triflux 9.8.1 → 9.8.3

package/bin/triflux.mjs

@@ -28,6 +28,7 @@ import {
   extractManagedHookFilename, getManagedRegistryHooks, ensureHooksInSettings,
   ensureCodexHubServerConfig,
 } from "../scripts/setup.mjs";
+import { cleanupTmpFiles } from "../scripts/tmp-cleanup.mjs";
 
 const PKG_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const CLAUDE_DIR = join(homedir(), ".claude");
@@ -3531,6 +3532,10 @@ async function main() {
   const cmd = NORMALIZED_ARGS[0] || "help";
   const cmdArgs = NORMALIZED_ARGS.slice(1);
 
+  cleanupTmpFiles({
+    protectPaths: [process.env.HOME, process.env.USERPROFILE],
+  }).catch(() => {});
+
   switch (cmd) {
     case "setup":
       cmdSetup({ dryRun: cmdArgs.includes("--dry-run") });

package/hooks/safety-guard.mjs

@@ -12,7 +12,7 @@ import { readFileSync } from "node:fs";
 
 // ── 차단 규칙 ──────────────────────────────────────────────
 const BLOCK_RULES = [
-  { pattern: /\brm\s+(-[^\s]*)?-rf?\s+[/~](?!\S*node_modules)/i, reason: "루트/홈 디렉토리 rm -rf 차단" },
+  { pattern: /\brm\s+(-[^\s]*)?-rf?\s+[/~](?!tmp\b)(?!\S*node_modules)/i, reason: "루트/홈 디렉토리 rm -rf 차단" },
   { pattern: /\brm\s+(-[^\s]*)?-rf?\s+\.\s*$/i, reason: "현재 디렉토리 rm -rf . 차단" },
   { pattern: /\bgit\s+push\s+.*--force\s+.*\b(main|master)\b/i, reason: "main/master force push 차단" },
   { pattern: /\bgit\s+push\s+--force\s*$/i, reason: "대상 미지정 force push 차단" },

package/hub/assign-callbacks.mjs

@@ -1,15 +1,12 @@
 // hub/assign-callbacks.mjs — assign job 상태 변경용 Named Pipe/Unix socket 브로드캐스터
 
-import net from 'node:net';
-import { existsSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
-
-export function getAssignCallbackPipePath(sessionId = process.pid) {
-  if (process.platform === 'win32') {
-    return `\\\\.\\pipe\\triflux-assign-callback-${sessionId}`;
-  }
-  return join('/tmp', `triflux-assign-callback-${sessionId}.sock`);
-}
+import net from 'node:net';
+import { existsSync, unlinkSync } from 'node:fs';
+import { IS_WINDOWS, pipePath } from './platform.mjs';
+
+export function getAssignCallbackPipePath(sessionId = process.pid) {
+  return pipePath('triflux-assign-callback', sessionId);
+}
 
 function buildAssignCallbackEvent(event = {}, row = null) {
   const source = row || event || {};
@@ -89,9 +86,9 @@ export function createAssignCallbackServer({ store = null, sessionId = process.p
     },
     async start() {
       if (server) return { path: pipePath };
-      if (process.platform !== 'win32' && existsSync(pipePath)) {
-        try { unlinkSync(pipePath); } catch {}
-      }
+      if (!IS_WINDOWS && existsSync(pipePath)) {
+        try { unlinkSync(pipePath); } catch {}
+      }
 
       server = net.createServer((socket) => {
         clients.add(socket);
@@ -127,9 +124,9 @@ export function createAssignCallbackServer({ store = null, sessionId = process.p
       }
       await new Promise((resolve) => server.close(resolve));
       server = null;
-      if (process.platform !== 'win32' && existsSync(pipePath)) {
-        try { unlinkSync(pipePath); } catch {}
-      }
+      if (!IS_WINDOWS && existsSync(pipePath)) {
+        try { unlinkSync(pipePath); } catch {}
+      }
     },
     broadcast,
   };

package/hub/hitl.mjs

@@ -109,8 +109,7 @@ export function createHitlManager(store, router = null) {
       const expired = pending.filter(hr => hr.deadline_ms <= now);
       if (!expired.length) return 0;
 
