dsh-cliworker-now 0.7.6 → 0.7.7

package/lib/windows-account-launch.mjs

@@ -0,0 +1,47 @@
+// Windows account PTY bootstrap. No native CLI runs until its process has been
+// assigned to the separate lifecycle Job owner; no task sandbox is applied.
+import { accountInput } from './windows-account-stdio.mjs'
+import { fileURLToPath } from 'node:url'
+import { spawnNativeProcess } from './native-spawn.mjs'
+import { writeFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { setTimeout as delay } from 'node:timers/promises'
+import { nativeLaunchArgv } from './native-launch.mjs'
+process.umask(0o077)
+const [directory, encoded] = process.argv.slice(2)
+let requested
+try { requested = JSON.parse(Buffer.from(encoded, 'base64').toString('utf8')) } catch { process.exit(1) }
+if (!directory || !Array.isArray(requested) || !requested.length || requested.some(value => typeof value !== 'string')) process.exit(1)
+// This exact plugin wrapper only sets umask and delegates an argv array. This
+// helper already does both; avoid another GUI runtime losing console stdin.
+if (requested[0] === process.execPath && requested[1] === fileURLToPath(new URL('./private-launch.mjs', import.meta.url)))
+  requested = requested.slice(2)
+const until = Date.now() + 15_000
+while (!existsSync(join(directory, 'ready'))) {
+  if (Date.now() >= until) process.exit(1)
+  await delay(20)
+}
+// Keep ConPTY alive after the native command exits so Host can dispose its
+// native worker before closing the entire Job. Only the exit code is exposed.
+setInterval(() => {}, 1000)
+const recordExit = (code, signal) => {
+  const exitCode = Number.isInteger(code) ? code : 1
+  writeFileSync(join(directory, 'exit'), JSON.stringify({ exitCode, signal: signal ?? null }), { mode: 0o600 })
+}
+if (!existsSync(join(directory, 'cancel')) && !existsSync(join(directory, 'stop'))) {
+  try {
+    const [executable, ...argv] = nativeLaunchArgv(requested)
+    // Node-based CLI account UIs also need their own Electron stdin restored.
+    // This fixed preload is scoped to that child, never NODE_OPTIONS or Host.
+    if (executable === process.execPath && process.versions.electron)
+      argv.unshift('--import', new URL('./windows-account-stdio.mjs', import.meta.url).href)
+    // Keep the existing ConPTY handles; a GUI-subsystem parent must not cause
+    // the native CLI to present an additional Windows console window.
+    const child = spawnNativeProcess(executable, argv, { env: process.env, stdio: [accountInput, 1, 2] })
+    child.once('error', () => { process.stderr.write('CLI launch failed\r\n') })
+    child.once('close', recordExit)
+  } catch {
+    process.stderr.write('CLI launch failed\r\n')
+    recordExit(1)
+  }
+}

