chainlesschain 0.162.148 → 0.162.150

package/src/lib/agent-team/team-worktree.js

@@ -0,0 +1,236 @@
+/**
+ * TeamWorktreeCoordinator (Phase 4) — give each teammate its OWN git worktree so
+ * parallel task execution never fights over the working tree, then integrate the
+ * results by SEQUENTIALLY previewing + merging each branch back to base. Two
+ * tasks that touch different files both merge clean; two that touch the same
+ * file surface a conflict on the second merge (the first having moved base) —
+ * the Phase 4 acceptance "并行 Worktree 修改可预览冲突并安全合并".
+ *
+ * Unlike `isolateTask` (which removes the worktree as soon as its fn returns),
+ * the coordinator KEEPS every worktree until integration is done — merge preview
+ * needs the branch's worktree present — then cleans them all up.
+ *
+ * The git surface (`worktree-isolator`) is injected via `_deps` so the
+ * coordinator's orchestration is unit-testable without a real repo; a real-git
+ * integration test exercises the actual worktree/commit/merge path.
+ */
+
+import {
+  createWorktree as _createWorktree,
+  removeWorktree as _removeWorktree,
+  previewWorktreeMerge as _previewWorktreeMerge,
+  mergeWorktree as _mergeWorktree,
+} from "../../harness/worktree-isolator.js";
+import { isGitRepo as _isGitRepo } from "../../lib/git-integration.js";
+import { execFileSync, spawn } from "node:child_process";
+
+function defaultRunShell(command, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, { cwd, shell: true, env: process.env });
+    let err = "";
+    child.stderr?.on("data", (d) => (err += d.toString("utf8")));
+    child.on("error", (e) => reject(new Error(e.message)));
+    child.on("close", (code) =>
+      code === 0
+        ? resolve({ code })
+        : reject(new Error(err.trim() || `command exited ${code}`)),
+    );
+  });
+}
+
+/** Stage + commit everything in a worktree. Returns true if a commit was made. */
+function defaultCommit(worktreePath, message) {
+  execFileSync("git", ["add", "-A"], { cwd: worktreePath, stdio: "ignore" });
+  try {
+    execFileSync(
+      "git",
+      [
+        "-c",
+        "user.email=team@chainlesschain.local",
+        "-c",
+        "user.name=cc team",
+        "commit",
+        "-m",
+        message,
+      ],
+      { cwd: worktreePath, stdio: "ignore" },
+    );
+    return true;
+  } catch {
+    return false; // nothing to commit (no changes)
+  }
+}
+
+export const _deps = {
+  createWorktree: _createWorktree,
+  removeWorktree: _removeWorktree,
+  previewWorktreeMerge: _previewWorktreeMerge,
+  mergeWorktree: _mergeWorktree,
+  isGitRepo: _isGitRepo,
+  runShell: defaultRunShell,
+  commit: defaultCommit,
+};
+
+export class TeamWorktreeCoordinator {
+  constructor(repoDir) {
+    this.repoDir = repoDir;
+    this._created = new Map(); // key → { branch, path, committed }
+  }
+
+  isGitRepo() {
+    return _deps.isGitRepo(this.repoDir);
+  }
+
+  branchFor(key) {
+    return `team/${key}`;
+  }
+
+  /**
+   * A TeamRunner `runTask` that runs a task inside a fresh per-task worktree and
+   * commits the result. By default it runs the task's shell `command`; pass
+   * `runInWorktree({ key, task, holder, cwd })` to instead drive an agent turn
+   * (its `prompt`) with cwd set to the worktree, so `--agent --worktree` gets the
+   * same parallel isolation as `--exec --worktree`. Throws (→ task failure) on a
+   * non-zero command / agent exit so retry/cancel still work.
+   */
+  makeRunTask({ runInWorktree = null } = {}) {
+    return async ({ key, task, holder }) => {
+      const branch = this.branchFor(key);
+      // A retry (the prior attempt failed and TaskLeaseRegistry re-queued the
+      // task) would collide with its own leftover worktree: createWorktree
+      // derives a DETERMINISTIC path from the branch and throws "Worktree
+      // already exists" (and `worktree add -b` rejects the existing branch), so
+      // the retry can never recover — it just re-fails on the collision instead
+      // of the real task. Tear down the prior attempt's worktree + branch first
+      // so a retry starts clean.
+      const prior = this._created.get(key);
+      if (prior) {
+        try {
+          _deps.removeWorktree(this.repoDir, prior.path, {
+            deleteBranch: true,
+          });
+        } catch {
+          /* best-effort — a real problem will resurface in createWorktree */
+        }
