beehaven 0.8.36 → 0.8.39

package/dist/daemon-codex.js

@@ -1,349 +0,0 @@
-/**
- * Daemon-side Codex — OpenAI Codex SDK integration, sibling of daemon-omni.
- *
- * The "treehouse" architecture: one daemon process hosts multiple AI
- * agent SDKs in parallel, each as its own module with the same shape:
- *   • daemon-omni.ts     → @anthropic-ai/claude-agent-sdk (Claude)
- *   • daemon-codex.ts    → @openai/codex-sdk             (GPT/Codex)
- *   • daemon-gemini-cli  → @google/gemini-cli-core       (planned)
- *
- * Each emits the SAME event shapes (agent:text-delta, agent:tool-call,
- * agent:tool-result, agent:done) so the FAB renderer doesn't need a
- * per-provider code path.
- *
- * IPC verbs the daemon exposes:
- *   codex:prompt   { prompt, sessionId, model?, workingDir? }
- *   codex:end      { sessionId }
- *   codex:sessions {}
- *
- * Codex SDK shape (v0.130):
- *   const codex = new Codex({ apiKey? });
- *   const thread = codex.startThread({ model?, workingDirectory? });
- *   const stream = thread.runStreamed(prompt);
- *   for await (const event of stream.events) { ... }
- *
- * Auth:
- *   Reads OPENAI_API_KEY from process.env. If absent, the SDK refuses
- *   to start. Future: per-user BYOK via daemon settings.
- */
-const sessions = new Map();
-const subscribers = new Set();
-// Lazy SDK instance — keeps the Codex client warm across sessions in
-// the same daemon process. Constructed on first session start.
-let _codex = null;
-// ── Safety knobs (parity with daemon-omni — audit task #64) ──────────
-/** Default max prompts queued per session before promptCodex rejects. */
-const DEFAULT_MAX_QUEUED_PROMPTS = 20;
-/** Idle-session reaper: a Codex session held in memory after the user
- *  stops using it leaks a Thread object (which the SDK may keep TCP
- *  connections / file descriptors warm for). Reaper sweeps every minute
- *  and ends sessions idle longer than the timeout. The Codex SDK's
- *  thread store survives — next promptCodex resumes via resumeThreadId. */
-const IDLE_TIMEOUT_MS = (() => {
-    const env = process.env.BEEHAVEN_CODEX_IDLE_TIMEOUT_MS;
-    if (env != null) {
-        const n = Number(env);
-        if (Number.isFinite(n) && n >= 0)
-            return n;
-    }
-    return 30 * 60_000; // 30 min default — matches Omni
-})();
-const CLEANUP_INTERVAL_MS = 60_000;
-let cleanupTimer = null;
-function reapIdleSessions() {
-    if (IDLE_TIMEOUT_MS === 0)
-        return 0;
-    const now = Date.now();
-    let reaped = 0;
-    for (const [id, sess] of sessions) {
-        if (sess.turnInFlight)
-            continue; // never reap mid-turn
-        if (sess.queuedPrompts.length > 0)
-            continue; // pending work
-        if (now - sess.lastActivityAt > IDLE_TIMEOUT_MS) {
-            endSession(id);
-            reaped++;
-        }
-    }
-    return reaped;
-}
-function ensureCleanupTimer() {
-    if (cleanupTimer)
-        return;
-    if (IDLE_TIMEOUT_MS === 0)
-        return;
-    cleanupTimer = setInterval(() => {
-        const reaped = reapIdleSessions();
-        if (reaped > 0) {
-            // eslint-disable-next-line no-console
-            console.log(`[codex] reaped ${reaped} idle session(s); ${sessions.size} remain`);
-        }
-    }, CLEANUP_INTERVAL_MS);
-    if (typeof cleanupTimer?.unref === 'function')
-        cleanupTimer.unref();
-}
-// ── Subscriber API ───────────────────────────────────────────────────
-export function subscribe(fn) {
-    subscribers.add(fn);
-    return () => subscribers.delete(fn);
-}
-function emit(event) {
-    for (const fn of subscribers) {
-        try {
-            fn(event);
-        }
-        catch { /* subscriber errors don't sink the loop */ }
-    }
-}
-async function getOrCreateCodex() {
-    if (_codex)
-        return _codex;
-    const mod = await import('@openai/codex-sdk');
-    _codex = new mod.Codex();
-    return _codex;
-}
-async function getOrCreateSession(opts) {
-    const existing = sessions.get(opts.sessionId);
-    if (existing)
-        return existing;
-    const now = Date.now();
-    const session = {
-        sessionId: opts.sessionId,
-        userId: opts.userId,
-        thread: null,
-        threadId: opts.resumeThreadId ?? null,
-        ended: false,
-        turnIndex: 0,
-        startedAt: now,
-        currentText: '',
-        turnInFlight: false,
-        queuedPrompts: [],
-        lastActivityAt: now,
-        maxQueuedPrompts: opts.maxQueuedPrompts ?? DEFAULT_MAX_QUEUED_PROMPTS,
-    };
-    sessions.set(opts.sessionId, session);
-    ensureCleanupTimer();
-    const codex = await getOrCreateCodex();
-    // Resolve working directory (#103): if compositionId is set, use the
-    // composition's scratch dir — same as Claude's FAB session. Codex
-    // and Claude operating in the same directory is the basis of the
-    // handoff pattern (Claude writes plan.md, Codex reads + implements).
