taskode 0.4.0

package/src/path-safety.js

@@ -0,0 +1,80 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function canonicalizePath(inputPath) {
+  if (typeof inputPath !== 'string' || inputPath.trim() === '') {
+    throw new Error(`Invalid path: ${inputPath}`);
+  }
+
+  const absolutePath = path.resolve(inputPath);
+  const { root, segments } = splitAbsolutePath(absolutePath);
+  return resolveSegments(root, [], segments);
+}
+
+export function assertPathInsideRoot(candidatePath, rootPath) {
+  const canonicalCandidate = canonicalizePath(candidatePath);
+  const canonicalRoot = canonicalizePath(rootPath);
+
+  if (canonicalCandidate === canonicalRoot) {
+    throw new Error(`Refusing to operate on workspace root: ${canonicalCandidate}`);
+  }
+
+  const rootPrefix = canonicalRoot.endsWith(path.sep) ? canonicalRoot : `${canonicalRoot}${path.sep}`;
+  const candidatePrefix = canonicalCandidate.endsWith(path.sep)
+    ? canonicalCandidate
+    : `${canonicalCandidate}${path.sep}`;
+
+  if (!candidatePrefix.startsWith(rootPrefix)) {
+    throw new Error(`Path escapes workspace root: ${canonicalCandidate}`);
+  }
+
+  return canonicalCandidate;
+}
+
+export function assertRemotePathSafe(remotePath) {
+  if (typeof remotePath !== 'string' || remotePath.trim() === '') {
+    throw new Error('Remote workspace path must be a non-empty string');
+  }
+  if (/[\0\r\n]/.test(remotePath)) {
+    throw new Error(`Invalid remote workspace path: ${remotePath}`);
+  }
+  return remotePath;
+}
+
+function splitAbsolutePath(absolutePath) {
+  const parsed = path.parse(absolutePath);
+  const root = parsed.root || path.sep;
+  const relative = absolutePath.slice(root.length);
+  const segments = relative ? relative.split(path.sep).filter(Boolean) : [];
+  return { root, segments };
+}
+
+function resolveSegments(root, resolvedSegments, pendingSegments) {
+  if (!pendingSegments.length) {
+    return joinPath(root, resolvedSegments);
+  }
+
+  const [segment, ...rest] = pendingSegments;
+  const candidatePath = joinPath(root, [...resolvedSegments, segment]);
+
+  try {
+    const stat = fs.lstatSync(candidatePath);
+    if (stat.isSymbolicLink()) {
+      const linkTarget = fs.readlinkSync(candidatePath);
+      const resolvedTarget = path.resolve(joinPath(root, resolvedSegments), linkTarget);
+      const splitTarget = splitAbsolutePath(resolvedTarget);
+      return resolveSegments(splitTarget.root, [], [...splitTarget.segments, ...rest]);
+    }
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      return joinPath(root, [...resolvedSegments, segment, ...rest]);
+    }
+    throw new Error(`Unable to inspect path ${candidatePath}: ${error.message}`);
+  }
+
+  return resolveSegments(root, [...resolvedSegments, segment], rest);
+}
+
+function joinPath(root, segments) {
+  return segments.reduce((current, segment) => path.join(current, segment), root);
+}

package/src/policy.js

@@ -0,0 +1,23 @@
+export function assertCommandAllowed(command, policy) {
+  const deny = policy.denyCommands || [];
+  if (matchesAny(command, deny)) {
+    throw new Error(`Command denied by policy: ${command}`);
+  }
+
+  const allow = policy.allowCommands || ['*'];
+  if (!matchesAny(command, allow)) {
+    throw new Error(`Command not allowed by policy: ${command}`);
+  }
+}
+
+function matchesAny(text, patterns) {
+  if (!patterns.length) return false;
+  return patterns.some((pattern) => {
+    if (pattern === '*') return true;
+    if (pattern.startsWith('/') && pattern.endsWith('/')) {
+      const regex = new RegExp(pattern.slice(1, -1));
+      return regex.test(text);
+    }
+    return text.includes(pattern);
+  });
+}

