killeros 2.0.3 → 2.0.5

package/killeros/hooks.ts

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { CONFIG_DIR_NAME, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { reportError } from "./errors.ts";
 import { MAX_NODE_TIMER_MS } from "./limits.ts";
@@ -22,6 +23,7 @@ interface HookExecutionResult {
   stdout: string;
   stderr: string;
   timedOut: boolean;
+  cancelled: boolean;
   exitUnconfirmed: boolean;
 }
 
@@ -43,6 +45,10 @@ function loadKillerosHooks(ctx: ExtensionContext): KillerosHookConfig {
       const candidates = parsed.hooks?.[event];
       if (!Array.isArray(candidates)) continue;
       hooks[event] = candidates.filter((hook, index) => {
+        if (event === "agent_settled" && hook?.matcher !== undefined) {
+          ctx.ui.notify(`Ignored ${event} hook ${index + 1}: matchers are only valid for tool events`, "warning");
+          return false;
+        }
         const valid = hook
           && typeof hook.command === "string"
           && hook.command.trim().length > 0
@@ -79,9 +85,19 @@ function matchesHook(hook: KillerosHook, value: string): boolean {
   }
 }
 
-function appendBounded(current: string, chunk: Buffer | string): string {
-  if (current.length >= HOOK_OUTPUT_LIMIT) return current;
-  return (current + chunk.toString()).slice(0, HOOK_OUTPUT_LIMIT);
+interface HookOutputBuffer {
+  bytes: number;
+  decoder: StringDecoder;
+  text: string;
+}
+
+function appendBounded(output: HookOutputBuffer, chunk: Buffer | string): void {
+  const remaining = HOOK_OUTPUT_LIMIT - output.bytes;
+  if (remaining <= 0) return;
+  const bytes = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+  const captured = bytes.subarray(0, remaining);
+  output.bytes += captured.length;
+  output.text += output.decoder.write(captured);
 }
 
 function terminateHookProcess(child: ReturnType<typeof spawn>, force: boolean): void {
@@ -109,7 +125,17 @@ function terminateHookProcess(child: ReturnType<typeof spawn>, force: boolean):
   }
 }
 