+        this._created.delete(key);
+      }
+      const { path: worktreePath } = _deps.createWorktree(this.repoDir, branch);
+      this._created.set(key, { branch, path: worktreePath, committed: false });
+      if (typeof runInWorktree === "function") {
+        await runInWorktree({ key, task, holder, cwd: worktreePath });
+      } else {
+        const command = task.metadata?.command || task?.command;
+        if (!command) {
+          throw new Error(
+            `task "${key}" has no \`command\` to run in a worktree`,
+          );
+        }
+        await _deps.runShell(command, worktreePath);
+      }
+      const committed = _deps.commit(worktreePath, `team task ${key}`);
+      this._created.get(key).committed = committed;
+      return { branch, committed };
+    };
+  }
+
+  /**
+   * Sequentially preview (and optionally merge) each committed branch back to
+   * base. Merging is in-order, so a later branch that conflicts with an
+   * already-merged one is reported as a conflict rather than silently clobbering.
+   *
+   * @param {object} [opts] { merge:boolean }  actually merge clean branches
+   * @returns {Array<{key,branch,committed,clean,merged,conflicts,error?}>}
+   */
+  integrate({ merge = false } = {}) {
+    const results = [];
+    for (const [key, info] of this._created) {
+      if (!info.committed) {
+        results.push({
+          key,
+          branch: info.branch,
+          committed: false,
+          clean: true,
+          merged: false,
+          conflicts: [],
+          note: "no changes to merge",
+        });
+        continue;
+      }
+      let preview;
+      try {
+        preview = _deps.previewWorktreeMerge(this.repoDir, info.branch);
+      } catch (err) {
+        results.push({
+          key,
+          branch: info.branch,
+          committed: true,
+          clean: false,
+          merged: false,
+          conflicts: [],
+          error: err.message,
+        });
+        continue;
+      }
+      const clean = preview?.success === true;
+      const conflicts = preview?.conflicts || [];
+      let merged = false;
+      if (clean && merge) {
+        // mergeWorktree does NOT throw on a failed merge — it catches internally
+        // and RETURNS {success:false, conflicts?, message} (a conflict the clean
+        // preview didn't predict, or any non-conflict git failure). The old
+        // try/catch was dead for that path and set merged:true unconditionally,
+        // reporting a real merge failure as success with empty conflicts. Inspect
+        // the return value. (The try still catches assertSafeGitRef, the only
+        // throw path — a malformed branch ref.)
+        let mergeResult;
+        try {
+          mergeResult = _deps.mergeWorktree(this.repoDir, info.branch, {
+            message: `Merge team task ${key}`,
+          });
+        } catch (err) {
+          mergeResult = { success: false, message: err.message };
+        }
+        if (mergeResult?.success === true) {
+          merged = true;
+        } else {
+          results.push({
+            key,
+            branch: info.branch,
+            committed: true,
+            clean: false,
+            merged: false,
+            conflicts: mergeResult?.conflicts?.length
+              ? mergeResult.conflicts
+              : conflicts,
+            error: `merge failed: ${mergeResult?.message || "unknown error"}`,
+          });
+          continue;
+        }
+      }
+      results.push({
+        key,
+        branch: info.branch,
+        committed: true,
+        clean,
+        merged,
+        conflicts,
+      });
+    }
+    return results;
+  }
+
+  /** Remove every worktree created for this run (branches left intact). */
+  cleanupAll({ deleteBranch = false } = {}) {
+    for (const [, info] of this._created) {
+      try {
+        _deps.removeWorktree(this.repoDir, info.path, { deleteBranch });
+      } catch {
+        /* best-effort */
+      }
+    }
+  }
+
+  branches() {
+    return Array.from(this._created.values()).map((i) => i.branch);
+  }
+}

package/src/lib/agents.js

@@ -22,6 +22,7 @@ import pathDefault from "node:path";
 import { homedir } from "node:os";
 import yaml from "js-yaml";
 import { projectRootBase } from "./project-root.cjs";
+import { discoverPluginAgentLayers } from "./plugin-runtime/agents.js";
 
 const _deps = { fs: fsDefault, path: pathDefault };
 
