chainlesschain 0.162.143 → 0.162.147

package/src/lib/background-agent-supervisor.js

@@ -0,0 +1,197 @@
+import { spawn, spawnSync } from "node:child_process";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { randomBytes } from "node:crypto";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { getHomeDir } from "./paths.js";
+
+export const _deps = { spawn, spawnSync };
+
+export function backgroundAgentsDir() {
+  const dir =
+    process.env.CC_BACKGROUND_AGENTS_DIR ||
+    join(getHomeDir(), "background-agents");
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+export function createBackgroundAgentId() {
+  return `bg-${Date.now()}-${randomBytes(3).toString("hex")}`;
+}
+
+function safeId(id) {
+  if (!/^bg-[a-zA-Z0-9-]+$/.test(String(id || ""))) {
+    throw new Error(`Invalid background agent id: ${id}`);
+  }
+  return String(id);
+}
+
+export function statePath(id) {
+  return join(backgroundAgentsDir(), `${safeId(id)}.json`);
+}
+
+export function logPath(id) {
+  return join(backgroundAgentsDir(), `${safeId(id)}.log`);
+}
+
+export function writeBackgroundAgentState(state) {
+  const target = statePath(state.id);
+  const tmp = `${target}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
+  renameSync(tmp, target);
+  return state;
+}
+
+export function readBackgroundAgentState(id) {
+  const file = statePath(id);
+  if (!existsSync(file)) return null;
+  try {
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function isProcessAlive(pid) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return false;
+  try {
+    process.kill(Number(pid), 0);
+    return true;
+  } catch (error) {
+    if (error?.code === "EPERM") return true;
+    return false;
+  }
+}
+
+export function effectiveBackgroundAgentState(state) {
+  if (!state) return null;
+  if (state.status === "running" && !isProcessAlive(state.pid)) {
+    return { ...state, status: "lost", endedAt: state.endedAt || Date.now() };
+  }
+  return state;
+}
+
+export function listBackgroundAgents(options = {}) {
+  return readdirSync(backgroundAgentsDir())
+    .filter((name) => name.endsWith(".json") && !name.includes(".job."))
+    .map((name) => readBackgroundAgentState(name.slice(0, -5)))
+    .filter(Boolean)
+    .map(effectiveBackgroundAgentState)
+    .filter((state) => options.all || state.status === "running")
+    .sort((a, b) => (b.startedAt || 0) - (a.startedAt || 0));
+}
+
+export function launchBackgroundAgent({
+  argv,
+  cwd,
+  sessionId,
+  title,
+  cliEntry,
+}) {
+  const id = createBackgroundAgentId();
+  const dir = backgroundAgentsDir();
+  const jobFile = join(dir, `${id}.job.${process.pid}.json`);
+  const worker = fileURLToPath(
+    new URL("../workers/background-agent-worker.js", import.meta.url),
+  );
+  const job = {
+    id,
+    argv,
+    cwd,
+    sessionId,
+    title: title || "Background agent",
+    cliEntry: cliEntry || process.argv[1],
+    logFile: logPath(id),
+  };
+  writeFileSync(jobFile, JSON.stringify(job), { mode: 0o600 });
+  let child;
+  try {
+    child = _deps.spawn(process.execPath, [worker, jobFile], {
+      cwd,
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+  } catch (error) {
+    rmSync(jobFile, { force: true });
+    throw error;
+  }
+  child.unref();
+  const state = {
+    id,
+    sessionId,
+    title: job.title,
+    cwd,
+    pid: child.pid,
+    status: "running",
+    startedAt: Date.now(),
+    endedAt: null,
+    exitCode: null,
+    logFile: job.logFile,
+  };
+  writeBackgroundAgentState(state);
+  return state;
+}
+
+export function readBackgroundAgentLog(id, options = {}) {
+  const file = logPath(id);
+  if (!existsSync(file)) return "";
+  const text = readFileSync(file, "utf8");
+  const lines = text.split(/\r?\n/);
+  const limit = Math.max(1, Number(options.lines) || 100);
+  return lines.slice(-limit).join("\n");
+}
+
+export function stopBackgroundAgent(id) {
+  const state = effectiveBackgroundAgentState(readBackgroundAgentState(id));
+  if (!state) throw new Error(`Background agent not found: ${id}`);
+  if (state.status !== "running") return { ...state, stopped: false };
+  if (process.platform === "win32") {
+    const killed = _deps.spawnSync(
+      "taskkill",
+      ["/PID", String(state.pid), "/T", "/F"],
+      {
+        windowsHide: true,
+        encoding: "utf8",
+      },
+    );
+    if (killed.error || (killed.status !== 0 && isProcessAlive(state.pid))) {
+      throw new Error(
+        `Failed to stop background agent ${id}: ${killed.error?.message || killed.stderr || `taskkill exited ${killed.status}`}`,
+      );
+    }
+  } else {
+    try {
+      process.kill(-Number(state.pid), "SIGTERM");
+    } catch {
+      process.kill(Number(state.pid), "SIGTERM");
+    }
+  }
+  const next = {
+    ...state,
+    status: "stopped",
+    endedAt: Date.now(),
+    stoppedByUser: true,
+  };
+  writeBackgroundAgentState(next);
+  return { ...next, stopped: true };
+}
+
+export function openBackgroundLogFile(id) {
+  const fd = openSync(logPath(id), "a", 0o600);
+  return { fd, close: () => closeSync(fd) };
+}
+
+export function removeJobFile(file) {
+  rmSync(file, { force: true });
+}

