pi-daddy 0.43.0 → 0.44.0

package/src/executors/captured-execution.ts

@@ -0,0 +1,61 @@
+/** Assemble the qualified owner and primary final channel; optional observations cannot replace either. */
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { runOwnedChild, type OwnedChildRunRequest, type OwnedChildRunResult } from "./owned-worker.ts";
+import type { BoundedReadCleanupError } from "../kernel/bounded-read.ts";
+import { ChildFinalCapture, type ChildFinal } from "./child-final.ts";
+export interface CapturedExecutionResult extends OwnedChildRunResult {
+  final: ChildFinal;
+  diagnostics: string;
+  diagnosticsTruncated: boolean;
+}
+export async function runCapturedExecution(
+  request: Omit<OwnedChildRunRequest, "ownershipDir" | "captureStdout"> & {
+    sessionPath: string;
+    onReadCleanup?: (error: BoundedReadCleanupError) => void;
+  },
+): Promise<CapturedExecutionResult> {
+  let directory: string;
+  try {
+    directory = await mkdtemp(join(tmpdir(), "pi-daddy-owner-"));
+  } catch (error) {
+    const reason = `ownership directory unavailable before helper launch: ${String(error)}`;
+    return {
+      code: null,
+      text: "",
+      truncated: false,
+      timedOut: false,
+      aborted: false,
+      spawnError: reason,
+      cleanup: { state: "not-started", reason },
+      final: { state: "unavailable", reason },
+      diagnostics: "",
+      diagnosticsTruncated: false,
+    };
+  }
+  const capture = new ChildFinalCapture(request.onOutput, request.onReadCleanup);
+  const args = [...request.args.slice(0, -1), "--mode", "json", request.args.at(-1)!];
+  const output = await runOwnedChild({
+    ...request,
+    args,
+    ownershipDir: join(directory, "ownership"),
+    captureStdout: false,
+    stopOnOutputLimit: false,
+    onObservation: (stream, bytes) => {
+      if (stream === "stdout") capture.observe(Buffer.from(bytes));
+      request.onObservation?.(stream, bytes);
+    },
+  });
+  const fork = args.indexOf("--fork") >= 0;
+  const id = args.indexOf("--session-id");
+  const final = await capture.finish(request.sessionPath, fork && id >= 0 ? args[id + 1] : undefined);
+  return {
+    ...output,
+    final,
+    truncated: false,
+    diagnostics: output.text,
+    diagnosticsTruncated: output.truncated,
+    text: final.state === "complete" ? final.text : (final.diagnosticText ?? ""),
+  };
+}

