@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/node_modules/pi-lens/dist/clients/safe-spawn.js

@@ -21,6 +21,7 @@ import { recordDegradation } from "./degradation-ledger.js";
 import { logExtension } from "./extension-log.js";
 import { isFullyQualifiedWin32 } from "./path-utils.js";
 import { startSpawnUsageSampler } from "./resource-sampler.js";
+import { compareOrdinal } from "./string-utils.js";
 /** Intent-level spawn failure. `cause` retains the original OS Error/errno. */
 export class SpawnFailureError extends Error {
     kind;
@@ -701,7 +702,7 @@ export function resolveWindowsCommandForEnvironment(command, cwd, env) {
         .flatMap(([key, value]) => /^=[A-Za-z]:$/.test(key)
         ? [[key.toLowerCase(), value]]
         : [])
-        .sort(([left], [right]) => left.localeCompare(right));
+        .sort(([left], [right]) => compareOrdinal(left, right));
     // Keep presence separate from value: absent PATHEXT means the Windows
     // default extension list, while PATHEXT="" means no implicit extensions.
     // The per-drive snapshot is equally important: it is provenance for
@@ -792,6 +793,13 @@ function ensureUtf8ConsoleCodePageOnce() {
         spawnSync(cmdExe, ["/d", "/s", "/c", "chcp 65001 >nul 2>&1"], {
             shell: false,
             windowsHide: true,
+            // #1980 population sweep: a synchronous spawn with no timeout parks
+            // the event loop for as long as the child takes, and nothing here
+            // bounds that. `chcp` is normally instant, but this runs before the
+            // FIRST real spawn of the process, which is exactly when a cold or
+            // antivirus-throttled cmd.exe is slowest. Matches the 5s bound every
+            // other synchronous child-process site in this repo already carries.
+            timeout: 5000,
         });
     }
     catch {
@@ -891,6 +899,8 @@ export async function safeSpawnAsync(command, args, options) {
         let aborted = false;
         let killed = false;
         let outputTruncated = false;
+        let killedForOutputCap = false;
+        let streamingMatch = false;
         // #1651 review: a single boolean the close/error handlers both check
         // AND set, so whichever one decides the outcome first wins outright —
         // the DECISION itself is shape-based (see the `close` handler below),
@@ -937,21 +947,116 @@ export async function safeSpawnAsync(command, args, options) {
             options.maxOutputBytes > 0
             ? Math.floor(options.maxOutputBytes)
             : undefined;
-        const appendOutput = (current, chunk) => {
+        const outputTruncationMarker = "\n...[output truncated]...\n";
+        let retainedHead = [];
+        let retainedTail = [];
+        let retainedTailBytes = 0;
+        let retainedTailLimit = 0;
+        let truncationStream = "stderr";
+        const streamingMatcher = options?.matchWhileStreaming;
+        const streamingCarryBytes = streamingMatcher
+            ? Math.max(0, streamingMatcher.source.length - 1)
+            : 0;
+        const streamingCarry = {
+            stdout: "",
+            stderr: "",
+        };
+        const bytePrefix = (text, bytes) => Buffer.from(text).subarray(0, bytes).toString();
+        const byteSuffix = (text, bytes) => {
+            const buffer = Buffer.from(text);
+            return buffer.subarray(Math.max(0, buffer.byteLength - bytes)).toString();
+        };
+        const appendTail = (part, maxBytes) => {
+            if (maxBytes <= 0)
+                return;
+            retainedTail.push({ stream: part.stream, text: part.text });
+            retainedTailBytes += Buffer.byteLength(part.text);
+            while (retainedTailBytes > maxBytes && retainedTail.length > 0) {
+                const first = retainedTail[0];
+                const excess = retainedTailBytes - maxBytes;
+                const firstBytes = Buffer.byteLength(first.text);
+                if (firstBytes <= excess) {
+                    retainedTail.shift();
+                    retainedTailBytes -= firstBytes;
+                }
+                else {
+                    first.text = byteSuffix(first.text, firstBytes - excess);
+                    retainedTailBytes -= excess;
+                }
+            }
+        };
+        const renderOutput = (stream) => {
+            const head = retainedHead
+                .filter((part) => part.stream === stream)
+                .map((part) => part.text)
+                .join("");
+            const tail = retainedTail
+                .filter((part) => part.stream === stream)
+                .map((part) => part.text)
+                .join("");
