amicus 1.7.4 → 1.7.6

package/src/sidecar/interactive-mirror.js

@@ -7,6 +7,9 @@ const { writeProgress } = require('./progress');
 const { sumPerMessageUsage } = require('../utils/pricing');
 const { logger } = require('../utils/logger');
 
+// Cap on the final flush poll during stop() so a wedged server cannot hang teardown.
+const STOP_FLUSH_TIMEOUT_MS = 3000;
+
 /**
  * Poll the OpenCode session and mirror it to conversation.jsonl + progress.json
  * live, exactly like headless. Best-effort and non-blocking — a poll/write error
@@ -18,9 +21,10 @@ const { logger } = require('../utils/logger');
  * @param {number} [opts.intervalMs=2000]
  * @param {() => void} [opts.onActivity]
  * @param {() => string} [opts.now]
+ * @param {number} [opts.stopFlushTimeoutMs=3000] - cap on the final flush poll in stop()
  * @returns {{ stop: () => Promise<{usage: object|null}> }}
  */
-function startInteractiveMirror({ getMessages, sessionDir, intervalMs = 2000, onActivity, now }) {
+function startInteractiveMirror({ getMessages, sessionDir, intervalMs = 2000, onActivity, now, stopFlushTimeoutMs = STOP_FLUSH_TIMEOUT_MS }) {
   const state = createMirrorState();
   const conversationPath = path.join(sessionDir, 'conversation.jsonl');
   let timer = null;
@@ -54,7 +58,15 @@ function startInteractiveMirror({ getMessages, sessionDir, intervalMs = 2000, on
     async stop() {
       stopped = true;
       if (timer) { clearTimeout(timer); timer = null; }
-      await pollOnce(); // final flush
+      // Final flush, but never let a wedged server hang teardown: race the poll
+      // against a short timeout so stop() always resolves promptly.
+      await Promise.race([
+        pollOnce(),
+        new Promise(resolve => {
+          const t = setTimeout(resolve, stopFlushTimeoutMs);
+          if (t.unref) { t.unref(); }
+        }),
+      ]);
       try { writeProgress(sessionDir, 'complete'); } catch { /* best-effort */ }
       let usage = null;
       try { usage = sumPerMessageUsage(state.usageByMsg); } catch { /* best-effort */ }

package/src/sidecar/interactive.js

@@ -229,11 +229,23 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
       mainPath
     ], { cwd: project, env, stdio: ['ignore', 'pipe', 'pipe'] });
 
+    // Best-effort: if the parent amicus process dies (exit / Ctrl-C / SIGTERM)
+    // before Electron exits, SIGTERM the orphaned child so it doesn't linger.
+    // Guarded against double-kill via killIfAlive(); removed in teardown below so
+    // the normal close path stays the sole owner of shutdown.
+    const killChildOnParentDeath = () => killIfAlive(electronProcess);
+    process.on('exit', killChildOnParentDeath);
+    process.on('SIGINT', killChildOnParentDeath);
+    process.on('SIGTERM', killChildOnParentDeath);
+
     // Belt-and-suspenders: also touch on raw Electron stdout activity.
     electronProcess.stdout.on('data', () => { watchdog.touch(); });
 
     // Clean up server + timers when Electron exits.
     handleElectronProcess(electronProcess, taskId, async (result) => {
+      process.removeListener('exit', killChildOnParentDeath);
+      process.removeListener('SIGINT', killChildOnParentDeath);
+      process.removeListener('SIGTERM', killChildOnParentDeath);
       watchdog.cancel();
       activityPoller.stop();
       try {

package/src/sidecar/setup-window.js

@@ -55,6 +55,14 @@ async function launchSetupWindow() {
       logger.debug('Setup window stderr', { data: chunk.trim() });
     });
 
