ccgx-workflow 2.1.0 → 2.1.2

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import cac from 'cac';
 import ansis from 'ansis';
-import { d as diagnoseMcpConfig, i as isWindows, r as readClaudeCodeConfig, f as fixWindowsMcpConfig, w as writeClaudeCodeConfig, a as readCcgConfig, b as initI18n, c as i18n, s as showMainMenu, e as init, g as configMcp, v as version } from './shared/ccgx-workflow.DVsx1kL4.mjs';
+import { d as diagnoseMcpConfig, i as isWindows, r as readClaudeCodeConfig, f as fixWindowsMcpConfig, w as writeClaudeCodeConfig, a as readCcgConfig, b as initI18n, c as i18n, s as showMainMenu, e as init, g as configMcp, v as version } from './shared/ccgx-workflow.dK6O-vwe.mjs';
 import { execSync } from 'node:child_process';
 import 'inquirer';
 import 'ora';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { h as collectSkills, j as resolvePluginBashCommand } from './shared/ccgx-workflow.DVsx1kL4.mjs';
-export { k as changeLanguage, G as checkForUpdates, I as collectInvocableSkills, H as compareVersions, m as createDefaultConfig, n as createDefaultRouting, J as generateCommandContent, o as getCcgDir, p as getConfigPath, E as getCurrentVersion, F as getLatestVersion, t as getWorkflowById, q as getWorkflowConfigs, c as i18n, e as init, b as initI18n, y as installAceTool, z as installAceToolRs, K as installSkillCommands, x as installWorkflows, C as migrateToV1_4_0, D as needsMigration, L as parseFrontmatter, a as readCcgConfig, s as showMainMenu, B as uninstallAceTool, A as uninstallWorkflows, u as update, l as writeCcgConfig } from './shared/ccgx-workflow.DVsx1kL4.mjs';
+import { h as collectSkills, j as resolvePluginBashCommand } from './shared/ccgx-workflow.dK6O-vwe.mjs';
+export { k as changeLanguage, G as checkForUpdates, I as collectInvocableSkills, H as compareVersions, m as createDefaultConfig, n as createDefaultRouting, J as generateCommandContent, o as getCcgDir, p as getConfigPath, E as getCurrentVersion, F as getLatestVersion, t as getWorkflowById, q as getWorkflowConfigs, c as i18n, e as init, b as initI18n, y as installAceTool, z as installAceToolRs, K as installSkillCommands, x as installWorkflows, C as migrateToV1_4_0, D as needsMigration, L as parseFrontmatter, a as readCcgConfig, s as showMainMenu, B as uninstallAceTool, A as uninstallWorkflows, u as update, l as writeCcgConfig } from './shared/ccgx-workflow.dK6O-vwe.mjs';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, statSync, readdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';

package/dist/shared/{ccgx-workflow.DVsx1kL4.mjs → ccgx-workflow.dK6O-vwe.mjs}

@@ -13,7 +13,7 @@ import { join as join$2 } from 'node:path/posix';
 import { join as join$1 } from 'node:path';
 import i18next from 'i18next';
 
-const version = "2.1.0";
+const version = "2.1.2";
 
 function cmd(id, order, category, name, nameEn, description, descriptionEn, cmdOverride) {
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccgx-workflow",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "Multi-model orchestration for Claude Code. Codex + Gemini parallel collaboration with fresh-context subagent protocols, OS-level process isolation, and Plan-Critic-Verify quality tiers. Successor to ccg-workflow.",
   "type": "module",
   "packageManager": "pnpm@10.17.1",

package/templates/commands/review.md

@@ -66,20 +66,20 @@ argument-hint: "[代码或描述] [--adversarial] [--fix [--all] [--auto]] [--ro
 Step 1. 用 Write 工具把【小任务描述】写到 tmpfile
    ⚠️ 内容必须是任务说明（≤ 2KB），不要塞 git diff / 文件内容
    Write({
-     file_path: "/tmp/ccg-review-codex-$JOB.txt",
+     file_path: ".context/tmp/ccg-review-codex-$JOB.txt",
      content: <下方"任务描述模板">  
    })
    Write({ 同上，gemini 版本 })
 