+            const marker = stream === truncationStream ? outputTruncationMarker : "";
+            return head + marker + tail;
+        };
+        const refreshRetainedOutputs = () => {
+            stdout = renderOutput("stdout");
+            stderr = renderOutput("stderr");
+        };
+        const appendOutput = (stream, current, chunk) => {
             const text = typeof chunk === "string" ? chunk : chunk.toString();
-            if (maxOutputBytes === undefined)
-                return current + text;
-            const used = Buffer.byteLength(stdout) + Buffer.byteLength(stderr);
-            const remaining = maxOutputBytes - used;
-            if (remaining <= 0) {
-                outputTruncated = true;
-                return current;
+            if (maxOutputBytes === undefined || outputTruncated) {
+                if (maxOutputBytes === undefined)
+                    return current + text;
+                appendTail({ stream, text }, retainedTailLimit);
+                truncationStream = stream;
+                return renderOutput(stream);
             }
+            const used = Buffer.byteLength(stdout) + Buffer.byteLength(stderr);
             const bytes = Buffer.byteLength(text);
-            if (bytes <= remaining)
+            if (used + bytes <= maxOutputBytes)
                 return current + text;
             outputTruncated = true;
-            return current + Buffer.from(text).subarray(0, remaining).toString();
+            truncationStream = stream;
+            const available = Math.max(0, maxOutputBytes - Buffer.byteLength(outputTruncationMarker));
+            const headBytes = Math.floor(available / 2);
+            const tailBytes = available - headBytes;
+            retainedTailLimit = tailBytes;
+            const parts = [
+                { stream: "stdout", text: stdout },
+                { stream: "stderr", text: stderr },
+                { stream, text },
+            ];
+            let headRemaining = headBytes;
+            for (const part of parts) {
+                if (headRemaining <= 0)
+                    break;
+                const kept = bytePrefix(part.text, headRemaining);
+                if (kept)
+                    retainedHead.push({ stream: part.stream, text: kept });
+                headRemaining -= Buffer.byteLength(kept);
+            }
+            let tailRemaining = tailBytes;
+            for (let index = parts.length - 1; index >= 0 && tailRemaining > 0; index--) {
+                const part = parts[index];
+                const kept = byteSuffix(part.text, tailRemaining);
+                if (kept) {
+                    retainedTail.unshift({ stream: part.stream, text: kept });
+                    tailRemaining -= Buffer.byteLength(kept);
+                }
+            }
+            retainedTailBytes = tailBytes - tailRemaining;
+            return renderOutput(stream);
+        };
+        const matchStreamingChunk = (stream, chunk) => {
+            if (streamingMatch || !streamingMatcher)
+                return;
+            const text = typeof chunk === "string" ? chunk : chunk.toString();
+            streamingMatcher.lastIndex = 0;
+            streamingMatch = streamingMatcher.test(streamingCarry[stream] + text);
+            if (streamingCarryBytes > 0) {
+                streamingCarry[stream] = Buffer.from(streamingCarry[stream] + text)
+                    .subarray(-streamingCarryBytes)
+                    .toString();
+            }
         };
         // Spawn the process (non-blocking). Keeping Node's `shell` option false
         // is important on every path here: shell:true concatenates tainted
@@ -1091,6 +1196,12 @@ export async function safeSpawnAsync(command, args, options) {
             }));
             return;
         }
+        // Keep historical open stdin by default. An opted-in payload is written
+        // completely and followed by EOF; input: "" closes stdin immediately.
+        if (options?.input !== undefined) {
+            child.stdin?.on("error", () => { });
+            child.stdin?.end(options.input);
+        }
         if (child.pid && (posixProcessGroup || options?.lifetimeCoupled)) {
             // #2026: POSIX registers unconditionally - detached children no
             // longer receive terminal signals directly, so the lifetime
@@ -1201,11 +1312,17 @@ export async function safeSpawnAsync(command, args, options) {
         };
         abortSignal?.addEventListener("abort", onAbort, { once: true });
         // Output-cap kills are awaited by finalize() below, just like
-        // timeout/abort kills. This keeps a noisy CLI from continuing in the
-        // background after its retained output has been bounded.
