jules-orchestrator-kit 0.74.0 → 0.75.1

package/src/security.mjs

@@ -19,7 +19,10 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { detectCrossPackageBoundaryViolations, detectEdgeRuntime } from "./stack-detector.mjs";
-import { checkTrojanSource } from "./bidi-guard.mjs";
+import {
+  checkUnicodeSecurity,
+  locateUnicodeFindingLine,
+} from "./bidi-guard.mjs";
 import {
   hasHighConfidenceSecret,
   hasLowConfidenceSecret,
@@ -164,6 +167,10 @@ function splitDiffByFile(diffText) {
       current.lines.push({ text: line.slice(1), no: lineNo });
       if (lineNo !== null) lineNo++;
     } else if (lineNo !== null && !line.startsWith("-") && !line.startsWith("\\")) {
+      if (line.startsWith(" ")) {
+        if (!current) select(null);
+        current.lines.push({ text: line.slice(1), no: lineNo });
+      }
       lineNo++; // A context line advances the post-image just as an added one does.
     }
   }
@@ -331,42 +338,35 @@ export function scanDiff(diffTextStr = "", options = {}) {
   for (const segment of segments) {
     const addedText = segment.lines.map((l) => l.text).join("\n");
 
-    // Check Trojan Source
-    if (!segment.file || !segment.file.endsWith('.md')) {
-      const tsRes = checkTrojanSource(addedText, options);
-      if (!tsRes.ok) {
-        // Find line number where it happened if possible
-        const bidiRegex = /[\u202A\u202B\u202C\u202D\u202E\u2066\u2067\u2068\u2069\u061C\u200E\u200F]/;
-        let lineNo = null;
-        for (const l of segment.lines) {
-          if (bidiRegex.test(l.text)) {
-            lineNo = l.no;
-            break;
-          }
-        }
-        for (const v of tsRes.violations) {
+    const hit = classifyAddedLines(addedText, segment.file);
+    if (hit) {
+      const line = segment.file ? locateFindingLine(segment.lines, hit.type, segment.file) : null;
+      const at = segment.file ? ` (${segment.file}${line ? `:${line}` : ""})` : "";
+      findings.push({
+        severity: hit.severity,
+        type: hit.type,
+        file: segment.file,
+        line,
+        description: `${hit.description}${at}`,
+      });
+    }
+
+    // Unicode security: BiDi Trojan Source, invisible obfuscation, mixed-script
+    // confusables. Markdown remains exempt (documentation may cite the controls).
+    if (!segment.file || !segment.file.endsWith(".md")) {
+      const uniRes = checkUnicodeSecurity(addedText, options);
+      if (!uniRes.ok) {
+        for (const v of uniRes.violations) {
           findings.push({
             severity: "CRITICAL",
-            type: "TROJAN_SOURCE_DETECTED",
+            type: v.type,
             file: segment.file,
-            line: lineNo,
+            line: locateUnicodeFindingLine(segment.lines, v.type),
             description: v.reason,
           });
         }
       }
     }
-
-    const hit = classifyAddedLines(addedText, segment.file);
-    if (!hit) continue;
-    const line = segment.file ? locateFindingLine(segment.lines, hit.type, segment.file) : null;
-    const at = segment.file ? ` (${segment.file}${line ? `:${line}` : ""})` : "";
-    findings.push({
-      severity: hit.severity,
-      type: hit.type,
-      file: segment.file,
-      line,
-      description: `${hit.description}${at}`,
-    });
   }
 
