chainlesschain 0.162.179 → 0.162.181

package/src/lib/cowork-cron.js

@@ -30,7 +30,14 @@
  */
 
 import crypto from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
 import { join } from "node:path";
 import { withFileLock } from "./with-file-lock.js";
 
@@ -38,7 +45,10 @@ export const _deps = {
   existsSync,
   mkdirSync,
   readFileSync,
+  renameSync,
+  unlinkSync,
   writeFileSync,
+  withFileLock,
   now: () => new Date(),
   runTask: null, // injected at runtime to avoid circular import
 };
@@ -225,7 +235,7 @@ function _scheduleFile(cwd) {
 }
 
 /** Load all schedules from disk. Returns [] if the file doesn't exist. */
-export function loadSchedules(cwd) {
+export function loadSchedules(cwd, { failOnMalformed = false } = {}) {
   const file = _scheduleFile(cwd);
   if (!_deps.existsSync(file)) return [];
   const raw = _deps.readFileSync(file, "utf-8");
@@ -235,20 +245,57 @@ export function loadSchedules(cwd) {
     if (!trimmed) continue;
     try {
       out.push(JSON.parse(trimmed));
-    } catch (_e) {
-      // Skip malformed lines — don't let one bad record break the rest
+    } catch (cause) {
+      if (failOnMalformed) {
+        const error = new Error(
+          `cowork schedule store contains malformed JSON: ${file}`,
+          { cause },
+        );
+        error.code = "COWORK_SCHEDULE_STORE_CORRUPT";
+        throw error;
+      }
+      // Advisory readers can still display the remaining valid records.
     }
   }
   return out;
 }
 
-/** Write the full schedule list back to disk, overwriting. */
-export function saveSchedules(cwd, schedules) {
+function _prepareScheduleDir(cwd) {
   const dir = join(cwd, ".chainlesschain", "cowork");
   _deps.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+function _saveSchedulesUnlocked(cwd, schedules) {
+  _prepareScheduleDir(cwd);
   const file = _scheduleFile(cwd);
   const body = schedules.map((s) => JSON.stringify(s)).join("\n");
-  _deps.writeFileSync(file, body ? body + "\n" : "", "utf-8");
+  const tmp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  try {
+    _deps.writeFileSync(tmp, body ? body + "\n" : "", "utf-8");
+    _deps.renameSync(tmp, file);
+  } catch (error) {
+    try {
+      _deps.unlinkSync(tmp);
+    } catch {
+      // Preserve the original persistence error.
+    }
+    throw error;
+  }
+}
+
+function _withScheduleLock(cwd, body) {
+  _prepareScheduleDir(cwd);
+  return _deps.withFileLock(_scheduleFile(cwd), body, {
+    failIfUnavailable: true,
+  });
+}
+
+/** Atomically replace the full schedule list under a fail-closed lock. */
+export function saveSchedules(cwd, schedules) {
+  return _withScheduleLock(cwd, () =>
+    _saveSchedulesUnlocked(cwd, schedules),
+  );
 }
 
 // ─── CRUD ────────────────────────────────────────────────────────────────────
@@ -263,8 +310,8 @@ export function addSchedule(cwd, input) {
 
   // Serialize the read-modify-write across processes (cc+cc / cc+desktop share
   // the cowork dir) so concurrently-added schedules don't clobber each other.
-  return withFileLock(_scheduleFile(cwd), () => {
-    const schedules = loadSchedules(cwd);
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
     const entry = {
       id: `sch-${crypto.randomUUID().slice(0, 12)}`,
       cron: cron.trim(),
@@ -277,41 +324,146 @@ export function addSchedule(cwd, input) {
       lastStatus: null,
     };
     schedules.push(entry);
-    saveSchedules(cwd, schedules);
+    _saveSchedulesUnlocked(cwd, schedules);
     return entry;
   });
 }
 
 export function removeSchedule(cwd, id) {
-  return withFileLock(_scheduleFile(cwd), () => {
-    const schedules = loadSchedules(cwd);
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
     const idx = schedules.findIndex((s) => s.id === id);
     if (idx === -1) return false;
     schedules.splice(idx, 1);
-    saveSchedules(cwd, schedules);
+    _saveSchedulesUnlocked(cwd, schedules);
     return true;
   });
 }
 
 export function setScheduleEnabled(cwd, id, enabled) {
-  return withFileLock(_scheduleFile(cwd), () => {
-    const schedules = loadSchedules(cwd);
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
     const s = schedules.find((x) => x.id === id);
     if (!s) return false;
     s.enabled = !!enabled;
-    saveSchedules(cwd, schedules);
+    _saveSchedulesUnlocked(cwd, schedules);
     return true;
   });
 }
 
