mixdog 0.7.17 → 0.8.0

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -0,0 +1,231 @@
+import { spawnSync } from 'child_process';
+import { existsSync } from 'fs';
+import { basename, dirname, join } from 'path';
+
+let _resolvedShell = null;
+let _configuredShell = null;
+// Per-kind cache for resolveShellFor(). 'default' aliases resolveShell()'s
+// singleton; 'bash'/'powershell' get their own memoized slots. ONLY a
+// successful (non-null) resolution is cached — a resolution MISS is
+// deliberately not memoized so the next call re-probes (Git Bash / pwsh may
+// be installed mid-session, and PATH can change for a long-lived host).
+const _resolvedShellByKind = new Map();
+
+export function setConfiguredShell(value = '') {
+    const next = String(value || '').trim();
+    _configuredShell = next || null;
+    _resolvedShell = null;
+    _resolvedShellByKind.clear();
+}
+
+function shellTypeFor(shell) {
+    const stem = basename(String(shell || '')).toLowerCase().replace(/\.exe$/, '');
+    if (stem === 'pwsh' || stem === 'powershell') return 'powershell';
+    if (stem === 'bash' || stem === 'zsh' || stem === 'sh') return 'posix';
+    return process.platform === 'win32' ? 'powershell' : 'posix';
+}
+
+function shellSpec(shell, shellType = shellTypeFor(shell)) {
+    if (shellType === 'powershell') {
+        // `-WindowStyle Hidden` is a Windows-only switch. PowerShell Core
+        // (pwsh) on macOS/Linux rejects it, so only append it on win32.
+        const psArgs = ['-NoLogo', '-NoProfile', '-NonInteractive'];
+        if (process.platform === 'win32') psArgs.push('-WindowStyle', 'Hidden');
+        psArgs.push('-Command');
+        return {
+            shell,
+            shellArg: '-Command',
+            shellArgs: psArgs,
+            shellType,
+        };
+    }
+    return { shell, shellArg: '-c', shellArgs: ['-c'], shellType };
+}
+
+function firstExistingPathFromWhere(commandName) {
+    try {
+        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+            timeout: 1000,
+        });
+        if (r.status !== 0 || !r.stdout) return null;
+        const lines = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+        return lines.find(p => existsSync(p)) || null;
+    } catch {
+        return null;
+    }
+}
+
+function resolveWindowsPowerShell() {
+    const pwsh = firstExistingPathFromWhere('pwsh.exe');
+    if (pwsh) return shellSpec(pwsh, 'powershell');
+
+    const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+    const bundled = join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    if (existsSync(bundled)) return shellSpec(bundled, 'powershell');
+
+    const powershell = firstExistingPathFromWhere('powershell.exe');
+    if (powershell) return shellSpec(powershell, 'powershell');
+
+    return shellSpec('powershell.exe', 'powershell');
+}
+
+export function resolveShell() {
+    if (_resolvedShell) return _resolvedShell;
+    // Gate on the actual platform, NOT WINDIR/SystemRoot env presence: under
+    // WSL those vars can be inherited via interop while process.platform is
+    // 'linux', and WSL must resolve /bin/sh — not Windows PowerShell.
+    const isWindows = process.platform === 'win32';
+    if (!isWindows) {
+        _resolvedShell = shellSpec('/bin/sh', 'posix');
+        return _resolvedShell;
+    }
+    const explicit = _configuredShell || process.env.MIXDOG_SHELL;
+    if (explicit && shellTypeFor(explicit) === 'powershell') {
+        _resolvedShell = shellSpec(explicit);
+        return _resolvedShell;
+    }
+    _resolvedShell = resolveWindowsPowerShell();
+    return _resolvedShell;
+}
+
+function _isWindows() {
+    // Real-platform check only (see resolveShell): env presence would make
+    // WSL (process.platform 'linux') mis-resolve to Windows Git Bash.