package/src/review.js

@@ -0,0 +1,197 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const INTERNAL_IGNORES = new Set(['.git', '.taskode', 'node_modules']);
+
+export function buildRunArtifacts({ projectRoot, workspacePath, logsRoot, runId, ignoreNames = [] }) {
+  if (!workspacePath || !fs.existsSync(workspacePath)) {
+    return emptyArtifacts();
+  }
+
+  const changes = collectWorkspaceChanges({ projectRoot, workspacePath, ignoreNames });
+  const diffText = generateWorkspaceDiff({ projectRoot, workspacePath, changes });
+  const diffFile = writeDiffFile({ logsRoot, runId, diffText });
+
+  return {
+    changedFiles: changes,
+    diffSummary: summarizeChanges(changes),
+    diffText,
+    diffFile
+  };
+}
+
+export function collectWorkspaceChanges({ projectRoot, workspacePath, ignoreNames = [] }) {
+  const ignoreSet = new Set([...INTERNAL_IGNORES, ...ignoreNames]);
+  const projectFiles = walkFiles(projectRoot, ignoreSet);
+  const workspaceFiles = walkFiles(workspacePath, ignoreSet);
+  const changes = [];
+
+  for (const relativePath of new Set([...projectFiles.keys(), ...workspaceFiles.keys()])) {
+    const projectEntry = projectFiles.get(relativePath);
+    const workspaceEntry = workspaceFiles.get(relativePath);
+
+    if (!projectEntry && workspaceEntry) {
+      changes.push({ path: relativePath, status: 'added' });
+      continue;
+    }
+
+    if (projectEntry && !workspaceEntry) {
+      changes.push({ path: relativePath, status: 'deleted' });
+      continue;
+    }
+
+    if (!entriesEqual(projectEntry, workspaceEntry)) {
+      changes.push({ path: relativePath, status: 'modified' });
+    }
+  }
+
+  return changes.sort((a, b) => a.path.localeCompare(b.path));
+}
+
+export function applyWorkspaceChanges({ projectRoot, workspacePath, changes, ignoreNames = [] }) {
+  const effectiveChanges = changes?.length
+    ? changes
+    : collectWorkspaceChanges({ projectRoot, workspacePath, ignoreNames });
+
+  for (const change of effectiveChanges) {
+    const projectFile = resolveSafeChild(projectRoot, change.path);
+    const workspaceFile = resolveSafeChild(workspacePath, change.path);
+
+    if (change.status === 'deleted') {
+      fs.rmSync(projectFile, { force: true });
+      removeEmptyParents(path.dirname(projectFile), projectRoot);
+      continue;
+    }
+
+    ensureDir(path.dirname(projectFile));
+    fs.copyFileSync(workspaceFile, projectFile);
+  }
+
+  return effectiveChanges;
+}
+
+function walkFiles(root, ignoreSet, basePath = '', files = new Map()) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    if (ignoreSet.has(entry.name)) continue;
+
+    const absolutePath = path.join(root, entry.name);
+    const relativePath = basePath ? path.join(basePath, entry.name) : entry.name;
+
+    if (entry.isDirectory()) {
+      walkFiles(absolutePath, ignoreSet, relativePath, files);
+      continue;
+    }
+
+    files.set(relativePath, snapshotEntry(absolutePath, entry));
+  }
+
+  return files;
+}
+
+function snapshotEntry(absolutePath, entry) {
+  if (entry.isSymbolicLink()) {
+    return {
+      type: 'symlink',
+      value: fs.readlinkSync(absolutePath)
+    };
+  }
+
+  return {
+    type: 'file',
+    value: fs.readFileSync(absolutePath)
+  };
+}
+
+function entriesEqual(left, right) {
+  if (!left || !right) return false;
+  if (left.type !== right.type) return false;
+  if (left.type === 'symlink') return left.value === right.value;
+  return Buffer.compare(left.value, right.value) === 0;
+}
+
+function generateWorkspaceDiff({ projectRoot, workspacePath, changes }) {
+  const sections = [];
+
+  for (const change of changes) {
+    const left = change.status === 'added' ? '/dev/null' : path.join(projectRoot, change.path);
+    const right = change.status === 'deleted' ? '/dev/null' : path.join(workspacePath, change.path);
+    const result = spawnSync('git', ['diff', '--no-index', '--no-ext-diff', '--text', '--', left, right], {
+      encoding: 'utf8',
+      maxBuffer: 10 * 1024 * 1024
+    });
+
+    if (result.error) {
+      return renderFallbackDiff(changes);
+    }
+
+    if (![0, 1].includes(result.status ?? 0)) {
+      throw new Error(result.stderr || `git diff failed for ${change.path}`);
+    }
+
+    if (result.stdout.trim()) {
+      sections.push(result.stdout.trimEnd());
+    }
+  }
+
+  return sections.join('\n\n');
+}
+
+function renderFallbackDiff(changes) {
+  return changes.map((change) => `${change.status.toUpperCase()} ${change.path}`).join('\n');
+}
+
+function writeDiffFile({ logsRoot, runId, diffText }) {
+  if (!diffText) return null;
+  ensureDir(logsRoot);
+  const diffFile = path.join(logsRoot, `${runId}.diff`);
+  fs.writeFileSync(diffFile, `${diffText}\n`, 'utf8');
+  return diffFile;
+}
+
+function summarizeChanges(changes) {
+  const summary = { total: changes.length, added: 0, modified: 0, deleted: 0 };
+  for (const change of changes) {
+    if (change.status === 'added') summary.added += 1;
+    if (change.status === 'modified') summary.modified += 1;
+    if (change.status === 'deleted') summary.deleted += 1;
+  }
+  return summary;
+}
+
+function removeEmptyParents(startDir, stopDir) {
+  let current = startDir;
+  while (current.startsWith(stopDir) && current !== stopDir) {
+    if (fs.existsSync(current) && fs.readdirSync(current).length === 0) {
+      fs.rmdirSync(current);
+      current = path.dirname(current);
+      continue;
+    }
+    break;
+  }
+}
+
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+function emptyArtifacts() {
+  return {
+    changedFiles: [],
+    diffSummary: { total: 0, added: 0, modified: 0, deleted: 0 },
+    diffText: '',
+    diffFile: null
+  };
+}
+
+function resolveSafeChild(root, relativePath) {
+  const normalized = path.normalize(String(relativePath || ''));
+  const absolute = path.resolve(root, normalized);
+  const rootPrefix = root.endsWith(path.sep) ? root : `${root}${path.sep}`;
+
+  if (absolute !== root && !absolute.startsWith(rootPrefix)) {
+    throw new Error(`Refusing to access path outside root: ${relativePath}`);
+  }
+
+  return absolute;
+}

