chainlesschain 0.162.197 → 0.162.198

package/src/lib/process-tree-termination.js

@@ -0,0 +1,253 @@
+import { executionBroker } from "./process-execution-broker/index.js";
+
+export const PROCESS_TREE_CLEANUP_MAX_MS = 2_000;
+export const PROCESS_TREE_GRACE_MAX_MS = 500;
+const TREE_MODES = new Set(["sandbox", "posix-group", "windows-tree"]);
+
+function boundedMilliseconds(value, fallback, maximum) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+  return Math.max(1, Math.min(maximum, Math.floor(parsed)));
+}
+
+function validChildPid(child) {
+  const pid = Number(child?.pid);
+  return Number.isInteger(pid) && pid > 0 && pid !== process.pid ? pid : null;
+}
+
+function childHasClosed(child, observedClose) {
+  return (
+    observedClose() ||
+    (child?.exitCode !== null && child?.exitCode !== undefined) ||
+    (child?.signalCode !== null && child?.signalCode !== undefined)
+  );
+}
+
+function posixGroupIsGone(pid, kill) {
+  try {
+    kill(-pid, 0);
+    return false;
+  } catch (error) {
+    return error?.code === "ESRCH";
+  }
+}
+
+function requestDirectSignal(child, signal) {
+  try {
+    return child?.kill?.(signal) !== false;
+  } catch {
+    return false;
+  }
+}
+
+function requestPosixGroupSignal(child, pid, signal, kill) {
+  try {
+    kill(-pid, signal);
+    return { requested: true, treeRequested: true };
+  } catch {
+    return {
+      requested: requestDirectSignal(child, signal),
+      treeRequested: false,
+    };
+  }
+}
+
+function requestWindowsTreeSignal(child, pid, force, spawnSync, timeoutMs) {
+  try {
+    const args = ["/PID", String(pid), "/T"];
+    if (force) args.push("/F");
+    const result = spawnSync("taskkill", args, {
+      shell: false,
+      windowsHide: true,
+      encoding: "utf8",
+      timeout: Math.max(1, timeoutMs),
+      origin: "process-tree:taskkill",
+      policy: "allow",
+      scope: "process-tree",
+    });
+    if (!result?.error && result?.status === 0) {
+      return { requested: true, treeRequested: true };
+    }
+  } catch {
+    // Fall through to the hard-phase fallback below.
+  }
+  // Never kill only the Windows root during the soft phase: doing so can
+  // orphan its descendants and make the later `/T /F` walk impossible.
+  if (!force) return { requested: false, treeRequested: false };
+  return {
+    requested: requestDirectSignal(child, "SIGKILL"),
+    treeRequested: false,
+  };
+}
+
+/**
+ * Retire one Broker-owned child tree inside a host-capped deadline.
+ *
+ * `treeMode` describes the ownership established at spawn time:
+ * - `sandbox`: a PID namespace / Windows Job close fence owns descendants;
+ * - `posix-group`: the child is the leader of a detached process group;
+ * - `windows-tree`: taskkill walks the live root's descendant tree.
+ *
+ * The function never throws and never treats a direct-child fallback as proof
+ * that descendants are gone. Callers can preserve their primary error while
+ * attaching the structured result, or fail closed on an unconfirmed explicit
+ * disconnect.
+ */
+export async function terminateOwnedProcessTree(child, options = {}) {
+  const platform = options.platform || process.platform;
+  const cleanupTimeoutMs = boundedMilliseconds(
+    options.cleanupTimeoutMs,
+    PROCESS_TREE_CLEANUP_MAX_MS,
+    PROCESS_TREE_CLEANUP_MAX_MS,
+  );
+  const graceMs = Math.min(
+    cleanupTimeoutMs,
+    boundedMilliseconds(options.graceMs, 250, PROCESS_TREE_GRACE_MAX_MS),
+  );
+  const now = options.now || Date.now;
+  const sleep =
+    options.sleep ||
+    ((milliseconds) =>
+      new Promise((resolve) => setTimeout(resolve, milliseconds)));
+  const kill = options.kill || process.kill.bind(process);
+  const spawnSync =
+    options.spawnSync || executionBroker.spawnSync.bind(executionBroker);
+  const pid = validChildPid(child);
+  const inferredTreeMode =
+    options.treeMode ||
+    (options.sandboxManagedTree === true
+      ? "sandbox"
+      : platform === "win32"