-export function executeHook(command: string, cwd: string, environment: Record<string, string>, timeoutMs = 30_000, spawnProcess: typeof spawn = spawn): Promise<HookExecutionResult> {
+export function executeHook(
+  command: string,
+  cwd: string,
+  environment: Record<string, string>,
+  timeoutMs = 30_000,
+  spawnProcess: typeof spawn = spawn,
+  signal?: AbortSignal,
+): Promise<HookExecutionResult> {
+  if (signal?.aborted) {
+    return Promise.resolve({ code: 130, stdout: "", stderr: "", timedOut: false, cancelled: true, exitUnconfirmed: false });
+  }
   return new Promise((resolve) => {
     const child = spawnProcess(command, {
       cwd,
@@ -119,39 +145,51 @@ export function executeHook(command: string, cwd: string, environment: Record<st
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
     });
-    let stdout = "";
-    let stderr = "";
+    const stdout: HookOutputBuffer = { bytes: 0, decoder: new StringDecoder("utf8"), text: "" };
+    const stderr: HookOutputBuffer = { bytes: 0, decoder: new StringDecoder("utf8"), text: "" };
     let completed = false;
-    let timedOut = false;
-    let exitUnconfirmed = false;
+    let termination: "timeout" | "cancelled" | undefined;
     let timer: NodeJS.Timeout | undefined;
     let forceTimer: NodeJS.Timeout | undefined;
     let settleTimer: NodeJS.Timeout | undefined;
-    const finish = (code: number, unconfirmed = false): void => {
+    const finish = (code: number, exitUnconfirmed = false): void => {
       if (completed) return;
       completed = true;
-      exitUnconfirmed = unconfirmed;
       if (timer) clearTimeout(timer);
       if (forceTimer) clearTimeout(forceTimer);
       if (settleTimer) clearTimeout(settleTimer);
-      resolve({ code, stdout, stderr, timedOut, exitUnconfirmed });
+      signal?.removeEventListener("abort", abort);
+      resolve({
+        code,
+        stdout: stdout.text,
+        stderr: stderr.text,
+        timedOut: termination === "timeout",
+        cancelled: termination === "cancelled",
+        exitUnconfirmed,
+      });
     };
-    child.stdout.on("data", (chunk) => { stdout = appendBounded(stdout, chunk); });
-    child.stderr.on("data", (chunk) => { stderr = appendBounded(stderr, chunk); });
-    child.on("error", (error) => {
-      stderr = appendBounded(stderr, error.message);
-      finish(timedOut ? 124 : 1);
-    });
-    child.once("close", (code) => finish(timedOut ? 124 : code ?? 1));
-    timer = setTimeout(() => {
-      timedOut = true;
+    const terminationCode = (): number => termination === "cancelled" ? 130 : 124;
+    const beginTermination = (reason: "timeout" | "cancelled"): void => {
+      if (completed || termination) return;
+      termination = reason;
       terminateHookProcess(child, false);
       forceTimer = setTimeout(() => {
         if (completed) return;
         terminateHookProcess(child, true);
-        settleTimer = setTimeout(() => finish(124, true), 1_000);
+        settleTimer = setTimeout(() => finish(terminationCode(), true), 1_000);
       }, 1_000);
-    }, Math.max(1_000, Math.min(timeoutMs, 300_000)));
+    };
+    const abort = (): void => beginTermination("cancelled");
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) beginTermination("cancelled");
+    child.stdout.on("data", (chunk) => appendBounded(stdout, chunk));
+    child.stderr.on("data", (chunk) => appendBounded(stderr, chunk));
+    child.on("error", (error) => {
+      appendBounded(stderr, error.message);
+      finish(termination ? terminationCode() : 1);
+    });
+    child.once("close", (code) => finish(termination ? terminationCode() : code ?? 1));
+    timer = setTimeout(() => beginTermination("timeout"), Math.max(1_000, Math.min(timeoutMs, 300_000)));
   });
 }
 
@@ -180,7 +218,10 @@ export function registerLifecycleHooks(pi: ExtensionAPI): void {
         ctx.cwd,
         hookEnvironment("tool_call", event.toolName, event.input),
         hook.timeoutMs,
+        spawn,
+        ctx.signal,
       );
+      if (result.cancelled) return { block: true, reason: "Hook cancelled because the parent request was aborted" };
       if (result.code !== 0) {
         const reason = hookFailureMessage(hook, result);
         ctx.ui.notify(reason, "error");
@@ -200,7 +241,10 @@ export function registerLifecycleHooks(pi: ExtensionAPI): void {
           isError: event.isError,
         }),
         hook.timeoutMs,
+        spawn,
+        ctx.signal,
       );
+      if (result.cancelled) break;
       if (result.code !== 0) ctx.ui.notify(hookFailureMessage(hook, result), "error");
     }
   });
@@ -212,7 +256,10 @@ export function registerLifecycleHooks(pi: ExtensionAPI): void {
         ctx.cwd,
         hookEnvironment("agent_settled"),
         hook.timeoutMs,
+        spawn,
+        ctx.signal,
       );
+      if (result.cancelled) break;
       if (result.code !== 0) ctx.ui.notify(hookFailureMessage(hook, result), "error");
     }
   });