-      // 트랜잭션으로 만료 요청을 일괄 처리해 DB 왕복을 줄인다.
-      const processExpired = store.db.transaction(() => {
+      const expireRequests = () => {
         for (const hr of expired) {
           store.updateHumanRequest(hr.request_id, 'timed_out', null);
           if (hr.default_action === 'timeout_continue') {
@@ -127,7 +126,11 @@ export function createHitlManager(store, router = null) {
           }
         }
         return expired.length;
-      });
+      };
+
+      const processExpired = store.db?.transaction
+        ? store.db.transaction(expireRequests)
+        : expireRequests;
 
       return processExpired();
     },

package/hub/intent.mjs

@@ -3,6 +3,7 @@
 
 import { execFileSync } from 'node:child_process';
 import crypto from 'node:crypto';
+import { whichCommand } from './platform.mjs';
 
 /** 캐시 엔트리: { category, confidence, ts } */
 const _intentCache = new Map();
@@ -13,13 +14,7 @@ let _codexAvailable = null;
 
 function _isCodexAvailable() {
   if (_codexAvailable !== null) return _codexAvailable;
-  try {
-    const cmd = process.platform === 'win32' ? 'where' : 'which';
-    execFileSync(cmd, ['codex'], { stdio: 'ignore' });
-    _codexAvailable = true;
-  } catch {
-    _codexAvailable = false;
-  }
+  _codexAvailable = Boolean(whichCommand('codex'));
   return _codexAvailable;
 }
 

package/hub/lib/process-utils.mjs

@@ -5,6 +5,7 @@ import { execSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
+import { IS_WINDOWS, killProcess } from "../platform.mjs";
 
 const CLEANUP_SCRIPT_DIR = join(tmpdir(), "tfx-process-utils");
 const SCAN_SCRIPT_PATH = join(CLEANUP_SCRIPT_DIR, "scan-processes.ps1");
@@ -58,7 +59,7 @@ function killWithEscalation(orphanPids, procMap) {
   const aliveBeforeKill = new Set(orphanPids.filter(pid => isPidAlive(pid)));
 
   for (const pid of aliveBeforeKill) {
-    try { process.kill(pid, "SIGTERM"); } catch {}
+    killProcess(pid, { signal: "SIGTERM" });
   }
 
   sleepSyncMs(3000);
@@ -73,7 +74,7 @@ function killWithEscalation(orphanPids, procMap) {
         if (snapshot) {
           try {
             const current = execSync(
-              process.platform === "win32"
+              IS_WINDOWS
                 ? `powershell -NoProfile -WindowStyle Hidden -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}' -ErrorAction SilentlyContinue).ParentProcessId"`
                 : `ps -o ppid= -p ${pid}`,
               { encoding: "utf8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"], windowsHide: true },
@@ -88,7 +89,7 @@ function killWithEscalation(orphanPids, procMap) {
           }
         }
       }
-      try { process.kill(pid, "SIGKILL"); } catch {}
+      killProcess(pid, { signal: "SIGKILL", force: true });
     }
     if (!isPidAlive(pid)) killed++;
   }
@@ -206,7 +207,7 @@ const KILLABLE_NAMES = new Set([
  * @returns {{ killed: number, remaining: number }}
  */
 export function cleanupOrphanNodeProcesses() {
-  if (process.platform !== "win32") return cleanupOrphansUnix();
+  if (!IS_WINDOWS) return cleanupOrphansUnix();
 
   ensureHelperScripts();
 

package/hub/pipe.mjs

@@ -3,7 +3,6 @@
 
 import net from 'node:net';
 import { existsSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import {
   teamInfo,
@@ -18,16 +17,14 @@ import {
   listPipelineStates,
   readPipelineState,
 } from './pipeline/state.mjs';
+import { IS_WINDOWS, pipePath } from './platform.mjs';
 import { safeJsonParse } from './workers/worker-utils.mjs';
 
 const DEFAULT_HEARTBEAT_TTL_MS = 60000;
 