package/src/runner.js

@@ -0,0 +1,133 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { exec } from 'node:child_process';
+import { Buffer } from 'node:buffer';
+import { runAppServerSession } from './app-server.js';
+import { assertCommandAllowed } from './policy.js';
+import { runSSHCommand } from './ssh.js';
+
+export class AgentRunner {
+  constructor({ config, store }) {
+    this.config = config;
+    this.store = store;
+  }
+
+  async run({ issue, workspacePath, prompt, runId, tracker, workerHost = null }) {
+    const command = this.buildCommand();
+    assertCommandAllowed(command, this.config.policy);
+
+    await writePromptArtifact(workspacePath, prompt, workerHost);
+
+    if (this.config.codex.mode === 'app-server') {
+      return runAppServerSession({
+        command,
+        cwd: workspacePath,
+        prompt,
+        issue,
+        tracker,
+        config: this.config,
+        maxTurns: this.config.codex.maxTurns,
+        runId,
+        store: this.store,
+        workerHost
+      });
+    }
+
+    return runShell({
+      command,
+      cwd: workspacePath,
+      timeoutMs: this.config.codex.timeoutMs,
+      issue,
+      workerHost
+    });
+  }
+
+  buildCommand() {
+    return this.config.codex.command;
+  }
+}
+
+async function writePromptArtifact(workspacePath, prompt, workerHost) {
+  if (!workerHost) {
+    const taskodeDir = path.join(workspacePath, '.taskode');
+    fs.mkdirSync(taskodeDir, { recursive: true });
+    fs.writeFileSync(path.join(taskodeDir, 'prompt.txt'), prompt, 'utf8');
+    return;
+  }
+
+  const encodedPrompt = Buffer.from(prompt, 'utf8').toString('base64');
+  await runSSHCommand(
+    workerHost,
+    `cd '${workspacePath.replaceAll("'", `'\"'\"'`)}' && mkdir -p .taskode && printf %s '${encodedPrompt}' | base64 -d > .taskode/prompt.txt`
+  );
+}
+
+function runShell({ command, cwd, timeoutMs, issue, workerHost }) {
+  const startedAt = Date.now();
+
+  if (workerHost) {
+    return runRemoteShell({ command, cwd, timeoutMs, issue, startedAt, workerHost });
+  }
+
+  return new Promise((resolve) => {
+    exec(command, { cwd, timeout: timeoutMs, shell: '/bin/bash' }, (error, stdout, stderr) => {
+      if (error) {
+        return resolve({
+          status: 'failed',
+          code: error.code ?? 1,
+          output: stdout || '',
+          error: stderr || error.message,
+          durationMs: Date.now() - startedAt,
+          telemetry: shellTelemetry(null)
+        });
+      }
+
+      return resolve({
+        status: 'succeeded',
+        code: 0,
+        output: stdout || `Processed issue ${issue.identifier}`,
+        error: stderr || '',
+        durationMs: Date.now() - startedAt,
+        telemetry: shellTelemetry(null)
+      });
+    });
+  });
+}
+
+async function runRemoteShell({ command, cwd, timeoutMs, issue, startedAt, workerHost }) {
+  try {
+    const { stdout, stderr } = await runSSHCommand(
+      workerHost,
+      `cd '${cwd.replaceAll("'", `'\"'\"'`)}' && ${command}`,
+      { timeoutMs }
+    );
+
+    return {
+      status: 'succeeded',
+      code: 0,
+      output: stdout || `Processed issue ${issue.identifier}`,
+      error: stderr || '',
+      durationMs: Date.now() - startedAt,
+      telemetry: shellTelemetry(workerHost)
+    };
+  } catch (error) {
+    return {
+      status: 'failed',
+      code: error.code ?? 1,
+      output: error.stdout || '',
+      error: error.stderr || error.message,
+      durationMs: Date.now() - startedAt,
+      telemetry: shellTelemetry(workerHost)
+    };
+  }
+}
+
+function shellTelemetry(workerHost) {
+  return {
+    turnCount: 1,
+    inputTokens: 0,
+    outputTokens: 0,
+    totalTokens: 0,
+    workerHost
+  };
+}