package/lib/windows-account-owner.ps1

@@ -0,0 +1,137 @@
+param([Parameter(Mandatory=$true)][string]$Directory, [Parameter(Mandatory=$true)][int]$HostProcessId)
+$ErrorActionPreference = 'Stop'
+# Fixed process ownership only: no resource, privilege, network, or filesystem limits.
+Add-Type -TypeDefinition @'
+using System;
+using System.Diagnostics;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+public sealed class CwnAccountJob : IDisposable {
+ [StructLayout(LayoutKind.Sequential)] struct BasicLimits { public long ProcessTime, JobTime; public uint Flags; public UIntPtr MinWorking, MaxWorking; public uint ActiveLimit; public UIntPtr Affinity; public uint Priority, Scheduling; }
+ [StructLayout(LayoutKind.Sequential)] struct Io { public ulong ReadOps, WriteOps, OtherOps, ReadBytes, WriteBytes, OtherBytes; }
+ [StructLayout(LayoutKind.Sequential)] struct ExtendedLimits { public BasicLimits Basic; public Io Io; public UIntPtr ProcessMemory, JobMemory, PeakProcessMemory, PeakJobMemory; }
+ [StructLayout(LayoutKind.Sequential)] struct Accounting { public long User, Kernel, PeriodUser, PeriodKernel; public uint PageFaults, TotalProcesses, ActiveProcesses, TerminatedProcesses; }
+ [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern IntPtr CreateJobObject(IntPtr attr, string name);
+ [DllImport("kernel32.dll", SetLastError=true)] static extern bool SetInformationJobObject(IntPtr job, int kind, ref ExtendedLimits limits, uint size);
+ [DllImport("kernel32.dll", SetLastError=true)] static extern bool QueryInformationJobObject(IntPtr job, int kind, out Accounting info, uint size, IntPtr length);
+ [DllImport("kernel32.dll", SetLastError=true)] static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
+ [DllImport("kernel32.dll", SetLastError=true)] static extern bool TerminateJobObject(IntPtr job, uint code);
+ [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+ [DllImport("kernel32.dll")] static extern bool FreeConsole();
+ [DllImport("kernel32.dll", SetLastError=true)] static extern bool AttachConsole(uint pid);
+ [DllImport("kernel32.dll")] static extern IntPtr GetConsoleWindow();
+ [DllImport("user32.dll", SetLastError=true)] static extern uint GetWindowThreadProcessId(IntPtr window, out uint pid);
+ [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern IntPtr GetModuleHandle(string name);
+ [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr GetProcAddress(IntPtr module, IntPtr ordinal);
+ [UnmanagedFunctionPointer(CallingConvention.Winapi)] delegate uint RealWindowOwner(IntPtr window);
+ IntPtr job; Process root;
+ public CwnAccountJob() { job=CreateJobObject(IntPtr.Zero,null); if(job==IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error()); var l=new ExtendedLimits(); l.Basic.Flags=0x2000; if(!SetInformationJobObject(job,9,ref l,(uint)Marshal.SizeOf(l))) { var error=Marshal.GetLastWin32Error(); Dispose(); throw new Win32Exception(error); } }
+ public void Attach(int pid, DateTime receiptTime, DateTime earliest) { root=Process.GetProcessById(pid); var handle=root.Handle; var started=root.StartTime.ToUniversalTime(); if(started>receiptTime || started<earliest) throw new Exception("process identity changed"); if(!AssignProcessToJobObject(job,handle)) throw new Win32Exception(Marshal.GetLastWin32Error()); }
