patchwork-os 0.2.0-beta.3 → 0.2.0-beta.5

package/dist/index.js

@@ -41,7 +41,10 @@ import { Bridge } from "./bridge.js";
 import { isBridgeToolsFileValid, repairBridgeToolsRulesIfStale, } from "./bridgeToolsRules.js";
 import { findEditor, parseConfig } from "./config.js";
 import { detectWorkspaceSymlinkInstall, PATCHWORK_PACKAGE_NAME, SYMLINK_INSTALL_FIX, } from "./installGuard.js";
+import { treeKill } from "./processTree.js";
 import { PACKAGE_VERSION, semverGt } from "./version.js";
+import { ensureCmdShim } from "./winShim.js";
+import { writeFileAtomicSync } from "./writeFileAtomic.js";
 const __dirnameTop = path.dirname(fileURLToPath(import.meta.url));
 // Warn when a symlinked global install is detected (`npm install -g .`).
 // launchctl / sandbox environments can fail through that link with EPERM.
@@ -190,8 +193,12 @@ if (process.argv[2] === "--help" ||
         `  recipe --help                             Full recipe subcommand index\n\n` +
         `Diagnose\n` +
         `  halts [--window 1h|24h|overnight|7d]      Morning summary of recent recipe halts\n` +
+        `  judgments [--window ...] [--recipe N]     Recent judge-step verdicts across runs\n` +
         `  traces export                             Bundle approval / recipe / decision traces\n` +
         `  print-token [--port N]                    Print the active bridge auth token\n\n` +
+        `Safety\n` +
+        `  kill-switch <engage|release|status>       Block / resume write-tier tools across bridges\n` +
+        `  panic [--reason "..."]                    Shorthand for kill-switch engage\n\n` +
         `Daemon (no subcommand)\n` +
         `  --workspace <dir>                         Start the bridge in foreground\n` +
         `  --watch                                   Auto-restart supervisor\n` +
@@ -1760,11 +1767,22 @@ if (process.argv[2] === "kill-switch") {
 // form is `kill-switch engage`; this alias matches it so shell history six
 // months later still makes sense. Does not accept sub-verbs — just runs engage.
 if (process.argv[2] === "panic") {
+    const extra = process.argv.slice(3); // e.g. --reason "..." --force-local
+    // Guard against `panic --help` engaging the kill switch — a real
+    // footgun if you tab-completed the verb to confirm syntax before
+    // committing to the action. `panic` is an alias, so we honor --help
+    // here ourselves rather than forwarding to kill-switch engage.
+    if (extra.includes("--help") || extra.includes("-h")) {
+        console.log('Usage: patchwork panic [--reason "..."] [--force-local]\n\n' +
+            "  Alias for `patchwork kill-switch engage` — blocks all write-tier\n" +
+            "  tool calls across every running bridge. Use --reason to leave a\n" +
+            "  note in the audit trail. Release with `patchwork kill-switch release`.\n");
+        process.exit(0);
+    }
     // Spawn self with kill-switch engage to reuse the full handler without
     // duplicating 200+ LOC. Passes through any flags (--reason, --force-local).
     import("node:child_process").then(({ spawnSync }) => {
         const self = process.argv[1] ?? process.execPath;
-        const extra = process.argv.slice(3); // e.g. --reason "..." --force-local
         const result = spawnSync(process.execPath, [self, "kill-switch", "engage", ...extra], { stdio: "inherit" });
         process.exit(result.status ?? 1);
     });
@@ -1831,14 +1849,6 @@ if (process.argv[2] === "halts") {
                 process.stderr.write("No running bridge found. Start one with `patchwork start` (or `--driver subprocess`).\n");
                 process.exit(2);
             }
-            // Single-bridge default: query the first. Multi-bridge users will
-            // typically have one orchestrator anyway; expanding to fan-out is a
-            // follow-up if needed.
-            const lock = liveLocks[0];
-            if (!lock) {
-                process.stderr.write("No running bridge found.\n");
-                process.exit(2);
-            }
             const sinceMs = windowSinceMs(window);
             const params = [];
             if (sinceMs != null)
@@ -1846,20 +1856,35 @@ if (process.argv[2] === "halts") {
             if (recipeFilter)
                 params.push(`recipe=${encodeURIComponent(recipeFilter)}`);
             const qs = params.length > 0 ? `?${params.join("&")}` : "";
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), 10_000);
-            let res;
-            try {
-                res = await fetch(`http://127.0.0.1:${lock.port}/runs/halt-summary${qs}`, {
-                    headers: { Authorization: `Bearer ${lock.authToken}` },
-                    signal: controller.signal,
-                });
-            }
-            finally {
-                clearTimeout(timer);
+            // Walk live bridges in order; first responsive one wins. See the
+            // matching block in the `judgments` handler — findAllLiveBridges
+            // can include stale entries when a recycled PID still answers
+            // `kill(pid, 0)` but the lock points at a dead bridge.
