agent-gear 1.1.9 → 1.2.0

package/src/fs-handler.ts

@@ -1,5 +1,38 @@
-import { mkdirSync } from 'fs';
-import { join } from 'path';
+import { mkdirSync, rmSync, statSync } from 'fs';
+import { join, parse, resolve, sep } from 'path';
+import { homedir } from 'os';
+
+// Security model for destructive operations (removeDir): whitelist.
+// Only paths the controller itself manages may be deleted — worktree/session
+// directories registered via registerAllowedPath (acp:start/acp:resume cwd,
+// git:worktree:add worktreePath, fs:mkdir results, ProcessRegistry entries).
+// Explicit denies (filesystem root, home dir, cwd and their ancestors,
+// Windows system paths) act as defense-in-depth on top of the whitelist.
+//
+// mkdir is non-destructive and stays on the legacy blacklist: worktree
+// creation needs to mkdir parents that are not registered yet.
+const BLOCKED_PATHS = ['/etc', '/usr', '/bin', '/sbin', '/var', '/proc', '/sys'];
+
+const WINDOWS_DENIED_PATTERNS = [
+  /^[a-zA-Z]:[\\/]*$/, // drive root, e.g. C:\
+  /^[a-zA-Z]:[\\/]+windows[\\/]*$/i, // C:\Windows
+  /^[a-zA-Z]:[\\/]+users[\\/]*$/i, // C:\Users root
+];
+
+function isSameOrAncestor(candidate: string, target: string): boolean {
+  return target === candidate || target.startsWith(candidate + sep);
+}
+
+function isExplicitlyDenied(rawPath: string, resolved: string): boolean {
+  if (WINDOWS_DENIED_PATTERNS.some((re) => re.test(rawPath.trim()))) return true;
+  if (resolved === parse(resolved).root) return true;
+  return isSameOrAncestor(resolved, homedir()) || isSameOrAncestor(resolved, process.cwd());
+}
+
+function isBlacklisted(targetPath: string): boolean {
+  const resolved = resolve(targetPath);
+  return BLOCKED_PATHS.some((blocked) => resolved === blocked || resolved.startsWith(blocked + '/'));
+}
 
 export interface FsMkdirResult {
   success: boolean;
@@ -8,16 +41,68 @@ export interface FsMkdirResult {
   error?: string;
 }
 
+export interface FsRemoveDirResult {
+  success: boolean;
+  error?: string;
+}
+
 export class FsHandler {
+  private allowedRoots = new Set<string>();
+
+  /** Register a controller-managed directory; it and its subpaths become removable. */
+  registerAllowedPath(path: string): void {
+    const resolved = resolve(path);
+    if (isExplicitlyDenied(path, resolved)) return;
+    this.allowedRoots.add(resolved);
+  }
+
+  /** Drop a previously registered directory (e.g. after it was removed). */
+  unregisterAllowedPath(path: string): void {
+    this.allowedRoots.delete(resolve(path));
+  }
+
+  private isPathSafe(targetPath: string): boolean {
+    const resolved = resolve(targetPath);
+    if (isExplicitlyDenied(targetPath, resolved)) return false;
+    for (const root of this.allowedRoots) {
+      if (resolved === root || resolved.startsWith(root + sep)) return true;
+    }
+    return false;
+  }
+
   async mkdir(parentPath: string, folderName: string): Promise<FsMkdirResult> {
     try {
       const fullPath = join(parentPath, folderName);
+      if (isBlacklisted(fullPath)) {
+        return { success: false, error: `Path not allowed: ${fullPath}` };
+      }
       mkdirSync(fullPath, { recursive: true });
       return { success: true, name: folderName, path: fullPath };
     } catch (err) {
       return { success: false, error: (err as Error).message };
     }
   }
+
+  async removeDir(path: string): Promise<FsRemoveDirResult> {
+    try {
+      if (!this.isPathSafe(path)) {
+        return { success: false, error: `Path not allowed: ${path}` };
+      }
+      // 主工作区保护（最后一道防线）：git 主工作区的 .git 是目录，
+      // linked worktree 的 .git 是指向主仓库 gitdir 的普通文件。
+      // 白名单可能被会话 cwd（= 仓库根）污染，凭路径无法区分，
+      // 凭 .git 形态可以——含 .git 目录的路径一律拒绝删除。
+      try {
+        if (statSync(join(resolve(path), '.git')).isDirectory()) {
+          return { success: false, error: `Refusing to remove a git main working tree: ${path}` };
+        }
+      } catch { /* no .git entry — not a repo root, proceed */ }
+      rmSync(path, { recursive: true, force: true });
+      return { success: true };
+    } catch (err) {
+      return { success: false, error: (err as Error).message };
+    }
+  }
 }
 