package/src/executors/child-final.ts

@@ -0,0 +1,190 @@
+/** Pi 1.0.4 current final: JSON settlement plus the exact persisted session active branch. */
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { join } from "node:path";
+import { readdir } from "node:fs/promises";
+import { SessionManager, type FileEntry } from "@earendil-works/pi-coding-agent";
+import { BoundedReadCleanupError, readBoundedBytes } from "../kernel/bounded-read.ts";
+const MAX_FINAL_BYTES = 4 * 1024 * 1024,
+  MAX_LINE_BYTES = 32 * 1024 * 1024,
+  MAX_SESSION_BYTES = 64 * 1024 * 1024;
+const object = (x: unknown): x is Record<string, any> => !!x && typeof x === "object" && !Array.isArray(x);
+const hash = (s: string) => createHash("sha256").update(s, "utf8").digest("hex");
+export type ChildFinal =
+  | { state: "complete"; text: string; sessionId: string; messageId: string; leafId: string; sha256: string }
+  | { state: "unavailable"; reason: string; diagnosticText?: string };
+export class ChildFinalCapture {
+  private decoder = new TextDecoder("utf-8", { fatal: true });
+  private buffer = "";
+  private problem?: string;
+  private sessionId?: string;
+  private settled = false;
+  private active = new Set<string>();
+  private final?: Record<string, any>;
+  private user?: Record<string, any>;
+  private readonly onText?: (text: string) => void;
+  private readonly onReadCleanup?: (error: BoundedReadCleanupError) => void;
+  constructor(onText?: (text: string) => void, onReadCleanup?: (error: BoundedReadCleanupError) => void) {
+    this.onText = onText;
+    this.onReadCleanup = onReadCleanup;
+  }
+  observe(bytes: Buffer): void {
+    if (this.problem) return;
+    try {
+      this.buffer += this.decoder.decode(bytes, { stream: true });
+      let end: number;
+      while ((end = this.buffer.indexOf("\n")) >= 0) {
+        const line = this.buffer.slice(0, end);
+        this.buffer = this.buffer.slice(end + 1);
+        if (Buffer.byteLength(line) > MAX_LINE_BYTES) throw Error("protocol line exceeds capture bound");
+        if (line.trim()) this.event(JSON.parse(line));
+      }
+      if (Buffer.byteLength(this.buffer) > MAX_LINE_BYTES) throw Error("protocol line exceeds capture bound");
+    } catch (error) {
+      this.problem = String(error);
+    }
+  }
+  private event(event: unknown): void {
+    if (!object(event) || typeof event.type !== "string") throw Error("malformed protocol event");
+    if (event.type === "session") {
+      if (this.sessionId || typeof event.id !== "string" || event.version !== 3)
+        throw Error("ambiguous session header");
+      this.sessionId = event.id;
+      return;
+    }
+    if (!this.sessionId) throw Error("protocol event precedes session identity");
+    if (
+      event.type === "message_update" &&
+      event.assistantMessageEvent?.type === "text_delta" &&
+      typeof event.assistantMessageEvent.delta === "string"
+    ) {
+      try {
+        this.onText?.(event.assistantMessageEvent.delta);
+      } catch {
+        /* display is observational */
+      }
+    }
+    if (["agent_start", "turn_start", "message_start", "message_update"].includes(event.type)) {
+      this.settled = false;
+      this.final = undefined;
+    }
+    if (event.type === "tool_execution_start") {
+      this.settled = false;
+      this.final = undefined;
+      if (typeof event.toolCallId !== "string" || this.active.has(event.toolCallId))
+        throw Error("ambiguous tool start");
+      this.active.add(event.toolCallId);
+    }
+    if (event.type === "tool_execution_end") {
+      this.settled = false;
+      if (!this.active.delete(event.toolCallId)) throw Error("unmatched tool completion");
+    }
+    if (event.type === "message_end") {
+      if (!object(event.message)) throw Error("malformed message end");
+      this.settled = false;
+      this.final = undefined;
+      if (event.message.role === "user") {
+        this.user = event.message;
+        this.final = undefined;
+        this.settled = false;
+      }
+      if (event.message.role === "assistant") {
+        this.final = event.message;
+        this.settled = false;
+      }
+    }
+    if (event.type === "agent_settled") this.settled = true;
