comfy-pr 1.4.2 → 1.5.0

package/bot/spawn-as-user.ts

@@ -0,0 +1,82 @@
+/**
+ * Spawn Claude Code CLI as a specific Linux user via sudo.
+ *
+ * Used with the Claude Agent SDK's `spawnClaudeCodeProcess` option
+ * to run agent subprocesses as per-task non-root users.
+ */
+import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
+import type { SpawnOptions, SpawnedProcess } from "@anthropic-ai/claude-agent-sdk";
+
+/**
+ * Create a spawnClaudeCodeProcess function that runs the CLI as a specific Linux user.
+ *
+ * The SDK passes: { command, args, cwd, env, signal }
+ * We wrap this in: sudo -n -u <username> <command> <args...>
+ */
+export function createUserSpawner(
+  username: string,
+  taskHome: string,
+): (options: SpawnOptions) => SpawnedProcess {
+  return (options: SpawnOptions): SpawnedProcess => {
+    const { command, args, cwd, env, signal } = options;
+
+    const childEnv: NodeJS.ProcessEnv = {
+      ...process.env,
+      ...env,
+      HOME: taskHome,
+      USER: username,
+      LOGNAME: username,
+    };
+    // Ensure PATH includes bun/node/claude locations
+    childEnv.PATH = `/root/.bun/bin:/root/.local/bin:/root/.nvm/versions/node/v25.2.1/bin:${childEnv.PATH || "/usr/local/bin:/usr/bin:/bin"}`;
+
+    // Resolve command to full path (sudo resets PATH)
+    const resolvedCommand =
+      command === "bun"
+        ? "/root/.bun/bin/bun"
+        : command === "node"
+          ? "/root/.nvm/versions/node/v25.2.1/bin/node"
+          : command === "claude"
+            ? "/root/.local/bin/claude"
+            : command;
+
+    // Use sudo to run as the task user
+    const sudoArgs = ["-n", "-u", username, "--preserve-env", resolvedCommand, ...args];
+
+    const proc = spawn("sudo", sudoArgs, {
+      cwd,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: childEnv,
+    }) as unknown as ChildProcessWithoutNullStreams;
+
+    // Wire up abort signal
+    if (signal) {
+      signal.addEventListener("abort", () => {
+        proc.kill("SIGTERM");
+      });
+    }
+
+    return {
+      stdin: proc.stdin,
+      stdout: proc.stdout,
+      get killed() {
+        return proc.killed;
+      },
+      get exitCode() {
+        return proc.exitCode;
+      },
+      kill(signal: NodeJS.Signals) {
+        return proc.kill(signal);
+      },
+      on(event, listener) {
+        proc.on(event, listener as never);
+      },
+      once(event, listener) {
+        proc.once(event, listener as never);
+      },
+      off(event, listener) {
+        proc.off(event, listener as never);
+      },
+    };
+  };
+}

