tokenmaxxing 1.8.0 → 1.9.0

package/src/lib/relay/modes.ts

@@ -1,82 +0,0 @@
-// Claude Code permission-mode vocabulary for the relay worker, plus the Codex
-// sandbox / ask-for-approval mapping. Host terms only: never invent alternate
-// security labels. `manual` aliases Claude's `default` (≥2.1.200 UI name).
-
-import { z } from "zod";
-
-export const ClaudePermissionModes = [
-  "default",
-  "acceptEdits",
-  "plan",
-  "auto",
-  "dontAsk",
-  "bypassPermissions",
-] as const;
-
-export const ClaudePermissionModeSchema = z.enum(ClaudePermissionModes);
-export type ClaudePermissionMode = z.infer<typeof ClaudePermissionModeSchema>;
-
-const AliasSchema = z.enum(["manual", "yolo", "dangerous"]);
-
-/** Parse a host/CLI permission-mode token into a Claude mode. */
-export function parsePermissionMode(input: { raw: string }): ClaudePermissionMode {
-  const trimmed = input.raw.trim();
-  const alias = AliasSchema.safeParse(trimmed);
-  if (alias.success) {
-    if (alias.data === "manual") return "default";
-    return "bypassPermissions";
-  }
-  return ClaudePermissionModeSchema.parse(trimmed);
-}
-
-export function tryParsePermissionMode(input: { raw: string }): ClaudePermissionMode | null {
-  try {
-    return parsePermissionMode(input);
-  } catch {
-    return null;
-  }
-}
-
-export type CodexAskForApproval = "untrusted" | "on-failure" | "on-request" | "never";
-
-export type CodexSpawnFlags = {
-  sandbox: "read-only" | "workspace-write" | "danger-full-access";
-  askForApproval: CodexAskForApproval;
-};
-
-/** Map a Claude permission-mode name onto Codex CLI flags. */
-export function codexFlagsForMode(input: { mode: ClaudePermissionMode }): CodexSpawnFlags {
-  switch (input.mode) {
-    case "plan":
-    case "default":
-      return { sandbox: "read-only", askForApproval: "on-request" };
-    case "acceptEdits":
-      return { sandbox: "workspace-write", askForApproval: "on-request" };
-    case "auto":
-      return { sandbox: "workspace-write", askForApproval: "on-request" };
-    case "dontAsk":
-      return { sandbox: "read-only", askForApproval: "never" };
-    case "bypassPermissions":
-      return { sandbox: "danger-full-access", askForApproval: "never" };
-  }
-}
-
-/** Claude argv fragment for a permission mode (includes allow-dangerously when needed). */
-export function claudeArgvForMode(input: { mode: ClaudePermissionMode }): string[] {
-  const args = ["--permission-mode", input.mode];
-  if (input.mode === "bypassPermissions") {
-    args.push("--dangerously-skip-permissions");
-  }
-  return args;
-}
-
-/** Codex argv fragment for a Claude-named mode. */
-export function codexArgvForMode(input: { mode: ClaudePermissionMode }): string[] {
-  const flags = codexFlagsForMode(input);
-  return ["--sandbox", flags.sandbox, "--ask-for-approval", flags.askForApproval];
-}
-
-/** Under bypassPermissions, worker permission pings must not surface to main. */
-export function permissionPingsEnabled(input: { mode: ClaudePermissionMode }): boolean {
-  return input.mode !== "bypassPermissions";
-}

