@danypops/pi-lector 0.6.0 → 0.7.0

package/extension/src/index.ts

@@ -27,6 +27,7 @@ import type {
 	WorkspaceMapResult,
 	WorkspaceQueryOutcome,
 } from "@danypops/lector";
+import { DEFAULT_EXTERNAL_SEARCH_MAX_RESULTS } from "@danypops/lector";
 import {
 	type AgentToolResult,
 	createEditToolDefinition,
@@ -83,7 +84,7 @@ import { setNewWorkspaceObserver } from "./lector-client.ts";
 import { createLectorLineEditOperations } from "./line-edit-operations.ts";
 import { formatLineEditCall, formatLineEditResult } from "./line-edit-rendering.ts";
 import { createMutationHistoryOperations } from "./mutation-history-operations.ts";
-import { nearestGitRoot } from "./nearest-workspace-root.ts";
+import { isFilesystemRoot, nearestGitRoot } from "./nearest-workspace-root.ts";
 import { createLectorPackageSourceOperations } from "./package-source-operations.ts";
 import { formatPackageSourceCall, formatPackageSourceResult } from "./package-source-rendering.ts";
 import { createLectorReadOperations } from "./read-operations.ts";
@@ -176,8 +177,16 @@ export default function (pi: ExtensionAPI) {
 		uiContext.ui.setStatus("lector-cache", uiContext.ui.theme.fg(worst, `Lector: ${summary}`));
 	}
 
-	/** Starts (or restarts, on a stale generation) monitoring one workspace root's cache lifecycle -- shared by session_start's own cwd root and every later root a tool call first touches. */
+	/**
+	 * Starts (or restarts, on a stale generation) monitoring one workspace root's cache
+	 * lifecycle -- shared by session_start's own cwd root and every later root a tool call
+	 * first touches. Refuses a bare filesystem root outright: workspaceForPath's own
+	 * intentional fallback for a raw read/write of a file outside any git repo can register
+	 * exactly this as a "new workspace", and auto-populating it would attempt a full
+	 * filesystem-wide symbol-graph scan -- confirmed live as a real, previously-shipped bug.
+	 */
 	function startMonitoringRoot(root: string, ctx: Parameters<Parameters<ExtensionAPI["on"]>[1]>[1]): void {
+		if (isFilesystemRoot(root)) return;
 		if (monitoringRoots.has(root)) return;
 		monitoringRoots.add(root);
 		const thisGeneration = sessionGeneration;
@@ -1550,7 +1559,7 @@ export default function (pi: ExtensionAPI) {
 				maxResults: Type.Optional(Type.Number({ description: "Maximum candidates to return (default 20)" })),
 			}),
 			async execute(_toolCallId, params): Promise<AgentToolResult<ExternalSearchToolDetails>> {
-				const maxResults = params.maxResults ?? 20;
+				const maxResults = params.maxResults ?? DEFAULT_EXTERNAL_SEARCH_MAX_RESULTS;
 				if (params.action === "github_repos") {
 					const result = await externalSearchOperations.githubRepos(params.query, maxResults);
 					return { content: [{ type: "text", text: JSON.stringify(result) }], details: { action: "github_repos", result } };

package/extension/src/nearest-workspace-root.ts

@@ -2,39 +2,60 @@ import { existsSync } from "node:fs";
 import { dirname, join, parse } from "node:path";
 
