parallel-codex-tui 0.1.3 → 0.1.5

package/dist/core/process-tree.js

@@ -0,0 +1,90 @@
+export class ProcessTreeCleanupError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProcessTreeCleanupError";
+    }
+}
+export async function terminateProcessTree(child, options) {
+    const pid = child.pid;
+    if (!pid || !processTreeIsAlive(child, options.processGroup)) {
+        return;
+    }
+    const termGraceMs = options.termGraceMs ?? 250;
+    const killWaitMs = options.killWaitMs ?? 500;
+    const pollMs = options.pollMs ?? 20;
+    try {
+        if (processGroupLeaderWasReused(child, options.processGroup)) {
+            return;
+        }
+        signalProcessTree(pid, "SIGTERM", options.processGroup);
+        if (await waitForProcessTreeExit(child, options.processGroup, termGraceMs, pollMs)) {
+            return;
+        }
+        signalProcessTree(pid, "SIGKILL", options.processGroup);
+        if (await waitForProcessTreeExit(child, options.processGroup, killWaitMs, pollMs)) {
+            return;
+        }
+    }
+    catch (error) {
+        throw new ProcessTreeCleanupError(`Could not terminate ${options.label} ${pid}: ${errorMessage(error)}`);
+    }
+    throw new ProcessTreeCleanupError(`${options.label} group ${pid} remained alive after SIGKILL.`);
+}
+export function processTreeIsAlive(child, processGroup) {
+    const pid = child.pid;
+    if (!pid) {
+        return false;
+    }
+    if (child.exitCode !== null || child.signalCode !== null) {
+        if (processGroupLeaderWasReused(child, processGroup)) {
+            return false;
+        }
+        return processGroup && signalTargetIsAlive(-pid);
+    }
+    if (processGroup && signalTargetIsAlive(-pid)) {
+        return true;
+    }
+    return signalTargetIsAlive(pid);
+}
+function processGroupLeaderWasReused(child, processGroup) {
+    // POSIX keeps the numeric PID reserved while the original process group still exists.
+    return processGroup
+        && (child.exitCode !== null || child.signalCode !== null)
+        && typeof child.pid === "number"
+        && signalTargetIsAlive(child.pid);
+}
+async function waitForProcessTreeExit(child, processGroup, timeoutMs, pollMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (!processTreeIsAlive(child, processGroup)) {
+            return true;
+        }
+        await delay(pollMs);
+    }
+    return !processTreeIsAlive(child, processGroup);
+}
+function signalProcessTree(pid, signal, processGroup) {
+    try {
+        process.kill(processGroup ? -pid : pid, signal);
+    }
+    catch (error) {
+        if (error.code !== "ESRCH") {
+            throw error;
+        }
+    }
+}
+function signalTargetIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+async function delay(milliseconds) {
+    await new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/core/router-audit.js

