subagent-cli 0.3.0 → 0.3.1

package/src/bridge/bridgeDebug.ts

@@ -1,135 +0,0 @@
-import { logForDebugging } from '../utils/debug.js'
-import { BridgeFatalError } from './bridgeApi.js'
-import type { BridgeApiClient } from './types.js'
-
-/**
- * Ant-only fault injection for manually testing bridge recovery paths.
- *
- * Real failure modes this targets (BQ 2026-03-12, 7-day window):
- *   poll 404 not_found_error   — 147K sessions/week, dead onEnvironmentLost gate
- *   ws_closed 1002/1006        —  22K sessions/week, zombie poll after close
- *   register transient failure —  residual: network blips during doReconnect
- *
- * Usage: /bridge-kick <subcommand> from the REPL while Remote Control is
- * connected, then tail debug.log to watch the recovery machinery react.
- *
- * Module-level state is intentional here: one bridge per REPL process, the
- * /bridge-kick slash command has no other way to reach into initBridgeCore's
- * closures, and teardown clears the slot.
- */
-
-/** One-shot fault to inject on the next matching api call. */
-type BridgeFault = {
-  method:
-    | 'pollForWork'
-    | 'registerBridgeEnvironment'
-    | 'reconnectSession'
-    | 'heartbeatWork'
-  /** Fatal errors go through handleErrorStatus → BridgeFatalError. Transient
-   *  errors surface as plain axios rejections (5xx / network). Recovery code
-   *  distinguishes the two: fatal → teardown, transient → retry/backoff. */
-  kind: 'fatal' | 'transient'
-  status: number
-  errorType?: string
-  /** Remaining injections. Decremented on consume; removed at 0. */
-  count: number
-}
-
-export type BridgeDebugHandle = {
-  /** Invoke the transport's permanent-close handler directly. Tests the
-   *  ws_closed → reconnectEnvironmentWithSession escalation (#22148). */
-  fireClose: (code: number) => void
-  /** Call reconnectEnvironmentWithSession() — same as SIGUSR2 but
-   *  reachable from the slash command. */
-  forceReconnect: () => void
-  /** Queue a fault for the next N calls to the named api method. */
-  injectFault: (fault: BridgeFault) => void
-  /** Abort the at-capacity sleep so an injected poll fault lands
-   *  immediately instead of up to 10min later. */
-  wakePollLoop: () => void
-  /** env/session IDs for the debug.log grep. */
-  describe: () => string
-}
-
-let debugHandle: BridgeDebugHandle | null = null
-const faultQueue: BridgeFault[] = []
-
-export function registerBridgeDebugHandle(h: BridgeDebugHandle): void {
-  debugHandle = h
-}
-
-export function clearBridgeDebugHandle(): void {
-  debugHandle = null
-  faultQueue.length = 0
-}
-
-export function getBridgeDebugHandle(): BridgeDebugHandle | null {
-  return debugHandle
-}
-
-export function injectBridgeFault(fault: BridgeFault): void {
-  faultQueue.push(fault)
-  logForDebugging(
-    `[bridge:debug] Queued fault: ${fault.method} ${fault.kind}/${fault.status}${fault.errorType ? `/${fault.errorType}` : ''} ×${fault.count}`,
-  )
-}
-
-/**
- * Wrap a BridgeApiClient so each call first checks the fault queue. If a
- * matching fault is queued, throw the specified error instead of calling
- * through. Delegates everything else to the real client.
- *
- * Only called when USER_TYPE === 'ant' — zero overhead in external builds.
- */
-export function wrapApiForFaultInjection(
-  api: BridgeApiClient,
-): BridgeApiClient {
-  function consume(method: BridgeFault['method']): BridgeFault | null {
-    const idx = faultQueue.findIndex(f => f.method === method)
-    if (idx === -1) return null
-    const fault = faultQueue[idx]!
-    fault.count--
-    if (fault.count <= 0) faultQueue.splice(idx, 1)
-    return fault
-  }
-
-  function throwFault(fault: BridgeFault, context: string): never {
-    logForDebugging(
-      `[bridge:debug] Injecting ${fault.kind} fault into ${context}: status=${fault.status} errorType=${fault.errorType ?? 'none'}`,
-    )
-    if (fault.kind === 'fatal') {
-      throw new BridgeFatalError(
-        `[injected] ${context} ${fault.status}`,
-        fault.status,
-        fault.errorType,
-      )
-    }
-    // Transient: mimic an axios rejection (5xx / network). No .status on
-    // the error itself — that's how the catch blocks distinguish.