+    // A spawn failure (ENOENT/EACCES) emits 'error' and NEVER 'close'. Without
+    // this listener the Promise would hang forever and Node would treat the
+    // unhandled child 'error' as a crash. Resolve with a clear failure instead.
+    proc.on('error', (err) => {
+      logger.error('Setup window failed to spawn', { error: err.message });
+      resolve({ success: false, error: `Failed to start setup window: ${err.message}` });
+    });
+
     proc.on('close', (code) => {
       logger.info('Setup window closed', { code });
 

package/src/sidecar/start.js

@@ -79,10 +79,12 @@ function createSessionMetadata(taskId, project, options) {
  * @param {string} [options.clientType] - Parent client type for discovery
  * @param {boolean} [options.noMcp] - Skip MCP inheritance from parent
  * @param {string[]} [options.excludeMcp] - Server names to exclude
+ * @param {string} [options.projectDir] - Target project directory used to resolve
+ *   a project-scoped opencode.json (NOT process.cwd() under Claude Code/MCP/Cowork)
  * @returns {object|null} MCP server configs or null
  */
 function buildMcpConfig(options) {
-  const { mcp, mcpConfig, clientType, noMcp, excludeMcp } = options;
+  const { mcp, mcpConfig, clientType, noMcp, excludeMcp, projectDir } = options;
   let mcpServers = null;
 
   // Layer 1: Discover parent MCPs (unless --no-mcp)
@@ -94,8 +96,10 @@ function buildMcpConfig(options) {
     }
   }
 
-  // Layer 2: File config (opencode.json) overrides discovered
-  const fileConfig = loadMcpConfig(mcpConfig);
+  // Layer 2: File config (opencode.json) overrides discovered.
+  // Resolve the project-scoped opencode.json against the target project dir,
+  // not process.cwd() (which differs under Claude Code/MCP/Cowork).
+  const fileConfig = loadMcpConfig(mcpConfig, projectDir);
   if (fileConfig) {
     mcpServers = mcpServers ? { ...mcpServers, ...fileConfig } : { ...fileConfig };
     logger.debug('Loaded MCP config from file', { serverCount: Object.keys(fileConfig).length });
@@ -154,7 +158,9 @@ async function startSidecar(options) {
   const effectiveSession = sessionId || session;
   const effectiveProject = cwd || project;
   const effectiveHeadless = noUi !== undefined ? noUi : headless;
-  const mcpServers = buildMcpConfig({ mcp, mcpConfig, clientType: client, noMcp, excludeMcp });
+  const mcpServers = buildMcpConfig({
+    mcp, mcpConfig, clientType: client, noMcp, excludeMcp, projectDir: effectiveProject
+  });
   const taskId = options.taskId || generateTaskId();
   const reasoning = thinking ? { effort: thinking } : undefined;
 

package/src/utils/atomic-write.js

@@ -0,0 +1,39 @@
+/**
+ * Atomic file write helper.
+ *
+ * Writes data to a unique temp file alongside the target, then renames it into
+ * place. Rename is atomic on a single filesystem, so a crash mid-write leaves
+ * the original file intact rather than a truncated/corrupt one. This is the
+ * pattern already used by council/verdict.js, session-index.js, and
+ * model-catalog.js; this module shares it for metadata writes.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+/**
+ * Atomically write `data` to `filePath` via temp file + rename.
+ *
+ * The temp name is unique per write (pid + random suffix) so concurrent writers
+ * never collide on the same temp file. On any failure the temp file is cleaned
+ * up best-effort. Errors propagate to the caller.
+ *
+ * @param {string} filePath - Destination path.
+ * @param {string|Buffer} data - Content to write.
+ * @param {{mode?: number}} [opts] - Write options; `mode` sets file permissions.
+ */
+function writeFileAtomic(filePath, data, opts = {}) {
+  const dir = path.dirname(filePath);
+  const base = path.basename(filePath);
+  const tmp = path.join(dir, `.${base}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+  try {
+    fs.writeFileSync(tmp, data, { mode: opts.mode });
+    fs.renameSync(tmp, filePath); // atomic on a single filesystem
+  } catch (err) {
+    try { fs.rmSync(tmp, { force: true }); } catch { /* best-effort cleanup */ }
+    throw err;
+  }
+}
+
+module.exports = { writeFileAtomic };

package/src/utils/auth-json.js

@@ -11,7 +11,43 @@ const os = require('os');
 const path = require('path');
 const { logger } = require('./logger');
 