   // Scanning per file loses anything that only matches across a file boundary,
@@ -462,6 +462,9 @@ export {
   ENV_TEMPLATE_BASENAMES,
   isEnvTemplateException,
   checkScope,
+  isProtectedWorkflowException,
+  UNWAIVABLE_DENY_PATTERNS,
+  isUnwaivableForbiddenPath,
 } from "./scope-guard.mjs";
 export {
   HIGH_CONFIDENCE_PATTERNS,
@@ -475,4 +478,12 @@ export {
   hasHighEntropyToken,
 } from "./secret-scanner.mjs";
 export { TAMPER_KINDS, TAMPER_KIND_NAMES, resolveAllowedTamperKinds, checkTestTampering } from "./test-tamper-guard.mjs";
-export { checkTrojanSource } from "./bidi-guard.mjs";
+export {
+  checkTrojanSource,
+  checkUnicodeSecurity,
+  BIDI_CONTROL_REGEX,
+  INVISIBLE_OBFUSCATION_REGEX,
+  PLANE14_TAG_REGEX,
+  hasMixedScriptConfusable,
+  locateUnicodeFindingLine,
+} from "./bidi-guard.mjs";

package/src/self-audit.mjs

@@ -10,7 +10,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { gate } from "./engine.mjs";
 import { loadConfig, parseYaml } from "./config.mjs";
-import { matchesGlob } from "./security.mjs";
+import { matchesGlob, TAMPER_KIND_NAMES } from "./security.mjs";
 
 /** Convenience wrapper kept for the historical `matchGlob` name. */
 export function matchGlob(filepath, globPattern) {
@@ -85,6 +85,202 @@ export function auditWorktrees(opts = {}) {
   return { ok: true, worktreeDir, exists };
 }
 