+            let res = null;
+            let lastStatus = 0;
+            for (const lock of liveLocks) {
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), 10_000);
+                try {
+                    const candidate = await fetch(`http://127.0.0.1:${lock.port}/runs/halt-summary${qs}`, {
+                        headers: { Authorization: `Bearer ${lock.authToken}` },
+                        signal: controller.signal,
+                    });
+                    if (candidate.ok) {
+                        res = candidate;
+                        break;
+                    }
+                    lastStatus = candidate.status;
+                }
+                catch {
+                    /* unreachable lock — try next */
+                }
+                finally {
+                    clearTimeout(timer);
+                }
             }
-            if (!res.ok) {
-                process.stderr.write(`Bridge returned ${res.status} for /runs/halt-summary\n`);
+            if (!res) {
+                process.stderr.write(`No live bridge served /runs/halt-summary (last status: ${lastStatus || "unreachable"}).\n`);
                 process.exit(1);
             }
             const summary = (await res.json());
@@ -1971,11 +1996,6 @@ if (process.argv[2] === "judgments") {
                 process.stderr.write("No running bridge found. Start one with `patchwork start` (or `--driver subprocess`).\n");
                 process.exit(2);
             }
-            const lock = liveLocks[0];
-            if (!lock) {
-                process.stderr.write("No running bridge found.\n");
-                process.exit(2);
-            }
             const sinceMs = windowSinceMs(window);
             const params = [];
             if (sinceMs != null)
@@ -1983,20 +2003,37 @@ if (process.argv[2] === "judgments") {
             if (recipeFilter)
                 params.push(`recipe=${encodeURIComponent(recipeFilter)}`);
             const qs = params.length > 0 ? `?${params.join("&")}` : "";
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), 10_000);
-            let res;
-            try {
-                res = await fetch(`http://127.0.0.1:${lock.port}/runs/judge-summary${qs}`, {
-                    headers: { Authorization: `Bearer ${lock.authToken}` },
-                    signal: controller.signal,
-                });
-            }
-            finally {
-                clearTimeout(timer);
+            // Walk live bridges in order; the first responsive one wins.
+            // findAllLiveBridges uses `kill(pid, 0)` for liveness, which
+            // returns true for any recycled PID — so liveLocks can contain
+            // stale entries from dead bridges. Previously we picked [0]
+            // unconditionally and surfaced a confusing 404; now we try each
+            // and only fall through to the error path when *all* fail.
+            let res = null;
+            let lastStatus = 0;
+            for (const lock of liveLocks) {
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), 10_000);
+                try {
+                    const candidate = await fetch(`http://127.0.0.1:${lock.port}/runs/judge-summary${qs}`, {
+                        headers: { Authorization: `Bearer ${lock.authToken}` },
+                        signal: controller.signal,
+                    });
+                    if (candidate.ok) {
+                        res = candidate;
+                        break;
+                    }
+                    lastStatus = candidate.status;
+                }
+                catch {
+                    /* unreachable lock — try next */
+                }
+                finally {
+                    clearTimeout(timer);
+                }
             }
-            if (!res.ok) {
-                process.stderr.write(`Bridge returned ${res.status} for /runs/judge-summary\n`);
+            if (!res) {
+                process.stderr.write(`No live bridge served /runs/judge-summary (last status: ${lastStatus || "unreachable"}).\n`);
                 process.exit(1);
             }
             const summary = (await res.json());
@@ -2630,9 +2667,12 @@ Steps performed:
         }
         if (extensionArg2) {
             try {
+                // Windows: editor binaries (code/cursor/windsurf) are `.cmd` shims that
+                // Node's execFileSync can't launch without a shell. See bridgeProcess.ts.
                 execFileSync(editor, ["--install-extension", extensionArg2], {
                     stdio: "pipe",
                     timeout: 30000,
+                    shell: process.platform === "win32",
                 });
                 process.stderr.write(`  ✓ Extension installed via ${editor}\n\n`);
             }
@@ -2761,13 +2801,18 @@ Steps performed:
             process.stderr.write(`  ✓ MCP shim — already registered in ${claudeJsonAbs}\n\n`);
         }
         else {
+            // claude -p spawns the stdio command via Node's child_process, which
+            // can't resolve a bare `.cmd` shim on Windows. Record the `.cmd` form
+            // on win32 so the bridge binary is findable by the spawned process.
             mcpServers["claude-ide-bridge"] = {
-                command: "claude-ide-bridge",
+                command: ensureCmdShim("claude-ide-bridge"),
                 args: ["shim"],
                 type: "stdio",
             };
             claudeJson.mcpServers = mcpServers;
-            writeFileSync(claudeJsonAbs, `${JSON.stringify(claudeJson, null, 2)}\n`);
+            // Atomic — `~/.claude.json` holds every MCP server registration on
+            // the machine. A crash mid-write would brick Claude Code globally.
