@evandu/super-pi 0.1.94 → 0.1.96

package/dist/server/store.js

@@ -1556,18 +1556,18 @@ export class Store {
         const waiting = this.waitingMessages(conversation);
         const from = waiting.indexOf(message);
         const target = Math.max(0, Math.min(Math.trunc(toIndex), waiting.length - 1));
-        if (target === from)
-            return structuredClone(message);
         // NOTHING MAY OCCUPY THE `sending` MESSAGE'S SLOT, in either direction. It is already in Pi's stdin and
         // Pi's steering queue is FIFO, so it is delivered next whatever this method does - meaning a different
         // message landing in front of it would be a move the UI performed and the transport then ignored, and
         // moving the `sending` message itself off that spot would be a lie of the same kind.
-        const sendingIndex = waiting.findIndex((item) => item.delivery === "sending");
-        if (sendingIndex >= 0 && (from === sendingIndex || target <= sendingIndex)) {
+        const lastSendingIndex = waiting.reduce((last, item, index) => item.delivery === "sending" ? index : last, -1);
+        if (lastSendingIndex >= 0 && (message.delivery === "sending" || target <= lastSendingIndex)) {
             throw new Error(message.delivery === "sending"
                 ? "这条消息已经交给 Agent 了，挪不动（Pi 会先回答已经收到的那条）"
                 : "前面那条消息已经交给 Agent 了，插不过去（Pi 按收到的顺序送达）");
         }
+        if (target === from)
+            return structuredClone(message);
         // Permute THE WAITING SLOTS rather than splicing a message to an index. The waiting messages are
         // usually a suffix of the array, but they are not guaranteed to be one - an assistant message sits
         // between two of them once a steer has been delivered mid-turn - and an offset derived from "where in

package/dist/server/ws-server.js

@@ -222,10 +222,11 @@ export class WsServer {
                     this.broadcaster.configureStreaming(socket, parsed.coalesce);
                     return;
                 }
-                // A send represents a streaming operation. It must be admitted immediately so a second send
-                // can observe the active run and enter the durable follow-up queue; waiting for the first model
-                // turn here makes every follow-up test time out and defeats the queue semantics.
-                const runIndependently = parsed.type === "message.send" || parsed.type === "run.stop";
+                // A send or selected queued turn is a streaming operation. It must leave the socket's command
+                // chain immediately: waiting for the model turn would block later priority/cancel commands and
+                // make a second send miss the durable queue. The service owns per-conversation run claims.
+                const runIndependently = parsed.type === "message.send" || parsed.type === "message.sendQueued"
+                    || parsed.type === "message.interrupt" || parsed.type === "run.stop";
                 // ...WHICH MEANS A SEND CAN OVERTAKE A REVERT SENT JUST BEFORE IT, because the revert below is
                 // queued behind whatever this socket was already doing. The service only learns it is cutting
                 // when the command EXECUTES, so a send handled in between would find the conversation open and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evandu/super-pi",
-  "version": "0.1.94",
+  "version": "0.1.96",
   "description": "Web control plane and companion for Pi",
   "license": "MIT",
   "type": "module",
@@ -19,7 +19,8 @@
     "bin",
     "scripts/restart-server.mjs",
     "README.md",
-    "assets/knowledge-model"
+    "assets/knowledge-model",
+    "scripts/patch-brace-expansion.mjs"
   ],
   "engines": {
     "node": ">=22.19.0"
@@ -35,11 +36,13 @@
     "start": "node dist/server/index.js",
     "restart:server": "node scripts/restart-server.mjs",
     "smoke": "npm run build && node scripts/smoke.mjs",
-    "check": "node scripts/run-check.mjs"
+    "check": "node scripts/run-check.mjs",
+    "postinstall": "node scripts/patch-brace-expansion.mjs"
   },
   "check:logic": [
     "scripts/stream-checkpoint.test.mjs",
     "scripts/stream-transport.test.mjs",
+    "scripts/pi-session.test.mjs",
     "scripts/lan-access.test.mjs",
     "scripts/terminal-pty.test.mjs",
     "scripts/persistence-repository.test.mjs",
@@ -141,6 +144,7 @@
     "scripts/knowledge-base-browser.test.mjs"
   ],
   "dependencies": {
+    "@earendil-works/pi-coding-agent": "^0.86.1",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "node-pty": "^1.2.0-beta.15",