+        ? "windows-tree"
+        : "posix-group");
+  const treeMode = TREE_MODES.has(inferredTreeMode)
+    ? inferredTreeMode
+    : platform === "win32"
+      ? "windows-tree"
+      : "posix-group";
+  const startedAt = now();
+  const deadline = startedAt + cleanupTimeoutMs;
+  let closeObserved = options.alreadyClosed === true;
+  let softRequested = false;
+  let hardRequested = false;
+  let treeRequested = false;
+  let escalated = false;
+
+  const onClose = () => {
+    closeObserved = true;
+  };
+  child?.once?.("close", onClose);
+
+  const remaining = () => Math.max(0, deadline - now());
+  const closed = () => childHasClosed(child, () => closeObserved);
+  const treeGone = () => {
+    if (!pid) return false;
+    if (treeMode === "sandbox") return closed();
+    if (treeMode === "posix-group") return posixGroupIsGone(pid, kill);
+    return treeRequested;
+  };
+  const confirmed = () => closed() && treeGone();
+  const waitForConfirmation = async (maximumMs) => {
+    const phaseDeadline = Math.min(deadline, now() + Math.max(0, maximumMs));
+    while (!confirmed() && now() < phaseDeadline) {
+      await sleep(Math.max(1, Math.min(10, phaseDeadline - now())));
+    }
+    return confirmed();
+  };
+  const request = (force) => {
+    if (!pid) {
+      return {
+        requested: requestDirectSignal(child, force ? "SIGKILL" : "SIGTERM"),
+        treeRequested: false,
+      };
+    }
+    if (treeMode === "sandbox") {
+      return {
+        requested: requestDirectSignal(child, force ? "SIGKILL" : "SIGTERM"),
+        treeRequested: true,
+      };
+    }
+    if (treeMode === "windows-tree") {
+      return requestWindowsTreeSignal(
+        child,
+        pid,
+        force,
+        spawnSync,
+        remaining(),
+      );
+    }
+    return requestPosixGroupSignal(
+      child,
+      pid,
+      force ? "SIGKILL" : "SIGTERM",
+      kill,
+    );
+  };
+
+  try {
+    if (!pid) {
+      // Test doubles and partial spawn failures have no verifiable tree
+      // identity. Preserve legacy best-effort direct-child cleanup without
+      // upgrading it to a whole-tree claim.
+      const attempt = request(true);
+      hardRequested = attempt.requested;
+      return {
+        pid: null,
+        treeMode,
+        verifiable: false,
+        softRequested,
+        hardRequested,
+        treeRequested: false,
+        escalated: true,
+        closed: closed(),
+        treeTerminated: false,
+        confirmed: false,
+        deadlineExceeded: false,
+        elapsedMs: Math.max(0, now() - startedAt),
+      };
+    }
+
+    // A managed sandbox close fence already proves its namespace/job is empty.
+    // A closed unmanaged POSIX root does not: descendants in the owned group
+    // must still be signalled and probed.
+    if (treeMode === "sandbox" && closed()) {
+      treeRequested = true;
+    } else if (!closed()) {
+      try {
+        child?.stdin?.end?.();
+      } catch {
+        // EOF is only an additional graceful hint; SIGTERM remains authoritative.
+      }
+      const attempt = request(false);
+      softRequested = attempt.requested;
+      treeRequested ||= attempt.treeRequested;
+      await waitForConfirmation(graceMs);
+    }
+
+    if (!confirmed()) {
+      escalated = true;
+      const attempt = request(true);
+      hardRequested = attempt.requested;
+      treeRequested ||= attempt.treeRequested;
+      if (remaining() > 0) await waitForConfirmation(remaining());
+    }
+
+    const didConfirm = confirmed();
+    return {
+      pid,
+      treeMode,
+      verifiable: true,
+      softRequested,
+      hardRequested,
+      treeRequested,
+      escalated,
+      closed: closed(),
+      treeTerminated: treeGone(),
+      confirmed: didConfirm,
+      deadlineExceeded: !didConfirm && remaining() === 0,
+      elapsedMs: Math.max(0, now() - startedAt),
+    };
+  } finally {
+    child?.removeListener?.("close", onClose);
+  }
+}