package/killeros/init-evidence.ts

@@ -0,0 +1,276 @@
+import { spawn } from "node:child_process";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { StringDecoder } from "node:string_decoder";
+
+export const INIT_READ_TOOL = "killeros_init_read";
+export const INIT_LIST_TOOL = "killeros_init_list";
+
+const SNAPSHOT_LIMIT = 40 * 1024;
+const AUTOMATIC_FILE_LIMIT = 8 * 1024;
+const READ_LIMIT = 32 * 1024;
+const PATH_LIMIT = 400;
+const DIRECTORY_LIMIT = 120;
+const DEPTH_LIMIT = 4;
+const EXCLUDED_DIRS = new Set([
+  ".agents", ".claude", ".git", ".next", ".pi", ".pytest_cache", ".turbo", ".venv", "__pycache__", "archive", "build", "coverage", "data", "dist", "logs", "node_modules", "target", "test-results", "vendor",
+]);
+const EXCLUDED_GUIDANCE = new Set([
+  ".cursorrules", "agents.md", "agents.local.md", "claude.md", "claude.local.md", "copilot-instructions.md", "gemini.md", "memory.md", "skill.md",
+]);
+const ROOT_EVIDENCE = [
+  "README.md", "README.rst", "README.txt", "CONTRIBUTING.md", "package.json", "pyproject.toml", "requirements.txt", "Cargo.toml", "go.mod", "Makefile", "Dockerfile", "compose.yaml", "compose.yml", "config.yaml", "config.yml", "tsconfig.json", "vite.config.ts", "vite.config.js", "eslint.config.js", "eslint.config.mjs",
+] as const;
+const NESTED_EVIDENCE = new Set(["package.json", "pyproject.toml", "requirements.txt", "Cargo.toml", "go.mod"]);
+
+export interface InitEvidenceIndex {
+  projectRoot: string;
+  canonicalPaths: ReadonlyMap<string, string>;
+  snapshot: string;
+}
+
+export interface InitEvidenceBuildResult {
+  index: InitEvidenceIndex;
+}
+
+function evidenceKey(relativePath: string): string {
+  const normalized = relativePath.replaceAll("\\", "/");
+  return process.platform === "win32" ? normalized.toLocaleLowerCase() : normalized;
+}
+
+function sensitiveEvidencePath(relativePath: string): boolean {
+  const normalized = relativePath.replaceAll("\\", "/").toLocaleLowerCase();
+  const name = path.posix.basename(normalized);
+  return /^\.env(?:\.|$)/u.test(name)
+    || [".npmrc", ".pypirc", ".netrc", "id_rsa", "id_ed25519", "credentials.json"].includes(name)
+    || /^service-account.*\.json$/u.test(name)
+    || /\.(?:pem|key|p12|pfx|jks|keystore)$/u.test(name);
+}
+
+function excludedPath(relativePath: string): boolean {
+  const segments = relativePath.replaceAll("\\", "/").split("/");
+  return segments.some((segment, index) =>
+    (index < segments.length - 1 && EXCLUDED_DIRS.has(segment.toLocaleLowerCase()))
+    || EXCLUDED_GUIDANCE.has(segment.toLocaleLowerCase()))
+    || sensitiveEvidencePath(relativePath);
+}
+
+async function collectCandidates(projectRoot: string): Promise<string[]> {
+  const files: string[] = [];
+  const queue: Array<{ relativePath: string; depth: number }> = [{ relativePath: "", depth: 0 }];
+  let directoriesRead = 0;
+  while (queue.length && files.length < PATH_LIMIT && directoriesRead < DIRECTORY_LIMIT) {
+    const current = queue.shift()!;
+    directoriesRead += 1;
+    let entries;
+    try {
+      entries = await fs.readdir(path.join(projectRoot, current.relativePath), { withFileTypes: true });
+    } catch (error) {
+      if (!current.relativePath) throw error;
+      continue;
+    }
+    entries.sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      if (files.length >= PATH_LIMIT) break;
+      const relativePath = path.posix.join(current.relativePath.replaceAll("\\", "/"), entry.name);
+      if (entry.isDirectory()) {
+        if (current.depth < DEPTH_LIMIT && !EXCLUDED_DIRS.has(entry.name.toLocaleLowerCase())) {
+          queue.push({ relativePath, depth: current.depth + 1 });
+        }
+      } else if (entry.isFile() && !excludedPath(relativePath)) {
+        try {
+          const stat = await fs.lstat(path.join(projectRoot, relativePath));
+          if (stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1) files.push(relativePath);
+        } catch {