-export const fsHandler = new FsHandler();
+export const fsHandler = new FsHandler();

package/src/index.ts

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
-import { hostname } from 'os';
+import { hostname, platform } from 'os';
 import { resolveKey, resolveEndpoint, saveKeyToConfig, saveEndpointToConfig } from './config.js';
 import { connectToServer } from './socketio-client.js';
 import { writePid, removePid, isRunning } from './daemon.js';
 import { startMcpRegistration } from './commands/mcp-proxy.js';
 import { startMcpProxy } from './commands/mcp.js';
+import { processRegistry, isProcessAlive } from './acp/process-registry.js';
 
 const program = new Command();
 
@@ -43,8 +44,32 @@ program
       serverName: options.name || hostname(),
     });
 
-    const shutdown = () => {
+    const shutdown = async () => {
       console.log('Shutting down...');
+      // Kill all registered ACP processes before exiting, using the same
+      // TERM → short wait → KILL semantics as the acp:stop handler
+      const registered = processRegistry.listEntries();
+      if (registered.length > 0) {
+        console.log(`Killing ${registered.length} registered ACP process(es)...`);
+        for (const entry of registered) {
+          try {
+            if (platform() === 'win32') {
+              const { execFileSync } = await import('child_process');
+              execFileSync('taskkill', ['/PID', String(entry.pid), '/T', '/F'], { timeout: 5000 });
+            } else {
+              process.kill(-entry.pid, 'SIGTERM');
+            }
+          } catch { /* process may already be dead */ }
+        }
+        // Give processes a moment to exit
+        await new Promise((r) => setTimeout(r, 1000));
+        for (const entry of registered) {
+          if (platform() !== 'win32' && isProcessAlive(entry.pid)) {
+            try { process.kill(-entry.pid, 'SIGKILL'); } catch { /* already dead */ }
+          }
+          processRegistry.deregister(entry.sessionId);
+        }
+      }
       socket.disconnect();
       removePid();
       process.exit(0);

package/src/socketio-client.ts

@@ -15,12 +15,17 @@ import { gitHandler } from './git-handler.js';
 import { worktreeHandler } from './worktree-handler.js';
 import { fsHandler } from './fs-handler.js';
 import { gatewayManager } from './gateway.js';
+import { processRegistry, isProcessAlive } from './acp/process-registry.js';
 
 const CONTROLLER_VERSION = '1.1.1';
 const acpBridges = new Map<string, AcpSessionBridge>();
 const permissionRequestBridge = new Map<string, AcpSessionBridge>();
 const elicitationRequestBridge = new Map<string, AcpSessionBridge>();
 
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((item) => typeof item === 'string');
+}
+
 function createSpawner(serverType: string, sessionId: string, cwd: string): AcpSpawner {
   const config = acpDetector.getSpawnerConfig(serverType);
   return new AcpSpawner({ sessionId, cwd, command: config.command, args: config.args });
@@ -85,6 +90,7 @@ interface AcpCancelPayload {
 
 interface AcpStopPayload {
   sessionId: string;
+  ackRequired?: boolean;
 }
 
 interface AcpSetConfigOptionPayload {
@@ -128,6 +134,8 @@ interface AcpResumePayload {
   cwd: string;
   mcpEndpoint?: { url: string; token: string; serverNames: string[] };
   additionalDirectories?: string[];
+  modeId?: string;
+  modelId?: string;
 }
 
 interface AcpListSessionsPayload {
@@ -208,6 +216,12 @@ export function connectToServer(
   const heartbeat = new Heartbeat();
   const controllerName = options?.serverName || hostname();
 
+  // Seed the fs:remove-dir whitelist with cwds of ACP processes that survived
+  // a controller restart (their worktrees remain controller-managed).
+  for (const entry of processRegistry.listEntries()) {
+    fsHandler.registerAllowedPath(entry.cwd);
+  }
+
   socket.on('connect', () => {
     console.log(`Connected to ${endpoint}`);
     const resumeToken = getResumeTokenFromConfig();
@@ -294,6 +308,14 @@ export function connectToServer(
     console.log(`[ACP ctrl] acp:start received: requestId=${data.requestId} sessionId=${data.sessionId} serverType=${data.serverType} cwd=${data.cwd} ${describeMcpConfig(data)}`);
 