package/src/lib/session-host-snapshot.js

@@ -14,7 +14,7 @@ import {
   projectWsTurnMessages,
   readVerifiedEvents as storeReadVerifiedEvents,
   readVerifiedProjection as storeReadVerifiedProjection,
-  sessionExists as storeSessionExists,
+  sessionHasPersistedEvidence as storeSessionHasPersistedEvidence,
 } from "../harness/jsonl-session-store.js";
 import {
   createMcpLedgerEventReducer,
@@ -344,12 +344,16 @@ function createStreamingSessionHostProjection(sessionId) {
 /**
  * Read one real JSONL session for a host resume/attach boundary.
  *
- * `null` means no JSONL session exists and callers may use their legacy store.
- * A present but damaged/unanchored transcript returns a fail-closed snapshot
- * and no raw messages, so a host cannot silently fall back to stale history.
+ * `null` means no canonical JSONL evidence exists and callers may use their
+ * legacy store. A tombstoned, missing, damaged, or unanchored transcript
+ * returns a fail-closed snapshot and no raw messages, so a host cannot silently
+ * fall back to stale history or implicitly recreate a deleted generation.
  */
 export function readSessionHostResumeState(sessionId, dependencies = {}) {
-  const exists = dependencies.sessionExists || storeSessionExists;
+  const exists =
+    dependencies.sessionHasPersistedEvidence ||
+    dependencies.sessionExists ||
+    storeSessionHasPersistedEvidence;
   const hasCustomLegacyReader =
     typeof dependencies.readVerifiedEvents === "function" &&
     dependencies.readVerifiedEvents !== storeReadVerifiedEvents;

package/src/lib/session-projection.js

@@ -260,7 +260,11 @@ function actionPreviews(kind, state, source, sourceId, linkedSessionId) {
       );
     }
     if (active && interactive) {
-      routes.reply = preview("terminal", ["attach", sourceId]);
+      routes.reply = preview(
+        "cli",
+        ["daemon", "reply", sourceId, PROJECTION_PROMPT_PLACEHOLDER, "--json"],
+        { mutates: true, input: "prompt" },
+      );
       routes.attach = preview("terminal", ["attach", sourceId]);
     }
     if (active) {

package/src/lib/session-tail.js

@@ -10,7 +10,31 @@
 
 import { promises as fsp } from "node:fs";
 import { existsSync, statSync } from "node:fs";
-import { sessionPath } from "../harness/jsonl-session-store.js";
+import {
+  getSessionPresence,
+  SESSION_PRESENCE,
+  sessionPath,
+} from "../harness/jsonl-session-store.js";
+
+function assertLiveTranscriptReadable(sessionId) {
+  const presence = getSessionPresence(sessionId);
+  if (
+    presence === SESSION_PRESENCE.PRESENT ||
+    presence === SESSION_PRESENCE.ABSENT
+  ) {
+    return;
+  }
+  const error = new Error(
+    presence === SESSION_PRESENCE.TOMBSTONED
+      ? `Session ${sessionId} has been deleted`
+      : `Session ${sessionId} transcript cannot be verified for live tailing`,
+  );
+  error.code =
+    presence === SESSION_PRESENCE.TOMBSTONED
+      ? "SESSION_DELETED"
+      : "SESSION_TRANSCRIPT_UNVERIFIED";
+  throw error;
+}
 
 function parseLine(line) {
   const trimmed = line.trim();
@@ -53,6 +77,7 @@ function matchesFilter(event, { types, sinceMs }) {
  *   - fromEnd (default): current EOF, so only new events are yielded
  */
 export function initialOffset(sessionId, { fromStart = false } = {}) {
+  assertLiveTranscriptReadable(sessionId);
   const p = sessionPath(sessionId);
   if (!existsSync(p)) return 0;
   if (fromStart) return 0;
@@ -98,6 +123,11 @@ export async function* followSession(sessionId, options = {}) {
   while (true) {
     if (signal?.aborted) return;
 
