rovecode 0.4.0-beta.2 → 0.4.0

package/src/core/verify.ts

@@ -0,0 +1,237 @@
+/** What check this project runs before the agent's work counts as done — decided without ever guessing.
+ *
+ *  Berkay (2026-09-06): the CLI should govern its own work and catch its own mistakes before saying done. The
+ *  loop's gate (core/verify-gate.ts, nimbus-99) runs a command after the last edit; THIS module decides which one,
+ *  and it is the half that can do damage: a gate that runs the wrong command once — `npm test` that deploys,
+ *  wipes a database, or takes twenty minutes — is turned off forever. Two measurements shaped it (nimbus-6f, same
+ *  night): in Berkay's real projects (plain HTML/CSS/JS, no package.json) there is nothing to run at all, so
+ *  "none" is the MAIN path and its text is what a person reads; and in a TypeScript project a type-check caught
+ *  the same three constructed mistakes as the full suite in a tenth of the time (10 s against 170 s here). So:
+ *
+ *  1. Configuration first. `verify` in .rovecode/settings.json (project) or ~/.rovecode/settings.json (user),
+ *     a command string or a list, project winning like every other key. This is the one source that needs
+ *     no inference, and the ONLY way a test suite becomes the gate. `false` turns the gate off on purpose and
+ *     stops the inference below as well.
+ *  2. Inference second, aimed at the FAST check, and only where both the name and the shape are recognised:
+ *     - package.json `typecheck` whose body is tsc; `lint` whose body is eslint, biome or oxlint. Name alone is
+ *       not enough (a `lint` script may do anything); the body has to be a runner known to run unattended and end.
+ *     - package.json `check`, only when neither of those was taken, and only when its body compiles or lints
+ *       without running tests: a `check` that runs the suite is the thorough gate, and the thorough gate is
+ *       configured, never inferred — the refusal names it and how to opt in.
+ *     - Cargo.toml → `cargo check`; go.mod → `go vet ./...`; a ruff-configured Python project → `ruff check .`.
+ *     - A `test` script, `cargo test`, `pytest`, Makefile targets: never inferred, always listed with the reason.
+ *  3. Everything seen and NOT inferred goes into `refused`, in words specific enough that a person reads the
+ *     line and either agrees or sets the key. "Nothing" is a good answer; "could not infer" is not.
+ *
+ *  The seam for the runner is `commands: string[]` it does not interpret, so per-file targeting ("tsc --noEmit"
+ *  plus the tests that import the changed files) can be added here later without touching anything downstream.
+ *  Pure apart from reading the files named above; never throws; never runs anything. */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { loadSettings, settingsPath } from "./settings.ts";
+
+export interface VerifyPlan {
+  /** where the commands came from; "none" = the gate has nothing to run */
+  source: "settings" | "inferred" | "none";
+  /** the shell commands the gate runs, in order, uninterpreted; empty when source is "none" */
+  commands: string[];
+  /** one sentence: the file and key or script the answer came from, or why there is none */
+  reason: string;
+  /** what was seen and deliberately not inferred, each with its reason — the argument for trusting the gate */
+  refused: string[];
+}
+
+export interface VerifyDeps {
+  exists?: (p: string) => boolean;
+  read?: (p: string) => string;
+}
+
+/** words in a `check` script's body that mean it is not a check */
+const DANGEROUS = /\b(deploy|publish|release|push|migrate|drop|rm\s+-rf|docker|kubectl|terraform|curl|wget|ssh|scp|rsync)\b/i;
+/** a body that keeps running until killed — never a gate */
+const WATCH = /(^|\s)(--watch(=\S*)?|-w|--watchAll)(\s|$)|\bnodemon\b|\bvitest\s*$/;
+/** a body that runs a test suite — the thorough gate, configured only */
+const RUNS_TESTS = /\b(bun test|vitest|jest|mocha|node --test|playwright test|cypress run|ava|tap|uvu)\b/;
+/** runners whose bare invocation runs once, unattended, and exits */
+const TYPECHECK_RUNNER = /^(bunx |npx |pnpm exec |yarn )?(tsc|vue-tsc|svelte-check)(\s|$)/;
+const LINT_RUNNER = /^(bunx |npx |pnpm exec |yarn )?(eslint|biome (check|lint)|oxlint)(\s|$)/;
+
+/** the package manager the lockfile says this project uses; npm when none says */