+ public static int ConsoleOwner(int pid) {
+  FreeConsole(); if(!AttachConsole((uint)pid)) throw new Win32Exception(Marshal.GetLastWin32Error());
+  try {
+   var window=GetConsoleWindow(); uint owner;
+   if(window==IntPtr.Zero || GetWindowThreadProcessId(window,out owner)==0 || owner==0) throw new Exception("console owner unavailable");
+   // Modern ConPTY gives its message-only window to the root client, not
+   // conhost: microsoft/terminal#14196. Resolve this same HWND's real owner
+   // using the maintainer's dynamic API from discussion #16447. The ordinal
+   // is not a stable public API; absence or an invalid result fails closed.
+   if(owner==(uint)pid) {
+    var module=GetModuleHandle("user32.dll");
+    var address=module==IntPtr.Zero?IntPtr.Zero:GetProcAddress(module,new IntPtr(2712));
+    if(address==IntPtr.Zero) throw new Exception("real console owner unavailable");
+    var getOwner=(RealWindowOwner)Marshal.GetDelegateForFunctionPointer(address,typeof(RealWindowOwner));
+    owner=getOwner(window);
+   }
+   if(owner==0 || owner>(uint)Int32.MaxValue || owner==(uint)pid) throw new Exception("console owner unavailable");
+   return (int)owner;
+  } finally { FreeConsole(); }
+ }
+ public string ConsoleIdentityReason { get; private set; }
+ public string ConsoleImageKind { get; private set; }
+ public bool ConsoleImageDevicePrefix { get; private set; }
+ public void AttachConsoleHost(int pid, DateTime latest, DateTime earliest) {
+  using(var p=Process.GetProcessById(pid)) {
+   var handle=p.Handle; var started=p.StartTime.ToUniversalTime();
+   var expected=System.IO.Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System),"conhost.exe");
+   if(started>latest) { ConsoleIdentityReason="after-receipt"; throw new Exception("console identity changed"); }
+   if(started<earliest) { ConsoleIdentityReason="before-directory"; throw new Exception("console identity changed"); }
+   var image=p.MainModule.FileName; var leaf=System.IO.Path.GetFileName(image);
+   ConsoleImageKind=String.Equals(leaf,"conhost.exe",StringComparison.OrdinalIgnoreCase)?"conhost.exe":String.Equals(leaf,"openconsole.exe",StringComparison.OrdinalIgnoreCase)?"openconsole.exe":"other";
+   ConsoleImageDevicePrefix=image!=null && (image.StartsWith(@"\\?\") || image.StartsWith(@"\??\"));
+   if(!String.Equals(image,expected,StringComparison.OrdinalIgnoreCase)) { ConsoleIdentityReason="wrong-image"; throw new Exception("console identity changed"); }
+   if(!AssignProcessToJobObject(job,handle)) throw new Win32Exception(Marshal.GetLastWin32Error());
+  }
+ }
+ public bool RootExited { get { return root.HasExited; } }
+ public void Stop() { if(!TerminateJobObject(job,143)) throw new Win32Exception(Marshal.GetLastWin32Error()); }
+ public bool Empty { get { Accounting a; if(!QueryInformationJobObject(job,1,out a,(uint)Marshal.SizeOf(typeof(Accounting)),IntPtr.Zero)) throw new Win32Exception(Marshal.GetLastWin32Error()); return a.ActiveProcesses==0; } }
+ public void Dispose() { if(job!=IntPtr.Zero) { CloseHandle(job); job=IntPtr.Zero; } if(root!=null) root.Dispose(); }
+}
+'@
+$job=$null
+$stage='await-bootstrap'
+$consolePid=$null
+$consoleParentPid=$null
+try {
