evolcore 0.0.12 → 0.0.14

package/dist/agents/codex-app-server-client.js

@@ -6,8 +6,8 @@ import { resolveCodexLaunchCommand } from '../utils/codex-cli.js';
 import { createHash } from 'crypto';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
 import fs from 'fs';
-import os from 'os';
 import path from 'path';
+import { ensureProcessManagedTempDir } from '../cli/task-context.js';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { registerCodexAppServerProcess, unregisterCodexAppServerProcess, } from '../utils/codex-app-server-registry.js';
 const BUILT_IN_CODEX_PROVIDER_IDS = new Set(['openai']);
@@ -30,6 +30,22 @@ function runtimeProviderId(baseUrl) {
     const digest = createHash('sha256').update(baseUrl || 'default').digest('hex').slice(0, 12);
     return `evolcore_runtime_${digest}`;
 }
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'undefined';
+}
+function serverRequestFingerprint(request) {
+    return createHash('sha256')
+        .update(`${request.method}\n${stableJson(request.params)}`)
+        .digest('hex');
+}
 function hasPermissionProfile(config) {
     if (!config || typeof config.default_permissions !== 'string' || !config.default_permissions)
         return false;
@@ -41,6 +57,7 @@ export class CodexAppServerClient {
     options;
     proc = null;
     pending = new Map();
+    serverRequestReplays = new Map();
     notificationHandlers = new Set();
     nextId = 1;
     initialized = false;
@@ -281,6 +298,9 @@ export class CodexAppServerClient {
             includeLayers: false,
         });
     }
+    async configRequirementsRead() {
+        return this.request('configRequirements/read');
+    }
     async pluginInstalled(cwd) {
         return this.request('plugin/installed', {
             ...(cwd ? { cwds: [cwd] } : {}),
@@ -305,6 +325,7 @@ export class CodexAppServerClient {
             pending.reject(new Error('Codex app-server closed'));
         }
         this.pending.clear();
+        this.serverRequestReplays.clear();
         if (!proc) {
             this.cleanupManagedHookRuntime();
             return;
@@ -361,7 +382,25 @@ export class CodexAppServerClient {
             this.initializing = null;
         }
     }
+    async assertManagedHooksAvailable() {
+        await this.ensureStarted();
+        if (process.platform !== 'win32')
+            return;
+        try {
+            await this.verifyWindowsManagedHooks();
+        }
+        catch (error) {
+            // Do not leave an unverified app-server alive after a fail-closed check.
+            await this.close();
+            throw error;
+        }
+    }
     startProcess() {
+        // Linux managed hooks need a private runtime even when the daemon was
+        // launched by a service manager that did not export TMPDIR.
+        if (process.platform === 'linux' && !process.env.TMPDIR?.trim()) {
+            ensureProcessManagedTempDir();
+        }
         const env = this.buildProcessEnvironment();
         const args = this.buildProcessArgs();
         const launchCommand = resolveCodexLaunchCommand(args);
@@ -430,7 +469,8 @@ export class CodexAppServerClient {
         if (this.managedHookRuntimeDir) {
             return path.join(this.managedHookRuntimeDir, 'requirements.toml');
         }
-        const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'evolcore-codex-hooks-'));
+        const tmpDir = ensureProcessManagedTempDir();
+        const directory = fs.mkdtempSync(path.join(tmpDir, 'evolcore-codex-hooks-'));
         try {
             fs.chmodSync(directory, 0o700);
             const hookPath = path.join(directory, 'pre-tool-use.mjs');
@@ -487,7 +527,39 @@ export class CodexAppServerClient {
             ...process.env,
             ...this.options.env,
         });
+        // The app-server is shared by multiple EvolCore sessions. Its process
+        // environment must therefore use the daemon's trusted private root;
+        // per-thread session roots are injected later through thread config.
+        const managedTmpDir = ensureProcessManagedTempDir();
+        env.TMPDIR = managedTmpDir;
+        delete env.EVOLCORE_RUNTIME_LOCK_DIR;
+        if (managedTmpDir) {
+            const runtimeLockDir = path.join(managedTmpDir, 'evolcore-locks');
+            try {
+                // The parent is the already-validated process root, so only create
+                // and validate the final component. Never follow a pre-existing
+                // symlink supplied through the inherited environment.
+                try {
+                    fs.mkdirSync(runtimeLockDir, { mode: 0o700 });
+                }
+                catch (error) {
+                    if (error?.code !== 'EEXIST')
+                        throw error;
+                }
+                const stat = fs.lstatSync(runtimeLockDir);
+                if (!stat.isDirectory() || stat.isSymbolicLink()
+                    || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                    || (stat.mode & 0o077) !== 0) {
+                    throw new Error('runtime lock directory is not private');
+                }
+                env.EVOLCORE_RUNTIME_LOCK_DIR = runtimeLockDir;
+            }
+            catch {
+                logger.warn(`[CodexAppServer] managed runtime lock directory unavailable: ${runtimeLockDir}`);
+            }
+        }
         env.CODEX_API_KEY = this.options.apiKey;
+        env.EVOLCORE_INSTANCE_SOCKET = resolvePaths().instanceSocket;
         for (const [name, value] of Object.entries(this.options.headers ?? {})) {
             env[codexHeaderEnvName(name)] = value;
         }
@@ -496,6 +568,73 @@ export class CodexAppServerClient {
         }
         return env;
     }
+    async verifyWindowsManagedHooks() {
+        const response = await this.configRequirementsRead();
+        const requirements = response.requirements;
+        const hooks = requirements?.hooks;
+        const featureRequirements = requirements?.featureRequirements ?? requirements?.feature_requirements;
+        const managedDir = hooks?.windowsManagedDir ?? hooks?.windows_managed_dir;
+        const preToolUse = hooks?.PreToolUse;
+        const expectedHookPath = typeof managedDir === 'string'
+            ? path.join(managedDir, 'pre-tool-use.mjs')
+            : undefined;
+        const currentHookLauncher = !!expectedHookPath && (() => {
+            try {
+                const source = fs.readFileSync(expectedHookPath, 'utf8');
+                const expectedPackageRoot = JSON.stringify(path.resolve(getPackageRoot()));
+                return source.includes('EVOLCORE_MANAGED_HOOK_LAUNCHER')
+                    && (source.includes(expectedPackageRoot)
+                        || (process.platform === 'win32' && source.toLowerCase().includes(expectedPackageRoot.toLowerCase())));
+            }
+            catch {
+                return false;
+            }
+        })();
+        const normalizeManagedPath = (value) => path.normalize(value).toLowerCase();
+        const commandTargetsHook = (value) => {
+            const command = normalizeManagedPath(value).trim();
+            const hook = normalizeManagedPath(expectedHookPath ?? '');
+            // The managed command is intentionally a single executable invocation.
