remote-codex 0.11.43 → 0.11.45

package/packages/process-runtime/src/index.ts

@@ -0,0 +1,253 @@
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+import crossSpawn from 'cross-spawn';
+
+export interface SpawnProcessOptions {
+  command: string;
+  args?: readonly string[];
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+  stdio?: SpawnOptions['stdio'];
+  detached?: boolean;
+  windowsHide?: boolean;
+}
+
+export interface RunProcessOptions extends Omit<SpawnProcessOptions, 'stdio' | 'detached'> {
+  timeoutMs?: number;
+  maxOutputBytes?: number;
+  input?: string | Buffer;
+}
+
+export interface ProcessResult {
+  code: number | null;
+  signal: NodeJS.Signals | null;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+  outputTruncated: boolean;
+  spawnError: Error | null;
+}
+
+export interface ParsedCommandLine {
+  command: string;
+  args: string[];
+}
+
+const DEFAULT_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+
+/**
+ * Parse a persisted/display command into argv without evaluating a shell.
+ * Supports the quoting used by the built-in runtime install commands. Shell
+ * operators and environment expansion are intentionally treated as literals.
+ */
+export function parseCommandLine(value: string): ParsedCommandLine {
+  const tokens: string[] = [];
+  let token = '';
+  let quote: 'single' | 'double' | null = null;
+  let tokenStarted = false;
+
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index]!;
+    if (quote === 'single') {
+      if (character === "'") {
+        quote = null;
+      } else {
+        token += character;
+      }
+      tokenStarted = true;
+      continue;
+    }
+    if (quote === 'double') {
+      if (character === '"') {
+        quote = null;
+      } else if (
+        character === '\\' &&
+        (value[index + 1] === '"' || value[index + 1] === '\\')
+      ) {
+        token += value[index + 1];
+        index += 1;
+      } else {
+        token += character;
+      }
+      tokenStarted = true;
+      continue;
+    }
+
+    if (/\s/.test(character)) {
+      if (tokenStarted) {
+        tokens.push(token);
+        token = '';
+        tokenStarted = false;
+      }
+      continue;
+    }
+    if (character === "'") {
+      quote = 'single';
+      tokenStarted = true;
+      continue;
+    }
+    if (character === '"') {
+      quote = 'double';
+      tokenStarted = true;
+      continue;
+    }
+    token += character;
+    tokenStarted = true;
+  }
+
+  if (quote) {
+    throw new Error('Command contains an unterminated quoted argument.');
+  }
+  if (tokenStarted) {
+    tokens.push(token);
+  }
+  const [command, ...args] = tokens;
+  if (!command) {
+    throw new Error('Command is empty.');
+  }
+  return { command, args };
+}
+
+/**
+ * Spawn an executable without constructing a shell command string.
+ * cross-spawn is used so Windows PATHEXT and npm .cmd shims work consistently.
+ */
+export function spawnProcess(options: SpawnProcessOptions): ChildProcess {
+  return crossSpawn(options.command, [...(options.args ?? [])], {
+    cwd: options.cwd,
+    env: options.env,
+    stdio: options.stdio ?? 'pipe',
+    detached: options.detached,
+    windowsHide: options.windowsHide ?? true,
+    shell: false,
+  });
+}
+
+export function runProcess(options: RunProcessOptions): Promise<ProcessResult> {
+  return new Promise((resolve) => {
+    const child = spawnProcess({
+      ...options,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+    let stdout: Buffer = Buffer.alloc(0);
+    let stderr: Buffer = Buffer.alloc(0);
+    let timedOut = false;
+    let outputTruncated = false;
+    let spawnError: Error | null = null;
+    let settled = false;
+
+    const append = (current: Buffer, chunk: Buffer | string) => {
+      const nextChunk = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      const remaining = Math.max(0, maxOutputBytes - current.byteLength);
+      if (nextChunk.byteLength > remaining) {
+        outputTruncated = true;
+      }
+      return remaining === 0
+        ? current
+        : Buffer.concat([current, nextChunk.subarray(0, remaining)]);
+    };
+
+    child.stdout?.on('data', (chunk: Buffer | string) => {
+      stdout = append(stdout, chunk);
+    });
+    child.stderr?.on('data', (chunk: Buffer | string) => {
+      stderr = append(stderr, chunk);
+    });
+    child.on('error', (error) => {
+      spawnError = error;
+    });
+
+    const finish = (code: number | null, signal: NodeJS.Signals | null) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timer) {
+        clearTimeout(timer);
+      }
+      resolve({
+        code: spawnError ? null : code,
+        signal,
+        stdout: stdout.toString('utf8'),
+        stderr: stderr.toString('utf8'),
+        timedOut,
+        outputTruncated,
+        spawnError,
+      });
+    };
+
+    child.on('close', finish);
+    const timer = options.timeoutMs && options.timeoutMs > 0
+      ? setTimeout(() => {
+          timedOut = true;
+          child.kill('SIGTERM');
+        }, options.timeoutMs)
+      : null;
+
+    if (options.input !== undefined) {
+      child.stdin?.end(options.input);
+    } else {
+      child.stdin?.end();
+    }
+  });
+}
+
+function pathEnvironmentValue(env: NodeJS.ProcessEnv) {
+  const entry = Object.entries(env).find(([key]) => key.toLowerCase() === 'path');
+  return entry?.[1] ?? '';
+}
+
+function windowsExtensions(command: string, env: NodeJS.ProcessEnv) {
+  if (path.extname(command)) {
+    return [''];
+  }
+  const pathExtEntry = Object.entries(env).find(([key]) => key.toLowerCase() === 'pathext');
+  const extensions = (pathExtEntry?.[1] ?? '.COM;.EXE;.BAT;.CMD')
+    .split(';')
+    .map((extension) => extension.trim())
+    .filter(Boolean);
+  return ['', ...extensions];
+}
+
+async function isFile(candidate: string) {
+  try {
+    return (await fs.stat(candidate)).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/** Resolve a command for diagnostics only. Execution must still use spawnProcess. */
+export async function resolveExecutable(
+  command: string,
+  options: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+  } = {},
+): Promise<string | null> {
+  const env = options.env ?? process.env;
+  const platform = options.platform ?? process.platform;
+  const cwd = options.cwd ?? process.cwd();
+  const hasPathSeparator = command.includes('/') || command.includes('\\');
+  const searchDirectories = hasPathSeparator
+    ? ['']
+    : pathEnvironmentValue(env).split(path.delimiter).filter(Boolean);
+  const extensions = platform === 'win32' ? windowsExtensions(command, env) : [''];
+
+  for (const directory of searchDirectories) {
+    const base = hasPathSeparator
+      ? (path.isAbsolute(command) ? command : path.resolve(cwd, command))
+      : path.join(directory, command);
+    for (const extension of extensions) {
+      const candidate = `${base}${extension}`;
+      if (await isFile(candidate)) {
+        return path.resolve(candidate);
+      }
+    }
+  }
+  return null;
+}

