cofluxd 2.3.0 → 2.4.0

package/executor/host.js

@@ -0,0 +1,933 @@
+// ../executor/src/host.ts
+import { fork } from "node:child_process";
+import { closeSync, mkdirSync, openSync, readFileSync as readFileSync2, realpathSync as realpathSync2, unlinkSync, writeSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// ../executor/src/settings-cache.ts
+import { readFileSync, statSync } from "node:fs";
+var EMPTY_EXECUTOR_CACHE = {
+  present: false,
+  revision: 0,
+  provider: "",
+  modelId: "",
+  customProviders: [],
+  credentials: {},
+  credentialError: ""
+};
+function asString(value) {
+  return typeof value === "string" ? value : "";
+}
+function parseCustomProviders(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object") continue;
+    const record = item;
+    const id = asString(record.id);
+    if (!id) continue;
+    out.push({
+      id,
+      name: asString(record.name) || id,
+      baseUrl: asString(record.baseUrl),
+      api: asString(record.api),
+      models: Array.isArray(record.models) ? record.models.filter((model) => !!model && typeof model === "object").map((model) => ({ id: asString(model.id), name: asString(model.name) || asString(model.id) })).filter((model) => model.id.length > 0) : [],
+      authHeader: record.authHeader === true,
+      keyless: record.keyless === true
+    });
+  }
+  return out;
+}
+function parseCredentials(value) {
+  if (!Array.isArray(value)) return {};
+  const out = {};
+  for (const item of value) {
+    if (!item || typeof item !== "object") continue;
+    const record = item;
+    const providerId = asString(record.providerId);
+    const apiKey = asString(record.apiKey);
+    if (!providerId || record.type !== "api_key" || !apiKey) continue;
+    out[providerId] = apiKey;
+  }
+  return out;
+}
+function readExecutorSettingsCache(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return EMPTY_EXECUTOR_CACHE;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return EMPTY_EXECUTOR_CACHE;
+    const record = parsed;
+    return {
+      present: true,
+      revision: typeof record.revision === "number" && Number.isFinite(record.revision) ? record.revision : 0,
+      provider: asString(record.provider),
+      modelId: asString(record.modelId),
+      customProviders: parseCustomProviders(record.customProviders),
+      credentials: parseCredentials(record.credentials),
+      credentialError: asString(record.credentialError)
+    };
+  } catch {
+    return { ...EMPTY_EXECUTOR_CACHE, present: true, credentialError: "\u672C\u673A\u7684 executor \u914D\u7F6E\u7F13\u5B58\u65E0\u6CD5\u89E3\u6790\uFF0C\u7B49\u5F85 daemon \u91CD\u65B0\u4E0B\u53D1" };
+  }
+}
+function defaultStat(path) {
+  try {
+    const stats = statSync(path);
+    return { mtimeMs: stats.mtimeMs, size: stats.size };
+  } catch {
+    return void 0;
+  }
+}
+function createExecutorSettingsCache(options) {
+  const read = options.read ?? readExecutorSettingsCache;
+  const stat = options.stat ?? defaultStat;
+  const pollMs = options.pollMs ?? 2e3;
+  let current = read(options.path);
+  let fingerprint = fingerprintOf(stat(options.path));
+  function fingerprintOf(stats) {
+    return stats ? `${stats.mtimeMs}:${stats.size}` : "";
+  }
+  function refresh() {
+    const next = fingerprintOf(stat(options.path));
+    if (next === fingerprint && current.present) return false;
+    fingerprint = next;
+    const settings = read(options.path);
+    const changed = JSON.stringify(settings) !== JSON.stringify(current);
+    current = settings;
+    if (changed) options.onChange?.(settings);
+    return changed;
+  }
+  const timer = setInterval(refresh, pollMs);
+  timer.unref();
+  return {
+    snapshot: () => current,
+    refresh,
+    async waitForRevision(revision, timeoutMs) {
+      const deadline = Date.now() + timeoutMs;
+      for (; ; ) {
+        refresh();
+        if (current.present && current.revision >= revision) return true;
+        if (Date.now() >= deadline) return false;
+        await new Promise((resolve) => setTimeout(resolve, 250));
+      }
+    },
+    dispose: () => clearInterval(timer)
+  };
+}
+
+// ../executor/src/config.ts
+var EXECUTOR_SYSTEM_PROMPT = [
+  "You are the coflux executor: a focused sub-agent that another coding agent delegates a single, bounded task to.",
+  "",
+  "Hard boundaries, enforced by a kernel sandbox \u2014 do not fight them, work within them:",
+  "- You can only modify files inside the workspace you were started in. Paths outside it are unreadable and unwritable.",
+  "- Git metadata is read-only. You cannot commit, stage, or rewrite history. Leave the changes in the working tree; the agent that called you reviews and commits them.",
+  "- Your shell has no network access. Do not try to install dependencies or fetch anything; assume what is already present is all you get.",
+  "- Use absolute paths for every file tool call.",
+  "",
+  "How to work:",
+  "- You get one prompt and no follow-up. There is nobody to ask, so make reasonable assumptions and say what you assumed.",
+  "- Finish the whole task. If part of it is impossible under the boundaries above, do the rest and state plainly what you skipped and why.",
+  "- Your final message is the entire report the calling agent receives. Lead with what you did and what changed, then anything that needs attention. Be concise and concrete."