+/**
+ * Parses the labels payload GitHub Actions exposes for a pull request.
+ * Accepts an array, raw `toJSON(...labels)` JSON string, or a plain comma-separated string.
+ *
+ * @param {string|Array} raw
+ * @returns {string[]}
+ */
+export function parseLabels(raw = "") {
+  if (Array.isArray(raw)) {
+    return raw.map((l) => (typeof l === "string" ? l : l && l.name) || "").filter(Boolean);
+  }
+  const text = String(raw || "").trim();
+  if (!text) return [];
+  try {
+    const parsed = JSON.parse(text);
+    if (Array.isArray(parsed)) {
+      return parsed.map((l) => (typeof l === "string" ? l : l && l.name) || "").filter(Boolean);
+    }
+  } catch (_) {}
+  return text.split(",").map((s) => s.trim()).filter(Boolean);
+}
+
+/**
+ * Resolves tamper guard waivers from PR labels bound to the exact head SHA.
+ *
+ * Test expectation waivers MUST be explicitly bound to the reviewed commit SHA
+ * (e.g. `allow-e:<40-hex-SHA>` or legacy `allow-test-expectation:<SHA>`).
+ * Short label `allow-e:<40-hex-SHA>` is 48 characters, fitting GitHub's 50-character limit.
+ * Unbound labels (without SHA) or stale labels (SHA mismatch) are rejected.
+ *
+ * @param {string|string[]} rawLabels - Array of labels, JSON string, or comma-separated string
+ * @param {string} headSha - Full 40-character commit SHA of the current PR head
+ * @returns {{ allowedKinds: string[], rejected: Array<{ label: string, reason: string }> }}
+ */
+export function resolveTestWaiverFromLabels(rawLabels = "", headSha = "") {
+  const labels = parseLabels(rawLabels);
+  const allowedKinds = new Set();
+  const rejected = [];
+  const normalizedHead = String(headSha || "").trim().toLowerCase();
+
+  for (const label of labels) {
+    const lower = label.trim().toLowerCase();
+
+    if (!lower.startsWith("allow-test-") && !lower.startsWith("allow-e:") && lower !== "allow-e") {
+      continue;
+    }
+
+    const parts = lower.split(":");
+    let kind = null;
+    let targetSha = null;
+
+    if (parts[0] === "allow-e") {
+      kind = "expectation";
+      if (parts.length > 1) {
+        targetSha = parts.slice(1).join(":");
+      }
+    } else if (parts[0] === "allow-test-expectation") {
+      kind = "expectation";
+      if (parts.length > 1) {
+        targetSha = parts.slice(1).join(":");
+      }
+    } else if (parts[0] === "allow-test-change" || parts[0] === "allow-test-changes") {
+      if (parts.length === 2) {
+        if (TAMPER_KIND_NAMES.includes(parts[1])) {
+          kind = parts[1];
+        } else {
+          kind = "expectation";
+          targetSha = parts[1];
+        }
+      } else if (parts.length >= 3) {
+        kind = parts[1];
+        targetSha = parts.slice(2).join(":");
+      } else {
+        kind = "expectation";
+      }
+    } else {
+      continue;
+    }
+
+    if (!targetSha) {
+      const canonicalFmt = parts[0] === "allow-e" || parts[0] === "allow-test-expectation"
+        ? "allow-e:<40-hex-SHA>"
+        : `${parts[0]}:<40-hex-SHA>`;
+      rejected.push({
+        label,
+        reason: `Unbound waiver: label has no commit SHA. Must be formatted as "${canonicalFmt}".`,
+      });
+      continue;
+    }
+
+    if (!/^[0-9a-f]{40}$/i.test(targetSha)) {
+      rejected.push({
+        label,
+        reason: `Invalid commit SHA "${targetSha}": must be exact 40 hexadecimal characters. Prefix matching is not permitted.`,
+      });
+      continue;
+    }
+
+    if (!normalizedHead || !/^[0-9a-f]{40}$/i.test(normalizedHead)) {
+      rejected.push({
+        label,
+        reason: `Cannot verify binding: HEAD_SHA "${headSha}" is missing or not a valid 40-character commit SHA.`,
+      });
+      continue;
+    }
+
+    if (targetSha.toLowerCase() !== normalizedHead) {
+      rejected.push({
+        label,
+        reason: `Stale waiver: label SHA "${targetSha}" does not match current HEAD SHA "${normalizedHead}".`,
+      });
+      continue;
+    }
+
+    if (TAMPER_KIND_NAMES.includes(kind)) {
+      allowedKinds.add(kind);
+    } else {
+      rejected.push({
+        label,
+        reason: `Unknown tamper kind "${kind}". Valid kinds: ${TAMPER_KIND_NAMES.join(", ")}`,
+      });
+    }
+  }
+
+  return {
+    allowedKinds: Array.from(allowedKinds),
+    rejected,
+  };
+}
+
+/**
+ * Resolves protected-path bypass waivers from PR labels bound to the exact head SHA.
+ *
+ * Protected path waivers MUST be explicitly bound to the reviewed commit SHA
+ * (e.g. `allow-p:<40-hex-SHA>` or legacy `allow-protected-paths:<40-hex-SHA>`).
+ * Short label `allow-p:<40-hex-SHA>` is 48 characters, fitting GitHub's 50-character limit.
+ * Unbound labels (without SHA), prefix matching, or stale labels (SHA mismatch) are rejected.
+ *
+ * @param {string|string[]} rawLabels - Array of labels, JSON string, or comma-separated string
+ * @param {string} headSha - Full 40-character commit SHA of the current PR head
+ * @returns {{ ok: boolean, boundSha?: string, rejected: Array<{ label: string, reason: string }> }}
+ */
+export function resolveProtectedWaiverFromLabels(rawLabels = "", headSha = "") {
+  const labels = parseLabels(rawLabels);
+  const normalizedHead = String(headSha || "").trim().toLowerCase();
+  const rejected = [];
+  let foundValid = false;
+
+  for (const label of labels) {
+    const lower = label.trim().toLowerCase();
+    if (!lower.startsWith("allow-protected-paths") && !lower.startsWith("allow-p:") && lower !== "allow-p") continue;
+
+    const parts = lower.split(":");
+    if (parts.length === 1) {
+      rejected.push({
+        label,
+        reason: 'Unbound waiver: label has no commit SHA. Must be formatted as "allow-p:<40-hex-SHA>".',
+      });
+      continue;
+    }
+
+    const targetSha = parts.slice(1).join(":");
+    if (!/^[0-9a-f]{40}$/i.test(targetSha)) {
+      rejected.push({
+        label,
+        reason: `Invalid commit SHA "${targetSha}": must be exact 40 hexadecimal characters. Prefix matching is not permitted.`,
+      });
+      continue;
+    }
+
+    if (!normalizedHead || !/^[0-9a-f]{40}$/i.test(normalizedHead)) {
+      rejected.push({
+        label,
+        reason: `Cannot verify binding: HEAD_SHA "${headSha}" is missing or not a valid 40-character commit SHA.`,
+      });
+      continue;
+    }
+
+    if (targetSha.toLowerCase() !== normalizedHead) {
+      rejected.push({
+        label,
+        reason: `Stale waiver: label SHA "${targetSha}" does not match current HEAD SHA "${normalizedHead}".`,
+      });
+      continue;
+    }
+
+    foundValid = true;
+  }
+
+  if (foundValid) {
+    return { ok: true, boundSha: normalizedHead, rejected };
+  }
+
+  return { ok: false, rejected };
+}
+
 /**
  * Audit gate rules (scope, payload governor, secret scanning, verification suite).
  */
@@ -93,13 +289,42 @@ export async function auditGates(opts = {}) {
   const config = opts.config || loadConfig(root);
   const base = opts.base || process.env.BASE_BRANCH || config.baseBranch || "main";
 
