github-router 0.3.117 → 0.3.118

package/dist/main.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { a as removeOwnClaudeConfigMirror, i as isUnderClaudeConfigMirror, l as writeRuntimeFileSecure, n as ensureClaudeConfigMirror, r as ensurePaths, t as PATHS } from "./paths-CDWhYOdp.js";
-import { c as parseBoolEnv, d as runCommandVoid, f as runManagedExeCapture, l as resolveExecutable, n as isPidAlive, o as trackChild, r as registerColbertExitHandlers, s as killManagedTree, t as getColbertInstanceUuid, u as runCommandCapture } from "./lifecycle-DzJicg68.js";
-import { a as sweepRegistry, i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-D6zt0iH_.js";
+import { a as removeOwnClaudeConfigMirror, i as isUnderClaudeConfigMirror, l as writeRuntimeFileSecure, n as ensureClaudeConfigMirror, r as ensurePaths, t as PATHS } from "./paths-BJvMAFht.js";
+import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, n as isPidAlive, o as trackChild, p as runManagedExeCapture, r as registerColbertExitHandlers, s as killChildProcessTree, t as getColbertInstanceUuid, u as resolveExecutable } from "./lifecycle-CELOx6yB.js";
+import { a as sweepRegistry, i as registerExitHandlers$1, n as getInstanceUuid, r as recordWorkerRepo, t as WorktreeRegistry } from "./lifecycle-CfYzpXK-.js";
 import { createRequire } from "node:module";
 import { defineCommand, runMain } from "citty";
 import consola from "consola";
@@ -1415,6 +1415,120 @@ function envInt$1(key, fallback) {
 const UPSTREAM_FETCH_TIMEOUT_MS = envInt$1("UPSTREAM_FETCH_TIMEOUT_MS", 0);
 const UPSTREAM_INACTIVITY_TIMEOUT_MS = envInt$1("UPSTREAM_INACTIVITY_TIMEOUT_MS", 3e5);
 
+//#endregion
+//#region src/lib/process-guard/index.ts
+/**
+* Live reaper children, held so the GC can't collect the `ChildProcess`
+* (and with it the stdin write-end that is the proxy-death signal) while
+* the proxy runs. Entries self-remove on the reaper's exit. We do NOT
+* proactively kill these on graceful shutdown: when the proxy exits the OS
+* closes the stdin pipe, the reaper hits EOF, re-verifies the child's
+* identity, and reaps any survivor that ignored the graceful SIGTERM —
+* exactly the backstop we want.
+*/
+const _activeReapers = /* @__PURE__ */ new Set();
+/** Guard is on by default; `GH_ROUTER_DISABLE_PROCESS_GUARD=1` opts out. */
+function processGuardEnabled() {
+	return parseBoolEnv(process$1.env.GH_ROUTER_DISABLE_PROCESS_GUARD) !== true;
+}
+/**
+* Build the start-time-verified node reaper script (POSIX). PURE — `pid`
+* is our own integer. `detachedGroup` selects `kill(-pid)` (process group,
+* the detached CLI) vs `kill(pid)` on POSIX.
+*
+* Kept dependency-free (require'd builtins only) so it runs under `node -e`
+* with no module resolution against the dist bundle.
+*/
+function buildNodeReaperScript(pid, detachedGroup) {
+	const target = detachedGroup ? "-PID" : "PID";
+	return `
+const cp = require("node:child_process");
+const fs = require("node:fs");
+const PID = ${pid >>> 0};
+function startTime() {
+  try {
+    if (process.platform === "linux") {
+      const stat = fs.readFileSync("/proc/" + PID + "/stat", "utf8");
+      const post = stat.slice(stat.lastIndexOf(")") + 1).trim().split(/\\s+/);
+      return post[19] || null; // field 22 (starttime) = index 19 after comm
+    }
+    const out = cp.execFileSync("ps", ["-o","lstart=","-p",String(PID)],
+      { stdio: ["ignore","pipe","ignore"], timeout: 2000 }).toString().trim();
+    return out || null;
+  } catch { return null; }
+}
+function alive() { try { process.kill(PID, 0); return true; } catch { return false; } }
+function treeKill() {
+  try { process.kill(${target}, "SIGTERM"); } catch {}
+  // NOT unref'd: this must keep the loop alive to deliver the escalated
+  // SIGKILL (the onDeath exit timer below stays alive past 500ms too).