+        // timeout/abort kills. An armed, unmatched streaming matcher is the one
+        // exception: retention remains bounded, but the caller's timeout is the
+        // bound while the child gets a chance to emit its rescue line.
         let killPromise;
         const stopForOutputLimit = () => {
-            if (outputTruncated && !killed && !child.killed) {
+            const waitingForStreamingMatch = streamingMatcher !== undefined && !streamingMatch;
+            if (outputTruncated &&
+                !waitingForStreamingMatch &&
+                !killed &&
+                !child.killed) {
+                killedForOutputCap = true;
                 killed = true;
                 killPromise = killTree();
             }
@@ -1214,12 +1331,18 @@ export async function safeSpawnAsync(command, args, options) {
         child.stdout?.setEncoding("utf-8");
         child.stderr?.setEncoding("utf-8");
         child.stdout?.on("data", (data) => {
-            stdout = appendOutput(stdout, data);
+            matchStreamingChunk("stdout", data);
+            stdout = appendOutput("stdout", stdout, data);
+            if (outputTruncated)
+                refreshRetainedOutputs();
             stopForOutputLimit();
             rearmIdleGrace?.();
         });
         child.stderr?.on("data", (data) => {
-            stderr = appendOutput(stderr, data);
+            matchStreamingChunk("stderr", data);
+            stderr = appendOutput("stderr", stderr, data);
+            if (outputTruncated)
+                refreshRetainedOutputs();
             stopForOutputLimit();
             rearmIdleGrace?.();
         });
@@ -1415,7 +1538,11 @@ export async function safeSpawnAsync(command, args, options) {
             resolved = true;
             await waitForPipeIdle();
             const resourceUsage = finishResourceUsage();
-            const outputInfo = outputTruncated ? { outputTruncated: true } : {};
+            const outputInfo = {
+                ...(outputTruncated ? { outputTruncated: true } : {}),
+                ...(killedForOutputCap ? { killedForOutputCap: true } : {}),
+            };
+            const streamingMatchInfo = streamingMatch ? { streamingMatch: true } : {};
             // #1816: surface the signal name as a field on every path where one
             // exists, so callers can NAME it instead of scraping `error.message`.
             const signalInfo = signal ? { signal } : {};
@@ -1440,6 +1567,7 @@ export async function safeSpawnAsync(command, args, options) {
                     ...(timeoutTeardown && { timeoutTeardown }),
                     spawnFailure: new SpawnFailureError("timeout", cause.message, cause),
                     ...outputInfo,
+                    ...streamingMatchInfo,
                     resourceUsage,
                 });
             }
@@ -1454,6 +1582,7 @@ export async function safeSpawnAsync(command, args, options) {
                     ...signalInfo,
                     spawnFailure: new SpawnFailureError("killed", cause.message, cause),
                     ...outputInfo,
+                    ...streamingMatchInfo,
                     resourceUsage,
                 });
             }
@@ -1468,6 +1597,7 @@ export async function safeSpawnAsync(command, args, options) {
                     ...signalInfo,
                     spawnFailure: new SpawnFailureError("killed", cause.message, cause),
                     ...outputInfo,
+                    ...streamingMatchInfo,
                     resourceUsage,
                 });
             }
@@ -1497,11 +1627,19 @@ export async function safeSpawnAsync(command, args, options) {
                     failure: "spawn",
                     spawnFailure,
                     ...outputInfo,
+                    ...streamingMatchInfo,
                     resourceUsage,
                 });
             }
             else {
-                resolve({ stdout, stderr, status: code, ...outputInfo, resourceUsage });
+                resolve({
+                    stdout,
+                    stderr,
+                    status: code,
+                    ...outputInfo,
+                    ...streamingMatchInfo,
+                    resourceUsage,
+                });
             }
         };
         child.on("exit", onChildSettle);
@@ -1545,6 +1683,8 @@ export async function safeSpawnAsync(command, args, options) {
                 failure,
                 spawnFailure,
                 ...(outputTruncated ? { outputTruncated: true } : {}),
+                ...(killedForOutputCap ? { killedForOutputCap: true } : {}),
+                ...(streamingMatch ? { streamingMatch: true } : {}),
                 resourceUsage,
             });
             if (controlFailure)

package/node_modules/pi-lens/dist/clients/security-scan-client.js

@@ -16,6 +16,9 @@ import * as path from "node:path";