+  let allowProtected =
+    opts.allowProtected ??
+    (process.env.JULES_ALLOW_COMMAND_FILE_CHANGES === "true" ||
+      process.env.JULES_ALLOW_COMMAND_FILE_CHANGES === "1");
+
+  const rawLabels = opts.prLabels || process.env.PR_LABELS;
+  const headSha = opts.headSha || process.env.HEAD_SHA;
+
+  if (!allowProtected && rawLabels) {
+    const waiver = resolveProtectedWaiverFromLabels(rawLabels, headSha);
+    if (waiver.ok) {
+      allowProtected = true;
+    }
+    for (const rej of waiver.rejected || []) {
+      console.warn(`::warning::[scope-waiver] ${rej.label}: ${rej.reason}`);
+    }
+  }
+
+  let allowTestChanges = opts.allowTestChanges || process.env.JULES_ALLOW_TEST_CHANGES;
+  if (!allowTestChanges && rawLabels) {
+    const waiver = resolveTestWaiverFromLabels(rawLabels, headSha);
+    if (waiver.allowedKinds.length > 0) {
+      allowTestChanges = waiver.allowedKinds.join(",");
+    }
+    for (const rej of waiver.rejected) {
+      console.warn(`::warning::[tamper-waiver] ${rej.label}: ${rej.reason}`);
+    }
+  }
+
   return await gate({
     root,
     config,
     base,
     fix: process.env.ALLOW_AUTO_REPAIR === "true",
-    allowProtected: process.env.JULES_ALLOW_COMMAND_FILE_CHANGES === "true",
-    allowTestChanges: process.env.JULES_ALLOW_TEST_CHANGES || opts.allowTestChanges,
+    allowProtected,
+    allowTestChanges,
   });
 }
 
@@ -118,6 +343,15 @@ export async function runSelfAudit(opts = {}) {
   const gatesResult = await auditGates(optsWithContext);
 
   if (!gatesResult.ok) {
+    // The CLI's exit-6 banner intentionally does not print diff contents.
+    // Surface safe finding coordinates so a legitimate change can be repaired
+    // without disabling the independent audit or guessing at the failure.
+    if (gatesResult.code === 6) {
+      const findings = gatesResult.phases?.find((phase) => phase.phase === "secrets")?.findings || [];
+      for (const finding of findings) {
+        console.error(`Self-audit finding: ${finding.type || "UNKNOWN"} at ${finding.file || "unattributed"}${finding.line ? `:${finding.line}` : ""}`);
+      }
+    }
     return gatesResult;
   }
 

package/src/state.mjs

@@ -233,24 +233,36 @@ export function withVfsMutex(mutexDir, fn, opts = {}) {
   const maxRetries = opts.maxRetries || 200;
   const retryDelayMs = opts.retryDelayMs || 10;
 