 /**
- * The nearest enclosing git repository root starting from (and including)
- * a given directory, or undefined if none is found (e.g. /tmp scratch
- * files, dotfiles outside any repo). Callers choose their own fallback --
- * see lector-client.ts's workspaceForPath (falls back to the filesystem
- * root: any absolute path is fair game for read/write/edit, exactly as
- * Pi's built-in tools already allow) vs. workspaceForDirectory (falls back
- * to the directory itself: widening a symbol-search scope all the way to
- * the entire filesystem when a project isn't a git repo would be absurd).
- *
- * This -- not a Pi session's original cwd -- is Lector's real workspace
- * granularity. A session routinely touches many unrelated repos, sibling
- * projects, and scratch paths in one run; pi's built-in read/write/edit
- * tools have never restricted which absolute path can be touched, and
- * Lector must not either. (Real, shipped bug this fixes: read/write/edit
- * hard-locked to whatever directory the session happened to start in,
- * refusing every legitimate path outside it with a "Lector-registered
- * workspace root" error -- discovered live, in a separate session, working
- * against a completely different, unrelated repository.)
+ * The bare filesystem root is never a legitimate discovered project root, even if it happens
+ * to contain a marker file (a stray `git init /`, a leftover `package.json`) -- matches the
+ * same convention already established elsewhere in this house (oculus/survey/rust_scanner.go's
+ * findCrateRoot, oculus/locator/match.go's effectiveParent: reaching "/" during a walk-up means
+ * "not found", never "found here"). Confirmed live: without this, a Lector daemon registered
+ * "/" as a workspace and a background job attempted to symbol-graph the entire filesystem.
+ * `exists` is injectable so a test can simulate "a marker exists at the filesystem root"
+ * without ever touching the real one.
  */
-function walkUpForMarkers(startDirectory: string, markers: readonly string[]): string | undefined {
+function walkUpForMarkers(startDirectory: string, markers: readonly string[], exists: (path: string) => boolean = existsSync): string | undefined {
 	let dir = startDirectory;
 	const fsRoot = parse(dir).root;
 	while (dir !== fsRoot) {
-		if (markers.some((marker) => existsSync(join(dir, marker)))) return dir;
+		if (markers.some((marker) => exists(join(dir, marker)))) return dir;
 		const parent = dirname(dir);
 		if (parent === dir) break; // defensive: dirname must be strictly ascending
 		dir = parent;
 	}
-	return markers.some((marker) => existsSync(join(fsRoot, marker))) ? fsRoot : undefined;
+	return undefined;
+}
+
+/**
+ * The nearest enclosing git repository root starting from (and including) a given directory,
+ * or undefined if none is found (e.g. /tmp scratch files, dotfiles outside any repo, or the
+ * walk reaching the filesystem root without a match). Callers choose their own fallback -- see
+ * lector-client.ts's workspaceForPath (falls back to the filesystem root: any absolute path is
+ * fair game for read/write/edit, exactly as Pi's built-in tools already allow) vs.
+ * workspaceForDirectory (falls back to the directory itself: widening a symbol-search scope all
+ * the way to the entire filesystem when a project isn't a git repo would be absurd).
+ *
+ * This -- not a Pi session's original cwd -- is Lector's real workspace granularity. A session
+ * routinely touches many unrelated repos, sibling projects, and scratch paths in one run; Pi's
+ * built-in read/write/edit tools have never restricted which absolute path can be touched, and
+ * Lector must not either. (Real, shipped bug this fixes: read/write/edit hard-locked to
+ * whatever directory the session happened to start in, refusing every legitimate path outside
+ * it with a "Lector-registered workspace root" error -- discovered live, in a separate session,
+ * working against a completely different, unrelated repository.)
+ *
+ * `exists` is injectable for tests -- see walkUpForMarkers.
+ */
+/**
+ * True for the bare filesystem root itself ("/" on Linux/macOS, "C:\\" on Windows) -- the one
+ * path a caller must never treat as a real project to auto-index. workspaceForPath's own
+ * intentional fallback for a raw read/write of a file outside any git repo can still produce
+ * this value; callers that trigger background work (auto-population, cache monitoring) off a
+ * newly-registered workspace must check this explicitly rather than assuming
+ * nearestGitRoot/nearestProjectRoot are the only paths that can hand them a workspace root.
+ */
+export function isFilesystemRoot(path: string): boolean {
+	return parse(path).root === path;
 }
 
-export function nearestGitRoot(startDirectory: string): string | undefined {
-	return walkUpForMarkers(startDirectory, [".git"]);
+export function nearestGitRoot(startDirectory: string, exists: (path: string) => boolean = existsSync): string | undefined {
+	return walkUpForMarkers(startDirectory, [".git"], exists);
 }
 
 /**
@@ -45,6 +66,6 @@ export function nearestGitRoot(startDirectory: string): string | undefined {
  * misattributes its whole project to the repo root, handing the language server the wrong
  * rootUri (and, for TypeScript, the wrong tsconfig.json) even though a closer one exists.
  */
-export function nearestProjectRoot(startDirectory: string, rootMarkers: readonly string[]): string | undefined {
-	return walkUpForMarkers(startDirectory, [...rootMarkers, ".git"]);
+export function nearestProjectRoot(startDirectory: string, rootMarkers: readonly string[], exists: (path: string) => boolean = existsSync): string | undefined {
+	return walkUpForMarkers(startDirectory, [...rootMarkers, ".git"], exists);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@danypops/pi-lector",
-	"version": "0.6.0",
+	"version": "0.7.0",
 	"description": "Pi host adapter for Lector: overrides read/write/edit with a daemon-backed, hash-guarded filesystem",
 	"license": "MIT",
 	"type": "module",
@@ -19,7 +19,7 @@
 	},
 	"dependencies": {
 		"@danypops/daemon-kit": "^0.22.1",
-		"@danypops/lector": "^0.7.0"
+		"@danypops/lector": "^0.8.0"
 	},
 	"devDependencies": {
 		"@earendil-works/pi-ai": "^0.81.1",