wogiflow 2.26.1 → 2.26.2

package/lib/wogi-claude

@@ -41,27 +41,68 @@ set -u
 WOGI_CLAUDE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WOGI_EXPECT_SCRIPT="$WOGI_CLAUDE_DIR/wogi-claude-expect.exp"
 
-# Detect whether to use the expect wrapper (v2.22.4: OPT-IN only).
-# Four conditions must all hold:
-#   1. WOGI_USE_EXPECT=1 is explicitly set (opt-in)
-#   2. WOGI_NO_EXPECT is NOT set (legacy escape hatch still honored)
-#   3. `expect` is on PATH and the wogi-claude-expect.exp script exists
-#   4. The args include --dangerously-load-development-channels (the only
-#      flag that triggers the dialog we want to auto-dismiss)
+# Detect whether to use the expect wrapper for auto-dismissing the
+# --dangerously-load-development-channels modal.
 #
-# 2.22.3 tried opt-out by default; in practice, expect's text match can miss
-# Ink's ANSI-fragmented output, which deadlocks the dialog (user keystrokes
-# get held in expect's buffer instead of reaching claude). 2.22.4 flips to
-# opt-in so the default UX is predictable.
+# Precedence (highest to lowest):
+#   1. WOGI_NO_EXPECT=1 → always OFF (kill switch)
+#   2. Workspace worker mode → ON automatically (headless, cannot Enter by hand)
+#   3. WOGI_USE_EXPECT=1 → ON (explicit opt-in for interactive users)
+#   4. Default → OFF (interactive users get the native Claude Code dialog)
+#
+# Worker auto-enable (v2.26.2): WOGI_WORKSPACE_ROOT + WOGI_REPO_NAME (worker
+# side) are set by `flow workspace start` before spawning this wrapper, so
+# detection here is reliable. Interactive users never set these vars, so their
+# default remains opt-in — the v2.22.3 regression (expect's text match miss on
+# Ink ANSI output) is bounded to users who explicitly asked for expect.
+#
+# The rewritten wogi-claude-expect.exp (v2.26.2) replaces the old brittle
+# per-chunk text match with: rolling buffer + ANSI strip + bounded elapsed-time
+# window. Misses fall back to the same failure mode as running claude without
+# the wrapper (dialog stays up until someone presses Enter) — no unsafe blind
+# keystrokes injected into server-mode Claude.
+
+__wogi_is_worker=0
+if [ -n "${WOGI_WORKSPACE_ROOT:-}" ] && [ -n "${WOGI_REPO_NAME:-}" ] && \
+   [ "${WOGI_REPO_NAME}" != "manager" ]; then
+  __wogi_is_worker=1
+fi
+
+__wogi_wants_expect=0
+if [ -z "${WOGI_NO_EXPECT:-}" ]; then
+  if [ "$__wogi_is_worker" -eq 1 ] || [ "${WOGI_USE_EXPECT:-}" = "1" ]; then
+    __wogi_wants_expect=1
+  fi
+fi
+
 __wogi_use_expect=0
-if [ "${WOGI_USE_EXPECT:-}" = "1" ] && [ -z "${WOGI_NO_EXPECT:-}" ] && \
-   command -v expect >/dev/null 2>&1 && [ -x "$WOGI_EXPECT_SCRIPT" ]; then
+if [ "$__wogi_wants_expect" -eq 1 ]; then
+  # The dialog only fires when --dangerously-load-development-channels is in
+  # argv; skip the expect dance otherwise.
+  __wogi_has_flag=0
   for arg in "$@"; do
     if [ "$arg" = "--dangerously-load-development-channels" ]; then
-      __wogi_use_expect=1
+      __wogi_has_flag=1
       break
     fi
   done
+  if [ "$__wogi_has_flag" -eq 1 ]; then
+    if command -v expect >/dev/null 2>&1 && [ -x "$WOGI_EXPECT_SCRIPT" ]; then
+      __wogi_use_expect=1
+      if [ "$__wogi_is_worker" -eq 1 ]; then
+        echo "[wogi-claude] worker mode detected — auto-enabled expect-based dialog dismissal" >&2
+      fi
+    elif [ "$__wogi_is_worker" -eq 1 ]; then
+      # Headless worker + missing expect = the dialog WILL deadlock this
+      # worker on restart. Warn loudly so the operator can install expect,
+      # but still start claude (better than failing the worker outright).
+      echo "[wogi-claude] WARNING: worker mode detected (repo '${WOGI_REPO_NAME}') but 'expect' is not installed." >&2
+      echo "[wogi-claude] The --dangerously-load-development-channels dialog will block this worker on the next restart." >&2
+      echo "[wogi-claude] Install expect to enable headless auto-dismiss:" >&2
+      echo "[wogi-claude]   macOS:           brew install expect" >&2
+      echo "[wogi-claude]   Debian/Ubuntu:   apt install expect" >&2
+    fi
+  fi
 fi
 