+].join("\n");
+function deriveReadiness(settings) {
+  if (settings.credentialError) {
+    return { ready: false, reason: `executor \u7684 API key \u8BFB\u4E0D\u51FA\u6765\uFF1A${settings.credentialError}\uFF08\u5728 Coflux \u8BBE\u7F6E\u9875\u7684 Executor \u5206\u533A\u91CD\u65B0\u586B\u4E00\u6B21\uFF09` };
+  }
+  if (!settings.present) {
+    return {
+      ready: false,
+      reason: "\u672C\u673A\u8FD8\u6CA1\u6536\u5230\u8D26\u53F7\u91CC\u7684 executor \u914D\u7F6E\uFF1A\u786E\u8BA4 Coflux \u5DF2\u63A5\u5165\u8FD9\u53F0\u673A\u5668\u3001daemon \u5728\u8DD1\u4E14\u662F\u6700\u65B0\u7248\u672C"
+    };
+  }
+  if (!settings.provider || !settings.modelId) {
+    return { ready: false, reason: "\u8D26\u53F7\u91CC\u8FD8\u6CA1\u914D executor \u7684 provider \u4E0E\u6A21\u578B\uFF1A\u5728 Coflux \u8BBE\u7F6E\u9875\u7684 Executor \u5206\u533A\u9009\u597D\u518D\u53D1" };
+  }
+  const custom = settings.customProviders.find((provider) => provider.id === settings.provider);
+  if (!custom?.keyless && !settings.credentials[settings.provider]) {
+    return { ready: false, reason: `\u8D26\u53F7\u91CC ${settings.provider} \u7684 API key \u8FD8\u6CA1\u586B\uFF1A\u5728 Coflux \u8BBE\u7F6E\u9875\u7684 Executor \u5206\u533A\u586B\u597D\u518D\u53D1` };
+  }
+  return { ready: true, reason: "" };
+}
+function toExecutorView(settings) {
+  const credentialProviders = Object.keys(settings.credentials).sort();
+  return {
+    provider: settings.provider,
+    modelId: settings.modelId,
+    hasApiKey: settings.provider ? credentialProviders.includes(settings.provider) : credentialProviders.length > 0,
+    present: settings.present,
+    credentialError: settings.credentialError,
+    customProviders: settings.customProviders,
+    credentialProviders,
+    revision: settings.revision,
+    ...deriveReadiness(settings)
+  };
+}
+function createExecutorConfigStore(options) {
+  const cache = createExecutorSettingsCache({
+    path: options.cachePath,
+    pollMs: options.pollMs,
+    onChange: (settings) => options.onChange?.(toExecutorView(settings))
+  });
+  return {
+    view: () => toExecutorView(cache.snapshot()),
+    secrets() {
+      const settings = cache.snapshot();
+      const custom = settings.customProviders.find((provider) => provider.id === settings.provider);
+      return {
+        provider: settings.provider,
+        modelId: settings.modelId,
+        apiKey: settings.credentials[settings.provider] ?? "",
+        customProviders: settings.customProviders,
+        keyless: custom?.keyless === true
+      };
+    },
+    cached: () => cache.snapshot(),
+    refresh: () => cache.refresh(),
+    waitForRevision: (revision, timeoutMs) => cache.waitForRevision(revision, timeoutMs),
+    dispose: () => cache.dispose()
+  };
+}
+
+// ../executor/src/host-core.ts
+import { randomUUID } from "node:crypto";
+
+// ../executor/src/capability.ts
+var EXECUTOR_HOST_CAPABILITY = "executor_host_v1";
+var EXECUTOR_HOST_CAPABILITIES = [EXECUTOR_HOST_CAPABILITY];
+
+// ../executor/src/manager.ts
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+// ../executor/src/jobs.ts
+var TERMINAL_STATES = /* @__PURE__ */ new Set([
+  "succeeded",
+  "rejected",
+  "model_error",
+  "tool_failed",
+  "cancelled",
+  "unknown"
+]);
+function isTerminal(state) {
+  return TERMINAL_STATES.has(state);
+}
+var DEFAULT_EXECUTOR_LIMITS = { maxConcurrent: 3 };
+var ExecutorJobTable = class {
+  constructor(limits = DEFAULT_EXECUTOR_LIMITS, readiness = { ready: false, reason: "\u5C1A\u672A\u914D\u7F6E provider \u4E0E\u6A21\u578B" }) {
+    this.limits = limits;
+    this.readiness = readiness;
+  }
+  jobs = /* @__PURE__ */ new Map();
+  setReadiness(readiness) {
+    this.readiness = readiness;
+  }
+  get(runId) {
+    return this.jobs.get(runId);
+  }
+  all() {
+    return [...this.jobs.values()];
+  }
+  /** The run ids still in flight (accepted / running), for reconnect reconciliation to re-report. */
+  activeRunIds() {
+    return this.all().filter((job) => !isTerminal(job.state)).map((job) => job.assignment.runId);
+  }
+  activeCount() {
+    return this.all().filter((job) => !isTerminal(job.state)).length;
+  }
+  writerOf(workspaceId) {
+    return this.all().find(
+      (job) => job.assignment.write && job.assignment.workspaceId === workspaceId && !isTerminal(job.state)
+    );
+  }
+  /**
+   * Take an assignment. **Idempotent**: the same runId arriving again only re-emits the effect for
+   * the current state and never starts a second process — this is what the daemon relies on when a
+   * submission times out and is re-pushed.