+  $earliest=[System.IO.Directory]::GetCreationTimeUtc($Directory).AddSeconds(-1)
+  $pidFile=Join-Path $Directory 'pid'
+  $stopFile=Join-Path $Directory 'stop'
+  [System.IO.File]::WriteAllText((Join-Path $Directory 'owner-ready'),'owner-ready')
+  $until=[DateTime]::UtcNow.AddSeconds(15)
+  while (!(Test-Path -LiteralPath $pidFile)) {
+    if ([DateTime]::UtcNow -ge $until) { throw 'bootstrap timeout' }
+    Start-Sleep -Milliseconds 20
+  }
+  $childPid=0
+  if (![int]::TryParse([System.IO.File]::ReadAllText($pidFile),[ref]$childPid) -or $childPid -le 0) { throw 'invalid bootstrap receipt' }
+  $stage='create-job'
+  $job=New-Object CwnAccountJob
+  $stage='attach-root'
+  $job.Attach($childPid,[System.IO.File]::GetLastWriteTimeUtc($pidFile),$earliest)
+  # The ConPTY console is a sibling of the bootstrap, created by the Host.
+  # Resolve it through this exact console, then validate parent and creation
+  # identity before adding it; never enumerate/kill processes by image name.
+  $stage='resolve-console'
+  $consolePid=[CwnAccountJob]::ConsoleOwner($childPid)
+  $stage='validate-console-parent'
+  $console=Get-CimInstance Win32_Process -Filter "ProcessId=$consolePid"
+  if ($null -ne $console) { $consoleParentPid=$console.ParentProcessId }
+  if ($null -eq $console -or $console.ParentProcessId -ne $HostProcessId) { throw 'console owner mismatch' }
+  $stage='attach-console'
+  $job.AttachConsoleHost($consolePid,[System.IO.File]::GetLastWriteTimeUtc($pidFile),$earliest)
+  $stage='await-stop'
+  [System.IO.File]::WriteAllText((Join-Path $Directory 'ready'),'ready')
+  while (!$job.RootExited -and !(Test-Path -LiteralPath $stopFile)) { Start-Sleep -Milliseconds 50 }
+  $stage='stop-job'
+  $job.Stop()
+  $stage='confirm-empty'
+  $until=[DateTime]::UtcNow.AddSeconds(8)
+  while (!$job.Empty) {
+    if ([DateTime]::UtcNow -ge $until) { throw 'empty receipt timeout' }
+    Start-Sleep -Milliseconds 20
+  }
+  [System.IO.File]::WriteAllText((Join-Path $Directory 'closed'),'closed')
+  exit 0
+} catch {
+  # Fixed stage and numeric metadata only; no exception text/argv/environment.
+  $failure=@{ stage=$stage; hostPid=$HostProcessId; ownerPid=$PID }
+  if ($null -ne $consolePid) { $failure.consolePid=$consolePid }
+  if ($null -ne $consoleParentPid) { $failure.consoleParentPid=$consoleParentPid }
+  if ($null -ne $job -and $job.ConsoleIdentityReason -in @('before-directory','after-receipt','wrong-image')) {
+    $failure.identityReason=$job.ConsoleIdentityReason
+    if ($job.ConsoleImageKind -in @('conhost.exe','openconsole.exe','other')) {
+      $failure.imageKind=$job.ConsoleImageKind
+      $failure.imageDevicePrefix=$job.ConsoleImageDevicePrefix
+    }
+  }
+  $errorObject=$_.Exception
+  while ($null -ne $errorObject) {
+    if ($errorObject -is [System.ComponentModel.Win32Exception]) { $failure.win32Code=$errorObject.NativeErrorCode; break }
+    $errorObject=$errorObject.InnerException
+  }
+  try { [System.IO.File]::WriteAllText((Join-Path $Directory 'failure'),($failure | ConvertTo-Json -Compress)) } catch {}
+  # Fixed classification only: never emit native exception/context/environment.
+  [Console]::Error.WriteLine('Windows account process ownership failed')
+  exit 2
+} finally { if ($null -ne $job) { $job.Dispose() } }

