ccqa 1.40.0 → 1.40.1

package/dist/bin/ccqa.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { HubApiError, createHubClient, hubRequest } from "../hub-client/index.mjs";
 import { t as EVIDENCE_DIR_ENV } from "../evidence-constants-C425F7ZG.mjs";
-import { a as formatAgentBrowserUnavailableMessage, i as assertAgentBrowserAvailable, n as spawnAB, o as pathWithAgentBrowserShim, r as AgentBrowserUnavailableError, s as resolveAgentBrowserBin$1, t as sleepSync } from "../spawn-ab-CRIVfWpw.mjs";
+import { a as formatAgentBrowserUnavailableMessage, i as assertAgentBrowserAvailable, n as spawnAB, o as pathWithAgentBrowserShim, r as AgentBrowserUnavailableError, s as resolveAgentBrowserBin$1, t as sleepSync } from "../spawn-ab-Bm34WBui.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { accessSync, appendFileSync, createWriteStream, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -19,6 +19,7 @@ import { promisify } from "node:util";
 import { createInterface } from "node:readline/promises";
 import { createServer } from "node:http";
 import { gunzipSync, gzipSync } from "node:zlib";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createInterface as createInterface$1 } from "node:readline";
 import { createServer as createServer$1 } from "node:net";
 //#region src/run/report-constants.ts
@@ -1615,10 +1616,17 @@ function warnOnceIfNativeBinaryMissing() {
 	const missing = missingNativeBinaryPackage();
 	if (missing) warn(missingNativeBinaryMessage(missing));
 }
+/** Whole minutes read best, but the ceiling is set in ms and may be seconds. */
+function formatDuration$1(ms) {
+	if (ms < 6e4 || ms % 6e4 !== 0) return `${Math.round(ms / 1e3)}s`;
+	const minutes = ms / 6e4;
+	return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+}
 async function invokeClaudeStreaming(options, onEvent) {
-	const { prompt, systemPrompt, allowedTools, disableBuiltinTools = false, disableThinking = false, mcpServers, maxTurns, env, model, cwd, onAbAction, onAbActionFailed, silenceBashLog = false, envScrubMap = [], relaxAbConstraints = false } = options;
+	const { prompt, systemPrompt, allowedTools, disableBuiltinTools = false, disableThinking = false, mcpServers, maxTurns, timeoutMs, env, model, cwd, onAbAction, onAbActionFailed, silenceBashLog = false, envScrubMap = [], relaxAbConstraints = false } = options;
 	const resolvedModel = resolveModel(model);
 	const mergedEnv = buildInvocationEnv(env);
+	const abortController = new AbortController();
 	let lastAbToolUseId = null;
 	const claimAbToolUse = (toolUseId) => {
 		if (toolUseId !== lastAbToolUseId) return false;
@@ -1631,6 +1639,7 @@ async function invokeClaudeStreaming(options, onEvent) {
 		allowedTools: allowedTools ?? ["Bash(*)"],
 		permissionMode: "bypassPermissions",
 		allowDangerouslySkipPermissions: true,
+		abortController,
 		...resolvedModel ? { model: resolvedModel } : {},
 		...cwd ? { cwd } : {},
 		...mergedEnv ? { env: mergedEnv } : {},
@@ -1695,7 +1704,10 @@ async function invokeClaudeStreaming(options, onEvent) {
 		} : void 0
 	};
 	warnOnceIfNativeBinaryMissing();
+	const capTimer = timeoutMs === void 0 ? null : setTimeout(() => abortController.abort(), timeoutMs);
+	capTimer?.unref?.();
 	let result = "";
+	let answered = false;
 	let isError = false;
 	let errorDetail = null;
 	let cost = {
@@ -1720,6 +1732,7 @@ async function invokeClaudeStreaming(options, onEvent) {
 				}
 			}
 			if (msg.type === "result") {
+				answered = true;
 				isError = msg.is_error ?? false;
 				if (msg.subtype === "success") result = msg.result;
 				else {
@@ -1733,6 +1746,13 @@ async function invokeClaudeStreaming(options, onEvent) {
 		isError = true;
 		errorDetail = err instanceof Error ? err.message : String(err);
 		if (!result) result = errorDetail;
+	} finally {
+		if (capTimer) clearTimeout(capTimer);
+	}
+	if (abortController.signal.aborted && timeoutMs !== void 0 && !answered) {
+		isError = true;
+		errorDetail = `stopped after ${formatDuration$1(timeoutMs)} (host time limit)`;
+		result = errorDetail;
 	}
 	tallyInvocation(cost);
 	return {
@@ -10490,16 +10510,8 @@ async function removeTempStateDir(statePath) {
 * than throwing; the caller decides whether an un-restored session is fatal.