 Step 2. 用 Bash 调 helper（占位符已渲染）：
    Bash({
-     command: `{{CODEX_BASH_TASK}} --prompt-file /tmp/ccg-review-codex-$JOB.txt`,
+     command: `{{CODEX_BASH_TASK}} --prompt-file .context/tmp/ccg-review-codex-$JOB.txt`,
      description: "Review: backend (codex direct)",
      run_in_background: true,
      timeout: 3600000
    })
    Bash({
-     command: `{{GEMINI_BASH_TASK}} --prompt-file /tmp/ccg-review-gemini-$JOB.txt`,
+     command: `{{GEMINI_BASH_TASK}} --prompt-file .context/tmp/ccg-review-gemini-$JOB.txt`,
      description: "Review: frontend (gemini direct)",
      run_in_background: true,
      timeout: 3600000
@@ -148,14 +148,14 @@ CLI 空答 / auth 过期时 wrapper 受 instruction-tuning 驱动**自答 fabric
 
 ```
 Bash({
-  command: "cat /tmp/ccg-review-codex-$JOB.txt | ~/.claude/bin/codeagent-wrapper {{LITE_MODE_FLAG}}--progress --backend codex - \"{{WORKDIR}}\"",
+  command: "cat .context/tmp/ccg-review-codex-$JOB.txt | ~/.claude/bin/codeagent-wrapper {{LITE_MODE_FLAG}}--progress --backend codex - \"{{WORKDIR}}\"",
   run_in_background: true,
   timeout: 3600000,
   description: "Review: backend (wrapper fallback)"
 })
 ```
 
-`/tmp/ccg-review-codex-$JOB.txt` 同 通道 A 的"任务描述模板"——不变。
+`.context/tmp/ccg-review-codex-$JOB.txt` 同 通道 A 的"任务描述模板"——不变。
 
