recursive: true });
+    const fd = fs.openSync(worktreeLockPath(root), 'wx');
+    fs.writeFileSync(fd, JSON.stringify({
+      pid: process.pid,
+      token,
+      since: Date.now(),
+      root: canonical(root),
+      session: (meta && meta.session) || null,
+    }));
+    fs.closeSync(fd);
+    return true;
+  } catch (e) {
+    if (e && e.code === 'EEXIST') return false;
+    return true;
+  }
+}
+
+/** Release `root`'s lock — only if `token` matches the current holder, so
+ * releasing a lock you don't (or no longer) own can never clobber whoever
+ * holds it now. No-op on a falsy root/token or any filesystem error
+ * (best-effort, like the rest of this repo's persistence helpers). */
+function releaseWorktreeLock(root, token) {
+  if (!root || !token || token === NOOP_TOKEN) return;
+  const holder = readHolder(root);
+  if (holder && holder.token === token) {
+    try { fs.unlinkSync(worktreeLockPath(root)); } catch {}
+  }
+}
+
+/**
+ * Acquire `root`'s lock, waiting out a live holder instead of racing it.
+ * Resolves a truthy opaque token once acquired — pass it back to
+ * `releaseWorktreeLock` — or `null` if `waitMs` elapses or `signal` aborts
+ * first; either way the caller must not write. A falsy `root` (not inside a
+ * git work tree — nothing shared to collide over) resolves the sentinel
+ * immediately with no file touched.
+ */
+async function acquireWorktreeLock(root, {
+  waitMs = DEFAULT_WORKTREE_WAIT_MS, pollMs = 200, signal, session = null,
+} = {}) {
+  if (!root) return NOOP_TOKEN;
+  const token = crypto.randomUUID();
+  const deadline = Date.now() + waitMs;
+  for (;;) {
+    if (signal && signal.aborted) return null;
+    if (tryAcquire(root, token, { session })) return token;
+    // Was stale, just reclaimed by clearing — retry now.
+    if (!isWorktreeLocked(root)) continue;
+    if (Date.now() >= deadline) return null;
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+}
+
+/**
+ * Run `fn` holding `root`'s lock, releasing it on every exit path. Throws
+ * `WorktreeBusyError` (rather than running unprotected) if the lock can't be
+ * taken, because proceeding without it is the bug this module exists to
+ * prevent.
+ */
+class WorktreeBusyError extends Error {
+  constructor(root, holder) {
+    super(`working tree ${root} is locked by pid ${holder ? holder.pid : '?'}`);
+    this.name = 'WorktreeBusyError';
+    this.root = root;
+    this.holder = holder || null;
+  }
+}
+
+async function withWorktreeLock(root, opts, fn) {
+  const token = await acquireWorktreeLock(root, opts);
+  if (!token) throw new WorktreeBusyError(root, worktreeLockHolder(root));
+  try {
+    return await fn();
+  } finally {
+    releaseWorktreeLock(root, token);
+  }
+}
+
+module.exports = {
+  DEFAULT_WORKTREE_WAIT_MS,
+  worktreeLockDir,
+  worktreeLockPath,
+  worktreeLockHolder,
+  isWorktreeLocked,
+  releaseWorktreeLock,
+  acquireWorktreeLock,
+  WorktreeBusyError,
+  withWorktreeLock,
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
@@ -29,10 +29,10 @@
     "icon": "node scripts/generate-icon.mjs",
     "dist": "npm run predist && electron-builder",
     "dist:dir": "npm run predist && electron-builder --dir",
-    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/max-tokens.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check lib/local/context.js && node --check lib/local/providers.js && node --check lib/local/ollama.js && node --check lib/local/engine.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check bin/aegis.js",
+    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check lib/local/context.js && node --check lib/local/providers.js && node --check lib/local/ollama.js && node --check lib/local/engine.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check bin/aegis.js",
     "test:shell": "node ../test/desktop-shell.mjs",
     "test:model": "node ../test/model-dispatch.mjs",
-    "test:max-tokens": "node ../test/max-tokens.test.mjs",
+    "test:budget": "node ../test/budget.test.mjs",
     "test:foreign-memory": "node ../test/foreign-memory.test.mjs",
     "test:tools": "node ../test/local-tools.test.mjs",
     "test:engine": "node ../test/local-engine.test.mjs",