+  setTimeout(() => { try { process.kill(${target}, "SIGKILL"); } catch {} }, 500);
+}
+const snap = (() => {
+  // The child is definitely ours and alive at startup, so a null here is a
+  // transient probe failure (e.g. a momentary 'ps' hiccup), NOT a real
+  // identity loss. Retry a few times so a one-off failure can't silently
+  // disable the guard for the rest of the run.
+  for (let i = 0; i < 3; i++) { const s = startTime(); if (s !== null) return s; }
+  return null;
+})();
+let done = false;
+function onDeath() {
+  if (done) return; done = true;
+  // Re-verify identity: kill ONLY if the live PID is still our child.
+  if (snap !== null && alive() && startTime() === snap) treeKill();
+  // REF'd (NOT unref'd): stdin has closed, so an unref'd timer would let
+  // the loop empty and the process exit immediately — dropping the 500ms
+  // SIGKILL escalation. Keep the loop alive to deliver it, then exit.
+  setTimeout(() => process.exit(0), 1500);
+}
+process.stdin.resume();
+process.stdin.on("end", onDeath);
+process.stdin.on("close", onDeath);
+process.stdin.on("error", onDeath);
+const cap = setTimeout(() => process.exit(0), 24*3600*1000); if (cap.unref) cap.unref();
+`.trim();
+}
+/**
+* Spawn the detached node reaper holding the stdin death-pipe. Always
+* `detached` so it outlives a force-kill of the proxy, and `unref`'d so it
+* never holds the proxy's event loop open. Returns null on spawn failure.
+*/
+function spawnNodeReaper(pid, detachedGroup) {
+	try {
+		const child = spawn(process$1.execPath, ["-e", buildNodeReaperScript(pid, detachedGroup)], {
+			stdio: [
+				"pipe",
+				"ignore",
+				"ignore"
+			],
+			detached: true,
+			windowsHide: true,
+			shell: false
+		});
+		child.on("error", () => {});
+		child.stdin?.on("error", () => {});
+		_activeReapers.add(child);
+		child.once("exit", () => _activeReapers.delete(child));
+		child.unref();
+		return child;
+	} catch {
+		return null;
+	}
+}
+/**
+* Start the crash-safe guard for a launched CLI child. No-op on Windows
+* (Node's Job Object already reaps the tree on proxy death) and when
+* disabled / unspawnable. Fire-and-forget; never throws.
+*/
+function startProcessGuard(child) {
+	if (!processGuardEnabled()) return;
+	const pid = child.pid;
+	if (!pid) return;
+	if (process$1.platform === "win32") return;
+	spawnNodeReaper(pid, true);
+}
+
 //#endregion
 //#region src/lib/toolbelt/path-inject.ts
 /**
@@ -1498,7 +1612,8 @@ const STRIPPED_PARENT_ENV_KEYS = [
 	"CLAUDE_CODE_ADDITIONAL_PROTECTION",
 	"OPENAI_API_KEY",
 	"OPENAI_BASE_URL",
-	"CODEX_HOME"
+	"CODEX_HOME",
+	"AIORDIE_CLAUDE_BIND"
 ];
 /**
 * Strip auth-related keys from a parent-process env object. The result
@@ -1618,6 +1733,18 @@ function buildLaunchCommand(target) {
 		})
 	};
 }
+/**
+* Whether a resolved Windows executable must be launched through cmd.exe
+* (`shell:true`). Only batch shims (`.cmd`/`.bat`) need it — and even then
+* cmd.exe stays alive as the CLI's parent, so `taskkill /T` reaps the
+* whole tree. A real `.exe` (e.g. the native-installer `claude.exe`) is
+* spawned DIRECTLY so the CLI is the direct child, with no cmd.exe
+* intermediary to orphan its node/MCP grandchildren on a kill.