+            // Reject shell operators and trailing arguments so a modified
+            // requirements file cannot retain the expected path while running a
+            // second command or changing the hook's behavior.
+            if (!command || !hook || /[\r\n;&|<>]/.test(command))
+                return false;
+            return command.replace(/["']+$/, '').endsWith(hook);
+        };
+        const managedHookLoaded = Array.isArray(preToolUse)
+            && preToolUse.some(group => {
+                if (!group || typeof group !== 'object' || Array.isArray(group))
+                    return false;
+                if (group.matcher !== '*')
+                    return false;
+                const handlers = group.hooks;
+                return Array.isArray(handlers) && handlers.some(handler => {
+                    if (!handler || typeof handler !== 'object' || Array.isArray(handler))
+                        return false;
+                    const entry = handler;
+                    const command = entry.commandWindows ?? entry.command_windows;
+                    return entry.type === 'command'
+                        && entry.async !== true
+                        && typeof entry.command === 'string'
+                        && entry.command.length > 0
+                        && typeof command === 'string'
+                        && command.length > 0
+                        && !!expectedHookPath
+                        && fs.existsSync(expectedHookPath)
+                        && fs.statSync(expectedHookPath).isFile()
+                        && currentHookLauncher
+                        && commandTargetsHook(command);
+                });
+            });
+        const lockdownEnabled = (requirements?.allowManagedHooksOnly ?? requirements?.allow_managed_hooks_only) === true;
+        const hooksEnabled = featureRequirements?.hooks === true;
+        if (typeof managedDir !== 'string' || !path.isAbsolute(managedDir)
+            || !fs.existsSync(managedDir) || !managedHookLoaded || !lockdownEnabled || !hooksEnabled) {
+            throw new Error('Codex Windows proactive requires an installed and loaded EvolCore managed PreToolUse hook. '
+                + 'Run the elevated Windows installer again to provision %ProgramData%\\OpenAI\\Codex\\requirements.toml.');
+        }
+    }
     buildProcessArgs() {
         const args = ['app-server', '--listen', 'stdio://'];
         if (this.options.enableRequestUserInput !== false) {
@@ -627,15 +766,44 @@ export class CodexAppServerClient {
             this.respondError(request.id, new Error('Unsupported Codex app-server request: ' + request.method));
             return;
         }
-        Promise.resolve(handler(request))
+        const replayKey = String(request.id);
+        const fingerprint = serverRequestFingerprint(request);
+        const previous = this.serverRequestReplays.get(replayKey);
+        if (previous) {
+            if (previous.fingerprint !== fingerprint) {
+                const conflict = new Error(`Conflicting Codex app-server request payload for id=${request.id}`);
+                logger.warn(`[CodexAppServer] server request ID conflict id=${request.id} method=${request.method}`);
+                this.respondError(request.id, conflict);
+                return;
+            }
+            // A retry must receive a response too, but must never invoke the
+            // approval handler a second time.
+            this.respondFromPromise(request.id, request.method, previous.response);
+            return;
+        }
+        let response;
+        try {
+            // Invoke synchronously so existing app-server latency stays unchanged,
+            // while the explicit catch still turns a synchronous handler throw into
+            // the same replayable rejected response as an async failure.
+            response = Promise.resolve(handler(request));
+        }
+        catch (error) {
+            response = Promise.reject(error);
+        }
+        this.serverRequestReplays.set(replayKey, { fingerprint, response });
+        this.respondFromPromise(request.id, request.method, response);
+    }
+    respondFromPromise(id, method, response) {
+        response
             .then(result => {
-            logger.info(`[CodexAppServer] server response id=${request.id} method=${request.method} result=${JSON.stringify(result ?? null)}`);
-            this.respond(request.id, result ?? null);
+            logger.info(`[CodexAppServer] server response id=${id} method=${method} result=${JSON.stringify(result ?? null)}`);
+            this.respond(id, result ?? null);
         })
             .catch(error => {
             const err = error instanceof Error ? error : new Error(String(error));
-            logger.warn(`[CodexAppServer] server request failed id=${request.id} method=${request.method}: ${err.message}`);
-            this.respondError(request.id, err);
+            logger.warn(`[CodexAppServer] server request failed id=${id} method=${method}: ${err.message}`);
+            this.respondError(id, err);
         });
     }
     emitNotification(notification) {
@@ -676,6 +844,7 @@ export class CodexAppServerClient {
             pending.reject(error);
         }
         this.pending.clear();
+        this.serverRequestReplays.clear();
         this.cleanupManagedHookRuntime();
     }
 }