 */
 function loadStateIntoSession(sessionName, statePath) {
-	const boot = spawnAB([
-		"--session",
-		sessionName,
-		"open",
-		"about:blank"
-	]);
-	if (boot.status !== 0) return {
-		ok: false,
-		error: (boot.stderr || boot.stdout || `open exited ${boot.status}`).trim()
-	};
+	const boot = bootSession(sessionName);
+	if (!boot.ok) return boot;
 	const load = spawnAB([
 		"--session",
 		sessionName,
@@ -10509,7 +10521,26 @@ function loadStateIntoSession(sessionName, statePath) {
 	]);
 	if (load.status !== 0) return {
 		ok: false,
-		error: (load.stderr || load.stdout || `state load exited ${load.status}`).trim()
+		error: (load.stderr || load.stdout || `state load exited ${load.status}`).trim(),
+		wedged: load.wedged
+	};
+	return { ok: true };
+}
+/**
+* Bring up the session's daemon and browser without navigating, so whatever
+* the caller attaches next lands on the session rather than racing a page load.
+*/
+function bootSession(sessionName) {
+	const boot = spawnAB([
+		"--session",
+		sessionName,
+		"open",
+		"about:blank"
+	]);
+	if (boot.status !== 0) return {
+		ok: false,
+		error: (boot.stderr || boot.stdout || `open exited ${boot.status}`).trim(),
+		wedged: boot.wedged
 	};
 	return { ok: true };
 }
@@ -10636,8 +10667,7 @@ function verifySessionRestores(statePath, verifyUrl) {
 * false "unhealthy" would re-inject the saved state and wipe auth the spec
 * acquired live — breaking a spec that was fine. Missing a same-origin-ish
 * sign-in wall just leaves that step failing as before (no regression), so the
-* asymmetry favours only firing on a provably dead daemon. `verifyUrl` is still
-* required (it's the re-anchor target for recovery) but no longer compared here.
+* asymmetry favours only firing on a provably dead daemon.
 */
 function checkLiveSessionHealth(sessionName) {
 	const probe = spawnAB([
@@ -10648,30 +10678,30 @@ function checkLiveSessionHealth(sessionName) {
 	]);
 	if (probe.status !== 0) return {
 		healthy: false,
+		kind: probe.wedged === true ? "unresponsive" : "errored",
 		reason: (probe.stderr || probe.stdout || `probe exited ${probe.status}`).trim()
 	};
 	const href = unwrapEvalString(probe.stdout);
 	if (!href || href === "about:blank" || href.startsWith("chrome://") || href.startsWith("chrome-error://")) return {
 		healthy: false,
+		kind: "blank",
 		reason: `blank/absent page (${href || "empty"})`
 	};
 	return { healthy: true };
 }
 /**
-* Recover a live session whose daemon was replaced mid-run (detected by
-* {@link checkLiveSessionHealth}). The restart drops the in-memory auth-state
-* injected at run start, so the session fell to a sign-in wall. Re-boot +
-* re-attach the saved state ({@link loadStateIntoSession} is idempotent —
-* `state load` is load-only, never writes back) and then navigate to
-* `verifyUrl`, a known signed-in page, so the retrying model has an
-* authenticated anchor to continue from instead of a login screen. Returns the
-* injection result; the trailing `open` is best-effort (a failed nav still
-* leaves the state attached for the model's own next navigation).
+* Put a live session back on its feet after {@link checkLiveSessionHealth}
+* found it broken: boot its browser, re-attach the saved state if it has one,
+* and anchor on `verifyUrl` so a retrying model resumes from a signed-in page.
+*
+* An unresponsive daemon must already have been killed by the caller — every
+* command below goes through the socket it is ignoring. The trailing `open` is
+* best-effort; a failed nav still leaves a usable session behind.