package/src/lib/relay/protocol.ts

@@ -1,61 +0,0 @@
-// Shared stdout contract for cheap host relay agents.
-
-import type { ClaudePermissionMode } from "./modes.ts";
-
-export type TurnOutput = {
-  sessionId: string;
-  permissionMode: ClaudePermissionMode;
-  kind: "turn-done";
-  text: string;
-};
-
-export type PermissionNeededOutput = {
-  sessionId: string;
-  permissionMode: ClaudePermissionMode;
-  kind: "permission-needed";
-  requestId: string;
-  summary: string;
-  detail: string;
-};
-
-export type RelayStdout = TurnOutput | PermissionNeededOutput;
-
-export function formatRelayStdout(input: { payload: RelayStdout }): string {
-  const p = input.payload;
-  const lines = [
-    `session: ${p.sessionId}`,
-    `permission-mode: ${p.permissionMode}`,
-  ];
-  if (p.kind === "permission-needed") {
-    lines.push(`permission-needed: ${p.requestId}`);
-    lines.push(`summary: ${p.summary}`);
-    lines.push(`detail: ${p.detail}`);
-    lines.push(`session: ${p.sessionId}`);
-    lines.push(`permission-mode: ${p.permissionMode}`);
-  } else if (p.text.trim() !== "") {
-    lines.push(p.text.replace(/\s+$/, ""));
-  }
-  return lines.join("\n") + "\n";
-}
-
-export function parseRelayStdout(input: { text: string }): {
-  sessionId: string | null;
-  permissionMode: string | null;
-  requestId: string | null;
-  summary: string | null;
-  detail: string | null;
-} {
-  let sessionId: string | null = null;
-  let permissionMode: string | null = null;
-  let requestId: string | null = null;
-  let summary: string | null = null;
-  let detail: string | null = null;
-  for (const line of input.text.split("\n")) {
-    if (line.startsWith("session: ")) sessionId = line.slice("session: ".length).trim();
-    else if (line.startsWith("permission-mode: ")) permissionMode = line.slice("permission-mode: ".length).trim();
-    else if (line.startsWith("permission-needed: ")) requestId = line.slice("permission-needed: ".length).trim();
-    else if (line.startsWith("summary: ")) summary = line.slice("summary: ".length);
-    else if (line.startsWith("detail: ")) detail = line.slice("detail: ".length);
-  }
-  return { sessionId, permissionMode, requestId, summary, detail };
-}