+    return process.platform === 'win32';
+}
+
+// Resolve Git Bash on Windows. Strategy (invariant-based, no silent fallback):
+//  1. Iterate ALL `where git.exe` hits — a shim (Scoop/Chocolatey/winget under
+//     a \shims\ dir) or a second install can be the FIRST match yet not a real
+//     Git-for-Windows layout with a sibling bash.exe. For each, walk a few
+//     ancestor levels of <gitDir> and probe the two known launcher shapes
+//     (<root>\bin\bash.exe, <root>\usr\bin\bash.exe). This tolerates git.exe
+//     living under cmd\, bin\, or mingw64\bin\ without a fixed sibling distance.
+//  2. `where bash.exe` EXCLUDING any hit under System32 — that path is the WSL
+//     `bash.exe` launcher, which is the wrong target (launches a Linux distro,
+//     not Git-for-Windows bash).
+// Returns a posix shellSpec, or null when Git Bash is genuinely not installed.
+function resolveWindowsGitBash() {
+    for (const git of allExistingPathsFromWhere('git.exe')) {
+        const bash = probeGitBashFromGitExe(git);
+        if (bash) return shellSpec(bash, 'posix');
+    }
+    // Fallback: a bare `bash.exe` on PATH, but never the System32 WSL launcher.
+    const bash = firstExistingPathFromWhereExcluding('bash.exe', /\\system32\\/i);
+    if (bash) return shellSpec(bash, 'posix');
+    // Final fallback: probe well-known Git-for-Windows install roots on the
+    // filesystem directly. PATH-independent and spawn-free, so it still resolves
+    // when a long-lived server process inherited an env without Git\cmd, or when
+    // the `where` probe times out (both observed in practice). Windows-only:
+    // this function is reached solely via the _isWindows() branch in
+    // resolveShellFor, so the hardcoded Windows paths never run on other OSes.
+    const direct = gitBashFromKnownWindowsRoots();
+    if (direct) return shellSpec(direct, 'posix');
+    return null;
+}
+
+// Probe standard Git-for-Windows install roots via the filesystem only.
+// Env-var roots first (machine ProgramFiles + per-user LOCALAPPDATA installs),
+// then fixed Program Files fallbacks for the rare case those vars are empty.
+function gitBashFromKnownWindowsRoots() {
+    const env = process.env;
+    const roots = [];
+    for (const base of [env.ProgramW6432, env.ProgramFiles, env['ProgramFiles(x86)']]) {
+        if (base) roots.push(join(base, 'Git'));
+    }
+    if (env.LOCALAPPDATA) roots.push(join(env.LOCALAPPDATA, 'Programs', 'Git'));
+    roots.push('C:\\Program Files\\Git', 'C:\\Program Files (x86)\\Git');
+    for (const root of roots) {
+        for (const rel of [['bin', 'bash.exe'], ['usr', 'bin', 'bash.exe']]) {
+            const cand = join(root, ...rel);
+            if (existsSync(cand)) return cand;
+        }
+    }
+    return null;
+}
+
+// Walk up to 3 ancestor levels from <gitExe>'s directory, probing each
+// candidate install root for bin\bash.exe then usr\bin\bash.exe. Covers
+// git.exe under <root>\cmd\, <root>\bin\, and <root>\mingw64\bin\.
+function probeGitBashFromGitExe(gitExe) {
+    let dir = dirname(gitExe);
+    for (let level = 0; level < 3 && dir; level++) {
+        for (const rel of [['bin', 'bash.exe'], ['usr', 'bin', 'bash.exe']]) {
+            const cand = join(dir, ...rel);
+            if (existsSync(cand)) return cand;
+        }
+        const parent = dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+    }
+    return null;
+}
+
+function allExistingPathsFromWhere(commandName) {
+    try {
+        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+            timeout: 1000,
+        });
+        if (r.status !== 0 || !r.stdout) return [];
+        return r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim())
+            .filter(Boolean).filter(p => existsSync(p));
+    } catch {
+        return [];
+    }
+}
+
+function firstExistingPathFromWhereExcluding(commandName, excludeRe) {
+    try {
+        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+            timeout: 1000,
+        });
+        if (r.status !== 0 || !r.stdout) return null;
+        const lines = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+        return lines.find(p => existsSync(p) && !excludeRe.test(p)) || null;
+    } catch {
+        return null;
+    }
+}
+
+// Kind-aware shell resolution. kind:
+//  'default'    → identical to resolveShell() (PowerShell on Windows, /bin/sh elsewhere).