+  }
+  private visible(): string {
+    if (!Array.isArray(this.final?.content)) return "";
+    return this.final.content
+      .filter((b: unknown) => object(b) && b.type === "text" && typeof b.text === "string")
+      .map((b: any) => b.text)
+      .join("");
+  }
+  async finish(sessionPath: string, expectedSessionId?: string, readSession = readBoundedBytes): Promise<ChildFinal> {
+    const unavailable = (reason: string): ChildFinal => ({
+      state: "unavailable",
+      reason,
+      ...(this.visible() ? { diagnosticText: this.visible().slice(0, 8192) } : {}),
+    });
+    try {
+      this.buffer += this.decoder.decode();
+      if (this.buffer.trim()) throw Error("unterminated protocol record");
+      if (this.problem) throw Error(this.problem);
+      if (!this.sessionId || (expectedSessionId && this.sessionId !== expectedSessionId))
+        throw Error("session identity mismatch");
+      if (!this.settled || this.active.size) throw Error("current run is not settled");
+      const final = this.final;
+      if (
+        !final ||
+        !this.user ||
+        final.stopReason !== "stop" ||
+        !Array.isArray(final.content) ||
+        final.content.some((b: unknown) => !object(b) || !["text", "thinking"].includes(b.type)) ||
+        final.content.some((b: any) => b.type === "text" && typeof b.text !== "string")
+      )
+        throw Error("no eligible current terminal assistant message");
+      const text = this.visible();
+      if (!text || Buffer.byteLength(text) > MAX_FINAL_BYTES)
+        throw Error("complete final is empty or exceeds capture bound");
+      let path = sessionPath;
+      if (expectedSessionId) {
+        const names = (await readdir(sessionPath)).filter((n) => n.endsWith(`_${expectedSessionId}.jsonl`));
+        if (names.length !== 1) throw Error("exact fork session is missing or ambiguous");
+        path = join(sessionPath, names[0]);
+      }
+      const read = await readSession(path, { maxBytes: MAX_SESSION_BYTES, timeoutMs: 3000 });
+      if (!read.ok) throw Error(`session read unavailable: ${read.detail}`);
+      const source = new TextDecoder("utf-8", { fatal: true }).decode(read.bytes);
+      if (!source.endsWith("\n")) throw Error("incomplete session record");
+      const entries = source
+        .split("\n")
+        .filter(Boolean)
+        .map((l) => JSON.parse(l));
+      const header = entries[0];
+      if (!object(header) || header.type !== "session" || header.version !== 3 || header.id !== this.sessionId)
+        throw Error("persisted session identity mismatch");
+      const seen = new Set<string>();
+      for (const entry of entries.slice(1)) {
+        if (
+          !object(entry) ||
+          entry.type === "session" ||
+          typeof entry.id !== "string" ||
+          seen.has(entry.id) ||
+          (entry.parentId !== null && !seen.has(entry.parentId))
+        )
+          throw Error("ambiguous session tree");
+        seen.add(entry.id);
+      }
+      // Public SDK derives the active branch from the already bounded, validated in-memory bytes.
+      const manager = SessionManager.inMemory(header.cwd, undefined, entries as FileEntry[]);
+      const branch = manager.getBranch();
+      const messages = branch.filter((e) => e.type === "message");
+      const last = messages.at(-1),
+        currentUser = messages.findLast((e) => e.message.role === "user");
+      if (
+        !last ||
+        last.message.role !== "assistant" ||
+        !isDeepStrictEqual(last.message, final) ||
+        !currentUser ||
+        !isDeepStrictEqual(currentUser.message, this.user)
+      )
+        throw Error("stream final does not match the current persisted branch and turn");
+      return {
+        state: "complete",
+        text,
+        sessionId: this.sessionId,
+        messageId: last.id,
+        leafId: manager.getLeafId()!,
+        sha256: hash(text),
+      };
+    } catch (error) {
+      if (error instanceof BoundedReadCleanupError) {
+        if (!this.onReadCleanup) throw error;
+        this.onReadCleanup(error);
+      }
+      return unavailable(String(error));
+    }
+  }
+}