package/src/lib/relay/registry.ts

@@ -1,175 +0,0 @@
-// Per-session registry under $TOKENMAXXING_HOME/relay/sessions/<id>.json.
-// Per-session flock only (high churn); never a global relay lock for turns.
-
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { z } from "zod";
-import { paths } from "../paths.ts";
-import { writeFileAtomic } from "../atomic.ts";
-import { withLock } from "../lock.ts";
-import { ClaudePermissionModeSchema, type ClaudePermissionMode } from "./modes.ts";
-import { loadRelayConfig, type RelayWorker } from "./config.ts";
-
-export const RelaySessionStateSchema = z.enum([
-  "idle",
-  "running",
-  "permission-needed",
-  "destroyed",
-]);
-export type RelaySessionState = z.infer<typeof RelaySessionStateSchema>;
-
-export const RelayRegistryEntrySchema = z.object({
-  sessionId: z.uuid(),
-  tmuxName: z.string().min(1),
-  worker: z.enum(["claude", "codex"]),
-  permissionMode: ClaudePermissionModeSchema,
-  cwd: z.string().min(1),
-  state: RelaySessionStateSchema,
-  createdAt: z.number().int().nonnegative(),
-  lastActiveAt: z.number().int().nonnegative(),
-  pendingRequestId: z.string().min(1).optional(),
-});
-export type RelayRegistryEntry = z.infer<typeof RelayRegistryEntrySchema>;
-
-export function relaySessionsDir(): string {
-  return join(paths.relayDir, "sessions");
-}
-
-export function relayLocksDir(): string {
-  return join(paths.relayDir, "locks");
-}
-
-export function relayTurnDoneDir(): string {
-  return join(paths.relayDir, "turn-done");
-}
-
-export function relayPendingDir(): string {
-  return join(paths.relayDir, "pending");
-}
-
-export function relayDecisionsDir(): string {
-  return join(paths.relayDir, "decisions");
-}
-
-export function sessionEntryPath(input: { sessionId: string }): string {
-  return join(relaySessionsDir(), `${input.sessionId}.json`);
-}
-
-export function sessionLockPath(input: { sessionId: string }): string {
-  return join(relayLocksDir(), input.sessionId);
-}
-
-export function turnDonePath(input: { sessionId: string }): string {
-  return join(relayTurnDoneDir(), input.sessionId);
-}
-
-export function pendingRequestPath(input: { sessionId: string; requestId: string }): string {
-  return join(relayPendingDir(), input.sessionId, `${input.requestId}.json`);
-}
-
-export function decisionPath(input: { sessionId: string; requestId: string }): string {
-  return join(relayDecisionsDir(), input.sessionId, `${input.requestId}.json`);
-}
-
-export function tmuxNameFor(input: { sessionId: string; prefix?: string }): string {
-  const prefix = input.prefix ?? loadRelayConfig().sessionPrefix;
-  return `${prefix}${input.sessionId}`;
-}
-
-export function newSessionId(): string {
-  return crypto.randomUUID();
-}
-
-export function readEntry(input: { sessionId: string }): RelayRegistryEntry | null {
-  const path = sessionEntryPath(input);
-  if (!existsSync(path)) return null;
-  return RelayRegistryEntrySchema.parse(JSON.parse(readFileSync(path, "utf8")));
-}
-
-export function writeEntry(input: { entry: RelayRegistryEntry }): void {
-  mkdirSync(relaySessionsDir(), { recursive: true });
-  writeFileAtomic(sessionEntryPath({ sessionId: input.entry.sessionId }), JSON.stringify(input.entry, null, 2) + "\n");
-}
-
-export function deleteEntry(input: { sessionId: string }): void {
-  rmSync(sessionEntryPath(input), { force: true });
-}
-
-export async function withSessionLock<T>(input: {
-  sessionId: string;
-  fn: () => Promise<T> | T;
-}): Promise<T> {
-  mkdirSync(relayLocksDir(), { recursive: true });
-  return withLock(sessionLockPath({ sessionId: input.sessionId }), input.fn);
-}
-
-export function listEntries(): RelayRegistryEntry[] {
-  const dir = relaySessionsDir();
-  if (!existsSync(dir)) return [];
-  const out: RelayRegistryEntry[] = [];
-  for (const name of readdirSync(dir)) {
-    if (!name.endsWith(".json")) continue;
-    const path = join(dir, name);
-    try {
-      out.push(RelayRegistryEntrySchema.parse(JSON.parse(readFileSync(path, "utf8"))));
-    } catch {
-      // skip corrupt; gc can reap
-    }
-  }
-  return out;
-}
-
-export function createEntry(input: {
-  sessionId: string;
-  worker: RelayWorker;
-  permissionMode: ClaudePermissionMode;
-  cwd: string;
-  now?: number;
-}): RelayRegistryEntry {
-  const now = input.now ?? Date.now();
-  const entry = RelayRegistryEntrySchema.parse({
-    sessionId: input.sessionId,
-    tmuxName: tmuxNameFor({ sessionId: input.sessionId }),
-    worker: input.worker,
-    permissionMode: input.permissionMode,
-    cwd: input.cwd,
-    state: "idle",
-    createdAt: now,
-    lastActiveAt: now,
-  });
-  writeEntry({ entry });
-  return entry;
-}
-
-export function touchEntry(input: {
-  sessionId: string;
-  state?: RelaySessionState;
-  permissionMode?: ClaudePermissionMode;
-  pendingRequestId?: string | null;
-  now?: number;
-}): RelayRegistryEntry {
-  const prev = readEntry({ sessionId: input.sessionId });
-  if (prev == null) throw new Error(`relay session not found: ${input.sessionId}`);
-  const next = RelayRegistryEntrySchema.parse({
-    ...prev,
-    state: input.state ?? prev.state,
-    permissionMode: input.permissionMode ?? prev.permissionMode,
-    lastActiveAt: input.now ?? Date.now(),
-    pendingRequestId: input.pendingRequestId === null
-      ? undefined
-      : (input.pendingRequestId ?? prev.pendingRequestId),
-  });
-  writeEntry({ entry: next });
-  return next;
-}
-
-/** True when a registry entry exists for this relay session id. */
-export function registryHas(input: { sessionId: string }): boolean {
-  return readEntry(input) != null;
-}
-
-export function entryMtimeMs(input: { sessionId: string }): number | null {
-  const path = sessionEntryPath(input);
-  if (!existsSync(path)) return null;
-  return statSync(path).mtimeMs;
-}

