claude-multi-session 1.0.0

package/src/safety-net.js

@@ -0,0 +1,170 @@
+/**
+ * SafetyNet — Automatic limits and protection for automated sessions.
+ *
+ * Enforces:
+ *   - Cost limit — Kill session if cumulative cost exceeds threshold
+ *   - Turn limit — Kill session if total agent turns exceed threshold
+ *   - Time limit — Kill session if a single interaction takes too long
+ *   - File protection — Prevent modifications to critical files/paths
+ *
+ * Integrates with StreamSession via the 'result' event.
+ *
+ * Usage:
+ *   const safety = new SafetyNet({
+ *     maxCostUsd: 1.00,    // Kill if total cost exceeds $1
+ *     maxTurns: 30,        // Kill if total turns exceed 30
+ *     maxDurationMs: 300000, // Kill if single interaction > 5 min
+ *     protectedPaths: ['.env', 'node_modules', '.git'],
+ *   });
+ *   safety.attach(streamSession);
+ */
+
+const { EventEmitter } = require('events');
+
+// Default safety limits
+const DEFAULTS = {
+  maxCostUsd: 2.00,       // $2 per session
+  maxTurns: 50,           // 50 agent turns
+  maxDurationMs: 300000,  // 5 minutes per interaction
+  protectedPaths: [       // Files that should never be modified
+    '.env',
+    '.env.local',
+    '.env.production',
+    'credentials',
+    'secrets',
+    '.git/',
+    'node_modules/',
+  ],
+};
+
+class SafetyNet extends EventEmitter {
+  /**
+   * @param {object} [limits] - Override default limits
+   * @param {number} [limits.maxCostUsd] - Max total cost in USD
+   * @param {number} [limits.maxTurns] - Max total agent turns
+   * @param {number} [limits.maxDurationMs] - Max time per interaction
+   * @param {string[]} [limits.protectedPaths] - Paths that can't be modified
+   */
+  constructor(limits = {}) {
+    super();
+    this.maxCostUsd = limits.maxCostUsd ?? DEFAULTS.maxCostUsd;
+    this.maxTurns = limits.maxTurns ?? DEFAULTS.maxTurns;
+    this.maxDurationMs = limits.maxDurationMs ?? DEFAULTS.maxDurationMs;
+    this.protectedPaths = limits.protectedPaths || DEFAULTS.protectedPaths;
+
+    this.violations = [];   // Record of all limit violations
+    this.attached = null;   // The session we're monitoring
+  }
+
+  /**
+   * Attach to a StreamSession to monitor it.
+   * @param {StreamSession} session
+   */
+  attach(session) {
+    this.attached = session;
+
+    // Check limits after each result
+    session.on('result', (response) => {
+      this._checkCost(session, response);
+      this._checkTurns(session, response);
+    });
+
+    // Check for protected file access in tool calls
+    session.on('tool-use', (toolCall) => {
+      this._checkProtectedPaths(session, toolCall);
+    });
+  }
+
+  /**
+   * Check if cost limit is exceeded.
+   */
+  _checkCost(session, response) {
+    if (this.maxCostUsd && session.totalCostUsd > this.maxCostUsd) {
+      const violation = {
+        type: 'cost_exceeded',
+        limit: this.maxCostUsd,
+        actual: session.totalCostUsd,
+        message: `Cost limit exceeded: $${session.totalCostUsd.toFixed(4)} > $${this.maxCostUsd.toFixed(2)} limit`,
+        timestamp: new Date().toISOString(),
+      };
+      this.violations.push(violation);
+      this.emit('violation', violation);
+      this.emit('kill', violation);
+
+      // Force kill the session
+      session.kill();
+    }
+  }
+
+  /**
+   * Check if turn limit is exceeded.
+   */
+  _checkTurns(session, response) {
+    if (this.maxTurns && session.totalTurns > this.maxTurns) {
+      const violation = {
+        type: 'turns_exceeded',
+        limit: this.maxTurns,
+        actual: session.totalTurns,
+        message: `Turn limit exceeded: ${session.totalTurns} > ${this.maxTurns} limit`,
+        timestamp: new Date().toISOString(),
+      };
+      this.violations.push(violation);
+      this.emit('violation', violation);
+      this.emit('kill', violation);
+
+      session.kill();
+    }
+  }
+
+  /**
+   * Check if a tool call targets a protected path.
+   */
+  _checkProtectedPaths(session, toolCall) {
+    if (!toolCall.input) return;
+
+    // Check common file path fields in tool inputs
+    const pathFields = ['file_path', 'path', 'command'];
+    for (const field of pathFields) {
+      const value = toolCall.input[field];
+      if (typeof value !== 'string') continue;
+
+      for (const protected_path of this.protectedPaths) {
+        if (value.includes(protected_path)) {
+          // Only flag write operations
+          const writeTools = ['Write', 'Edit', 'NotebookEdit', 'Bash'];
+          if (writeTools.includes(toolCall.name)) {
+            const violation = {
+              type: 'protected_path',
+              tool: toolCall.name,
+              path: value,
+              protectedPattern: protected_path,
+              message: `Attempted to modify protected path: ${value} (matches "${protected_path}")`,
+              timestamp: new Date().toISOString(),
+            };
+            this.violations.push(violation);
+            this.emit('violation', violation);
+            // Don't kill — just warn. The permission system handles blocking.
+          }
+        }
+      }
+    }
+  }
+
+  /**
+   * Get a summary of all violations.
+   */
+  getSummary() {
+    return {
+      totalViolations: this.violations.length,
+      violations: this.violations,
+      limits: {
+        maxCostUsd: this.maxCostUsd,
+        maxTurns: this.maxTurns,
+        maxDurationMs: this.maxDurationMs,
+        protectedPaths: this.protectedPaths,
+      },
+    };
+  }
+}
+
+module.exports = SafetyNet;