package/packages/shared/src/index.ts

@@ -64,6 +64,15 @@ export interface RuntimeConfigDto {
   port: number;
   workspaceRoot: string;
   environment: string;
+  platform?: string;
+  architecture?: string;
+  nodeVersion?: string;
+  capabilities?: {
+    terminal: boolean;
+    tmux: boolean;
+    managedSignals: boolean;
+    windowsTaskScheduler: boolean;
+  };
 }
 
 export interface AuthSessionDto {
@@ -1066,6 +1075,9 @@ export interface PluginManifestDto {
 export interface PluginDto extends PluginManifestDto {
   enabled: boolean;
   source?: 'builtin' | 'imported' | null;
+  available?: boolean;
+  unavailableReasonCode?: 'unsupported_platform' | null;
+  unavailableReason?: string | null;
 }
 
 export interface UpdatePluginInput {

package/scripts/service-manager.mjs

@@ -2,9 +2,10 @@ import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import net from 'node:net';
+import crypto from 'node:crypto';
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(scriptDir, '..');
@@ -67,6 +68,12 @@ async function startService() {
   await assertTcpPortAvailable(apiHost, apiPort, 'API');
   await assertTcpPortAvailable(serviceHost, servicePort, 'Web');
 
+  const apiInstanceId = crypto.randomUUID();
+  const apiControlToken = crypto.randomBytes(32).toString('base64url');
+  const apiControlEndpoint = process.platform === 'win32'
+    ? `\\\\.\\pipe\\remote-codex-service-${crypto.createHash('sha256').update(serviceDir).digest('hex').slice(0, 24)}`
+    : path.join(serviceDir, 'api-control.sock');
+
   const apiPid = spawnDetached(process.execPath, [apiEntry], apiLogPath, {
     NODE_ENV: 'production',
     HOST: apiHost,
@@ -76,6 +83,9 @@ async function startService() {
     REMOTE_CODEX_PACKAGE_ROOT: repoRoot,
     REMOTE_CODEX_DISABLE_BUILD_RESTART:
       process.env.REMOTE_CODEX_DISABLE_BUILD_RESTART ?? (supportsSourceRestart ? 'false' : 'true'),
+    REMOTE_CODEX_LIFECYCLE_CONTROL_ENDPOINT: apiControlEndpoint,
+    REMOTE_CODEX_LIFECYCLE_CONTROL_TOKEN: apiControlToken,
+    REMOTE_CODEX_LIFECYCLE_INSTANCE_ID: apiInstanceId,
   });
 