+*/
+function windowsLaunchNeedsShell(executable) {
+	const ext = nodePath.extname(executable).toLowerCase();
+	return ext === ".cmd" || ext === ".bat";
+}
 function launchChild(target, server$1, options = {}) {
 	const { cmd, env } = buildLaunchCommand(target);
 	const executable = cmd[0];
@@ -1629,7 +1756,7 @@ function launchChild(target, server$1, options = {}) {
 	}
 	let child;
 	try {
-		if (process$1.platform === "win32") child = spawn(cmd.map((a) => a.includes(" ") ? `"${a}"` : a).join(" "), [], {
+		if (process$1.platform === "win32") if (windowsLaunchNeedsShell(cmd[0])) child = spawn(cmd.map((a) => a.includes(" ") ? `"${a}"` : a).join(" "), [], {
 			env,
 			stdio: "inherit",
 			shell: true
@@ -1638,6 +1765,11 @@ function launchChild(target, server$1, options = {}) {
 			env,
 			stdio: "inherit"
 		});
+		else child = spawn(cmd[0], cmd.slice(1), {
+			env,
+			stdio: "inherit",
+			detached: true
+		});
 	} catch (error) {
 		const msg = `Failed to launch ${executable}: ${error instanceof Error ? error.message : String(error)}`;
 		consola.error(msg);
@@ -1646,15 +1778,16 @@ function launchChild(target, server$1, options = {}) {
 		if (options.onShutdown) Promise.resolve(options.onShutdown()).catch(() => {});
 		process$1.exit(1);
 	}
+	startProcessGuard(child);
 	let cleaned = false;
 	let exiting = false;
 	async function cleanup() {
 		if (cleaned) return;
 		cleaned = true;
+		const timeout = setTimeout(() => process$1.exit(1), 5e3);
 		try {
-			child.kill();
+			killChildProcessTree(child, { detachedGroup: process$1.platform !== "win32" });
 		} catch {}
-		const timeout = setTimeout(() => process$1.exit(1), 5e3);
 		try {
 			await server$1.close(true);
 		} catch {}
@@ -1668,11 +1801,33 @@ function launchChild(target, server$1, options = {}) {
 		exiting = true;
 		process$1.exit(code);
 	}
-	const onSignal = () => {
+	let forwardGrace = null;
+	const lastForwardAt = {
+		SIGINT: 0,
+		SIGTERM: 0
+	};
+	const onSignal = (sig) => {
+		if (process$1.platform !== "win32" && child.pid && !cleaned) {
+			const now = Date.now();
+			if (now - lastForwardAt[sig] > 250) {
+				lastForwardAt[sig] = now;
+				try {
+					process$1.kill(-child.pid, sig);
+				} catch {}
+			}
+			const graceMs = sig === "SIGINT" ? 1e4 : 3e3;
+			if (!forwardGrace) {
+				forwardGrace = setTimeout(() => {
+					cleanup().then(() => exit(130)).catch(() => exit(1));
+				}, graceMs);
+				forwardGrace.unref?.();
+			}
+			return;
+		}
 		cleanup().then(() => exit(130)).catch(() => exit(1));
 	};
-	process$1.on("SIGINT", onSignal);
-	process$1.on("SIGTERM", onSignal);
+	process$1.on("SIGINT", () => onSignal("SIGINT"));
+	process$1.on("SIGTERM", () => onSignal("SIGTERM"));
 	child.on("exit", (exitCode, signal) => {
 		try {
 			sweepRegistry();
@@ -7103,7 +7258,7 @@ function logAudit$1(record) {
 		try {
 			const fs$2 = await import("node:fs/promises");
 			const path$1 = await import("node:path");
-			const { PATHS: PATHS$1 } = await import("./paths-DNVIKCZP.js");
+			const { PATHS: PATHS$1 } = await import("./paths-BdQSPUOg.js");
 			const dir = path$1.join(PATHS$1.APP_DIR, "browser-mcp");
 			await fs$2.mkdir(dir, { recursive: true });
 			const line = JSON.stringify({
@@ -9900,9 +10055,15 @@ const exitHandler = () => {
 	inFlight$1.clear();
 	lastUsedSeq.clear();
 };
-process$1.on("SIGINT", sigintHandler);
-process$1.on("SIGTERM", sigtermHandler);
-process$1.on("exit", exitHandler);
+let _exitHandlersRegistered = false;
+function registerExitHandlers$2() {
+	if (_exitHandlersRegistered) return;
+	_exitHandlersRegistered = true;
+	process$1.on("SIGINT", sigintHandler);
+	process$1.on("SIGTERM", sigtermHandler);
+	process$1.on("exit", exitHandler);
+}
+registerExitHandlers$2();
 
 //#endregion
 //#region src/vendor/pi/ai/api-registry.ts
@@ -19437,6 +19598,18 @@ function buildStopHookCommand(execPath, scriptPath) {
 	return `${q(execPath)} internal-stop-hook`;
 }
 /**
+* Build the shell command Claude Code runs for the SessionStart/SessionEnd hooks
+* (registered only when github-router runs inside an ai-or-die Terminal tab). The
+* sidecar path is baked in as a literal `--out` arg — NOT passed via env — so it
+* survives `AIORDIE_CLAUDE_BIND` being stripped from the child's environment and a
+* nested `github-router claude` can't inherit it. Pure (binary + script + out
+* paths) for unit-testable quoting; the live firing is verified end-to-end.