-const AUTH_JSON_PATH = path.join(os.homedir(), '.local', 'share', 'opencode', 'auth.json');
+/**
+ * Ordered, de-duplicated candidate locations for OpenCode's auth.json, most
+ * specific first. OpenCode uses XDG-style data dirs; on Windows it still writes
+ * to ~/.local/share/opencode (verified), so that path stays FIRST after XDG.
+ * Mirrors the cross-platform precedence pattern in src/sidecar/electron-cache.js.
+ * @param {NodeJS.ProcessEnv} [env] - Environment (injectable for tests)
+ * @returns {string[]}
+ */
+function authJsonCandidates(env = process.env) {
+  const home = os.homedir();
+  const candidates = [];
+  if (env.XDG_DATA_HOME) { candidates.push(path.join(env.XDG_DATA_HOME, 'opencode', 'auth.json')); }
+  candidates.push(path.join(home, '.local', 'share', 'opencode', 'auth.json'));
+  if (process.platform === 'win32') {
+    const appData = env.APPDATA || path.join(home, 'AppData', 'Roaming');
+    candidates.push(path.join(appData, 'opencode', 'auth.json'));
+  }
+  return [...new Set(candidates)];
+}
+
+/**
+ * Resolve the auth.json path to use: first existing candidate, else the primary
+ * (~/.local/share) path so callers/writers have a stable default.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string}
+ */
+function resolveAuthJsonPath(env = process.env) {
+  const candidates = authJsonCandidates(env);
+  for (const c of candidates) {
+    if (fs.existsSync(c)) { return c; }
+  }
+  const localShare = path.join('.local', 'share');
+  return candidates.find((c) => c.includes(localShare)) || candidates[0];
+}
+
+// Backward-compat export: the resolved path at module load time.
+const AUTH_JSON_PATH = resolveAuthJsonPath();
 
 /** Known provider IDs that map to sidecar's PROVIDER_ENV_MAP */
 const KNOWN_PROVIDERS = ['openrouter', 'google', 'openai', 'anthropic', 'deepseek'];
@@ -37,10 +73,11 @@ function extractKey(entry) {
  * @returns {Object<string, string>} Map of provider -> key string (only providers with keys)
  */
 function readAuthJsonKeys() {
-  if (!fs.existsSync(AUTH_JSON_PATH)) { return {}; }
+  const authPath = resolveAuthJsonPath();
+  if (!fs.existsSync(authPath)) { return {}; }
   let parsed;
   try {
-    parsed = JSON.parse(fs.readFileSync(AUTH_JSON_PATH, 'utf-8'));
+    parsed = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
   } catch (_err) {
     logger.debug('auth.json is malformed, skipping import');
     return {};
@@ -89,11 +126,12 @@ function checkAuthJson(provider) {
  */
 function removeFromAuthJson(provider) {
   try {
-    if (!fs.existsSync(AUTH_JSON_PATH)) { return; }
-    const parsed = JSON.parse(fs.readFileSync(AUTH_JSON_PATH, 'utf-8'));
+    const authPath = resolveAuthJsonPath();
+    if (!fs.existsSync(authPath)) { return; }
+    const parsed = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
     if (!parsed[provider]) { return; }
     delete parsed[provider];
-    fs.writeFileSync(AUTH_JSON_PATH, JSON.stringify(parsed, null, 2), 'utf-8');
+    fs.writeFileSync(authPath, JSON.stringify(parsed, null, 2), 'utf-8');
   } catch (_err) {
     logger.debug('Failed to remove provider from auth.json', { provider });
   }
@@ -105,5 +143,7 @@ module.exports = {
   checkAuthJson,
   removeFromAuthJson,
   AUTH_JSON_PATH,
-  KNOWN_PROVIDERS
+  KNOWN_PROVIDERS,
+  resolveAuthJsonPath,
+  authJsonCandidates
 };