 > ⚠️ 通道 B `codeagent-wrapper` 已标 **deprecated**，仅 plugin 未装时使用。
 
@@ -227,11 +227,11 @@ Bash({
 
 ```
 Step 1. 用 Write 把任务描述写入 tmpfile（同样不塞 diff，让 codex 自己读）:
-   Write({ file_path: "/tmp/ccg-review-adv-$JOB.txt", content: <下方任务描述> })
+   Write({ file_path: ".context/tmp/ccg-review-adv-$JOB.txt", content: <下方任务描述> })
 
 Step 2. 调 helper:
    Bash({
-     command: `{{CODEX_BASH_TASK}} --prompt-file /tmp/ccg-review-adv-$JOB.txt`,
+     command: `{{CODEX_BASH_TASK}} --prompt-file .context/tmp/ccg-review-adv-$JOB.txt`,
      description: "Adversarial review (codex direct)",
      run_in_background: true,
      timeout: 3600000

package/templates/scripts/ccgx-call-plugin.mjs

@@ -44,7 +44,7 @@
 //    --prompt-file <path>    Required. Path to file containing prompt body.
 //    --json                  Pass --json to companion (default: true).
 //    --no-json               Disable --json (text output).
-//    --timeout-ms <N>        Kill companion after N ms (default: 600000).
+//    --timeout-ms <N>        Kill companion if total wall-time exceeds N ms (default: 7200000, 2h; pass 0 to disable).
 //    --max-budget-usd <N>    Forwarded to companion (default: 50).
 //
 //  Cross-cutting:
@@ -55,9 +55,9 @@
 // =============================================================================
 
 import { spawn } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync, unlinkSync } from 'node:fs'
 import { homedir, platform } from 'node:os'
-import { join } from 'node:path'
+import { basename, join, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 // ---------------------------------------------------------------------------
@@ -103,7 +103,26 @@ function parseArgs(argv) {
     vendor: null,
     promptFile: null,
     json: true,
-    timeoutMs: 600000,
+    // 2.1.1: wall-time bumped 600s → 7200s (2h). Real codex audits /
+    // multi-file reviews / planning tasks routinely run 5-30 min; the old
+    // 600s default was SIGTERM-ing healthy tasks mid-thought. 2h is a
+    // generous safety ceiling — pass 0 to disable entirely.
+    timeoutMs: 7200000,
+    // 2.1.2: idle detection is OPT-IN (default 0 = disabled). The original
+    // 2.1.1 assumption that "healthy long-running audits emit continuous
+    // stdout/stderr chunks" is FALSE for both vendors:
+    //   - codex-companion `task`: writes progress to its internal job
+    //     state.json (read via `codex status`); helper sees ZERO stdout
+    //     until the final JSON envelope.
+    //   - gemini-batch / gemini-cli `--output-format json`: emits 4-5
+    //     startup warning lines, then SILENT through model reasoning + all
+    //     tool calls, then the final JSON.
+    // Deep reasoning passes can silently exceed any reasonable idle
+    // threshold while being perfectly healthy. Wall-time (default 2h)
+    // remains the only safety bound by default. Callers who know their
+    // task class is supposed to stream (e.g. future protocol additions)
+    // can pass --idle-timeout-ms <N> explicitly.
+    idleTimeoutMs: 0,
     maxBudgetUsd: 50,
     // 1.0.5 regression fix: pre-1.0.5 callers always passed --write directly
     // to codex-companion. Default true preserves BC; --no-write opt-out for
@@ -127,6 +146,7 @@ function parseArgs(argv) {
       case '--json':           opts.json = true; break
       case '--no-json':        opts.json = false; break
       case '--timeout-ms':     opts.timeoutMs = Number.parseInt(next(), 10); break
+      case '--idle-timeout-ms': opts.idleTimeoutMs = Number.parseInt(next(), 10); break
       case '--max-budget-usd': opts.maxBudgetUsd = Number.parseFloat(next()); break
       case '--write':          opts.write = true; break
       case '--no-write':       opts.write = false; break
@@ -166,7 +186,8 @@ Required:
 Optional:
   --json                  Pass --json to companion (default: true)
   --no-json               Disable --json (text output)
-  --timeout-ms <N>        Kill companion after N ms (default: 600000)
+  --timeout-ms <N>        Kill companion if total wall-time exceeds N ms (default: 7200000, 2h; pass 0 to disable)
+  --idle-timeout-ms <N>   Kill companion if no stdout/stderr output for N ms (default: 0 = disabled). NOTE: codex-companion and gemini-batch both emit NOTHING to stdout/stderr during execution (progress lives in internal state files); idle defaults to disabled to avoid false-positive kills of healthy long tasks. Set to a positive value only if your task class is known to stream.
   --max-budget-usd <N>    Per-call cost cap (default: 50)
   --write                 Enable workspace-write sandbox (default: true; codex needs this to spawn read commands too under default approval policy)