 /** 플랫폼별 pipe 경로 계산 */
 export function getPipePath(sessionId = process.pid) {
-  if (process.platform === 'win32') {
-    return `\\\\.\\pipe\\triflux-${sessionId}`;
-  }
-  return join('/tmp', `triflux-${sessionId}.sock`);
+  return pipePath('triflux', sessionId);
 }
 
 function normalizeTopics(topics) {
@@ -517,7 +514,7 @@ export function createPipeServer({
     async start() {
       if (server) return { path: pipePath };
 
-      if (process.platform !== 'win32' && existsSync(pipePath)) {
+      if (!IS_WINDOWS && existsSync(pipePath)) {
         try { unlinkSync(pipePath); } catch {}
       }
 
@@ -554,7 +551,7 @@ export function createPipeServer({
         await new Promise((resolve) => current.close(resolve));
       }
 
-      if (process.platform !== 'win32' && existsSync(pipePath)) {
+      if (!IS_WINDOWS && existsSync(pipePath)) {
         try { unlinkSync(pipePath); } catch {}
       }
     },

package/hub/platform.mjs

@@ -0,0 +1,186 @@
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync, execSync } from 'node:child_process';
+
+export const IS_WINDOWS = process.platform === 'win32';
+export const IS_MAC = process.platform === 'darwin';
+export const IS_LINUX = process.platform === 'linux';
+export const TEMP_DIR = IS_WINDOWS ? os.tmpdir() : '/tmp';
+export const PATH_SEP = path.sep;
+
+function getPathApi(platform) {
+  return platform === 'win32' ? path.win32 : path.posix;
+}
+
+function coercePathInput(value, platform) {
+  const text = String(value ?? '');
+  if (platform === 'win32') {
+    return text.replaceAll('/', '\\');
+  }
+  return text.replaceAll('\\', '/');
+}
+
+function sanitizePipeSegment(value) {
+  return String(value ?? '')
+    .trim()
+    .replace(/[<>:"/\\|?*\u0000-\u001f]+/gu, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '');
+}
+
+/**
+ * 경로를 플랫폼에 맞게 정규화합니다.
+ * Windows 환경에서는 역슬래시(\)를 슬래시(/)로 변환하여 반환합니다.
+ * 
+ * @param {string} value - 정규화할 경로 문자열
+ * @param {object} [options] - 옵션
+ * @param {string} [options.platform] - 대상 플랫폼 (기본값: process.platform)
+ * @returns {string} 정규화된 경로
+ */
+export function normalizePath(value, options = {}) {
+  const platform = options.platform || process.platform;
+  const pathApi = getPathApi(platform);
+  const normalized = pathApi.normalize(coercePathInput(value, platform));
+
+  if (platform === 'win32') {
+    return normalized.replaceAll('\\', '/');
+  }
+  return normalized;
+}
+
+/**
+ * 시스템에서 실행 가능한 명령의 절대 경로를 찾습니다.
+ * Windows에서는 'where', Unix 계열에서는 'which' 명령을 사용합니다.
+ * 
+ * @param {string} name - 찾을 명령어 이름
+ * @param {object} [options] - 옵션
+ * @param {string} [options.platform] - 대상 플랫폼
+ * @param {number} [options.timeout=5000] - 검색 타임아웃 (ms)
+ * @param {object} [options.env] - 환경 변수
+ * @param {string} [options.cwd] - 작업 디렉토리
+ * @returns {string|null} 명령어의 절대 경로 또는 찾지 못한 경우 null
+ */
+export function whichCommand(name, options = {}) {
+  const commandName = String(name ?? '').trim();
+  if (!commandName) return null;
+
+  const platform = options.platform || process.platform;
+  const lookupCommand = platform === 'win32' ? 'where' : 'which';
+
+  try {
+    const output = execFileSync(lookupCommand, [commandName], {
+      encoding: 'utf8',
+      timeout: options.timeout ?? 5000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      windowsHide: true,
+      env: options.env || process.env,
+      cwd: options.cwd,