-    throw new Error(`[injected transient] ${context} ${fault.status}`)
-  }
-
-  return {
-    ...api,
-    async pollForWork(envId, secret, signal, reclaimMs) {
-      const f = consume('pollForWork')
-      if (f) throwFault(f, 'Poll')
-      return api.pollForWork(envId, secret, signal, reclaimMs)
-    },
-    async registerBridgeEnvironment(config) {
-      const f = consume('registerBridgeEnvironment')
-      if (f) throwFault(f, 'Registration')
-      return api.registerBridgeEnvironment(config)
-    },
-    async reconnectSession(envId, sessionId) {
-      const f = consume('reconnectSession')
-      if (f) throwFault(f, 'ReconnectSession')
-      return api.reconnectSession(envId, sessionId)
-    },
-    async heartbeatWork(envId, workId, token) {
-      const f = consume('heartbeatWork')
-      if (f) throwFault(f, 'Heartbeat')
-      return api.heartbeatWork(envId, workId, token)
-    },
-  }
-}

package/src/bridge/bridgeEnabled.ts

@@ -1,202 +0,0 @@
-import { feature } from 'src/_stubs/bun-bundle.js'
-import {
-  checkGate_CACHED_OR_BLOCKING,
-  getDynamicConfig_CACHED_MAY_BE_STALE,
-  getFeatureValue_CACHED_MAY_BE_STALE,
-} from '../services/analytics/growthbook.js'
-// Namespace import breaks the bridgeEnabled → auth → config → bridgeEnabled
-// cycle — authModule.foo is a live binding, so by the time the helpers below
-// call it, auth.js is fully loaded. Previously used require() for the same
-// deferral, but require() hits a CJS cache that diverges from the ESM
-// namespace after mock.module() (daemon/auth.test.ts), breaking spyOn.
-import * as authModule from '../utils/auth.js'
-import { isEnvTruthy } from '../utils/envUtils.js'
-import { lt } from '../utils/semver.js'
-
-/**
- * Runtime check for bridge mode entitlement.
- *
- * Remote Control requires a claude.ai subscription (the bridge auths to CCR
- * with the claude.ai OAuth token). isClaudeAISubscriber() excludes
- * Bedrock/Vertex/Foundry, apiKeyHelper/gateway deployments, env-var API keys,
- * and Console API logins — none of which have the OAuth token CCR needs.
- * See github.com/deshaw/anthropic-issues/issues/24.
- *
- * The `feature('BRIDGE_MODE')` guard ensures the GrowthBook string literal
- * is only referenced when bridge mode is enabled at build time.
- */
-export function isBridgeEnabled(): boolean {
-  // Positive ternary pattern — see docs/feature-gating.md.
-  // Negative pattern (if (!feature(...)) return) does not eliminate
-  // inline string literals from external builds.
-  return feature('BRIDGE_MODE')
-    ? isClaudeAISubscriber() &&
-        getFeatureValue_CACHED_MAY_BE_STALE('tengu_ccr_bridge', false)
-    : false
-}
-
-/**
- * Blocking entitlement check for Remote Control.
- *
- * Returns cached `true` immediately (fast path). If the disk cache says
- * `false` or is missing, awaits GrowthBook init and fetches the fresh
- * server value (slow path, max ~5s), then writes it to disk.
- *
- * Use at entitlement gates where a stale `false` would unfairly block access.
- * For user-facing error paths, prefer `getBridgeDisabledReason()` which gives
- * a specific diagnostic. For render-body UI visibility checks, use
- * `isBridgeEnabled()` instead.
- */
-export async function isBridgeEnabledBlocking(): Promise<boolean> {
-  return feature('BRIDGE_MODE')
-    ? isClaudeAISubscriber() &&
-        (await checkGate_CACHED_OR_BLOCKING('tengu_ccr_bridge'))
-    : false
-}
-
-/**
- * Diagnostic message for why Remote Control is unavailable, or null if
- * it's enabled. Call this instead of a bare `isBridgeEnabledBlocking()`
- * check when you need to show the user an actionable error.
- *
- * The GrowthBook gate targets on organizationUUID, which comes from
- * config.oauthAccount — populated by /api/oauth/profile during login.
- * That endpoint requires the user:profile scope. Tokens without it
- * (setup-token, CLAUDE_CODE_OAUTH_TOKEN env var, or pre-scope-expansion
- * logins) leave oauthAccount unpopulated, so the gate falls back to
- * false and users see a dead-end "not enabled" message with no hint
- * that re-login would fix it. See CC-1165 / gh-33105.
- */
-export async function getBridgeDisabledReason(): Promise<string | null> {
-  if (feature('BRIDGE_MODE')) {
-    if (!isClaudeAISubscriber()) {
-      return 'Remote Control requires a claude.ai subscription. Run `claude auth login` to sign in with your claude.ai account.'
-    }
-    if (!hasProfileScope()) {
-      return 'Remote Control requires a full-scope login token. Long-lived tokens (from `claude setup-token` or CLAUDE_CODE_OAUTH_TOKEN) are limited to inference-only for security reasons. Run `claude auth login` to use Remote Control.'
-    }
-    if (!getOauthAccountInfo()?.organizationUuid) {
-      return 'Unable to determine your organization for Remote Control eligibility. Run `claude auth login` to refresh your account information.'
-    }
-    if (!(await checkGate_CACHED_OR_BLOCKING('tengu_ccr_bridge'))) {
-      return 'Remote Control is not yet enabled for your account.'