 import { createSubsystemLogger } from "./extension-log.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
 import { classifyProbeFailure, createAvailabilityLatch, describeInstallAttempt, describeProbeEvidence, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
+import { createAvailabilityProbeFlight } from "./availability-probe-flight.js";
+import { createSingleFlight } from "./single-flight.js";
+const securityProbeFlights = createAvailabilityProbeFlight();
 export class SecurityScanClient {
     toolName;
     /**
@@ -79,7 +82,8 @@ export class SecurityScanClient {
     }
     /** Outcome of the most recent `probeVersion` call. */
     lastProbeOutcome = null;
-    ensureInFlight = null;
+    /** Availability resolution is instance-owned; only its external probe is shared. */
+    ensureFlight = createSingleFlight();
     inFlight = new Map();
     binaryPath = null;
     log;
@@ -99,15 +103,7 @@ export class SecurityScanClient {
     async ensureAvailable() {
         if (this.available !== null)
             return this.available;
-        if (this.ensureInFlight)
-            return this.ensureInFlight;
-        this.ensureInFlight = this.doEnsureAvailable();
-        try {
-            return await this.ensureInFlight;
-        }
-        finally {
-            this.ensureInFlight = null;
-        }
+        return this.ensureFlight.run("availability", () => this.doEnsureAvailable());
     }
     /**
      * Spawn `toolName <versionArgs>` and report whether it answered cleanly.
@@ -128,10 +124,26 @@ export class SecurityScanClient {
         const startedAt = Date.now();
         let probe;
         let hostStallMs;
+        let resolvedBinaryPath = null;
+        let probeJoined = false;
         try {
-            probe = await safeSpawnAsync(this.toolName, versionArgs, {
-                timeout: 5000,
+            const shared = securityProbeFlights.run(`security:${this.toolName}|${versionArgs.join("|")}`, async () => {
+                const { findManagedToolBinary } = await import("./installer/index.js");
+                const managed = await findManagedToolBinary(this.toolName);
+                return {
+                    probe: await safeSpawnAsync(managed ?? this.toolName, versionArgs, {
+                        timeout: 5000,
+                    }),
+                    binaryPath: managed ?? null,
+                };
             });
+            probeJoined = shared.joined;
+            const flightResult = await shared.promise;
+            probe = flightResult.probe;
+            resolvedBinaryPath = flightResult.binaryPath;
+            if (!probe.error && probe.status === 0 && flightResult.binaryPath) {
+                this.binaryPath = flightResult.binaryPath;
+            }
         }
         finally {
             hostStallMs = sampler.stop();
@@ -149,8 +161,14 @@ export class SecurityScanClient {
                 latched: true,
                 hostStallMs,
                 budgetMs: 5000,
-                classifiedBy: "probe",
-                evidence: describeProbeEvidence(probe),
+                classifiedBy: probeJoined ? "joined" : "probe",
+                evidence: {
+                    ...describeProbeEvidence(probe),
+                    ...(resolvedBinaryPath && {
+                        binary: path.basename(resolvedBinaryPath),
+                        source: "managed-dir",
+                    }),
+                },
             });
             return true;
         }
@@ -175,8 +193,14 @@ export class SecurityScanClient {
             hostStallMs,
             ...(retryAfterMs > 0 && { retryAfterMs }),
             budgetMs: 5000,
-            classifiedBy: "probe",
-            evidence,
+            classifiedBy: probeJoined ? "joined" : "probe",
+            evidence: {
+                ...evidence,
+                ...(resolvedBinaryPath && {
+                    binary: path.basename(resolvedBinaryPath),
+                    source: "managed-dir",
+                }),
+            },
         });
         return false;
     }
@@ -311,7 +335,14 @@ export class SecurityScanClient {
             this.log(`Scan already in flight for ${key}; sharing result`);
             return existing;
         }
-        const promise = run().finally(() => this.inFlight.delete(key));
+        // Identity-guarded release (#1968's pattern): delete only if THIS run is
+        // still the registered one. A bare delete-by-key lets a late-settling run
+        // evict a live successor a second writer registered under the same key
+        // mid-flight, after which the next caller starts a duplicate scan.
+        const promise = run().finally(() => {
+            if (this.inFlight.get(key) === promise)
+                this.inFlight.delete(key);
+        });
         this.inFlight.set(key, promise);
         return promise;
     }