package/src/lib/code-review.js

@@ -0,0 +1,72 @@
+/**
+ * Code review utilities (ESM)
+ * Mirrors Claude Code /review behavior
+ * @module lib/code-review
+ */
+
+import { execSync } from "child_process";
+import { logger } from "./logger.js";
+
+/**
+ * Get git diff for review
+ * @param {string} target - Diff target (default: staged changes)
+ * @returns {string} diff output
+ */
+export function getGitDiff(target = "--staged") {
+  try {
+    return execSync(`git diff ${target}`, {
+      encoding: "utf8",
+      maxBuffer: 10 * 1024 * 1024,
+    });
+  } catch (err) {
+    logger.error(`Failed to get git diff: ${err.message}`);
+    return "";
+  }
+}
+
+/**
+ * Get list of changed files
+ * @param {string} target - Diff target
+ * @returns {string[]} changed files
+ */
+export function getChangedFiles(target = "--staged") {
+  try {
+    const output = execSync(`git diff ${target} --name-only`, {
+      encoding: "utf8",
+    });
+    return output.trim().split("\n").filter(Boolean);
+  } catch (err) {
+    logger.error(`Failed to get changed files: ${err.message}`);
+    return [];
+  }
+}
+
+/**
+ * Run code review on current changes
+ * @param {Object} options Review options
+ * @returns {Promise<Object>} review result
+ */
+export async function runCodeReview(options = {}) {
+  const target = options.target || "--staged";
+  const diff = getGitDiff(target);
+  const files = getChangedFiles(target);
+
+  if (files.length === 0) {
+    logger.info("No changed files to review");
+    return { reviewed: false, files: [], issues: [] };
+  }
+
+  logger.info(`Reviewing ${files.length} changed files...`);
+  files.forEach((f) => logger.info(`  - ${f}`));
+
+  return {
+    reviewed: true,
+    files,
+    diffSize: diff.length,
+    // Actual AI review will be handled by agent core
+    message:
+      "Code review request prepared. AI will analyze changes for bugs, security issues, and style problems.",
+  };
+}
+
+export default { getGitDiff, getChangedFiles, runCodeReview };