package/scripts/patch-brace-expansion.mjs

@@ -0,0 +1,179 @@
+// Repairs one vulnerable transitive dependency that Super Pi cannot fix from the outside.
+//
+// THE PROBLEM. Pi's package ships an `npm-shrinkwrap.json`, and a shrinkwrap pins a dependency's
+// whole subtree. Pi's shrinkwrap pins `brace-expansion@5.0.9`, and npm honours a shrinkwrap over
+// everything else - so neither `overrides` (in either the flat or the nested form) nor `npm audit fix`
+// can move it. `npm audit` therefore reports "1 high severity vulnerability" to every person who
+// installs Super Pi, and the finding is real: brace-expansion 5.0.9 is quadratic-time on `{a,b}` and
+// recurses without bound on nested brace groups, so a pattern that reaches it can burn the CPU or the
+// stack.
+//
+// THE REACHABILITY, so this is not a reflex. brace-expansion is reached through `minimatch`, and in
+// Pi's tree `minimatch` is used by the package manager - to match the paths of installed extensions
+// and skills. Those names come from files on disk, so a hostile workspace is enough to feed a pattern
+// in. It is a denial of service, not a privilege escalation, but it is reachable by opening a
+// repository, and a workspace is exactly what Super Pi is pointed at.
+//
+// THE FIX. `brace-expansion@5.0.12` is the patched release, and it has the same file layout as
+// 5.0.9 (both are `tshy` builds with the same `dist/commonjs` + `dist/esm` shape), so replacing the
+// installed copy is a file-level swap with no re-linking and no API change.
+//
+// WHY IT IS A POSTINSTALL AND NOT A DEPENDENCY. A dependency cannot express "a different version of
+// my dependency's dependency", because the shrinkwrap is the whole point of a shrinkwrap. The only
+// place left is the install itself.
+//
+// WHAT IT WILL NOT DO. It never fails an install. A patched copy that cannot be fetched leaves the
+// tree as it was, and the script says so in one line. An install that cannot finish because of a
+// security patch is a worse outcome than an install that finishes with a known advisory, so the script
+// only ever warns.
+import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync, cpSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFileSync } from "node:child_process";
+import { tmpdir } from "node:os";
+
+/** The patched release. 5.0.9 is what Pi's shrinkwrap pins; 5.0.12 carries the fix. */
+const PATCHED_VERSION = "5.0.12";
+/** The first fixed version. Below this, the advisory applies. */
+const VULNERABLE_BELOW = "5.0.12";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const repositoryRoot = resolve(here, "..");
+
+/** The lockfile-relative path of a directory, in the form a lockfile's keys take. */
+const lockKeyOf = (directory) => relative(repositoryRoot, directory).split(/[\\/]/).filter(Boolean).join("/");
+
+/** Where Pi's package keeps its own `brace-expansion`, if it keeps one. */
+function findVulnerableCopies() {
+  const found = [];
+  const candidates = [
+    join(repositoryRoot, "node_modules", "@earendil-works", "pi-coding-agent", "node_modules", "brace-expansion"),
+    join(repositoryRoot, "node_modules", "brace-expansion"),
+  ];
+  for (const directory of candidates) {
+    const manifest = join(directory, "package.json");
+    if (!existsSync(manifest)) continue;
+    let version = "";
+    try { version = JSON.parse(readFileSync(manifest, "utf8")).version ?? ""; } catch { continue; }
+    if (!version) continue;
+    if (compareVersions(version, VULNERABLE_BELOW) >= 0) continue;
+    found.push({ directory, version, lockKey: lockKeyOf(directory) });
+  }
+  return found;
+}
+
+/** Numeric version comparison that does not care about a leading `v` or a prerelease tag. */
+function compareVersions(a, b) {
+  const parts = (value) => String(value).replace(/^v/, "").split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const left = parts(a);
+  const right = parts(b);
+  for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
+    const difference = (left[index] ?? 0) - (right[index] ?? 0);
+    if (difference !== 0) return difference < 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * Replaces one installed copy with the patched release.
+ *
+ * The patched copy is fetched with `npm install` into a throwaway directory - npm's own
+ * fetch-and-verify path - rather than `npm pack` plus `tar`, which needs a `tar` on PATH whose flags
+ * differ between platforms. It is laid out exactly the way npm would have laid it out.