package/bot/task-user.ts

@@ -0,0 +1,136 @@
+/**
+ * Task User Management
+ *
+ * Creates and manages per-task Linux users for agent isolation.
+ * Each agent task runs as its own Linux user to prevent cross-task interference.
+ */
+import { $ } from "bun";
+
+const TASK_USER_PREFIX = "task-";
+const TASK_USER_GROUP = "comfy-tasks";
+const TASK_ACTIVITY_FILE = ".last-activity";
+
+export interface TaskUser {
+  username: string;
+  homeDir: string;
+}
+
+function workspaceIdToTaskSuffix(workspaceId: string): string {
+  return workspaceId.replace(".", "-").slice(0, 24);
+}
+
+function taskHomeDir(username: string): string {
+  return `/tmp/${username}`;
+}
+
+async function writeTaskActivity(username: string): Promise<void> {
+  const homeDir = taskHomeDir(username);
+  const activityPath = `${homeDir}/${TASK_ACTIVITY_FILE}`;
+  await Bun.write(activityPath, new Date().toISOString());
+  await $`chown ${username}:${TASK_USER_GROUP} ${activityPath}`.quiet().catch(() => {});
+}
+
+/** Ensure the shared group exists */
+async function ensureGroup(): Promise<void> {
+  try {
+    await $`getent group ${TASK_USER_GROUP}`.quiet();
+  } catch {
+    await $`groupadd --system ${TASK_USER_GROUP}`.quiet();
+  }
+}
+
+/** Create a temporary Linux user for a task */
+export async function createTaskUser(workspaceId: string): Promise<TaskUser> {
+  await ensureGroup();
+
+  const username = `${TASK_USER_PREFIX}${workspaceIdToTaskSuffix(workspaceId)}`;
+  const homeDir = taskHomeDir(username);
+
+  // Check if user already exists (task resume)
+  try {
+    await $`id ${username}`.quiet();
+    // User exists, just ensure home dir
+    await $`mkdir -p ${homeDir}/.claude`.quiet();
+    await $`chown -R ${username}:${TASK_USER_GROUP} ${homeDir}`.quiet();
+    await writeTaskActivity(username);
+    return { username, homeDir };
+  } catch {
+    // User doesn't exist, create it
+  }
+
+  await $`useradd --system --no-create-home --gid ${TASK_USER_GROUP} --shell /bin/sh ${username}`.quiet();
+  await $`mkdir -p ${homeDir}/.claude`.quiet();
+  await $`chown -R ${username}:${TASK_USER_GROUP} ${homeDir}`.quiet();
+  await writeTaskActivity(username);
+
+  return { username, homeDir };
+}
+
+/** Set up workspace directory ownership for the task user */
+export async function prepareTaskWorkspace(username: string, workDir: string): Promise<void> {
+  await $`mkdir -p ${workDir}`.quiet();
+  await $`chown -R ${username}:${TASK_USER_GROUP} ${workDir}`.quiet();
+}
+
+/** Delete a task user and clean up */
+export async function deleteTaskUser(username: string): Promise<void> {
+  if (!username.startsWith(TASK_USER_PREFIX)) return; // safety guard
+  await $`userdel ${username}`.quiet().catch(() => {});
+  await $`rm -rf /tmp/${username}`.quiet().catch(() => {});
+}
+
+/** Record that a task received new activity */
+export async function touchTaskUserActivity(workspaceId: string): Promise<void> {
+  const username = `${TASK_USER_PREFIX}${workspaceIdToTaskSuffix(workspaceId)}`;
+  const homeDir = taskHomeDir(username);
+  await $`mkdir -p ${homeDir}`.quiet();
+  await writeTaskActivity(username);
+}
+
+/** List all task-* users */
+export async function listTaskUsers(): Promise<string[]> {
+  try {
+    const output = await $`getent passwd`.text();
+    return output
+      .split("\n")
+      .filter((line) => line.startsWith(TASK_USER_PREFIX))
+      .map((line) => line.split(":")[0]);
+  } catch {
+    return [];
+  }
+}
+
+/** Clean up stale task users not in the active set */
+export async function cleanupStaleTaskUsers(activeWorkspaceIds: Set<string>): Promise<string[]> {
+  const users = await listTaskUsers();
+  const cleaned: string[] = [];
+  const activeTaskSuffixes = new Set([...activeWorkspaceIds].map(workspaceIdToTaskSuffix));
+
+  for (const username of users) {
+    const taskSuffix = username.slice(TASK_USER_PREFIX.length);
+
+    // Check if this task is still active
+    const isActive = activeTaskSuffixes.has(taskSuffix);
+    if (isActive) continue;
+
+    // Skip if the task has seen activity in the last 24h.
+    const homeDir = taskHomeDir(username);
+    const activityPath = `${homeDir}/${TASK_ACTIVITY_FILE}`;
+    try {
+      const stat = await Bun.file(activityPath).stat();
+      if (Date.now() - stat.mtimeMs < 24 * 60 * 60 * 1000) continue;
+    } catch {
+      try {
+        const stat = await Bun.file(`${homeDir}/.claude`).stat();
+        if (Date.now() - stat.mtimeMs < 24 * 60 * 60 * 1000) continue;
+      } catch {
+        // No activity file or fallback dir; safe to clean.
+      }
+    }
+
+    await deleteTaskUser(username);
+    cleaned.push(username);
+  }
+
+  return cleaned;
+}