+function packageRunner(cwd: string, exists: (p: string) => boolean): { run: string; from: string } {
+  if (exists(join(cwd, "bun.lock")) || exists(join(cwd, "bun.lockb"))) return { run: "bun run", from: "bun.lock" };
+  if (exists(join(cwd, "pnpm-lock.yaml"))) return { run: "pnpm run", from: "pnpm-lock.yaml" };
+  if (exists(join(cwd, "yarn.lock"))) return { run: "yarn", from: "yarn.lock" };
+  if (exists(join(cwd, "package-lock.json"))) return { run: "npm run", from: "package-lock.json" };
+  return { run: "npm run", from: "no lockfile (npm assumed)" };
+}
+
+export const NONE_REASON = "nothing configured and nothing fast and safe to infer — set verify in .rovecode/settings.json (a command, or a list) to turn the gate on";
+export const NOTHING_HERE = "no package.json, Cargo.toml, go.mod or pyproject.toml here, so there is no compiler, linter or test runner to run; for a plain HTML/CSS/JS site that is the normal answer, and the gate stays off";
+
+/** Resolve this project's verify command(s). */
+export function resolveVerify(cwd: string, deps: VerifyDeps = {}): VerifyPlan {
+  const exists = deps.exists ?? existsSync;
+  const read = deps.read ?? ((p: string) => readFileSync(p, "utf8"));
+
+  // 1. configuration
+  const settings = loadSettings(cwd);
+  if (settings.verify === false) {
+    return { source: "none", commands: [], reason: "settings.json verify: false — the gate is off by choice, nothing is inferred", refused: [] };
+  }
+  if (settings.verify !== undefined) {
+    const commands = Array.isArray(settings.verify) ? settings.verify : [settings.verify];
+    const projectFile = settingsPath("project", cwd);
+    const where = existsSync(projectFile) && hasVerifyKey(projectFile, read) ? projectFile : settingsPath("user", cwd);
+    return { source: "settings", commands, reason: `${where} verify`, refused: [] };
+  }
+
+  // 2. inference
+  const commands: string[] = [];
+  const from: string[] = [];
+  const refused: string[] = [];
+
+  const pkgPath = join(cwd, "package.json");
+  if (exists(pkgPath)) {
+    let scripts: Record<string, string> = {};
+    let ok = true;
+    try {
+      const raw = JSON.parse(read(pkgPath)) as { scripts?: unknown };
+      const s = raw.scripts;
+      if (s !== undefined && (typeof s !== "object" || s === null || Array.isArray(s))) { refused.push('package.json: "scripts" is not an object — nothing inferred from it'); ok = false; }
+      else if (s) for (const [k, v] of Object.entries(s as Record<string, unknown>)) if (typeof v === "string") scripts[k] = v;
+    } catch { refused.push("package.json is not valid JSON — nothing inferred from it"); ok = false; scripts = {}; }
+    if (ok) {
+      const pm = packageRunner(cwd, exists);
+      const body = (name: string): string => scripts[name]!.trim();
+      const optIn = (name: string) => `set \`"verify": "${pm.run} ${name}"\` in .rovecode/settings.json`;
+
+      // the fast checks: a recognised runner, or a refusal that quotes the body
+      const take = (name: string, runner: RegExp, what: string, known: string): void => {
+        if (scripts[name] === undefined) return;
+        const b = body(name);
+        if (WATCH.test(b)) { refused.push(`package.json script "${name}" runs \`${b}\`: a watch mode never exits, so it cannot gate a run`); return; }
+        if (!runner.test(b)) { refused.push(`package.json script "${name}" runs \`${b}\`: not a ${what} this gate knows runs unattended and ends (${known}) — ${optIn(name)} to run it anyway`); return; }
+        commands.push(`${pm.run} ${name}`); from.push(`package.json script "${name}" (${pm.from})`);
+      };
+      take("typecheck", TYPECHECK_RUNNER, "type-checker", "tsc, vue-tsc, svelte-check");
+      take("lint", LINT_RUNNER, "linter", "eslint, biome check, oxlint");
+
+      // `check`: the convention means "verify, change nothing" — taken as the fallback fast check when it only
+      // compiles or lints; refused, with the cost named, when it runs the suite or does anything a check must not
+      if (scripts.check !== undefined) {
+        const b = body("check");
+        const bad = DANGEROUS.exec(b);
+        const tests = RUNS_TESTS.exec(b);
+        if (bad) refused.push(`package.json script "check" runs \`${b}\`: it names \`${bad[1]}\`, which a check must not do — ${optIn("check")} if that is really what you want the gate to run`);
+        else if (WATCH.test(b)) refused.push(`package.json script "check" runs \`${b}\`: a watch mode never exits, so it cannot gate a run`);