 */
 function recoverLiveSession(sessionName, statePath, verifyUrl) {
-	const injected = loadStateIntoSession(sessionName, statePath);
-	if (!injected.ok) return injected;
-	spawnAB([
+	const restored = statePath ? loadStateIntoSession(sessionName, statePath) : bootSession(sessionName);
+	if (!restored.ok) return restored;
+	if (verifyUrl) spawnAB([
 		"--session",
 		sessionName,
 		"open",
@@ -12051,6 +12081,146 @@ function buildLiveUserPrompt(step) {
 	return `Execute step ${step.id} and emit your STEP_RESULT verdict as instructed in the system prompt.`;
 }
 //#endregion
+//#region src/runtime/agent-browser-daemon.ts
+/**
+* Forcing a session's agent-browser daemon out when it has stopped answering.
+*
+* Every other way ccqa reaches a daemon is a command over that daemon's socket
+* — `close`, the only shutdown the CLI offers, included — so none of them work
+* on one that no longer reads it. The per-session pid file does not.
+*/
+/** Measured against agent-browser 0.26-0.34. */
+function agentBrowserRuntimeDir() {
+	const explicit = process.env["AGENT_BROWSER_SOCKET_DIR"];
+	const xdg = process.env["XDG_RUNTIME_DIR"];
+	const base = explicit ?? (xdg ? join(xdg, "agent-browser") : join(homedir(), ".agent-browser"));
+	const namespace = process.env["AGENT_BROWSER_NAMESPACE"];
+	return namespace ? join(base, "namespaces", namespace, "run") : base;
+}
+/** The daemon pid agent-browser recorded for `sessionName`, if it wrote one. */
+function readDaemonPid(sessionName) {
+	try {
+		const pid = Number(readFileSync(join(agentBrowserRuntimeDir(), `${sessionName}.pid`), "utf8").trim());
+		return Number.isInteger(pid) && pid > 1 ? pid : null;
+	} catch {
+		return null;
+	}
+}
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (e) {
+		return e.code === "EPERM";
+	}
+}
+/**
+* A pid file outlives an unclean exit, so its number may since have been handed
+* to something else. Where `ps` cannot answer — Windows has none — decline
+* rather than guess, which makes the kill a no-op instead of a hazard.
+*
+* Residual risk this cannot cover: a pid recycled onto *another session's*
+* daemon has identical argv and passes.
+*/
+function looksLikeAgentBrowser(pid) {
+	const ps = spawnSync("ps", [
+		"-p",
+		String(pid),
+		"-o",
+		"args="
+	], { encoding: "utf8" });
+	return ps.status === 0 && ps.stdout.includes("agent-browser");
+}
+function childPids(parent) {
+	const ps = spawnSync("ps", ["-eo", "pid=,ppid="], { encoding: "utf8" });
+	if (ps.status !== 0) return [];
+	const children = [];
+	for (const line of ps.stdout.split("\n")) {
+		const [pid, ppid] = line.trim().split(/\s+/).map(Number);
+		if (pid && ppid === parent) children.push(pid);
+	}
+	return children;
+}
+/** Ramped so the common case — a daemon that exits at once — is not taxed. */
+const TERM_POLL_MS = [
+	25,
+	50,
+	100,
+	250,
+	250,
+	250,
+	500,
+	500,
+	1e3,
+	1e3,
+	1e3
+];
+/** One phrase covering both outcomes, so callers log a single line. */
+function describeKill(kill) {
+	return kill.killed ? `killed daemon pid ${kill.pid}` : `could not kill the daemon (${kill.reason})`;
+}
+/**
+* Stop the daemon serving `sessionName`. The session stays reusable —
+* agent-browser boots a fresh daemon under the same name and clears the stale
+* socket itself.
+*
+* SIGTERM is given time because a daemon that exits on its own signal takes its
+* browser down with it, while SIGKILL leaves that browser running with no owner.
