Claude Code Linear Agent

import { spawn, ChildProcessWithoutNullStreams } from 'child_process';
import type { LinearClient } from './linear-client.js';
import type { ExecutionResult } from './types.js';

const PR_URL_REGEX = /https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+/g;

// Only these env vars are passed to the Claude child process.
// This prevents leakage of LINEAR_OAUTH_ACCESS_TOKEN,
// LINEAR_CLIENT_SECRET, LINEAR_WEBHOOK_SECRET, etc.
const ALLOWED_CHILD_ENV_VARS = [
  'GITHUB_TOKEN',
  'LINEAR_API_KEY',
  'HOME',
  'PATH',
  'NODE_ENV',
  'LANG',
  'TERM',
];

export class ClaudeExecutor {
  private claudePath: string;
  private defaultWorkspaceDir: string;
  private maxExecutionTime: number;

  constructor() {
    this.claudePath = process.env.CLAUDE_PATH
      || '/home/claude-agent/.local/bin/claude';
    this.defaultWorkspaceDir = process.env.WORKSPACE_DIR
      || '/home/claude-agent/repos/default';
    this.maxExecutionTime = parseInt(
      process.env.MAX_EXECUTION_TIME || '600000', 10
    );
  }

  private buildChildEnv(): Record<string, string> {
    const env: Record<string, string> = {};
    for (const key of ALLOWED_CHILD_ENV_VARS) {
      if (process.env[key]) env[key] = process.env[key]!;
    }
    env.HOME = process.env.HOME || '/home/claude-agent';
    env.PATH = [
      '/home/claude-agent/.local/bin',
      '/home/claude-agent/.npm-global/bin',
      '/usr/local/bin',
      '/usr/bin',
      '/bin',
    ].join(':');
    return env;
  }

  async executeAndReport(
    prompt: string,
    sessionId: string,
    issueIdentifier: string,
    linearClient: LinearClient,
    workspaceDir?: string
  ): Promise<ExecutionResult> {
    const workspace = workspaceDir || this.defaultWorkspaceDir;

    return new Promise((resolve, reject) => {
      let stdout = '';
      let stderr = '';

      // Timeout — kill the process if it runs too long
      const timeoutId = setTimeout(() => {
        claude.kill('SIGTERM');
        linearClient.sendError(sessionId,
          'Session timed out. The task may be too complex.'
        );
        reject(new Error('Execution timeout'));
      }, this.maxExecutionTime);

      // Spawn Claude directly — no shell, no escaping needed.
      // Arguments pass through execvp, eliminating shell injection.
      const claude = spawn(this.claudePath, [
        '-p', prompt,
        '--dangerously-skip-permissions',
        '--output-format', 'json',
      ], {
        cwd: workspace,
        env: this.buildChildEnv(),
        stdio: ['pipe', 'pipe', 'pipe'],
      });

      // CRITICAL: Close stdin immediately. Claude Code hangs
      // indefinitely if stdin stays open — it waits for input
      // that will never come.
      claude.stdin.end();

      claude.stdout.on('data', (data: Buffer) => {
        stdout += data.toString();
      });
      claude.stderr.on('data', (data: Buffer) => {
        stderr += data.toString();
      });

      claude.on('close', async (code) => {
        clearTimeout(timeoutId);

        if (!stdout) {
          const errorMsg = stderr || `Exited with code ${code}`;
          await linearClient.sendError(sessionId, errorMsg);
          return reject(new Error(errorMsg));
        }

        const result = JSON.parse(stdout);
        const responseText =
          result.result || result.response || result.content;
        await linearClient.sendResponse(sessionId, responseText);

        // Detect PR URLs in the response
        const prUrls = responseText.match(PR_URL_REGEX);
        resolve({ responseText, prUrl: prUrls?.[0] });
      });
    });
  }
}