package/src/server.js

@@ -0,0 +1,168 @@
+import express from 'express';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { authMiddleware } from './auth.js';
+
+export function createServer({ store, orchestrator, tracker, config }) {
+  const app = express();
+  app.use(express.json());
+
+  app.get('/api/health', (_req, res) => {
+    res.json({
+      ok: true,
+      now: new Date().toISOString(),
+      tracker: config.tracker.kind
+    });
+  });
+
+  app.use('/api', authMiddleware(config, store));
+
+  app.get('/api/tasks', async (_req, res) => {
+    try {
+      await syncRemoteTasksIfNeeded(tracker, config);
+      res.json({ tasks: store.listTasks() });
+    } catch (error) {
+      res.status(502).json({ error: error.message });
+    }
+  });
+
+  app.get('/api/tasks/:id', async (req, res) => {
+    try {
+      await syncRemoteTasksIfNeeded(tracker, config);
+      const task = store.getTask(req.params.id);
+      if (!task) return res.status(404).json({ error: 'task not found' });
+      return res.json({ task, runs: store.listRuns(task.id) });
+    } catch (error) {
+      return res.status(502).json({ error: error.message });
+    }
+  });
+
+  app.post('/api/tasks', (req, res) => {
+    if (config.tracker.kind !== 'local') {
+      return res.status(400).json({ error: 'task creation is only supported in local tracker mode' });
+    }
+
+    const { title, description, type, priority } = req.body || {};
+    if (!title || typeof title !== 'string') {
+      return res.status(400).json({ error: 'title is required' });
+    }
+
+    const task = store.createTask({
+      title,
+      description,
+      type,
+      priority,
+      dependencies: normalizeDependencies(req.body?.dependencies)
+    });
+
+    store.appendAudit({ action: 'task_created', actor: req.ip, metadata: { taskId: task.id } });
+    return res.status(201).json({ task });
+  });
+
+  app.patch('/api/tasks/:id', (req, res) => {
+    const task = store.updateTask(req.params.id, {
+      ...req.body,
+      dependencies: req.body?.dependencies !== undefined ? normalizeDependencies(req.body.dependencies) : undefined
+    });
+
+    if (!task) {
+      return res.status(404).json({ error: 'task not found' });
+    }
+
+    store.appendAudit({ action: 'task_updated', actor: req.ip, metadata: { taskId: task.id } });
+    return res.json({ task });
+  });
+
+  app.post('/api/tasks/:id/requeue', async (req, res) => {
+    try {
+      const task = await orchestrator.requeueTask(req.params.id);
+      return res.json({ task });
+    } catch (error) {
+      return res.status(400).json({ error: error.message });
+    }
+  });
+
+  app.get('/api/runs', (_req, res) => {
+    res.json({ runs: store.listRuns(_req.query.taskId) });
+  });
+
+  app.get('/api/runs/:id', (req, res) => {
+    const run = store.getRun(req.params.id);
+    if (!run) return res.status(404).json({ error: 'run not found' });
+    return res.json({ run });
+  });
+
+  app.get('/api/runs/:id/diff', (req, res) => {
+    const run = store.getRun(req.params.id);
+    if (!run) return res.status(404).json({ error: 'run not found' });
+    if (!run.diffFile || !fs.existsSync(run.diffFile)) return res.type('text/plain').send('');
+    return res.type('text/plain').send(fs.readFileSync(run.diffFile, 'utf8'));
+  });
+
+  app.post('/api/runs/:id/approve', async (req, res) => {
+    try {
+      const run = await orchestrator.approveRun(req.params.id);
+      return res.json({ run });
+    } catch (error) {
+      return res.status(400).json({ error: error.message });
+    }
+  });
+
+  app.post('/api/runs/:id/reject', async (req, res) => {
+    try {
+      const run = await orchestrator.rejectRun(req.params.id, req.body?.reason || '');
+      return res.json({ run });
+    } catch (error) {
+      return res.status(400).json({ error: error.message });
+    }
+  });
+
+  app.get('/api/logs', (_req, res) => {
+    res.json({ logs: store.listSystemLogs() });
+  });
+
+  app.get('/api/audit', (_req, res) => {
+    res.json({ audit: store.listAudit() });
+  });
+
+  app.get('/api/v1/state', (_req, res) => {
+    res.json({
+      workflow_path: config.workflowPath,
+      tracker: config.tracker.kind,
+      state: orchestrator.getState()
+    });
+  });
+
+  app.get('/api/v1/:issueIdentifier', (req, res) => {
+    const task = store.getTask(req.params.issueIdentifier);
+    const runs = store.listRuns(req.params.issueIdentifier);
+    return res.json({ task, runs });
+  });
+
+  app.post('/api/v1/refresh', async (req, res) => {
+    await orchestrator.tick();
+    store.appendAudit({ action: 'manual_refresh', actor: req.ip, metadata: {} });
+    res.json({ ok: true });
+  });
+
+  const __dirname = path.dirname(fileURLToPath(import.meta.url));
+  app.use('/', express.static(path.join(__dirname, '..', 'public')));
+
+  return app;
+}
+
+async function syncRemoteTasksIfNeeded(tracker, config) {
+  if (config.tracker.kind === 'local') return;
+  await tracker.fetchCandidates();
+}
+
+function normalizeDependencies(value) {
+  if (Array.isArray(value)) {
+    return [...new Set(value.map((entry) => String(entry || '').trim()).filter(Boolean))];
+  }
+  if (typeof value === 'string') {
+    return [...new Set(value.split(',').map((entry) => entry.trim()).filter(Boolean))];
+  }
+  return [];
+}