-    // Explicit workingDir overrides; otherwise compositionId wins;
-    // otherwise SDK default.
-    let workingDirectory;
-    if (opts.workingDir) {
-        workingDirectory = opts.workingDir;
-    }
-    else if (opts.compositionId) {
-        const { homedir } = await import('os');
-        const { join } = await import('path');
-        const { existsSync, mkdirSync } = await import('fs');
-        workingDirectory = join(homedir(), '.clearly', 'compositions', opts.compositionId);
-        try {
-            if (!existsSync(workingDirectory))
-                mkdirSync(workingDirectory, { recursive: true });
-        }
-        catch { /* fall through — Codex will fail with a clearer error */ }
-    }
-    // `skipGitRepoCheck`: Codex defaults to requiring a Git repo for the
-    // working directory (refuses to start otherwise). Composition dirs
-    // aren't git repos by default, so we disable the check.
-    session.thread = opts.resumeThreadId
-        ? codex.resumeThread(opts.resumeThreadId)
-        : codex.startThread({
-            ...(opts.model ? { model: opts.model } : {}),
-            ...(workingDirectory ? { workingDirectory } : {}),
-            skipGitRepoCheck: true,
-        });
-    return session;
-}
-/**
- * Run a single Codex turn — the SDK's runStreamed returns an iterable
- * of typed events; we re-shape each into our CodexEvent union and emit.
- *
- * Codex's event taxonomy (per SDK 0.130):
- *   • item.completed → text chunks (kind: 'agent_message')
- *   • item.completed → tool calls/results (kind: 'command_execution')
- *   • turn.completed → end of turn marker
- *   • thread.started → session id update
- *   • error → fail the turn
- *
- * We translate these to the same {agent:text-delta, agent:tool-call,
- * agent:tool-result, agent:done} the FAB already speaks for Claude.
- */
-async function runTurn(session, prompt) {
-    if (session.ended)
-        return;
-    if (!session.thread) {
-        throw new Error('Codex session not initialized');
-    }
-    session.turnInFlight = true;
-    session.currentText = '';
-    const turnStart = Date.now();
-    try {
-        const stream = await session.thread.runStreamed(prompt);
-        for await (const event of stream.events) {
-            if (session.ended)
-                break;
-            handleCodexEvent(session, event);
-        }
-        session.turnIndex += 1;
-        emit({
-            type: 'agent:turn-complete',
-            sessionId: session.sessionId,
-            turnIndex: session.turnIndex,
-        });
-        emit({
-            type: 'agent:done',
-            sessionId: session.sessionId,
-            result: {
-                text: session.currentText,
-                turns: session.turnIndex,
-                durationMs: Date.now() - turnStart,
-            },
-        });
-    }
-    catch (err) {
-        emit({
-            type: 'agent:error',
-            sessionId: session.sessionId,
-            error: err?.message ?? String(err),
-        });
-    }
-    finally {
-        session.turnInFlight = false;
-        session.lastActivityAt = Date.now();
-        // Drain queued prompts FIFO (parity with daemon-omni — audit #64).