+    });
+
+    const match = String(output)
+      .split(/\r?\n/u)
+      .map((line) => line.trim())
+      .find(Boolean);
+
+    return match || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 프로세스를 종료합니다.
+ * Windows에서는 트리 구조 종료(/T) 및 강제 종료(/F)를 지원합니다.
+ * 
+ * @param {number|string} pid - 종료할 프로세스 ID
+ * @param {object} [options] - 옵션
+ * @param {string} [options.platform] - 대상 플랫폼
+ * @param {string} [options.signal='SIGTERM'] - 전송할 신호
+ * @param {boolean} [options.tree=false] - 자식 프로세스까지 포함하여 종료할지 여부
+ * @param {boolean} [options.force=false] - 강제 종료 여부
+ * @param {number} [options.timeout=5000] - 타임아웃 (ms)
+ * @returns {boolean} 종료 성공 여부
+ */
+export function killProcess(pid, options = {}) {
+  const numericPid = Number.parseInt(String(pid), 10);
+  if (!Number.isInteger(numericPid) || numericPid <= 0) return false;
+
+  const platform = options.platform || process.platform;
+  const signal = options.signal || 'SIGTERM';
+  const tree = options.tree === true;
+  const force = options.force === true || signal === 'SIGKILL';
+
+  try {
+    if (platform === 'win32' && (tree || force)) {
+      const command = [
+        'taskkill',
+        '/PID',
+        String(numericPid),
+        tree ? '/T' : '',
+        force ? '/F' : '',
+      ]
+        .filter(Boolean)
+        .join(' ');
+      execSync(command, {
+        stdio: 'ignore',
+        timeout: options.timeout ?? 5000,
+        windowsHide: true,
+      });
+      return true;
+    }
+
+    process.kill(numericPid, signal);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * 플랫폼별 IPC 파이프 또는 소켓 경로를 생성합니다.
+ * Windows에서는 네임드 파이프 경로를, Unix 계열에서는 도메인 소켓 파일 경로를 반환합니다.
+ * 
+ * @param {string} name - 파이프/소켓 기본 이름
+ * @param {number|string} [pid=process.pid] - 프로세스 ID (식별자 추가용)
+ * @param {object} [options] - 옵션
+ * @param {string} [options.platform] - 대상 플랫폼
+ * @param {string} [options.tempDir] - 임시 디렉토리 경로 (Unix 전용)
+ * @returns {string} 플랫폼별 파이프/소켓 경로
+ */
+export function pipePath(name, pid = process.pid, options = {}) {
+  const platform = options.platform || process.platform;
+  const safeName = sanitizePipeSegment(name) || 'triflux';
+  const suffix = pid == null || pid === '' ? safeName : `${safeName}-${pid}`;
+
+  if (platform === 'win32') {
+    return `\\\\.\\pipe\\${suffix}`;
+  }
+
+  const baseDir = options.tempDir || TEMP_DIR;
+  return path.posix.join(baseDir, `${suffix}.sock`);
+}
+
+/**
+ * 특정 경로가 대상 디렉토리 내부에 포함되는지 확인합니다.
+ * 대소문자 구분 및 상대 경로 처리를 플랫폼 규격에 맞게 수행합니다.
+ * 
+ * @param {string} resolvedPath - 검사할 절대 경로
+ * @param {string} dir - 기준이 되는 대상 디렉토리 경로
+ * @param {object} [options] - 옵션
+ * @param {string} [options.platform] - 대상 플랫폼
+ * @returns {boolean} 포함 여부
+ */
+export function isPathWithin(resolvedPath, dir, options = {}) {
+  if (!resolvedPath || !dir) return false;
+
+  const platform = options.platform || process.platform;
+  const pathApi = getPathApi(platform);
+  const left = pathApi.resolve(coercePathInput(resolvedPath, platform));
+  const right = pathApi.resolve(coercePathInput(dir, platform));
+
+  const normalizedLeft = platform === 'win32' ? left.toLowerCase() : left;
+  const normalizedRight = platform === 'win32' ? right.toLowerCase() : right;
+  const relative = pathApi.relative(normalizedRight, normalizedLeft);
+
+  return relative === '' || (!relative.startsWith('..') && !pathApi.isAbsolute(relative));
+}