 # run_claude — invoke claude, routing through expect when we can auto-dismiss

package/lib/wogi-claude-expect.exp

@@ -8,21 +8,38 @@
 #   - The CLI is launched with --dangerously-load-development-channels
 #
 # There's no Claude Code setting that persists an "accepted" state
-# (verified via decompiled source 2026-04-17). So we intercept the dialog
-# at the wrapper level: spawn claude in an expect-managed PTY, watch for
-# the dialog title text, send Enter to accept the already-highlighted
-# "I am using this for local development" option, then hand off control
-# to the user via `interact`.
+# (verified via decompiled source 2026-04-17) and no --accept-dev-channels
+# flag exists in `claude --help`.
+#
+# v2.22.x implementation (DEPRECATED): `-re "Loading development channels"`
+# matched per-chunk output. Ink paints the dialog in fragmented writes
+# interleaved with ANSI color codes, so the literal phrase rarely arrived
+# in a single buffer and the regex missed. Workers deadlocked.
+#
+# v2.26.2 rewrite (this file) solves it with three properties:
+#   1. Rolling buffer — accumulate every chunk into one growing string,
+#      match against the whole buffer on each iteration, not per-chunk.
+#   2. ANSI strip — remove CSI / OSC escape sequences before matching,
+#      so the color-interleaved Ink output normalizes to plain text.
+#   3. Bounded elapsed-time window — stop accumulating after
+#      WOGI_EXPECT_TIMEOUT seconds (default 30). Without this, a very
+#      chatty claude startup with no dialog would keep exp_continue'ing
+#      forever until the per-iteration timeout.
+#
+# NO BLIND FALLBACK. If the window elapses without matching, we hand off
+# to interact unchanged. Sending a speculative \r to claude in server:
+# mode mid-startup is not safe (server-mode input handling is not a
+# standard REPL and could corrupt the handshake). Miss = same failure
+# mode as running claude without this wrapper. Worker retries via
+# wogi-claude's restart loop.
 #
 # Usage (invoked from lib/wogi-claude):
 #   expect wogi-claude-expect.exp /absolute/path/to/claude [args...]
 #
 # Disable at runtime: set WOGI_NO_EXPECT=1. The wrapper then execs claude
-# directly and the user sees the dialog as before (manual single-click).
+# directly and the user sees the dialog as before.
 
 set timeout 30
-
-# Allow WOGI_EXPECT_TIMEOUT override (rarely needed)
 if {[info exists env(WOGI_EXPECT_TIMEOUT)]} {
     set timeout $env(WOGI_EXPECT_TIMEOUT)
 }
@@ -40,34 +57,84 @@ set claude_bin [lindex $argv 0]
 set claude_args [lrange $argv 1 end]
 
 # Spawn claude in a pseudo-TTY so its Ink UI renders normally.
-# eval is needed because claude_args is a list and spawn expects a
-# flattened command line.
-eval spawn $claude_bin $claude_args
+# Use {*} list-splice rather than `eval spawn` — `eval` reparses its
+# arguments as Tcl script, which lets an argument containing bracket syntax
+# (e.g. `[exec attacker-cmd]`) escape to command execution. The splice form
+# expands the list without reparsing.
+spawn $claude_bin {*}$claude_args
 