+   */
+  assign(assignment) {
+    const existing = this.jobs.get(assignment.runId);
+    if (existing) {
+      return [{ kind: "report", runId: existing.assignment.runId, state: existing.state, note: existing.note, outcome: existing.outcome }];
+    }
+    const rejection = this.rejectionFor(assignment);
+    if (rejection) {
+      const job2 = {
+        assignment,
+        state: "rejected",
+        note: rejection,
+        outcome: null,
+        reportPending: true,
+        stopRequested: false
+      };
+      this.jobs.set(assignment.runId, job2);
+      return [{ kind: "report", runId: assignment.runId, state: "rejected", note: rejection, outcome: null }];
+    }
+    const job = {
+      assignment,
+      state: "accepted",
+      note: "",
+      outcome: null,
+      reportPending: false,
+      stopRequested: false
+    };
+    this.jobs.set(assignment.runId, job);
+    return [
+      { kind: "report", runId: assignment.runId, state: "accepted", note: "", outcome: null },
+      { kind: "start", assignment }
+    ];
+  }
+  /** The reason for refusing on the spot; null means it can be taken. The wording is read by the
+   * calling agent, so it has to say what that agent can do next. */
+  rejectionFor(assignment) {
+    if (!this.readiness.ready) {
+      return this.readiness.reason || "\u684C\u9762 app \u5C1A\u672A\u914D\u7F6E executor \u7684 provider \u4E0E\u6A21\u578B";
+    }
+    if (assignment.write) {
+      const writer = this.writerOf(assignment.workspaceId);
+      if (writer) {
+        return `\u8BE5\u5DE5\u4F5C\u533A\u5DF2\u6709\u4E00\u4E2A\u5199\u6A21\u5F0F executor \u4EFB\u52A1\u5728\u8DD1\uFF08${writer.assignment.runId}\uFF09\uFF1B\u5199\u6A21\u5F0F\u540C\u4E00\u5DE5\u4F5C\u533A\u53EA\u80FD\u6709\u4E00\u4E2A\uFF0C\u7B49\u5B83\u7ED3\u675F\u518D\u53D1`;
+      }
+    }
+    if (this.activeCount() >= this.limits.maxConcurrent) {
+      return `\u672C\u673A\u540C\u65F6\u5728\u8DD1\u7684 executor \u4EFB\u52A1\u5DF2\u8FBE\u4E0A\u9650 ${this.limits.maxConcurrent}\uFF0C\u7B49\u4E00\u4E2A\u7ED3\u675F\u518D\u53D1`;
+    }
+    return null;
+  }
+  /** The runner really started. */
+  markRunning(runId, note = "") {
+    const job = this.jobs.get(runId);
+    if (!job || isTerminal(job.state)) return [];
+    if (job.state === "running" && job.note === note) return [];
+    job.state = "running";
+    job.note = note;
+    return [{ kind: "report", runId, state: "running", note, outcome: null }];
+  }
+  /**
+   * Record a terminal state. The caller must call this **only after confirming the tool's child
+   * processes really stopped** — the write lock holds the next write request off by virtue of this
+   * run not being finished, so finishing early releases the lock early and lets a second writer in.
+   */
+  finish(runId, outcome) {
+    const job = this.jobs.get(runId);
+    if (!job || isTerminal(job.state)) return [];
+    job.state = outcome.state;
+    job.outcome = outcome;
+    job.note = outcome.error ?? job.note;
+    job.reportPending = true;
+    return [{ kind: "report", runId, state: outcome.state, note: job.note, outcome }];
+  }
+  /** Cancel is **idempotent**: cancelling a finished run does nothing, and repeated cancels never
+   * emit a second stop. */
+  cancel(runId) {
+    const job = this.jobs.get(runId);
+    if (!job || isTerminal(job.state) || job.stopRequested) return [];
+    job.stopRequested = true;
+    job.note = "\u6B63\u5728\u505C\u6B62";
+    return [{ kind: "stop", runId }];
+  }
+  /** The daemon confirmed it received the terminal state; the local copy can go. */
+  ack(runId) {
+    const job = this.jobs.get(runId);
+    if (!job) return;
+    job.reportPending = false;
+    if (isTerminal(job.state)) this.jobs.delete(runId);
+  }
+  /**
+   * Reconnect reconciliation: the daemon hands over its list of unfinished runs and we re-report
+   * each one. Runs we recognize and that are still going are reported as they are; **anything we do
+   * not recognize is unknown** — this host instance has no way to know how far that run got, so the
+   * daemon records unknown and leaves the judgement to a person. Never re-run automatically.