 export function updateScheduleRunState(cwd, id, { lastRunAt, lastStatus }) {
-  return withFileLock(_scheduleFile(cwd), () => {
-    const schedules = loadSchedules(cwd);
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
     const s = schedules.find((x) => x.id === id);
     if (!s) return false;
     if (lastRunAt) s.lastRunAt = lastRunAt;
     if (lastStatus) s.lastStatus = lastStatus;
-    saveSchedules(cwd, schedules);
+    _saveSchedulesUnlocked(cwd, schedules);
+    return true;
+  });
+}
+
+/**
+ * Claim one concrete cron fire before launching its side effect. The persisted
+ * delivery id prevents two scheduler processes from running the same fire; an
+ * expired claim can be recovered after a crashed owner.
+ */
+export function claimScheduleFire(
+  cwd,
+  id,
+  deliveryId,
+  { ownerId, now = _deps.now(), leaseMs = 120_000 } = {},
+) {
+  if (!ownerId || !deliveryId) {
+    throw new Error("claimScheduleFire requires ownerId and deliveryId");
+  }
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
+    const schedule = schedules.find((entry) => entry.id === id);
+    if (!schedule) return null;
+    if (schedule.lastDeliveryId === deliveryId) return null;
+
+    const nowMs = now.getTime();
+    const active = schedule.activeDelivery;
+    const expiresAt = Date.parse(active?.leaseExpiresAt || "");
+    if (active && Number.isFinite(expiresAt) && expiresAt > nowMs) {
+      return null;
+    }
+
+    const fence =
+      Math.max(
+        Number(schedule.deliveryFence) || 0,
+        Number(active?.fence) || 0,
+      ) + 1;
+    const claim = {
+      deliveryId,
+      ownerId,
+      fence,
+      claimedAt: now.toISOString(),
+      leaseExpiresAt: new Date(nowMs + Math.max(1000, leaseMs)).toISOString(),
+    };
+    schedule.deliveryFence = fence;
+    schedule.activeDelivery = claim;
+    _saveSchedulesUnlocked(cwd, schedules);
+    return { ...claim };
+  });
+}
+
+/** Renew a live claim. A stale owner can never renew after its fence is stolen. */
+export function renewScheduleFire(
+  cwd,
+  id,
+  claim,
+  { now = _deps.now(), leaseMs = 120_000 } = {},
+) {
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
+    const schedule = schedules.find((entry) => entry.id === id);
+    const active = schedule?.activeDelivery;
+    if (
+      !active ||
+      active.deliveryId !== claim?.deliveryId ||
+      active.ownerId !== claim?.ownerId ||
+      active.fence !== claim?.fence
+    ) {
+      return false;
+    }
+    active.leaseExpiresAt = new Date(
+      now.getTime() + Math.max(1000, leaseMs),
+    ).toISOString();
+    _saveSchedulesUnlocked(cwd, schedules);
+    return true;
+  });
+}
+
+/**
+ * Commit the delivery outcome only when the owner/fence still matches. This is
+ * the scheduler equivalent of compare-and-swap: a late crashed owner cannot
+ * overwrite the successor's task state.
+ */
+export function settleScheduleFire(
+  cwd,
+  id,
+  claim,
+  { lastRunAt, lastStatus } = {},
+) {
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
+    const schedule = schedules.find((entry) => entry.id === id);
+    const active = schedule?.activeDelivery;
+    if (
+      !active ||
+      active.deliveryId !== claim?.deliveryId ||
+      active.ownerId !== claim?.ownerId ||
+      active.fence !== claim?.fence
+    ) {
+      return false;
+    }
+    schedule.lastDeliveryId = claim.deliveryId;
+    schedule.lastRunAt = lastRunAt || _deps.now().toISOString();
+    schedule.lastStatus = lastStatus || "completed";
+    schedule.activeDelivery = null;
+    _saveSchedulesUnlocked(cwd, schedules);
     return true;
   });
 }
@@ -329,6 +481,10 @@ export class CoworkCronScheduler {
     this._intervalPinned = typeof options.intervalMs === "number";
     this.intervalMs = options.intervalMs || 60_000;
     this.onEvent = options.onEvent || null; // (event) => void
+    this.ownerId =
+      options.ownerId ||
+      `cowork-cron:${process.pid}:${crypto.randomUUID().slice(0, 12)}`;
+    this.leaseMs = Math.max(1000, Number(options.leaseMs) || 120_000);
     this._timer = null;
     this._firedKeys = new Set();
     this._running = new Set();
@@ -416,9 +572,27 @@ export class CoworkCronScheduler {
       const isDue = matcher(now);
       if (!isDue) continue;
 