+          // Files may disappear while the bounded map is collected.
+        }
+      }
+    }
+  }
+  return files;
+}
+
+async function gitIgnoredPaths(projectRoot: string, candidates: readonly string[]): Promise<ReadonlySet<string>> {
+  if (!candidates.length) return new Set();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let stdout = Buffer.alloc(0);
+    const child = spawn("git", ["-C", projectRoot, "check-ignore", "--stdin", "-z"], {
+      shell: false,
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true,
+    });
+    const fail = (): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new Error("Git ignore inspection failed; /init did not build repository evidence"));
+    };
+    const succeed = (value: ReadonlySet<string>): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(value);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      fail();
+    }, 2_000);
+    child.stdout.on("data", (chunk: Buffer) => {
+      if (stdout.length + chunk.length > 256 * 1024) {
+        child.kill("SIGKILL");
+        fail();
+        return;
+      }
+      stdout = Buffer.concat([stdout, chunk]);
+    });
+    child.once("error", fail);
+    child.stdin.once("error", () => {
+      child.kill("SIGKILL");
+      fail();
+    });
+    child.once("close", (code) => {
+      if (code === 1) {
+        if (stdout.length) fail();
+        else succeed(new Set());
+        return;
+      }
+      if (code !== 0 || !stdout.length || stdout.at(-1) !== 0) {
+        fail();
+        return;
+      }
+      let values: string[];
+      try {
+        values = new TextDecoder("utf-8", { fatal: true }).decode(stdout.subarray(0, -1)).split("\0");
+      } catch {
+        fail();
+        return;
+      }
+      const candidateSet = new Set(candidates.map(evidenceKey));
+      const ignored = new Set(values.map(evidenceKey));
+      if (values.some((value) => !value || !candidateSet.has(evidenceKey(value))) || ignored.size !== values.length) {
+        fail();
+        return;
+      }
+      succeed(ignored);
+    });
+    child.stdin.end(`${candidates.join("\0")}\0`);
+  });
+}
+
+function decodeCompleteUtf8(bytes: Buffer): string {
+  return new StringDecoder("utf8").write(bytes);
+}
+
+function appendWithinLimit(current: string, section: string, limit: number): string {
+  const remaining = limit - Buffer.byteLength(current, "utf8");
+  if (remaining <= 0) return current;
+  const bytes = Buffer.from(section, "utf8");
+  return current + decodeCompleteUtf8(bytes.subarray(0, remaining));
+}
+
+async function validateAndRead(projectRoot: string, absolutePath: string, limit: number): Promise<{ content: string; truncated: boolean }> {
+  const relative = path.relative(projectRoot, absolutePath);
+  if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    throw new Error("path is not available to /init");
+  }
+  let current = projectRoot;
+  for (const segment of relative.split(path.sep)) {
+    current = path.join(current, segment);
+    const stat = await fs.lstat(current);
+    if (stat.isSymbolicLink()) throw new Error("/init rejects symbolic-link and junction paths");
+  }
+  const pathStat = await fs.lstat(absolutePath);
+  if (!pathStat.isFile() || pathStat.nlink !== 1) throw new Error("/init rejects linked and non-regular files");
+  const handle = await fs.open(absolutePath, "r");
+  try {
+    const openedStat = await handle.stat();
+    if (!openedStat.isFile() || openedStat.nlink !== 1
+      || openedStat.dev !== pathStat.dev || openedStat.ino !== pathStat.ino) {
+      throw new Error("/init file changed while it was being opened");
+    }
+    const buffer = Buffer.alloc(limit + 1);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+    const data = buffer.subarray(0, Math.min(bytesRead, limit));
+    if (data.includes(0)) throw new Error("/init rejects binary files");
+    return { content: decodeCompleteUtf8(data), truncated: bytesRead > limit };
+  } finally {
+    await handle.close();
+  }
+}
