rterm-backend 3.9.1 → 3.9.2

package/package.json

@@ -50,6 +50,6 @@
     "url": "git+https://github.com/DrOlu/RTerm.git"
   },
   "name": "rterm-backend",
-  "version": "3.9.1",
+  "version": "3.9.2",
   "description": "AI-native terminal & agentic-AI operations platform for Forward Deployed Engineers & SREs: AIOps closed-loop remediation, AI SRE, self-healing infrastructure, runbook automation, ChatOps; executes over SSH/WinRM/serial under policy with tamper-evident audit."
 }

package/plugins/neuralos/neuralos.extreme.spec.mts

@@ -12,7 +12,7 @@
  * Run:  npx tsx plugins/neuralos/neuralos.extreme.spec.mts
  */
 import { spawnSync } from 'node:child_process'
-import { mkdtempSync, writeFileSync, mkdirSync, existsSync, readFileSync, chmodSync } from 'node:fs'
+import { mkdtempSync, writeFileSync, mkdirSync, existsSync, chmodSync } from 'node:fs'
 import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 
@@ -290,6 +290,94 @@ else { console.log(JSON.stringify({ function_calls: [{ name: 'transactions_count
   ok(plain.code === 0 && plain.stdout.trim() === 'true', 'defaultExec keeps the parent environment for plain calls')
 }
 