@@ -0,0 +1,155 @@
+import { z } from "zod";
+import { RouteDecisionSchema, RouterFailureKindSchema } from "../domain/schemas.js";
+import { readRecentJsonLines } from "./file-store.js";
+import { sanitizeRouterText } from "./router-redaction.js";
+export { RouterFailureKindSchema };
+export const RouterAuditRecordSchema = RouteDecisionSchema.extend({
+    time: z.string().datetime(),
+    request: z.string(),
+    workspace: z.string().min(1),
+    scope: z.enum(["initial", "follow-up"]).default("initial"),
+    router_timeout_ms: z.number().int().positive().optional(),
+    router_first_output_timeout_ms: z.number().int().positive().optional(),
+    router_idle_timeout_ms: z.number().int().positive().optional(),
+    router_max_output_bytes: z.number().int().min(1024).max(16 * 1024 * 1024).optional(),
+    router_max_attempts: z.number().int().min(1).max(3).optional(),
+    router_retry_delay_ms: z.number().int().nonnegative().max(10000).optional(),
+    proxy_configured: z.boolean().optional(),
+    failure_kind: RouterFailureKindSchema.optional()
+});
+export function classifyRouterFailure(reason) {
+    const timedOut = /\b(?:timed out|timeout|ETIMEDOUT)\b/i.test(reason);
+    const proxyMentioned = /\bproxy\b|代理/i.test(reason);
+    const proxyFailure = (/\bproxy(?:\s+(?:connection|connect|handshake|authentication|request|server|transport|tunnel))?\s+(?:authentication|required|failed|failure|error|refused|unreachable|invalid|closed|reset)\b/i.test(reason)
+        || /\b(?:failed|unable|cannot|could not)\s+(?:to\s+)?(?:connect|reach|use|negotiate).{0,30}\bproxy\b/i.test(reason)
+        || /代理.{0,20}(?:认证|失败|错误|拒绝|无法|不可达)/i.test(reason));
+    if (proxyMentioned && timedOut) {
+        return "timeout";
+    }
+    if (proxyFailure) {
+        return "proxy";
+    }
+    if (/\b(?:401|403)\b|\b(?:unauthori[sz]ed|forbidden|authentication|api[-_\s]?key|login required|not logged in|sign in)\b/i.test(reason)) {
+        return "auth";
+    }
+    if (/\b429\b|\b(?:rate[ -]?limit|too many requests|quota (?:exceeded|exhausted)|usage limit)\b/i.test(reason)) {
+        return "rate-limit";
+    }
+    if (/\b(?:ECONNREFUSED|ECONNRESET|ENETUNREACH|EHOSTUNREACH|ENOTFOUND|EAI_AGAIN)\b|\b(?:network|websocket|https transport|fetch failed|certificate|tls|ssl)\b/i.test(reason)) {
+        return "network";
+    }
+    if (timedOut) {
+        return "timeout";
+    }
+    if (/\b(?:ENOENT|command not found|spawn error)\b/i.test(reason)) {
+        return "unavailable";
+    }
+    if (/\b(?:no json object|invalid json|invalid codex router (?:mode|response object)|failed to parse json|unexpected token)\b/i.test(reason)) {
+        return "invalid-output";
+    }
+    if (/\b(?:exited with (?:code|signal)|process exited)\b/i.test(reason)) {
+        return "exit";
+    }
+    if (/\b(?:router input failed|stdin|EPIPE)\b/i.test(reason)) {
+        return "input";
+    }
+    return null;
+}
+export function routerFallbackIsTransient(route) {
+    if (route.source !== "fallback") {
+        return false;
+    }
+    if (route.router_timeout_kind === "total") {
+        return false;
+    }
+    if (route.router_timeout_kind === "first-output" || route.router_timeout_kind === "idle") {
+        return true;
+    }
+    const kind = route.router_failure_kind ?? classifyRouterFailure(route.reason);
+    if (kind === "network" || kind === "proxy") {
+        return true;
+    }
+    if (kind === "timeout") {
+        return route.router_failure_stage !== "response";
+    }
+    if (kind === "input") {
+        return /\b(?:EPIPE|ECONNRESET|temporar(?:y|ily))\b/i.test(route.reason);
+    }
+    if (kind === "exit") {
+        return /\b(?:ECONNRESET|ETIMEDOUT|EAI_AGAIN|temporar(?:y|ily)|try again|connection reset)\b/i.test(route.reason);
+    }
+    return false;
+}
+export function diagnoseRouterFailure(evidence) {
+    const kind = evidence.failure_kind ?? classifyRouterFailure(evidence.reason) ?? "unknown";
+    if (kind === "auth") {
+        return diagnosis(kind, "Codex authentication failed", "run codex login, then retry Router");
+    }
+    if (kind === "rate-limit") {
+        return diagnosis(kind, "The provider rate limit blocked routing", "wait for quota or change the Router model/provider");
+    }
+    if (kind === "proxy") {
+        return diagnosis(kind, "Router reported a proxy-path failure", "run parallel-codex-tui --doctor --probe-router and verify the proxy upstream");
+    }
+    if (kind === "network") {
+        return diagnosis(kind, "Router reported a network-path failure", "run parallel-codex-tui --doctor --probe-router and verify DNS, TLS, and API reachability");
+    }
+    if (kind === "unavailable") {
+        return diagnosis(kind, evidence.router_failure_stage === "spawn" ? "Router process could not start" : "Router command is unavailable", "run parallel-codex-tui --doctor and fix router.codex.command");
+    }
+    if (kind === "invalid-output") {
+        return diagnosis(kind, "Router returned output that was not valid route JSON", "retry Router; if it repeats, inspect the Router model/provider output");
+    }
+    if (kind === "input") {
+        return diagnosis(kind, "Router process rejected the request input", "check that router.codex.args accepts a prompt on stdin");
+    }
+    if (kind === "timeout") {
+        return diagnoseRouterTimeout(evidence);
+    }
+    if (kind === "exit") {
+        return diagnosis(kind, "Router process exited before a valid route response", "run the configured Codex command directly and inspect its exit output");
+    }
+    return diagnosis("unknown", "Router failed before a valid route response", "run parallel-codex-tui --doctor --probe-router and inspect the recorded reason");
+}
+function diagnoseRouterTimeout(evidence) {
+    if (evidence.router_timeout_kind === "first-output") {
+        return diagnosis("timeout", "Router produced no output before the first-output deadline", evidence.proxy_configured
+            ? "run parallel-codex-tui --doctor --probe-router; verify Codex login and proxy upstream, or raise router.codex.firstOutputTimeoutMs"
+            : "run parallel-codex-tui --doctor --probe-router; verify Codex login and API network path, or raise router.codex.firstOutputTimeoutMs");
+    }
+    if (evidence.router_timeout_kind === "idle") {
+        return diagnosis("timeout", (evidence.router_stdout_bytes ?? 0) > 0
+            ? "Router response stopped before valid route JSON completed"
+            : "Router diagnostics stopped before a route response", "inspect the reason; retry Router or raise router.codex.idleTimeoutMs");
+    }
+    if ((evidence.router_stdout_bytes ?? 0) > 0) {
+        return diagnosis("timeout", "Router began a route response but did not finish", "retry Router or raise router.codex.timeoutMs");
+    }
+    if ((evidence.router_stderr_bytes ?? 0) > 0) {
+        return diagnosis("timeout", "Router emitted diagnostics but no route response", "inspect the reason, then run parallel-codex-tui --doctor --probe-router");
+    }
+    if (evidence.router_failure_stage === "waiting-output") {
+        return diagnosis("timeout", "Router produced no output before the timeout", evidence.proxy_configured
+            ? "run parallel-codex-tui --doctor --probe-router; verify Codex login and proxy upstream"
+            : "run parallel-codex-tui --doctor --probe-router; verify Codex login and API network path");
+    }
+    return diagnosis("timeout", "Router timed out before a valid route response", evidence.proxy_configured
+        ? "run parallel-codex-tui --doctor --probe-router; verify Codex login and proxy upstream"
+        : "run parallel-codex-tui --doctor --probe-router; verify Codex login and API network path");
+}
+function diagnosis(kind, summary, action) {
+    return { kind, summary, action };
+}
+export async function readRouterAudit(path, limit = 100) {
+    const boundedLimit = Number.isFinite(limit)
+        ? Math.min(500, Math.max(0, Math.trunc(limit)))
+        : 100;
+    if (boundedLimit === 0) {
+        return [];
+    }
+    return (await readRecentJsonLines(path, RouterAuditRecordSchema, boundedLimit)).map((record) => ({
+        ...record,
+        request: sanitizeRouterText(record.request),
+        reason: sanitizeRouterText(record.reason)
+    }));
+}