     try {
+      // 同 sessionId 重复 start（如 start 超时后的兜底 resume/重试与迟到初始化交叠）：
+      // 先停掉旧 bridge，避免同会话双进程、旧 bridge 泄漏
+      const existingBridge = acpBridges.get(data.sessionId);
+      if (existingBridge) {
+        console.warn(`[ACP ctrl] acp:start for session ${data.sessionId} already has a bridge, stopping the previous one`);
+        acpBridges.delete(data.sessionId);
+        await existingBridge.stop().catch(() => {});
+      }
       const spawner = createSpawner(data.serverType, data.sessionId, data.cwd);
       const bridge = new AcpSessionBridge(socket, {
         sessionId: data.sessionId,
@@ -307,6 +329,41 @@ export function connectToServer(
 
       acpBridges.set(data.sessionId, bridge);
 
+      // The session cwd is a controller-managed worktree: allow fs:remove-dir on it
+      fsHandler.registerAllowedPath(data.cwd);
+      // Registry lifecycle is bound to the bridge: any stop exit (user close,
+      // agent exit, error) deregisters the PID so stale entries cannot pile up
+      bridge.on('acp:stopped', (payload: { sessionId: string }) => {
+        if (payload.sessionId === data.sessionId) {
+          processRegistry.deregister(data.sessionId);
+        }
+      });
+
+      // Register PID in process registry after spawner starts
+      const registerPid = () => {
+        const pid = spawner.pid;
+        if (pid) {
+          processRegistry.register(data.sessionId, {
+            pid,
+            cwd: data.cwd,
+            acpServerType: data.serverType,
+          });
+        }
+      };
+      // Register immediately if pid already available, otherwise wait for spawn
+      registerPid();
+      if (!spawner.pid) {
+        spawner.closed.then(() => {}).catch(() => {});
+        // Poll briefly for pid to appear after spawn
+        const pollId = setInterval(() => {
+          if (spawner.pid) {
+            clearInterval(pollId);
+            registerPid();
+          }
+        }, 50);
+        setTimeout(() => clearInterval(pollId), 5000);
+      }
+
       bridge.on('permission:sent', (requestId: string) => {
         permissionRequestBridge.set(requestId, bridge);
       });
@@ -346,6 +403,7 @@ export function connectToServer(
         bridge.off('acp:initialized', onInitialized);
         bridge.off('acp:stopped', onStopped);
         acpBridges.delete(data.sessionId);
+        processRegistry.deregister(data.sessionId);
         console.log(`[ACP ctrl] emitting acp:start:result: requestId=${data.requestId} sessionId=${data.sessionId} success=false reason=${payload.reason} error=${payload.error ?? 'n/a'}`);
         socket.emit('acp:start:result', {
           requestId: data.requestId,
@@ -375,16 +433,33 @@ export function connectToServer(
     console.log(`[ACP ctrl] acp:resume received: requestId=${data.requestId} sessionId=${data.sessionId} serverType=${data.serverType} externalSessionId=${data.externalSessionId} ${describeMcpConfig(data)}`);
 
     try {
+      // 同 sessionId 重复 resume/start：先停掉旧 bridge（同 acp:start 的防双进程处理）
+      const existingBridge = acpBridges.get(data.sessionId);
+      if (existingBridge) {
+        console.warn(`[ACP ctrl] acp:resume for session ${data.sessionId} already has a bridge, stopping the previous one`);
+        acpBridges.delete(data.sessionId);
+        await existingBridge.stop().catch(() => {});
+      }
       const spawner = createSpawner(data.serverType, data.sessionId, data.cwd);
       const bridge = new AcpSessionBridge(socket, {
         sessionId: data.sessionId,
         cwd: data.cwd,
         mcpEndpoint: data.mcpEndpoint,
         additionalDirectories: data.additionalDirectories,
+        // 初始 mode/model：resume 完成后、acp:initialized 之前应用（时序同 acp:start）
+        initialModeId: data.modeId,
+        initialModelId: data.modelId,
       }, spawner);
 
       acpBridges.set(data.sessionId, bridge);
 
+      fsHandler.registerAllowedPath(data.cwd);
+      bridge.on('acp:stopped', (payload: { sessionId: string }) => {
+        if (payload.sessionId === data.sessionId) {
+          processRegistry.deregister(data.sessionId);
+        }
+      });
+
       bridge.on('permission:sent', (requestId: string) => {
         permissionRequestBridge.set(requestId, bridge);
       });
@@ -419,6 +494,7 @@ export function connectToServer(
         bridge.off('acp:initialized', onInitialized);
         bridge.off('acp:stopped', onStopped);
         acpBridges.delete(data.sessionId);
+        processRegistry.deregister(data.sessionId);
         console.log(`[ACP ctrl] emitting acp:resume:result: requestId=${data.requestId} sessionId=${data.sessionId} success=false reason=${payload.reason} error=${payload.error ?? 'n/a'}`);
         socket.emit('acp:resume:result', {
           requestId: data.requestId,
@@ -580,12 +656,47 @@ export function connectToServer(
     }
   });
 