+    // A long-lived tail is a live canonical reader. Re-check the durable
+    // sidecar witness on every poll so external deletion or a tombstoned path
+    // restoration cannot silently turn into empty output or stale replay.
+    assertLiveTranscriptReadable(sessionId);
+
     if (existsSync(filePath)) {
       const stat = await fsp.stat(filePath);
       if (stat.size < offset) {

package/src/lib/skill-budget.js

@@ -0,0 +1,222 @@
+/**
+ * Host-owned admission limits for file-backed CLI skills.
+ *
+ * These are security ceilings, not defaults that callers may raise. Loader
+ * options can only tighten them through resolveSkillLimits().
+ */
+export const HOST_SKILL_LIMITS = Object.freeze({
+  maxSkillFileBytes: 256 * 1024,
+  maxSkillTotalBytes: 512 * 1024,
+  maxSkillDiscoveryEntries: 16_384,
+  maxSkillDiscoveryFiles: 4096,
+  maxSkillDiscoveryBytes: 64 * 1024 * 1024,
+  maxSkillNestDepth: 5,
+  maxSkillPromptBytes: 48_000,
+  // Provider-neutral conservative ceiling: one token cannot require fewer
+  // than zero bytes, and byte-level tokenizers cannot produce more tokens than
+  // the UTF-8 byte sequence. Hosts with a smaller context may tighten this.
+  maxSkillPromptTokens: 48_000,
+  maxSkillPromptTotalBytes: 192_000,
+  maxSkillPromptTotalTokens: 192_000,
+});
+
+const LIMIT_KEYS = Object.freeze(Object.keys(HOST_SKILL_LIMITS));
+
+function tighteningLimit(value, hardLimit) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+    return hardLimit;
+  }
+  return Math.min(hardLimit, Math.max(1, Math.floor(value)));
+}
+
+export function resolveSkillLimits(options = {}) {
+  const limits = {};
+  for (const key of LIMIT_KEYS) {
+    limits[key] = tighteningLimit(options?.[key], HOST_SKILL_LIMITS[key]);
+  }
+  return Object.freeze(limits);
+}
+
+export function skillBudgetError(code, message, details = {}) {
+  const error = new Error(message);
+  error.name = "SkillBudgetError";
+  error.code = code;
+  if (Number.isFinite(details.limit)) error.limit = details.limit;
+  if (Number.isFinite(details.actual)) error.actual = details.actual;
+  if (details.component) error.component = details.component;
+  return error;
+}
+
+export function isSkillBudgetError(error) {
+  return error?.name === "SkillBudgetError";
+}
+
+export function assertSkillFileSize(component, size, limitsInput = {}) {
+  const limits = resolveSkillLimits(limitsInput);
+  if (!Number.isSafeInteger(size) || size < 0) {
+    throw skillBudgetError(
+      "CC_SKILL_FILE_SIZE_INVALID",
+      `Skill component size is invalid: ${component}`,
+      { component },
+    );
+  }
+  if (size > limits.maxSkillFileBytes) {
+    throw skillBudgetError(
+      "CC_SKILL_FILE_TOO_LARGE",
+      `Skill component exceeds the host byte limit: ${component}`,
+      { component, limit: limits.maxSkillFileBytes, actual: size },
+    );
+  }
+  return size;
+}
+
+export function assertSkillTotalSize(size, limitsInput = {}) {
+  const limits = resolveSkillLimits(limitsInput);
+  if (!Number.isSafeInteger(size) || size < 0) {
+    throw skillBudgetError(
+      "CC_SKILL_TOTAL_SIZE_INVALID",
+      "Skill component total is invalid.",
+    );
+  }
+  if (size > limits.maxSkillTotalBytes) {
+    throw skillBudgetError(
+      "CC_SKILL_TOTAL_BYTES_EXCEEDED",
+      "Skill components exceed the host aggregate byte limit.",
+      { limit: limits.maxSkillTotalBytes, actual: size },
+    );
+  }
+  return size;
+}
+
+export function createSkillDiscoveryBudget(limitsInput = {}) {
+  return {
+    limits: resolveSkillLimits(limitsInput),
+    entries: 0,
+    files: 0,
+    bytes: 0,
+  };
+}
+
+export function debitSkillDiscoveryEntry(budget) {
+  const nextEntries = budget.entries + 1;
+  if (
+    !Number.isSafeInteger(nextEntries) ||