+  const staleMs = opts.staleMs || 2000;
+
   for (let i = 0; i < maxRetries; i++) {
+    let acquired = false;
     try {
       mkdirSync(mutexDir);
-      try {
-        return fn();
-      } finally {
-        try {
-          rmdirSync(mutexDir);
-        } catch (_) {}
-      }
+      acquired = true;
     } catch (err) {
       if (err.code === "EEXIST") {
+        try {
+          if (Date.now() - statSync(mutexDir).mtimeMs > staleMs) {
+            rmdirSync(mutexDir);
+          }
+        } catch (_) {}
         const deadline = Date.now() + retryDelayMs;
         while (Date.now() < deadline) {}
         continue;
       }
       throw err;
     }
+    
+    if (acquired) {
+      try {
+        return fn();
+      } finally {
+        try {
+          rmdirSync(mutexDir);
+        } catch (_) {}
+      }
+    }
   }
   throw new MutexTimeoutError(`Failed to acquire VFS mutex lock at ${mutexDir} after ${maxRetries} retries`);
 }
@@ -634,9 +646,10 @@ export function acquireLock(agentName, taskId, files = [], rootOrOpts = resolveR
   const root = typeof rootOrOpts === "string" ? rootOrOpts : (rootOrOpts?.root || resolveRoot());
   const branch = (typeof rootOrOpts === "object" && rootOrOpts?.branch) || opts?.branch || process.env.JULES_BRANCH || process.env.BRANCH_NAME || "";
   const lockDir = getLockDir(root);
-  const lockFile = join(lockDir, `${taskId}.json`);
+  return withVfsMutex(join(lockDir, ".acquire.mutex"), () => {
+    const lockFile = join(lockDir, `${taskId}.json`);
 
-  if (existsSync(lockFile)) {
+    if (existsSync(lockFile)) {
     try {
       const existing = JSON.parse(readFileSync(lockFile, "utf-8"));
       if (isLockLive(existing)) {
@@ -667,12 +680,17 @@ export function acquireLock(agentName, taskId, files = [], rootOrOpts = resolveR
   if (requested.size > 0) {
     for (const held of lockStatus(root)) {
       if (!held || held.taskId === taskId) continue;
-      if (!isLockLive(held)) continue;
 
       const overlap = (Array.isArray(held.files) ? held.files : [])
         .map((f) => normalizePath(f))
         .filter((f) => requested.has(f));
       if (overlap.length > 0) {
+        if (!isLockLive(held)) {
+          if (held.taskId) {
+            try { unlinkSync(join(lockDir, `${held.taskId}.json`)); } catch (_) {}
+          }
+          continue;
+        }
         return {
           ok: false,
           holder: held.agent,
@@ -723,6 +741,8 @@ export function acquireLock(agentName, taskId, files = [], rootOrOpts = resolveR
         const existing = JSON.parse(readFileSync(lockFile, "utf-8"));
         return { ok: false, holder: existing.agent, taskId };
       } catch (_) {
+        // Corrupted or 0-byte existing file: unlink so the task does not stay wedged.
+        try { unlinkSync(lockFile); } catch (_) {}
         return { ok: false, holder: "unknown", taskId };
       }
     }
@@ -733,6 +753,7 @@ export function acquireLock(agentName, taskId, files = [], rootOrOpts = resolveR
       try { closeSync(fd); } catch (_) {}
     }
   }
+  });
 }
 
 export function releaseLock(taskId, rootOrOpts = resolveRoot()) {
@@ -754,8 +775,9 @@ export function releaseLock(taskId, rootOrOpts = resolveRoot()) {
   return false;
 }
 