+      let claim;
+      try {
+        claim = claimScheduleFire(this.cwd, s.id, fireKey, {
+          ownerId: this.ownerId,
+          now,
+          leaseMs: this.leaseMs,
+        });
+      } catch (err) {
+        this._emit({
+          type: "schedule-claim-failed",
+          id: s.id,
+          deliveryId: fireKey,
+          error: err.message,
+        });
+        continue;
+      }
+
       this._firedKeys.add(fireKey);
+      if (!claim) continue;
       this._running.add(s.id);
-      this._runSchedule(s).finally(() => {
+      this._runSchedule(s, claim).finally(() => {
         this._running.delete(s.id);
       });
     }
@@ -429,12 +603,25 @@ export class CoworkCronScheduler {
     }
   }
 
-  async _runSchedule(schedule) {
+  async _runSchedule(schedule, claim) {
     const runTask = _deps.runTask;
     if (typeof runTask !== "function") {
+      try {
+        settleScheduleFire(this.cwd, schedule.id, claim, {
+          lastStatus: "failed",
+        });
+      } catch (err) {
+        this._emit({
+          type: "schedule-settlement-failed",
+          id: schedule.id,
+          deliveryId: claim.deliveryId,
+          error: err.message,
+        });
+      }
       this._emit({
         type: "run-error",
         id: schedule.id,
+        deliveryId: claim.deliveryId,
         error: "runTask not injected",
       });
       return;
@@ -444,35 +631,90 @@ export class CoworkCronScheduler {
       id: schedule.id,
       cron: schedule.cron,
       templateId: schedule.templateId,
+      deliveryId: claim.deliveryId,
     });
+
+    const renewal = setInterval(() => {
+      try {
+        const renewed = renewScheduleFire(this.cwd, schedule.id, claim, {
+          leaseMs: this.leaseMs,
+        });
+        if (!renewed) {
+          this._emit({
+            type: "schedule-lease-lost",
+            id: schedule.id,
+            deliveryId: claim.deliveryId,
+          });
+        }
+      } catch (err) {
+        this._emit({
+          type: "schedule-lease-renewal-failed",
+          id: schedule.id,
+          deliveryId: claim.deliveryId,
+          error: err.message,
+        });
+      }
+    }, Math.max(1000, Math.floor(this.leaseMs / 3)));
+    renewal.unref?.();
+
+    let result = null;
+    let failure = null;
     try {
-      const result = await runTask({
+      result = await runTask({
         templateId: schedule.templateId,
         userMessage: schedule.userMessage,
         files: schedule.files,
         cwd: this.cwd,
+        scheduleId: schedule.id,
+        deliveryId: claim.deliveryId,
       });
-      updateScheduleRunState(this.cwd, schedule.id, {
+    } catch (err) {
+      failure = err;
+    } finally {
+      clearInterval(renewal);
+    }
+
+    let settled;
+    try {
+      settled = settleScheduleFire(this.cwd, schedule.id, claim, {
         lastRunAt: _deps.now().toISOString(),
-        lastStatus: result?.status || "completed",
+        lastStatus: failure ? "failed" : result?.status || "completed",
       });
+    } catch (err) {
       this._emit({
-        type: "schedule-completed",
+        type: "schedule-settlement-failed",
         id: schedule.id,
-        taskId: result?.taskId,
-        status: result?.status,
+        deliveryId: claim.deliveryId,
+        error: err.message,
       });
-    } catch (err) {
-      updateScheduleRunState(this.cwd, schedule.id, {
-        lastRunAt: _deps.now().toISOString(),
-        lastStatus: "failed",
+      return;
+    }
+    if (!settled) {
+      this._emit({
+        type: "schedule-settlement-rejected",
+        id: schedule.id,
+        deliveryId: claim.deliveryId,
       });
+      return;
+    }
+
+    if (failure) {
       this._emit({
         type: "schedule-failed",
         id: schedule.id,
-        error: err.message,
+        deliveryId: claim.deliveryId,
+        error: failure.message,
       });
+      return;
     }
+
+    this._emit({
+      type: "schedule-completed",
+      id: schedule.id,
+      deliveryId: claim.deliveryId,
+      taskId: result?.taskId,
+      status: result?.status,
+    });
   }
 }
 

