commandmate 0.42.2 → 0.44.0

package/dist/cli/utils/process-inspect.js

@@ -0,0 +1,214 @@
+"use strict";
+/**
+ * Best-effort process inspection for stop/start (Issue #3087)
+ *
+ * - Zombies: `kill(pid, 0)` succeeds for a zombie, so without an init process
+ *   (a container whose PID 1 never reaps) a stopped server's group looked alive
+ *   forever. On Linux, /proc tells a zombie apart; elsewhere nothing is known
+ *   and callers keep their signal-based answer.
+ * - Listeners: when something answers on the configured port but is not the
+ *   server the PID file describes, the user is told which PID holds it.
+ *
+ * Every function here is read-only and never throws.
+ *
+ * @module process-inspect
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseProcStat = parseProcStat;
+exports.isZombieProcess = isZombieProcess;
+exports.listProcessGroupStates = listProcessGroupStates;
+exports.isExitedState = isExitedState;
+exports.findListeningPids = findListeningPids;
+exports.describeProcess = describeProcess;
+exports.describeListeners = describeListeners;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+/** Process states that are no longer running code: zombie and dead. */
+const EXITED_STATES = new Set(['Z', 'X', 'x']);
+/**
+ * Parse `/proc/<pid>/stat`. The command name is parenthesised and may itself
+ * contain spaces or parentheses, so fields are read after the LAST `)`.
+ */
+function parseProcStat(content) {
+    const end = content.lastIndexOf(')');
+    if (end === -1)
+        return null;
+    const fields = content.slice(end + 1).trim().split(/\s+/);
+    // fields[0] = state, fields[1] = ppid, fields[2] = pgrp
+    const pgrp = parseInt(fields[2] ?? '', 10);
+    if (!fields[0] || Number.isNaN(pgrp))
+        return null;
+    return { state: fields[0], pgrp };
+}
+function readProcStat(pid) {
+    try {
+        return parseProcStat((0, fs_1.readFileSync)(`/proc/${pid}/stat`, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * @returns true when /proc reports the process as a zombie (or dead); false when it is
+ *   running, absent, or the platform has no /proc
+ */
+function isZombieProcess(pid) {
+    if (process.platform !== 'linux')
+        return false;
+    const stat = readProcStat(pid);
+    return stat !== null && EXITED_STATES.has(stat.state);
+}
+/**
+ * States of every process whose process group is `pgid`.
+ *
+ * @returns the state letters (possibly empty), or null when /proc cannot be read
+ *   (non-Linux), in which case nothing is known
+ */
+function listProcessGroupStates(pgid) {
+    if (process.platform !== 'linux')
+        return null;
+    let entries;
+    try {
+        entries = (0, fs_1.readdirSync)('/proc');
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(entries))
+        return null;
+    const states = [];
+    for (const entry of entries) {
+        if (!/^\d+$/.test(entry))
+            continue;
+        const stat = readProcStat(parseInt(entry, 10));
+        if (stat !== null && stat.pgrp === pgid) {
+            states.push(stat.state);
+        }
+    }
+    return states;
+}
+/** @returns true when a /proc state letter means the process no longer runs */
+function isExitedState(state) {
+    return EXITED_STATES.has(state);
+}
+/** Socket inodes listening on `port` per /proc/net/tcp{,6} (state 0A = LISTEN). */
+function listeningInodes(port) {
+    const inodes = new Set();
+    const hexPort = port.toString(16).toUpperCase().padStart(4, '0');
+    for (const table of ['/proc/net/tcp', '/proc/net/tcp6']) {
+        let content;
+        try {
+            content = (0, fs_1.readFileSync)(table, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of String(content).split('\n').slice(1)) {
+            const fields = line.trim().split(/\s+/);
+            // sl local_address rem_address st tx:rx tr:when retrnsmt uid timeout inode
+            if (fields.length < 10)
+                continue;
+            const localPort = fields[1].split(':')[1];
+            if (localPort === hexPort && fields[3] === '0A') {
+                inodes.add(fields[9]);
+            }
+        }
+    }
+    return inodes;
+}
+function findListeningPidsLinux(port) {
+    const inodes = listeningInodes(port);
+    if (inodes.size === 0)
+        return [];
+    const pids = [];
+    let entries;
+    try {