-export function lockStatus(rootOrOpts = resolveRoot()) {
-  const root = typeof rootOrOpts === "string" ? rootOrOpts : resolveRoot();
+export function lockStatus(rootOrOpts = resolveRoot(), opts = {}) {
+  const root = typeof rootOrOpts === "string" ? rootOrOpts : (rootOrOpts?.root || resolveRoot());
+  const activeOnly = opts?.activeOnly === true;
   const lockDir = getLockDir(root);
   const locks = [];
   try {
@@ -764,7 +786,10 @@ export function lockStatus(rootOrOpts = resolveRoot()) {
       if (file.endsWith(".json")) {
         try {
           const content = readFileSync(join(lockDir, file), "utf-8");
-          locks.push(Object.freeze(JSON.parse(content)));
+          const record = JSON.parse(content);
+          const live = isLockLive(record);
+          if (activeOnly && !live) continue;
+          locks.push(Object.freeze({ ...record, live }));
         } catch (_) {}
       }
     }
@@ -788,6 +813,7 @@ export function isConcurrencyGroupLocked(groupName, rootOrOpts = resolveRoot(),
   const locks = lockStatus(rootOrOpts);
   for (const lock of locks) {
     if (excludeTaskId && lock.taskId === excludeTaskId) continue;
+    if (!isLockLive(lock)) continue;
     const lockGroup = String(lock.concurrencyGroup || lock.concurrency_group || "").trim().toLowerCase();
     if (lockGroup === targetGroup) {
       return true;
@@ -796,4 +822,88 @@ export function isConcurrencyGroupLocked(groupName, rootOrOpts = resolveRoot(),
   return false;
 }
 
+/**
+ * Scans .agent/state/locks/ for stale, expired, or corrupted lock records.
+ *
+ * Supported queue/process model:
+ * - Leased locks: reaped if Date.now() >= lockExpiry(record).
+ * - Process-bound locks: reaped if owner PID is dead (or recycled with different start time).
+ * - Corrupted files: 0-byte or unparseable JSON files reaped immediately.
+ * - Live locks: left completely untouched.
+ *
+ * @param {string|Object} [rootOrOpts=resolveRoot()]
+ * @param {Object} [opts]
+ * @param {boolean} [opts.dryRun=false] - When true, reports stale locks without deleting them.
+ * @returns {{ reapedCount: number, reaped: Array<{ file: string, taskId: string, agent: string, pid: number|null, reason: "corrupted"|"expired"|"dead-pid" }> }}
+ */
+export function reapStaleLocks(rootOrOpts = resolveRoot(), { dryRun = false } = {}) {
+  const root = typeof rootOrOpts === "string" ? rootOrOpts : (rootOrOpts?.root || resolveRoot());
+  const lockDir = getLockDir(root);
+
+  if (!existsSync(lockDir)) {
+    return { reapedCount: 0, reaped: [] };
+  }
+
+  const reaped = [];
+  let files = [];
+  try {
+    files = readdirSync(lockDir);
+  } catch (_) {
+    return { reapedCount: 0, reaped: [] };
+  }
+
+  for (const file of files) {
+    if (!file.endsWith(".json")) continue;
+    const lockPath = join(lockDir, file);
+    let record = null;
+    let corrupted = false;
+
+    try {
+      const content = readFileSync(lockPath, "utf-8");
+      if (!content || !content.trim()) {
+        corrupted = true;
+      } else {
+        record = JSON.parse(content);
+      }
+    } catch (_) {
+      corrupted = true;
+    }
+
+    let shouldReap = false;
+    let reason = "";
+
+    if (corrupted) {
+      shouldReap = true;
+      reason = "corrupted";
+    } else if (!isLockLive(record)) {
+      shouldReap = true;
+      if (record.leased === true) {
+        reason = "expired";
+      } else if (record.expiresAt && Date.now() >= lockExpiry(record)) {
+        reason = "expired";
+      } else {
+        reason = "dead-pid";
+      }
+    }
+
+    if (shouldReap) {
+      if (!dryRun) {
+        try {
+          unlinkSync(lockPath);
+        } catch (_) {}
+      }
+      reaped.push({
+        file,
+        taskId: record?.taskId || file.replace(/\.json$/, ""),
+        agent: record?.agent || "unknown",
+        pid: record?.pid ?? null,
+        reason,
+      });
+    }
+  }
+
+  return { reapedCount: reaped.length, reaped };
+}
+
+