package/src/utils/format-duration.js

@@ -0,0 +1,24 @@
+// src/utils/format-duration.js
+'use strict';
+
+/**
+ * @module utils/format-duration
+ * Single ms->human duration formatter shared by the fanout and council
+ * renderers. Rolls minutes up ("1m5s" / "42s") and lets each caller pick its
+ * own null placeholder ("-" for fanout stdout, "—" for the council report).
+ */
+
+/**
+ * Format a millisecond duration as "1m5s" / "42s".
+ * @param {number|null|undefined} ms - Duration in milliseconds.
+ * @param {string} [empty='-'] - Placeholder for null/undefined input.
+ * @returns {string}
+ */
+function formatDuration(ms, empty = '-') {
+  if (ms === null || ms === undefined) { return empty; }
+  const s = Math.round(ms / 1000);
+  const m = Math.floor(s / 60);
+  return m > 0 ? `${m}m${s % 60}s` : `${s}s`;
+}
+
+module.exports = { formatDuration };

package/src/utils/server-setup.js

@@ -4,8 +4,8 @@
  * Handles port management and cleanup for the OpenCode server.
  */
 
-const { execFileSync } = require('child_process');
 const { logger } = require('./logger');
+const { findListenerPid } = require('./port-pid');
 
 const DEFAULT_PORT = 4096;
 
@@ -15,18 +15,9 @@ const DEFAULT_PORT = 4096;
  * @returns {number|null} PID or null if not in use
  */
 function getPortPid(port) {
-  try {
-    // Use execFileSync with arguments array (safe from injection)
-    const result = execFileSync('lsof', ['-ti', `:${port}`], {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe']
-    });
-    const pid = parseInt(result.trim(), 10);
-    return isNaN(pid) ? null : pid;
-  } catch {
-    // lsof returns non-zero if no process found
-    return null;
-  }
+  // Delegate to the cross-platform lookup (netstat on Windows, lsof elsewhere)
+  // so the port-in-use check and kill path work off Unix too.
+  return findListenerPid(port);
 }
 
 /**

package/src/utils/session-abort.js

@@ -11,6 +11,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { writeFileAtomic } = require('./atomic-write');
 
 /**
  * Synchronously write a terminal status to a session's metadata. Best-effort: never throws.
@@ -28,7 +29,8 @@ function markTerminal(sessionDir, status, reason) {
     meta.status = status;
     meta.reason = reason;
     meta[status === 'aborted' ? 'abortedAt' : 'completedAt'] = new Date().toISOString();
-    fs.writeFileSync(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
+    // Atomic (temp + rename): a crash mid-write must not corrupt the marker.
+    writeFileAtomic(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
     return true;
   } catch {
     return false;

package/src/utils/shared-server.js

@@ -73,6 +73,7 @@ class SharedServerManager {
       this.server = server;
       this.client = client;
       this._starting = null;
+      this._wireCrashListener(server);
       this._serverWatchdog = new IdleWatchdog({
         mode: 'server',
         onTimeout: () => {
@@ -169,6 +170,36 @@ class SharedServerManager {
     }
   }
 
+  /**
+   * Wire crash detection onto a freshly started server handle so an unexpected
+   * exit triggers _onServerCrash (and the restart machinery). The OpenCode
+   * server handle is a plain wrapper; it may surface lifecycle events either on
+   * itself or on an underlying child `process`. Attach to whichever is an event
+   * emitter, guarding against double-wiring across restarts.
+   *
+   * @param {object} server - Server handle returned by _doStartServer
+   */
+  _wireCrashListener(server) {
+    const emitter = (server && typeof server.on === 'function')
+      ? server
+      : (server && server.process && typeof server.process.on === 'function')
+        ? server.process
+        : null;
+    if (!emitter || emitter._amicusCrashWired) {
+      return;
+    }
+    emitter._amicusCrashWired = true;
+    const onExit = (code) => {
+      // Ignore exits from a stale handle we have already replaced/closed.
+      if (this.server !== server) {
+        return;
+      }
+      this._onServerCrash(code);
+    };
+    emitter.on('exit', onExit);
+    emitter.on('close', onExit);
+  }
+
   /**
    * Handle a server crash: log, notify sessions, then schedule restart.
    *