+// ---------------------------------------------------------------------------
+// 12. The lost-exec-bit family (v3.9.2). curl -o / electron-builder
+//     extraResources ship engines with mode 0644; spawning them dies with
+//     EACCES and an EMPTY stderr. Resolution must check executability, not
+//     existence — a broken bundle must never shadow a runnable engine.
+// ---------------------------------------------------------------------------
+{
+  // 12a. A 0644 bundled engine is skipped, and the next candidate wins.
+  const root = mkdtempSync(join(tmpdir(), 'neuralos-execbit-'))
+  const resources = join(root, 'resources')
+  const cache = join(root, 'cache')
+  const instances = join(root, 'instances')
+  mkdirSync(join(resources, 'neuralos'), { recursive: true })
+  mkdirSync(cache, { recursive: true })
+  mkdirSync(join(instances, 'engine'), { recursive: true })
+  // bundled copy: present but NOT executable (the v3.9.1 bug)
+  writeFileSync(join(resources, 'neuralos', 'engine-macos-arm64'), 'bundled-broken')
+  writeFileSync(join(resources, 'neuralos', 'needle3.cact'), 'bundled-weights')
+  chmodSync(join(resources, 'neuralos', 'engine-macos-arm64'), 0o644)
+  // fleet-convention copy: executable
+  writeFileSync(join(instances, 'engine', 'needle'), '#!/bin/sh\necho ok')
+  writeFileSync(join(instances, 'engine', 'needle3.cact'), 'fleet-weights')
+  chmodSync(join(instances, 'engine', 'needle'), 0o755)
+
+  const cfg = resolveConfig({ getSettings: () => ({}) }, { NEURALOS_INSTANCES_DIR: instances, NEURALOS_CACHE_DIR: cache, NEURALOS_AUTO_DOWNLOAD: '0' })
+  const resolved = await resolveEngine(cfg, { platform: 'darwin', arch: 'arm64', resourcesPath: resources })
+  ok(resolved.engineBin === join(instances, 'engine', 'needle'), 'a 0644 bundled engine is skipped for the runnable fleet engine', JSON.stringify(resolved))
+
+  // 12b. chmod recovery: a 0644 engine we OWN is fixed in place, not skipped.
+  const ownedDir = mkdtempSync(join(tmpdir(), 'neuralos-owned-'))
+  writeFileSync(join(ownedDir, 'engine-macos-arm64'), 'owned')
+  writeFileSync(join(ownedDir, 'needle3.cact'), 'owned-weights')
+  chmodSync(join(ownedDir, 'engine-macos-arm64'), 0o644)
+  const cfgOwned = resolveConfig({ getSettings: () => ({}) }, { NEURALOS_INSTANCES_DIR: join(root, 'nope'), NEURALOS_CACHE_DIR: ownedDir, NEURALOS_AUTO_DOWNLOAD: '0' })
+  const recovered = await resolveEngine(cfgOwned, { platform: 'darwin', arch: 'arm64' })
+  ok(recovered.engineBin === join(ownedDir, 'engine-macos-arm64'), 'a 0644 engine we own is chmod-recovered instead of skipped', JSON.stringify(recovered))
+
+  // 12c. EACCES at spawn time is named, with the fix in the message.
+  const denied = await engineSelect(
+    () => Promise.resolve({ ok: false, code: 'EACCES', stdout: '', stderr: '' }),
+    { engineBin: '/broken/engine', engineWeights: '/w' },
+    '/m',
+    'q',
+  )
+  ok(
+    (denied as { error?: string }).error?.includes('engine not executable') && (denied as { error?: string }).error?.includes('chmod +x'),
+    'EACCES spawn failure names the fix (chmod +x / engineBin override)',
+    JSON.stringify(denied),
+  )
+
+  // 12d. A non-EACCES crash keeps the original shape.
+  const crash = await engineSelect(
+    () => Promise.resolve({ ok: false, code: 1, stdout: '', stderr: 'boom' }),
+    { engineBin: '/e', engineWeights: '/w' },
+    '/m',
+    'q',
+  )
+  ok((crash as { error?: string }).error === 'engine exited 1: boom', 'non-EACCES crashes keep the engine exited N: stderr shape')
+
+  // 12e. defaultExec preserves a real EACCES code from the OS.
+  const realExec = defaultExec()
+  const noExecFile = join(root, 'not-executable')
+  writeFileSync(noExecFile, 'x')
+  chmodSync(noExecFile, 0o644)
+  const eacc = await realExec(noExecFile, [])
+  ok(eacc.code === 'EACCES', 'defaultExec surfaces EACCES as the code (not a generic 1)', JSON.stringify(eacc.code))
+
+  // 12f. defaultExec reports timeout kills honestly.
+  const slow = await realExec(process.execPath, ['-e', 'setTimeout(() => {}, 30000)'], { timeoutMs: 300 })
+  ok(String(slow.code).includes('killed') || String(slow.code).includes('ETIMEDOUT'), 'a timeout kill is reported as killed/ETIMEDOUT, not exit 1', JSON.stringify(slow.code))
+
+  // 12g. truncate(undefined) must not throw (JSON.stringify(undefined) is undefined).
+  const undef = truncate(undefined as never)
+  ok(undef === 'null', 'truncate(undefined) renders honestly instead of crashing', String(undef))
+
+  // 12h. A corrupt menu is data for graphProbe, never an exception.
+  const corruptDir = mkdtempSync(join(tmpdir(), 'neuralos-corrupt-'))
+  writeFileSync(join(corruptDir, 'needle_menu.json'), 'NOT JSON {{{')
+  const corrupt = await graphProbe(() => Promise.resolve({ ok: true, code: 0, stdout: '{}', stderr: '' }), resolveConfig({}, {}), corruptDir, { op: 'overview' })
+  ok((corrupt as { error?: string }).error?.includes('instance menu unreadable'), 'graphProbe reports a corrupt menu as data')
+
+  // 12i. A menu that is valid JSON but not an array is also rejected as data.
+  const nonArrayDir = mkdtempSync(join(tmpdir(), 'neuralos-nonarray-'))
+  writeFileSync(join(nonArrayDir, 'needle_menu.json'), '{"not":"an array"}')
+  const nonArray = await graphProbe(() => Promise.resolve({ ok: true, code: 0, stdout: '{}', stderr: '' }), resolveConfig({}, {}), nonArrayDir, { op: 'overview' })
+  ok((nonArray as { error?: string }).error?.includes('instance menu unreadable'), 'a non-array menu is rejected as data')
+}
+
 console.log(`\n${pass} passed, ${fail} failed`)
 if (fail > 0) {
   console.log(`FAILURES:\n${failures.map((f) => `  - ${f}`).join('\n')}`)