package/src/executors/executor.ts

@@ -28,7 +28,7 @@ export interface ExecutorChoice {
   /** Whether a probe was needed at all — false only for `0`. */
   probed: boolean;
   /**
-   * Set ONLY when herdr was demanded and is unreachable. Every delegation must refuse with this.
+   * Unavailable or unqualified execution. Every delegation must refuse with this.
    *
    * Note that `kind` stays `"herdr"` in that case, deliberately: nothing downstream may mistake a refusing
    * session for a working process-executor one.
@@ -43,7 +43,20 @@ export function needsProbe(raw: string | undefined): boolean {
   return raw === undefined || raw === "1";
 }
 
+export const HERDR_UNQUALIFIED_REASON =
+  "Herdr governed execution is not qualified for complete current finals and subtree cleanup in this release. " +
+  "Delegation is refused; set PI_DADDY_HERDR=0 explicitly to select captured execution. No backend fallback occurs.";
+
 export function chooseExecutor(raw: string | undefined, probe: HerdrProbe | null): ExecutorChoice {
+  const choice = selectExecutor(raw, probe);
+  if (choice.kind !== "herdr") return choice;
+  return {
+    ...choice,
+    refusal: [choice.refusal, HERDR_UNQUALIFIED_REASON].filter(Boolean).join(" "),
+    disclosure: `${choice.disclosure} — unqualified; governed delegation will refuse`,
+  };
+}
+function selectExecutor(raw: string | undefined, probe: HerdrProbe | null): ExecutorChoice {
   if (raw === "0") {
     return {
       kind: "process",