+        else if (tests) refused.push(`package.json script "check" runs \`${b}\`: it runs the test suite (\`${tests[1]}\`), which is minutes here rather than seconds; the thorough gate is configured, never inferred — ${optIn("check")} if that cost is right for this project`);
+        else if (commands.length > 0) refused.push(`package.json script "check" runs \`${b}\`: a faster script already covers it (${from.map((f) => f.split(" (")[0]).join(", ")}) — ${optIn("check")} to run it instead`);
+        else { commands.push(`${pm.run} check`); from.push(`package.json script "check" (${pm.from})`); }
+      }
+
+      // `test`: never inferred — the name promises nothing about the body, and a suite is the slow gate
+      if (scripts.test !== undefined) {
+        const b = body("test");
+        refused.push(`package.json script "test" runs \`${b}\`: a test suite is never inferred, only configured (the fast gate is a type-check; a suite can take minutes and may need services) — ${optIn("test")} if it is quick enough here`);
+      }
+      if (commands.length === 0 && refused.length === 0) refused.push('package.json has no "typecheck", "lint", "check" or "test" script — name one, or set verify in .rovecode/settings.json');
+    }
+  }
+
+  if (exists(join(cwd, "Cargo.toml"))) {
+    commands.push("cargo check"); from.push("Cargo.toml");
+    refused.push("`cargo test` is not inferred: it runs the crate's tests, which may be slow or need services — set verify to run it");
+  }
+  if (exists(join(cwd, "go.mod"))) {
+    commands.push("go vet ./..."); from.push("go.mod");
+    refused.push("`go test ./...` is not inferred: it runs the module's tests — set verify to run it");
+  }
+  const pyproject = join(cwd, "pyproject.toml");
+  if (exists(pyproject) || exists(join(cwd, "ruff.toml"))) {
+    const ruffToml = exists(join(cwd, "ruff.toml"));
+    let ruff = ruffToml;
+    if (!ruff && exists(pyproject)) { try { ruff = /^\[tool\.ruff(\.|\])/m.test(read(pyproject)); } catch { /* unreadable: no ruff */ } }
+    if (ruff) { commands.push("ruff check ."); from.push(ruffToml ? "ruff.toml" : "pyproject.toml [tool.ruff]"); }
+    else refused.push("pyproject.toml without a [tool.ruff] section: no linter is configured that this gate knows — set verify (for example `ruff check .` or `pytest -q`) to run one");
+    refused.push("`pytest` is not inferred: it runs the project's tests — set verify to run it");
+  }
+  if (exists(join(cwd, "Makefile")) || exists(join(cwd, "makefile"))) {
+    refused.push("a Makefile is here, but make targets are never inferred (a target can do anything) — set verify to `make check` or the target you mean");
+  }
+
+  if (commands.length > 0) {
+    return { source: "inferred", commands, reason: `inferred from ${from.join(", ")}`, refused };
+  }
+  if (refused.length === 0) return { source: "none", commands: [], reason: NOTHING_HERE, refused: [] };
+  return { source: "none", commands: [], reason: NONE_REASON, refused };
+}
+
+function hasVerifyKey(path: string, read: (p: string) => string): boolean {
+  try { const raw = JSON.parse(read(path)) as Record<string, unknown>; return raw !== null && typeof raw === "object" && "verify" in raw; } catch { return false; }
+}
+
+/** the commands as one label — the SAME words in the doctor row and in the loop's `verify` RunEvent ("running
+ *  bun run check  &&  bun test"), so a person sees one name for one thing */
+export function verifyLabel(plan: VerifyPlan): string {
+  return plan.commands.join("  &&  ");
+}
+
+/** one line for `rovecode doctor` and the settings docs */
+export function describeVerify(plan: VerifyPlan): string {
+  if (plan.source === "none") return `none — ${plan.reason}`;
+  return `${verifyLabel(plan)} — ${plan.reason}`;
+}
+
+/** what the gate does NOT see, said wherever the gate is described (doctor, README): the loop counts edits made
+ *  through `edit` and `write`; a run that changed files only through `bash` has no counted write, so it is not
+ *  verified. Owned here so the doctor row and the docs cannot drift apart. */
+export const VERIFY_BLIND_SPOT = "runs after edits made with `edit` or `write`; a run that changed files only through `bash` is not counted, so it is not verified";
+
+// ---- cost: a check's duration is the fact that makes the doctor row honest ("bun run check, 170 s last time").