package/plugins/neuralos/neuralosEngine.mjs

@@ -79,7 +79,14 @@ export function defaultExec() {
     new Promise((resolve) => {
       const execEnv = opts.env ? { ...process.env, ...opts.env } : process.env
       const child = cpExecFile(cmd, args, { timeout: opts.timeoutMs ?? 120000, maxBuffer: 16 * 1024 * 1024, env: execEnv }, (err, stdout, stderr) => {
-        resolve({ ok: !err, code: err ? err.code ?? 1 : 0, stdout: String(stdout ?? ''), stderr: String(stderr ?? '') })
+        // err.code: 'EACCES'/'ENOENT'/'ETIMEDOUT' style codes, undefined for
+        // signal kills (e.g. our own timeout SIGTERM). Preserve the real
+        // code; a timeout must not masquerade as a generic exit 1.
+        let code = 0
+        if (err) {
+          code = typeof err.code === 'string' || typeof err.code === 'number' ? err.code : err.signal ? `killed (${err.signal})` : 1
+        }
+        resolve({ ok: !err, code, stdout: String(stdout ?? ''), stderr: String(stderr ?? '') })
       })
       void child
     })
@@ -94,6 +101,33 @@ async function exists(p) {
   }
 }
 
+/**
+ * A candidate is USABLE only if the binary is actually EXECUTABLE.
+ * Existence alone is not enough: electron-builder's extraResources copy and
+ * curl-downloaded files routinely land with mode 0644 — spawning them dies
+ * with EACCES ("engine exited EACCES:" with an empty stderr, the classic
+ * symptom). We probe X_OK; where the path is OURS to manage (the shared
+ * cache, the fleet-convention dir, an explicit override) we attempt a
+ * one-shot chmod recovery and re-probe. The app bundle is NOT ours to
+ * mutate — a 0644 bundled engine is skipped, never chmod'd, so a broken
+ * bundle falls through to the next runnable engine instead of shadowing it.
+ */
+async function executable(p, { recover = true } = {}) {
+  try {
+    await fs.access(p, fsConstants.X_OK)
+    return true
+  } catch {
+    if (!recover) return false
+    try {
+      await fs.chmod(p, 0o755)
+      await fs.access(p, fsConstants.X_OK)
+      return true
+    } catch {
+      return false
+    }
+  }
+}
+
 /** Download one file over HTTPS into dir with its basename (idempotent). */
 async function download(deps, url, dir) {
   await fs.mkdir(dir, { recursive: true })
@@ -149,19 +183,36 @@ export async function resolveEngine(cfg, deps = {}) {
   const resources = (deps.resourcesPath ?? process.resourcesPath) ?? undefined
   const bundled = bundledEngineName(platform, arch)
   if (resources && bundled) {
-    candidates.push({ bin: path.join(resources, 'neuralos', bundled), weights: path.join(resources, 'neuralos', WEIGHTS_NAME) })
+    // the app bundle is not ours to chmod — probe, skip, never recover
+    candidates.push({ bin: path.join(resources, 'neuralos', bundled), weights: path.join(resources, 'neuralos', WEIGHTS_NAME), recover: false })
   }
   if (bundled) {
     candidates.push({ bin: path.join(cfg.cacheDir, bundled), weights: path.join(cfg.cacheDir, WEIGHTS_NAME) })
   }
   candidates.push({ bin: path.join(cfg.instancesDir, 'engine', 'needle'), weights: path.join(cfg.instancesDir, 'engine', WEIGHTS_NAME) })
+  const skipped = []
   for (const c of candidates) {
-    if ((await exists(c.bin)) && (await exists(c.weights))) return { engineBin: c.bin, engineWeights: c.weights }
+    if (!(await exists(c.bin)) || !(await exists(c.weights))) continue
+    if (!(await executable(c.bin, { recover: c.recover !== false }))) {
+      // A present-but-unexecutable engine is a broken candidate, never a
+      // hard stop: record it and fall through to the next candidate.
+      skipped.push(c.bin)
+      continue
+    }
+    return { engineBin: c.bin, engineWeights: c.weights }
   }
   if (cfg.autoDownload) {
-    return ensureEngine({ ...deps, cacheDir: cfg.cacheDir, platform, arch })
+    const ensured = await ensureEngine({ ...deps, cacheDir: cfg.cacheDir, platform, arch })
+    if (!ensured.error) return ensured
+    // autoDownload could not provision a usable engine either — surface
+    // BOTH failures so the operator can see why every path was exhausted.
+    return {
+      error: `neuralOS engine not usable: ${ensured.error}${skipped.length ? `; also found but not executable: ${skipped.join(', ')} (chmod +x them or set neuralos.engineBin/engineWeights)` : ''}`,
+    }
+  }
+  return {
+    error: `neuralOS engine not found or not executable${skipped.length ? ` (found but not executable: ${skipped.join(', ')} — chmod +x them or set neuralos.engineBin/engineWeights)` : ' — set neuralos.engineBin/engineWeights (settings), install the desktop bundle, or enable autoDownload'}`,
   }
-  return { error: 'neuralOS engine not found — set neuralos.engineBin/engineWeights (settings), install the desktop bundle, or enable autoDownload' }
 }
 