package/src/ssh.js

@@ -0,0 +1,82 @@
+import { execFile, spawn } from 'node:child_process';
+
+export function runSSHCommand(host, command, options = {}) {
+  return new Promise((resolve, reject) => {
+    const executable = findSshExecutable();
+    const child = execFile(
+      executable,
+      buildSshArgs(host, command),
+      {
+        timeout: options.timeoutMs,
+        cwd: options.cwd,
+        encoding: 'utf8',
+        maxBuffer: options.maxBuffer ?? 10 * 1024 * 1024
+      },
+      (error, stdout, stderr) => {
+        if (error) {
+          error.stdout = stdout;
+          error.stderr = stderr;
+          reject(error);
+          return;
+        }
+        resolve({ stdout, stderr });
+      }
+    );
+
+    if (options.stdin) {
+      child.stdin?.end(options.stdin);
+    }
+  });
+}
+
+export function startSSHProcess(host, command, options = {}) {
+  const executable = findSshExecutable();
+  return spawn(executable, buildSshArgs(host, command), {
+    cwd: options.cwd,
+    stdio: options.stdio || ['pipe', 'pipe', 'pipe']
+  });
+}
+
+export function remoteShellCommand(command) {
+  return `bash -lc ${shellEscape(command)}`;
+}
+
+export function shellEscape(value) {
+  return `'${String(value).replaceAll("'", `'\"'\"'`)}'`;
+}
+
+function buildSshArgs(host, command) {
+  const args = [];
+  const configPath = process.env.TASKODE_SSH_CONFIG;
+  if (configPath) {
+    args.push('-F', configPath);
+  }
+
+  args.push('-T');
+
+  const target = parseTarget(host);
+  if (target.port) {
+    args.push('-p', target.port);
+  }
+
+  args.push(target.destination, remoteShellCommand(command));
+  return args;
+}
+
+function parseTarget(host) {
+  const trimmed = String(host || '').trim();
+  const match = trimmed.match(/^(.*):(\d+)$/);
+  if (match && isPortDestination(match[1])) {
+    return { destination: match[1], port: match[2] };
+  }
+  return { destination: trimmed, port: null };
+}
+
+function isPortDestination(destination) {
+  return destination !== '' && (!destination.includes(':') || (destination.includes('[') && destination.includes(']')));
+}
+
+function findSshExecutable() {
+  const executable = process.env.TASKODE_SSH_BIN || 'ssh';
+  return executable;
+}