@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/node_modules/pi-lens/dist/clients/git-guard.js

@@ -207,7 +207,13 @@ function delimitedSubstitutionBody(command, start, opener, closer) {
     }
     return undefined;
 }
-function containsGuardedSubstitution(command, depth) {
+const COMMIT_PUSH_MATCHER = {
+    id: "commit-push",
+    matchesVerb: (verb) => verb === "commit" || verb === "push",
+    indirectAlwaysMatches: true,
+    suppressPostVerbHelp: false,
+};
+function containsGuardedSubstitution(command, depth, matcher) {
     if (depth > 3)
         return false;
     let quote;
@@ -249,8 +255,8 @@ function containsGuardedSubstitution(command, depth) {
                         : undefined;
         if (substitution && substitution.end >= 0) {
             const nested = canonicalizeGuardCommand(substitution.body);
-            if (containsGuardedSubstitution(nested, depth + 1) ||
-                tokenizeShellCommand(nested).some((segment) => containsCommitOrPush(segment.tokens, depth + 1))) {
+            if (containsGuardedSubstitution(nested, depth + 1, matcher) ||
+                tokenizeShellCommand(nested).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher))) {
                 return true;
             }
             i = substitution.end;
@@ -258,7 +264,169 @@ function containsGuardedSubstitution(command, depth) {
     }
     return false;
 }
-function containsCommitOrPush(tokens, depth) {
+/** Git global options that consume the following token as their value. */
+const GIT_GLOBAL_OPTIONS_WITH_VALUE = new Set([
+    "-C",
+    "-c",
+    "--config-env",
+    "--git-dir",
+    "--work-tree",
+    "--exec-path",
+    "--namespace",
+]);
+const GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE = [
+    "--config-env",
+    "--git-dir",
+    "--work-tree",
+    "--exec-path",
+    "--namespace",
+];
+/**
+ * Index of git's subcommand token in `gitTokens` (which starts at the `git`
+ * executable), after skipping global options and their values. Returns
+ * `undefined` when the invocation has no subcommand at all — `git --help`,
+ * `git --version`, or a trailing option with no verb behind it.
+ *
+ * Shared by the direct and indirect paths so both ask the same question about
+ * the same position (#2007).
+ */
+function gitVerbIndex(gitTokens) {
+    let i = 1;
+    while (i < gitTokens.length && gitTokens[i].startsWith("-")) {
+        const option = gitTokens[i];
+        if (["--help", "-h", "--version", "-v", "-V"].includes(option)) {
+            return undefined;
+        }
+        if (option === "--")
+            return i + 1 < gitTokens.length ? i + 1 : undefined;
+        if (["-C", "-c"].some((prefix) => option.startsWith(prefix) && option.length > prefix.length)) {
+            i += 1;
+            continue;
+        }
+        if (GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE.some((prefix) => option.startsWith(`${prefix}=`))) {
+            i += 1;
+            continue;
+        }
+        i += GIT_GLOBAL_OPTIONS_WITH_VALUE.has(option) ? 2 : 1;
+    }
+    return i < gitTokens.length ? i : undefined;
+}
+/**
+ * True when the subcommand in git's command position is one the matcher
+ * governs. `gitTokens[0]` is the `git` executable token.
+ */
+export function matchGitVerbAtCommandPosition(gitTokens, matcher) {
+    const index = gitVerbIndex(gitTokens);
+    if (index === undefined)
+        return false;
+    const argsAfterVerb = gitTokens.slice(index + 1);
+    // `git checkout --help` prints documentation and touches nothing, and the
+    // global-option walk above cannot see it, because it sits AFTER the verb.
+    //
+    // Only the FIRST argument counts, and only for matchers that opt in. `-h`
+    // deeper in the argv may be an option VALUE rather than a help request —
+    // `git commit -m -h` commits with the message `-h`, `git clean -e -h`
+    // excludes a pattern named `-h`. Reading any position would need a
+    // per-verb table of value-taking options for every governed verb, which is
+    // exactly the hand-maintained parallel list this repo forbids, and every
+    // gap in it would silently UNDER-block. Leading-position-only needs no
+    // table, covers how help is actually invoked, and every other spelling
+    // falls through to a match, which is the safe direction for a guard.
+    if (matcher.suppressPostVerbHelp &&
+        (argsAfterVerb[0] === "--help" || argsAfterVerb[0] === "-h")) {
+        return false;