   try {
@@ -108,11 +118,14 @@ async function startService() {
     apiHost,
     apiPort,
     apiPid,
+    apiInstanceId,
+    apiControlToken,
+    apiControlEndpoint,
     webPid,
     apiLogPath,
     webLogPath,
   };
-  await fsp.writeFile(stateFile, `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+  await writePrivateState(state);
 
   console.log(`Started supervisor service.`);
   console.log(`Web: http://${serviceHost}:${servicePort} (pid ${webPid})`);
@@ -305,8 +318,14 @@ async function probeHttp(url) {
 }
 
 async function stopState(state) {
-  for (const pid of [state.webPid, state.apiPid]) {
-    stopPid(pid);
+  stopPid(state.webPid);
+  let apiShutdownRequested = false;
+  if (state.apiControlEndpoint && state.apiControlToken && state.apiInstanceId) {
+    const response = await requestLifecycleControl(state, 'shutdown').catch(() => null);
+    apiShutdownRequested = response?.ok === true && response.instanceId === state.apiInstanceId;
+  }
+  if (!apiShutdownRequested) {
+    stopPid(state.apiPid);
   }
 
   const deadline = Date.now() + 5_000;
@@ -331,6 +350,44 @@ async function readState() {
   }
 }
 
+async function writePrivateState(state) {
+  await fsp.mkdir(serviceDir, { recursive: true, mode: 0o700 });
+  await fsp.chmod(serviceDir, 0o700).catch(() => undefined);
+  const temporaryPath = `${stateFile}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
+  let handle = null;
+  try {
+    handle = await fsp.open(temporaryPath, 'wx', 0o600);
+    await handle.writeFile(`${JSON.stringify(state, null, 2)}\n`, 'utf8');
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    await fsp.rename(temporaryPath, stateFile);
+    if (process.platform === 'win32') {
+      const username = process.env.USERDOMAIN && process.env.USERNAME
+        ? `${process.env.USERDOMAIN}\\${process.env.USERNAME}`
+        : process.env.USERNAME ?? os.userInfo().username;
+      spawnSync('icacls.exe', [
+        serviceDir,
+        '/inheritance:r',
+        '/grant:r',
+        `${username}:(OI)(CI)F`,
+        'SYSTEM:(OI)(CI)F',
+      ], { windowsHide: true, stdio: 'ignore' });
+      spawnSync('icacls.exe', [
+        stateFile,
+        '/inheritance:r',
+        '/grant:r',
+        `${username}:F`,
+        'SYSTEM:F',
+      ], { windowsHide: true, stdio: 'ignore' });
+    }
+  } catch (error) {
+    await handle?.close().catch(() => undefined);
+    await fsp.rm(temporaryPath, { force: true }).catch(() => undefined);
+    throw error;
+  }
+}
+
 function serviceStateAlive(state) {
   return [state.apiPid, state.webPid].some((pid) => isProcessAlive(pid));
 }
@@ -340,6 +397,14 @@ function stopPid(pid) {
     return;
   }
 
+  if (process.platform === 'win32') {
+    spawn('taskkill.exe', ['/PID', String(pid), '/T'], {
+      windowsHide: true,
+      stdio: 'ignore',
+    }).unref();
+    return;
+  }
+
   try {
     process.kill(-pid, 'SIGTERM');
     return;
@@ -359,6 +424,14 @@ function forceStopPid(pid) {
     return;
   }
 
+  if (process.platform === 'win32') {
+    spawn('taskkill.exe', ['/PID', String(pid), '/T', '/F'], {
+      windowsHide: true,
+      stdio: 'ignore',
+    }).unref();
+    return;
+  }
+
   try {
     process.kill(-pid, 'SIGKILL');
     return;
@@ -412,3 +485,38 @@ function sleep(milliseconds) {
     setTimeout(resolve, milliseconds);
   });
 }
+
+function requestLifecycleControl(state, action, timeoutMs = 2_000) {
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(state.apiControlEndpoint);
+    const timer = setTimeout(() => {
+      socket.destroy();
+      reject(new Error('Lifecycle control request timed out.'));
+    }, timeoutMs);
+    let output = '';
+    socket.setEncoding('utf8');
+    socket.once('connect', () => {
+      socket.write(`${JSON.stringify({
+        action,
+        token: state.apiControlToken,
+        instanceId: state.apiInstanceId,
+      })}\n`);
+    });
+    socket.on('data', (chunk) => {
+      output += chunk;
+      const newline = output.indexOf('\n');
+      if (newline < 0) return;
+      clearTimeout(timer);
+      socket.end();
+      try {
+        resolve(JSON.parse(output.slice(0, newline)));
+      } catch (error) {
+        reject(error);
+      }
+    });
+    socket.once('error', (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}