-        const next = session.queuedPrompts.shift();
-        if (next && !session.ended) {
-            void runTurn(session, next).catch((e) => {
-                emit({
-                    type: 'agent:error',
-                    sessionId: session.sessionId,
-                    error: e?.message ?? String(e),
-                });
-            });
-        }
-    }
-}
-function handleCodexEvent(session, event) {
-    // Item events — Codex bundles assistant messages, tool calls, and
-    // tool results all as "items." We dispatch on kind.
-    if (event?.type === 'item.completed' || event?.type === 'item.updated') {
-        const item = event.item;
-        if (!item)
-            return;
-        if (item.item_type === 'agent_message' && typeof item.text === 'string') {
-            // Codex sends the full assistant message text in one item rather
-            // than delta-chunks. We emit it as a single agent:text-delta with
-            // the whole payload — the FAB's streaming bubble handler treats
-            // "current = '' + this chunk" as full text, which is the right
-            // behavior since the bubble had no prior content.
-            const delta = item.text.slice(session.currentText.length);
-            if (delta) {
-                session.currentText = item.text;
-                emit({
-                    type: 'agent:text-delta',
-                    sessionId: session.sessionId,
-                    text: delta,
-                });
-            }
-            return;
-        }
-        if (item.item_type === 'command_execution') {
-            // Two-phase: when Codex starts a command, we emit tool-call.
-            // When it finishes (status === 'completed' | 'failed'), we emit
-            // tool-result. Both carry the same call id so the FAB can match.
-            const callId = item.id ?? `codex-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-            const status = item.status;
-            if (status === 'in_progress' || event.type === 'item.updated') {
-                emit({
-                    type: 'agent:tool-call',
-                    sessionId: session.sessionId,
-                    callId,
-                    tool: 'Bash', // Codex's command_execution is shell-based
-                    input: { command: item.command ?? '', description: '' },
-                });
-            }
-            else if (status === 'completed' || status === 'failed') {
-                const out = item.aggregated_output ?? '';
-                emit({
-                    type: 'agent:tool-result',
-                    sessionId: session.sessionId,
-                    callId,
-                    tool: 'Bash',
-                    ok: status === 'completed',
-                    preview: typeof out === 'string' ? out.slice(0, 200) : '',
-                });
-            }
-            return;
-        }
-        return;
-    }
-    if (event?.type === 'thread.started' && event.thread_id) {
-        session.threadId = event.thread_id;
-        return;
-    }
-    if (event?.type === 'error') {
-        emit({
-            type: 'agent:error',
-            sessionId: session.sessionId,
-            error: event.message ?? 'Codex error',
-        });
-        return;
-    }
-}
-/** Push a user message into a Codex session. Resolves when the SDK
- *  starts processing (events stream via subscribers). One concurrent
- *  turn per session; subsequent prompts queue FIFO (parity with
- *  daemon-omni). Throws QUEUE_FULL if the queue is at capacity. */
-export async function promptCodex(input) {
-    const session = await getOrCreateSession({
-        sessionId: input.sessionId,
-        userId: input.userId,
-        model: input.model,
-        workingDir: input.workingDir,
-        compositionId: input.compositionId,
-        resumeThreadId: input.resumeThreadId,
-        maxQueuedPrompts: input.maxQueuedPrompts,
-    });
-    if (session.ended) {
-        throw new Error(`Codex session ${input.sessionId} has ended; start a new one.`);
-    }
-    if (session.turnInFlight) {
-        // Queue cap (audit task #64 — parity with daemon-omni).
-        if (session.queuedPrompts.length >= session.maxQueuedPrompts) {
-            throw new Error(`QUEUE_FULL: Codex session ${input.sessionId} has ${session.queuedPrompts.length} prompts queued (max ${session.maxQueuedPrompts}). ` +
-                `Wait for the current turn to finish or end this session.`);
-        }
-        session.queuedPrompts.push(input.prompt);
-    }
-    else {
-        // Fire-and-forget the turn — the subscriber stream surfaces progress.