+   */
+  reconcile(daemonRunIds) {
+    const effects = [];
+    for (const runId of daemonRunIds) {
+      const job = this.jobs.get(runId);
+      if (job) {
+        effects.push({ kind: "report", runId, state: job.state, note: job.note, outcome: job.outcome });
+      } else {
+        effects.push({
+          kind: "report",
+          runId,
+          state: "unknown",
+          note: "\u684C\u9762 app \u4E0D\u8BA4\u8BC6\u8FD9\u6761\u4EFB\u52A1\uFF08app \u91CD\u542F\u6216\u5B9E\u4F8B\u66F4\u6362\uFF09\uFF1B\u5B83\u662F\u5426\u5199\u8FC7\u6587\u4EF6\u65E0\u6CD5\u5224\u65AD",
+          outcome: { state: "unknown", error: "host \u4E0D\u8BA4\u8BC6\u8BE5 run" }
+        });
+      }
+    }
+    for (const job of this.all()) {
+      if (job.reportPending && !daemonRunIds.includes(job.assignment.runId)) {
+        effects.push({
+          kind: "report",
+          runId: job.assignment.runId,
+          state: job.state,
+          note: job.note,
+          outcome: job.outcome
+        });
+      }
+    }
+    return effects;
+  }
+  /**
+   * The local runtime is going away: every unfinished run becomes `cancelled` and is asked to stop.
+   *
+   * "The runtime stopped, so the job stopped" is an accepted product constraint, but a **definite
+   * terminal state is not optional** — without one the CLI on the other end polls forever. The
+   * caller passes the sentence saying which user action ended the run (see `executor-lifecycle`).
+   */
+  cancelAll(error) {
+    const effects = [];
+    for (const job of this.all()) {
+      if (isTerminal(job.state)) continue;
+      effects.push({ kind: "stop", runId: job.assignment.runId });
+      effects.push(...this.finish(job.assignment.runId, { state: "cancelled", error }));
+    }
+    return effects;
+  }
+};
+
+// ../executor/src/sandbox.ts
+var WRITABLE_DEVICES = ["/dev/null", "/dev/stdout", "/dev/stderr", "/dev/tty", "/dev/dtracehelper"];
+function assertProfilePath(label, path) {
+  if (!path || !path.startsWith("/")) {
+    throw new Error(`executor \u6C99\u7BB1\uFF1A${label} \u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u6536\u5230 ${JSON.stringify(path)}`);
+  }
+  if (/["\\\n\r]/.test(path)) {
+    throw new Error(`executor \u6C99\u7BB1\uFF1A${label} \u542B\u5F15\u53F7\u6216\u6362\u884C\uFF0C\u62D2\u7EDD\u5199\u8FDB profile\uFF1A${JSON.stringify(path)}`);
+  }
+  if (path !== "/" && path.endsWith("/")) {
+    throw new Error(`executor \u6C99\u7BB1\uFF1A${label} \u4E0D\u5E94\u4EE5\u659C\u6760\u7ED3\u5C3E\uFF08subpath \u524D\u7F00\u8BED\u4E49\u4F1A\u53D8\uFF09\uFF0C\u6536\u5230 ${JSON.stringify(path)}`);
+  }
+  if (path.split("/").includes("..") || path.split("/").includes(".")) {
+    throw new Error(`executor \u6C99\u7BB1\uFF1A${label} \u5FC5\u987B\u662F realpath \u89E3\u6790\u540E\u7684\u8DEF\u5F84\uFF0C\u4E0D\u80FD\u542B . \u6216 ..\uFF1A${JSON.stringify(path)}`);
+  }
+  if (/^\/(var|tmp|etc)(\/|$)/.test(path)) {
+    throw new Error(
+      `executor \u6C99\u7BB1\uFF1A${label} \u770B\u8D77\u6765\u672A\u7ECF realpath \u89E3\u6790\uFF08${path}\uFF09\u2014\u2014macOS \u4E0A /var /tmp /etc \u90FD\u662F\u6307\u5411 /private \u7684\u7B26\u53F7\u94FE\u63A5\uFF0C\u76F4\u63A5\u5199\u8FDB profile \u89C4\u5219\u4F1A\u9759\u9ED8\u5931\u6548`
+    );
+  }
+}
+function subpath(rule, path) {
+  return `(${rule} (subpath "${path}"))`;
+}
+function buildSandboxProfile(input) {
+  assertProfilePath("\u5DE5\u4F5C\u533A\u6839", input.workspaceRoot);
+  assertProfilePath("scratch \u76EE\u5F55", input.scratchDir);
+  for (const path of input.nestedWorktrees) assertProfilePath("\u5D4C\u5957 worktree", path);
+  for (const path of input.gitDirs) assertProfilePath("git \u76EE\u5F55", path);
+  const lines = [
+    "(version 1)",
+    ";; coflux executor tool sandbox. Tier = against mistakes, not adversaries: Mach/XPC and Apple Events are not closed off.",
+    "(allow default)",
+    "",
+    ";; Network: one blanket denial. It blocks loopback TCP and unix sockets alike (measured), so a tool",
+    ";; process cannot call back into the daemon's /agent and have the unconstrained daemon run commands",