package/src/store.js

@@ -0,0 +1,130 @@
+/**
+ * Store — JSON file persistence for session metadata.
+ *
+ * Sessions are kept alive in-memory (as StreamSession objects) by the Manager,
+ * but their metadata is persisted here so sessions can survive process restarts.
+ *
+ * The store saves:
+ *   - Session config (name, model, workDir, etc.)
+ *   - Claude session ID (for resuming after restart)
+ *   - Interaction history (prompts + responses)
+ *   - Cost tracking
+ *
+ * Data location: ~/.claude-multi-session/ (user home directory)
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+// Default data directory in user's home
+const DEFAULT_DATA_DIR = path.join(os.homedir(), '.claude-multi-session');
+
+class Store {
+  /**
+   * @param {string} [dataDir] - Override data directory path
+   */
+  constructor(dataDir) {
+    this.dataDir = dataDir || DEFAULT_DATA_DIR;
+    this.sessionsFile = path.join(this.dataDir, 'sessions.json');
+
+    // Ensure directory exists
+    if (!fs.existsSync(this.dataDir)) {
+      fs.mkdirSync(this.dataDir, { recursive: true });
+    }
+  }
+
+  /**
+   * Load all session records from disk.
+   * @returns {Object<string, object>} Map of name -> session data
+   */
+  loadAll() {
+    if (!fs.existsSync(this.sessionsFile)) {
+      return {};
+    }
+    try {
+      return JSON.parse(fs.readFileSync(this.sessionsFile, 'utf-8'));
+    } catch (err) {
+      return {};
+    }
+  }
+
+  /**
+   * Save all session records to disk.
+   * @param {Object<string, object>} sessions
+   */
+  saveAll(sessions) {
+    fs.writeFileSync(this.sessionsFile, JSON.stringify(sessions, null, 2), 'utf-8');
+  }
+
+  /**
+   * Get a single session record.
+   * @param {string} name
+   * @returns {object|null}
+   */
+  get(name) {
+    const all = this.loadAll();
+    return all[name] || null;
+  }
+
+  /**
+   * Save/update a single session record.
+   * @param {string} name
+   * @param {object} data
+   */
+  set(name, data) {
+    const all = this.loadAll();
+    all[name] = { ...data, lastSaved: new Date().toISOString() };
+    this.saveAll(all);
+  }
+
+  /**
+   * Delete a session record.
+   * @param {string} name
+   */
+  delete(name) {
+    const all = this.loadAll();
+    delete all[name];
+    this.saveAll(all);
+  }
+
+  /**
+   * List all session records.
+   * @param {string} [statusFilter] - Optional status filter
+   * @returns {object[]}
+   */
+  list(statusFilter) {
+    const all = this.loadAll();
+    let list = Object.values(all);
+    if (statusFilter) {
+      list = list.filter(s => s.status === statusFilter);
+    }
+    return list;
+  }
+
+  /**
+   * Clean up old sessions (completed/failed/killed older than N days).
+   * @param {number} days
+   * @returns {string[]} Names of removed sessions
+   */
+  cleanup(days = 7) {
+    const all = this.loadAll();
+    const cutoff = new Date();
+    cutoff.setDate(cutoff.getDate() - days);
+    const cutoffISO = cutoff.toISOString();
+    const removed = [];
+
+    for (const [name, session] of Object.entries(all)) {
+      const lastActive = session.lastSaved || session.created;
+      if (lastActive < cutoffISO && ['completed', 'failed', 'killed', 'stopped'].includes(session.status)) {
+        removed.push(name);
+        delete all[name];
+      }
+    }
+
+    this.saveAll(all);
+    return removed;
+  }
+}
+
+module.exports = Store;