   --no-write              Force read-only sandbox (companion approval-policy will decline most commands)
@@ -285,6 +306,35 @@ async function main(argv) {
     process.exit(66) // EX_NOINPUT
   }
 
+  // 2.1.1: auto-delete the prompt file after a successful read iff the
+  // PHYSICAL path sits inside the caller's `<cwd>/.context/tmp/` AND the
+  // filename starts with `ccg-`. This is the workflow-managed throwaway-
+  // prompt directory (see templates/commands/review.md — Step 1 writes
+  // prompts here).
+  //
+  // CRITICAL — codex audit 2026-05-12 raised: lexical `resolve()` is
+  // insufficient. If `.context` or `.context/tmp` is a symlink/junction
+  // pointing outside the workspace, OR the caller passes a path whose
+  // lexical form is `<cwd>/.context/tmp/ccg-x.txt` but its physical
+  // target is `/etc/passwd` (or worse, `C:\Windows\System32\...`), the
+  // lexical-only check would still authorize the unlink. realpathSync
+  // canonicalizes ALL symlinks/junctions/`..` segments before the
+  // whitelist compare — both for the candidate file AND the safeRoot.
+  // Two ANDed gates: physical prefix + filename prefix.
+  try {
+    const resolvedFile = realpathSync(opts.promptFile)
+    const safeRoot = realpathSync(resolve(process.cwd(), '.context', 'tmp')) + sep
+    if (resolvedFile.startsWith(safeRoot) && basename(resolvedFile).startsWith('ccg-')) {
+      unlinkSync(resolvedFile)
+    }
+  }
+  catch {
+    // Best-effort. ENOENT (.context/tmp absent, file already gone, etc.)
+    // is the dominant non-error case here; we deliberately don't surface
+    // it. Real failures (permission etc.) will leave a file behind that
+    // .gitignore catches and the user's next run overwrites.
+  }
+
   // Discover companion via SSoT (no glob, no head -1)
   const disc = discoverCompanion(opts.vendor)
   if (disc.error) {
@@ -327,24 +377,53 @@ async function main(argv) {
 
   let stdoutBuf = ''
   let stderrBuf = ''
-  child.stdout.on('data', (chunk) => { stdoutBuf += chunk.toString('utf-8') })
-  child.stderr.on('data', (chunk) => { stderrBuf += chunk.toString('utf-8') })
+  let lastActivityAt = Date.now()
+  child.stdout.on('data', (chunk) => {
+    stdoutBuf += chunk.toString('utf-8')
+    lastActivityAt = Date.now()
+  })
+  child.stderr.on('data', (chunk) => {
+    stderrBuf += chunk.toString('utf-8')
+    lastActivityAt = Date.now()
+  })
 
-  // Timeout: kill child if exceeds opts.timeoutMs
+  // 2.1.1: two-layer timeout. wall-time is the safety ceiling; idle is the
+  // primary "stuck" detector — a healthy long task keeps producing tool-call
+  // / progress chunks, a truly hung companion produces nothing. SIGTERM is
+  // best-effort on Windows where the kernel doesn't propagate to the
+  // grandchild tree; companion processes on this code path are expected to
+  // do their own subtree cleanup (taskkill /T) when they receive SIGTERM.
   let timedOut = false
-  const timer = setTimeout(() => {
+  let timeoutReason = null
+  const killChild = (reason) => {
     timedOut = true
+    timeoutReason = reason
     try { child.kill('SIGTERM') } catch { /* ignore */ }
     setTimeout(() => {
       try { child.kill('SIGKILL') } catch { /* ignore */ }
     }, 5000).unref?.()
-  }, opts.timeoutMs)
+  }
+  const wallTimer = opts.timeoutMs > 0
+    ? setTimeout(() => killChild(`wall-time ${opts.timeoutMs}ms`), opts.timeoutMs)
+    : null
+  // Check idle every 30s. A 30s sampling granularity adds at most 30s slop
+  // to the configured idle threshold, which is negligible at 600s default.
+  const idleChecker = opts.idleTimeoutMs > 0
+    ? setInterval(() => {
+        const silent = Date.now() - lastActivityAt
+        if (silent >= opts.idleTimeoutMs) {
+          killChild(`idle ${silent}ms exceeds ${opts.idleTimeoutMs}ms`)
+        }
+      }, 30000)
+    : null
+  if (idleChecker?.unref) idleChecker.unref()
 
   const exit = await new Promise((resolve) => {
     child.once('exit', (code, signal) => resolve({ code, signal }))
     child.once('error', (err) => resolve({ code: 70, signal: null, errorMsg: err.message }))
   })
-  clearTimeout(timer)
+  if (wallTimer) clearTimeout(wallTimer)
+  if (idleChecker) clearInterval(idleChecker)
 
   const durationMs = Date.now() - startedAt
   const status = (!timedOut && exit.code === 0) ? 'ok' : 'error'
@@ -357,7 +436,7 @@ async function main(argv) {
     stdout: stdoutBuf,
     stderr: stderrBuf,
   }
-  if (timedOut) result.error = `timeout after ${opts.timeoutMs}ms`
+  if (timedOut) result.error = `companion killed: ${timeoutReason}`
   else if (exit.errorMsg) result.error = `spawn error: ${exit.errorMsg}`
   else if (exit.code !== 0) result.error = `companion exited with code ${exit.code}`