package/lib/windows-account-stdio.mjs

@@ -0,0 +1,19 @@
+// Imported only by the Windows account-terminal runtime and its Electron CLI
+// child. Electron attaches stdout/stderr to the parent console, but its GUI
+// executable can leave fd 0 mapped to NUL. Reopen this already-owned console;
+// do not redirect stdin for task processes or change the shared Host.
+import { openSync, closeSync } from 'node:fs'
+import { isatty, ReadStream } from 'node:tty'
+export let accountInput = 0
+if (process.platform === 'win32' && !isatty(0)) {
+  try {
+    accountInput = openSync('\\\\.\\CONIN$', 'r+')
+    if (!isatty(accountInput)) throw new Error('not a console')
+    const input = new ReadStream(accountInput)
+    Object.defineProperty(process, 'stdin', { value: input, configurable: true })
+    process.once('exit', () => { try { closeSync(accountInput) } catch {} })
+  } catch {
+    if (accountInput) { try { closeSync(accountInput) } catch {} }
+    throw new Error('Windows account console input unavailable')
+  }
+}

package/lib/windows-agy-account.ps1

@@ -0,0 +1,81 @@
+# Read only Antigravity's own native Windows credential. Never emit its blob.
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+try {
+  Add-Type @'
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+public static class CwnAgyCredential {
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] struct Credential {
+    public uint Flags, Type;
+    public string TargetName, Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public uint CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public uint Persist, AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias, UserName;
+  }
+  [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  static extern bool CredRead(string target, uint type, uint flags, out IntPtr value);
+  [DllImport("advapi32.dll")] static extern void CredFree(IntPtr value);
+  public static string Read() {
+    IntPtr value;
+    if (!CredRead("gemini:antigravity", 1, 0, out value)) {
+      if (Marshal.GetLastWin32Error() == 1168) return null;
+      throw new Exception("Credential store unavailable");
+    }
+    byte[] bytes = null;
+    try {
+      var credential = (Credential)Marshal.PtrToStructure(value, typeof(Credential));
+      if (credential.CredentialBlobSize > 65536) throw new Exception("Invalid credential");
+      bytes = new byte[credential.CredentialBlobSize];
+      Marshal.Copy(credential.CredentialBlob, bytes, 0, bytes.Length);
+      return bytes.Length > 1 && bytes[1] == 0
+        ? new UnicodeEncoding(false, false, true).GetString(bytes)
+        : new UTF8Encoding(false, true).GetString(bytes);
+    } finally {
+      if (bytes != null) Array.Clear(bytes, 0, bytes.Length);
+      CredFree(value);
+    }
+  }
+}
+'@
+  $raw = [CwnAgyCredential]::Read()
+  if ($null -eq $raw) { @{ state = 'unconfigured' } | ConvertTo-Json -Compress; exit 0 }
+  $account = $raw | ConvertFrom-Json
+  $raw = $null
+  if ($account.auth_method -ne 'consumer' -or -not $account.token) {
+    @{ state = 'unknown' } | ConvertTo-Json -Compress; exit 0
+  }
+  $active = $false
+  if ($account.token.access_token -is [string] -and $account.token.access_token.Trim()) {
+    try { $active = [DateTimeOffset]::Parse($account.token.expiry) -gt [DateTimeOffset]::UtcNow } catch {}
+  }
+  $refreshable = $account.token.refresh_token -is [string] -and $account.token.refresh_token.Trim().Length -gt 0
+  if (-not $active -and -not $refreshable) {
+    @{ state = 'unauthenticated' } | ConvertTo-Json -Compress; exit 0
+  }
+  $result = @{ state = 'authenticated' }
+  if ($account.id_token -is [string] -and $account.id_token.Length -le 32768 -and $account.id_token -match '^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$') {
+    $encoded = $account.id_token.Split('.')[1].Replace('-','+').Replace('_','/')
+    $encoded = $encoded.PadRight($encoded.Length + ((4 - $encoded.Length % 4) % 4), '=')
+    $bytes = [Convert]::FromBase64String($encoded)
+    try { $claims = [Text.Encoding]::UTF8.GetString($bytes) | ConvertFrom-Json }
+    finally { [Array]::Clear($bytes, 0, $bytes.Length) }
+    if ($claims.iss -in @('accounts.google.com', 'https://accounts.google.com') -and $claims.sub -is [string] -and $claims.sub -match '^[A-Za-z0-9_-]{6,128}$') {
+      $hash = [Security.Cryptography.SHA256]::Create()
+      $principal = [Text.Encoding]::UTF8.GetBytes('google:' + $claims.sub)
+      try { $result.principalHash = ([BitConverter]::ToString($hash.ComputeHash($principal))).Replace('-','').ToLowerInvariant() }
+      finally { [Array]::Clear($principal, 0, $principal.Length); $hash.Dispose() }
+      if ($claims.email -is [string] -and $claims.email.Length -le 254 -and $claims.email -match '^[^\s<>@]+@[^\s<>@]+\.[^\s<>@]+$') { $result.email = $claims.email }
+    }
+  }
+  $account = $null; $claims = $null
+  $result | ConvertTo-Json -Compress
+} catch {
+  # Neither exception strings nor credential fragments cross the process boundary.
+  @{ state = 'unavailable' } | ConvertTo-Json -Compress
+  exit 1
+}