package/dist/core/router-redaction.js

@@ -0,0 +1,31 @@
+const ROUTER_URL_PATTERN = /\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"'`]+/giu;
+const ROUTER_SECRET_ASSIGNMENT_PATTERN = /\b((?:(?:[a-z][a-z0-9]*_)*(?:api_?key|access_?token|auth_?token|token|password|passwd|secret|client_?secret))\s*(?:=|:)\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;]+)/giu;
+const ROUTER_AUTHORIZATION_PATTERN = /\b((?:authorization\s*:\s*)?(?:bearer|basic)\s+)[^\s,;]+/giu;
+const ROUTER_RAW_TOKEN_PATTERN = /\b(?:sk-[a-z0-9_-]{8,}|npm_[a-z0-9]{20,}|gh[pousr]_[a-z0-9]{20,}|github_pat_[a-z0-9_]{20,})\b/giu;
+const ROUTER_URL_TRAILING_PUNCTUATION = /[),.;!?，。；！？、]+$/u;
+export function sanitizeRouterText(value) {
+    return value
+        .replace(ROUTER_URL_PATTERN, sanitizeRouterUrl)
+        .replace(ROUTER_AUTHORIZATION_PATTERN, "$1***")
+        .replace(ROUTER_SECRET_ASSIGNMENT_PATTERN, "$1***")
+        .replace(ROUTER_RAW_TOKEN_PATTERN, "***");
+}
+function sanitizeRouterUrl(value) {
+    const trailing = value.match(ROUTER_URL_TRAILING_PUNCTUATION)?.[0] ?? "";
+    const candidate = trailing ? value.slice(0, -trailing.length) : value;
+    try {
+        const parsed = new URL(candidate);
+        const credentials = parsed.username || parsed.password ? "***@" : "";
+        return `${parsed.protocol}//${credentials}${parsed.host}${trailing}`;
+    }
+    catch {
+        const authority = candidate.match(/^([a-z][a-z0-9+.-]*:\/\/)([^/?#]*)/iu);
+        if (!authority) {
+            return value.replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^@\s/]+)@/iu, "$1***@");
+        }
+        const safeAuthority = authority[2]?.includes("@")
+            ? `***@${authority[2].slice(authority[2].lastIndexOf("@") + 1)}`
+            : authority[2] ?? "";
+        return `${authority[1]}${safeAuthority}${trailing}`;
+    }
+}