@@ -76,6 +77,23 @@ export function agentDirs(cwd = process.cwd(), opts = {}) {
     dirs.push({ dir: path.join(root, ".claude", "agents"), scope: "project" });
   }
   dirs.push({ dir: path.join(home, ".claude", "agents"), scope: "personal" });
+  // Installed-plugin agents (Phase 3.3h) — LOWEST precedence: appended last so
+  // that after discoverAgents' reverse() they are scanned FIRST and a user's own
+  // project/personal agent of the same name shadows them. Declarative (system
+  // prompt only), so not trust-gated. Best-effort: a discovery failure just
+  // contributes no plugin dirs.
+  if (opts.includePlugins !== false) {
+    try {
+      for (const layer of discoverPluginAgentLayers({
+        cwd,
+        scopes: opts.scopes,
+      })) {
+        dirs.push({ dir: layer.dir, scope: "plugin" });
+      }
+    } catch {
+      /* best-effort — plugin discovery never breaks core agent loading */
+    }
+  }
   return dirs;
 }
 

package/src/lib/async-hook-supervisor.cjs

@@ -0,0 +1,391 @@
+"use strict";
+
+/**
+ * async-hook-supervisor — run `async: true` settings hooks FIRE-AND-FORGET so a
+ * long-running hook (a test suite, a log scan, an external status probe) never
+ * blocks the agent's tool chain. The sync path (hook-runner.cjs `runHooks`) uses
+ * `spawnSync` and gates the turn; this path uses `spawn` and returns
+ * immediately, collecting each hook's result in the background.
+ *
+ * Two consumption modes on the collected results:
+ *   - drainResults()  → every completed hook since the last drain, injected into
+ *                       the NEXT turn's additionalContext (like the monitor
+ *                       supervisor). Cleared on read.
+ *   - drainRewakes()  → the subset whose hook set `asyncRewake: true` AND that
+ *                       finished in a FAILURE state (non-zero / blocked /
+ *                       timed-out). A pending rewake is the signal to proactively
+ *                       re-engage the agent with the structured error, rather
+ *                       than waiting for the user's next prompt.
+ *
+ * Guardrails (parity with PluginMonitorSupervisor, and the Phase 6 acceptance
+ * "高频文件写入不会造成无限 Hook 并发"):
+ *   - per-(event+command) dedupe while a prior run of the same hook is still in
+ *     flight — a rapid PostToolUse hook can't stack N copies of itself;
+ *   - a maxConcurrent cap — overflow is DROPPED with a recorded skip, never
+ *     queued unbounded;
+ *   - a per-hook timeout that TREE-kills the child (shell + the real command it
+ *     spawned — a bare child.kill would orphan the grandchild);
+ *   - tree-reaping of every child on stopAll() / process 'exit', so a session
+ *     never leaves an orphan hook process.
+ *
+ * `_deps.spawn` / `_deps.now` are injected so the whole supervisor is unit-
+ * testable with fake child processes (no real shell).
+ */
+
+const cpDefault = require("node:child_process");
+const { tryParseDecision } = require("./hook-runner.cjs");
+
+const DEFAULT_TIMEOUT_MS = 60000;
+const MAX_TIMEOUT_MS = 600000;
+const DEFAULT_MAX_CONCURRENT = 4;
+// Ring cap on undrained records (parity with PluginMonitorSupervisor's
+// OUTPUT_RING): drainResults()/drainRewakes() normally clear each turn, but a
+// stalled/absent drain over a high-frequency hook would otherwise grow these
+// arrays without bound. Keep only the most recent RESULT_RING; older records
+// are dropped oldest-first.
+const RESULT_RING = 500;
+
+class AsyncHookSupervisor {
+  constructor(opts = {}) {
+    this.maxConcurrent =
+      Number(opts.maxConcurrent) > 0
+        ? Number(opts.maxConcurrent)
+        : DEFAULT_MAX_CONCURRENT;
+    this._deps = {
+      spawn: opts.spawn || cpDefault.spawn,
+      spawnSync: opts.spawnSync || cpDefault.spawnSync,
+      now: opts.now || (() => Date.now()),
+    };
+    this._running = new Map(); // key -> { child, timer }
+    this._results = []; // completed records awaiting drainResults()
+    this._rewakes = []; // failed asyncRewake records awaiting drainRewakes()
+    this._stopped = false;
+    // The exit reaper is installed LAZILY (on first spawn), not in the ctor:
+    // a supervisor that never dispatches a hook (or the many built in tests)
+    // must not leave a permanent `process.once('exit')` listener behind —
+    // that accumulates across sessions/instances into a MaxListenersExceeded
+    // leak. Mirrors PluginMonitorSupervisor._installExitHook.
+    this._exitHook = () => this.stopAll();
+    this._exitHookInstalled = false;
+  }
+
+  _key(hook) {
+    return `${hook.event || ""}::${hook.command}`;
+  }
+
+  /**
+   * Kill a hook child's WHOLE process tree. Hooks run with `shell: true`, so the
+   * real command is a grandchild of the shell — a plain `child.kill()` only
+   * signals the shell (POSIX: reparents + keeps the command running; Windows:
+   * killing cmd.exe never touches its children), orphaning the actual hook