+    ";; for it via terminal.new. Model calls happen in the runner, outside the sandbox, and are unaffected.",
+    "(deny network*)",
+    "",
+    ";; File writes: deny everything by default, then allow back item by item.",
+    "(deny file-write*)"
+  ];
+  if (input.writable) {
+    lines.push("", ";; Writable mode: allow only the workspace that started the task.", subpath("allow file-write*", input.workspaceRoot));
+  } else {
+    lines.push("", ";; Read-only mode: even the workspace is not writable; the executor may only look and run.");
+  }
+  lines.push(
+    "",
+    ";; The task's private scratch (TMPDIR points at it). Not all of /tmp, which holds other tasks and shared sockets.",
+    subpath("allow file-write*", input.scratchDir),
+    "",
+    ";; The device nodes shell redirection needs.",
+    `(allow file-write* ${WRITABLE_DEVICES.map((device) => `(literal "${device}")`).join(" ")})`
+  );
+  if (input.gitDirs.length > 0) {
+    lines.push(
+      "",
+      ";; Git metadata is read-only (v1 does not commit). The carve-out only works after the allow,",
+      ";; because the main workspace's .git sits inside the workspace root. It also closes the chain of",
+      ";; persisted execution entry points: hooks, worktree-level config, the rebase sequencer's exec,",
+      ";; and submodule config.",
+      ...input.gitDirs.map((path) => subpath("deny file-write*", path))
+    );
+  }
+  if (input.nestedWorktrees.length > 0) {
+    lines.push(
+      "",
+      ";; Other registered worktrees nested inside: someone else's unmerged work must not become",
+      ";; writable just because it happens to live under this workspace's directory.",
+      ...input.nestedWorktrees.map((path) => subpath("deny file-write*", path))
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+function otherWorktreePaths(porcelain, selfRoot) {
+  return porcelain.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => line.slice("worktree ".length).trim()).filter((path) => path.length > 0 && path !== selfRoot);
+}
+
+// ../executor/src/workspace.ts
+function collectWorkspaceFacts(root, runGit) {
+  const gitDir = readGitPath(runGit, root, "--git-dir");
+  const commonDir = readGitPath(runGit, root, "--git-common-dir");
+  const listed = runGit(["worktree", "list", "--porcelain"], root);
+  const gitDirs = [...new Set([gitDir, commonDir].filter((path) => Boolean(path)))];
+  const otherWorktrees = listed.ok ? otherWorktreePaths(listed.stdout, root) : [];
+  return { root, gitDirs, otherWorktrees: [...new Set(otherWorktrees)] };
+}
+function readGitPath(runGit, cwd, flag) {
+  const result = runGit(["rev-parse", "--path-format=absolute", flag], cwd);
+  if (!result.ok) return null;
+  const value = result.stdout.trim();
+  return value.length > 0 ? value : null;
+}
+
+// ../executor/src/manager.ts
+var DEFAULT_TIMEOUT_MS = 20 * 60 * 1e3;
+var defaultRunGit = (args, cwd) => {
+  try {
+    return { stdout: execFileSync("git", [...args], { cwd, encoding: "utf8", timeout: 1e4 }), ok: true };
+  } catch {
+    return { stdout: "", ok: false };
+  }
+};
+var ExecutorManager = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.runGit = deps.runGit ?? defaultRunGit;
+    const config = deps.config();
+    this.table = new ExecutorJobTable(void 0, { ready: config.ready, reason: config.reason });
+  }
+  table;
+  live = /* @__PURE__ */ new Map();
+  runGit;
+  /** The configuration changed (the user just set a provider/model): the job table's admission
+   * criteria have to follow. */
+  refreshReadiness() {
+    const config = this.deps.config();
+    this.table.setReadiness({ ready: config.ready, reason: config.reason });
+  }
+  activeRunIds() {
+    return this.table.activeRunIds();
+  }
+  onAssign(assignment) {
+    this.apply(this.table.assign(assignment));
+  }
+  onCancel(runId) {
+    this.apply(this.table.cancel(runId));
+  }
+  onAck(runId) {
+    this.table.ack(runId);
+  }
+  onReconcile(daemonRunIds) {
+    this.apply(this.table.reconcile(daemonRunIds));
+  }
+  /**
+   * The local runtime is going away: every unfinished run reaches a definite terminal state and
+   * every tool process group is stopped, so the write lock is released and no CLI polls forever.