+*/
+function buildSessionBindHookCommand(execPath, scriptPath, outPath) {
+	const q = (s) => `"${s}"`;
+	return `${scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)}` : q(execPath)} internal-session-bind --out ${q(outPath)}`;
+}
+/**
 * Read-merge-atomic-write the Stop hook into a Claude Code `settings.json` file
 * (the mirrored one). A MISSING file (ENOENT) starts from `{}`; any OTHER read or
 * parse error THROWS (the caller's try/catch warns and continues) rather than
@@ -23346,7 +23519,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.117";
+var version$1 = "0.3.118";
 
 //#endregion
 //#region src/lib/approval.ts
@@ -25532,6 +25705,15 @@ const claude = defineCommand({
 				if (skillsWritten > 0) process$1.stderr.write(`Floor-raising skills injected (${skillsWritten}/${INJECTED_SKILLS.length}): /gh-research, /gh-orchestrate, /gh-floor-keeper.
 `);
 			}
+			const aiordieSidecar = (process$1.env.AIORDIE_CLAUDE_BIND ?? "").trim();
+			if (aiordieSidecar.length > 0 && !aiordieSidecar.includes("\"")) try {
+				const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+				const command = buildSessionBindHookCommand(process$1.execPath, process$1.argv[1], aiordieSidecar);
+				await injectStopHookIntoSettingsFile(settingsPath, command, "SessionStart");
+				await injectStopHookIntoSettingsFile(settingsPath, command, "SessionEnd");
+			} catch (err) {
+				consola.warn(`Could not register the ai-or-die session-bind hook: ${String(err)}`);
+			}
 			if (args["trust-gate"] === true) try {
 				const root = await trustRepo(sessionCwd);
 				process$1.stderr.write(`Structural gate trusted for this repo (${root}); it will run on launch here from now on.\n`);
@@ -25855,7 +26037,7 @@ async function postJson(url, payload, opts) {
 * no such handle. Hooks always receive piped/redirected stdin, so this never
 * blocks (guarded against an interactive TTY, and any error -> "").
 */
-function readStdin$1() {
+function readStdin$2() {
 	try {
 		if (process.stdin.isTTY) return "";
 		return readFileSync(0, "utf8");
@@ -25886,7 +26068,7 @@ const internalPromptSubmit = defineCommand({
 	},
 	async run() {
 		try {
-			const stdin = readStdin$1();
+			const stdin = readStdin$2();
 			const steerEnabled = parseBoolEnv(process.env.GH_ROUTER_DISABLE_PROMPT_STEER) !== true;
 			const runtime = hookMcpRuntimeFromEnv();
 			let decision;
@@ -25938,6 +26120,111 @@ const internalPromptSubmit = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/internal-session-bind.ts
+/**
+* Read the hook payload from stdin SYNCHRONOUSLY (`readFileSync(0)`). An async
+* stdin read leaves an in-flight libuv FS request that, on Windows, races process
+* teardown and trips a `uv_async_send` assertion; a synchronous read has no such
+* handle. Hooks always receive piped stdin (guarded against a TTY; any error -> "").
+*/
+function readStdin$1() {
+	try {
+		if (process.stdin.isTTY) return "";
+		return readFileSync(0, "utf8");
+	} catch {
+		return "";
+	}
+}
+/**
+* Resolve a transcript path to its real location. The path claude reports sits
+* under the per-launch CLAUDE_CONFIG_DIR mirror, whose `projects` entry is a
+* junction/symlink back to the real `~/.claude/projects`. ai-or-die reads the
+* real dir, and the per-launch mirror is swept on github-router shutdown, so we
+* persist the REAL path. The file (and even intermediate dirs) may not exist yet
+* at SessionStart, so we realpath the DEEPEST EXISTING ancestor and rejoin the
+* not-yet-created trailing segments. Best-effort: if nothing resolves, keep raw.