+// The resolver never runs anything, so it cannot measure; the gate can, and records here after each run. Project-local
+// because the same command costs different amounts in different repos; one small file, one entry per command.
+
+export const VERIFY_TIMING_FILE = join(".rovecode", "verify-timing.json");
+type Timings = Record<string, { ms: number; at: string }>;
+
+function readTimings(cwd: string): Timings {
+  try {
+    const raw = JSON.parse(readFileSync(join(cwd, VERIFY_TIMING_FILE), "utf8")) as unknown;
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {};
+    const out: Timings = {};
+    for (const [k, v] of Object.entries(raw as Record<string, unknown>)) {
+      if (v && typeof v === "object" && typeof (v as { ms?: unknown }).ms === "number" && typeof (v as { at?: unknown }).at === "string") out[k] = v as { ms: number; at: string };
+    }
+    return out;
+  } catch { return {}; }
+}
+
+/** for the gate: remember how long `command` took in this project. Never throws (a timing is not worth a crash). */
+export function recordVerifyTiming(cwd: string, command: string, ms: number, now: Date = new Date()): void {
+  try {
+    const t = readTimings(cwd);
+    t[command] = { ms: Math.max(0, Math.round(ms)), at: now.toISOString() };
+    mkdirSync(join(cwd, ".rovecode"), { recursive: true });
+    writeFileSync(join(cwd, VERIFY_TIMING_FILE), JSON.stringify(t, null, 2) + "\n");
+  } catch { /* a timing is not worth a crash */ }
+}
+
+/** the last measured duration of `command` here, or undefined when it has not run yet */
+export function lastVerifyTiming(cwd: string, command: string): number | undefined {
+  return readTimings(cwd)[command]?.ms;
+}
+
+/** "3 s" / "170 s" / "2 min 50 s" — the cost as a person says it */
+export function formatDuration(ms: number): string {
+  const s = Math.round(ms / 1000);
+  if (s < 1) return "under a second";
+  if (s < 120) return `${s} s`;
+  const m = Math.floor(s / 60), r = s % 60;
+  return r === 0 ? `${m} min` : `${m} min ${r} s`;
+}
+
+/** the label with each command's last cost when known: "bun run typecheck (9 s)  &&  bun test (not run yet)" */
+export function verifyLabelWithCost(cwd: string, plan: VerifyPlan): string {
+  return plan.commands.map((c) => { const ms = lastVerifyTiming(cwd, c); return ms === undefined ? `${c} (not run here yet)` : `${c} (${formatDuration(ms)} last time)`; }).join("  &&  ");
+}

package/src/core/voice.ts

@@ -0,0 +1,158 @@
+/** rovecode's voice — the one place user-facing wording lives: mode labels, the no-model recipe, the
+ *  welcome card, the panels' empty-state hints. First person, short plain sentences, one idea per
+ *  line, no emoji; the ◆ glyph marks rovecode's own lines; a problem always ends with the next step.