+   * Idempotent — a second call finds nothing unfinished and nothing live.
+   */
+  cancelAll(error) {
+    this.apply(this.table.cancelAll(error));
+    for (const [, run] of this.live) run.handle.kill();
+    this.live.clear();
+  }
+  log(message) {
+    this.deps.log?.(`[executor] ${message}`);
+  }
+  apply(effects) {
+    for (const effect of effects) {
+      if (effect.kind === "report") {
+        this.deps.sendReport({
+          runId: effect.runId,
+          state: effect.state,
+          note: effect.note,
+          summary: effect.outcome?.summary,
+          changedFiles: effect.outcome?.changedFiles,
+          error: effect.outcome?.error
+        });
+      } else if (effect.kind === "start") {
+        this.start(effect.assignment);
+      } else {
+        this.stop(effect.runId);
+      }
+    }
+  }
+  start(assignment) {
+    let scratchDir = "";
+    try {
+      const config = this.deps.config();
+      const root = realpathSync(assignment.workspaceRoot);
+      scratchDir = realpathSync(mkdtempSync(join(tmpdir(), "coflux-executor-")));
+      const facts = collectWorkspaceFacts(root, this.runGit);
+      const profile = buildSandboxProfile({
+        workspaceRoot: root,
+        writable: assignment.write,
+        nestedWorktrees: facts.otherWorktrees,
+        gitDirs: facts.gitDirs,
+        scratchDir
+      });
+      const profilePath = join(scratchDir, "sandbox.sb");
+      writeFileSync(profilePath, profile, { mode: 384 });
+      const handle = this.deps.spawnRunner();
+      this.live.set(assignment.runId, { handle, scratchDir, settled: false });
+      handle.on("message", (message) => this.onRunnerMessage(assignment.runId, message));
+      handle.on("exit", (code) => this.onRunnerExit(assignment.runId, code));
+      const start = {
+        type: "start",
+        runId: assignment.runId,
+        prompt: assignment.prompt,
+        write: assignment.write,
+        workspaceRoot: root,
+        scratchDir,
+        sandboxProfilePath: profilePath,
+        shell: config.shell,
+        systemPrompt: config.systemPrompt,
+        model: { provider: config.provider, id: config.modelId },
+        customProviders: config.customProviders,
+        apiKey: config.apiKey,
+        timeoutMs: DEFAULT_TIMEOUT_MS
+      };
+      handle.postMessage(start);
+      this.log(`run ${assignment.runId} \u5DF2\u8D77\uFF08${assignment.write ? "\u53EF\u5199" : "\u53EA\u8BFB"}\uFF0C${root}\uFF09`);
+    } catch (error) {
+      const text = error instanceof Error ? error.message : String(error);
+      this.log(`run ${assignment.runId} \u542F\u52A8\u5931\u8D25\uFF1A${text}`);
+      if (scratchDir) this.cleanScratch(scratchDir);
+      this.live.delete(assignment.runId);
+      this.apply(this.table.finish(assignment.runId, { state: "tool_failed", error: `executor \u542F\u52A8\u5931\u8D25\uFF1A${text}` }));
+    }
+  }
+  stop(runId) {
+    const run = this.live.get(runId);
+    if (!run) return;
+    run.handle.postMessage({ type: "abort" });
+    setTimeout(() => {
+      if (this.live.has(runId)) {
+        this.log(`run ${runId} \u672A\u5728\u5BBD\u9650\u671F\u5185\u81EA\u884C\u505C\u6B62\uFF0C\u5F3A\u6740 runner`);
+        run.handle.kill();
+      }
+    }, 8e3);
+  }
+  onRunnerMessage(runId, message) {
+    if (message.type === "running") {
+      this.apply(this.table.markRunning(runId));
+    } else if (message.type === "progress") {
+      this.apply(this.table.markRunning(runId, message.note));
+    } else if (message.type === "done") {
+      const outcome = {
+        state: message.outcome,
+        summary: message.summary,
+        changedFiles: message.changedFiles,
+        error: message.error
+      };
+      const run = this.live.get(runId);
+      if (run) run.settled = true;
+      this.apply(this.table.finish(runId, outcome));
+    }
+  }
+  /**
+   * The runner process is gone. Fill in a terminal state **only if one was not recorded already** —
+   * otherwise a run that already succeeded would be overwritten as a failure. What gets filled in is
+   * `unknown`, not `tool_failed`: when a process vanishes unexpectedly, we do not know how far it got.