package/src/executors/owned-worker.ts

@@ -0,0 +1,322 @@
+/** Captured Linux execution with a gated, independently settling native subreaper owner. */
+import { constants as fsConstants } from "node:fs";
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { lstat, mkdir, open, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { constants as osConstants } from "node:os";
+import { fileURLToPath } from "node:url";
+import { StringDecoder } from "node:string_decoder";
+import { WORKER_SHA256 } from "./worker-artifact.ts";
+import type { ChildRunRequest, ChildRunResult } from "../kernel/run-child.ts";
+import { takeBytes, DEFAULT_MAX_OUTPUT_BYTES, DEFAULT_TIMEOUT_MS, DEFAULT_KILL_GRACE_MS } from "../kernel/run-child.ts";
+import type { CapturedWorkerCleanup, CapturedWorkerIdentity } from "../kernel/captured-worker-contract.ts";
+import {
+  isCapturedWorkerIdentity,
+  readCapturedWorkerReceipt,
+  validateLiveWorker,
+} from "../governance/captured-worker-record.ts";
+export type { CapturedWorkerCleanup, CapturedWorkerIdentity } from "../kernel/captured-worker-contract.ts";
+
+export interface OwnedChildRunRequest extends ChildRunRequest {
+  executionId: string;
+  /** Fresh, caller-private directory. Existing directories are refused rather than overwritten. */
+  ownershipDir: string;
+  onOwnership?: (identity: CapturedWorkerIdentity) => Promise<void> | void;
+  /** JSON protocol consumers observe all bytes without capturing enormous replay streams as answer text. */
+  captureStdout?: boolean;
+  /** Bounded diagnostics may truncate without stopping independently captured primary output. */
+  stopOnOutputLimit?: boolean;
+}
+export interface OwnedChildRunResult extends ChildRunResult {
+  cleanup: CapturedWorkerCleanup;
+}
+export async function runOwnedChild(request: OwnedChildRunRequest): Promise<OwnedChildRunResult> {
+  const notStarted = (reason: string, aborted = false): OwnedChildRunResult => ({
+    code: null,
+    text: "",
+    truncated: false,
+    timedOut: false,
+    aborted,
+    ...(!aborted ? { spawnError: reason } : {}),
+    cleanup: { state: "not-started", reason },
+  });
+  if (request.hardDeadlineAt !== undefined && request.hardDeadlineAt <= Date.now())
+    return { ...notStarted("deadline elapsed before helper launch"), timedOut: true };
+  if (request.signal?.aborted) return notStarted("cancelled before helper launch", true);
+  if (process.platform !== "linux" || process.arch !== "x64")
+    return notStarted("captured worker requires qualified Linux x64 helper");
+  let helper: string, root: string, hash: string;
+  const nonce = randomUUID();
+  let binary: import("node:fs/promises").FileHandle | undefined;
+  try {
+    helper = fileURLToPath(new URL("../../native/linux-x64/worker", import.meta.url));
+    const info = await lstat(helper);
+    if (!info.isFile() || info.isSymbolicLink() || !(info.mode & 0o111))
+      throw new Error("packaged worker helper is not an ordinary executable");
+    binary = await open(helper, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+    const pinned = await binary.stat();
+    if (pinned.dev !== info.dev || pinned.ino !== info.ino) throw new Error("worker helper changed before pinning");
+    hash = WORKER_SHA256;
+    if (
+      !/^[a-f0-9]{64}$/.test(hash) ||
+      createHash("sha256")
+        .update(await binary.readFile())
+        .digest("hex") !== hash
+    )
+      throw new Error("packaged worker helper hash mismatch");
+    root = await realpath(request.cwd);
+    if (!request.executionId || request.executionId.length > 512)
+      throw new Error("executionId must be bounded and nonempty");
+    await mkdir(request.ownershipDir, { mode: 0o700 });
+    if ((await realpath(request.ownershipDir)) !== request.ownershipDir)
+      throw new Error("ownershipDir must be a canonical absolute path");
+  } catch (error) {
+    await binary?.close();
+    return notStarted(String(error));
+  }
+  return new Promise((resolve) => {
+    const grace = Math.min(request.killGraceMs ?? DEFAULT_KILL_GRACE_MS, 60000);
+    const cleanupCeiling = grace + 5000;
+    const child = spawn(
+      "/proc/self/fd/5",
+      [
+        request.executionId,
+        nonce,
+        root,
+        hash,
+        request.ownershipDir,
+        String(grace),
+        String(cleanupCeiling),
+        "--",
+        request.command,
+        ...request.args,
+      ],
+      {
+        cwd: root,
+        env: request.env,
+        stdio: ["ignore", "pipe", "pipe", "pipe", "pipe", binary!.fd],
+        detached: true,
+      },
+    );
+    void binary!.close();
+    const control = child.stdio[3] as import("node:stream").Duplex;
+    const status = child.stdio[4] as import("node:stream").Readable;
+    let identity: CapturedWorkerIdentity | undefined;
+    let text = "",
+      count = 0,
+      truncated = false,
+      timedOut = false,
+      aborted = false,
+      idle = false;
+    let failure: string | undefined,
+      done = false,
+      stopping = false,
+      ready = "";
+    let stopWatchdog: NodeJS.Timeout | undefined, idleTimer: NodeJS.Timeout | undefined;
+    const decoders = { stdout: new StringDecoder("utf8"), stderr: new StringDecoder("utf8") };
+    const timers: NodeJS.Timeout[] = [];
+    const observe = (stream: "stdout" | "stderr", bytes: Buffer) => {
+      armIdle();
+      try {
+        request.onObservation?.(stream, bytes);
+      } catch {
+        /* observer owns its own incomplete/error state */
+      }
+      if (stream === "stdout" && request.captureStdout === false) return;
+      const chunk = decoders[stream].write(bytes);
+      const kept = takeBytes(chunk, Math.max(0, (request.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES) - count));
+      count += Buffer.byteLength(kept);
+      text += kept;
+      try {
+        if (kept) request.onOutput?.(kept);
+      } catch {
+        /* display only */
+      }
+      if (kept.length < chunk.length) {
+        truncated = true;
+        if (request.stopOnOutputLimit !== false) stop();
+      }
+    };
+    const stop = (hard = false) => {
+      if (hard && !done && control.writable) control.write("K");
+      if (done || stopping) return;