+*/
+async function killSessionDaemon(sessionName) {
+	const pid = readDaemonPid(sessionName);
+	if (pid === null) return {
+		killed: false,
+		reason: "no pid file for this session"
+	};
+	if (!isAlive(pid)) return {
+		killed: false,
+		reason: `pid ${pid} is not running`
+	};
+	if (!looksLikeAgentBrowser(pid)) return {
+		killed: false,
+		reason: `pid ${pid} is not an agent-browser process`
+	};
+	try {
+		process.kill(pid, "SIGTERM");
+	} catch {
+		return {
+			killed: false,
+			reason: `pid ${pid} could not be signalled`
+		};
+	}
+	for (const wait of TERM_POLL_MS) {
+		if (!isAlive(pid)) return {
+			killed: true,
+			pid
+		};
+		await setTimeout$1(wait);
+	}
+	if (!isAlive(pid)) return {
+		killed: true,
+		pid
+	};
+	const owned = childPids(pid);
+	try {
+		process.kill(pid, "SIGKILL");
+	} catch {}
+	for (const wait of TERM_POLL_MS) {
+		if (!isAlive(pid)) break;
+		await setTimeout$1(wait);
+	}
+	if (isAlive(pid)) return {
+		killed: false,
+		reason: `pid ${pid} survived SIGKILL`
+	};
+	for (const child of owned) if (isAlive(child)) try {
+		process.kill(child, "SIGTERM");
+	} catch {}
+	return {
+		killed: true,
+		pid
+	};
+}
+//#endregion
 //#region src/runtime/live-result-parse.ts
 const MAX_REASON_LEN = 2e3;
 /** Parse a single STEP_RESULT line. Returns null on malformed input. */
@@ -12142,7 +12312,14 @@ async function runLiveExecutor(input) {
 	const retries = Math.max(0, input.retries ?? 0);
 	if (statePath) {
 		const injected = loadStateIntoSession(input.sessionName, statePath);
-		if (!injected.ok) warn(`session state restore failed: ${injected.error}`);
+		if (!injected.ok && injected.wedged) {
+			const kill = await killSessionDaemon(input.sessionName);
+			warn(`session state restore failed: ${injected.error}; ${describeKill(kill)}`);
+			if (kill.killed) {
+				const retried = loadStateIntoSession(input.sessionName, statePath);
+				if (!retried.ok) warn(`session state restore failed again: ${retried.error}`);
+			}
+		} else if (!injected.ok) warn(`session state restore failed: ${injected.error}`);
 	}
 	for (let i = 0; i < input.steps.length; i++) {
 		const step$1 = input.steps[i];
@@ -12163,15 +12340,18 @@ async function runLiveExecutor(input) {
 		for (;;) {
 			lastOutcome = await executeStepAttempt(step$1, paths, systemPrompt, userPrompt);
 			if (lastOutcome.status === "passed") break;
-			if (!recoveredOnce && statePath && verifyUrl) {
+			if (!recoveredOnce) {
+				recoveredOnce = true;
 				const health = checkLiveSessionHealth(input.sessionName);
-				if (!health.healthy) {
-					warn(`session lost mid-step for ${step$1.id} (${health.reason}); re-injecting auth-state and retrying`);
-					const rec = recoverLiveSession(input.sessionName, statePath, verifyUrl);
-					if (!rec.ok) warn(`session recovery failed: ${rec.error}`);
-					recoveredOnce = true;
-					attempt++;
-					continue;
+				if (!health.healthy && (health.kind !== "blank" || statePath)) {
+					const kill = health.kind === "unresponsive" ? await killSessionDaemon(input.sessionName) : null;
+					warn(`session broken during ${step$1.id} (${health.reason}); ` + (kill ? describeKill(kill) : "re-injecting auth-state"));
+					if (!kill || kill.killed) {
+						const rec = recoverLiveSession(input.sessionName, statePath, verifyUrl);
+						if (!rec.ok) warn(`session recovery failed: ${rec.error}`);
+						attempt++;
+						continue;
+					}
 				}
 			}
 			if (attempt >= retries) break;
@@ -12215,7 +12395,8 @@ async function runLiveExecutor(input) {
 				systemPrompt,
 				model: input.model,
 				envScrubMap: input.envScrubMap,
-				relaxAbConstraints: true
+				relaxAbConstraints: true,
+				timeoutMs: stepAttemptTimeoutMs()
 			}, (msg) => {
 				if (msg.type !== "assistant") return;
 				for (const block of msg.message.content ?? []) {
@@ -12271,6 +12452,18 @@ async function runLiveExecutor(input) {
 * are the winning path — exactly the shortcut a later run should reuse.
 */
 const MAX_LEARNED_COMMANDS = 15;
+/**
+* Wall-clock ceiling on one step attempt. The prompt's own ~3 minute wait
+* budget cannot end a step, because a model parked on a notification never
+* comes back to read it. Sized off measured runs: the longest passing step was
+* 4 minutes, against a wedged one that ran 15.