-  socket.on('acp:stop', (data: AcpStopPayload) => {
-    console.log(`ACP stop requested for session ${data.sessionId}`);
+  socket.on('acp:stop', async (data: AcpStopPayload) => {
+    if (!data || typeof data.sessionId !== 'string') {
+      console.warn(`[ACP ctrl] acp:stop ignored: invalid payload ${JSON.stringify(data)}`);
+      return;
+    }
+    console.log(`ACP stop requested for session ${data.sessionId} ackRequired=${data.ackRequired ?? false}`);
     const bridge = acpBridges.get(data.sessionId);
+    let killedByRegistry = false;
     if (bridge) {
-      bridge.stop();
+      await bridge.stop();
       acpBridges.delete(data.sessionId);
+    } else {
+      // Bridge not found: fallback to registry PID kill
+      const entry = processRegistry.get(data.sessionId);
+      if (entry) {
+        console.log(`[ACP ctrl] bridge not found for session ${data.sessionId}, killing by PID ${entry.pid}`);
+        killedByRegistry = true;
+        try {
+          if (platform() === 'win32') {
+            const { execFile } = await import('child_process');
+            await new Promise<void>((resolve) => {
+              execFile('taskkill', ['/PID', String(entry.pid), '/T', '/F'], () => resolve());
+            });
+          } else {
+            process.kill(-entry.pid, 'SIGTERM');
+            setTimeout(() => {
+              // Probe before SIGKILL: the PID may have been reused after exit
+              if (!isProcessAlive(entry.pid)) return;
+              try { process.kill(-entry.pid, 'SIGKILL'); } catch { /* already dead */ }
+            }, 5000);
+          }
+        } catch { /* process may already be dead */ }
+        processRegistry.deregister(data.sessionId);
+      }
+    }
+    if (data.ackRequired) {
+      socket.emit('acp:stopped', {
+        sessionId: data.sessionId,
+        reason: 'user_close',
+        killed: killedByRegistry,
+      });
     }
   });
 
@@ -780,16 +891,22 @@ export function connectToServer(
   // Worktree / Git extension events
   socket.on('fs:mkdir', async (data: FsMkdirPayload) => {
     const result = await fsHandler.mkdir(data.parentPath, data.folderName);
+    if (result.success && result.path) {
+      fsHandler.registerAllowedPath(result.path);
+    }
     socket.emit('fs:mkdir:result', { requestId: data.requestId, ...result });
   });
 
   socket.on('git:worktree:add', async (data: GitWorktreeAddPayload) => {
     const result = await worktreeHandler.add(data.repoPath, data.worktreePath, data.branch);
+    if (result.success) {
+      fsHandler.registerAllowedPath(data.worktreePath);
+    }
     socket.emit('git:worktree:add:result', { requestId: data.requestId, ...result });
   });
 
-  socket.on('git:worktree:remove', async (data: GitWorktreeRemovePayload) => {
-    const result = await worktreeHandler.remove(data.repoPath, data.worktreePath);
+  socket.on('git:worktree:remove', async (data: GitWorktreeRemovePayload & { force?: boolean }) => {
+    const result = await worktreeHandler.remove(data.repoPath, data.worktreePath, data.force);
     socket.emit('git:worktree:remove:result', { requestId: data.requestId, ...result });
   });
 
@@ -803,6 +920,60 @@ export function connectToServer(
     socket.emit('git:commit:result', { requestId: data.requestId, ...result });
   });
 