+   */
+  onRunnerExit(runId, code) {
+    const run = this.live.get(runId);
+    this.live.delete(runId);
+    if (run) this.cleanScratch(run.scratchDir);
+    if (!run || run.settled) return;
+    this.log(`run ${runId} \u7684 runner \u5F02\u5E38\u9000\u51FA\uFF08code=${code}\uFF09\uFF0C\u5224 unknown`);
+    this.apply(
+      this.table.finish(runId, {
+        state: "unknown",
+        error: `executor \u8FDB\u7A0B\u5F02\u5E38\u9000\u51FA\uFF08code=${code}\uFF09\uFF1B\u5B83\u662F\u5426\u5DF2\u7ECF\u6539\u8FC7\u6587\u4EF6\u65E0\u6CD5\u5224\u65AD`
+      })
+    );
+  }
+  /** Delete only the directory mkdtemp handed back, and only when the string is non-empty. */
+  cleanScratch(scratchDir) {
+    if (!scratchDir || !scratchDir.includes("coflux-executor-")) return;
+    try {
+      rmSync(scratchDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+};
+
+// ../executor/src/host-core.ts
+function createExecutorHostCore(options) {
+  const hostId = randomUUID();
+  let accepted = false;
+  const manager = new ExecutorManager({
+    spawnRunner: options.spawnRunner,
+    config: () => {
+      const view = options.config.view();
+      const secrets = options.config.secrets();
+      return {
+        ready: view.ready,
+        reason: view.reason,
+        provider: secrets.provider,
+        modelId: secrets.modelId,
+        apiKey: secrets.apiKey,
+        customProviders: secrets.customProviders,
+        systemPrompt: EXECUTOR_SYSTEM_PROMPT,
+        shell: options.shell || process.env.SHELL || "/bin/zsh"
+      };
+    },
+    sendReport: (report) => options.send({ type: "report", ...report }),
+    log: options.log
+  });
+  return {
+    hostId,
+    registerFrame(epoch) {
+      const view = options.config.view();
+      return {
+        type: "register",
+        hostId,
+        hostEpoch: epoch,
+        capabilities: [...EXECUTOR_HOST_CAPABILITIES],
+        ready: view.ready,
+        notReadyReason: view.reason
+      };
+    },
+    handle(message) {
+      switch (message.type) {
+        case "registered":
+          if (!message.ok) {
+            accepted = false;
+            options.log(`\u672C\u673A daemon \u62D2\u7EDD\u4E86 host \u767B\u8BB0\uFF1A${message.error ?? "\u672A\u7ED9\u51FA\u539F\u56E0"}`);
+            break;
+          }
+          accepted = true;
+          manager.onReconcile(message.reconcileRunIds);
+          break;
+        case "assign":
+          manager.onAssign({
+            runId: message.runId,
+            prompt: message.prompt,
+            write: message.write,
+            workspaceId: message.workspaceId,
+            workspaceRoot: message.workspaceRoot,
+            submittedAt: message.submittedAt
+          });
+          break;
+        case "cancel":
+          manager.onCancel(message.runId);
+          break;
+        case "ack":
+          manager.onAck(message.runId);
+          break;
+      }
+    },
+    refreshReadiness: () => manager.refreshReadiness(),
+    hosting: () => accepted,
+    activeRunIds: () => manager.activeRunIds(),
+    cancelAll: (reason) => manager.cancelAll(reason)
+  };
+}
+
+// ../executor/src/host-protocol.ts
+var MAX_HOST_LINE_BYTES = 4 * 1024 * 1024;
+
+// ../executor/src/host.ts
+var LOCK_WAIT_MS = 25 * 60 * 1e3;
+var LOCK_POLL_MS = 500;
+var DRAIN_TIMEOUT_MS = 25 * 60 * 1e3;
+var DRAIN_POLL_MS = 1e3;
+function homeDir() {
+  const configured = process.env.COFLUX_HOME?.trim();
+  return configured || join2(homedir(), ".coflux");
+}
+function logLine(message) {
+  process.stderr.write(`[executor-host] ${message}
+`);
+}
+async function acquireHostLock(path) {
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  for (; ; ) {
+    try {
+      const fd = openSync(path, "wx", 384);
+      writeSync(fd, `${process.pid}
+`);
+      closeSync(fd);
+      return () => {
+        try {
+          if (readHolder(path) === process.pid) unlinkSync(path);
+        } catch {
+        }
+      };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+    const holder = readHolder(path);
+    if (holder === null || !alive(holder)) {
+      try {
+        unlinkSync(path);
+      } catch {
+      }
+      continue;
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`\u672C\u673A\u5DF2\u6709 executor host \u5728\u8DD1\uFF08pid ${holder}\uFF09\uFF0C\u7B49\u5F85\u8D85\u65F6`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, LOCK_POLL_MS));
+  }
+}
+function readHolder(path) {