+   * process. POSIX: the child is spawned detached (its own group), so a negative
+   * pid signals the whole group. Windows: `taskkill /T` walks the tree. Both are
+   * SYNCHRONOUS (spawnSync / process.kill) so this is safe inside stopAll() and
+   * the process 'exit' reaper, where async work would be cut off. A child with no
+   * real pid (the unit-test fakes) falls back to its own `.kill()`.
+   */
+  _killChildTree(child, signal = "SIGTERM") {
+    if (!child) return;
+    const pid = child.pid;
+    if (typeof pid !== "number" || pid <= 0) {
+      try {
+        child.kill(signal);
+      } catch {
+        /* already gone / fake with no kill */
+      }
+      return;
+    }
+    try {
+      if (process.platform === "win32") {
+        const r = this._deps.spawnSync(
+          "taskkill",
+          ["/pid", String(pid), "/T", "/F"],
+          { windowsHide: true },
+        );
+        // If taskkill couldn't launch, fall back to a direct kill.
+        if (r && r.error) child.kill(signal);
+      } else {
+        // Negative pid → the whole process group (requires the detached spawn).
+        try {
+          process.kill(-pid, signal);
+        } catch {
+          child.kill(signal);
+        }
+      }
+    } catch {
+      try {
+        child.kill(signal);
+      } catch {
+        /* already gone */
+      }
+    }
+  }
+
+  /** Install the process-exit reaper exactly once, only when a child exists. */
+  _installExitHook() {
+    if (this._exitHookInstalled) return;
+    this._exitHookInstalled = true;
+    process.once("exit", this._exitHook);
+  }
+
+  /** Append a result record, bounded to the most recent RESULT_RING. */
+  _pushResult(rec) {
+    this._results.push(rec);
+    if (this._results.length > RESULT_RING) this._results.shift();
+  }
+
+  /**
+   * Dispatch a batch of async hooks fire-and-forget. Returns IMMEDIATELY with a
+   * per-hook disposition (`{command, dispatched, reason?}`) — it never awaits a
+   * hook. `payload` is JSON-written to each hook's stdin (same protocol as the
+   * sync runner).
+   *
+   * @param {Array<{command:string, event?:string, timeout?:number,
+   *                asyncRewake?:boolean}>} hooks
+   * @param {object} payload   the hook event payload (hook_event_name, …)
+   * @param {object} [opts]    { cwd, timeout }  (per-hook timeout wins)
+   */
+  dispatch(hooks, payload = {}, opts = {}) {
+    const dispositions = [];
+    for (const hook of hooks || []) {
+      if (!hook || !hook.command) continue;
+      if (this._stopped) {
+        dispositions.push({
+          command: hook.command,
+          dispatched: false,
+          reason: "supervisor stopped",
+        });
+        continue;
+      }
+      const key = this._key(hook);
+      if (this._running.has(key)) {
+        dispositions.push({
+          command: hook.command,
+          dispatched: false,
+          reason: "already running (deduped)",
+        });
+        continue;
+      }
+      if (this._running.size >= this.maxConcurrent) {
+        dispositions.push({
+          command: hook.command,
+          dispatched: false,
+          reason: "max concurrent reached",
+        });
+        // Record the skip so the caller/agent can SEE that a hook was dropped
+        // (silent truncation would read as "the hook ran and said nothing").
+        this._pushResult({
+          command: hook.command,
+          event: hook.event || null,
+          ok: false,
+          skipped: true,
+          exitCode: null,
+          error: "async hook skipped: max concurrent reached",
+          additionalContext: null,
+          blocked: false,
+          ts: this._deps.now(),
+          ms: 0,
+        });
+        continue;
+      }
+      this._spawnOne(hook, payload, opts);
+      dispositions.push({ command: hook.command, dispatched: true });
+    }
+    return dispositions;
+  }
+
+  _spawnOne(hook, payload, opts) {
+    // A live child now exists — arm the exit reaper so a session never leaves
+    // an orphan hook process (installed once, only from here).
+    this._installExitHook();
+    const key = this._key(hook);
+    const started = this._deps.now();
+    const rawTimeout = Number(
+      hook.timeout != null ? hook.timeout * 1000 : opts.timeout,
+    );
+    const timeout =
+      Number.isFinite(rawTimeout) && rawTimeout > 0
+        ? Math.min(rawTimeout, MAX_TIMEOUT_MS)
+        : DEFAULT_TIMEOUT_MS;
+
+    let child;
+    try {
+      child = this._deps.spawn(hook.command, {
+        cwd: opts.cwd || process.cwd(),
+        shell: true,
+        // POSIX: own process group so a timeout / stopAll can signal the whole
+        // tree (shell + the real hook command), not just the shell wrapper.
+        // No-op on Windows, where the tree is reaped via `taskkill /T` instead.
+        detached: process.platform !== "win32",
+        env: {
+          ...process.env,
+          CLAUDE_HOOK_EVENT: hook.event || payload.hook_event_name || "",