package/src/lib/relay/tmux.ts

@@ -1,109 +0,0 @@
-// Thin tmux wrapper. Exact session names only; never pattern-kill. Injectable
-// for hermetic tests that must not require a real tmux server or workers.
-
-import { z } from "zod";
-
-export type TmuxBackend = {
-  hasSession: (input: { name: string }) => boolean;
-  newSession: (input: { name: string; cwd: string; command: string }) => void;
-  killSession: (input: { name: string }) => void;
-  sendKeys: (input: { name: string; text: string; enter?: boolean }) => void;
-  capturePane: (input: { name: string }) => string;
-  listSessions: () => string[];
-};
-
-function runTmux(args: string[]): { ok: boolean; stdout: string; stderr: string; code: number } {
-  const res = Bun.spawnSync(["tmux", ...args], {
-    stdout: "pipe",
-    stderr: "pipe",
-    env: process.env,
-  });
-  return {
-    ok: res.exitCode === 0,
-    code: res.exitCode ?? 1,
-    stdout: res.stdout.toString(),
-    stderr: res.stderr.toString(),
-  };
-}
-
-export const liveTmux: TmuxBackend = {
-  hasSession: ({ name }) => runTmux(["has-session", "-t", name]).ok,
-  newSession: ({ name, cwd, command }) => {
-    const res = runTmux(["new-session", "-d", "-s", name, "-c", cwd, command]);
-    if (!res.ok) throw new Error(`tmux new-session failed for ${name}: ${res.stderr.trim() || res.stdout.trim()}`);
-  },
-  killSession: ({ name }) => {
-    // Exact name only. Missing session is success for destroy/gc idempotence.
-    runTmux(["kill-session", "-t", name]);
-  },
-  sendKeys: ({ name, text, enter = true }) => {
-    const res = runTmux(["send-keys", "-t", name, "-l", "--", text]);
-    if (!res.ok) throw new Error(`tmux send-keys failed for ${name}: ${res.stderr.trim()}`);
-    if (enter) {
-      const enterRes = runTmux(["send-keys", "-t", name, "Enter"]);
-      if (!enterRes.ok) throw new Error(`tmux send-keys Enter failed for ${name}: ${enterRes.stderr.trim()}`);
-    }
-  },
-  capturePane: ({ name }) => {
-    const res = runTmux(["capture-pane", "-p", "-t", name, "-S", "-200"]);
-    if (!res.ok) return "";
-    return res.stdout;
-  },
-  listSessions: () => {
-    const res = runTmux(["list-sessions", "-F", "#{session_name}"]);
-    if (!res.ok) return [];
-    return res.stdout.split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
-  },
-};
-
-let backend: TmuxBackend = liveTmux;
-
-export function getTmux(): TmuxBackend {
-  return backend;
-}
-
-/** Test-only: replace the tmux backend. */
-export function setTmuxBackend(input: { backend: TmuxBackend }): void {
-  backend = input.backend;
-}
-
-export function resetTmuxBackend(): void {
-  backend = liveTmux;
-}
-
-const MemorySessionSchema = z.object({
-  name: z.string(),
-  cwd: z.string(),
-  command: stringOrEmpty(),
-  keys: z.array(z.string()).default([]),
-  pane: z.string().default(""),
-});
-
-function stringOrEmpty() {
-  return z.string();
-}
-
-/** In-memory tmux for hermetic tests. */
-export function createMemoryTmux(): TmuxBackend & { sessions: Map<string, z.infer<typeof MemorySessionSchema>> } {
-  const sessions = new Map<string, z.infer<typeof MemorySessionSchema>>();
-  const api: TmuxBackend & { sessions: typeof sessions } = {
-    sessions,
-    hasSession: ({ name }) => sessions.has(name),
-    newSession: ({ name, cwd, command }) => {
-      if (sessions.has(name)) throw new Error(`tmux session already exists: ${name}`);
-      sessions.set(name, MemorySessionSchema.parse({ name, cwd, command, keys: [], pane: "" }));
-    },
-    killSession: ({ name }) => {
-      sessions.delete(name);
-    },
-    sendKeys: ({ name, text, enter = true }) => {
-      const s = sessions.get(name);
-      if (!s) throw new Error(`no tmux session: ${name}`);
-      s.keys.push(enter ? `${text}\n` : text);
-      s.pane += enter ? `${text}\n` : text;
-    },
-    capturePane: ({ name }) => sessions.get(name)?.pane ?? "",
-    listSessions: () => [...sessions.keys()],
-  };
-  return api;
-}