+ *  Pure strings and string builders: every surface (CLI, REPL, TUI, server, ACP) reads from here so a
+ *  wording change lands everywhere at once. */
+
+/** the permission modes as the screen names them; the flags/commands keep their names (--yolo, /yolo, ROVECODE_YOLO) */
+export const MODE_ASK = "ask first";
+export const MODE_AUTO = "auto (never asks)";
+export const MODE_ACCEPT = "accept edits";
+
+/** "ask first" | "auto (never asks)" — the status/notes label for the yolo flag */
+export function modeLabel(yolo: boolean): string { return yolo ? MODE_AUTO : MODE_ASK; }
+/** compact form for footers and status bars: "ask first" | "auto" */
+export function modeLabelShort(yolo: boolean): string { return yolo ? "auto" : MODE_ASK; }
+/** what each mode means, in one sentence */
+export function modeMeaning(yolo: boolean): string {
+  return yolo ? "I won't stop to ask before writes or shell commands" : "I ask before I write or run anything";
+}
+
+/** the marker every problem message ends with */
+export const NEXT = "→ next:";
+export const next = (text: string): string => `${NEXT} ${text}`;
+
+/** The no-model recipe — three lines, `rovecode setup` first. `where` picks the commands that exist
+ *  on that surface; the first line is stable ("no provider configured") for callers that match it. */
+export function noModelHint(where: "cli" | "tui" = "cli"): string {
+  const setup = where === "tui" ? "/setup" : "rovecode setup";
+  const alt = where === "tui"
+    ? "/provider add <id> <baseUrl> · /provider key <id> <secret>"
+    : "rovecode provider add <id> <baseUrl>, then rovecode auth set <id>";
+  return [
+    "no provider configured — no model to think with yet.",
+    `  ${next(setup)}   (pick a provider, paste the key hidden, one test call)`,
+    `  or: ${alt} · or set ROVECODE_BASE_URL + ROVECODE_API_KEY`,
+  ].join("\n");
+}
+
+/** `rovecode run` with nothing configured answers from a scripted mock; this is what it says. */
+export const MOCK_PROVIDER_TEXT =
+  `Rovecode mock provider: no model is connected, so this is a canned reply. ${next("rovecode setup")} (or rovecode provider add <id> <baseUrl> + rovecode auth set <id>, or set ROVECODE_BASE_URL and ROVECODE_API_KEY)`;
+
+export interface WelcomeOpts {
+  /** the session's provider/model when one is connected; null = nothing configured */
+  connected: { provider: string; model: string } | null;
+  cwd: string;
+  yolo: boolean;
+  /** plan/act; act is the default and is not mentioned */
+  mode?: "plan" | "act";
+  /** the running version, so "which rovecode is this" never needs a second command */
+  version?: string;
+  /** what this session actually loaded. Zeroes are omitted rather than printed: a line reading
+   *  "0 skills · 0 plugins · 0 MCP servers" is three facts nobody asked for, while "19 skills · 2 MCP
+   *  servers" is the answer to "did my install take". */
+  loaded?: { skills?: number; plugins?: number; mcp?: number };
+  /** the one-line update notice, when there is one; see core/update-check.ts */
+  update?: string | null;
+  /** columns available; under BANNER_COLS the wordmark is dropped rather than wrapped (default 80) */
+  width?: number;
+}
+
+/** ROVECODE in half-block letters, two rows. Berkay picked this over a boxed header and a plain block
+ *  (2026-09-06). It is 31 columns wide, so it fits a narrow split, and it only appears when the card
+ *  knows the version — a banner with nothing to say under it is decoration. */
+const WORDMARK = ["█▀█ █▀█ █ █ █▀▀ █▀▀ █▀█ █▀▄ █▀▀", "█▀▄ █▄█ ▀▄▀ █▄▄ █▄▄ █▄█ █▄▀ █▄▄"] as const;
+const BANNER_COLS = 46;
+
+/** "19 skills · 3 plugins · 2 MCP servers", counting only what is there. Null when nothing loaded,
+ *  because the absence of the line says that better than the line saying zero three times. */
+export function loadedLine(loaded: WelcomeOpts["loaded"]): string | null {
+  if (!loaded) return null;
+  const plural = (n: number, one: string) => `${n} ${one}${n === 1 ? "" : "s"}`;
+  const bits: string[] = [];
+  if (loaded.skills) bits.push(plural(loaded.skills, "skill"));
+  if (loaded.plugins) bits.push(plural(loaded.plugins, "plugin"));
+  if (loaded.mcp) bits.push(plural(loaded.mcp, "MCP server"));
+  return bits.length > 0 ? bits.join(" · ") : null;
+}
+
+/** The card a fresh session opens with (the messages panel's first note). */
+export function welcomeCard(o: WelcomeOpts): string {
+  const where = `${o.cwd} · ${modeLabelShort(o.yolo)}${o.mode === "plan" ? " · plan mode (read-only)" : ""}`;
+  const version = o.version ? ` ${o.version}` : "";
+  // the two optional footers, in the order a reader wants them: what this session has, then what it
+  // could have. Both drop out entirely when there is nothing to say — see loadedLine and updateLine.
+  const tail = [loadedLine(o.loaded), where, o.update ?? null].filter((l): l is string => l !== null);
+  // The banner form: the wordmark, then one line per fact. It needs a version (there is nothing to put
+  // beside the mark otherwise) and room (under BANNER_COLS the mark would wrap into noise), and it falls
+  // back to exactly the prose card below — which is what a resumed or narrow session still sees.