+  // Worktree list event
+  socket.on('git:worktree:list', async (data: { requestId: string; workspacePath: string }) => {
+    console.log(`[ACP ctrl] git:worktree:list received: requestId=${data.requestId} workspacePath=${data.workspacePath}`);
+    const result = await worktreeHandler.list(data.workspacePath);
+    socket.emit('git:worktree:list:result', { requestId: data.requestId, ...result });
+  });
+
+  // FS remove-dir event
+  socket.on('fs:remove-dir', async (data: { requestId: string; path: string }) => {
+    console.log(`[ACP ctrl] fs:remove-dir received: requestId=${data.requestId} path=${data.path}`);
+    const result = await fsHandler.removeDir(data.path);
+    if (result.success) {
+      fsHandler.unregisterAllowedPath(data.path);
+    }
+    socket.emit('fs:remove-dir:result', { requestId: data.requestId, ...result });
+  });
+
+  // Reconnection reconciliation
+  socket.on('acp:reconcile', async (data: { activeSessionIds: string[]; pendingKillSessionIds: string[] }) => {
+    if (!data || !isStringArray(data.activeSessionIds) || !isStringArray(data.pendingKillSessionIds)) {
+      console.warn(`[ACP ctrl] acp:reconcile ignored: invalid payload ${JSON.stringify(data)}`);
+      return;
+    }
+    console.log(`[ACP ctrl] acp:reconcile received: active=${data.activeSessionIds.length} pendingKill=${data.pendingKillSessionIds.length}`);
+    const registered = processRegistry.listEntries();
+    for (const entry of registered) {
+      const shouldKill = data.pendingKillSessionIds.includes(entry.sessionId) || !data.activeSessionIds.includes(entry.sessionId);
+      if (shouldKill) {
+        console.log(`[ACP ctrl] reconcile: killing session=${entry.sessionId} pid=${entry.pid} (pendingKill=${data.pendingKillSessionIds.includes(entry.sessionId)})`);
+        try {
+          if (platform() === 'win32') {
+            const { execFile } = await import('child_process');
+            await new Promise<void>((resolve) => {
+              execFile('taskkill', ['/PID', String(entry.pid), '/T', '/F'], () => resolve());
+            });
+          } else {
+            process.kill(-entry.pid, 'SIGTERM');
+            setTimeout(() => {
+              // Probe before SIGKILL: the PID may have been reused after exit
+              if (!isProcessAlive(entry.pid)) return;
+              try { process.kill(-entry.pid, 'SIGKILL'); } catch { /* already dead */ }
+            }, 5000);
+          }
+        } catch { /* process may already be dead */ }
+        processRegistry.deregister(entry.sessionId);
+        // Also clean up bridge if present
+        const bridge = acpBridges.get(entry.sessionId);
+        if (bridge) {
+          acpBridges.delete(entry.sessionId);
+        }
+      }
+    }
+  });
+
   // Port Forward events (event names kept unchanged for backward compatibility)
   socket.on('port-forward:create', async (data: { tunnelId: string; port: number }) => {
     console.log(`Gateway tunnel create requested: tunnelId=${data.tunnelId} port=${data.port}`);

package/src/worktree-handler.ts

@@ -31,6 +31,18 @@ export interface WorktreeRemoveResult {
   error?: string;
 }
 
+export interface WorktreeInfo {
+  path: string;
+  branch: string | null;
+  head: string;
+}
+
+export interface WorktreeListResult {
+  success: boolean;
+  worktrees?: WorktreeInfo[];
+  error?: string;
+}
+
 export interface GitStatusResult {
   isClean: boolean;
   error?: string;
@@ -62,10 +74,37 @@ export class WorktreeHandler {
     }
   }
 
-  async remove(repoPath: string, worktreePath: string): Promise<WorktreeRemoveResult> {
+  async list(workspacePath: string): Promise<WorktreeListResult> {
+    try {
+      const resolvedPath = expandTilde(workspacePath);
+      const { stdout } = await execAsync(`git -C "${resolvedPath}" worktree list --porcelain`);
+      const worktrees: WorktreeInfo[] = [];
+      const blocks = stdout.trim().split('\n\n');
+      for (const block of blocks) {
+        if (!block.trim()) continue;
+        const lines = Object.fromEntries(
+          block.split('\n').map(line => {
+            const idx = line.indexOf(' ');
+            return [line.slice(0, idx), line.slice(idx + 1)];
+          }),
+        );
+        worktrees.push({
+          path: lines['worktree'] || '',
+          branch: lines['branch']?.replace('refs/heads/', '') ?? null,
+          head: lines['HEAD'] || '',
+        });
+      }
+      return { success: true, worktrees };
+    } catch (err) {
+      return { success: false, error: (err as Error).message };
+    }
+  }
+
+  async remove(repoPath: string, worktreePath: string, force = false): Promise<WorktreeRemoveResult> {
     try {
       const resolvedPath = expandTilde(worktreePath);
-      const { stderr } = await execAsync(`git -C "${repoPath}" worktree remove "${resolvedPath}"`);
+      const forceFlag = force ? ' --force' : '';
+      const { stderr } = await execAsync(`git -C "${repoPath}" worktree remove${forceFlag} "${resolvedPath}"`);
       if (stderr) return { success: false, error: stderr.trim() };
       try {
         if (existsSync(resolvedPath)) {