+        },
+      });
+    } catch (err) {
+      this._record(hook, {
+        ok: false,
+        exitCode: null,
+        error: `hook spawn failed: ${err.message}`,
+        started,
+      });
+      return;
+    }
+
+    let out = "";
+    let errOut = "";
+    let killedByTimeout = false;
+    const rec = { child, timer: null };
+    this._running.set(key, rec);
+
+    try {
+      // `.end(data)` flushes ASYNCHRONOUSLY: if the hook exited before consuming
+      // stdin (a fast command), the write fails with an async EPIPE emitted as an
+      // 'error' event on the stream — NOT a sync throw this catch can see. With no
+      // listener that becomes an uncaught exception that crashes the process (seen
+      // on Linux CI). Attach a no-op error handler first so a closed-stdin write
+      // is swallowed as the non-fatal condition it is.
+      child.stdin?.on("error", () => {});
+      child.stdin?.end(JSON.stringify(payload));
+    } catch {
+      /* stdin may already be closed — non-fatal */
+    }
+    child.stdout?.on("data", (d) => {
+      out += d.toString("utf8");
+    });
+    child.stderr?.on("data", (d) => {
+      errOut += d.toString("utf8");
+    });
+
+    const timer = setTimeout(() => {
+      killedByTimeout = true;
+      // Tree-kill: a hook that spawned a subprocess (e.g. `npm test`) must not
+      // leave that subprocess orphaned when it exceeds its timeout.
+      this._killChildTree(child, "SIGTERM");
+    }, timeout);
+    if (typeof timer.unref === "function") timer.unref();
+    rec.timer = timer;
+
+    let settled = false;
+    const finalize = (exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      this._running.delete(key);
+      const parsed = tryParseDecision(out);
+      const blocked = !!(parsed && parsed.decision === "block");
+      const ok = !killedByTimeout && exitCode === 0 && !blocked;
+      const additionalContext =
+        (parsed && parsed.additionalContext) ||
+        (exitCode === 0 && out.trim() && out.trim()[0] !== "{"
+          ? out.trim()
+          : null);
+      this._record(hook, {
+        ok,
+        exitCode,
+        started,
+        blocked,
+        additionalContext,
+        error: killedByTimeout
+          ? `timed out after ${timeout}ms`
+          : ok
+            ? null
+            : errOut.trim() ||
+              (blocked
+                ? parsed.reason || "hook requested block"
+                : `hook exited ${exitCode}`),
+      });
+    };
+
+    child.on("error", (e) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      this._running.delete(key);
+      this._record(hook, {
+        ok: false,
+        exitCode: null,
+        error: `hook error: ${e.message}`,
+        started,
+      });
+    });
+    child.on("close", (code) => finalize(code));
+  }
+
+  _record(hook, fields) {
+    const now = this._deps.now();
+    const rec = {
+      command: hook.command,
+      event: hook.event || null,
+      ok: fields.ok === true,
+      exitCode: fields.exitCode ?? null,
+      error: fields.error || null,
+      additionalContext: fields.additionalContext || null,
+      blocked: !!fields.blocked,
+      asyncRewake: hook.asyncRewake === true,
+      ts: now,
+      ms: fields.started != null ? now - fields.started : 0,
+    };
+    this._pushResult(rec);
+    // A rewake fires only for a hook that OPTED IN and finished in a failure
+    // state — a passing async check should not re-engage the agent.
+    if (hook.asyncRewake && !rec.ok) {
+      this._rewakes.push(rec);
+      if (this._rewakes.length > RESULT_RING) this._rewakes.shift();
+    }
+  }
+
+  /** Completed result records since the last drain (cleared on read). */
+  drainResults() {
+    const r = this._results;
+    this._results = [];
+    return r;
+  }
+
+  peekResults() {
+    return this._results.slice();
+  }
+
+  /** Failed asyncRewake records since the last drain (cleared on read). */
+  drainRewakes() {
+    const r = this._rewakes;
+    this._rewakes = [];
+    return r;
+  }
+
+  hasRewake() {
+    return this._rewakes.length > 0;
+  }
+
+  runningCount() {
+    return this._running.size;
+  }
+
+  /** Kill every in-flight hook and detach the exit reaper. Idempotent. */
+  stopAll() {
+    this._stopped = true;
+    for (const [key, rec] of this._running) {
+      try {
+        clearTimeout(rec.timer);
+      } catch {
+        /* ignore */
+      }
+      // Tree-kill (not a bare child.kill) so a session end / process exit never
+      // leaves an orphaned hook subprocess — the guarantee this class documents.
+      this._killChildTree(rec.child, "SIGTERM");
+      this._running.delete(key);
+    }
+    try {
+      process.removeListener("exit", this._exitHook);
+    } catch {
+      /* ignore */
+    }
+    this._exitHookInstalled = false;
+  }
+}
+
+module.exports = {
+  AsyncHookSupervisor,
+  DEFAULT_TIMEOUT_MS,
+  DEFAULT_MAX_CONCURRENT,
+};