+
+function normalizeRequestedPath(requestedPath: string): string {
+  if (!requestedPath || requestedPath.trim() !== requestedPath || requestedPath.startsWith("~")
+    || /^file:/iu.test(requestedPath) || path.isAbsolute(requestedPath)) {
+    throw new Error("path is not available to /init");
+  }
+  const normalized = requestedPath.replaceAll("\\", "/");
+  if (!normalized || normalized.split("/").some((segment) => segment === ".." || segment === "")) {
+    throw new Error("path is not available to /init");
+  }
+  return normalized.replace(/^\.\//u, "");
+}
+
+export async function buildInitEvidence(projectRoot: string): Promise<InitEvidenceBuildResult> {
+  const candidates = await collectCandidates(projectRoot);
+  const ignored = await gitIgnoredPaths(projectRoot, candidates);
+  const canonicalPaths = new Map<string, string>();
+  for (const relativePath of candidates) {
+    if (!ignored.has(evidenceKey(relativePath))) canonicalPaths.set(evidenceKey(relativePath), relativePath);
+  }
+
+  let snapshot = [
+    "# KillerOS repository snapshot",
+    "Root AGENTS.md is protected policy and is intentionally not part of this untrusted evidence.",
+    "",
+    "## Project files",
+    [...canonicalPaths.values()].join("\n"),
+  ].join("\n");
+  snapshot = appendWithinLimit("", snapshot, SNAPSHOT_LIMIT);
+  const automatic = new Set<string>(ROOT_EVIDENCE);
+  for (const relativePath of canonicalPaths.values()) {
+    const name = path.posix.basename(relativePath);
+    if (NESTED_EVIDENCE.has(name) || /^\.github\/workflows\/[^/]+\.ya?ml$/iu.test(relativePath)) automatic.add(relativePath);
+  }
+  for (const requested of automatic) {
+    const relativePath = canonicalPaths.get(evidenceKey(requested));
+    if (!relativePath || Buffer.byteLength(snapshot, "utf8") >= SNAPSHOT_LIMIT) continue;
+    try {
+      const result = await validateAndRead(projectRoot, path.join(projectRoot, relativePath), AUTOMATIC_FILE_LIMIT);
+      const suffix = result.truncated ? "\n[truncated by /init]" : "";
+      snapshot = appendWithinLimit(snapshot, `\n\n## ${relativePath}\n${result.content}${suffix}`, SNAPSHOT_LIMIT);
+    } catch {
+      // A mapped file may become unsafe or disappear before snapshot creation.
+    }
+  }
+  return { index: { projectRoot, canonicalPaths, snapshot } };
+}
+
+export async function readInitEvidence(index: InitEvidenceIndex, requestedPath: string): Promise<string> {
+  const normalized = normalizeRequestedPath(requestedPath);
+  const relativePath = index.canonicalPaths.get(evidenceKey(normalized));
+  if (!relativePath) throw new Error(`${requestedPath} is not available to /init`);
+  const result = await validateAndRead(index.projectRoot, path.join(index.projectRoot, relativePath), READ_LIMIT);
+  return result.truncated ? `${result.content}\n[truncated by /init at ${READ_LIMIT} bytes]` : result.content;
+}
+
+export async function readGeneratedInitTarget(projectRoot: string, targetPath: string): Promise<string> {
+  const result = await validateAndRead(projectRoot, targetPath, READ_LIMIT);
+  return result.truncated ? `${result.content}\n[truncated by /init at ${READ_LIMIT} bytes]` : result.content;
+}
+
+export function listInitEvidence(index: InitEvidenceIndex, requestedPath = "."): string[] {
+  const prefix = requestedPath === "." ? "" : normalizeRequestedPath(requestedPath).replace(/\/$/u, "");
+  const prefixWithSlash = prefix ? `${prefix}/` : "";
+  const children = new Set<string>();
+  let found = !prefix;
+  for (const relativePath of index.canonicalPaths.values()) {
+    if (!relativePath.startsWith(prefixWithSlash)) continue;
+    const remainder = relativePath.slice(prefixWithSlash.length);
+    if (!remainder) continue;
+    found = true;
+    children.add(remainder.split("/")[0]!);
+  }
+  if (!found) throw new Error(`${requestedPath} is not available to /init`);
+  return [...children].sort((left, right) => left.localeCompare(right)).slice(0, PATH_LIMIT);
+}