package/src/lib/cross-chain-mtc.js

@@ -536,11 +536,12 @@ export function closeBatch(dir, opts = {}) {
   // Serialize the whole staging-scan → batch-write → staging-cleanup section
   // across processes. Without it, two concurrent closes both read the same
   // staged ops, allocate the same per-pair sequence (namespace collision), and
-  // batch the same ops twice before clearing staging. Best-effort lock (never
-  // hangs); generous timeout since the section includes batch assembly+signing.
+  // batch the same ops twice before clearing staging. Ledger state is critical:
+  // bounded contention must fail closed rather than assemble an unlocked batch.
   ensureDirs(dir);
   return withFileLock(batchesDir(dir), () => _closeBatchImpl(dir, opts), {
     timeoutMs: 15000,
+    failIfUnavailable: true,
   });
 }
 

package/src/lib/durable-security-store.js

@@ -0,0 +1,124 @@
+/**
+ * Crash-safe, fail-closed persistence for security metadata.
+ *
+ * Trust, consent and credential references are durable security decisions
+ * shared by every CLI process. A plain read-modify-write can silently lose a
+ * grant or a revocation, while treating a corrupt file as an empty object can
+ * overwrite the only evidence that the store is unavailable. This helper
+ * keeps the entire mutation under the canonical cross-process lock and
+ * replaces the JSON file atomically.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { withFileLock } from "./with-file-lock.js";
+
+function storeError(label, operation, filePath, cause) {
+  const detail = cause?.message || String(cause || "unknown error");
+  const error = new Error(
+    `${label} store ${operation} failed (${filePath}): ${detail}`,
+    { cause },
+  );
+  error.name = "DurableSecurityStoreError";
+  error.code = `DURABLE_SECURITY_STORE_${operation.toUpperCase()}_FAILED`;
+  error.filePath = filePath;
+  return error;
+}
+
+export function readSecurityStore(filePath, label) {
+  let serialized;
+  try {
+    serialized = fs.readFileSync(filePath, "utf8");
+  } catch (cause) {
+    if (cause?.code === "ENOENT") return {};
+    throw storeError(label, "read", filePath, cause);
+  }
+
+  try {
+    const parsed = JSON.parse(serialized);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new TypeError("top-level value must be an object");
+    }
+    return parsed;
+  } catch (cause) {
+    throw storeError(label, "corrupt", filePath, cause);
+  }
+}
+
+export function writeSecurityStore(filePath, label, store) {
+  const directory = path.dirname(filePath);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const temporaryPath = path.join(
+    directory,
+    `.${path.basename(filePath)}.${process.pid}.${crypto.randomUUID()}.tmp`,
+  );
+  let descriptor = null;
+  let renamed = false;
+
+  try {
+    descriptor = fs.openSync(temporaryPath, "wx", 0o600);
+    fs.writeFileSync(
+      descriptor,
+      `${JSON.stringify(store, null, 2)}\n`,
+      "utf8",
+    );
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = null;
+    fs.renameSync(temporaryPath, filePath);
+    renamed = true;
+
+    if (process.platform !== "win32") {
+      const directoryDescriptor = fs.openSync(directory, "r");
+      try {
+        fs.fsyncSync(directoryDescriptor);
+      } finally {
+        fs.closeSync(directoryDescriptor);
+      }
+    }
+  } catch (cause) {
+    if (descriptor != null) {
+      try {
+        fs.closeSync(descriptor);
+      } catch {
+        // Preserve the original persistence error.
+      }
+    }
+    if (!renamed) {
+      try {
+        fs.unlinkSync(temporaryPath);
+      } catch {
+        // Best-effort orphan cleanup.
+      }
+    }
+    throw storeError(label, "write", filePath, cause);
+  }
+}
+
+export function mutateSecurityStore(
+  filePath,
+  label,
+  mutator,
+  { lock = withFileLock, timeoutMs = 2000, staleMs = 30000 } = {},
+) {
+  // withFileLock expects the target's parent to exist. Directory creation is
+  // idempotent and safe outside the critical section.
+  try {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  } catch (cause) {
+    throw storeError(label, "prepare", filePath, cause);
+  }
+
+  return lock(
+    filePath,
+    () => {
+      const current = readSecurityStore(filePath, label);
+      const draft = structuredClone(current);
+      const result = mutator(draft);
+      writeSecurityStore(filePath, label, draft);
+      return result;
+    },
+    { timeoutMs, staleMs, failIfUnavailable: true },
+  );
+}