-# Watch for the DevChannels dialog title, then press Enter to accept
-# the default-highlighted "I am using this for local development" option.
+# --- Dialog dismissal watch ---
 #
-# On timeout or EOF: fall through to `interact`. If the dialog appears
-# AFTER our timeout window, the user can still answer it manually —
-# same failure mode as running claude directly.
+# dialog_buf accumulates raw stdout chunks. After each chunk we strip ANSI
+# escapes into `plain` and substring-search for the dialog title text. If
+# found, we send Enter (accepts the default-highlighted "I am using this
+# for local development" option). Otherwise we exp_continue until either
+# the total elapsed time exceeds $timeout or EOF.
+set dialog_buf ""
+set start_ts [clock seconds]
+
 expect {
-    -re "Loading development channels" {
-        # Let Ink finish rendering the dialog before sending Enter.
-        # Without this, the select-input component may not have bound
-        # its keyboard listener yet and the keystroke is dropped.
-        after 250
-        send "\r"
+    -re "(.+)" {
+        append dialog_buf $expect_out(1,string)
+
+        # Strip ANSI CSI sequences (colors, cursor moves): ESC [ ... letter
+        regsub -all {\x1b\[[0-9;?]*[a-zA-Z]} $dialog_buf "" plain
+        # Strip 8-bit CSI form (0x9B byte instead of ESC [), same terminator
+        regsub -all {\x9b[0-9;?]*[a-zA-Z]} $plain "" plain
+        # Strip OSC sequences (titles, hyperlinks): ESC ] ... BEL
+        regsub -all {\x1b\][^\x07]*\x07} $plain "" plain
+        # Strip ISO 2022 charset-selection sequences: ESC ( B, ESC ) 0, etc.
+        regsub -all {\x1b[\(\)\*\+\-\.\/][\x20-\x7e]} $plain "" plain
+        # Strip bare ESC that didn't belong to a recognized sequence
+        regsub -all {\x1b} $plain "" plain
+
+        if {[string first "Loading development channels" $plain] >= 0} {
+            # Let Ink finish rendering the select-input component before
+            # sending Enter — without this the keystroke can land before
+            # the keyboard listener binds and gets dropped.
+            after 250
+            send "\r"
+            # Fall through to interact — dialog is dismissed, user drives
+            # from here.
+        } else {
+            # Bound total accumulation by elapsed wall-clock time so we
+            # don't exp_continue forever on a chatty startup with no
+            # dialog.
+            set elapsed [expr {[clock seconds] - $start_ts}]
+            if {$elapsed < $timeout} {
+                # Cap buffer at 64KB to prevent runaway memory on a very
+                # long startup that never shows the dialog. Keep the tail
+                # half so any late-arriving title text still matches.
+                if {[string length $dialog_buf] > 65536} {
+                    set dialog_buf [string range $dialog_buf 32768 end]
+                }
+                exp_continue
+            }
+            # Elapsed >= timeout: fall through to interact without
+            # dismissing. Same failure mode as running claude without
+            # this wrapper.
+        }
     }
     timeout { }
     eof { exit }
 }
 
-# Hand off: user's keystrokes flow to claude, claude's output flows
-# to the user's terminal. interact blocks until claude exits.
-interact
+# Hand off: user's keystrokes flow to claude, claude's output flows to
+# the user's terminal. interact blocks until claude exits.
+#
+# Test hook: set WOGI_EXPECT_NO_INTERACT=1 to substitute `expect eof`.
+# `interact` requires a real TTY on stdin; under node:test / CI with
+# pipe-backed stdin it closes the PTY before our sent \r flushes to the
+# child. The test harness sets this env var so the behavioral tests (dialog
+# dismissal, ANSI fragmentation) can actually observe the child receiving
+# the keystroke. Production callers MUST NOT set this — users need
+# interact to drive claude after the dialog dismisses.
+if {[info exists env(WOGI_EXPECT_NO_INTERACT)] && $env(WOGI_EXPECT_NO_INTERACT) eq "1"} {
+    expect eof
+} else {
+    interact
+}
 
-# After claude exits, let the bash wrapper decide whether to restart.
-# Pass through claude's exit status (expect sets it in $expect_out(-code)
-# after `interact`, but a plain exit is sufficient since the wrapper
-# only cares about the restart flag file, not exit code).
+# Pass claude's exit status — wrapper cares about the restart flag file,
+# not exit code, so a plain exit suffices.
 exit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wogiflow",
-  "version": "2.26.1",
+  "version": "2.26.2",
   "description": "AI-powered development workflow management system with multi-model support",
   "main": "lib/index.js",
   "bin": {