 export function parseJsonObject(text) {
@@ -220,7 +271,16 @@ export async function engineSelect(exec, engine, menuPath, question, opts = {})
   } catch (e) {
     return { error: `engine execution failed: ${String(e?.message ?? e)}` }
   }
-  if (out.code !== 0 && !out.stdout.trim()) return { error: `engine exited ${out.code}: ${out.stderr.slice(0, 200)}` }
+  if (out.code !== 0 && !out.stdout.trim()) {
+    // EACCES on spawn surfaces as code 'EACCES' with EMPTY stderr — the
+    // classic lost-exec-bit symptom. Name the fix instead of a bare code.
+    if (out.code === 'EACCES' || /EACCES|permission denied/i.test(String(out.stderr))) {
+      return {
+        error: `engine not executable (${engine.engineBin}) — restore the exec bit (chmod +x) or set neuralos.engineBin/engineWeights to a runnable binary`,
+      }
+    }
+    return { error: `engine exited ${out.code}: ${out.stderr.slice(0, 200)}` }
+  }
   const parsed = parseJsonObject(out.stdout)
   if (!parsed) return { error: `engine output not JSON: ${out.stdout.slice(0, 120)}` }
   const calls = parsed.function_calls
@@ -266,8 +326,16 @@ export async function executeProbe(exec, cfg, instanceDir, probe, args, opts = {
  */
 export async function graphProbe(exec, cfg, instanceDir, input) {
   if (!['overview', 'neighbors', 'connect'].includes(input.op)) return { error: `unknown graph op: ${input.op}` }
-  const raw = await fs.readFile(path.join(instanceDir, 'needle_menu.json'), 'utf-8')
-  const menu = JSON.parse(raw)
+  // A corrupt/unreadable menu is an answer, never a thrown exception —
+  // every other read path in this file already reports errors as data.
+  let menu
+  try {
+    const raw = await fs.readFile(path.join(instanceDir, 'needle_menu.json'), 'utf-8')
+    menu = JSON.parse(raw)
+    if (!Array.isArray(menu)) throw new Error('menu is not an array')
+  } catch (e) {
+    return { error: `instance menu unreadable: ${String(e?.message ?? e)}` }
+  }
   const graphNames = menu.map((t) => t.name).filter((n) => n.includes('_graph_'))
   const probe = graphNames.find((n) => n.endsWith(`_graph_${input.op}`))
   if (!probe) return { error: `this instance has no ${input.op} graph probe`, available_graph_probes: graphNames }
@@ -288,7 +356,9 @@ export async function adminProbe(exec, cfg, instanceDir, probe, args) {
 }
 
 export function truncate(value, max = MAX_RESULT_CHARS) {
-  const text = typeof value === 'string' ? value : JSON.stringify(value)
+  // JSON.stringify(undefined) is undefined (not a string) — a probe that
+  // returned nothing must not crash the tool; render it honestly instead.
+  const text = typeof value === 'string' ? value : JSON.stringify(value) ?? 'null'
   if (text.length <= max) return text
   return `${text.slice(0, max)}\n… (truncated at ${max} chars)`
 }