package/src/lib/plugin-security.js

@@ -0,0 +1,128 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { loadManagedSettings } from "./settings-loader.cjs";
+
+function stringSet(value) {
+  return Array.isArray(value)
+    ? new Set(
+        value
+          .map((v) =>
+            typeof v === "string" ? v : v?.name || v?.source || v?.url || null,
+          )
+          .map((v) => String(v || "").trim())
+          .filter(Boolean),
+      )
+    : null;
+}
+
+export function enforcePluginPolicy(
+  { name, source = null, action = "install" },
+  managed,
+) {
+  if (!managed) return { allowed: true };
+  const denied = stringSet(managed.deniedPlugins) || new Set();
+  const allowed = stringSet(managed.allowedPlugins);
+  if (denied.has(name)) {
+    throw new Error(`plugin "${name}" is denied by managed settings`);
+  }
+  if (allowed && !allowed.has(name)) {
+    throw new Error(`plugin "${name}" is not in the managed allowlist`);
+  }
+
+  const blockedSources = new Set([
+    ...(stringSet(managed.blockedPluginSources) || []),
+    ...(stringSet(managed.blockedMarketplaces) || []),
+  ]);
+  const allowedSources = stringSet(managed.allowedPluginSources);
+  if (source && blockedSources.has(source)) {
+    throw new Error(`plugin source "${source}" is blocked by managed settings`);
+  }
+  if (action === "install" && allowedSources) {
+    if (!source) {
+      throw new Error(
+        "managed settings require --source for plugin installation",
+      );
+    }
+    if (!allowedSources.has(source)) {
+      throw new Error(
+        `plugin source "${source}" is not in the managed allowlist`,
+      );
+    }
+  }
+  return { allowed: true };
+}
+
+export function verifyPluginManifest({
+  manifestFile,
+  expectedSha256,
+  signatureFile,
+  publicKeyFile,
+  requireSignature = false,
+  trustedKeySha256 = null,
+  requireTrustedKey = false,
+}) {
+  if (!manifestFile) {
+    if (requireSignature) {
+      throw new Error("managed settings require a signed plugin manifest");
+    }
+    return null;
+  }
+  const bytes = readFileSync(manifestFile);
+  const sha256 = createHash("sha256").update(bytes).digest("hex");
+  if (
+    expectedSha256 &&
+    sha256.toLowerCase() !== String(expectedSha256).toLowerCase()
+  ) {
+    throw new Error(
+      `plugin manifest SHA-256 mismatch (expected ${expectedSha256}, got ${sha256})`,
+    );
+  }
+
+  const wantsSignature = requireSignature || signatureFile || publicKeyFile;
+  let signatureVerified = false;
+  if (wantsSignature) {
+    if (!signatureFile || !publicKeyFile) {
+      throw new Error(
+        "plugin signature verification requires --signature and --public-key",
+      );
+    }
+    const signature = readFileSync(signatureFile);
+    const publicKey = readFileSync(publicKeyFile, "utf8");
+    const keyObject = createPublicKey(publicKey);
+    const publicKeySha256 = createHash("sha256")
+      .update(keyObject.export({ type: "spki", format: "der" }))
+      .digest("hex");
+    const trusted = stringSet(trustedKeySha256);
+    if (requireTrustedKey && (!trusted || trusted.size === 0)) {
+      throw new Error(
+        "managed settings require trustedPluginKeySha256 fingerprints",
+      );
+    }
+    if (trusted && !trusted.has(publicKeySha256)) {
+      throw new Error(`plugin signing key is not trusted (${publicKeySha256})`);
+    }
+    signatureVerified = verify(null, bytes, keyObject, signature);
+    if (!signatureVerified) {
+      throw new Error("plugin manifest signature verification failed");
+    }
+  }
+  return {
+    bytes,
+    sha256,
+    signatureVerified,
+    publicKeySha256: signatureVerified
+      ? createHash("sha256")
+          .update(
+            createPublicKey(readFileSync(publicKeyFile, "utf8")).export({
+              type: "spki",
+              format: "der",
+            }),
+          )
+          .digest("hex")
+      : null,
+  };
+}
+
+export function loadPluginManagedPolicy(options = {}) {
+  return loadManagedSettings(options).settings;
+}

package/src/lib/pr-create.js

@@ -0,0 +1,108 @@
+/**
+ * Pull request creation utilities (ESM)
+ * Mirrors Claude Code /pr behavior
+ * @module lib/pr-create
+ */
+
+import { execSync } from "child_process";
+import { logger } from "./logger.js";
+
+/**
+ * Get current git branch
+ * @returns {string} branch name
+ */
+export function getCurrentBranch() {
+  try {
+    return execSync("git rev-parse --abbrev-ref HEAD", {
+      encoding: "utf8",
+    }).trim();
+  } catch {
+    return "main";
+  }
+}
+
+/**
+ * Get remote URL
+ * @returns {string|null}
+ */
+export function getRemoteUrl() {
+  try {
+    return execSync("git remote get-url origin", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract GitHub owner/repo from remote URL
+ * @returns {{owner: string, repo: string}|null}
+ */
+export function parseGitHubRepo() {
+  const url = getRemoteUrl();
+  if (!url) return null;
+
+  // Handle SSH and HTTPS URLs
+  const match = url.match(/github\.com[:/]([^/]+)\/([^/.]+)(\.git)?/);
+  if (!match) return null;
+
+  return { owner: match[1], repo: match[2] };
+}
+
+/**
+ * Prepare pull request
+ * @param {Object} options PR options
+ * @returns {Promise<Object>} PR creation result
+ */
+export async function preparePullRequest(options = {}) {
+  const branch = getCurrentBranch();
+  const repo = parseGitHubRepo();
+
+  // Check for uncommitted changes
+  const status = execSync("git status --porcelain", { encoding: "utf8" });
+  const hasChanges = status.trim().length > 0;
+
+  if (hasChanges && !options.skipStash) {
+    logger.warn(
+      "You have uncommitted changes. Commit or stash before creating PR.",
+    );
+  }
+
+  // Get commit messages for PR body
+  const defaultBase = options.base || "main";
+  const logRange = `${defaultBase}...${branch}`;
+  let commitLog = "";
+  try {
+    commitLog = execSync(`git log ${logRange} --oneline`, { encoding: "utf8" });
+  } catch {
+    commitLog = "";
+  }
+
+  const prUrl = repo
+    ? `https://github.com/${repo.owner}/${repo.repo}/compare/${defaultBase}...${branch}?expand=1`
+    : null;
+
+  logger.info(`Branch: ${branch}`);
+  logger.info(`Base: ${defaultBase}`);
+  if (prUrl) {
+    logger.info(`Open PR in browser: ${prUrl}`);
+  }
+
+  return {
+    prepared: true,
+    branch,
+    base: defaultBase,
+    repo,
+    commitLog,
+    prUrl,
+    hasUncommittedChanges: hasChanges,
+    message:
+      "PR draft prepared. AI will help generate title and body from commits.",
+  };
+}
+
+export default {
+  getCurrentBranch,
+  getRemoteUrl,
+  parseGitHubRepo,
+  preparePullRequest,
+};