-        void runTurn(session, input.prompt).catch((err) => {
-            emit({
-                type: 'agent:error',
-                sessionId: session.sessionId,
-                error: err?.message ?? String(err),
-            });
-        });
-    }
-    return { sessionId: input.sessionId, threadId: session.threadId };
-}
-export function endSession(sessionId) {
-    const session = sessions.get(sessionId);
-    if (!session)
-        return;
-    session.ended = true;
-    sessions.delete(sessionId);
-}
-export function listSessions() {
-    const now = Date.now();
-    return Array.from(sessions.values()).map((s) => ({
-        sessionId: s.sessionId,
-        userId: s.userId,
-        turns: s.turnIndex,
-        ageMs: now - s.startedAt,
-        threadId: s.threadId,
-    }));
-}

package/dist/daemon-write-sandbox.js

@@ -1,191 +0,0 @@
-/**
- * Sandbox-then-commit Write policy (#62) — gate destructive Write tool
- * calls behind a temp-directory sandbox so a buggy agent can't
- * irrecoverably trash the user's filesystem.
- *
- * The pattern:
- *   1. Agent calls `Write` with file_path X + new content.
- *   2. canUseTool wrapper intercepts:
- *      - mkdtemp under `~/.beehaven/sandbox/<sessionId>/`
- *      - mirror the file (or its containing dir) into the sandbox
- *      - write to the sandboxed copy
- *      - return ok to the agent (it sees the write as "successful")
- *   3. On agent:done OR explicit `commit-sandbox` IPC verb, atomically
- *      promote the sandbox into the real path.
- *   4. On `discard-sandbox` (timeout / agent error), rm -rf the
- *      sandbox dir.
- *
- * Wins:
- *   - One buggy agent turn doesn't permanently corrupt the user's
- *     project. Diffs are reviewable before commit.
- *   - Pair with `git-vfs.ts` (#103 Claude→Codex handoff) — the sandbox
- *     dir is a git working tree, so the agent's edits show as
- *     untracked changes the user can `git diff` against.
- *
- * Wiring (Mac app rebuild required after this lands):
- *   - daemon-omni-hooks.ts: add a PreToolUse hook for `Write` that
- *     calls `wrapInSandbox()` before the agent SDK dispatches.
- *   - daemon-omni.ts: on agent:done, fire `commitSandbox(sessionId)`.
- *   - Add `commit-sandbox` + `discard-sandbox` IPC verbs in
- *     packages/cli/src/ipc-server.ts so the FAB can drive a "Review
- *     changes → Apply" approval card (#59).
- */
-import { mkdir, copyFile, rename, rm, stat, readFile, writeFile } from 'node:fs/promises';
-import { dirname, join, normalize as normalizePath, isAbsolute, } from 'node:path';
-import { homedir } from 'node:os';
-import { existsSync } from 'node:fs';
-const SANDBOX_ROOT = join(homedir(), '.beehaven', 'sandbox');
-/**
- * Defense-in-depth path check (note from 2.19.0 audit). Callers today
- * pre-normalize realPath via the path-transform layer, so escape-via-`..`
- * isn't reachable in the current wiring. But this module is library
- * code — future callers may invoke it directly. Reject anything that
- * isn't an absolute, normalized path with no `..` segments.
- */
-function assertSafeRealPath(realPath) {
-    if (typeof realPath !== 'string' || realPath.length === 0) {
-        throw new Error('wrapInSandbox: realPath must be a non-empty string');
-    }
-    if (!isAbsolute(realPath)) {
-        throw new Error(`wrapInSandbox: realPath must be absolute (got '${realPath}')`);
-    }
-    const normalized = normalizePath(realPath);
-    if (normalized !== realPath) {
-        throw new Error(`wrapInSandbox: realPath must be normalized — '${realPath}' normalizes to '${normalized}'`);
-    }
-    if (normalized.split('/').includes('..')) {
-        throw new Error(`wrapInSandbox: realPath must not contain '..' segments (got '${realPath}')`);
-    }
-}
-const _activeSandboxes = new Map();
-/**
- * Wrap a Write call in a sandbox. Returns the sandboxed path the
- * agent should actually write to. The caller is responsible for
- * subbing that path into the agent's tool-input before dispatch.
- */
-export async function wrapInSandbox(args) {
-    assertSafeRealPath(args.realPath);
-    // Per-session sandbox dir. Same session reuses the dir so multi-file
-    // writes share a coherent staging area.
-    const sessionDir = await ensureSessionDir(args.sessionId);
-    // Mirror the realPath structure inside the sandbox. For a real path
-    // `/Users/me/proj/src/foo.ts` we land at
-    // `~/.beehaven/sandbox/<sid>/Users/me/proj/src/foo.ts`. Absolute-path
-    // preservation lets the commit step paths-back-1-to-1.