+      stopping = true;
+      if (control.writable) control.write("C");
+      stopWatchdog = setTimeout(() => {
+        failure ??= "worker helper failed to establish cleanup before its bound";
+        child.kill("SIGKILL");
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        status.destroy();
+      }, cleanupCeiling + 1000);
+    };
+    function armIdle() {
+      if (!request.idleTimeoutMs || done || stopping) return;
+      if (idleTimer) clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        timedOut = true;
+        idle = true;
+        stop();
+      }, request.idleTimeoutMs);
+    }
+    child.stdout?.on("data", (bytes) => observe("stdout", bytes));
+    child.stderr?.on("data", (bytes) => observe("stderr", bytes));
+    for (const stream of ["stdout", "stderr"] as const)
+      child[stream]?.on("end", () => {
+        const tail = decoders[stream].end();
+        if (tail && !(stream === "stdout" && request.captureStdout === false)) {
+          const kept = takeBytes(tail, Math.max(0, (request.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES) - count));
+          text += kept;
+          count += Buffer.byteLength(kept);
+        }
+        try {
+          request.onStreamEnd?.(stream);
+        } catch {
+          /* observer only */
+        }
+      });
+    control.on("error", () => {
+      /* helper close is evaluated against independent receipt */
+    });
+    status.on("data", (bytes: Buffer) => {
+      if (identity) return;
+      ready += bytes.toString("utf8");
+      if (ready.length > 16384) {
+        failure = "oversized worker readiness";
+        stop();
+        return;
+      }
+      if (!ready.includes("\n")) return;
+      void (async () => {
+        try {
+          const value: unknown = JSON.parse(ready.trim());
+          if (
+            !isCapturedWorkerIdentity(value) ||
+            value.executionId !== request.executionId ||
+            value.nonce !== nonce ||
+            value.root !== root ||
+            value.helperPid !== child.pid ||
+            value.helperSha256 !== hash ||
+            value.ownershipPath !== join(request.ownershipDir, "ownership.json")
+          )
+            throw new Error("wrong worker readiness identity");
+          identity = value;
+          await validateLiveWorker(identity, helper);
+          await request.onOwnership?.(identity);
+          if (request.hardDeadlineAt !== undefined && request.hardDeadlineAt <= Date.now()) {
+            timedOut = true;
+            stop(true);
+          }
+          if (!stopping && !done) {
+            request.onSpawn?.(identity.workerPid);
+            control.write("S");
+          }
+        } catch (error) {
+          failure = String(error);
+          stop();
+        }
+      })();
+    });
+    // Startup is bounded by the caller's timeout/deadline too. A separate readiness cutoff can
+    // discard a valid delayed ownership record and prevent later exact receipt reconciliation.
+    timers.push(
+      setTimeout(() => {
+        timedOut = true;
+        stop();
+      }, request.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+    );
+    if (request.hardDeadlineAt !== undefined)
+      timers.push(
+        setTimeout(
+          () => {
+            timedOut = true;
+            stop(true);
+          },
+          Math.max(0, request.hardDeadlineAt - Date.now()),
+        ),
+      );
+    armIdle();
+    if (request.activityProbe && request.idleTimeoutMs) {
+      let previous: unknown,
+        probing = false;
+      timers.push(
+        setInterval(() => {
+          if (probing || done) return;
+          probing = true;
+          Promise.resolve()
+            .then(() => request.activityProbe!())
+            .then((value) => {
+              if (value !== undefined && value !== previous) {
+                previous = value;
+                armIdle();
+              }
+            })
+            .catch(() => undefined)
+            .finally(() => {
+              probing = false;
+            });
+        }, request.activityProbeIntervalMs ?? 2000),
+      );
+    }
+    const onAbort = () => {
+      aborted = true;
+      stop();
+    };
+    request.signal?.addEventListener("abort", onAbort, { once: true });
+    if (request.hardDeadlineAt !== undefined && request.hardDeadlineAt <= Date.now()) {
+      timedOut = true;
+      stop(true);
+    }
+    if (request.signal?.aborted) onAbort();
+    child.on("error", (error) => {
+      failure = String(error);
+    });
+    child.on("exit", () => {
+      void (async () => {
+        if (!identity || !(await readCapturedWorkerReceipt(identity))) {
+          failure ??= "helper exited without an independent settlement receipt";
+          child.stdout?.destroy();
+          child.stderr?.destroy();
+          status.destroy();
+        }
+      })();
+    });
+    child.on("close", () => {
+      if (done) return;
+      done = true;
+      timers.forEach(clearTimeout);
+      if (idleTimer) clearTimeout(idleTimer);
+      if (stopWatchdog) clearTimeout(stopWatchdog);
+      request.signal?.removeEventListener("abort", onAbort);
+      control.destroy();
+      void (async () => {
+        const receipt = identity ? await readCapturedWorkerReceipt(identity) : null;
+        const cleanup: CapturedWorkerCleanup =
+          receipt && identity
+            ? { state: "settled", identity, receipt }
+            : {
+                state: "unknown",
+                ...(identity ? { identity } : {}),
+                reason: failure ?? "helper closed without matching durable settlement receipt",
+              };
+        const signal = receipt?.workerSignal
+          ? (Object.entries(osConstants.signals).find(
+              ([, value]) => value === receipt.workerSignal,
+            )?.[0] as NodeJS.Signals)
+          : null;
+        resolve({
+          code: receipt?.workerCode ?? null,
+          signal,
+          text,
+          truncated,
+          timedOut,
+          ...(idle ? { idle: true as const } : {}),
+          aborted,
+          ...(failure ? { spawnError: failure } : {}),
+          cleanup,
+        });
+      })();
+    });
+  });
+}