package/bot/taskInputFlow.spec.ts

@@ -0,0 +1,87 @@
+import { describe, test, expect } from "bun:test";
+
+/**
+ * Verifies the TaskInputFlow drain pattern used by slack-bot.ts to inject
+ * follow-up Slack messages into a running Claude Agent SDK session.
+ *
+ * The bot wraps a TransformStream<string, string> per workspace; writers
+ * push new user messages, the SDK reader yields them as SDKUserMessage.
+ *
+ * If the drain logic ever regresses (e.g., reader gets dropped, debouncer
+ * eats messages), the live "follow-up" feature breaks silently — we have
+ * no production telemetry for it. These tests guard the contract.
+ */
+describe("TaskInputFlow drain contract", () => {
+  test("buffered writes are read back in order, single-reader", async () => {
+    // TransformStream has highWaterMark=1, so writer.write() awaits the
+    // reader for the second chunk. Writers fire-and-forget here to mirror
+    // how slack-bot.ts pushes follow-ups without blocking on the agent.
+    const flow = new TransformStream<string, string>();
+    const writer = flow.writable.getWriter();
+    const reader = flow.readable.getReader();
+
+    void writer.write("first follow-up");
+    void writer.write("second follow-up");
+
+    const a = await reader.read();
+    const b = await reader.read();
+    expect(a).toEqual({ done: false, value: "first follow-up" });
+    expect(b).toEqual({ done: false, value: "second follow-up" });
+
+    writer.releaseLock();
+    reader.releaseLock();
+  });
+
+  test("close() ends the reader loop with done=true", async () => {
+    const flow = new TransformStream<string, string>();
+    const writer = flow.writable.getWriter();
+    const reader = flow.readable.getReader();
+
+    void writer.write("only message");
+    void writer.close();
+
+    const a = await reader.read();
+    const b = await reader.read();
+    expect(a).toEqual({ done: false, value: "only message" });
+    expect(b.done).toBe(true);
+  });
+
+  test("multiple released-and-reacquired writers preserve order", async () => {
+    // Mirrors the actual usage pattern in slack-bot.ts: each follow-up goes
+    // through a fresh .getWriter() / .write() / .releaseLock() cycle, with
+    // a concurrent reader draining into the SDK agent.
+    const flow = new TransformStream<string, string>();
+    const reader = flow.readable.getReader();
+
+    const writeAll = (async () => {
+      for (const text of ["one", "two", "three"]) {
+        const w = flow.writable.getWriter();
+        await w.write(text);
+        w.releaseLock();
+      }
+    })();
+
+    expect((await reader.read()).value).toBe("one");
+    expect((await reader.read()).value).toBe("two");
+    expect((await reader.read()).value).toBe("three");
+
+    await writeAll;
+    reader.releaseLock();
+  });
+
+  test("reader started before any write still receives values", async () => {
+    const flow = new TransformStream<string, string>();
+    const reader = flow.readable.getReader();
+
+    // Kick off the read first; it should park until the write lands.
+    const readPromise = reader.read();
+
+    const w = flow.writable.getWriter();
+    await w.write("late message");
+    w.releaseLock();
+
+    const result = await readPromise;
+    expect(result).toEqual({ done: false, value: "late message" });
+    reader.releaseLock();
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "comfy-pr",
-  "version": "1.4.2",
+  "version": "1.5.0",
   "description": "Make PRs that publishes ComfyUI Custom Nodes to [ComfyUI Registry]( https://registry.comfy.org/ ).",
   "keywords": [],
   "license": "ISC",