+*/
+function realTranscriptPath(tp) {
+	if (!tp) return "";
+	try {
+		return realpathSync.native(tp);
+	} catch {}
+	const missing = [];
+	let cur = tp;
+	for (let i = 0; i < 64; i++) {
+		missing.unshift(nodePath.basename(cur));
+		const parent = nodePath.dirname(cur);
+		if (parent === cur) break;
+		try {
+			return nodePath.join(realpathSync.native(parent), ...missing);
+		} catch {
+			cur = parent;
+		}
+	}
+	return tp;
+}
+/**
+* Pure core: turn a raw Claude Code hook payload (stdin string) into the sidecar
+* record, or `null` when there's nothing to write. Returns null for: non-JSON
+* input, a subagent/teammate payload (agent_id/agent_type present — top-level
+* filter), or a missing session_id. Exported for unit tests.
+*/
+function decodeSessionBind(stdin) {
+	let payload = {};
+	try {
+		const p = JSON.parse(stdin);
+		if (p && typeof p === "object") payload = p;
+		else return null;
+	} catch {
+		return null;
+	}
+	if (isSubagentContext(payload)) return null;
+	const claudeSessionId = typeof payload.session_id === "string" ? payload.session_id : "";
+	if (!claudeSessionId) return null;
+	const event = (typeof payload.hook_event_name === "string" ? payload.hook_event_name : "") === "SessionEnd" ? "end" : "start";
+	const record = {
+		schema: 1,
+		claudeSessionId,
+		transcriptPath: realTranscriptPath(typeof payload.transcript_path === "string" ? payload.transcript_path : ""),
+		cwd: typeof payload.cwd === "string" ? payload.cwd : "",
+		event,
+		at: Date.now()
+	};
+	if (event === "start" && typeof payload.source === "string") record.source = payload.source;
+	if (event === "end" && typeof payload.reason === "string") record.reason = payload.reason;
+	return record;
+}
+/** Atomically write the sidecar (temp + rename) so the reader never sees a partial file. */
+function writeSidecar(out, record) {
+	try {
+		mkdirSync(nodePath.dirname(out), { recursive: true });
+	} catch {}
+	const tmp = `${out}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+	writeFileSync(tmp, JSON.stringify(record), { mode: 384 });
+	renameSync(tmp, out);
+}
+const internalSessionBind = defineCommand({
+	meta: {
+		name: "internal-session-bind",
+		description: "Internal: the SessionStart/SessionEnd hook. Reads the Claude Code hook payload on stdin and atomically writes the active session id + transcript path to the --out sidecar file (consumed by ai-or-die to bind a tab's sticky-note summariser). Side-effect only."
+	},
+	args: { out: {
+		type: "string",
+		description: "Absolute path to the sidecar file to (atomically) write.",
+		required: false
+	} },
+	run({ args }) {
+		try {
+			const out = typeof args.out === "string" ? args.out.trim() : "";
+			if (!out) return;
+			const record = decodeSessionBind(readStdin$1());
+			if (record) writeSidecar(out, record);
+		} catch {}
+		process.exitCode = 0;
+	}
+});
+
 //#endregion
 //#region src/internal-stop-hook.ts
 /**
@@ -26450,7 +26737,7 @@ process.on("uncaughtException", (error) => {
 const version = getPackageVersion();
 const argv = process.argv.slice(2);
 const isVersionFlag = argv.includes("--version");
-const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review";
+const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-session-bind";
 if (!isVersionFlag && !isInternalHook) consola.info(`github-router v${version}`);
 await runMain(defineCommand({
 	meta: {
@@ -26468,7 +26755,8 @@ await runMain(defineCommand({
 		debug,
 		"internal-stop-hook": internalStopHook,
 		"internal-prompt-submit": internalPromptSubmit,
-		"internal-stop-review": internalStopReview
+		"internal-stop-review": internalStopReview,
+		"internal-session-bind": internalSessionBind
 	}
 }));