+  if (o.version !== undefined && (o.width ?? 80) >= BANNER_COLS) {
+    const model = o.connected === null ? null
+      : o.connected.model.length > 0 ? `${o.connected.provider}/${o.connected.model}` : o.connected.provider;
+    const loaded = loadedLine(o.loaded);
+    return [
+      `  ${WORDMARK[0]}`,
+      `  ${WORDMARK[1]}  ${o.version}`,
+      "",
+      model === null ? "  no model connected yet — /setup fixes that in about a minute"
+        : `  ${[model, loaded].filter((s) => s !== null).join(" · ")}`,
+      `  ${where}`,
+      ...(model === null ? [] : [`  I read first, then ${o.yolo ? "work without asking" : "ask before I write or run anything"}. /help lists commands by topic.`]),
+      ...(o.update ? [`  ${o.update}`] : []),
+    ].join("\n");
+  }
+  if (o.connected === null) {
+    return [
+      `◆ rovecode${version} here. No model connected yet, so I can't think.`,
+      "/setup fixes that in about a minute.",
+      ...tail,
+    ].join("\n");
+  }
+  const model = o.connected.model.length > 0 ? `${o.connected.provider}/${o.connected.model}` : o.connected.provider;
+  return [
+    `◆ rovecode${version} here. Connected to ${model}.`,
+    `Tell me what you want done; I read first, then ${o.yolo ? "work without asking" : "ask before I write or run anything"}.`,
+    "/help lists commands by topic.",
+    ...tail,
+  ].join("\n");
+}
+
+/** one-liner for a resumed session (its transcript is the card) */
+export function resumedLine(id: string, cwd: string, yolo: boolean): string {
+  return `◆ back in session ${id.slice(0, 8)} · ${cwd} · ${modeLabelShort(yolo)}`;
+}
+
+/** the /effort note. Says what the level costs, because that is the part that surprises people:
+ *  thinking tokens are billed as output and they arrive before any answer does. */
+export function effortNote(level: string, receives?: string): string {
+  const head = level === "off" ? "thinking: off — I answer straight away."
+    : level === "auto" ? "thinking: auto — the model decides how much to reason; I send no dial."
+    : `thinking: ${level} — I reason before answering. It costs output tokens and delays the first word.`;
+  // the second line is the truth on the wire (providers/thinking.ts thinkingLine): the level is one word,
+  // what this model's endpoint actually receives for it is another, and a model without a reasoning mode
+  // receives nothing at all — the person should not have to guess which
+  return receives ? `${head}\n  ${receives}` : head;
+}
+
+/** the /yolo toggle's note */
+export function modeSwitchNote(yolo: boolean): string {
+  return `mode: ${modeLabel(yolo)} — ${modeMeaning(yolo)}`;
+}
+
+/** the /accept-edits toggle's note. Says the boundary out loud: this is not auto mode, and the two
+ *  things it does NOT cover are the two that can leave the repository. */
+export function acceptEditsNote(on: boolean): string {
+  return on
+    ? `mode: ${MODE_ACCEPT} — I write inside this folder without asking. Shell commands, subagents, network and any write outside it still ask, and deny rules still hold.`
+    : `mode: ${MODE_ASK} — I ask before every write again.`;
+}
+
+// ---------- panel empty states (one dim line each; a second line only when the panel has room) ----------
+
+export const EMPTY = {
+  code: "nothing open — when I read a file it shows here",
+  files: ["no files yet", "they appear as I read them"] as const,
+  plan: ["no plan yet", "my steps show up here"] as const,
+  usage: "0 so far",
+} as const;

package/src/core/win-job.ts

@@ -0,0 +1,183 @@
+/** Windows process-TREE kill via a kernel Job Object (port #21 HIGH-1).
+ *
+ *  `taskkill /T` walks LIVE parent links. msys2 (Git bash) implements a
+ *  Cygwin→Cygwin exec by handing the pid to the new image and exiting the
+ *  forked stub, so the external command actually running inside a compound
+ *  (`a; sleep N; b`), nested (`bash -c '…'`) or backgrounded (`x & y & wait`)
+ *  shape has a DEAD Win32 parent and the walk never reaches it. Measured
+ *  through bunRunner on the reference box with an msys `sleep` child: 3/3
+ *  leaks + 3/3 runner hangs per shape (the orphan kept stdout open); only a
+ *  bare `sleep N`, exec'd without a fork, died. A native child (bun.exe) stays
+ *  reachable, which is why the shipped test passed. A Job Object records
+ *  membership at CreateProcess time and inherits it down the tree, so
+ *  TerminateJobObject kills every descendant regardless of parent links.