+    }
+    const verbs = expandGuardVerbToken(gitTokens[index] ?? "");
+    return verbs.length === 1 && matcher.matchesVerb(verbs[0], argsAfterVerb);
+}
+/** Strip one layer of shell quoting the lexer preserved on a value token. */
+function unquoteGuardValue(value) {
+    const trimmed = value.trim();
+    if (trimmed.length >= 2) {
+        const first = trimmed[0];
+        const last = trimmed[trimmed.length - 1];
+        if ((first === '"' || first === "'") && first === last) {
+            return trimmed.slice(1, -1);
+        }
+    }
+    return trimmed;
+}
+/**
+ * The directory a git invocation actually targets (#2007).
+ *
+ * `git -C <dir>` and `--work-tree` retarget the command at a DIFFERENT
+ * directory, so a guard that evaluates the caller's cwd would inspect the
+ * wrong working tree and allow a destructive command against a shared one.
+ * `-C` composes cumulatively, exactly as git applies it; `--work-tree` names
+ * the working tree directly and therefore wins.
+ *
+ * Returns the resolved absolute directory, or `cwd` when the invocation
+ * carries no retargeting option.
+ */
+export function resolveGitTargetDirectory(gitTokens, cwd) {
+    let base = cwd;
+    let workTree;
+    let i = 1;
+    while (i < gitTokens.length && gitTokens[i].startsWith("-")) {
+        const option = gitTokens[i];
+        if (["--help", "-h", "--version", "-v", "-V"].includes(option))
+            break;
+        if (option === "--")
+            break;
+        if (option === "-C" && i + 1 < gitTokens.length) {
+            base = path.resolve(base, unquoteGuardValue(gitTokens[i + 1]));
+            i += 2;
+            continue;
+        }
+        if (option.startsWith("-C") && option.length > 2) {
+            base = path.resolve(base, unquoteGuardValue(option.slice(2)));
+            i += 1;
+            continue;
+        }
+        if (option === "--work-tree" && i + 1 < gitTokens.length) {
+            workTree = unquoteGuardValue(gitTokens[i + 1]);
+            i += 2;
+            continue;
+        }
+        if (option.startsWith("--work-tree=")) {
+            workTree = unquoteGuardValue(option.slice("--work-tree=".length));
+            i += 1;
+            continue;
+        }
+        if (option.startsWith("-c") &&
+            option.length > 2 &&
+            !option.startsWith("--")) {
+            i += 1;
+            continue;
+        }
+        if (GIT_GLOBAL_OPTIONS_WITH_INLINE_VALUE.some((prefix) => option.startsWith(`${prefix}=`))) {
+            i += 1;
+            continue;
+        }
+        i += GIT_GLOBAL_OPTIONS_WITH_VALUE.has(option) ? 2 : 1;
+    }
+    return workTree === undefined ? base : path.resolve(base, workTree);
+}
+/**
+ * Every git invocation the command contains, as token arrays starting at the
+ * `git` executable. Used by callers that must know WHICH directory a matched
+ * command targets, not merely that it matched (#2007).
+ */
+export function collectGitInvocations(toolName, input) {
+    if (toolName !== "bash")
+        return [];
+    const command = getShellCommand(input);
+    if (!command)
+        return [];
+    const invocations = [];
+    for (const segment of tokenizeShellCommand(canonicalizeGuardCommand(command))) {
+        const gitIndex = segment.tokens.findIndex((token) => isGitExecutable(token));
+        if (gitIndex >= 0)
+            invocations.push(segment.tokens.slice(gitIndex));
+    }
+    return invocations;
+}
+function containsGuardedGitVerb(tokens, depth, matcher) {
     if (depth > 3 || tokens.length === 0)
         return false;
     let commandTokens = tokens;
@@ -276,7 +444,7 @@ function containsCommitOrPush(tokens, depth) {
         const runIndex = lower.findIndex((token) => token === "--run");
         if (runIndex >= 0 && runIndex + 1 < commandTokens.length) {
             const nestedCommand = commandTokens.slice(runIndex + 2).join(" ");
-            return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsCommitOrPush(segment.tokens, depth + 1));
+            return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
         }
     }
     // These commands consume their following words as text/patterns; a bare
@@ -290,43 +458,14 @@ function containsCommitOrPush(tokens, depth) {
     if (gitIndex >= 0) {
         // Any non-leading git invocation is indirect. Do not maintain a wrapper
         // or flag allowlist: unknown launchers are the security boundary here.
-        if (gitIndex > 0)