+        entries = (0, fs_1.readdirSync)('/proc');
+    }
+    catch {
+        return [];
+    }
+    for (const entry of entries) {
+        if (!/^\d+$/.test(entry))
+            continue;
+        let fds;
+        try {
+            fds = (0, fs_1.readdirSync)(`/proc/${entry}/fd`);
+        }
+        catch {
+            continue; // not ours to read, or gone
+        }
+        for (const fd of fds) {
+            let target;
+            try {
+                target = (0, fs_1.readlinkSync)(`/proc/${entry}/fd/${fd}`);
+            }
+            catch {
+                continue;
+            }
+            const match = /^socket:\[(\d+)\]$/.exec(target);
+            if (match && inodes.has(match[1])) {
+                pids.push(parseInt(entry, 10));
+                break;
+            }
+        }
+    }
+    return pids;
+}
+function findListeningPidsLsof(port) {
+    try {
+        const out = (0, child_process_1.execFileSync)('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-t'], {
+            encoding: 'utf-8',
+            timeout: 3000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return [...new Set(String(out).split('\n').map((l) => parseInt(l, 10)).filter((n) => !Number.isNaN(n)))];
+    }
+    catch {
+        return []; // lsof exits 1 when nothing matches, or is not installed
+    }
+}
+/**
+ * PIDs listening on a TCP port: /proc on Linux, `lsof` elsewhere.
+ *
+ * @returns the PIDs found; empty when none are visible (another user's process, or no tool)
+ */
+function findListeningPids(port) {
+    return process.platform === 'linux' ? findListeningPidsLinux(port) : findListeningPidsLsof(port);
+}
+/**
+ * One-line description of a process for an error message.
+ *
+ * @returns the command line, or null when it cannot be read
+ */
+function describeProcess(pid) {
+    try {
+        if (process.platform === 'linux') {
+            const cmdline = (0, fs_1.readFileSync)(`/proc/${pid}/cmdline`, 'utf-8').split('\0').filter(Boolean).join(' ');
+            return cmdline || null;
+        }
+        const out = (0, child_process_1.execFileSync)('ps', ['-o', 'command=', '-p', String(pid)], {
+            encoding: 'utf-8',
+            timeout: 3000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        return out || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * "PID 875 (node dist/server/server.js), PID 876" — or null when no PID is visible.
+ */
+function describeListeners(port) {
+    const pids = findListeningPids(port);
+    if (pids.length === 0)
+        return null;
+    return pids
+        .map((pid) => {
+        const command = describeProcess(pid);
+        return command ? `PID ${pid} (${command.slice(0, 120)})` : `PID ${pid}`;
+    })
+        .join(', ');
+}

package/dist/cli/utils/remote-pairing.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Re-issue the pairing code of a live `commandmate remote` session (Issue #3127).
+ *
+ * `remote up` shows the pairing link once, as a QR code, and keeps only the
+ * code's HASH on disk (`pairing-code.ts`). When that QR is lost — an agent's
+ * chat pane folds the output and cuts the QR off — the link cannot be shown
+ * again, because the plaintext code no longer exists anywhere. Before this
+ * module the only way back was `remote stop` + `remote`, which tears the
+ * Provider down and publishes a NEW URL.
+ *
+ * What this does instead: mint a fresh code and swap its hash into the
+ * existing handoff file, keeping the session token and the expiry. Nothing
+ * else changes — the server, the Provider and the public URL are untouched,
+ * and no new way in is created. The previous code stops working, because its
+ * hash is gone.
+ *
+ * ## Why the file is renamed away first
+ *
+ * The consumed flag is the ABSENCE of the handoff file: the server unlinks it
+ * on a successful pairing. A plain read-modify-write races with that — a
+ * pairing landing between our read and our write would see the file deleted,
+ * then recreated by us, and the already-paired session token would become
+ * pairable a second time. Renaming the file to a private name first is an
+ * atomic claim: if the rename fails with ENOENT the code was spent and we stop;
+ * if it succeeds the server can no longer consume it (it sees "absent", which
+ * answers 410 for the old code — the code we are about to replace anyway).
+ *
+ * ## Fail-closed
+ *
+ * Anything unreadable, malformed or already expired yields no code. A failure
+ * after the claim deletes the claimed file rather than guessing, so the worst
+ * case is "pairing is gone, run `remote stop` and `remote` again", never "a
+ * spent token is pairable again".
+ */
+/** Why no new code was issued. */
+export type PairingReissueFailure = 
+/** The handoff file is absent: the code was used (or never written). */
+'consumed'
+/** The code's window has closed. */
+ | 'expired'
+/** The file exists but could not be claimed or parsed. */
+ | 'unreadable'
+/** Claimed, but the new code could not be written. The pairing is gone. */
+ | 'write-failed';
+export type PairingReissueResult = {
+    ok: true;
+    /** Plaintext pairing code. Never persisted; the caller shows it and drops it. */
+    code: string;
+    /** Epoch ms, unchanged from the original code. */
+    expiresAt: number;
+} | {
+    ok: false;
+    reason: PairingReissueFailure;
+};
+/**
+ * @param filePath - Handoff file
+ * @returns The private name the file is claimed under while it is rewritten
+ */
+export declare function getReissueClaimPath(filePath: string): string;
+/**
+ * Replace the pairing code of an unused handoff file with a fresh one.
+ *
+ * @param filePath - Absolute path of the handoff file (`state.pairing.filePath`)
+ * @param now - Epoch ms, injectable for tests
+ * @returns The new code and its (unchanged) expiry, or why there is none
+ */
+export declare function reissuePairingCode(filePath: string, now?: number): PairingReissueResult;
+//# sourceMappingURL=remote-pairing.d.ts.map

package/dist/cli/utils/remote-pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-pairing.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/remote-pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAYH,kCAAkC;AAClC,MAAM,MAAM,qBAAqB;AAC/B,wEAAwE;AACtE,UAAU;AACZ,oCAAoC;GAClC,SAAS;AACX,0DAA0D;GACxD,YAAY;AACd,2EAA2E;GACzE,cAAc,CAAC;AAEnB,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AA+BD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,oBAAoB,CAmCnG"}

package/dist/cli/utils/remote-pairing.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Re-issue the pairing code of a live `commandmate remote` session (Issue #3127).
+ *
+ * `remote up` shows the pairing link once, as a QR code, and keeps only the
+ * code's HASH on disk (`pairing-code.ts`). When that QR is lost — an agent's
+ * chat pane folds the output and cuts the QR off — the link cannot be shown
+ * again, because the plaintext code no longer exists anywhere. Before this
+ * module the only way back was `remote stop` + `remote`, which tears the
+ * Provider down and publishes a NEW URL.
+ *
+ * What this does instead: mint a fresh code and swap its hash into the
+ * existing handoff file, keeping the session token and the expiry. Nothing
+ * else changes — the server, the Provider and the public URL are untouched,
+ * and no new way in is created. The previous code stops working, because its
+ * hash is gone.
+ *
+ * ## Why the file is renamed away first
+ *
+ * The consumed flag is the ABSENCE of the handoff file: the server unlinks it
+ * on a successful pairing. A plain read-modify-write races with that — a
+ * pairing landing between our read and our write would see the file deleted,
+ * then recreated by us, and the already-paired session token would become
+ * pairable a second time. Renaming the file to a private name first is an
+ * atomic claim: if the rename fails with ENOENT the code was spent and we stop;
+ * if it succeeds the server can no longer consume it (it sees "absent", which
+ * answers 410 for the old code — the code we are about to replace anyway).
+ *
+ * ## Fail-closed
+ *
+ * Anything unreadable, malformed or already expired yields no code. A failure
+ * after the claim deletes the claimed file rather than guessing, so the worst
+ * case is "pairing is gone, run `remote stop` and `remote` again", never "a
+ * spent token is pairable again".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getReissueClaimPath = getReissueClaimPath;
+exports.reissuePairingCode = reissuePairingCode;
+const fs_1 = require("fs");
+const auth_1 = require("../../lib/security/auth");
+const pairing_code_1 = require("../../lib/security/pairing-code");
+/**
+ * @param filePath - Handoff file
+ * @returns The private name the file is claimed under while it is rewritten
+ */
+function getReissueClaimPath(filePath) {
+    return `${filePath}.reissue-${process.pid}`;
+}
+/**
+ * Best-effort unlink. A missing file is the state we wanted.
+ *
+ * @param filePath - File to remove
+ */
+function removeQuietly(filePath) {
+    try {
+        (0, fs_1.unlinkSync)(filePath);
+    }
+    catch {
+        // Already gone.
+    }
+}
+/**
+ * Put a claimed file back where the server reads it. When that fails the
+ * claimed copy is deleted: an orphan holding the plaintext token is worse than
+ * a pairing that has to be started again.
+ *
+ * @param claimPath - Where the file was claimed to
+ * @param filePath - Where the server expects it
+ */
+function restoreClaim(claimPath, filePath) {
+    try {
+        (0, fs_1.renameSync)(claimPath, filePath);
+    }
+    catch {
+        removeQuietly(claimPath);
+    }
+}
+/**
+ * Replace the pairing code of an unused handoff file with a fresh one.
+ *
+ * @param filePath - Absolute path of the handoff file (`state.pairing.filePath`)
+ * @param now - Epoch ms, injectable for tests
+ * @returns The new code and its (unchanged) expiry, or why there is none
+ */
+function reissuePairingCode(filePath, now = Date.now()) {
+    const claimPath = getReissueClaimPath(filePath);
+    try {
+        (0, fs_1.renameSync)(filePath, claimPath);
+    }
+    catch (error) {
+        const code = error?.code;
+        return { ok: false, reason: code === 'ENOENT' ? 'consumed' : 'unreadable' };
+    }
+    const handoff = (0, pairing_code_1.readPairingHandoff)(claimPath);
+    if (handoff === null) {
+        restoreClaim(claimPath, filePath);
+        return { ok: false, reason: 'unreadable' };
+    }
+    if ((0, pairing_code_1.isPairingExpired)(handoff, now)) {
+        restoreClaim(claimPath, filePath);
+        return { ok: false, reason: 'expired' };
+    }
+    const code = (0, pairing_code_1.generatePairingCode)();
+    try {
+        (0, pairing_code_1.writePairingHandoff)(claimPath, {
+            pairingHash: (0, auth_1.hashToken)(code),
+            expiresAt: handoff.expiresAt,
+            sessionToken: handoff.sessionToken,
+        });
+        (0, fs_1.renameSync)(claimPath, filePath);
+    }
+    catch {
+        removeQuietly(claimPath);
+        return { ok: false, reason: 'write-failed' };
+    }
+    return { ok: true, code, expiresAt: handoff.expiresAt };
+}

package/dist/cli/utils/reply-ledger.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Reading an agent's reply out of the chat ledger (Issue #2376 / #2386 / #3039)
+ *
+ * `ask` reads the reply after its own turn; `reply` (Issue #3039) reads the
+ * latest reply of a turn somebody else sent — a worker told to "stop and
+ * report" by a supervisor nudge. Both mean the same thing by "the reply", so
+ * the rules live here once rather than in two commands that can drift:
+ *
+ * - only assistant rows in `GET /api/worktrees/:id/messages` are candidates,
+ *   prompt rows excluded;
+ * - CommandMate's own furniture (`relay-sys:` / `model-changed:`) is never an
+ *   answer;
+ * - a row a transcript reader wrote (`<tool>-turn:<id>`) wins over a scrape;
+ * - ANSI escapes and control bytes are dropped before the text is returned.
+ *
+ * What differs between the two callers — how long to hold out for a turn row,
+ * and whether an unmarked row may stand in for one — stays with the caller.
+ */
+import type { PromptMessageResponse } from '../types/api-responses';
+import type { ApiClient } from './api-client';
+/**
+ * Chat rows read back per request.
+ *
+ * Bounded because only the tail matters and an unbounded read of a long-running
+ * worktree's history is a large response for one line of answer. Generous
+ * enough that a turn which wrote several assistant rows (a tool-use narration
+ * followed by the summary) still has its last one inside the window.
+ */
+export declare const REPLY_LOOKBACK_MESSAGES = 30;
+/**
+ * Tools whose reply CommandMate reads out of a transcript rather than a screen.
+ *
+ * For these five the ledger is authoritative and a row with no turn marker is
+ * by definition not the answer. For every other tool (copilot / gemini /
+ * vibe-local) the scraper's row is the only record there will ever be.
+ *
+ * Mirrors the five readers that live under `src/lib/hooks/sources/`.
+ */
+export declare const TRANSCRIPT_READER_TOOLS: ReadonlySet<string>;
+/**
+ * A reply body fit to print, or `''` if nothing survived.
+ *
+ * Issue #2386 asked for this as a belt to the braces: the row the junk came
+ * from held RAW ANSI, and a caller that pipes a reply into a report or a commit
+ * message should never have to strip escape codes out of an agent's sentence.
+ *
+ * @param raw - Reply text as it arrived
+ */
+export declare function sanitizeReply(raw: string): string;
+/** One assistant row that could be the reply. */
+export interface ReplyCandidate {
+    /** Sanitized body. Never empty — an empty one is not a candidate. */
+    content: string;
+    /** Whether a transcript reader wrote it (see {@link isTurnRow}). */
+    fromTranscript: boolean;
+    /** The row's `request_id`, or null when the producer had none. */
+    requestId: string | null;
+    /** The row's own timestamp, as the messages route serialized it. */
+    at: string;
+}
+/**
+ * The rows that could be a reply written at or after `since`, oldest first.
+ *
+ * @param messages - Rows as the messages route serialized them
+ * @param since - Epoch ms; rows stamped earlier are not candidates
+ */
+export declare function replyCandidates(messages: PromptMessageResponse[], since: number): ReplyCandidate[];
+/**
+ * The newest reply among `candidates`, or null.
+ *
+ * Newest first among the rows a reader wrote: a turn that emitted several
+ * assistant rows (a narration then the summary) still ends on its summary.
+ * When `turnRowsOnly` is false and no reader wrote anything, the newest row of
+ * any kind is taken — the only record a tool without a transcript has.
+ *
+ * @param candidates - Output of {@link replyCandidates}
+ * @param turnRowsOnly - Whether an unmarked (scraped) row may stand in
+ */
+export declare function pickLatestReply(candidates: ReplyCandidate[], turnRowsOnly: boolean): ReplyCandidate | null;
+/**
+ * The recent chat rows for this instance. Throws what the API client throws.
+ *
+ * @param client - API client
+ * @param worktreeId - Worktree ID
+ * @param instanceId - Resolved instance ID, or undefined for every instance
+ */
+export declare function requestRecentMessages(client: ApiClient, worktreeId: string, instanceId: string | undefined): Promise<PromptMessageResponse[]>;
+/**
+ * {@link requestRecentMessages}, or null if the rows cannot be read.
+ *
+ * For a caller whose turn already completed: a daemon that cannot serve the
+ * ledger is a reason to fall back, not a reason to lose the turn.
+ */
+export declare function fetchRecentMessages(client: ApiClient, worktreeId: string, instanceId: string | undefined): Promise<PromptMessageResponse[] | null>;
+//# sourceMappingURL=reply-ledger.d.ts.map

package/dist/cli/utils/reply-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reply-ledger.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/reply-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AA4B1C;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAMtD,CAAC;AAcH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAaD,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,qBAAqB,EAAE,EACjC,KAAK,EAAE,MAAM,GACZ,cAAc,EAAE,CAkBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,cAAc,EAAE,EAC5B,YAAY,EAAE,OAAO,GACpB,cAAc,GAAG,IAAI,CAMvB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAUlC;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAMzC"}