package/lib/windows-hidden-launch.mjs

@@ -0,0 +1,49 @@
+// A GUI-subsystem Electron root avoids Windows Terminal's console delegation.
+// The enclosing Harness Job still owns this root and every native descendant.
+import { Socket } from 'node:net'
+import { forwardNativeStdio, spawnNativeProcess } from './native-spawn.mjs'
+
+// Pinned Harness 0.2.0-rc.2 public control contract. This helper must remain
+// self-contained: an ordinary child does not use the Host's SDK module loader.
+const marker = process.env.DSH_SUBPROCESS_CONTROL
+delete process.env.DSH_SUBPROCESS_CONTROL
+if (marker !== 'pipe') throw new Error('Windows background control channel is unavailable')
+const control = new Socket({ fd: 7, readable: true, writable: true, allowHalfOpen: true })
+let child, sent = false
+function receipt(value) {
+  if (sent) return
+  sent = true
+  control.end(JSON.stringify(value) + '\n', () => control.destroy())
+}
+control.on('error', () => {
+  child?.kill('SIGTERM')
+  process.exitCode = 1
+})
+try {
+  const [encoded, executable, ...argv] = process.argv.slice(2)
+  const restore = JSON.parse(encoded)
+  if (!restore || !Object.hasOwn(restore, 'nodeEnv') ||
+      (restore.nodeEnv !== null && typeof restore.nodeEnv !== 'string') || !executable)
+    throw new Error('Invalid fixed bootstrap arguments')
+  if (restore.privateUmask === true) process.umask(0o077)
+  // ELECTRON_RUN_AS_NODE belongs only to this GUI bootstrap. Preserve the
+  // original target environment, including an explicit deletion of that value.
+  const env = { ...process.env }
+  for (const key of Object.keys(env))
+    if (key.toUpperCase() === 'ELECTRON_RUN_AS_NODE') delete env[key]
+  if (restore.nodeEnv !== null) env.ELECTRON_RUN_AS_NODE = restore.nodeEnv
+  child = spawnNativeProcess(executable, argv, { env, stdio: ['pipe', 'pipe', 'pipe'], detached: false })
+  forwardNativeStdio(child)
+  child.once('error', error => receipt({
+    kind: 'spawn-error',
+    code: ['ENOENT', 'EACCES', 'ENOEXEC', 'EINVAL'].includes(error.code) ? error.code : 'UNKNOWN',
+  }))
+  // A descendant may keep these pipes open after the native parent exits.
+  // Report its actual exit now; keep forwarding bytes until the pipes close.
+  // The Host's original Job remains responsible for the entire process range.
+  child.once('exit', (exitCode, signal) => receipt({ kind: 'exit', exitCode, signal }))
+  for (const signal of ['SIGTERM', 'SIGINT'])
+    process.on(signal, () => child.kill(signal))
+} catch {
+  receipt({ kind: 'spawn-error', code: 'UNKNOWN' })
+}

package/lib/zcode-resume.mjs

@@ -1,7 +1,7 @@
 // ZCode ignores configured defaults on --resume. Apply the selected native model
 // through metadata RPC, close the server completely, then run the original argv.
 // The Host owns the surrounding Seatbelt and process range; never detach or shell.
-import { spawn } from 'node:child_process'
+import { spawnNativeProcess } from './native-spawn.mjs'
 import { constants } from 'node:fs'
 import { open, lstat, realpath, unlink } from 'node:fs/promises'
 import { dirname, isAbsolute, resolve } from 'node:path'
@@ -25,7 +25,7 @@ const checkActive = () => {
 
 function start(argv, project, pipes) {
   checkActive()
-  const child = spawn(argv[0], argv.slice(1), {
+  const child = spawnNativeProcess(argv[0], argv.slice(1), {
     cwd: project,
     env: process.env,
     detached: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cliworker-now",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Multiple agent CLI conversations in the DeepSeek Harness sidebar",
   "type": "module",
   "license": "MIT",