+            writeFileAtomicSync(claudeJsonAbs, `${JSON.stringify(claudeJson, null, 2)}\n`);
             process.stderr.write(`  ✓ MCP shim — registered in ${claudeJsonAbs}\n     Note: bridge tools are wired via ~/.claude.json (global), not .mcp.json.\n     This is intentional — when VS Code/Windsurf/Cursor launches Claude Code it\n     injects --mcp-config which overrides any project .mcp.json. Only ~/.claude.json\n     is always loaded. You do not need to add anything to .mcp.json.\n\n`);
         }
     }
@@ -2818,7 +2863,9 @@ Steps performed:
         }
         if (added.length > 0 || migrated.length > 0) {
             ccSettings.hooks = ccHooks;
-            writeFileSync(ccSettingsPath, `${JSON.stringify(ccSettings, null, 2)}\n`);
+            // Atomic — `~/.claude/settings.json` holds every CC hook entry; a
+            // crash mid-write loses the user's full hook configuration.
+            writeFileAtomicSync(ccSettingsPath, `${JSON.stringify(ccSettings, null, 2)}\n`);
             const addMsg = added.length > 0
                 ? `  ✓ CC hooks — wired ${added.length} automation hook(s) in ${ccSettingsPath}\n     Added: ${added.join(", ")}\n`
                 : "";
@@ -2859,6 +2906,9 @@ Steps performed:
         execFileSync("claude-ide-bridge", ["--version"], {
             stdio: "pipe",
             timeout: 5000,
+            // Windows: global npm bin is a `.cmd` shim that Node's execFileSync
+            // can't launch without a shell. See bridgeProcess.ts for context.
+            shell: process.platform === "win32",
         });
         shimOnPath = true;
     }
@@ -2937,8 +2987,11 @@ Steps performed:
                 ? fallbackDocs
                 : null;
         if (target) {
-            const { exec } = await import("node:child_process");
-            exec(`code "${target}"`, { timeout: 3000 }, () => { });
+            // Use execFile with argv (no shell) — exec(`code "${target}"`) was
+            // shell-evaluated and could be injected via `--workspace '"; ...'`
+            // since path.resolve preserves shell metachars. Audit 2026-05-17.
+            const { execFile } = await import("node:child_process");
+            execFile("code", [target], { timeout: 3000 }, () => { });
         }
     }
     // Analytics opt-in prompt — only ask once; skip if preference already set
@@ -3055,9 +3108,11 @@ else if (process.argv[2] === "install-extension") {
     }
     try {
         process.stderr.write(`Installing extension via ${editor}...\n`);
+        // Windows: editor binaries are `.cmd` shims; need shell for resolution.
         execFileSync(editor, ["--install-extension", extensionArg], {
             stdio: "inherit",
             timeout: 30000,
+            shell: process.platform === "win32",
         });
         process.stderr.write("Extension installed successfully.\n");
     }
@@ -3401,7 +3456,12 @@ else {
             for (const sig of ["SIGTERM", "SIGINT"]) {
                 process.once(sig, () => {
                     stopping = true;
-                    child.kill(sig);
+                    // Use treeKill so grandchildren (recipe runners, claude
+                    // subprocesses, extension watchers) are reaped on Windows.
+                    // Bare `child.kill(sig)` maps to TerminateProcess on win32
+                    // and skips descendants → orphaned processes survive a
+                    // supervisor SIGTERM. Audit 2026-05-17.
+                    treeKill(child, sig);
                 });
             }
             child.on("exit", (code, signal) => {
@@ -3439,12 +3499,12 @@ else {
         if (!isSourceBuild) {
             import("node:child_process")
                 .then(({ exec }) => {
-                exec("npm view claude-ide-bridge version", { timeout: 5000 }, (err, stdout) => {
+                exec("npm view patchwork-os version", { timeout: 5000 }, (err, stdout) => {
                     if (err || !stdout)
                         return;
                     const latest = stdout.trim();
                     if (latest && semverGt(latest, PACKAGE_VERSION)) {
-                        console.log(`\n  Bridge v${latest} available — run: npm update -g claude-ide-bridge\n`);
+                        console.log(`\n  Patchwork OS v${latest} available — run: npm update -g patchwork-os\n`);
                     }
                 });
             })