package/src/executors/worker-artifact.ts

@@ -0,0 +1,2 @@
+/** Generated by scripts/build-worker.ts; the loader never trusts a sidecar hash. */
+export const WORKER_SHA256 = "981a45591b1de790501ef531f6b0ccc8299b1e9a2d08a7970ccaeeecb9868798";

package/src/governance/approval-prompt.ts

@@ -79,7 +79,8 @@ export interface ApprovalGateOptions {
   hasUI: boolean;
   /** pi's `ctx.mode`, quoted back in the refusal so an operator can see why. */
   mode: string;
-  timeoutMs?: number;
+  /** Resolve only when this caller must open a new dialog; unused invalid settings cannot revoke authority. */
+  timeoutMs?: number | (() => number | undefined);
 }
 
 export interface ApprovalGate {
@@ -91,16 +92,18 @@ const DEFAULT_TIMEOUT_MS = 120_000;
 /**
  * Read `PI_DADDY_APPROVAL_TIMEOUT`, in SECONDS, into the milliseconds pi expects.
  *
- * `0` or an unparseable value means no timeout: waiting forever denies nothing, so it is the safe
- * interpretation of a value we do not understand.
+ * Only literal `0` disables the deadline. Other values must be canonical whole seconds
+ * within Node's signed 32-bit millisecond timer limit; malformed settings refuse a needed prompt.
  */
 export function timeoutMsFromEnv(raw: string | undefined): number | undefined {
   if (raw === undefined) return DEFAULT_TIMEOUT_MS;
-  const seconds = Number.parseInt(raw, 10);
-  if (!Number.isFinite(seconds) || seconds <= 0) return undefined;
-  return seconds * 1000;
+  if (raw === "0") return undefined;
+  if (!/^[1-9][0-9]*$/.test(raw) || Number(raw) > 2_147_483)
+    throw new Error(
+      "PI_DADDY_APPROVAL_TIMEOUT must be literal 0 or whole seconds 1..2147483 without signs, padding or units",
+    );
+  return Number(raw) * 1000;
 }
-
 function labelToScope(label: string, scopes: ApprovalScope[]): ApprovalScope | null {
   return scopes.find((s) => SCOPE_LABELS[s] === label) ?? null;
 }
@@ -160,7 +163,7 @@ export function createApprovalGate(
     let chosen: string | undefined;
     try {
       chosen = await options.ui.select(title, [DENY_LABEL, ...scopes.map((s) => SCOPE_LABELS[s])], {
-        timeout: options.timeoutMs,
+        timeout: typeof options.timeoutMs === "function" ? options.timeoutMs() : options.timeoutMs,
         signal: request.signal,
       });
     } catch (error) {
@@ -169,6 +172,9 @@ export function createApprovalGate(
       return { scope: null, kind: "error", reason: `approval dialog failed, denying (${String(error)})` };
     }
 
+    if (request.signal?.aborted)
+      return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was canceled` };
+
     // undefined covers dismissal, timeout, and abort. All are a no, but none is a person saying no.
     if (chosen === undefined) {
       return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was dismissed` };
@@ -185,6 +191,8 @@ export function createApprovalGate(
 
   return {
     async request(request: PromptRequest): Promise<PromptOutcome> {
+      if (request.signal?.aborted)
+        return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was canceled` };
       if (!options.hasUI) {
         // Nobody was there to ask — distinct from a person declining, which is why this is its own kind
         // rather than being folded into "declined" (see PromptOutcomeKind).
@@ -208,6 +216,8 @@ export function createApprovalGate(
         const existing = inFlight.get(key);
         if (!existing) break;
         const outcome = await existing;
+        if (request.signal?.aborted)
+          return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was canceled` };
         // **`joined` marks the rider, and the ledger depends on it (R-66).** Sharing a non-`once` outcome
         // is correct — the human authorised the capability for the session, not for one child — but the
         // caller then stamped `approvalSource: "prompt"` on every one of them, so a fan-out of eight wrote