-    const sandboxPath = join(sessionDir, args.realPath.replace(/^\//, ''));
-    await mkdir(dirname(sandboxPath), { recursive: true });
-    // Snapshot existing content (for restore-on-discard). Skip for
-    // files > 5 MB — we don't want to balloon disk on a large file
-    // sandbox. Those skip restore, and discard becomes "delete only."
-    let originalContent;
-    let preExisting = false;
-    if (existsSync(args.realPath)) {
-        preExisting = true;
-        try {
-            const s = await stat(args.realPath);
-            if (s.size < 5 * 1024 * 1024) {
-                originalContent = await readFile(args.realPath, 'utf8');
-            }
-            // Pre-populate the sandbox with the current file so partial
-            // edits (e.g. agent appending) start from real state.
-            await copyFile(args.realPath, sandboxPath);
-        }
-        catch {
-            // Source unreadable — let the agent write its content fresh
-            // into the sandbox.
-        }
-    }
-    // If the agent supplied content, write it to the sandbox up-front
-    // so the inspector RPC can show it without waiting for the agent
-    // to finish.
-    if (args.content !== undefined) {
-        await writeFile(sandboxPath, args.content, 'utf8');
-    }
-    const sandboxedWrite = {
-        sessionId: args.sessionId,
-        realPath: args.realPath,
-        sandboxPath,
-        preExisting,
-        originalContent,
-        ts: Date.now(),
-    };
-    const list = _activeSandboxes.get(args.sessionId) ?? [];
-    list.push(sandboxedWrite);
-    _activeSandboxes.set(args.sessionId, list);
-    return { sandboxPath, sandboxedWrite };
-}
-/**
- * Atomically promote a session's sandboxed writes into their real
- * paths. Uses fs.rename which is atomic on the same filesystem.
- *
- * Returns the list of {realPath, ok, error?} per file so the UI can
- * surface which writes landed cleanly.
- */
-export async function commitSandbox(sessionId) {
-    const writes = _activeSandboxes.get(sessionId) ?? [];
-    const results = [];
-    for (const w of writes) {
-        try {
-            await mkdir(dirname(w.realPath), { recursive: true });
-            // rename is atomic on same FS; if cross-FS, fall back to copy.
-            try {
-                await rename(w.sandboxPath, w.realPath);
-            }
-            catch {
-                await copyFile(w.sandboxPath, w.realPath);
-                await rm(w.sandboxPath, { force: true });
-            }
-            results.push({ realPath: w.realPath, ok: true });
-        }
-        catch (err) {
-            results.push({ realPath: w.realPath, ok: false, error: err?.message ?? 'commit-failed' });
-        }
-    }
-    _activeSandboxes.delete(sessionId);
-    // Best-effort: nuke the session dir so the next session starts clean.
-    try {
-        await rm(await sessionDirPath(sessionId), { recursive: true, force: true });
-    }
-    catch { }
-    return results;
-}
-/**
- * Discard a session's sandboxed writes. Restores any pre-existing
- * content from `originalContent` snapshots; deletes new files.
- */
-export async function discardSandbox(sessionId) {
-    const writes = _activeSandboxes.get(sessionId) ?? [];
-    let restored = 0;
-    for (const w of writes) {
-        if (w.preExisting && w.originalContent !== undefined) {
-            try {
-                await writeFile(w.realPath, w.originalContent, 'utf8');
-                restored++;
-            }
-            catch { }
-        }
-    }
-    _activeSandboxes.delete(sessionId);
-    try {
-        await rm(await sessionDirPath(sessionId), { recursive: true, force: true });
-    }
-    catch { }
-    return { discarded: writes.length, restored };
-}
-/**
- * List a session's pending writes. Powers the FAB approval card's
- * "Review N changes" affordance.
- */
-export function listPendingWrites(sessionId) {
-    return _activeSandboxes.get(sessionId) ?? [];
-}
-async function ensureSessionDir(sessionId) {
-    const dir = await sessionDirPath(sessionId);
-    await mkdir(dir, { recursive: true });
-    return dir;
-}
-async function sessionDirPath(sessionId) {
-    // Sanitize sessionId — agent-supplied. Anything outside [a-z0-9-_] becomes _.
-    const safe = sessionId.replace(/[^a-z0-9\-_]/gi, '_').slice(0, 64);
-    return join(SANDBOX_ROOT, safe);
-}