+*/
+const STEP_ATTEMPT_TIMEOUT_MS = 8 * 6e4;
+/** Env override so a slow environment can be tuned without a release. */
+function stepAttemptTimeoutMs() {
+	const raw = Number(process.env["CCQA_LIVE_STEP_TIMEOUT_MS"]);
+	return Number.isFinite(raw) && raw > 0 ? raw : STEP_ATTEMPT_TIMEOUT_MS;
+}
 function emptyStepCost() {
 	return {
 		totalCostUsd: null,
@@ -12581,13 +12774,14 @@ function truncate(s, maxBytes) {
 * Close an agent-browser session by name. Used before/after a `ccqa generate`
 * run so a wedged daemon from a previous attempt can't hang the next one.
 *
-* Always resolves; never throws. If the binary is missing, the session
-* doesn't exist, or the call exceeds {@link CLOSE_TIMEOUT_MS}, we silently
-* return — close is best-effort cleanup, not a precondition.
+* Always resolves; never throws. If the binary is missing or the session
+* doesn't exist, we silently return — close is best-effort cleanup, not a
+* precondition.
 */
 async function closeSession(sessionName) {
 	const abBin = resolveAgentBrowserBin();
 	if (!abBin) return;
+	let unanswered = false;
 	await new Promise((resolve) => {
 		const child = spawn(process.execPath, [abBin, "close"], {
 			env: {
@@ -12597,6 +12791,7 @@ async function closeSession(sessionName) {
 			stdio: "ignore"
 		});
 		const timer = setTimeout(() => {
+			unanswered = true;
 			child.kill("SIGTERM");
 		}, CLOSE_TIMEOUT_MS);
 		const finish = () => {
@@ -12606,6 +12801,7 @@ async function closeSession(sessionName) {
 		child.on("error", finish);
 		child.on("exit", finish);
 	});
+	if (unanswered) await killSessionDaemon(sessionName);
 }
 //#endregion
 //#region src/cli/run-live.ts
@@ -17279,7 +17475,7 @@ function runValidationAction(action, sessionName, envOverrides = {}) {
 		};
 	}
 	let result = spawnAB(built);
-	if (result.status !== 0 && looksLikeHardTimeout(result)) result = spawnAB(built);
+	if (result.status !== 0 && result.wedged === true) result = spawnAB(built);
 	if (result.status === 0) return {
 		skipped: false,
 		ok: true,
@@ -17410,10 +17606,6 @@ function rescueLostSteps(actions, kept, dropped, opts) {
 		rescuedSteps
 	};
 }
-/** Did this agent-browser invocation get SIGTERM'd by the ccqa hard-timeout watchdog? */
-function looksLikeHardTimeout(result) {
-	return result.stderr.includes("agent-browser killed after hard timeout");
-}
 /**
 * Passive (read-only) actions whose only effect is observation. When a
 * preceding action fails, dropping these too is the right move because

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.40.0",
+  "version": "1.40.1",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/dist/runtime/test-helpers.mjs

@@ -1,5 +1,5 @@
 import { i as sanitizeStepId, n as FAILURE_SOURCE, r as FAILURE_STEP_ID, t as EVIDENCE_DIR_ENV } from "../evidence-constants-C425F7ZG.mjs";
-import { n as spawnAB, t as sleepSync } from "../spawn-ab-CRIVfWpw.mjs";
+import { n as spawnAB, t as sleepSync } from "../spawn-ab-Bm34WBui.mjs";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 //#region src/runtime/test-helpers.ts

package/dist/{spawn-ab-CRIVfWpw.mjs → spawn-ab-Bm34WBui.mjs}

@@ -163,10 +163,12 @@ function spawnABOnce(args) {
 		stdio: "pipe",
 		timeout: PROCESS_HARD_TIMEOUT_MS
 	});
+	const wedged = result.error?.code === "ETIMEDOUT";
 	return {
 		status: result.status,
 		stdout: result.stdout?.toString() ?? "",
-		stderr: (result.stderr?.toString() ?? "") + (result.signal === "SIGTERM" ? "\n[ccqa] agent-browser killed after hard timeout" : "")
+		stderr: (result.stderr?.toString() ?? "") + (wedged ? "\n[ccqa] agent-browser killed after hard timeout" : ""),
+		wedged
 	};
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.40.0",
+  "version": "1.40.1",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {