cursor-route 0.1.1 → 0.1.5

package/src/jobs.ts

@@ -98,10 +98,21 @@ export function writeJob(job: Job): void {
 function pidAlive(pid: number): boolean {
   try {
     process.kill(pid, 0);
-    return true;
   } catch {
     return false;
   }
+  // kill(pid, 0) stays true for zombies, and terminatePid's sync waits block the
+  // event loop so children can sit unreaped as zombies — a zombie is not a worker.
+  try {
+    const r = spawnSync("ps", ["-o", "state=", "-p", String(pid)], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    const state = (r.stdout || "").trim();
+    return state !== "" && !state.startsWith("Z");
+  } catch {
+    return true;
+  }
 }
 
 function sleepMs(ms: number): void {
@@ -169,6 +180,25 @@ export function refreshStatus(job: Job): Job {
   return job;
 }
 
+export function countActiveJobs(): number {
+  ensureJobsDir();
+  let n = 0;
+  for (const f of readdirSync(config.jobsDir)) {
+    if (!f.endsWith(".json")) continue;
+    const id = f.replace(/\.json$/, "");
+    if (!JOB_ID_RE.test(id)) continue;
+    try {
+      const job = JSON.parse(readFileSync(join(config.jobsDir, f), "utf8")) as Job;
+      if (job?.schema === "cursor-route.job.v1" && (job.status === "running" || job.status === "pending")) {
+        n++;
+      }
+    } catch {
+      /* skip */
+    }
+  }
+  return n;
+}
+
 export function listJobs(limit = config.jobsListLimit): Job[] {
   ensureJobsDir();
   const files = readdirSync(config.jobsDir).filter(
@@ -211,10 +241,21 @@ export function startJob(opts: StartOptions): {
 } | { ok: false; error: string } {
   const worker = resolveWorker(opts);
   const cwd = opts.cwd || process.cwd();
+  // CURSOR_ROUTE_ASK applies to all workers; CLAUDE_DS_ASK is mid-lane only
   const alwaysApprove =
     opts.alwaysApprove !== false &&
     process.env.CURSOR_ROUTE_ASK !== "1" &&
-    process.env.CLAUDE_DS_ASK !== "1";
+    !(worker === "claude-ds" && process.env.CLAUDE_DS_ASK === "1");
+
+  if (!opts.dryRun) {
+    const active = countActiveJobs();
+    if (active >= config.maxConcurrentJobs) {
+      return {
+        ok: false,
+        error: `Too many active jobs (${active} >= ${config.maxConcurrentJobs}) — wait for jobs to finish or raise CURSOR_ROUTE_MAX_JOBS`,
+      };
+    }
+  }
 
   // Preflight: requested worker must be healthy
   const adapter = getAdapter(worker);
@@ -235,6 +276,11 @@ export function startJob(opts: StartOptions): {
       alwaysApprove,
     });
   } catch (e) {
+    try {
+      unlinkSync(paths.prompt);
+    } catch {
+      /* ignore */
+    }
     return { ok: false, error: (e as Error).message };
   }
 
@@ -258,7 +304,15 @@ export function startJob(opts: StartOptions): {
     } catch {
       /* ignore */
     }
-    return { ok: true, job, dryRun: true, command: plan.command };
+    const envNote = plan.env
+      ? ` (+env: ${Object.keys(plan.env).join(",")})`
+      : "";
+    return {
+      ok: true,
+      job,
+      dryRun: true,
+      command: plan.command + envNote,
+    };
   }
 
   const here = dirname(fileURLToPath(import.meta.url));
@@ -293,6 +347,7 @@ export function startJob(opts: StartOptions): {
       cwd,
       detached: true,
       stdio: ["ignore", logFd, logFd],
+      env: plan.env ? { ...process.env, ...plan.env } : process.env,
     });
     try {
       closeSync(logFd);
@@ -308,8 +363,13 @@ export function startJob(opts: StartOptions): {
       return { ok: false, error: job.error };
     }
 
-    job.pid = child.pid;
-    writeJob(job);
+    // Merge-on-write: only set pid if still running (avoid clobbering mark-complete)
+    const latest = readJob(id) || job;
+    if (latest.status === "running" || latest.status === "pending") {
+      latest.pid = child.pid;
+      writeJob(latest);
+      Object.assign(job, latest);
+    }
     child.unref();
     return { ok: true, job };
   }
@@ -321,6 +381,7 @@ export function startJob(opts: StartOptions): {
     logFile: paths.log,
     jobFile: paths.json,
     markCompleteScript: markComplete,
+    env: plan.env,
   });
 
   if (!created.ok) {
@@ -331,14 +392,22 @@ export function startJob(opts: StartOptions): {
     return { ok: false, error: created.error };
   }
 
-  writeJob(job);
-  return { ok: true, job };
+  // Re-read before final write — mark-complete may have already finished
+  const after = readJob(id) || job;
+  if (after.status === "running" || after.status === "pending") {
+    writeJob(after);
+  }
+  return { ok: true, job: after };
 }
 
 export function killJob(id: string): { ok: true; job: Job } | { ok: false; error: string } {
   const job = readJob(id);
   if (!job) return { ok: false, error: `Job not found: ${id}` };
 
+  if (job.status === "completed" || job.status === "failed" || job.status === "killed") {
+    return { ok: false, error: `Job already terminal (${job.status}) — refuse kill rewrite` };
+  }
+
   if (job.tmuxSession.startsWith("headless-")) {
     if (job.pid) {
       const ok = terminatePid(job.pid);
@@ -358,10 +427,15 @@ export function killJob(id: string): { ok: true; job: Job } | { ok: false; error
     }
   }
 
-  job.status = "killed";
-  job.completedAt = new Date().toISOString();
-  writeJob(job);
-  return { ok: true, job };
+  // Merge-on-write: do not clobber a completion that landed mid-kill
+  const latest = readJob(id) || job;
+  if (latest.status === "completed" || latest.status === "failed") {
+    return { ok: false, error: `Job finished during kill (${latest.status})` };
+  }
+  latest.status = "killed";
+  latest.completedAt = new Date().toISOString();
+  writeJob(latest);
+  return { ok: true, job: latest };
 }
 
 export function cleanJobs(olderThanDays = 7): number {

package/src/mark-complete.ts

@@ -4,6 +4,7 @@
  * Invoked from tmux / headless completion hooks — keep dep-free.
  */
 import { readFileSync, writeFileSync } from "node:fs";
+import { redactSecrets } from "./secrets.ts";
 
 const jobPath = process.argv[2];
 const exitCode = Number(process.argv[3] ?? "1");
@@ -24,12 +25,7 @@ try {
       try {
         const log = readFileSync(logPath, "utf8");
         job.logBytes = Buffer.byteLength(log);
-        // Avoid retaining secret-looking tails in job metadata
-        const redacted = log
-          .replace(/\bsk-[a-zA-Z0-9]{20,}\b/g, "[REDACTED]")
-          .replace(/\bghp_[A-Za-z0-9]{20,}\b/g, "[REDACTED]")
-          .replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi, "[REDACTED]");
-        job.logTail = redacted.slice(-2000);
+        job.logTail = redactSecrets(log).slice(-2000);
       } catch {
         /* ignore */
       }

package/src/openrouter-run.ts

@@ -0,0 +1,102 @@
+#!/usr/bin/env bun
+/**
+ * One-shot OpenRouter easy-lane runner — reads a prompt file and POSTs it to
+ * OpenRouter's chat/completions, printing the assistant reply to stdout.
+ * No runtime npm deps (Node 20+ global fetch). Invoked by the openrouter
+ * adapter (dist via node, else src via bun). Never echoes OPENROUTER_API_KEY.
+ */
+import { readFileSync } from "node:fs";
+import { openRouterModel, openRouterBaseUrl } from "./config.ts";
+import { looksLikeSecretMaterial } from "./secrets.ts";
+
+const SYSTEM_PROMPT =
+  "You are a drafting/rewrite helper for cursor-route. Never invent credentials, API keys, or secrets; if asked for secret material, refuse. Provide educational, general-purpose help.";
+
+function fail(msg: string, code: number): never {
+  console.error(`cursor-route/openrouter-run: ${msg}`);
+  process.exit(code);
+}
+
+function parseArgs(argv: string[]): { promptFile?: string } {
+  const flags: { promptFile?: string } = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h" || a === "--help") {
+      console.log(
+        "usage: cursor-route/openrouter-run --prompt-file <path>\n" +
+          "env: OPENROUTER_API_KEY (required), CURSOR_ROUTE_OPENROUTER_MODEL, OPENROUTER_BASE_URL",
+      );
+      process.exit(0);
+    }
+    if (a === "--prompt-file") {
+      const v = argv[i + 1];
+      if (!v || v.startsWith("--")) fail("--prompt-file requires a value", 2);
+      flags.promptFile = v;
+      i++;
+    } else if (a.startsWith("--prompt-file=")) {
+      flags.promptFile = a.slice("--prompt-file=".length);
+    } else {
+      fail(`unknown argument: ${a}`, 2);
+    }
+  }
+  return flags;
+}
+
+async function main(): Promise<void> {
+  const { promptFile } = parseArgs(process.argv.slice(2));
+  if (!promptFile) fail("--prompt-file <path> is required", 2);
+
+  let prompt: string;
+  try {
+    prompt = readFileSync(promptFile, "utf8");
+  } catch (e) {
+    fail(`cannot read prompt file: ${(e as Error).message}`, 2);
+  }
+  if (!prompt.trim()) fail("prompt file is empty", 2);
+  if (looksLikeSecretMaterial(prompt)) {
+    fail("refusing prompt: looks like secret key material — easy lane is for non-secret drafts", 3);
+  }
+
+  const apiKey = process.env.OPENROUTER_API_KEY;
+  if (!apiKey) fail("OPENROUTER_API_KEY is not set", 2);
+
+  const base = openRouterBaseUrl().replace(/\/+$/, "");
+  const url = `${base}/chat/completions`;
+
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+        // OpenRouter etiquette: identify the app so the provider can see usage source.
+        "HTTP-Referer": "https://github.com/cemini23/cursor-route",
+        "X-Title": "cursor-route",
+      },
+      body: JSON.stringify({
+        model: openRouterModel(),
+        messages: [
+          { role: "system", content: SYSTEM_PROMPT },
+          { role: "user", content: prompt },
+        ],
+      }),
+    });
+  } catch (e) {
+    fail(`network error calling ${url}: ${(e as Error).message}`, 1);
+  }
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    fail(`OpenRouter API ${res.status}: ${body.slice(0, 500)}`, 1);
+  }
+
+  const json = (await res.json()) as {
+    choices?: Array<{ message?: { content?: string } }>;
+  };
+  const content = json.choices?.[0]?.message?.content ?? "";
+  if (!content) fail("OpenRouter returned no assistant content", 1);
+  process.stdout.write(content.endsWith("\n") ? content : content + "\n");
+}
+
+main().catch((e) => fail(e instanceof Error ? e.message : String(e), 1));

package/src/runtime.ts

@@ -1,17 +1,22 @@
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { existsSync } from "node:fs";
 import { commandExists, shellQuote } from "./util.ts";
 
 /**
- * Resolve how to re-invoke TypeScript helpers (mark-complete) from shell hooks.
- * Prefer bun; else pinned npx tsx — never bare network-unpinned without note.
+ * Resolve how to re-invoke the completion hook (mark-complete) from shell hooks.
+ * Prefer compiled dist via node (no loader); else Bun on src. No npx/tsx on the
+ * happy path — surface a clear failure if neither is available.
  */
 export function markCompleteInvoker(scriptPath: string): string {
+  const compiled = scriptPath.replace(/\.ts$/, ".js");
+  if (existsSync(compiled)) {
+    return `node ${shellQuote(compiled)}`;
+  }
   if (commandExists("bun")) {
     return `bun ${shellQuote(scriptPath)}`;
   }
-  // Pin tsx major for supply-chain predictability on Node-only hosts
-  return `npx --yes tsx@4.19.4 ${shellQuote(scriptPath)}`;
+  return `sh -c 'echo "cursor-route: completion hook needs a compiled dist or Bun (run bun run build)" >&2; exit 1'`;
 }
 
 /** XDG-ish default away from git-clone install dir (~/.cursor-route). */

package/src/secrets.ts

@@ -1,19 +1,36 @@
 /**
  * Secret material detectors — match key *contents*, not the phrase "API key".
- * Applied to `start` and `send`.
+ * Applied to `start` and `send`, and reused for log-tail redaction.
  */
-const PATTERNS: RegExp[] = [
+export const SECRET_PATTERNS: RegExp[] = [
+  // OpenAI / DeepSeek legacy + project / Anthropic hyphenated keys
   /\bsk-[a-zA-Z0-9]{20,}\b/,
+  /\bsk-(?:proj|ant|oai)-[A-Za-z0-9_-]{16,}\b/,
+  /\bsk-[a-zA-Z0-9-]{20,}\b/,
   /\bghp_[A-Za-z0-9]{20,}\b/,
   /\bgho_[A-Za-z0-9]{20,}\b/,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/,
   /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/i,
+  /\bxai-[A-Za-z0-9_-]{20,}\b/,
   /\bAIza[0-9A-Za-z_-]{20,}\b/,
-  /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/,
+  /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/,
   /\bAKIA[0-9A-Z]{16}\b/,
+  /hooks\.slack\.com\/services\/[A-Za-z0-9/_-]+/i,
 ];
 
 export function looksLikeSecretMaterial(text: string): boolean {
-  return PATTERNS.some((re) => re.test(text));
+  return SECRET_PATTERNS.some((re) => re.test(text));
+}
+
+/** Redact secret-looking spans for job metadata / log tails. */
+export function redactSecrets(text: string): string {
+  let out = text;
+  for (const re of SECRET_PATTERNS) {
+    // Clone with global flag so we replace all matches
+    const flags = re.flags.includes("g") ? re.flags : `${re.flags}g`;
+    out = out.replace(new RegExp(re.source, flags), "[REDACTED]");
+  }
+  return out;
 }
 
 export const JOB_ID_RE = /^[a-f0-9]{8}$/;

package/src/tmux.ts

@@ -49,10 +49,14 @@ export function capturePane(name: string, lines = 50): string {
 
 export function sendKeys(name: string, message: string): boolean {
   if (!sessionExists(name)) return false;
+  // Reject embedded newlines — they would submit early even with -l
+  if (/[\r\n]/.test(message)) return false;
   try {
-    execSync(`tmux send-keys -t ${shellQuote(name)} -- ${shellQuote(message)}`, {
-      stdio: "ignore",
-    });
+    // -l = literal keys (so "C-c" types text, does not SIGINT the worker)
+    execSync(
+      `tmux send-keys -l -t ${shellQuote(name)} -- ${shellQuote(message)}`,
+      { stdio: "ignore" },
+    );
     spawnSync("sleep", ["0.25"]);
     execSync(`tmux send-keys -t ${shellQuote(name)} Enter`, { stdio: "ignore" });
     return true;
@@ -86,6 +90,7 @@ export function createWorkerSession(options: {
   logFile: string;
   jobFile: string;
   markCompleteScript: string;
+  env?: Record<string, string>;
 }): { ok: true; session: string } | { ok: false; error: string } {
   const name = sessionName(options.jobId);
   const isLinux = process.platform === "linux";
@@ -107,11 +112,18 @@ export function createWorkerSession(options: {
     ? `script -q -e -c ${shellQuote(`/bin/sh -c ${shellQuote(options.workerCmd)}`)} ${shellQuote(options.logFile)}; ${completion}`
     : `script -q ${shellQuote(options.logFile)} /bin/sh -c ${shellQuote(options.workerCmd)}; ${completion}`;
 
-  const r = spawnSync(
-    "tmux",
-    ["new-session", "-d", "-s", name, "-c", options.cwd, wrapped],
-    { encoding: "utf8", cwd: options.cwd },
-  );
+  const args = ["new-session", "-d", "-s", name, "-c", options.cwd];
+  if (options.env) {
+    for (const [k, v] of Object.entries(options.env)) {
+      args.push("-e", `${k}=${v}`);
+    }
+  }
+  args.push(wrapped);
+
+  const r = spawnSync("tmux", args, {
+    encoding: "utf8",
+    cwd: options.cwd,
+  });
 
   if (r.status !== 0) {
     return {

package/src/util.ts

@@ -13,7 +13,9 @@ export function newJobId(): string {
 
 export function commandExists(cmd: string): boolean {
   try {
-    const r = spawnSync("sh", ["-c", `command -v ${cmd}`], { encoding: "utf8" });
+    const r = spawnSync("sh", ["-c", `command -v ${shellQuote(cmd)}`], {
+      encoding: "utf8",
+    });
     return r.status === 0 && Boolean(r.stdout?.trim());
   } catch {
     return false;

package/docs/audit-2026-08-10-sol-grok-kimi.md

@@ -1,64 +0,0 @@
-# Cursor audit — cursor-route v0.1.0→0.1.1
-
-**Mode:** `code-debug` · **Roles → models:** code-implementation→`gpt-5.6-sol-medium`, adversarial→`cursor-grok-4.5-high-fast`, third-lens→`kimi-k3-max`
-
-Auditors: [Sol](fad461d6-9be9-421e-b42e-081cd7888a56) · [Grok](79e70632-1de7-456e-871b-cdb66b7b72f1) · [Kimi](9a0b224f-eacf-4a2f-969c-6854db1d6876)
-
-## Verdict rollup (pre-fix)
-
-| Model | Verdict |
-|-------|---------|
-| GPTSOL | FAIL |
-| Cursor Grok | FAIL |
-| Kimi 3 | WARN |
-
-**Overall (pre-fix):** REWORK — then SHIP-WITH-FIXES after 0.1.1.
-
-## Consensus (≥2 auditors)
-
-1. Headless `kill` did not kill (no PID) — phantom killed
-2. `refreshStatus` inferred `completed` from missing tmux — lies on `--no-tmux`
-3. Completion hooks hard-coded `bun` vs Node fallback
-4. macOS `script` left `cd && …` unquoted
-5. Stock `claude` silent fallback for “claude-ds”
-6. Secret deny false-positive on prose “API key”; `send` bypass
-7. Missing DeepSeek setup docs / mid-lane dead end for public users
-8. Skill `/route` collision with federation `/route`
-
-## Unique
-
-- [Sol] Job-id path traversal; dry-run side effects; race before `running` write
-- [Grok] Always-approve + skill contract burns private SIP/verify; Grok sandbox missing
-- [Kimi] No hero.gif; typecheck red; jobsDir collided with clone path; no CI
-
-## Conflicts
-
-| Topic | Sol | Grok | Kimi | Resolution |
-|-------|-----|------|------|------------|
-| Overall ship | FAIL | FAIL | WARN | Fix criticals then soft-launch; GIF still deferred |
-| Skill name `/route` | — | critical rename | — | Renamed triggers to `/route-orch` |
-
-## Fixes shipped in `20b1580` (v0.1.1)
-
-- PID-tracked headless spawn + polled terminate on `kill`
-- No phantom `completed` from session absence; exit via mark-complete / failed unknown
-- `markCompleteInvoker` (bun or pinned `tsx@4.19.4`)
-- macOS/Linux `script` always via `/bin/sh -c`
-- Stock Claude only with `CURSOR_ROUTE_ALLOW_STOCK_CLAUDE=1`
-- Material-only secret deny on `start` + `send`
-- XDG jobs dir `~/.local/share/cursor-route/jobs`
-- README DeepSeek setup; skill deconflict; CI workflow; `--version`; typecheck green
-
-## Verify after fix
-
-- 11/11 tests · `tsc --noEmit` clean
-- Headless claude-ds → `CURSOR_ROUTE_SMOKE_OK2` · `exitCode: 0`
-- Headless `kill` → `status: killed`
-- Prose “API key” dry-run allowed; `sk-…` refused exit 3
-
-## Still open (not tweet-blockers for soft launch)
-
-- Real tmux attach/send GIF (`docs/DEMO_GIF.md`) — needs `brew install tmux` (sudo)
-- npm publish
-- Grok Build balance for live grok demos
-- Optional: grok `--sandbox`, `wait` command, remove skill file duplicate via symlink