+ */
+function patch(directory) {
+  const scratch = join(tmpdir(), `super-pi-brace-${process.pid}-${Date.now()}`);
+  try {
+    mkdirSync(scratch, { recursive: true });
+    const stage = join(scratch, "stage");
+    mkdirSync(stage, { recursive: true });
+    writeFileSync(join(stage, "package.json"), JSON.stringify({ name: "super-pi-brace-stage", version: "0.0.0", private: true }));
+    execFileSync("npm", ["install", `brace-expansion@${PATCHED_VERSION}`, "--no-audit", "--no-fund", "--silent", "--omit=dev"], {
+      cwd: stage,
+      stdio: ["ignore", "ignore", "pipe"],
+      shell: process.platform === "win32",
+    });
+    const unpacked = join(stage, "node_modules", "brace-expansion");
+    if (!existsSync(join(unpacked, "package.json"))) throw new Error("the staged install produced no package");
+    // The old copy is moved aside rather than deleted first, so a failure mid-swap cannot leave the
+    // tree with half a package in it.
+    const previous = `${directory}.super-pi-backup`;
+    rmSync(previous, { recursive: true, force: true });
+    renameSync(directory, previous);
+    try {
+      cpSync(unpacked, directory, { recursive: true });
+    } catch (error) {
+      // The swap failed halfway: put the old copy back rather than leaving the tree broken.
+      rmSync(directory, { recursive: true, force: true });
+      renameSync(previous, directory);
+      throw error;
+    }
+    rmSync(previous, { recursive: true, force: true });
+    return true;
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
+/**
+ * The integrity hash npm recorded for the patched version, so the lockfile still describes a tree npm
+ * can verify. It comes from the registry metadata npm itself trusts.
+ */
+function readIntegrity() {
+  try {
+    const output = execFileSync("npm", ["view", `brace-expansion@${PATCHED_VERSION}`, "dist.integrity", "--silent"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: process.platform === "win32",
+      encoding: "utf8",
+    });
+    return output.trim() || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Rewrites the lockfile's entry for a patched package.
+ *
+ * WITHOUT THIS THE PATCH IS INVISIBLE. `npm audit` reads the LOCKFILE, not the files on disk - it
+ * compares the resolved versions against the advisory database. So a tree that is genuinely patched
+ * still reports "1 high severity vulnerability", and the person who installed Super Pi is left looking
+ * at a warning that no amount of reinstalling will clear.
+ */
+function updateLockfile(lockKey, version, integrity) {
+  const lockPath = join(repositoryRoot, "package-lock.json");
+  if (!existsSync(lockPath)) return false;
+  let lock;
+  try { lock = JSON.parse(readFileSync(lockPath, "utf8")); }
+  catch { return false; }
+  const entry = lock.packages?.[lockKey];
+  if (!entry || entry.version === version) return false;
+  entry.version = version;
+  if (integrity) entry.integrity = integrity;
+  if (entry.resolved) entry.resolved = entry.resolved.replace(/-\/[^/]*\.tgz$/, `-/brace-expansion-${version}.tgz`);
+  writeFileSync(lockPath, `${JSON.stringify(lock, null, 2)}\n`);
+  return true;
+}
+
+const copies = findVulnerableCopies();
+if (copies.length === 0) {
+  console.log("[super-pi] brace-expansion is not a vulnerable version here; nothing to patch.");
+} else {
+  let patched = 0;
+  for (const copy of copies) {
+    try {
+      if (!patch(copy.directory)) continue;
+      patched += 1;
+      console.log(`[super-pi] patched brace-expansion ${copy.version} -> ${PATCHED_VERSION} (${copy.directory})`);
+      // And the lockfile, so `npm audit` stops reporting a tree that is no longer vulnerable.
+      if (updateLockfile(copy.lockKey, PATCHED_VERSION, readIntegrity())) {
+        console.log("[super-pi] the lockfile now records the patched version, so `npm audit` stops reporting it.");
+      }
+    } catch (error) {
+      // NEVER fail the install over this. An install that cannot finish is worse than an install that
+      // finishes with a known advisory, and the advisory is reported by `npm audit` either way.
+      console.warn(`[super-pi] could not patch brace-expansion in ${copy.directory}: ${error instanceof Error ? error.message : String(error)}. Run \`npm audit fix\` or reinstall to try again.`);
+    }
+  }
+  if (patched === 0) console.warn("[super-pi] brace-expansion is still at a vulnerable version; `npm audit` will keep reporting it. This is Pi's own pinned dependency tree.");
+}