+ *
+ *  Per-spawn lifecycle (executor.ts bunRunner):
+ *    createWinJob() → assign(launcherPid)   right after Bun.spawn
+ *    abort  → terminate()                    TerminateJobObject, then close
+ *    settle → release()                      a run that completed on its own:
+ *             drop the close-kill limit, then close — a child the command
+ *             deliberately left behind (`server > log 2>&1 &`) survives, as
+ *             it does on POSIX and did before this port. While the command is
+ *             in flight the limit stays armed, so an rovecode crash takes the
+ *             tree with it (the OS closes the handle).
+ *  assign() also sweeps the launcher's already-visible descendants by a
+ *  Toolhelp32 parent-chain walk: a child forked in the spawn→assign window is
+ *  not a member by inheritance (under load that window can span a scheduler
+ *  quantum). Residual: a Cygwin stub that already exec'd AND exited inside
+ *  that window leaves its child unreachable by any parent walk. The sweep
+ *  costs one process snapshot (~15ms with ~300 processes on the loaded
+ *  reference box).
+ *  Fail-safe: non-win32, no bun:ffi, or any kernel32 call failing → null; the
+ *  caller keeps `taskkill /T /F` alone and reports treeKill "taskkill-only".
+ *  Nested jobs (Windows 8+) let this work when rovecode itself already runs
+ *  inside a job (terminals and IDEs do that): the launcher is then in both. */
+
+import { dlopen, FFIType, ptr } from "bun:ffi";
+
+const JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x2000;
+const JobObjectExtendedLimitInformation = 9;
+/** sizeof(JOBOBJECT_EXTENDED_LIMIT_INFORMATION) on x64; LimitFlags sits at
+ *  BasicLimitInformation offset 16 (after two LARGE_INTEGERs). */
+const EXTENDED_LIMIT_SIZE = 144;
+const LIMIT_FLAGS_OFFSET = 16;
+const PROCESS_SET_QUOTA_AND_TERMINATE = 0x0101;
+const TH32CS_SNAPPROCESS = 0x2;
+/** sizeof(PROCESSENTRY32W) on x64; th32ProcessID at 8, th32ParentProcessID at 32. */
+const PE32_SIZE = 568;
+const PE32_PID = 8;
+const PE32_PPID = 32;
+
+type Handle = number;
+
+interface Kernel32 {
+  CreateJobObjectW(attrs: null, name: null): Handle | null;
+  SetInformationJobObject(job: Handle, cls: number, info: number, len: number): number;
+  AssignProcessToJobObject(job: Handle, proc: Handle): number;
+  TerminateJobObject(job: Handle, exitCode: number): number;
+  OpenProcess(access: number, inherit: number, pid: number): Handle | null;
+  CloseHandle(h: Handle): number;
+  CreateToolhelp32Snapshot(flags: number, pid: number): Handle | null;
+  Process32FirstW(snap: Handle, entry: number): number;
+  Process32NextW(snap: Handle, entry: number): number;
+}
+
+let library: { symbols: unknown } | null | undefined; // undefined = not tried yet
+let override: boolean | null = null;
+
+function kernel32(): Kernel32 | null {
+  if (library === undefined) {
+    library = null;
+    if (process.platform === "win32") {
+      try {
+        library = dlopen("kernel32.dll", {
+          CreateJobObjectW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.ptr },
+          SetInformationJobObject: { args: [FFIType.ptr, FFIType.i32, FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
+          AssignProcessToJobObject: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+          TerminateJobObject: { args: [FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
+          OpenProcess: { args: [FFIType.u32, FFIType.i32, FFIType.u32], returns: FFIType.ptr },
+          CloseHandle: { args: [FFIType.ptr], returns: FFIType.i32 },
+          CreateToolhelp32Snapshot: { args: [FFIType.u32, FFIType.u32], returns: FFIType.ptr },
+          Process32FirstW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+          Process32NextW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+        });
+      } catch { library = null; }
+    }
+  }
+  return library ? (library.symbols as Kernel32) : null;
+}
+
+/** A kernel HANDLE is a small positive value: NULL arrives as null and