package/src/lib/audit-logger.js

@@ -5,6 +5,7 @@
 
 import crypto from "crypto";
 import { safeJsonParse } from "./safe-json.js";
+import { escapeLike } from "./sql-like.js";
 
 /**
  * Event types for audit logging.
@@ -183,13 +184,13 @@ export function queryLogs(db, filters = {}) {
   }
 
   if (filters.operation) {
-    sql += " AND operation LIKE ?";
-    params.push(`%${filters.operation}%`);
+    sql += " AND operation LIKE ? ESCAPE '\\'";
+    params.push(`%${escapeLike(filters.operation)}%`);
   }
 
   if (filters.actor) {
-    sql += " AND actor LIKE ?";
-    params.push(`%${filters.actor}%`);
+    sql += " AND actor LIKE ? ESCAPE '\\'";
+    params.push(`%${escapeLike(filters.actor)}%`);
   }
 
   if (filters.riskLevel) {
@@ -214,8 +215,8 @@ export function queryLogs(db, filters = {}) {
 
   if (filters.search) {
     // Search in operation field (primary search field for CLI)
-    sql += " AND operation LIKE ?";
-    params.push(`%${filters.search}%`);
+    sql += " AND operation LIKE ? ESCAPE '\\'";
+    params.push(`%${escapeLike(filters.search)}%`);
   }
 
   sql += " ORDER BY created_at DESC";