package/src/lib/publish-workspace.js

@@ -0,0 +1,107 @@
+/**
+ * Publish workspace packages to npm (ESM)
+ * Mirrors Claude Code /publish behavior
+ * @module lib/publish-workspace
+ */
+
+import { execSync } from "child_process";
+import { logger } from "./logger.js";
+import path from "path";
+import fs from "fs";
+
+/**
+ * Get all workspace packages
+ * @returns {Array<{name: string, path: string, version: string}>}
+ */
+export function getWorkspacePackages() {
+  try {
+    const rootPkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+    const packages = [];
+
+    // Handle workspaces config
+    const workspaces = rootPkg.workspaces?.packages || rootPkg.workspaces || [];
+    for (const pattern of workspaces) {
+      // Simple glob handling for basic patterns
+      const dir = pattern.replace(/\*+/g, "");
+      if (fs.existsSync(dir)) {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (entry.isDirectory()) {
+            const pkgPath = path.join(dir, entry.name);
+            const pkgFile = path.join(pkgPath, "package.json");
+            if (fs.existsSync(pkgFile)) {
+              const pkg = JSON.parse(fs.readFileSync(pkgFile, "utf8"));
+              if (pkg.name && !pkg.private) {
+                packages.push({
+                  name: pkg.name,
+                  path: pkgPath,
+                  version: pkg.version,
+                });
+              }
+            }
+          }
+        }
+      }
+    }
+
+    return packages;
+  } catch (err) {
+    logger.error(`Failed to get workspace packages: ${err.message}`);
+    return [];
+  }
+}
+
+/**
+ * Publish a single package
+ * @param {Object} pkg Package info
+ * @param {Object} options Publish options
+ * @returns {boolean} success
+ */
+export function publishPackage(pkg, options = {}) {
+  try {
+    logger.info(`Publishing ${pkg.name}@${pkg.version}...`);
+    let cmd = "npm publish";
+    if (options.tag) cmd += ` --tag ${options.tag}`;
+    if (options.access) cmd += ` --access ${options.access}`;
+
+    execSync(cmd, {
+      cwd: pkg.path,
+      stdio: "inherit",
+      encoding: "utf8",
+    });
+    logger.succeed(`Published ${pkg.name}@${pkg.version}`);
+    return true;
+  } catch (err) {
+    logger.error(`Failed to publish ${pkg.name}: ${err.message}`);
+    return false;
+  }
+}
+
+/**
+ * Publish all changed workspace packages
+ * @param {Object} options Options
+ * @returns {Promise<boolean>} success
+ */
+export async function publishWorkspace(options = {}) {
+  const packages = getWorkspacePackages();
+  if (packages.length === 0) {
+    logger.info("No publishable packages found");
+    return true;
+  }
+
+  logger.info(`Found ${packages.length} publishable packages`);
+  let allSucceeded = true;
+
+  for (const pkg of packages) {
+    if (options.dryRun) {
+      logger.info(`[dry-run] Would publish ${pkg.name}@${pkg.version}`);
+      continue;
+    }
+    const ok = publishPackage(pkg, options);
+    if (!ok) allSucceeded = false;
+  }
+
+  return allSucceeded;
+}
+
+export default { getWorkspacePackages, publishPackage, publishWorkspace };