+//  'bash'       → on Windows, Git Bash (or null if not installed); elsewhere /bin/sh (POSIX is already bash-compatible).
+//  'powershell' → on Windows, resolveShell(); elsewhere pwsh if present, else null.
+// Each kind is memoized independently, but ONLY on success: a resolution miss
+// (null) is not cached, so the caller's clear-error path is re-probed on the
+// next call rather than pinned for the life of the process.
+export function resolveShellFor(kind = 'default') {
+    if (kind == null || kind === 'default') return resolveShell();
+    if (_resolvedShellByKind.has(kind)) return _resolvedShellByKind.get(kind);
+
+    let spec = null;
+    if (kind === 'bash') {
+        spec = _isWindows() ? resolveWindowsGitBash() : shellSpec('/bin/sh', 'posix');
+    } else if (kind === 'powershell') {
+        if (_isWindows()) {
+            spec = resolveShell();
+        } else {
+            const pwsh = (() => {
+                try {
+                    const r = spawnSync('which', ['pwsh'], { stdio: ['ignore', 'pipe', 'ignore'], timeout: 1000 });
+                    if (r.status !== 0 || !r.stdout) return null;
+                    const p = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).find(Boolean);
+                    return p && existsSync(p) ? p : null;
+                } catch { return null; }
+            })();
+            spec = pwsh ? shellSpec(pwsh, 'powershell') : null;
+        }
+    } else {
+        spec = resolveShell();
+    }
+
+    // Cache positively only — see the _resolvedShellByKind / doc comments above.
+    if (spec) _resolvedShellByKind.set(kind, spec);
+    return spec;
+}

package/src/runtime/agent/orchestrator/tools/builtin/snapshot-store.mjs

@@ -0,0 +1,223 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync } from 'fs';
+import { join } from 'path';
+import { writeJsonAtomicSync } from '../../../../shared/atomic-file.mjs';
+import { resolvePluginData } from '../../../../shared/plugin-paths.mjs';
+
+// Mixdog read/write/edit share a scoped snapshot store. Value stores the
+// mtime + size at read-time. A missing scope is fail-closed: snapshots without
+// a real scope id are NOT recorded under a shared default bucket (would let
+// worker A's read satisfy worker B's edit-gate across sessions via a persisted
+// __global__.json).
+const readFilesByScope = new Map(); // scope → Map(fullPath → { mtimeMs, size, ...meta })
+
+// ── Disk-persisted snapshot store ────────────────────────────────────────
+// Mirror the in-memory readFilesByScope to per-scope JSON files under
+// `${PLUGIN_DATA}/read-snapshots/`. Hydration is lazy (first scope access);
+// flush is debounced and drained synchronously on process exit.
+const SNAPSHOT_DIR = (() => {
+    try {
+        const dataDir = resolvePluginData();
+        if (!dataDir) return null;
+        const dir = join(dataDir, 'read-snapshots');
+        // R4 data-at-rest: snapshot entries reveal which files an actor
+        // has read; clamp dir to owner-only on POSIX (advisory on Windows).