+ *  INVALID_HANDLE_VALUE (-1) fits this range in no representation. */
+const isHandle = (h: unknown): h is Handle => typeof h === "number" && h > 0 && h <= 0xffff_ffff;
+
+/** Whether the real Job Object path is usable here (status surfaces, tests). */
+export function winJobsAvailable(): boolean { return override ?? kernel32() !== null; }
+
+/** Test seam: `false` forces the fail-safe path (the box-without-kernel32
+ *  shape — callers fall back to taskkill-only); `null` restores detection. */
+export function overrideWinJobs(available: boolean | null): void { override = available; }
+
+export interface WinJob {
+  /** Put `pid` and its currently visible descendants in the job. false →
+   *  nothing is a member (caller must fall back); the job is closed. */
+  assign(pid: number): boolean;
+  /** Abort: kill every member now, then close. Idempotent. */
+  terminate(): void;
+  /** Normal settle: clear the close-kill limit, then close — members that
+   *  outlived the command keep running. No-op after terminate(). */
+  release(): void;
+}
+
+/** One job per spawn, armed with KILL_ON_JOB_CLOSE. null = unavailable. */
+export function createWinJob(): WinJob | null {
+  if (override === false) return null;
+  const k = kernel32();
+  if (!k) return null;
+  const job = k.CreateJobObjectW(null, null);
+  if (!isHandle(job)) return null;
+  const limits = new Uint8Array(EXTENDED_LIMIT_SIZE);
+  new DataView(limits.buffer).setUint32(LIMIT_FLAGS_OFFSET, JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, true);
+  if (!k.SetInformationJobObject(job, JobObjectExtendedLimitInformation, ptr(limits), EXTENDED_LIMIT_SIZE)) {
+    k.CloseHandle(job);
+    return null;
+  }
+  let handle: Handle | null = job;
+  const close = (): void => { if (handle !== null) { k.CloseHandle(handle); handle = null; } };
+  const assignOne = (pid: number): boolean => {
+    if (handle === null) return false;
+    const p = k.OpenProcess(PROCESS_SET_QUOTA_AND_TERMINATE, 0, pid);
+    if (!isHandle(p)) return false;
+    try { return k.AssignProcessToJobObject(handle, p) !== 0; } finally { k.CloseHandle(p); }
+  };
+  return {
+    assign(pid) {
+      if (!assignOne(pid)) { close(); return false; }
+      // belt-and-braces for the spawn→assign window; already-member or
+      // already-exited descendants simply fail to assign, which is fine
+      for (const d of descendants(k, pid)) assignOne(d);
+      return true;
+    },
+    terminate() {
+      if (handle === null) return;
+      k.TerminateJobObject(handle, 1);
+      close();
+    },
+    release() {
+      if (handle === null) return;
+      k.SetInformationJobObject(handle, JobObjectExtendedLimitInformation, ptr(new Uint8Array(EXTENDED_LIMIT_SIZE)), EXTENDED_LIMIT_SIZE);
+      close();
+    },
+  };
+}
+
+/** Live descendants of `root` by parent-pid chain (one Toolhelp32 snapshot).
+ *  pids recycle, so a stale parent link could form a cycle: visited-set walk. */
+function descendants(k: Kernel32, root: number): number[] {
+  const snap = k.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+  if (!isHandle(snap)) return [];
+  const children = new Map<number, number[]>();
+  try {
+    const entry = new Uint8Array(PE32_SIZE);
+    const view = new DataView(entry.buffer);
+    view.setUint32(0, PE32_SIZE, true); // dwSize must be set before Process32FirstW
+    if (!k.Process32FirstW(snap, ptr(entry))) return [];
+    do {
+      const pid = view.getUint32(PE32_PID, true);
+      const ppid = view.getUint32(PE32_PPID, true);
+      const list = children.get(ppid);
+      if (list) list.push(pid); else children.set(ppid, [pid]);
+    } while (k.Process32NextW(snap, ptr(entry)));
+  } finally {
+    k.CloseHandle(snap);
+  }
+  const seen = new Set<number>([root]);
+  const out: number[] = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    for (const c of children.get(stack.pop()!) ?? []) {
+      if (!seen.has(c)) { seen.add(c); out.push(c); stack.push(c); }
+    }
+  }
+  return out;
+}