+        if (gitIndex > 0 && matcher.indirectAlwaysMatches)
             return true;
-        const gitTokens = commandTokens.slice(gitIndex);
-        let i = 1;
-        const takesValue = new Set([
-            "-C",
-            "-c",
-            "--config-env",
-            "--git-dir",
-            "--work-tree",
-            "--exec-path",
-            "--namespace",
-        ]);
-        while (i < gitTokens.length && gitTokens[i].startsWith("-")) {
-            const option = gitTokens[i];
-            if (["--help", "-h", "--version", "-v", "-V"].includes(option))
-                return false;
-            if (option === "--")
-                return gitTokens[i + 1] === "commit" || gitTokens[i + 1] === "push";
-            if (["-C", "-c"].some((prefix) => option.startsWith(prefix) && option.length > prefix.length)) {
-                i += 1;
-                continue;
-            }
-            if ([
-                "--config-env",
-                "--git-dir",
-                "--work-tree",
-                "--exec-path",
-                "--namespace",
-            ].some((prefix) => option.startsWith(`${prefix}=`))) {
-                i += 1;
-                continue;
-            }
-            i += takesValue.has(option) ? 2 : 1;
-        }
-        const verbs = expandGuardVerbToken(gitTokens[i] ?? "");
-        return verbs.length === 1 && (verbs[0] === "commit" || verbs[0] === "push");
+        // #2007: a guard that protects the agent from its own accident must not
+        // decline `xargs git status`, so the indirect path stays armed only when
+        // a governed verb sits in git's real COMMAND POSITION. Scanning every
+        // token instead would fire on `find . -name checkout | xargs git add`,
+        // where `checkout` is a positional value and not a subcommand at all.
+        return matchGitVerbAtCommandPosition(commandTokens.slice(gitIndex), matcher);
     }
     const leadingExecutable = commandTokens[0] ?? "";
     const knownCommandStringWrapper = isShellWrapper(leadingExecutable) ||
@@ -344,7 +483,7 @@ function containsCommitOrPush(tokens, depth) {
         if (commandIndex >= commandTokens.length)
             return false;
         const nestedCommand = commandTokens.slice(commandIndex).join(" ");
-        return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsCommitOrPush(segment.tokens, depth + 1));
+        return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
     }
     const lower = commandTokens.slice(1).map((token) => token.toLowerCase());
     const switchIndex = lower.findIndex((token) => token === "-c" ||
@@ -369,19 +508,30 @@ function containsCommitOrPush(tokens, depth) {
     if (commandTokens[commandIndex] === "--")
         commandIndex += 1;
     const nestedCommand = commandTokens.slice(commandIndex).join(" ");
-    return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsCommitOrPush(segment.tokens, depth + 1));
+    return tokenizeShellCommand(canonicalizeGuardCommand(nestedCommand)).some((segment) => containsGuardedGitVerb(segment.tokens, depth + 1, matcher));
 }
-/** Analyze actual executable invocations, not substrings in shell text. */
-export function isGitCommitOrPushAttempt(toolName, input) {
+/**
+ * Analyze actual executable invocations, not substrings in shell text.
+ *
+ * Shared entry point for every guard that needs "is this bash input really a
+ * git invocation of a verb I govern" (#2007). The verb question is the only
+ * parameter; wrapper, substitution, and text-consumer analysis are identical
+ * for all callers by construction.
+ */
+export function detectGuardedGitVerb(toolName, input, matcher) {
     if (toolName !== "bash")
         return false;
     const command = getShellCommand(input);
     if (!command)
         return false;
     const canonical = canonicalizeGuardCommand(command);
-    if (containsGuardedSubstitution(canonical, 0))
+    if (containsGuardedSubstitution(canonical, 0, matcher))
         return true;
-    return tokenizeShellCommand(canonical).some((segment) => containsCommitOrPush(segment.tokens, 0));
+    return tokenizeShellCommand(canonical).some((segment) => containsGuardedGitVerb(segment.tokens, 0, matcher));
+}
+/** The #1063 commit gate's own question. */
+export function isGitCommitOrPushAttempt(toolName, input) {
+    return detectGuardedGitVerb(toolName, input, COMMIT_PUSH_MATCHER);
 }
 function isTurnEndFindingsCache(value) {
     if (!value || typeof value !== "object")