package/src/lib/relay/turn.ts

@@ -1,137 +0,0 @@
-// relay turn: ensure session, send prompt, wait until turn-done OR permission-needed.
-
-import { delay } from "es-toolkit";
-import { loadRelayConfig } from "./config.ts";
-import {
-  clearPendingRequest,
-  clearTurnDoneMarker,
-  listPendingRequests,
-  readTurnDoneMarker,
-} from "./markers.ts";
-import { permissionPingsEnabled, type ClaudePermissionMode } from "./modes.ts";
-import { formatRelayStdout, type RelayStdout } from "./protocol.ts";
-import { readEntry, touchEntry, withSessionLock } from "./registry.ts";
-import { getTmux } from "./tmux.ts";
-import { ensureSession, sendPrompt } from "./worker.ts";
-import type { RelayWorker } from "./config.ts";
-
-const POLL_MS = 50;
-
-export type TurnParams = {
-  sessionId?: string;
-  worker?: RelayWorker;
-  permissionMode?: ClaudePermissionMode;
-  cwd: string;
-  prompt?: string;
-  /** When true, do not send a prompt; only wait for the next marker. */
-  waitOnly?: boolean;
-  timeoutMs?: number;
-  now?: () => number;
-  sleep?: (ms: number) => Promise<void>;
-};
-
-export type TurnResult = {
-  exitCode: number;
-  stdout: string;
-  payload: RelayStdout;
-  entrySessionId: string;
-};
-
-export async function runTurn(input: TurnParams): Promise<TurnResult> {
-  const cfg = loadRelayConfig();
-  const sleep = input.sleep ?? delay;
-  const now = input.now ?? Date.now;
-  const timeoutMs = input.timeoutMs ?? cfg.turnTimeoutMs;
-
-  const entry = await ensureSession({
-    sessionId: input.sessionId,
-    worker: input.worker,
-    permissionMode: input.permissionMode,
-    cwd: input.cwd,
-    now: now(),
-  });
-
-  if (!input.waitOnly) {
-    const prompt = input.prompt ?? "";
-    if (prompt.trim() === "") throw new Error("relay turn requires a prompt (argv or stdin)");
-    await sendPrompt({ sessionId: entry.sessionId, prompt });
-  } else {
-    await withSessionLock({
-      sessionId: entry.sessionId,
-      fn: () => touchEntry({ sessionId: entry.sessionId, state: "running", now: now() }),
-    });
-  }
-
-  const deadline = now() + timeoutMs;
-  while (now() < deadline) {
-    const pending = listPendingRequests({ sessionId: entry.sessionId });
-    const live = readEntry({ sessionId: entry.sessionId });
-    const mode = live?.permissionMode ?? entry.permissionMode;
-    if (pending.length > 0 && permissionPingsEnabled({ mode })) {
-      const req = pending[0]!;
-      await withSessionLock({
-        sessionId: entry.sessionId,
-        fn: () => touchEntry({
-          sessionId: entry.sessionId,
-          state: "permission-needed",
-          pendingRequestId: req.requestId,
-          now: now(),
-        }),
-      });
-      const payload: RelayStdout = {
-        kind: "permission-needed",
-        sessionId: entry.sessionId,
-        permissionMode: mode,
-        requestId: req.requestId,
-        summary: req.summary,
-        detail: req.detail,
-      };
-      return {
-        exitCode: 0,
-        stdout: formatRelayStdout({ payload }),
-        payload,
-        entrySessionId: entry.sessionId,
-      };
-    }
-    // Under bypassPermissions, auto-clear any stray pending (should not fire).
-    if (pending.length > 0 && !permissionPingsEnabled({ mode })) {
-      for (const req of pending) {
-        clearPendingRequest({ sessionId: entry.sessionId, requestId: req.requestId });
-      }
-    }
-
-    const done = readTurnDoneMarker({ sessionId: entry.sessionId });
-    if (done != null) {
-      const text = getTmux().capturePane({ name: entry.tmuxName });
-      clearTurnDoneMarker({ sessionId: entry.sessionId });
-      await withSessionLock({
-        sessionId: entry.sessionId,
-        fn: () => touchEntry({
-          sessionId: entry.sessionId,
-          state: "idle",
-          pendingRequestId: null,
-          now: now(),
-        }),
-      });
-      const payload: RelayStdout = {
-        kind: "turn-done",
-        sessionId: entry.sessionId,
-        permissionMode: mode,
-        text,
-      };
-      return {
-        exitCode: 0,
-        stdout: formatRelayStdout({ payload }),
-        payload,
-        entrySessionId: entry.sessionId,
-      };
-    }
-
-    await sleep(POLL_MS);
-  }
-
-  throw new Error(`relay turn timed out after ${timeoutMs}ms (session ${entry.sessionId})`);
-}
-
-// re-export for callers that type worker from turn
-export type { RelayWorker };