+  try {
+    const pid = Number.parseInt(readFileSync2(path, "utf8").trim(), 10);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function sendFrame(message) {
+  try {
+    process.stdout.write(`${JSON.stringify(message)}
+`);
+  } catch {
+  }
+}
+function readFrames(onFrame, onEnd) {
+  let buffer = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => {
+    buffer += chunk;
+    if (buffer.length > MAX_HOST_LINE_BYTES) {
+      logLine("\u4E0A\u884C\u5E27\u8D85\u8FC7\u957F\u5EA6\u4E0A\u9650\uFF0C\u4E22\u5F03\u7F13\u51B2");
+      buffer = "";
+      return;
+    }
+    let index = buffer.indexOf("\n");
+    while (index >= 0) {
+      const line = buffer.slice(0, index).trim();
+      buffer = buffer.slice(index + 1);
+      if (line) {
+        try {
+          onFrame(JSON.parse(line));
+        } catch {
+          logLine("\u6536\u5230\u65E0\u6CD5\u89E3\u6790\u7684\u5E27\uFF0C\u5DF2\u5FFD\u7565");
+        }
+      }
+      index = buffer.indexOf("\n");
+    }
+  });
+  process.stdin.on("end", onEnd);
+  process.stdin.on("close", onEnd);
+  process.stdin.on("error", onEnd);
+}
+function runnerPath() {
+  return join2(dirname(fileURLToPath(import.meta.url)), "runner.js");
+}
+function forkRunner() {
+  const child = fork(runnerPath(), [], { stdio: ["ignore", "ignore", "pipe", "ipc"] });
+  child.stderr?.setEncoding("utf8");
+  child.stderr?.on("data", (chunk) => {
+    for (const line of chunk.split("\n")) if (line.trim()) logLine(`runner: ${line.trim()}`);
+  });
+  return {
+    postMessage: (message) => {
+      if (child.connected) child.send(message);
+    },
+    kill: () => void child.kill(),
+    on(event, listener) {
+      if (event === "message") child.on("message", listener);
+      else child.on("exit", listener);
+    }
+  };
+}
+async function runExecutorHost() {
+  const home = homeDir();
+  mkdirSync(home, { recursive: true, mode: 448 });
+  const release = await acquireHostLock(join2(home, "executor-host.lock"));
+  let epoch = 0;
+  let draining = false;
+  const config = createExecutorConfigStore({
+    cachePath: join2(home, "executor-settings.json"),
+    onChange: () => {
+      core.refreshReadiness();
+      if (!draining) register();
+    }
+  });
+  const core = createExecutorHostCore({
+    config,
+    spawnRunner: forkRunner,
+    send: sendFrame,
+    log: logLine
+  });
+  function register() {
+    epoch += 1;
+    sendFrame(core.registerFrame(epoch));
+    logLine(`\u5DF2\u5411\u672C\u673A daemon \u62A5\u5230\uFF08hostId=${core.hostId}\uFF0Cepoch=${epoch}\uFF09`);
+  }
+  readFrames(
+    (message) => {
+      if (draining) return;
+      core.handle(message);
+    },
+    () => {
+      if (draining) return;
+      draining = true;
+      const active = core.activeRunIds().length;
+      logLine(active === 0 ? "daemon \u94FE\u8DEF\u5DF2\u65AD\uFF0C\u65E0\u5728\u8DD1\u4EFB\u52A1\uFF0C\u9000\u51FA" : `daemon \u94FE\u8DEF\u5DF2\u65AD\uFF0C\u7B49\u5F85 ${active} \u4E2A\u5728\u8DD1\u4EFB\u52A1\u6536\u5C3E\u540E\u9000\u51FA`);
+      void drain();
+    }
+  );
+  async function drain() {
+    const deadline = Date.now() + DRAIN_TIMEOUT_MS;
+    while (core.activeRunIds().length > 0 && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, DRAIN_POLL_MS));
+    }
+    if (core.activeRunIds().length > 0) {
+      logLine("\u5728\u8DD1\u4EFB\u52A1\u8D85\u8FC7\u6536\u5C3E\u4E0A\u9650\uFF0C\u5F3A\u5236\u505C\u6B62\u540E\u9000\u51FA");
+      core.cancelAll("daemon \u5DF2\u9000\u51FA\u4E14\u4EFB\u52A1\u672A\u80FD\u5728\u9650\u671F\u5185\u6536\u5C3E");
+    }
+    config.dispose();
+    release();
+    process.exit(0);
+  }
+  process.stdout.on("error", () => {
+  });
+  for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.on(signal, () => {
+      logLine(`\u6536\u5230 ${signal}\uFF0C\u505C\u6B62\u6240\u6709\u5728\u8DD1\u4EFB\u52A1`);
+      core.cancelAll("\u672C\u673A daemon \u505C\u6B62\u4E86 executor host\uFF0C\u4EFB\u52A1\u88AB\u4E2D\u65AD");
+      config.dispose();
+      release();
+      process.exit(0);
+    });
+  }
+  register();
+}
+function startedDirectly() {
+  try {
+    return realpathSync2(process.argv[1] ?? "") === realpathSync2(fileURLToPath(import.meta.url));
+  } catch {
+    return true;
+  }
+}
+if (startedDirectly()) {
+  runExecutorHost().catch((error) => {
+    logLine(`\u542F\u52A8\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  });
+}
+export {
+  runExecutorHost
+};