package/node_modules/pi-lens/dist/clients/git-tracked-ignore.js

@@ -33,8 +33,25 @@
  */
 import * as path from "node:path";
 import { isExcludedDirName } from "./file-utils.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
 import { normalizeEphemeralMapKey, normalizeMapKey } from "./path-utils.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { truncatedByOutputCap } from "./spawn-output-cap.js";
+function recordTruncatedLsFiles(parseSite) {
+    recordDegradationOnce({
+        kind: "git-tracked-ignore-truncated",
+        subject: `git-ls-files:${parseSite}`,
+        reason: "safeSpawnAsync capped git ls-files stdout",
+    });
+}
+// The binding listing is the untracked-ignored one: a mid-size project's
+// node_modules alone yields a ~66k-line ignored list (roughly 4-6 MiB), and
+// a monorepo with several dependency trees can multiply that. 16 MiB leaves
+// that headroom while stopping safeSpawnAsync from retaining unbounded
+// stdout (an uncapped probe held 20 MiB in full). The tracked listing is
+// far smaller (~133 KiB in this repository). A capped read fails closed to
+// unavailable with one bounded ledger record per site.
+const MAX_LS_FILES_OUTPUT_BYTES = 16 * 1024 * 1024;
 /**
  * Parses `git ls-files --others --ignored --exclude-standard` output
  * (repo-relative paths, one per line) into normalized map-key file ids.
@@ -62,7 +79,16 @@ export function parseUntrackedIgnoredOutput(stdout, cwd) {
 }
 async function fetchUntrackedIgnoredIds(cwd) {
     try {
-        const result = await safeSpawnAsync("git", ["ls-files", "--others", "--ignored", "--exclude-standard"], { cwd, timeout: 10_000, resourceLabel: "git-tracked-ignore" });
+        const result = await safeSpawnAsync("git", ["ls-files", "--others", "--ignored", "--exclude-standard"], {
+            cwd,
+            timeout: 10_000,
+            maxOutputBytes: MAX_LS_FILES_OUTPUT_BYTES,
+            resourceLabel: "git-tracked-ignore",
+        });
+        if (truncatedByOutputCap(result)) {
+            recordTruncatedLsFiles("untracked-ignored");
+            return undefined;
+        }
         if (result.error || result.status !== 0)
             return undefined;
         return parseUntrackedIgnoredOutput(result.stdout, cwd);
@@ -141,8 +167,13 @@ async function fetchTrackedFiles(cwd) {
         const result = await safeSpawnAsync("git", ["ls-files"], {
             cwd,
             timeout: 10_000,
+            maxOutputBytes: MAX_LS_FILES_OUTPUT_BYTES,
             resourceLabel: "git-tracked-ignore",
         });
+        if (truncatedByOutputCap(result)) {
+            recordTruncatedLsFiles("tracked");
+            return undefined;
+        }
         if (result.error || result.status !== 0)
             return undefined;
         return parseTrackedFilesOutput(result.stdout, cwd);

package/node_modules/pi-lens/dist/clients/govulncheck-client.js

@@ -110,6 +110,7 @@ export class GovulncheckClient extends SecurityScanClient {
                     hostStallMs: goHostStallMs,
                     ...(retryAfterMs > 0 && { retryAfterMs }),
                     budgetMs: 5000,
+                    classifiedBy: "probe",
                 });
                 return false;
             }
@@ -188,8 +189,10 @@ export class GovulncheckClient extends SecurityScanClient {
                     // row says so and carries the install facts behind it. Every retry
                     // DID run a `go install` that failed, so `install: "failed"` is
                     // earned, and the reason names the ceiling rather than the spawn.
+                    // Below the ceiling, outcome/cause are fresh off `classifyProbeFailure`
+                    // above, so that row is still `"probe"` (#2209).
+                    classifiedBy: exhausted ? "caller" : "probe",
                     ...(exhausted && {
-                        classifiedBy: "caller",
                         evidence: {
                             ...describeProbeEvidence(install, "go install"),
                             install: "failed",
@@ -313,6 +316,7 @@ export class GovulncheckClient extends SecurityScanClient {
                 hostStallMs: reprobeHostStallMs,
                 ...(retryAfterMs > 0 && { retryAfterMs }),
                 budgetMs: 5000,
+                classifiedBy: "probe",
             });
             return false;
         }

package/node_modules/pi-lens/dist/clients/gzip-stage-write.js

@@ -39,6 +39,10 @@ import { stagePathFor } from "./atomic-write-staging.js";
  * to a main-thread rewrite on an error result).
  */
 export async function writeGzipStageFile(data, stagePath, testDelayMs, options) {
+    // Worker-path duration starts inside this stage, so it includes the worker's
+    // test delay, serialization, gzip, and rename, but excludes postMessage queue
+    // latency. Main-thread callers measure from their inclusive persist entry.
+    const startedAt = performance.now();
     const tmpPath = stagePathFor(stagePath);
     try {
         if (testDelayMs) {
@@ -56,6 +60,7 @@ export async function writeGzipStageFile(data, stagePath, testDelayMs, options)
                 gzBytes: 0,
                 serializeMs,
                 writeMs: 0,
+                durationMs: performance.now() - startedAt,
                 semanticFingerprint,
                 skippedUnchanged: true,
             };
@@ -77,6 +82,7 @@ export async function writeGzipStageFile(data, stagePath, testDelayMs, options)
             gzBytes,
             serializeMs,
             writeMs,
+            durationMs: performance.now() - startedAt,
             semanticFingerprint,
         };
     }
@@ -116,6 +122,7 @@ export function serveGzipStageWorker(buildBaseResult, options) {
                 result.gzBytes = metrics.gzBytes;
                 result.serializeMs = metrics.serializeMs;
                 result.writeMs = metrics.writeMs;
+                result.durationMs = metrics.durationMs;
                 result.semanticFingerprint = metrics.semanticFingerprint;
                 result.skippedUnchanged = metrics.skippedUnchanged;
             }