package/src/lib/event-runtime-host.js

@@ -35,12 +35,24 @@ export class EventRuntimeHost extends EventEmitter {
     worker = null,
     setTimeoutFn = setTimeout,
     clearTimeoutFn = clearTimeout,
+    id = store.owner,
+    role = process.env.CC_EVENT_RUNTIME_HOST_ROLE || "cli",
+    pid = process.pid,
+    heartbeatStaleMs = null,
   } = {}) {
     super();
     this.store = store;
     this.intervalMs = Math.max(1, Number(intervalMs) || 1000);
     this.setTimeoutFn = setTimeoutFn;
     this.clearTimeoutFn = clearTimeoutFn;
+    this.id = String(id || store.owner || `${process.pid}`);
+    this.role = String(role || "cli");
+    this.pid = Number.isFinite(Number(pid)) ? Number(pid) : null;
+    this.startedAt = null;
+    this.heartbeatStaleMs =
+      heartbeatStaleMs == null
+        ? Math.max(5000, this.intervalMs * 3)
+        : Math.max(1, Number(heartbeatStaleMs) || 5000);
     this.handlers = new Map();
     this.running = false;
     this.timer = null;
@@ -58,6 +70,25 @@ export class EventRuntimeHost extends EventEmitter {
       });
   }
 
+  _reportHost(state, { stats = this.lastStats, error = this.lastError } = {}) {
+    if (typeof this.store.reportHost !== "function") return null;
+    try {
+      return this.store.reportHost({
+        id: this.id,
+        pid: this.pid,
+        role: this.role,
+        state,
+        startedAt: this.startedAt,
+        staleAfterMs: this.heartbeatStaleMs,
+        lastStats: stats,
+        lastError: error?.message || error || null,
+      });
+    } catch (reportError) {
+      this.emit("host-status-error", reportError);
+      return null;
+    }
+  }
+
   registerHandler(
     handler,
     { queue = "inbox", type = "*", origin = "*" } = {},
@@ -125,11 +156,13 @@ export class EventRuntimeHost extends EventEmitter {
       .then((stats) => {
         this.lastStats = stats;
         this.lastError = null;
+        this._reportHost("running", { stats, error: null });
         this.emit("tick", stats);
         return stats;
       })
       .catch((error) => {
         this.lastError = error;
+        this._reportHost("running", { error });
         this.emit("runtime-error", error);
         throw error;
       })
@@ -158,6 +191,8 @@ export class EventRuntimeHost extends EventEmitter {
   start({ immediate = true } = {}) {
     if (this.running) return false;
     this.running = true;
+    this.startedAt = Date.now();
+    this._reportHost("running", { stats: null, error: null });
     if (immediate) {
       void this.runOnce()
         .catch(() => {})
@@ -169,18 +204,42 @@ export class EventRuntimeHost extends EventEmitter {
     return true;
   }
 
-  async stop({ drain = true } = {}) {
+  async stop({ drain = true, maxDrainTicks = 10 } = {}) {
     const wasRunning = this.running;
     this.running = false;
     if (this.timer != null) {
       this.clearTimeoutFn(this.timer);
       this.timer = null;
     }
-    if (drain && this.inFlight) {
+    if (drain && (wasRunning || this.inFlight)) {
+      const maxTicks = Math.max(1, Number(maxDrainTicks) || 10);
+      for (let tick = 0; tick < maxTicks; tick += 1) {
+        let stats;
+        try {
+          stats = this.inFlight ? await this.inFlight : await this.runOnce();
+        } catch {
+          // Error already exposed through runtime-error/lastError. A later
+          // process can recover the durable records after the lease expires.
+          break;
+        }
+        const claimed =
+          Number(stats?.inboxClaimed || 0) +
+          Number(stats?.outboxClaimed || 0);
+        if (claimed === 0) break;
+      }
+    }
+    if (typeof this.store.stopHost === "function") {
       try {
-        await this.inFlight;
-      } catch {
-        // Error already exposed through runtime-error/lastError.
+        this.store.stopHost(this.id, {
+          pid: this.pid,
+          role: this.role,
+          startedAt: this.startedAt,
+          staleAfterMs: this.heartbeatStaleMs,
+          lastStats: this.lastStats,
+          lastError: this.lastError?.message || null,
+        });
+      } catch (reportError) {
+        this.emit("host-status-error", reportError);
       }
     }
     if (wasRunning) this.emit("stopped");
@@ -190,6 +249,9 @@ export class EventRuntimeHost extends EventEmitter {
   status() {
     return {
       running: this.running,
+      id: this.id,
+      role: this.role,
+      pid: this.pid,
       inFlight: this.inFlight != null,
       handlerRoutes: this.handlers.size,
       lastStats: this.lastStats,
@@ -222,4 +284,3 @@ export async function stopDefaultEventRuntimeHost(options) {
 export function _resetDefaultEventRuntimeHostForTests() {
   defaultHost = null;
 }
-