-    }
-    return null
-  }
-  return 'Remote Control is not available in this build.'
-}
-
-// try/catch: main.tsx:5698 calls isBridgeEnabled() while defining the Commander
-// program, before enableConfigs() runs. isClaudeAISubscriber() → getGlobalConfig()
-// throws "Config accessed before allowed" there. Pre-config, no OAuth token can
-// exist anyway — false is correct. Same swallow getFeatureValue_CACHED_MAY_BE_STALE
-// already does at growthbook.ts:775-780.
-function isClaudeAISubscriber(): boolean {
-  try {
-    return authModule.isClaudeAISubscriber()
-  } catch {
-    return false
-  }
-}
-function hasProfileScope(): boolean {
-  try {
-    return authModule.hasProfileScope()
-  } catch {
-    return false
-  }
-}
-function getOauthAccountInfo(): ReturnType<
-  typeof authModule.getOauthAccountInfo
-> {
-  try {
-    return authModule.getOauthAccountInfo()
-  } catch {
-    return undefined
-  }
-}
-
-/**
- * Runtime check for the env-less (v2) REPL bridge path.
- * Returns true when the GrowthBook flag `tengu_bridge_repl_v2` is enabled.
- *
- * This gates which implementation initReplBridge uses — NOT whether bridge
- * is available at all (see isBridgeEnabled above). Daemon/print paths stay
- * on the env-based implementation regardless of this gate.
- */
-export function isEnvLessBridgeEnabled(): boolean {
-  return feature('BRIDGE_MODE')
-    ? getFeatureValue_CACHED_MAY_BE_STALE('tengu_bridge_repl_v2', false)
-    : false
-}
-
-/**
- * Kill-switch for the `cse_*` → `session_*` client-side retag shim.
- *
- * The shim exists because compat/convert.go:27 validates TagSession and the
- * claude.ai frontend routes on `session_*`, while v2 worker endpoints hand out
- * `cse_*`. Once the server tags by environment_kind and the frontend accepts
- * `cse_*` directly, flip this to false to make toCompatSessionId a no-op.
- * Defaults to true — the shim stays active until explicitly disabled.
- */
-export function isCseShimEnabled(): boolean {
-  return feature('BRIDGE_MODE')
-    ? getFeatureValue_CACHED_MAY_BE_STALE(
-        'tengu_bridge_repl_v2_cse_shim_enabled',
-        true,
-      )
-    : true
-}
-
-/**
- * Returns an error message if the current CLI version is below the
- * minimum required for the v1 (env-based) Remote Control path, or null if the
- * version is fine. The v2 (env-less) path uses checkEnvLessBridgeMinVersion()
- * in envLessBridgeConfig.ts instead — the two implementations have independent
- * version floors.
- *
- * Uses cached (non-blocking) GrowthBook config. If GrowthBook hasn't
- * loaded yet, the default '0.0.0' means the check passes — a safe fallback.
- */
-export function checkBridgeMinVersion(): string | null {
-  // Positive pattern — see docs/feature-gating.md.
-  // Negative pattern (if (!feature(...)) return) does not eliminate
-  // inline string literals from external builds.
-  if (feature('BRIDGE_MODE')) {
-    const config = getDynamicConfig_CACHED_MAY_BE_STALE<{
-      minVersion: string
-    }>('tengu_bridge_min_version', { minVersion: '0.0.0' })
-    if (config.minVersion && lt(MACRO.VERSION, config.minVersion)) {
-      return `Your version of Claude Code (${MACRO.VERSION}) is too old for Remote Control.\nVersion ${config.minVersion} or higher is required. Run \`claude update\` to update.`
-    }
-  }
-  return null
-}
-
-/**
- * Default for remoteControlAtStartup when the user hasn't explicitly set it.
- * When the CCR_AUTO_CONNECT build flag is present (ant-only) and the
- * tengu_cobalt_harbor GrowthBook gate is on, all sessions connect to CCR by
- * default — the user can still opt out by setting remoteControlAtStartup=false
- * in config (explicit settings always win over this default).
- *
- * Defined here rather than in config.ts to avoid a direct
- * config.ts → growthbook.ts import cycle (growthbook.ts → user.ts → config.ts).
- */
-export function getCcrAutoConnectDefault(): boolean {
-  return feature('CCR_AUTO_CONNECT')
-    ? getFeatureValue_CACHED_MAY_BE_STALE('tengu_cobalt_harbor', false)
-    : false
-}
-
-/**
- * Opt-in CCR mirror mode — every local session spawns an outbound-only
- * Remote Control session that receives forwarded events. Separate from
- * getCcrAutoConnectDefault (bidirectional Remote Control). Env var wins for
- * local opt-in; GrowthBook controls rollout.
- */
-export function isCcrMirrorEnabled(): boolean {
-  return feature('CCR_MIRROR')
-    ? isEnvTruthy(process.env.CLAUDE_CODE_CCR_MIRROR) ||
-        getFeatureValue_CACHED_MAY_BE_STALE('tengu_ccr_mirror', false)
-    : false
-}