+        if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+        return dir;
+    } catch { return null; }
+})();
+
+const SNAPSHOT_STALE_MS = 30 * 24 * 60 * 60 * 1000;
+(function sweepStaleSnapshotScopes() {
+    if (!SNAPSHOT_DIR) return;
+    let entries;
+    try { entries = readdirSync(SNAPSHOT_DIR); }
+    catch { return; }
+    const now = Date.now();
+    for (const name of entries) {
+        if (!name.endsWith('.json')) continue;
+        const full = join(SNAPSHOT_DIR, name);
+        try {
+            const st = statSync(full);
+            if ((now - st.mtimeMs) > SNAPSHOT_STALE_MS) unlinkSync(full);
+        } catch { /* missing / race — skip */ }
+    }
+})();
+
+const PERSIST_DEBOUNCE_MS = 500;
+const persistPending = new Map(); // scopeKey → Timeout
+const scopeHydrated = new Set();
+
+function snapshotScopeFilePath(scopeKey) {
+    if (!SNAPSHOT_DIR) return null;
+    const safe = String(scopeKey).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 200);
+    return join(SNAPSHOT_DIR, `${safe}.json`);
+}
+
+// R3 H1: persisted snapshots are read-back from disk on lazy hydration and
+// directly trusted by the edit-gate (`isSnapshotStale` early-returns false
+// on stat match). A malformed / forged entry must NEVER reach the gate, so
+// every field that downstream code consumes is shape-validated here. Bad
+// entries are dropped silently (treated as "never read") rather than
+// surfaced — the model will simply be forced to re-read before edit.
+const MAX_RANGES_PER_ENTRY = 4096;
+function isValidPersistedSnapshotEntry(snap) {
+    if (!snap || typeof snap !== 'object' || Array.isArray(snap)) return false;
+    if (!Number.isFinite(snap.mtimeMs)) return false;
+    if (!Number.isFinite(snap.size) || snap.size < 0) return false;
+    if (snap.ctimeMs !== undefined && !Number.isFinite(snap.ctimeMs)) return false;
+    if (snap.contentHash !== undefined && snap.contentHash !== null) {
+        if (typeof snap.contentHash !== 'string') return false;
+        if (!/^[a-f0-9]{1,128}$/i.test(snap.contentHash)) return false;
+    }
+    if (snap.ranges !== undefined) {
+        if (!Array.isArray(snap.ranges)) return false;
+        if (snap.ranges.length > MAX_RANGES_PER_ENTRY) return false;
+    }
+    if (snap.rangeHashes !== undefined) {
+        if (!Array.isArray(snap.rangeHashes)) return false;
+        if (snap.rangeHashes.length > MAX_RANGES_PER_ENTRY) return false;
+    }
+    if (snap.rangeHash !== undefined && snap.rangeHash !== null && typeof snap.rangeHash !== 'string') return false;
+    if (snap.grepOnly !== undefined && typeof snap.grepOnly !== 'boolean') return false;
+    return true;
+}
+
+function loadScopeFromDisk(scopeKey) {
+    const path = snapshotScopeFilePath(scopeKey);
+    if (!path || !existsSync(path)) return new Map();
+    try {
+        const raw = readFileSync(path, 'utf-8');
+        const obj = _reviveInfinitySentinels(JSON.parse(raw));
+        if (!obj || typeof obj !== 'object' || Array.isArray(obj)) return new Map();
+        const map = new Map();
+        for (const [fp, snap] of Object.entries(obj)) {
+            if (typeof fp !== 'string' || !fp) continue;
+            if (!isValidPersistedSnapshotEntry(snap)) continue;
+            map.set(fp, snap);
+        }
+        return map;
+    } catch { return new Map(); }
+}
+
+// JSON cannot represent Infinity (it serializes to null), which silently turns
+// a full-file range { endLine: Infinity } into { endLine: null } on persist and
+// breaks the `endLine === Infinity` full-coverage checks after hydrate. Convert
+// Infinity to a unique sentinel on write and back on read. Shape-agnostic deep
+// clone (does NOT mutate the live in-memory snapshot objects).
+const INFINITY_SENTINEL = '__mixdog_Infinity_sentinel__';
+function _withInfinitySentinels(value) {
+    if (value === Infinity) return INFINITY_SENTINEL;
+    if (Array.isArray(value)) return value.map(_withInfinitySentinels);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) out[k] = _withInfinitySentinels(v);
+        return out;
+    }
+    return value;
+}
+function _reviveInfinitySentinels(value) {
+    if (value === INFINITY_SENTINEL) return Infinity;
+    if (Array.isArray(value)) return value.map(_reviveInfinitySentinels);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) out[k] = _reviveInfinitySentinels(v);
+        return out;
+    }
+    return value;
+}
+
+function persistScopeSync(scopeKey) {
+    const path = snapshotScopeFilePath(scopeKey);
+    if (!path) return;
+    const readFiles = readFilesByScope.get(scopeKey);
+    if (!readFiles || readFiles.size === 0) {
+        // Empty scope: remove on-disk file so it doesn't grow stale.
+        try { if (existsSync(path)) unlinkSync(path); } catch {}
+        return;
+    }
+    const obj = {};
+    for (const [fp, snap] of readFiles.entries()) obj[fp] = snap;
+    try {
+        writeJsonAtomicSync(path, _withInfinitySentinels(obj), {
+            compact: true,
+            lock: true,
+            mode: 0o600,
+            fsync: false,
+            fsyncDir: false,
+        });
+    } catch {}
+}
+
+export function deleteReadSnapshotPathEverywhere(fullPath) {
+    for (const [scopeKey, readFiles] of readFilesByScope.entries()) {
+        if (readFiles.delete(fullPath)) scheduleScopePersist(scopeKey);
+    }
+    if (!SNAPSHOT_DIR) return;
+    let entries;
+    try { entries = readdirSync(SNAPSHOT_DIR); }
+    catch { return; }
+    for (const name of entries) {
+        if (!name.endsWith('.json')) continue;
+        const p = join(SNAPSHOT_DIR, name);
+        try {
+            const obj = JSON.parse(readFileSync(p, 'utf-8'));
+            if (!obj || typeof obj !== 'object' || !Object.prototype.hasOwnProperty.call(obj, fullPath)) continue;
+            delete obj[fullPath];
+            if (Object.keys(obj).length === 0) unlinkSync(p);
+            else {
+                writeJsonAtomicSync(p, obj, {
+                    compact: true,
+                    lock: true,
+                    mode: 0o600,
+                    fsync: false,
+                    fsyncDir: false,
+                });
+            }
+        } catch {}
+    }
+}
+
+export function scheduleScopePersist(scopeKey) {
+    if (scopeKey === null || scopeKey === undefined) return;
+    if (persistPending.has(scopeKey)) return;
+    const t = setTimeout(() => {
+        persistPending.delete(scopeKey);
+        try { persistScopeSync(scopeKey); } catch {}
+    }, PERSIST_DEBOUNCE_MS);
+    if (t.unref) t.unref();
+    persistPending.set(scopeKey, t);
+}
+
+function flushAllScopesSync() {
+    for (const [key, timer] of persistPending) {
+        try { clearTimeout(timer); } catch {}
+        try { persistScopeSync(key); } catch {}
+    }
+    persistPending.clear();
+}
+process.on('exit', flushAllScopesSync);
+
+export function readScopeKey(scope) {
+    return scope ? String(scope) : null;
+}
+
+export function readFilesForScope(scope) {
+    const key = readScopeKey(scope);
+    if (key === null) {
+        // No scope id: fail-closed. Return a fresh ephemeral Map that is
+        // never cached in readFilesByScope, never hydrated, never
+        // persisted to disk. Writes are dropped on the floor, lookups
+        // return undefined → edit-gate cannot pass without a real scoped
+        // read. Closes the cross-session bypass via __global__.json.
+        return new Map();
+    }
+    let readFiles = readFilesByScope.get(key);
+    if (!readFiles) {
+        // Lazy hydrate: pull persisted snapshots for this scope from disk
+        // on first access. Subsequent gets stay in-memory.
+        readFiles = scopeHydrated.has(key) ? new Map() : loadScopeFromDisk(key);
+        scopeHydrated.add(key);
+        readFilesByScope.set(key, readFiles);
+    }
+    return readFiles;
+}