+    nextEntries > budget.limits.maxSkillDiscoveryEntries
+  ) {
+    throw skillBudgetError(
+      "CC_SKILL_DISCOVERY_ENTRIES_EXCEEDED",
+      "Recursive skill discovery exceeds the host directory-entry limit.",
+      {
+        limit: budget.limits.maxSkillDiscoveryEntries,
+        actual: nextEntries,
+      },
+    );
+  }
+  budget.entries = nextEntries;
+  return budget;
+}
+
+export function debitSkillDiscoveryBudget(budget, fileCount, byteCount) {
+  const nextFiles = budget.files + fileCount;
+  const nextBytes = budget.bytes + byteCount;
+  if (
+    !Number.isSafeInteger(nextFiles) ||
+    nextFiles > budget.limits.maxSkillDiscoveryFiles
+  ) {
+    throw skillBudgetError(
+      "CC_SKILL_DISCOVERY_FILES_EXCEEDED",
+      "Recursive skill discovery exceeds the host file-count limit.",
+      {
+        limit: budget.limits.maxSkillDiscoveryFiles,
+        actual: nextFiles,
+      },
+    );
+  }
+  if (
+    !Number.isSafeInteger(nextBytes) ||
+    nextBytes > budget.limits.maxSkillDiscoveryBytes
+  ) {
+    throw skillBudgetError(
+      "CC_SKILL_DISCOVERY_BYTES_EXCEEDED",
+      "Recursive skill discovery exceeds the host aggregate byte limit.",
+      {
+        limit: budget.limits.maxSkillDiscoveryBytes,
+        actual: nextBytes,
+      },
+    );
+  }
+  budget.files = nextFiles;
+  budget.bytes = nextBytes;
+  return budget;
+}
+
+export function measureSkillPrompt(body) {
+  if (typeof body !== "string") {
+    throw skillBudgetError(
+      "CC_SKILL_PROMPT_INVALID",
+      "Skill instructions must be a string before model projection.",
+    );
+  }
+  const bytes = Buffer.byteLength(body, "utf8");
+  return Object.freeze({
+    bytes,
+    // Conservative provider-neutral upper bound for text-derived tokens. This
+    // intentionally does not trust a configurable estimator that could return
+    // zero or NaN.
+    tokenUpperBound: bytes,
+  });
+}
+
+export function admitSkillPrompt(body, limitsInput = {}) {
+  const limits = resolveSkillLimits(limitsInput);
+  const measured = measureSkillPrompt(body);
+  if (measured.bytes > limits.maxSkillPromptBytes) {
+    throw skillBudgetError(
+      "CC_SKILL_PROMPT_BYTES_EXCEEDED",
+      "Skill instructions exceed the host model-projection byte limit.",
+      { limit: limits.maxSkillPromptBytes, actual: measured.bytes },
+    );
+  }
+  if (measured.tokenUpperBound > limits.maxSkillPromptTokens) {
+    throw skillBudgetError(
+      "CC_SKILL_PROMPT_TOKENS_EXCEEDED",
+      "Skill instructions exceed the host model-projection token limit.",
+      { limit: limits.maxSkillPromptTokens, actual: measured.tokenUpperBound },
+    );
+  }
+  return measured;
+}
+
+export function debitSkillPromptBudget(budget, measured) {
+  const nextBytes = budget.bytes + measured.bytes;
+  const nextTokens = budget.tokens + measured.tokenUpperBound;
+  if (
+    !Number.isSafeInteger(nextBytes) ||
+    nextBytes > budget.limits.maxSkillPromptTotalBytes
+  ) {
+    throw skillBudgetError(
+      "CC_SKILL_PROMPT_TOTAL_BYTES_EXCEEDED",
+      "Skill instructions exceed the host aggregate model-projection byte limit.",
+      {
+        limit: budget.limits.maxSkillPromptTotalBytes,
+        actual: nextBytes,
+      },
+    );
+  }
+  if (
+    !Number.isSafeInteger(nextTokens) ||
+    nextTokens > budget.limits.maxSkillPromptTotalTokens
+  ) {
+    throw skillBudgetError(
+      "CC_SKILL_PROMPT_TOTAL_TOKENS_EXCEEDED",
+      "Skill instructions exceed the host aggregate model-projection token limit.",
+      {
+        limit: budget.limits.maxSkillPromptTotalTokens,
+        actual: nextTokens,
+      },
+    );
+  }
+  budget.bytes = nextBytes;
+  budget.tokens = nextTokens;
+  return budget;
+}